AlexanderHolmeset

Thorough Secrets/Credentials Sweep — Reusable Prompt

Paste the prompt below into a new Copilot session whenever you want to run a wide-net audit of your Microsoft 365 content for exposed secrets, credentials, and sensitive links.

---

The Prompt

Scan everything I have access to in Microsoft 365 — emails (inbox, sent, archive, deleted), Teams chats and channel messages, calendar events (descriptions/notes), OneDrive, and every SharePoint site I'm a member of — for exposed secrets, credentials, and sensitive links. Be exhaustive. Treat this as a security audit, not a quick search. >

AlexanderHolmeset

# This is how you can upload and download a file to/from Azure Blob Storage using PowerShell and a SAS URL.
# For download the SAS URL must have read permissions and for upload it must have write permissions.


# Specify the filename to upload
$Filename = "picture.png"

# Replace with your actual SAS URL
$SasUrl = "https://aiswedenholmes7080246781.blob.core.windows.net/files/$($Filename)?sp=rw&st=2025-11-13T12:03:14Z&se=2025-11-13T20:18:14Z&spr=https&sv=2024-11-04&sr=c&sig=Rb0Aqy5Hg6G0PZiJV1M8cYY5MvELK8TXN8gxCu4xqjU%3D"

AlexanderHolmeset

{
  "messages": [
    {
      "role": "system",
      "content": [
        {
          "type": "text",
          "text": "You are an AI assistant that does sentiment analysis on the text you receive on how positive it is. In the response, only give a number between 1 to 10, where 10 is the most possitive. "
        }
      ]

AlexanderHolmeset

$PolicyNameID = "Enter your Policy Name ID here"
$ApplicationId = "xxxxx"
$ClientSecret = "xxxxx"
$TenantId = "xxxxx"


# Connect to PowerApps and Microsoft Graph
# Ensure you have the required modules installed: Microsoft.PowerApps.Administration.PowerShell and Microsoft.Graph
Add-PowerAppsAccount -ApplicationId $ApplicationId -ClientSecret $ClientSecret -TenantID $TenantId

AlexanderHolmeset

#Requires -Modules Microsoft.Graph
# Install the module. (You need admin on the machine.)
# Install-Module Microsoft.Graph

# Set Static Variables
$TenantID="Enter your tenant ID here"
$AutomationAccountDisplayname ="Enter your Automation Account Display Name here"


# Define dynamic variables

AlexanderHolmeset

# Set environment variables or edit the corresponding values here.
$endpoint = "XXXXXXXXXXXXXXXXX"
$api_key = "XXXXXXXXXXXXXXXXX"

$api_version = 'preview'
$headers = @{
    "api-key"    = $api_key
    "Content-Type" = "application/json"
}

AlexanderHolmeset

param
(
    [Parameter(Mandatory=$false)]
    [object] $WebhookData
)

$threshold = 5

# Jira authentication
$Text = "jirasystem@contoso.no:$(Get-AutomationVariable -Name 'JIRA')"

AlexanderHolmeset

# This script will get all VMs with the guest OS "Windows Server" and send the details to a webhook URL in JSON format.
$VMs = get-vm | Where-Object{$_.guest -match "Windows Server"} |Select-Object -Property Name,Guest,CreateDate


# Convert the VM details to JSON format
$body = $VMs | ConvertTo-Json


$webhookURI = "Enter your webhook URL here"
# Send the JSON data to the webhook URL for the Azure Automation runbook

AlexanderHolmeset

# Alexander Holmeset
# Version 1.0
# This script is designed to extract sensitivity labels from files in SharePoint document libraries in one tenant and apply them to the same files in another tenant.
# It uses Microsoft Graph API to interact with SharePoint and sensitivity labels.
# The script connects to two different tenants using app registrations and retrieves files from SharePoint document libraries.
# App regstiration permissions source: Directory.Read.All, Files.Read.All, Sites.Read.All and InformationProtectionPolicy.Read.All
# App regstiration permissions target: Directory.Read.All, Files.ReadWrite.All, Sites.Read.All and InformationProtectionPolicy.Read.All

# Parameters for the app registration source tenant
$ClientId = "xxxxxxx"  

AlexanderHolmeset

# Parameters for the app registration    
$ClientId = "xxxxx"  
$TenantId = "xxxxx"  
$ClientSecret = "xxxxx"  


$NumberOfMajorVersionsToKeep = 20

$TotalSizeAllVersions = 0
$TotalSizeReducedVersions = 0