No user-submitted related servers found.
Scored across 13 tools
The four sign-in tools (signin_logs, signin_by_ip, signin_failure_stats, signin_success_stats) share a data source but are clearly scoped by user vs IP vs failures vs successes, and get_user vs get_user_auth_methods are cleanly separated. daily_brief deliberately overlaps by composing m365_service_health, signin_failure_stats, and directory_audits, but is explicitly framed as a one-call aggregator rather than a peer.
Names are uniformly snake_case and descriptive nouns/actions, with a consistent 'signin_' family and 'vm_' family. The only minor inconsistency is verb prefixes: get_user/get_user_auth_methods and list_subscriptions use verbs while signin_logs, directory_audits, m365_service_health, and daily_brief are bare noun phrases.
Thirteen tools is well within the sweet spot for a focused triage/diagnostic server, and each tool covers a distinct query or aggregation. No obvious filler or redundant tool bloats the set.
The surface covers the core triage lifecycle: identity/lifecycle state, MFA registration, per-user and per-IP sign-in detail, tenant-wide failure and success aggregation, admin audit history, M365 service health, and Azure VM backup status/policies. Gaps exist for role/group membership lookup, device compliance, and Identity Protection risk detections, but these are minor for a read-only triage-oriented server and the aggregate tools let agents work around most of them.
