Tencent SkillHub · Productivity

Ms365 Tenant Manager

Microsoft 365 tenant administration for Global Administrators. Automate M365 tenant setup, Office 365 admin tasks, Azure AD user management, Exchange Online configuration, Teams administration, and security policies. Generate PowerShell scripts for bulk operations, Conditional Access policies, license management, and compliance reporting. Use for M365 tenant manager, Office 365 admin, Azure AD users, Global Administrator, tenant configuration, or Microsoft 365 automation.

skill openclawclawhub Free

0 Downloads

0 Stars

0 Installs

0 Score

High Signal

⬇ 0 downloads ★ 0 stars Unverified but indexed

Install for OpenClaw

Quick setup

Download the package from Yavira.
Extract the archive and review SKILL.md first.
Import or place the package into your OpenClaw setup.

Requirements

Target platform: OpenClaw
Install method: Manual import
Extraction: Extract archive
Prerequisites: OpenClaw
Primary doc: SKILL.md

Package facts

Download mode: Yavira redirect
Package format: ZIP package
Source platform: Tencent SkillHub
What's included: SKILL.md, expected_output.json, references/powershell-templates.md, references/security-policies.md, references/troubleshooting.md, sample_input.json

Validation

Use the Yavira download entry.
Review SKILL.md after the package is downloaded.
Confirm the extracted package contains the expected setup assets.

Install with your agent

Agent handoff

Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.

Download the package from Yavira.
Extract it into a folder your agent can access.
Paste one of the prompts below and point your agent at the extracted folder.

New install

I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.

Upgrade existing

I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.

Open Send to Agent page Open JSON manifest Open Markdown brief

Trust & source

Release facts

Source: Tencent SkillHub
Verification: Indexed source record
Version: 2.1.1

Provenance

Publisher: alirezarezvani
Source page: View original listing
Canonical URL: Open canonical page

Documentation

ClawHub primary doc Primary doc: SKILL.md 14 sections Open source page

Microsoft 365 Tenant Manager

Expert guidance and automation for Microsoft 365 Global Administrators managing tenant setup, user lifecycle, security policies, and organizational optimization.

Run a Security Audit

Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","AuditLog.Read.All" Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits, @{N="Total";E={$_.PrepaidUnits.Enabled}} Get-MgPolicyAuthorizationPolicy | Select-Object AllowInvitesFrom, DefaultUserRolePermissions

Bulk Provision Users from CSV

# CSV columns: DisplayName, UserPrincipalName, Department, LicenseSku Import-Csv .\new_users.csv | ForEach-Object { $passwordProfile = @{ Password = (New-Guid).ToString().Substring(0,16) + "!"; ForceChangePasswordNextSignIn = $true } New-MgUser -DisplayName $_.DisplayName -UserPrincipalName $_.UserPrincipalName ` -Department $_.Department -AccountEnabled -PasswordProfile $passwordProfile }

Create a Conditional Access Policy (MFA for Admins)

$adminRoles = (Get-MgDirectoryRole | Where-Object { $_.DisplayName -match "Admin" }).Id $policy = @{ DisplayName = "Require MFA for Admins" State = "enabledForReportingButNotEnforced" # Start in report-only mode Conditions = @{ Users = @{ IncludeRoles = $adminRoles } } GrantControls = @{ Operator = "OR"; BuiltInControls = @("mfa") } } New-MgIdentityConditionalAccessPolicy -BodyParameter $policy

Workflow 1: New Tenant Setup

Step 1: Generate Setup Checklist Confirm prerequisites before provisioning: Global Admin account created and secured with MFA Custom domain purchased and accessible for DNS edits License SKUs confirmed (E3 vs E5 feature requirements noted) Step 2: Configure and Verify DNS Records # After adding the domain in the M365 admin center, verify propagation before proceeding $domain = "company.com" Resolve-DnsName -Name "_msdcs.$domain" -Type NS -ErrorAction SilentlyContinue # Also run from a shell prompt: # nslookup -type=MX company.com # nslookup -type=TXT company.com # confirm SPF record Wait for DNS propagation (up to 48 h) before bulk user creation. Step 3: Apply Security Baseline # Disable legacy authentication (blocks Basic Auth protocols) $policy = @{ DisplayName = "Block Legacy Authentication" State = "enabled" Conditions = @{ ClientAppTypes = @("exchangeActiveSync","other") } GrantControls = @{ Operator = "OR"; BuiltInControls = @("block") } } New-MgIdentityConditionalAccessPolicy -BodyParameter $policy # Enable unified audit log Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true Step 4: Provision Users $licenseSku = (Get-MgSubscribedSku | Where-Object { $_.SkuPartNumber -eq "ENTERPRISEPACK" }).SkuId Import-Csv .\employees.csv | ForEach-Object { try { $user = New-MgUser -DisplayName $_.DisplayName -UserPrincipalName $_.UserPrincipalName ` -AccountEnabled -PasswordProfile @{ Password = (New-Guid).ToString().Substring(0,12)+"!"; ForceChangePasswordNextSignIn = $true } Set-MgUserLicense -UserId $user.Id -AddLicenses @(@{ SkuId = $licenseSku }) -RemoveLicenses @() Write-Host "Provisioned: $($_.UserPrincipalName)" } catch { Write-Warning "Failed $($_.UserPrincipalName): $_" } } Validation: Spot-check 3–5 accounts in the M365 admin portal; confirm licenses show "Active."

Workflow 2: Security Hardening

Step 1: Run Security Audit Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","AuditLog.Read.All","Reports.Read.All" # Export Conditional Access policy inventory Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName, State | Export-Csv .\ca_policies.csv -NoTypeInformation # Find accounts without MFA registered $report = Get-MgReportAuthenticationMethodUserRegistrationDetail $report | Where-Object { -not $_.IsMfaRegistered } | Select-Object UserPrincipalName, IsMfaRegistered | Export-Csv .\no_mfa_users.csv -NoTypeInformation Write-Host "Audit complete. Review ca_policies.csv and no_mfa_users.csv." Step 2: Create MFA Policy (report-only first) $policy = @{ DisplayName = "Require MFA All Users" State = "enabledForReportingButNotEnforced" Conditions = @{ Users = @{ IncludeUsers = @("All") } } GrantControls = @{ Operator = "OR"; BuiltInControls = @("mfa") } } New-MgIdentityConditionalAccessPolicy -BodyParameter $policy Validation: After 48 h, review Sign-in logs in Entra ID; confirm expected users would be challenged, then change State to "enabled". Step 3: Review Secure Score # Retrieve current Secure Score and top improvement actions Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore, MaxScore, ActiveUserCount Get-MgSecuritySecureScoreControlProfile | Sort-Object -Property ActionType | Select-Object Title, ImplementationStatus, MaxScore | Format-Table -AutoSize

Workflow 3: User Offboarding

Step 1: Block Sign-in and Revoke Sessions $upn = "departing.user@company.com" $user = Get-MgUser -Filter "userPrincipalName eq '$upn'" # Block sign-in immediately Update-MgUser -UserId $user.Id -AccountEnabled:$false # Revoke all active tokens Invoke-MgInvalidateAllUserRefreshToken -UserId $user.Id Write-Host "Sign-in blocked and sessions revoked for $upn" Step 2: Preview with -WhatIf (license removal) # Identify assigned licenses $licenses = (Get-MgUserLicenseDetail -UserId $user.Id).SkuId # Dry-run: print what would be removed $licenses | ForEach-Object { Write-Host "[WhatIf] Would remove SKU: $_" } Step 3: Execute Offboarding # Remove licenses Set-MgUserLicense -UserId $user.Id -AddLicenses @() -RemoveLicenses $licenses # Convert mailbox to shared (requires ExchangeOnlineManagement module) Set-Mailbox -Identity $upn -Type Shared # Remove from all groups Get-MgUserMemberOf -UserId $user.Id | ForEach-Object { try { Remove-MgGroupMemberByRef -GroupId $_.Id -DirectoryObjectId $user.Id } catch {} } Write-Host "Offboarding complete for $upn" Validation: Confirm in the M365 admin portal that the account shows "Blocked," has no active licenses, and the mailbox type is "Shared."

Tenant Setup

Enable MFA before adding users Configure named locations for Conditional Access Use separate admin accounts with PIM Verify custom domains (and DNS propagation) before bulk user creation Apply Microsoft Secure Score recommendations

Security Operations

Start Conditional Access policies in report-only mode Review Sign-in logs for 48 h before enforcing a new policy Never hardcode credentials in scripts — use Azure Key Vault or Get-Credential Enable unified audit logging for all operations Conduct quarterly security reviews and Secure Score check-ins

PowerShell Automation

Prefer Microsoft Graph (Microsoft.Graph module) over legacy MSOnline Include try/catch blocks for error handling Implement Write-Host/Write-Warning logging for audit trails Use -WhatIf or dry-run output before bulk destructive operations Test in a non-production tenant first

Reference Guides

references/powershell-templates.md Ready-to-use script templates Conditional Access policy examples Bulk user provisioning scripts Security audit scripts references/security-policies.md Conditional Access configuration MFA enforcement strategies DLP and retention policies Security baseline settings references/troubleshooting.md Common error resolutions PowerShell module issues Permission troubleshooting DNS propagation problems

Limitations

ConstraintImpactGlobal Admin requiredFull tenant setup needs highest privilegeAPI rate limitsBulk operations may be throttledLicense dependenciesE3/E5 required for advanced featuresHybrid scenariosOn-premises AD needs additional configurationPowerShell prerequisitesMicrosoft.Graph module required

Required PowerShell Modules

Install-Module Microsoft.Graph -Scope CurrentUser Install-Module ExchangeOnlineManagement -Scope CurrentUser Install-Module MicrosoftTeams -Scope CurrentUser

Required Permissions

Global Administrator — Full tenant setup User Administrator — User management Security Administrator — Security policies Exchange Administrator — Mailbox management

Category context

Workflow acceleration for inboxes, docs, calendars, planning, and execution loops.

Source: Tencent SkillHub

Largest current source with strong distribution and engagement signals.

Package contents

Included in package

4 Docs2 Config

SKILL.md Primary doc
references/powershell-templates.md Docs
references/security-policies.md Docs
references/troubleshooting.md Docs
expected_output.json Config
sample_input.json Config