msgraph-developer-skills

A GitHub Copilot CLI plugin for building and modernizing Microsoft Graph applications with minimal, purpose-built API clients.

The plugin turns a natural-language use case into working application code. It identifies the required Microsoft Graph endpoints and least-privileged permissions, generates a focused client with Kiota or an AI-assisted workflow, and applies recommended authentication and SDK patterns.

Why use it?

• Generate only the Microsoft Graph API surface your application needs.
• Resolve exact endpoints and least-privileged delegated or application permissions.
• Create new applications or migrate applications from the full Microsoft Graph SDK.
• Apply patterns for pagination, batching, large file uploads, delta queries, and webhooks.
• Include production-oriented authentication, error handling, and setup guidance.

Supported languages

Language	Tested frameworks	Kiota client	AI-generated client
C#	.NET console, ASP.NET Core	Yes	Yes
Python	Console, Flask, Django	Yes	Yes
TypeScript	Console, React, Angular	Yes	Yes

How it works

The orchestrator coordinates four specialized skills:

1. endpoint-resolver identifies the Microsoft Graph endpoints and least-privileged permissions for the use case.
2. generate-sdk-kiota generates or updates a deterministic, modular client with Kiota. This is the default workflow.
3. generate-sdk-ai creates a tightly scoped client from normalized Microsoft Graph OpenAPI contracts when explicitly requested.
4. write-app-code integrates authentication, application logic, error handling, and setup instructions.

flowchart LR
		A[Describe a Graph use case] --> B[Resolve endpoints and permissions]
		B --> C{Client strategy}
		C -->|Default| D[Generate with Kiota]
		C -->|Explicit request| E[Generate with AI]
		D --> F[Write and configure the app]
		E --> F

Prerequisites

• GitHub Copilot CLI, available with all Copilot plans
• A Microsoft Entra tenant and permission to create or use an app registration
• The toolchain for your target language
• .NET SDK and Kiota for the default Kiota workflow

Install Kiota as a global .NET tool if it is not already available:

dotnet tool install --global Microsoft.OpenApi.Kiota

Installation

Start a Copilot CLI session, then install this repository as a plugin:

/plugin install <path-to-this-repository>

Restart the session so Copilot can discover the plugin, then verify the installation:

/plugin list
/skills list

The plugin appears as msgraph-developer-skills. The skills list should include orchestrator, endpoint-resolver, generate-sdk-ai, generate-sdk-kiota, and write-app-code.

If installation fails with Access is denied. (os error 5), close processes that are using the repository, including terminals or editor windows opened in that directory, and try again.

Usage

Describe the application, Microsoft Graph use case, language, and preferred client strategy. Kiota is used unless you explicitly request an AI-generated client.

Create an application with Kiota

Generate a .NET background service named InactiveUsers that runs every hour
and lists users in the tenant who have not signed in during the last 30 days.
Use a modular Microsoft Graph SDK generated with Kiota.

Create an application with an AI-generated client

Create a Python Flask application named DailyTasks that reads my inbox and
today's calendar events, then generates a summary. Use an AI-generated,
purpose-built Microsoft Graph client.

Migrate an existing application

Migrate this application from the full Microsoft Graph SDK to a modular client generated with Kiota.

Replace the Microsoft Graph integration in this application with an AI-generated client.

Generated applications include instructions for registering the application in Microsoft Entra ID, granting permissions, configuring authentication, and running the project locally. Review all generated code and requested permissions before deploying it.

Client strategies

Both strategies are designed to produce focused application clients. Choose based on how you plan to maintain the generated API surface.

Capability	Kiota	AI-generated client
Best suited for	Extensible, deterministic clients	Highly scoped clients
API surface	Selected endpoint model graph	Models required by the use case
Generation speed	Faster	Slower
Updating the client	Supported with kiota update	Regenerate the client
Default strategy	Yes	No, must be requested

Evaluation

The evals directory contains Waza tasks, graders, schemas, and recorded results. The evaluation suites cover:

• Endpoint and least-privileged permission resolution
• Static checks for modifying existing .NET applications
• End-to-end generation for C#, Python, and TypeScript applications
• Compilation, SDK usage, error handling, and application setup guidance

Example commands:

# Compare endpoint resolution with and without the skill.
waza run evals/endpoint-resolver/eval.yaml -v \
	-o evals/endpoint-resolver/indiv-results.json \
	--baseline --model claude-sonnet-4.6

# Generate new applications and retain their workspaces for inspection.
waza run evals/new-apps/eval.yaml -v \
	-o evals/new-apps/results.json \
	--keep-workspace

# Explore results in the Waza dashboard.
waza serve --results-dir evals

Evaluation output is intended for local inspection. Do not commit verbose logs or generated workspaces unless a maintainer is intentionally refreshing the repository's recorded evaluation results.

Recorded evaluations show the following results. Treat these figures as directional: outcomes vary by model, prompt, toolchain version, and evaluation task.

Evaluation	General model knowledge	With developer skills
Exact endpoints and least-privileged permissions	80%	95%
Advanced SDK core patterns	66%	96%
Applications that run on the first attempt	55%	78%

• Models evaluated: MAI Code 1 Flash, Gemini 3.6 Flash, Gemini 3.1 Pro Preview, Claude Opus 4.8, Claude Sonnet 4.6, Claude Haiku 4.5, GPT 5.5
• Models recommended: Gemini 3.6 Flash, Gemini 3.1 Pro, Claude Opus 4.8, Claude Sonnet 4.6

Project structure

.
|-- .github/plugin/       # Copilot CLI plugin manifest
|-- skills/               # Skill instructions, references, and scripts
|   |-- orchestrator/
|   |-- endpoint-resolver/
|   |-- generate-sdk-kiota/
|   |-- generate-sdk-ai/
|   `-- write-app-code/
`-- evals/                # Waza evaluation suites and recorded results

Contributing

See the contribution guidelines and the Microsoft Open Source Code of Conduct.

Security

Generated applications can request access to organizational Microsoft 365 data. Always verify generated endpoints, permissions, authentication flows, and secret handling before use. Grant only the permissions required by the scenario, and do not commit credentials or tenant configuration. To report a vulnerability, follow the security policy.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft’s Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos is subject to those third-party’s policies.

License

Copyright (c) Microsoft Corporation. All Rights Reserved. Licensed under the MIT License.