AI Agent Posture
SCStelz/security-investigator
Audit or report on AI agent security posture across Copilot Studio, Microsoft 365 Copilot, Microsoft Foundry, and third-party agents.
Microsoft 365 Agents SDK for .NET. An agent skill from microsoft/skills.
$ npx skills add microsoft/skills --skill m365-agents-dotnet -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install microsoft/skills m365-agents-dotnet --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet .claude/skills/m365-agents-dotnet && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "m365-agents-dotnet" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet into .claude/skills/m365-agents-dotnet/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-dotnet", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnetType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add microsoft/skills --skill m365-agents-dotnet -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install microsoft/skills m365-agents-dotnet --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet .agents/skills/m365-agents-dotnet && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "m365-agents-dotnet" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet into .agents/skills/m365-agents-dotnet/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-dotnet", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/skills --skill m365-agents-dotnet -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install microsoft/skills m365-agents-dotnet --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet .cursor/skills/m365-agents-dotnet && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "m365-agents-dotnet" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet into .cursor/skills/m365-agents-dotnet/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-dotnet", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/microsoft/skills.git --path .github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add microsoft/skills --skill m365-agents-dotnet -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install microsoft/skills m365-agents-dotnet --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet .gemini/skills/m365-agents-dotnet && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "m365-agents-dotnet" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet into .gemini/skills/m365-agents-dotnet/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-dotnet", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install microsoft/skills m365-agents-dotnetInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add microsoft/skills --skill m365-agents-dotnet -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet .github/skills/m365-agents-dotnet && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "m365-agents-dotnet" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet into .github/skills/m365-agents-dotnet/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-dotnet", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/skills --skill m365-agents-dotnet -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install microsoft/skills m365-agents-dotnet --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet .opencode/skills/m365-agents-dotnet && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "m365-agents-dotnet" agent skill from https://github.com/microsoft/skills/tree/main/.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet into .opencode/skills/m365-agents-dotnet/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "m365-agents-dotnet", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
m365-agents-dotnetMicrosoft 365 Agents SDK for .NET. An agent skill from microsoft/skills.
M365 Agents Dotnet is an agent skill from microsoft/skills, published by the product's own GitHub organization. Microsoft 365 Agents SDK for .NET. Build multichannel agents for Teams/M365/Copilot Studio with ASP.NET Core hosting, AgentApplication routing, and MSAL-based auth. Triggers: "Microsoft 365 Agents SDK", "Microsoft.Agents", "AddAgentApplicationOptions", "AgentApplication", "AddAgentAspNetAuthentication", "Copilot Studio client", "IAgentHttpAdapter".
Its SKILL.md is about 2.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Documents & Office, covering Cloud office suites. It works with Microsoft 365, .NET, Microsoft Copilot Studio and ASP.NET Core. The repository describes itself as: Skills, MCP servers, Custom Agents, Agents.md for SDKs to ground Coding Agents. The licence is MIT.
6 steps, taken from the first numbered list in SKILL.md.
Read from SKILL.md and the folder at commit 354361d. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
dotnetFrom the folder's file list and the shell code blocks in SKILL.md.
Hosts in commands or code, which the agent is likely to contact:
login.microsoftonline.comapi.botframework.comAlso links to:
learn.microsoft.comgithub.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
M365 Agents Dotnet loads about 2.5k tokens when it runs. Until then it costs about 92 tokens; SKILL.md has 175 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from microsoft/skills at commit 354361d, republished under its MIT licence (© microsoft). 175 words, ~2,512 tokens.
.claude/skills/m365-agents-dotnet/SKILL.md (or your agent's skills folder).Build enterprise agents for Microsoft 365, Teams, and Copilot Studio using the Microsoft.Agents SDK with ASP.NET Core hosting, agent routing, and MSAL-based authentication.
dotnet add package Microsoft.Agents.Hosting.AspNetCore
dotnet add package Microsoft.Agents.Authentication.Msal
dotnet add package Microsoft.Agents.Storage
dotnet add package Microsoft.Agents.CopilotStudio.Client
dotnet add package Microsoft.Identity.Client.Extensions.Msal{
"TokenValidation": {
"Enabled": true,
"Audiences": ["{{ClientId}}"],
"TenantId": "{{TenantId}}"
},
"AgentApplication": {
"StartTypingTimer": false,
"RemoveRecipientMention": false,
"NormalizeMentions": false
},
"Connections": {
"ServiceConnection": {
"Settings": {
"AuthType": "ClientSecret",
"ClientId": "{{ClientId}}",
"ClientSecret": "{{ClientSecret}}",
"AuthorityEndpoint": "https://login.microsoftonline.com/{{TenantId}}",
"Scopes": ["https://api.botframework.com/.default"]
}
}
},
"ConnectionsMap": [
{
"ServiceUrl": "*",
"Connection": "ServiceConnection"
}
],
"CopilotStudioClientSettings": {
"DirectConnectUrl": "",
"EnvironmentId": "",
"SchemaName": "",
"TenantId": "",
"AppClientId": "",
"AppClientSecret": ""
}
}using Microsoft.Agents.Builder;
using Microsoft.Agents.Hosting.AspNetCore;
using Microsoft.Agents.Storage;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddHttpClient();
builder.AddAgentApplicationOptions();
builder.AddAgent<MyAgent>();
builder.Services.AddSingleton<IStorage, MemoryStorage>();
builder.Services.AddControllers();
builder.Services.AddAgentAspNetAuthentication(builder.Configuration);
WebApplication app = builder.Build();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/", () => "Microsoft Agents SDK Sample");
var incomingRoute = app.MapPost("/api/messages",
async (HttpRequest request, HttpResponse response, IAgentHttpAdapter adapter, IAgent agent, CancellationToken ct) =>
{
await adapter.ProcessAsync(request, response, agent, ct);
});
if (!app.Environment.IsDevelopment())
{
incomingRoute.RequireAuthorization();
}
else
{
app.Urls.Add("http://localhost:3978");
}
app.Run();using Microsoft.Agents.Builder;
using Microsoft.Agents.Builder.App;
using Microsoft.Agents.Builder.State;
using Microsoft.Agents.Core.Models;
using System;
using System.Threading;
using System.Threading.Tasks;
public sealed class MyAgent : AgentApplication
{
public MyAgent(AgentApplicationOptions options) : base(options)
{
OnConversationUpdate(ConversationUpdateEvents.MembersAdded, WelcomeAsync);
OnActivity(ActivityTypes.Message, OnMessageAsync, rank: RouteRank.Last);
OnTurnError(OnTurnErrorAsync);
}
private static async Task WelcomeAsync(ITurnContext turnContext, ITurnState turnState, CancellationToken ct)
{
foreach (ChannelAccount member in turnContext.Activity.MembersAdded)
{
if (member.Id != turnContext.Activity.Recipient.Id)
{
await turnContext.SendActivityAsync(
MessageFactory.Text("Welcome to the agent."),
ct);
}
}
}
private static async Task OnMessageAsync(ITurnContext turnContext, ITurnState turnState, CancellationToken ct)
{
await turnContext.SendActivityAsync(
MessageFactory.Text($"You said: {turnContext.Activity.Text}"),
ct);
}
private static async Task OnTurnErrorAsync(
ITurnContext turnContext,
ITurnState turnState,
Exception exception,
CancellationToken ct)
{
await turnState.Conversation.DeleteStateAsync(turnContext, ct);
var endOfConversation = Activity.CreateEndOfConversationActivity();
endOfConversation.Code = EndOfConversationCodes.Error;
endOfConversation.Text = exception.Message;
await turnContext.SendActivityAsync(endOfConversation, ct);
}
}using System.Net.Http.Headers;
using Microsoft.Agents.CopilotStudio.Client;
using Microsoft.Identity.Client;
internal sealed class AddTokenHandler : DelegatingHandler
{
private readonly SampleConnectionSettings _settings;
public AddTokenHandler(SampleConnectionSettings settings) : base(new HttpClientHandler())
{
_settings = settings;
}
protected override async Task<HttpResponseMessage> SendAsync(
HttpRequestMessage request,
CancellationToken cancellationToken)
{
if (request.Headers.Authorization is null)
{
string[] scopes = [CopilotClient.ScopeFromSettings(_settings)];
IPublicClientApplication app = PublicClientApplicationBuilder
.Create(_settings.AppClientId)
.WithAuthority(AadAuthorityAudience.AzureAdMyOrg)
.WithTenantId(_settings.TenantId)
.WithRedirectUri("http://localhost")
.Build();
AuthenticationResult authResponse;
try
{
var account = (await app.GetAccountsAsync()).FirstOrDefault();
authResponse = await app.AcquireTokenSilent(scopes, account).ExecuteAsync(cancellationToken);
}
catch (MsalUiRequiredException)
{
authResponse = await app.AcquireTokenInteractive(scopes).ExecuteAsync(cancellationToken);
}
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", authResponse.AccessToken);
}
return await base.SendAsync(request, cancellationToken);
}
}using Microsoft.Agents.CopilotStudio.Client;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
HostApplicationBuilder builder = Host.CreateApplicationBuilder(args);
var settings = new SampleConnectionSettings(
builder.Configuration.GetSection("CopilotStudioClientSettings"));
builder.Services.AddHttpClient("mcs").ConfigurePrimaryHttpMessageHandler(() =>
{
return new AddTokenHandler(settings);
});
builder.Services
.AddSingleton(settings)
.AddTransient<CopilotClient>(sp =>
{
var logger = sp.GetRequiredService<ILoggerFactory>().CreateLogger<CopilotClient>();
return new CopilotClient(settings, sp.GetRequiredService<IHttpClientFactory>(), logger, "mcs");
});
IHost host = builder.Build();
var client = host.Services.GetRequiredService<CopilotClient>();
await foreach (var activity in client.StartConversationAsync(emitStartConversationEvent: true))
{
Console.WriteLine(activity.Type);
}
await foreach (var activity in client.AskQuestionAsync("Hello!", null))
{
Console.WriteLine(activity.Type);
}© microsoft, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Just SKILL.md in .github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet of microsoft/skills.
Open the folder on GitHubat commit 354361d
We found 18 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 6 other GitHub owners. This page covers the copy in microsoft/skills, which our catalogue first saw on October 7, 2026.
M365 Agents Dotnet next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| M365 Agents Dotnet this skillmicrosoft/skills | 3.1k | 6 repos | ~2.5k | Automated safety check: Pass | MIT | |
| AI Agent PostureSCStelz/security-investigator | 249 | — | ~21k | Automated safety check: Pass | MIT | |
| Msgraph SDKgithub/awesome-copilot | 40k | — | ~2.1k | Automated safety check: Pass | MIT | |
| Purview Dspm AIvinayaklatthe/microsoft-security-skills | 175 | — | ~1.5k | Automated safety check: Pass | MIT | |
| Code Reviewpnp/powershell | 905 | — | ~385 | Automated safety check: Pass | MIT | |
| CLI Microsoft365pnp/cli-microsoft365-mcp-server | 131 | — | ~3.5k | Automated safety check: Pass | MIT |
SCStelz/security-investigator
Audit or report on AI agent security posture across Copilot Studio, Microsoft 365 Copilot, Microsoft Foundry, and third-party agents.
github/awesome-copilot
Integrate Microsoft Graph SDK into any project — .NET, TypeScript/JavaScript, or Python.
vinayaklatthe/microsoft-security-skills
Guidance for Microsoft Purview Data Security Posture Management for AI (DSPM for AI) - discovering, monitoring, and protecting sensitive data interactions with generative AI apps like Microsoft 365…
pnp/powershell
Reviews changes to PnP PowerShell, a .NET 8 module of 800+ cmdlets for Microsoft 365.
pnp/cli-microsoft365-mcp-server
Use CLI for Microsoft 365 to manage Microsoft 365 tenants from the terminal.
pnp/docker-spfx
Automate SPFx version releases - branch, update files, commit, open PR, then tag after merge
microsoft/skills
Reference for building on Microsoft Foundry with the azure-ai-projects Python SDK: project clients, versioned agents, evaluations, connections, datasets and indexes.
microsoft/skills
Python guidance for the Azure AI Search SDK covering vector, hybrid and semantic search, index management and indexers, with Entra ID authentication preferred over keys.
microsoft/skills
Covers producer, consumer, and checkpoint-store setup for Azure Event Hubs streaming in Python, with Entra ID auth and partition targeting.
microsoft/skills
Create Pydantic models following the multi-model pattern with Base, Create, Update, Response, and InDB variants.
microsoft/skills
Captures and filters Windows user-mode and kernel debug output from the command line with the Sysinternals DebugView CLI, including bounded runs suited to agents.
microsoft/skills
Build dark-themed React applications using Tailwind CSS with custom theming, glassmorphism effects, and Framer Motion animations.
Categories
Microsoft 365 Agents SDK for .NET. An agent skill from microsoft/skills. M365 Agents Dotnet is an agent skill from microsoft/skills, published by the product's own GitHub organization.NET.
M365 Agents Dotnet fits situations like: tasks that involve Cloud office suites.
Run `npx skills add microsoft/skills --skill m365-agents-dotnet -a claude-code`. Or copy the skill folder (.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet in microsoft/skills) into .claude/skills/m365-agents-dotnet in your project. Claude Code loads it when a task matches its description.
Run `npx skills add microsoft/skills --skill m365-agents-dotnet -a codex`. Or copy the skill folder (.github/plugins/azure-sdk-dotnet/skills/m365-agents-dotnet in microsoft/skills) into .agents/skills/m365-agents-dotnet in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add microsoft/skills --skill m365-agents-dotnet -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/m365-agents-dotnet, .gemini/skills/m365-agents-dotnet, .github/skills/m365-agents-dotnet and .opencode/skills/m365-agents-dotnet in your project.
Going by SKILL.md and its folder, M365 Agents Dotnet needs the command-line tools its instructions call (dotnet).
SKILL.md names 4 domains. In commands or code: login.microsoftonline.com and api.botframework.com; the agent is likely to contact these when it follows the instructions. As links in the text: learn.microsoft.com and github.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
M365 Agents Dotnet is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 2.5k tokens (SKILL.md is roughly 10k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
Skills that share tags, products or a category with M365 Agents Dotnet: AI Agent Posture (SCStelz/security-investigator, 249 stars), Msgraph SDK (github/awesome-copilot, 40k stars), Purview Dspm AI (vinayaklatthe/microsoft-security-skills, 175 stars) and Code Review (pnp/powershell, 905 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
microsoft (a GitHub organization, an official publisher) maintains it in microsoft/skills, which has 3,091 GitHub stars. The repository holds 150 skills in this directory. The repository was last updated on October 6, 2026.
Source: microsoft/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.