Browse by category.
Every skill is a single Markdown file you can paste into Microsoft 365 Copilot, Copilot Studio or Claude. Read-only by default, Australian-compliant, CC BY 4.0.
TL;DR: The library has three collections: Cowork for agentic AI and Copilot workflows, SharePoint for architecture and oversharing, and Purview for security and compliance. Each skill is read-only unless it says otherwise and cites a source.
Which collection do I need?
| Your goal | Collection |
|---|---|
| Govern Microsoft 365 Copilot, Copilot Studio agents and Entra agent identities | Cowork |
| Fix oversharing and permissions before Copilot rollout | SharePoint |
| Data protection, Entra, Defender, Sentinel, Exchange and Australian frameworks | Purview |
New to this? Start with what is an AI skill, the Copilot readiness guide and the Copilot governance guide.
What Is an AI Skill?
Agent skills, Copilot skills and this library's read-only audit skills are three different things. Learn the difference and where to start.
Governing AI Agents in Microsoft 365
Govern AI agents in Microsoft 365: Entra Agent ID, Agent 365 registry, Copilot Studio DLP, shadow agents, Work IQ and computer use, with read-only skills.
Copilot Readiness Assessment
Scores a Microsoft 365 tenant for Copilot readiness across licensing, sensitivity labelling, oversharing, Conditional Access and audit retention.
Entra Agent ID Audit
Inventories every Microsoft Entra Agent ID, flags agents with no accountable sponsor, and reports Conditional Access coverage per agent.
Conditional Access for Agents
Turn an AI agent's risk profile and data tier into a Microsoft Entra Conditional Access policy specification for admin review, aligned to Essential Eight.
Copilot Studio DLP Gap Check
Check Copilot Studio agents against the tenant DLP policy to flag missing, weak or bypassed Data Loss Prevention, aligned to Essential Eight.
Copilot Studio Agent Inventory and Connector Audit
Inventory every Microsoft Copilot Studio agent with its connectors, knowledge sources, sharing scope and DLP coverage, then flag ungoverned agents.
Copilot Control System Governance Validator
Validates Microsoft 365 Copilot Control System: data security policies, agent publishing approvals, and sensitivity-label enforcement for Copilot.
Secure Meeting Minutes
Draft formal minutes from notes or a Teams transcript in Microsoft 365 Copilot, with the meeting's sensitivity label, routing actions to named owners.
Stakeholder Update Email
Converts project notes into a concise 200-300 word stakeholder email with a consistent four-section RAG structure, drafted in Microsoft 365 Copilot.
Policy Document Template
Generate a consistently structured policy or procedure document with required governance sections in Microsoft 365 Copilot, ready for review and approval.
Onboarding Checklist
Work a new-starter onboarding checklist in Microsoft 365 Copilot: draft artefacts and raise access requests without auto-approving, for leader review.
Copilot Wave 3 Autonomous Agent Governance
Assess Microsoft 365 Copilot Wave 3 autonomous agent governance: approval-workflow coverage, data-scope limits, audit-log setup and human overrides.
Entra Agent Identity Sponsorship Lifecycle
Audit Microsoft Entra agent identity sponsorship: confirm every agent has an active human sponsor and flag agents without one for decommissioning review.
Agent Audit Trail and Forensics Investigation
Reconstruct what a Copilot or Copilot Studio agent did from the Purview unified audit log: actions, data accessed and who authorised each one.
Agent 365 Tools and MCP Server Governance Baseline
Audit the Agent 365 tools catalogue: available and blocked MCP servers, pending BYO MCP requests and per-agent tools in Defender, for a governed baseline.
Agent 365 Registry and Shadow AI Discovery
Compare registered and unmanaged AI agents using the Agent 365 registry, Shadow AI page and Defender for Endpoint local agent discovery. Read-only.
Work IQ API Access and Tool Call Governance Audit
Audit which agents hold Work IQ API grants to Microsoft 365 calendar, email, org chart and files, and check tool calls stay in the tenant trust boundary.
Computer-Using Agent Risk Assessment
Inventory Computer-Using Agents in Copilot Studio, the apps they can drive, human approval gates and audit log coverage for CUA actions.
Copilot Notebooks Data Governance Review
Review shared Copilot Notebooks: grounding sources, sensitivity label inheritance on outputs, guest and external access, and Australian data residency.
Microsoft 365 Copilot Readiness Guide for SharePoint and Data
An ordered path to Microsoft 365 Copilot readiness: find oversharing, fix permissions, restrict discovery, label data, then monitor.
SharePoint Oversharing Audit
Site-level audit of SharePoint Online sharing links by type, flagging Anyone links and unapproved external recipients in a risk-ranked action table.
Everyone Except External Users (EEEU) Sweep
Item-level sweep for SharePoint content granted to Everyone or Everyone Except External Users, scored by reach and label sensitivity, then risk-ranked.
External Sharing Deep Audit
Point-in-time inventory of every externally shared item across SharePoint, OneDrive and Teams, grouped by recipient domain and ranked by recipient risk.
Sharing Links Activity Audit
Analyse sharing-link creation and access activity over time across SharePoint and OneDrive to surface risk trends and stale links of every type.
Broken Permission Inheritance Audit
List every SharePoint library, folder and item with broken permission inheritance and rank each by access scope and sensitivity, for Essential Eight.
Site Permissions Baseline
Snapshot each SharePoint site's broad-access principals, primary admin and unique-permission counts as a least-privilege baseline; object detail is left to the audit.
Data Access Governance Report Review
Interpret SharePoint Advanced Management Data Access Governance reports and turn oversharing and sharing-link findings into a prioritised remediation plan.
Restricted SharePoint Search Readiness
Rank SharePoint sites by oversharing risk and pick Restricted Content Discovery candidates as Restricted SharePoint Search retires, before Copilot access.
Restricted Content Discovery Review
Review where Restricted Content Discovery is applied in SharePoint, what it does and does not change, and what to check before and after rollout.
Site Lifecycle Review
Identify inactive, ownerless, and stale SharePoint Online sites and recommend a keep, archive, or decommission action for each governance cycle.
Teams and Groups Sprawl Audit
Audit Microsoft 365 Groups and Teams sprawl: ownerless groups, public teams, guest access and inactivity that widen the Copilot oversharing surface.
Teams Meeting Recording Policy Audit
Audit Teams meeting policies for recording permissions, transcription, label inheritance and compliance recording to limit meeting data exposure.
Teams External Access and Guest Audit
Audit Microsoft Teams external access, federation, and guest sharing settings that widen the collaboration and Copilot surface.
SharePoint Advanced Management Governance Audit
Audit SharePoint Advanced Management: data access governance reports, restricted access control, site ownership policies and AI readiness signals.
SharePoint AI Skills Governance Audit
Inventory AI Skill files in SharePoint, audit authoring permissions on the Agent Assets library and check sensitivity labels on skill Markdown files.
SharePoint Agent Publishing and Data Source Audit
Find Copilot Studio agents published to SharePoint sites and audit publisher, knowledge sources, licensing, owner approval and sensitivity inheritance.
Copilot in SharePoint Availability and Site AI Settings Review
Review where Copilot in SharePoint is available, how each site's Site AI settings are set, and what to migrate before PowerShell controls lapse.
Governing Microsoft 365 Copilot with Microsoft Purview
How Microsoft Purview governs Microsoft 365 Copilot: what Learn documents, where the gaps are, and which read-only skills check each control.
Australian Compliance for Microsoft 365 Copilot and AI
How Essential Eight, ISM, PSPF, IRAP and APRA CPS 234 relate to Microsoft 365 Copilot, and which skills in this library produce evidence.
Purview Label Coverage
Scans SharePoint libraries for the proportion of documents carrying a Purview sensitivity label and flags libraries with unlabelled sensitive content.
DSPM for AI Remediation
Turn Microsoft Purview DSPM for AI oversharing findings into an owner-assigned remediation plan mapped to labels, DLP and SharePoint sharing clean-up.
Shadow AI App Discovery
Ranks unsanctioned generative AI apps from Defender for Cloud Apps and Purview DSPM for AI signals by users, data exposure, and risk score.
Teams Meeting Label Inheritance Check
Verifies Teams recordings, transcripts, and Loop notes inherited the meeting's Purview sensitivity label, flagging unlabelled artefacts and downgrades.
Tenant DLP Coverage and Effectiveness Audit
Audit Microsoft Purview DLP coverage across Exchange, SharePoint, OneDrive, Teams and endpoints to surface gaps, overlaps and simulation results.
Copilot DLP Impact and Simulation
Simulate Microsoft Purview DLP for Microsoft 365 Copilot: preview which prompts, files and labels would be blocked and measure coverage.
Data Classification and SIT Coverage
Assess Microsoft Purview sensitive information type and trainable-classifier match coverage across your data estate for DLP and compliance.
Retention and Records Management Audit
Audit Microsoft Purview retention labels, policies, records management coverage, disposition reviews, and Microsoft 365 Copilot content retention.
Communication Compliance Coverage
Assess Microsoft Purview Communication Compliance policy coverage, AI-interaction monitoring, match rates and escalation health in Microsoft 365.
Insider Risk Management Coverage Review
Audit Microsoft Purview Insider Risk Management policy and indicator coverage to surface gaps and tuning opportunities, read-only.
eDiscovery and Legal Hold Readiness
Audit Microsoft Purview eDiscovery legal holds, collection integrity and search or export readiness for litigation and regulatory response.
Audit Log Retention and Coverage Validator
Verify the Microsoft Purview Unified Audit Log is enabled, retention meets ISM event logging needs, and Microsoft 365 Copilot interactions are captured.
Copilot Interaction Compliance Audit
Analyse Microsoft 365 Copilot audit and DSPM for AI signals to surface sensitive-data exposure and compliance risk in user interactions.
Conditional Access Coverage Gap Analysis
Find users, apps, and sign-ins outside Conditional Access coverage, surfacing MFA, compliant-device, and legacy-auth gaps for Essential Eight assurance.
PIM Privileged Role and Activation Audit
Audit Entra Privileged Identity Management for standing versus eligible roles, activation anomalies and approval gaps against Essential Eight.
Access Reviews Health Audit
Audit Microsoft Entra access reviews for coverage, currency and completion, flagging stale reviews and unactioned recommendations for least privilege.
Entitlement Management Access Package Audit
Audit Microsoft Entra entitlement management access packages: policies, separation of duties, approvals and expirations for identity governance.
Lifecycle Workflows Joiner Mover Leaver Coverage
Audit Microsoft Entra lifecycle workflows for joiner, mover and leaver automation coverage and manual identity gaps.
Stale and Guest Account Audit
Read-only audit that finds inactive, disabled, and orphaned Microsoft Entra guest accounts to reduce identity attack surface and support access reviews.
App Registration and Secret Hygiene
Audit Microsoft Entra app registrations for expiring secrets, certificates, missing owners and over-permissioned API access.
Enterprise App and OAuth Consent Risk Audit
Audit admin-consented enterprise apps and risky OAuth grants in Microsoft Entra to surface illicit consent and over-privileged service principals.
Workload Identity Risk Audit
Audit service principals and managed identities for risk, credentials and anomalous sign-ins using Microsoft Entra ID Protection.
Risky Users and Sign-Ins Summary
Summarise Microsoft Entra ID Protection risk detections: leaked credentials, impossible travel and password spray, with remediation paths.
MFA and Strong Authentication Coverage Audit
Audit Microsoft Entra to find users without MFA, weak SMS or voice methods, and FIDO2 or passkey adoption to lift authentication assurance.
Starter Leaver Access Review
Maps a user's SharePoint, Teams, group, mailbox, and app access and recommends an onboarding baseline or an audit-safe revocation order.
Inactive Licence Recovery
Reports Microsoft 365 users dormant past a sign-in threshold, separates disabled from dormant accounts, and quantifies recoverable AUD spend.
E8 Evidence Packager
Compiles SharePoint permission reports, sharing summaries and Conditional Access policies into a versioned, indexed evidence folder to support an Essential Eight assessment.
Essential Eight Maturity Self-Assessment
Self-assess your Microsoft 365 tenant against all eight ACSC Essential Eight strategies and produce a maturity scorecard with evidence pointers.
Essential Eight ML3 Uplift Planner
Assess current Essential Eight maturity across all eight controls and produce a prioritised, read-only plan to uplift from Maturity Level 2 to Level 3.
Zero Trust Maturity Baseline
Scores a Microsoft 365 tenant against the AT.8xxx Zero Trust control family across five pillars, with control-level evidence pointers and uplift steps.
Microsoft Secure Score Improvement Plan
Benchmark Microsoft Secure Score across identity, device, app and data and produce a prioritised improvement plan mapped to the Essential Eight.
Compliance Manager Control Mapper
Map Microsoft Purview Compliance Manager controls to ISM, Essential Eight, SOCI and the Privacy Act to produce a prioritised gap list.
Intune Device Compliance and Baseline Gap
Audit Intune devices for missing compliance policies, security baselines and encryption against Essential Eight patching and hardening.
Admin Action and Audit Trail Review
Review privileged admin actions in the Microsoft Purview audit log to detect unauthorised role changes, policy edits, and agent activity.
IRAP Evidence Trail
Reorganises governance documents into ISM-mapped evidence folders for an IRAP assessment, indexed by control and gap-flagged.
IRAP Control Evidence
Produce control-by-control IRAP assessment evidence for in-scope Microsoft 365 security controls, read-only, mapped to the ISM.
PSPF Control Mapping
Maps your Microsoft 365 security controls to the Australian PSPF and Essential Eight, then reports a prioritised gap list.
APRA CPS 234 Readiness
Read-only audit that assesses your Microsoft 365 information-security controls against APRA CPS 234 obligations for regulated financial entities.
ISM Control Pack
Read-only audit that maps your Microsoft 365 tenant to ASD ISM controls and builds a control-by-control evidence pack.
SOCI Incident Responder
Drafts a SOCI Act cyber incident notification brief for a person to review: affected assets, impact classification, containment, service impact and the ASD ACSC report.
Privacy Act ADM Logger
Produces an automated decision-making log for an in-scope agent, capturing inputs, rationale, model version, and manual review path.
Purview AI Activity Explorer
Audit Purview AI Hub activity explorer data: prompt and response events, sensitive data access and policy violations across Copilot and AI apps.
Copilot Multi-Model Routing and Purview Controls
Which Microsoft Purview controls Microsoft documents for Microsoft 365 Copilot when Anthropic models handle prompts, and where it is undocumented.
Defender for Cloud Apps Policy Coverage Audit
Audit Defender for Cloud Apps policy coverage for gaps in discovery, access, session and anomaly detection across sanctioned and unsanctioned apps.
Defender for Cloud Apps OAuth App Governance
Audit OAuth apps consented in Microsoft 365 via Defender for Cloud Apps app governance, flag high-risk and over-privileged apps, and get remediation steps.
Defender for Cloud Apps Session Controls Review
Review Defender for Cloud Apps session policies to find SaaS apps lacking real-time session protection and recommend coverage for regulated apps.
Cloud App Risk Catalogue Review
Review Microsoft Defender for Cloud Apps catalogue risk scores and sanctioned or unsanctioned tagging for the apps in use.
Defender Advanced Hunting Pack
Run curated read-only Microsoft Defender XDR advanced hunting KQL queries to surface anomalous sign-ins, suspicious inbox rules and risky OAuth grants.
Defender ASR and Endpoint Config Assessment
Read-only audit of Microsoft Defender for Endpoint ASR rules and endpoint hardening against Essential Eight application controls.
Defender Incident Hygiene Review
Read-only review of Microsoft Defender XDR incidents for unassigned, ageing or improperly suppressed items to summarise response hygiene.
MITRE ATT&CK Coverage Gap
Map active Microsoft Sentinel and Defender XDR detections to MITRE ATT&CK tactics and techniques, then report where coverage is missing.
Threat Hunting Readiness Baseline
Assess whether the tenant is ready for threat hunting: log retention, advanced hunting access, Sentinel workspace coverage and KQL availability.
Sentinel Analytics Rule Coverage
Audit Microsoft Sentinel analytics rules for enabled status, MITRE ATT&CK coverage, and noisy or stale detections.
Sentinel Data Connector Coverage
Audit which Microsoft Sentinel data connectors are ingesting and report logging coverage gaps for detection and IRAP.
Security Copilot Governance Review
Audit Microsoft Security Copilot across access roles, SCU capacity, promptbooks, agents, Sentinel data lake and MCP, Security Store and audit logging.
Exchange Anti-Phishing Coverage
Audit Microsoft Defender for Office 365 anti-phishing, spoof and impersonation protection policy coverage across all mailboxes.
Safe Links and Safe Attachments Coverage
Read-only audit of Microsoft Defender for Office 365 Safe Links and Safe Attachments policy coverage across users and domains.
Mailbox Delegation and Forwarding Audit
Audit Exchange Online mailbox delegations, full-access permissions, and auto-forwarding to external recipients to close a data-exfiltration vector.
Transport Rule Risk Review
Review Exchange Online mail flow (transport) rules for risky patterns that bypass security controls or exfiltrate mail.
Microsoft Security Exposure Management Baseline
Run a Security Exposure Management baseline to map critical attack paths, score exposure by initiative and rank fixes across Microsoft 365 and Azure.