Microsoft Cloud — Services Tools

The 22 service tools cover Microsoft 365 surfaces: licensing (subscribed SKUs and per-user assignments), Teams (teams, members, channels, apps), SharePoint (sites, lists, drives), OneDrive and SharePoint document libraries including their standing sharing links and the tenant sharing policy, Exchange Online (mailbox settings, mail folders, messages, and mail-flow message traces), and usage and Copilot reports. Intune device management moved to its own group — see Microsoft Cloud — Intune.

All tools accept an optional connection_id. Omit it to use the default Entra connection. See entra_connection_list for multi-tenant scenarios.

Licensing

mscloud_service_list_subscribed_skus

Lists all commercial subscriptions (license SKUs) the tenant has acquired. Returns SKU name, ID, consumed and total unit counts, and service plans. Takes only an optional connection_id.

Example prompt.

"List every license SKU the tenant has, with consumed and total units."

mscloud_service_get_user_license_details

Returns license details assigned to a specific user — SKU and enabled service plans. Pass user_id (GUID or UPN).

Example prompt.

"Which licenses does stefan.hayduk@example.com have?"

Teams

mscloud_service_list_teams

Lists all teams in the tenant (groups with Team resource provisioning). Compose with mscloud_service_list_team_channels, mscloud_service_list_team_members, and mscloud_service_get_team for detailed team analysis.

Parameter	Type	Required	Description
connection_id	string	—	Target Entra tenant.
filter	string	—	Additional OData $filter.
select	string	—	Comma-separated property list.
top	number	—	Page size, max 100.
skiptoken	string	—	From the previous response.

Example prompt.

"List all Teams and flag any with external guest members."

mscloud_service_get_team

Returns details of a specific team — messaging settings, member settings, guest access, and fun settings. Check guest access and external sharing configurations for security.

Parameter	Type	Required	Description
team_id	string	✓	Team (group) ID.
connection_id	string	—	Target Entra tenant.
select	string	—	Comma-separated property list.

Example prompt.

"Show me guest access and external sharing settings for the 'Engineering' Team."

mscloud_service_list_team_members

Lists members of a team. Returns roles (owner, member, guest). Check for guest users and verify ownership assignment.

Parameter	Type	Required	Description
team_id	string	✓	Team (group) ID.
connection_id	string	—	Target Entra tenant.
filter	string	—	OData $filter.
top	number	—	Page size, max 100.
skiptoken	string	—	From the previous response.

Example prompt.

"Who are the members of the 'Engineering' Team — flag the guests."

mscloud_service_list_team_channels

Lists channels in a team. Includes standard, private, and shared channels. Private and shared channels have separate permissions from the parent team.

Parameter	Type	Required	Description
team_id	string	✓	Team (group) ID.
connection_id	string	—	Target Entra tenant.
filter	string	—	OData $filter.
select	string	—	Comma-separated property list.

Example prompt.

"List all private and shared channels in the 'Engineering' Team."

mscloud_service_list_teams_apps

Lists Teams apps from the app catalog.

Parameter	Type	Required	Description
connection_id	string	—	Target Entra tenant.
filter	string	—	OData $filter.
select	string	—	Comma-separated property list.
top	number	—	Page size, max 100.
skiptoken	string	—	From the previous response.

Example prompt.

"List all third-party Teams apps in the app catalog."

SharePoint & OneDrive

mscloud_service_list_sites

Searches SharePoint sites by name or URL. Compose with mscloud_service_get_site, mscloud_service_list_site_lists, and mscloud_service_list_drives to audit content and permissions.

Parameter	Type	Required	Description
connection_id	string	—	Target Entra tenant.
search	string	—	Search query.
select	string	—	Comma-separated property list.
top	number	—	Page size, max 100.
skiptoken	string	—	From the previous response.

Example prompt.

"Find SharePoint sites whose name contains 'finance'."

mscloud_service_get_site

Returns a single SharePoint site by ID or path (e.g. contoso.sharepoint.com:/sites/team).

Parameter	Type	Required	Description
site_id	string	✓	Site ID or path.
connection_id	string	—	Target Entra tenant.
select	string	—	Comma-separated property list.

Example prompt.

"Show me the full configuration of the 'Finance' SharePoint site."

mscloud_service_list_site_lists

Lists SharePoint lists in a site.

Parameter	Type	Required	Description
site_id	string	✓	Site ID.
connection_id	string	—	Target Entra tenant.
select	string	—	Comma-separated property list.
top	number	—	Page size, max 100.
skiptoken	string	—	From the previous response.

Example prompt.

"List all SharePoint lists in this site."

mscloud_service_list_drives

Lists document libraries (drives) in a site.

Parameter	Type	Required	Description
site_id	string	✓	Site ID.
connection_id	string	—	Target Entra tenant.
select	string	—	Comma-separated property list.

Example prompt.

"List all document libraries in this SharePoint site."

mscloud_service_list_drive_items

Lists items (files and folders) inside a drive. Pass an empty path for the root.

Parameter	Type	Required	Description
drive_id	string	✓	Drive ID.
connection_id	string	—	Target Entra tenant.
path	string	—	Folder path within the drive (e.g. Documents/Reports).
select	string	—	Comma-separated property list.
top	number	—	Page size, max 100.
skiptoken	string	—	From the previous response.

Example prompt.

"List the contents of the 'Reports' folder in this document library."

Sharing Links & Sharing Policy

mscloud_service_list_sharing_links

Enumerates active standing sharing links across SharePoint sites and OneDrive for Business — the links that event-based sources such as audit logs no longer show. Each row carries the link's scope, type, recipients, expiration, who shared the item (shared_by), and risk flags: anonymous, never-expiring, edit-capable, or external. By default the result is filtered to the highest-risk exposure — anonymous or never-expiring links — and links that propagate to descendant items are collapsed to one row.

Prefer targeted calls. Classifying links requires reading each shared item's permissions, so cost scales with the number of drives and shared items. Pass a human identifier and the tool resolves it server-side:

• "What does this user share?" — onedrive_for with the UPN, paired with shared_by_contains to keep only links that user created.
• "What is shared in this Team?" — group_ids with the team ID (crawls the team's site plus private and shared channel sites).
• "What is shared in this site?" — site_urls with the site URL.

A tenant-wide sweep (target_scope of all, sites, or onedrive) cannot finish in one call on a tenant with hundreds of sites: pages are returned with a next_cursor, and you must keep calling with the cursor until none is returned. Re-pass your filters on each page — the cursor carries only the remaining work.

Parameter	Type	Required	Description
connection_id	string	—	Target Entra tenant.
onedrive_for	array	—	Crawl these users' OneDrives (UPN or object ID), resolved server-side.
group_ids	array	—	Crawl these Microsoft 365 Groups / Teams (main site plus channel sites).
site_urls	array	—	Crawl these SharePoint sites by URL, resolved server-side.
site_ids / drive_ids	array	—	Crawl raw site or drive IDs (from list_sites / list_drives).
target_scope	string	—	Tenant-wide sweep when no targets given: all, sites, or onedrive. Paged via next_cursor.
cursor	string	—	Continuation token from the previous page's next_cursor.
filter	string	—	Risk filter: a preset (all, anonymous, external, no_expiry, anonymous_or_no_expiry (default)) or a comma-separated AND set of raw flags (anonymous, no_expiry, edit, external) — e.g. external,edit keeps only links that are both external and edit-capable.
link_scope	string	—	Output filter: anonymous, organization, users (comma-separated = OR).
link_type	string	—	Output filter: view, edit, embed.
drive_kind	string	—	Output filter: site or onedrive. Drives targeted directly via drive_ids are excluded by this filter.
item_type	string	—	Output filter: file or folder.
owner_contains	string	—	Substring on the site or OneDrive owner.
shared_by_contains	string	—	Substring on who shared the item.
granted_to_contains	string	—	Substring on any link recipient.
path_contains	string	—	Substring on the item path.
has_password / has_expiry	boolean	—	Filter by password protection / expiry presence.
expiring_before / expiring_after	string	—	ISO-8601 bounds on the link's expiry.
modified_since	string	—	Skip items not modified since this time — reduces crawl work.
include_inherited	boolean	—	Emit a row for every item a propagated link applies to. Default false.
timeout_seconds	integer	—	Soft per-page budget. Default 25, max 45 — page with the cursor instead of raising it.

WARNING

For security conclusions, check coverage before claiming completeness: each page reports drives_crawled and may set incomplete (with the affected drives) or enumeration_failed when throttling or errors kept some drives from being fully crawled. Microsoft Graph throttles tenant-wide — space out calls and prefer few, targeted crawls over repeated sweeps.

Example prompt.

"Find every anonymous or never-expiring sharing link in the Finance team's sites."

mscloud_service_get_sharepoint_sharing_policy

Returns the organization-wide SharePoint and OneDrive sharing-governance settings exposed by Microsoft Graph: sharing capability, domain restriction mode with allowed/blocked domains, external resharing, legacy authentication protocols, unmanaged-device sync restrictions, deleted-user OneDrive retention, idle-session sign-out, and site-page commenting. Use it as context for judging the risk of links found by mscloud_service_list_sharing_links — for example, whether anonymous links are even allowed tenant-wide. Takes only an optional connection_id.

Note that the granular Anyone-link and guest-expiry controls are not available via the API; the response's note field says so explicitly.

Example prompt.

"What is our tenant-wide external sharing posture for SharePoint and OneDrive?"

Exchange Online

mscloud_service_get_mailbox_settings

Returns mailbox settings for a user — auto-reply, time zone, language, and so on. Check auto-reply configurations for information disclosure risks during security reviews.

Parameter	Type	Required	Description
user_id	string	✓	User ID or UPN.
connection_id	string	—	Target Entra tenant.

Example prompt.

"What auto-reply is currently set for stefan.hayduk@example.com?"

mscloud_service_list_mail_folders

Lists mail folders for a user — folder structure including custom folders, item counts, and unread counts.

Parameter	Type	Required	Description
user_id	string	✓	User ID or UPN.
connection_id	string	—	Target Entra tenant.
select	string	—	Comma-separated property list.
top	number	—	Page size, max 100.
skiptoken	string	—	From the previous response.

Example prompt.

"Show me the mail folder structure for this user."

mscloud_service_list_messages

Lists mail messages for a user. Useful for investigating phishing attempts or data exfiltration during security assessments. Requires Mail.Read or equivalent permission.

Parameter	Type	Required	Description
user_id	string	✓	User ID or UPN.
connection_id	string	—	Target Entra tenant.
filter	string	—	OData $filter, e.g. isRead eq false.
orderby	string	—	OData $orderby, e.g. receivedDateTime desc.
select	string	—	Comma-separated property list.
top	number	—	Page size, max 100.
skiptoken	string	—	From the previous response.

WARNING

Listing user messages reads private mailbox content. Use only for investigations the caller has authorized, and avoid persisting message bodies into insights or artifacts unless they are essential evidence.

Example prompt.

"Show me unread messages for this user from the last week — subject and sender only."

mscloud_service_get_message

Returns a single mail message by ID — full content including headers, body, and attachment metadata.

Parameter	Type	Required	Description
message_id	string	✓	Message ID.
user_id	string	✓	User ID or UPN.
connection_id	string	—	Target Entra tenant.
select	string	—	Comma-separated property list.

Example prompt.

"Show me the full content of message <id> for this user — I'm investigating a suspected phishing email."

Exchange Online Message Trace

These two tools report mail-flow — how messages moved through Exchange Online — not mailbox contents. Use them to answer "did the message arrive", "where was it quarantined", or "what did this sender blast out", then switch to mscloud_service_list_messages for what is sitting in a mailbox. They require the ExchangeMessageTrace.Read.All permission, which is part of the standard InfraScout app registration.

Tenant onboarding required

Beyond the permission, message trace needs a one-time onboarding step in the target tenant: the tenant must have a provisioned service principal for the Microsoft first-party "Transport Data Platform" app. If a trace call returns an authorization error even though the permission is granted and consented, run Microsoft's message-trace onboarding step in the target tenant and retry. See Microsoft's Graph-based message trace API onboarding guide.

mscloud_service_list_message_traces

Traces messages as they passed through Exchange Online, with a delivery status of delivered, failed, pending, or quarantined per recipient. Traces cover the last 90 days; a single query spans at most 10 days, and with no filter the last 48 hours are returned.

Parameter	Type	Required	Description
connection_id	string	—	Target Entra tenant.
filter	string	—	OData $filter on senderAddress, recipientAddress, receivedDateTime, subject (supports contains()), status, messageId, fromIP, or toIP. Combine clauses with and.
top	number	—	Page size, 1–5000. Default 1000.
skiptoken	string	—	From the previous response.

Example prompt.

"Trace all failed or quarantined mail from billing@example.com in the last 3 days."

mscloud_service_get_message_trace_details

Returns the per-recipient processing events for a single trace — the ordered steps Exchange Online applied to the message: receive, transport rules, spam verdicts, and delivery. Pass the message_trace_id (the id from mscloud_service_list_message_traces) and the recipient_address.

Example prompt.

"Why did this message end up in quarantine for stefan.hayduk@example.com?"

Usage & Copilot Reports

mscloud_service_get_usage_report

Returns a Microsoft 365 usage report as CSV. Common reports include getOffice365ActiveUserDetail, getOffice365ActiveUserCounts, getMailboxUsageDetail, getOneDriveUsageAccountDetail, getSharePointSiteUsageDetail, getTeamsUserActivityUserDetail, getEmailActivityUserDetail, and getOffice365GroupsActivityDetail.

Parameter	Type	Required	Description
report_name	string	✓	Report name (see above).
connection_id	string	—	Target Entra tenant.
period	string	—	D7, D30, D90, or D180. Default D30.

Example prompt.

"Get the Microsoft 365 active user report for the last 30 days."

mscloud_service_get_copilot_usage

Returns the Microsoft 365 Copilot per-user usage report (beta API). Shows Copilot actions per user across M365 apps.

Parameter	Type	Required	Description
connection_id	string	—	Target Entra tenant.
period	string	—	D7, D30, D90, or D180. Default D30.

Example prompt.

"Show me Copilot adoption across the tenant for the last 90 days."

See Also

For Intune managed devices, configuration, compliance, and apps, see Microsoft Cloud — Intune. For users, groups, directory roles, and PIM, see Microsoft Cloud — Identity. For app registrations, Azure infrastructure, and GDAP, see Microsoft Cloud — Platform. For Conditional Access, sign-ins, the Unified Audit Log, Defender, BitLocker, and LAPS, see Microsoft Cloud — Security. For Microsoft 365 service status and message center announcements, see Microsoft Cloud — Service Health. For shadow IT discovery, see Microsoft Cloud — Cloud App Discovery.