Tool Groups ​

A tool group is a named bundle of tools the AI is allowed to call when an end user ticks the group at chat start. Without tool groups, granting access is a per-tool checkbox grind; with them, "Entra ID Identity" or "Azure Platform" is a single decision the launcher exposes.

Tool Groups tab with Built-in Groups (Insights, Persistent Memory, Sessions, Acme Platform, Entra ID Identity, Inventory, M365 Services, Remote Agents, Security & Compliance), External Servers (Context7, ITdesign Atlassian Rovo, Microsoft Learn), and Custom Groups

Layout ​

The page header carries the AI Integrations title and the Admin Access chip; the tab strip puts you on Tool Groups. Two header buttons sit above the body: New Tool Group and Refresh. The header sub-line reminds you that the page "Manages built-in and custom MCP tool groups."

The body has three sections, top to bottom:

  1. Built-in Groups — system-defined bundles that ship with InfraScout.
  2. External Servers — bundles backed by registered MCP servers.
  3. Custom Groups — bundles you defined by combining tools from the catalog.

Each card carries a Built-in / External / Custom chip, the title, a one-line description, and a tool count. A "Estimate All Tokens" and "New Tool Group" button cluster sits at the top right.

Built-in groups ​

The built-in groups map roughly to InfraScout's domain areas:

  • Insights — read and manage assessment findings.
  • Persistent Memory — read and write entries in the persistent memory store.
  • Sessions — start, pause, and inspect assessment sessions.
  • Acme Platform (named after your tenant) — subscriptions, resources, governance, cost management.
  • Entra ID Identity — users, groups, roles, service principals, PIM.
  • Inventory — query the inventory of hosts, software, services, certificates.
  • M365 Services — Mail, Teams, SharePoint, Intune, licenses.
  • Remote Agents — execute commands on remote hosts (shell, PowerShell, LDAP, WMI).
  • Security & Compliance — Conditional Access, Defender, Secure Score, sign-in logs.

Built-in groups can be edited (visibility, default selection in the launcher) but not deleted.

External server groups ​

Each registered MCP server shows up as its own tool group on this tab. The card shows the server name, its purpose, and the count of tools the server exposes.

The external groups in the screenshot are typical: Context7 for live library documentation, ITdesign Atlassian Rovo for Confluence and Jira, Microsoft Learn for official Microsoft documentation. Adding a new MCP server in the MCP Servers tab automatically creates the corresponding tool group here.

Custom groups ​

Custom groups are bundles you assemble by hand from individual tools across the built-in and external catalogs. A typical use case: "Identity-Read-Only" — a custom group with mscloud_identity_get_user, mscloud_identity_list_groups, and mscloud_identity_list_role_assignments only. Users who need to read identity but should never write tick that group instead of the full Entra ID Identity group.

Visibility ​

Each group carries its own visibility list. Hide the Remote Agents group from a junior team and they will not see it in the launcher; expose a custom group to a specific Entra security group and only those members can tick it.

Token estimation ​

The Estimate All Tokens button at the top runs every tool group through a token counter so you know how much of the chat budget the group costs simply by being available. The number is shown on each card after the run.