AzureAD

Triage and remediate MSRC/ITD security vulnerabilities for Android Authenticator and Broker. Use code evidence and independent verification to assess risk, right-size severity, and produce finding/on-call/WBR reports. Execute fixes only after explicit…

Generate the weekly Android on-call (OCE) WoW + 60-day trend telemetry reports as polished self-contained HTML. Produces TWO reports by default — the Android Broker report (from `android_spans` materialized views) and the Authenticator app report (from the…

Systematically explore unfamiliar codebases to find implementations, patterns, and architecture. Use this skill when asked to find code, locate implementations, understand how features work, trace call flows, or explore project structure. Triggers include…

Systematically investigate IcM incidents and customer-reported authentication issues for Android Broker/MSAL. Use this skill when asked to investigate an incident, troubleshoot auth failures, analyze customer logs, diagnose PRT/SSO issues, or review IcM…

Analyze Android authentication telemetry using Azure Data Explorer (Kusto). Use this skill for querying android_spans, eSTS correlation, latency investigation, error analysis, and telemetry troubleshooting. Triggers include "query Kusto", "analyze telemetry",…

Understand, navigate, and troubleshoot the Android Auth Client CI/CD pipeline system. Use this skill when asked about pipelines, release processes, build pipelines, hotfix workflows, daily validation, cron schedules, pipeline templates, release branches, RC…

Analyze GitHub Copilot code review effectiveness across Android Auth repositories. Collects all Copilot inline review comments via GitHub API, classifies them as helpful/declined/incorrect/unresolved through reply analysis, diff verification, and AI-assisted…

Decompose high-level feature requests into detailed, repo-targeted PBIs for the Android Auth multi-repo project. Use this skill when a developer describes a feature at a high level and wants it broken down into actionable work items. Triggers include "plan…

Authorization Code Flow for web applications using MSAL.NET confidential client to sign in users and access APIs on their behalf

Client Credentials Flow for service-to-service (daemon) authentication in MSAL.NET without user involvement

Repository-wide MSAL.NET pull request review for correctness, behavioral compatibility, public API contracts, protocol behavior, caching, concurrency, transports, platforms, packaging, performance, security, privacy, and test adequacy. Use before reviewing…

FIC token exchange pattern using assertions for mTLS PoP with MSI and Confidential Client support

Shared terminology, conventions, and patterns for mTLS Proof-of-Possession (PoP) flows in MSAL.NET

Direct mTLS PoP token acquisition for target resources using Managed Identity or Confidential Client

On-Behalf-Of (OBO) Flow for web APIs to call downstream APIs while preserving user identity in MSAL.NET

Guide for adding Microsoft Entra ID (Azure AD) authentication to Aspire applications. Use this when asked to add authentication, Entra ID, Azure AD, OIDC, or identity to an Aspire app, or when working with Microsoft.Identity.Web in Aspire projects.

Provision Entra ID (Azure AD) app registrations for Aspire applications and update configuration. Use after adding Microsoft.Identity.Web authentication code to create or update app registrations, configure scopes, credentials, and update appsettings.json…

Guide for configuring mTLS Proof-of-Possession (PoP) using Microsoft.Identity.Web. Covers all credential types: certificate, pure managed identity, and federated identity credentials (FIC). Use this when asked about mTLS PoP, MTLS_POP protocol scheme,…

Guide GitHub Copilot pull-request reviews for the Common Android Auth library using repository-specific correctness, security, compatibility, telemetry, performance, testing, and comment-quality rules.