Skip to main content
Glama
shigechika

entraadm-mcp

by shigechika
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

daily_brief

Generates a compact daily triage summary of Microsoft 365 service health, sign-in failures, spray suspects, and admin actions in one call.

Instructions

One-call morning-patrol summary: M365 service health, sign-in failures, spray suspects, admin actions.

Combines m365_service_health, signin_failure_stats, directory_audits and compromise_suspects (its counts and the top 5 of each list; summary.compromise_suspects has the high/medium counts) into one result with a compact summary on top. The failure stats and the compromise suspects come from one walk of the sign-in log. The shape matches this fleet's other daily_brief tools. A permission failure in one section degrades only that section's contribution to summary -- the other sections still return in full. Azure VM backup is deliberately not a section here: its ARM fan-out is the one scan that could exhaust the shared budget, so call vm_backup_status separately.

With a tenant file (ENTRAADM_CONFIG) it covers every tenant: the top-level keys stay the DEFAULT tenant's brief, exactly as in a single-tenant deployment, plus tenant (the default's name) and tenants ({name: the same brief} for each other tenant). The call budget (ENTRAADM_DEADLINE) is split: default first, each tenant gets an even share of what is left, so a busy tenant cannot starve the next one (a tenant that finishes early leaves its rest to the others). With ENTRAADM_DEADLINE=0 there is no budget and every tenant is scanned in full, one after another, which can outlast a client's ~60 s cutoff. Env-only results carry neither key.

Runs both sections synchronously in one tool call, unlike the sibling gwsadm-mcp's job+poll daily_brief. If this proves too slow for a tenant's sign-in volume against the client's tool-call timeout, port that job+poll pattern here (tracked in this repo's CLAUDE.md Roadmap).

Args: hours: How far back to look, clamped to [1, 720] (30 days). max_pages: Page budget passed to both sections (default: ENTRAADM_MAX_PAGES_DEFAULT). samples: Reserved for a future drill-down sample size; currently unused.

Input Schema

NameRequiredDescriptionDefault
hoursNo
samplesNo
max_pagesNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so: it discloses per-section graceful degradation on permission failure, the shared call-budget splitting across tenants, that results are synchronous (unlike the job+poll sibling) with a timeout risk, and what shape the return payload takes. These are non-obvious operational traits an agent could not infer from the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the one-sentence summary, and nearly every paragraph carries operational value. It is somewhat long and includes repo-internal roadmap/CLAUDE.md references that don't help an agent decide or invoke, which keeps it short of a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-param aggregator with no output schema and no annotations, the description is thorough: it describes the return shape (compact summary plus top-5 lists), the multi-tenant top-level/tenant keys, budget allocation, and failure modes. An agent has everything needed to call it correctly and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does for all three params: hours is clamped to [1,720], max_pages is a page budget passed to both sections with a named default, and samples is flagged as currently unused. The only softness is that max_pages' default is given as an env-var name rather than a resolved value, but the semantics are still clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource framing ('One-call morning-patrol summary') and enumerates exactly which data it aggregates (M365 service health, sign-in failures, spray suspects, admin actions). It explicitly names the four sibling tools it combines, so an agent can distinguish it from calling those tools individually.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly steers away from the obvious alternative: it says Azure VM backup is deliberately excluded and that the agent should call vm_backup_status separately, with a stated reason (ARM fan-out exhausting the shared budget). It also explains the multi-tenant case and the deadline=0 tradeoff, giving clear when-to-use and when-not-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools