Add k12-it-admin-plugin: M365 security auditing for K-12 IT admins

[stevemojica]

What this adds

A new plugin — k12-it-admin-plugin — with 7 Microsoft 365 security audit skills built specifically for K-12 IT administrators.

Most K-12 schools run lean IT teams managing hundreds of staff and student accounts. They're on M365 A1/A3 Education (Entra ID P1 — no P2), don't have a SOC, and often don't have time for PowerShell scripts. This plugin gives them professional-grade M365 security auditing through plain conversational commands, with no extra tooling or licensing required.

Skills included

Skill	What It Does
/threat-scan	Detects credential stuffing, impossible travel, and compromised accounts from Entra sign-in logs
/admin-role-audit	Inventories all privileged roles and flags over-provisioned accounts
/mfa-audit	Checks MFA registration compliance against any security group; optionally enforces via Conditional Access
/ca-audit	Finds gaps in Conditional Access policy coverage (report-only, legacy auth, missing admin policy, etc.)
/oauth-audit	Reviews third-party app consents and high-risk API permissions (FERPA-aware)
/guest-audit	Inventories external/guest accounts and flags stale access
/inactive-accounts	Identifies accounts inactive 30/60/90+ days and accounts that have never signed in

Auth model

Bearer token via browser DevTools (zero setup, works with any M365 account) or optional app registration via Microsoft Graph API for scheduled/automated use. Full instructions in CONNECTORS.md.

Why K-12 specifically

• Designed around Entra ID P1 constraints (no Identity Protection API)
• FERPA-awareness built into OAuth audit risk scoring
• Output language and recommendations written for IT generalists, not security engineers
• Covers the exact attack patterns common in school environments (credential stuffing, shared accounts, never-used migration accounts)

Plugin structure

k12-it-admin-plugin/
├── .claude-plugin/plugin.json
├── .mcp.json
├── CONNECTORS.md
├── README.md
├── commands/ (7 slash commands)
└── skills/ (7 SKILL.md files)

Built and battle-tested running IT for a K-12 private school. Happy to answer questions or adjust based on reviewer feedback.

[stevemojica]

What this adds

A new plugin — k12-it-admin-plugin — with 7 Microsoft 365 security audit skills built specifically for K-12 IT administrators.

Most K-12 schools run lean IT teams managing hundreds of staff and student accounts. They're on M365 A1/A3 Education (Entra ID P1 — no P2), don't have a SOC, and often don't have time for PowerShell scripts. This plugin gives them professional-grade M365 security auditing through plain conversational commands, with no extra tooling or licensing required.

Skills included

Skill	What It Does
/threat-scan	Detects credential stuffing, impossible travel, and compromised accounts from Entra sign-in logs
/admin-role-audit	Inventories all privileged roles and flags over-provisioned accounts
/mfa-audit	Checks MFA registration compliance against any security group; optionally enforces via Conditional Access
/ca-audit	Finds gaps in Conditional Access policy coverage (report-only, legacy auth, missing admin policy, etc.)
/oauth-audit	Reviews third-party app consents and high-risk API permissions (FERPA-aware)
/guest-audit	Inventories external/guest accounts and flags stale access
/inactive-accounts	Identifies accounts inactive 30/60/90+ days and accounts that have never signed in

Auth model

Bearer token via browser DevTools (zero setup, works with any M365 account) or optional app registration via Microsoft Graph API for scheduled/automated use. Full instructions in CONNECTORS.md.

Why K-12 specifically

• Designed around Entra ID P1 constraints (no Identity Protection API)
• FERPA-awareness built into OAuth audit risk scoring
• Output language and recommendations written for IT generalists, not security engineers
• Covers the exact attack patterns common in school environments (credential stuffing, shared accounts, never-used migration accounts)

Plugin structure

k12-it-admin-plugin/
├── .claude-plugin/plugin.json
├── .mcp.json
├── CONNECTORS.md
├── README.md
├── commands/   (7 slash commands)
└── skills/     (7 SKILL.md files)

Built and battle-tested running IT for a K-12 private school. Happy to answer questions or adjust based on reviewer feedback.