microsoft / entra-pocadvisor

Every session starts in one of three modes — Guidance Only (no tenant connection, still produces docs, scripts with placeholder values, and diagrams), Read-Only (connects through the Microsoft MCP Server for Enterprise to read live tenant configuration and produce gap-analysis reports), and Read-Write (same read access, but scripts and portal instructions are pre-populated with the tenant's actual values) — and along the way it can generate a POC guide, a gap-analysis report, PowerShell scripts, architecture diagrams, an audit log, and a prerequisite checklist. The README's own overview line claims six Entra Suite products are covered, but its own product table lists seven — Global Secure Access, Private Access, Internet Access, ID Protection, ID Governance, Verified ID, and External Identities — so the table, not the summary line, is the real count.

This is built for administrators already running Entra Suite POCs inside VS Code, not for a general Claude or Cursor workflow: install goes through the GitHub Copilot Skill mechanism, which needs VS Code 1.99 or later, a paid GitHub Copilot subscription (Pro, Business, or Enterprise), and the Copilot extension itself; Read-Only and Read-Write modes additionally require PowerShell 7, because the README documents that the Microsoft Graph PowerShell SDK throws an EventSourceException under PowerShell 5.1. Nobody outside Entra administration gets anything from entra-pocadvisor.

READ THE FULL ANALYSIS＋

It never writes to your tenant directly. Even in Read-Write mode the assistant only produces PowerShell scripts (all -WhatIf-enabled) and portal instructions for a human to review and run; its stated guardrails also block deletions, block changes to Conditional Access policies scoped to all users or apps, and require confirmation before any tenant-wide change, with every MCP call logged to an audit trail.

Official, but not yet proven by adoption. It carries Microsoft's own official mark and an MIT license, but at seven stars it is a very new release with no visible independent usage to check its claims against.