daily_brief
Get a combined morning summary of sign-in failures and directory admin actions in one call, with a compact summary. Allows quick triage of security issues without separate lookups.
Instructions
One-call morning-patrol summary: sign-in failures, spray suspects, and admin actions.
Combines signin_failure_stats and directory_audits into one
result with a compact summary on top, matching the shape of this
fleet's other daily_brief tools. A permission failure in one section
degrades only that section's contribution to summary -- the other
section still returns in full.
Runs both sections synchronously in one tool call, unlike the sibling
gwsadm-mcp's job+poll daily_brief. If this proves too slow for a
tenant's sign-in volume against the client's tool-call timeout, port
that job+poll pattern here (tracked in this repo's CLAUDE.md Roadmap).
Args: hours: How far back to look, clamped to [1, 720] (30 days). max_pages: Page budget passed to both sections (default: ENTRAADM_MAX_PAGES_DEFAULT). samples: Reserved for a future drill-down sample size; currently unused.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | ||
| samples | No | ||
| max_pages | No |