/groups
Tenant-scoped Entra/M365 group enumeration and creation in CIPP, the four group types (Security, Microsoft 365, Distribution, Mail-Enabled Security) and when to pick each, and the boundary where CIPP's group surface ends and Graph/M365 takes over.
$ npx -y skills add wyre-technology/msp-claude-plugins --skill groups --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/groups
Context preview
The summary Claude sees to decide when to auto-load this skill.
Tenant-scoped Entra/M365 group enumeration and creation in CIPP, the four group types (Security, Microsoft 365, Distribution, Mail-Enabled Security) and when to pick each, and the boundary where CIPP's group surface ends and Graph/M365 takes over.
One command to supercharge Claude Code for MSP workflows. Then restart Claude Code. That's it. Documentation: mcp.wyre.ai
Repo: wyre-technology/msp-claude-plugins
Other skills on msp-claude-plugins.
- /account-takeover
Abnormal Security account takeover (ATO) detection: suspicious sign-in signals, impossible travel, mailbox rule changes, lateral-movement indicators, ATO case structure, investigation workflows, and remediation actions.
Open skill - /api-patterns
Abnormal Security REST API fundamentals: Bearer token authentication, base URLs, rate limiting, pagination, OData filtering, request/response formats, and error handling.
Open skill - /cases
Abnormal Security abuse mailbox cases: user-reported email submissions, case statuses and judgments, the case lifecycle, bulk and remediation actions, and phishing simulation handling.
Open skill - /messages
Abnormal Security message analysis: message retrieval, email header inspection, attachments, sender reputation, delivery context, and SPF/DKIM/DMARC authentication results.
Open skill - /threats
Abnormal Security threat detection: threat types (BEC, phishing, malware, socially-engineered attacks, spam, graymail, credential theft), attack vectors, severity assessment, remediation actions, and investigation workflows.
Open skill - /vendors
Abnormal Security VendorBase vendor risk: vendor risk scores and levels, risk factors, compromised-vendor detection, vendor domain analysis, and supply-chain email threat workflows.
Open skill