This is a powershell module to help implement the AD Tier Model

Manage and maintain Defender XDR custom collection configuration

Multi-tenant Microsoft Graph PIM Activator with MFA Enforcement

KQL Queries. Microsoft Defender, Microsoft Sentinel

Collection of awesome KQL queries for use in Portal and via PowerShell - by @JesseLoudon

A pure PowerShell solution for Entra OAuth authentication, enabling easy retrieval of access and refresh tokens

A comprehensive list of usable Entra ID first-party clients with pre-consented Microsoft Graph scopes, in a simple YAML-file explorable with a simple HTML GUI.

Venture: Cross-Platform GUI tool for parsing and analyzing Windows event logs

12 Lessons to Get Started Building AI Agents

An automated deployment tool that creates instrumented Azure environments with vulnerable systems for simulating attacks and testing Microsoft Sentinel detection capabilities

This is the offical Repository for the Access Package Builder Web App.

This open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed …

This repository contains a wide array of KQL Queries ready for you to easily copy, paste, and execute within Intune.

Microsoft Defender Advanced Threat Protection

A collection of scripts for assessing Microsoft Azure security

Community-driven baseline to accelerate Intune adoption and learning.

Azure Managed Identity Permissions Tool, a new PowerShell tool that simplifies and streamlines the management of Managed Identity permissions in Azure (Entra ID)

track the planet

Enables an LLM to remotely & securely control a jumphost using synchronous or asynchronous GET requests.

Microsoft Entra PowerShell

Intune managed Secured workstation

Maester is a PowerShell based test automation framework to help you stay in control of your Microsoft security configuration.

This publication is a collection of various common attack scenarios on Microsoft Entra ID (formerly known as Azure Active Directory) and how they can be mitigated or detected.

Enable the programmatic deployment and management of Microsoft Defender for Cloud using code

Advanced Hunting Queries for Microsoft Security Products

Expriments