{"id":"ms365-tenant-manager","name":"ms365-tenant-manager","summary":"グローバル管理者向けのMicrosoft 365テナント管理スキルの包括的設定、設定、ユーザー管理、セキュリティポリシー、組織構造最適化","body":"# Microsoft 365 Tenant Manager\n\nThis skill provides expert guidance and automation for Microsoft 365 Global Administrators managing tenant setup, configuration, user lifecycle, security policies, and organizational optimization.\n\n## Capabilities\n\n- **Tenant Setup & Configuration**: Initial tenant setup, domain configuration, DNS records, service provisioning\n- **User & Group Management**: User lifecycle (create, modify, disable, delete), group creation, license assignment\n- **Security & Compliance**: Conditional Access policies, MFA setup, DLP policies, retention policies, security baselines\n- **SharePoint & OneDrive**: Site provisioning, permissions management, storage quotas, sharing policies\n- **Teams Administration**: Team creation, policy management, guest access, compliance settings\n- **Exchange Online**: Mailbox management, distribution groups, mail flow rules, anti-spam/malware policies\n- **License Management**: License allocation, optimization, cost analysis, usage reporting\n- **Reporting & Auditing**: Activity reports, audit logs, compliance reporting, usage analytics\n- **Automation Scripts**: PowerShell script generation for bulk operations and recurring tasks\n- **Best Practices**: Microsoft recommended configurations, security hardening, governance frameworks\n\n## Input Requirements\n\nTenant management tasks require:\n- **Action type**: setup, configure, create, modify, delete, report, audit\n- **Resource details**: User info, group names, policy settings, service configurations\n- **Organizational context**: Company size, industry, compliance requirements (GDPR, HIPAA, etc.)\n- **Current state**: Existing configurations, licenses, user count\n- **Desired outcome**: Specific goals, requirements, or changes needed\n\nFormats accepted:\n- Text descriptions of administrative tasks\n- JSON with structured configuration data\n- CSV for bulk user/group operations\n- Existing PowerShell scripts to review or modify\n\n## Output Formats\n\nResults include:\n- **Step-by-step instructions**: Detailed guidance for manual configuration via Admin Center\n- **PowerShell scripts**: Ready-to-use scripts for automation (with safety checks)\n- **Configuration recommendations**: Security and governance best practices\n- **Validation checklists**: Pre/post-implementation verification steps\n- **Documentation**: Markdown documentation of changes and configurations\n- **Rollback procedures**: Instructions to undo changes if needed\n- **Compliance reports**: Security posture and compliance status\n\n## How to Use\n\n\"Set up a new Microsoft 365 tenant for a 50-person company with security best practices\"\n\"Create a PowerShell script to provision 100 users from a CSV file with appropriate licenses\"\n\"Configure Conditional Access policy requiring MFA for all admin accounts\"\n\"Generate a report of all inactive users in the past 90 days\"\n\"Set up Teams policies for external collaboration with security controls\"\n\n## Scripts\n\n- `tenant_setup.py`: Initial tenant configuration and service provisioning automation\n- `user_management.py`: User lifecycle operations and bulk provisioning\n- `security_policies.py`: Security policy configuration and compliance checks\n- `reporting.py`: Analytics, audit logs, and compliance reporting\n- `powershell_generator.py`: Generates PowerShell scripts for Microsoft Graph API and admin modules\n\n## Best Practices\n\n### Tenant Setup\n1. **Enable MFA first** - Before adding users, enforce multi-factor authentication\n2. **Configure named locations** - Define trusted IP ranges for Conditional Access\n3. **Set up privileged access** - Use separate admin accounts, enable PIM (Privileged Identity Management)\n4. **Domain verification** - Add and verify custom domains before bulk user creation\n5. **Baseline security** - Apply Microsoft Secure Score recommendations immediately\n\n### User Management\n1. **License assignment** - Use group-based licensing for scalability\n2. **Naming conventions** - Establish consistent user principal names (UPNs) and display names\n3. **Lifecycle management** - Implement automated onboarding/offboarding workflows\n4. **Guest access** - Enable only when necessary, set expiration policies\n5. **Shared mailboxes** - Use for department emails instead of assigning licenses\n\n### Security & Compliance\n1. **Zero Trust approach** - Verify explicitly, use least privilege access, assume breach\n2. **Conditional Access** - Start with report-only mode, then enforce gradually\n3. **Data Loss Prevention** - Define sensitive information types, test policies before enforcement\n4. **Retention policies** - Balance compliance requirements with storage costs\n5. **Regular audits** - Review permissions, licenses, and security settings quarterly\n\n### SharePoint & Teams\n1. **Site provisioning** - Use templates and governance policies\n2. **External sharing** - Restrict to specific domains, require authentication\n3. **Storage management** - Set quotas, enable auto-cleanup of old content\n4. **Teams templates** - Create standardized team structures for consistency\n5. **Guest lifecycle** - Set expiration and regular recertification\n\n### PowerShell Automation\n1. **Use Microsoft Graph** - Prefer Graph API over legacy MSOnline modules\n2. **Error handling** - Include try/catch blocks and validation checks\n3. **Dry-run mode** - Test scripts with -WhatIf before executing\n4. **Logging** - Capture all operations for audit trails\n5. **Credential management** - Use Azure Key Vault or managed identities, never hardcode\n\n## Common Tasks\n\n### Initial Tenant Setup\n- Configure company branding\n- Add and verify custom domains\n- Set up DNS records (MX, SPF, DKIM, DMARC)\n- Enable required services (Teams, SharePoint, Exchange)\n- Create organizational structure (departments, locations)\n- Set default user settings and policies\n\n### User Onboarding\n- Create user accounts (single or bulk)\n- Assign appropriate licenses\n- Add to security and distribution groups\n- Configure mailbox and OneDrive\n- Set up multi-factor authentication\n- Provision Teams access\n\n### Security Hardening\n- Enable Security Defaults or Conditional Access\n- Configure MFA enforcement\n- Set up admin role assignments\n- Enable audit logging\n- Configure anti-phishing policies\n- Set up DLP and retention policies\n\n### Reporting & Monitoring\n- Active users and license utilization\n- Security incidents and alerts\n- Mailbox usage and storage\n- SharePoint site activity\n- Teams usage and adoption\n- Compliance and audit logs\n\n## Limitations\n\n- **Permissions required**: Global Administrator or specific role-based permissions\n- **API rate limits**: Microsoft Graph API has throttling limits for bulk operations\n- **License dependencies**: Some features require specific license tiers (E3, E5)\n- **Delegation constraints**: Some tasks cannot be delegated to service principals\n- **Regional variations**: Compliance features may vary by geographic region\n- **Hybrid scenarios**: On-premises Active Directory integration requires additional configuration\n- **Third-party integrations**: External apps may require separate authentication and permissions\n- **PowerShell prerequisites**: Requires appropriate modules installed (Microsoft.Graph, ExchangeOnlineManagement, etc.)\n\n## Security Considerations\n\n### Authentication\n- Never store credentials in scripts or configuration files\n- Use Azure Key Vault for credential management\n- Implement certificate-based authentication for automation\n- Enable Conditional Access for admin accounts\n- Use Privileged Identity Management (PIM) for JIT access\n\n### Authorization\n- Follow principle of least privilege\n- Use custom admin roles instead of Global Admin when possible\n- Regularly review and audit admin role assignments\n- Enable PIM for temporary elevated access\n- Separate user accounts from admin accounts\n\n### Compliance\n- Enable audit logging for all activities\n- Retain logs according to compliance requirements\n- Configure data residency for regulated industries\n- Implement information barriers where needed\n- Regular compliance assessments and reporting\n\n## PowerShell Modules Required\n\nTo execute generated scripts, ensure these modules are installed:\n- `Microsoft.Graph` (recommended, modern Graph API)\n- `ExchangeOnlineManagement` (Exchange Online management)\n- `MicrosoftTeams` (Teams administration)\n- `SharePointPnPPowerShellOnline` (SharePoint management)\n- `AzureAD` or `AzureADPreview` (Azure AD management - being deprecated)\n- `MSOnline` (Legacy, being deprecated - avoid when possible)\n\n## Updates & Maintenance\n\n- Microsoft 365 features and APIs evolve rapidly\n- Review Microsoft 365 Roadmap regularly for upcoming changes\n- Test scripts in non-production tenant before production deployment\n- Subscribe to Microsoft 365 Admin Center message center for updates\n- Keep PowerShell modules updated to latest versions\n- Regular security baseline reviews (quarterly recommended)\n\n## Helpful Resources\n\n- **Microsoft 365 Admin Center**: https://admin.microsoft.com\n- **Microsoft Graph Explorer**: https://developer.microsoft.com/graph/graph-explorer\n- **PowerShell Gallery**: https://www.powershellgallery.com\n- **Microsoft Secure Score**: Security posture assessment in Admin Center\n- **Microsoft 365 Compliance Center**: https://compliance.microsoft.com\n- **Azure AD Conditional Access**: Identity and access management policies","author":"@alirezarezvani","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/alirezarezvani/claude-code-skill-factory/tree/dev/generated-skills/ms365-tenant-manager","license":"MIT","category":"document","lang":"en","tokens":1842,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[{"path":"expected_output.json","size":2052,"sha256":"9b6ff101a79e8ab0ea446c92cb55f48015dae823d7e2c6d0b179da38a8a8c05e"},{"path":"HOW_TO_USE.md","size":7269,"sha256":"6f0b751b40809c954bccfd7d59d39ea320e9bcd9e145f555ca70472b7c59aa71"},{"path":"powershell_generator.py","size":14246,"sha256":"ff0318ae7cfbd688e3167105b9fb6ed11843543418db59ce365a5f4b2799ad21"},{"path":"sample_input.json","size":471,"sha256":"e01f08efca98b8724f524d5eca19241446a5a1d87f84e206ff9a29035046f464"},{"path":"tenant_setup.py","size":17034,"sha256":"3a1410f3e9277f8c682b2fc684c143c75c8ab5087527ec0081fc50be3dacad3a"},{"path":"user_management.py","size":16404,"sha256":"f3c2897ff652f7c6dc246c3ca3ad8148dd43ec703f79ee6dfbaeb0066a370ab4"}],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[{"code":"net.endpoints","kind":"exfiltration","excerpt":"aad.portal.azure.com, admin.microsoft.com, compliance.microsoft.com, developer.microsoft.com, www.microsoft.com, www.powershellgallery.com","message":"bundled scripts reach 6 external host(s)","severity":"warn"}],"scannedAt":"2026-08-22","hasScripts":true,"networkEndpoints":["aad.portal.azure.com","admin.microsoft.com","compliance.microsoft.com","developer.microsoft.com","www.microsoft.com","www.powershellgallery.com"]}}