MSC - Microsoft Security Center¶

View Microsoft Security Center tenant overview, sign-in activity, conditional access policies, and license inventory.

All commands except msc tenants take a Microsoft tenant ID (GUID). Discover the tenant IDs for the active organization with msc tenants, then pass the value from its TENANT ID column to the other subcommands.

Commands¶

msc tenants - List Microsoft tenants
msc tenant - View tenant overview
msc signins - View sign-in activity aggregates
msc ca-policies - View conditional access policy results
msc licenses - View license inventory

msc tenants¶

List the Microsoft tenants available to the active organization. Tenants are derived from tenant-type, MSC-licensed assets; the Microsoft tenant ID is read from each asset's identifying_properties.tenant_id.

mysecutec msc tenants [flags]

Flags¶

Flag	Type	Default	Description
`--output`, `-o`	string		Output format (json, text)

API¶

1	`GET /tam/v1/assets/?type=tenant&license_module=msc&limit=100`

Query Param	Description
`type`	Filtered to `tenant`
`license_module`	Filtered to `msc`
`limit`	Page size (100)

Request Example¶

mysecutec msc tenants --output json

GET /tam/v1/assets/?type=tenant&license_module=msc&limit=100
Authorization: Bearer <token>
Accept: application/json

msc tenant¶

Display the overview for a Microsoft Security Center tenant, including user, device, group, and app counts.

mysecutec msc tenant <tenant_id> [flags]

Flags¶

Flag	Type	Default	Description
`--output`, `-o`	string		Output format (json, text)

API¶

1	`GET /msc/v1/tenants/{tenant_id}`

Request Example¶

mysecutec msc tenant 00000000-0000-0000-0000-000000000000 --output json

GET /msc/v1/tenants/00000000-0000-0000-0000-000000000000
Authorization: Bearer <token>
Accept: application/json

msc signins¶

View aggregated sign-in activity for a tenant over a date range.

mysecutec msc signins <tenant_id> [flags]

Flags¶

Flag	Type	Description
`--start`	string	Start date (e.g. 2026-01-01)
`--end`	string	End date (e.g. 2026-01-31)
`--group-by`	string	Group by dimension
`--granularity`	string	Time granularity (e.g. day, week, month)

API¶

GET /msc/v1/tenants/{tenant_id}/signins/aggregates?start=&end=&group_by=&granularity=

Query Param	Description
`start`	Start date
`end`	End date
`group_by`	Group by dimension
`granularity`	Time granularity (day, week, month)

Request Example¶

mysecutec msc signins 00000000-0000-0000-0000-000000000000 --start 2026-01-01 --end 2026-01-31 --granularity day

GET /msc/v1/tenants/00000000-0000-0000-0000-000000000000/signins/aggregates?start=2026-01-01&end=2026-01-31&granularity=day
Authorization: Bearer <token>
Accept: application/json

msc ca-policies¶

View conditional access policy results for a tenant over a date range.

mysecutec msc ca-policies <tenant_id> [flags]

Flags¶

Flag	Type	Default	Description
`--start`	string		Start date (e.g. 2026-01-01)
`--end`	string		End date (e.g. 2026-01-31)

API¶

1	`GET /msc/v1/tenants/{tenant_id}/signins/ca-policies?start=&end=`

Query Param	Description
`start`	Start date
`end`	End date

Request Example¶

mysecutec msc ca-policies 00000000-0000-0000-0000-000000000000 --start 2026-01-01 --end 2026-01-31

GET /msc/v1/tenants/00000000-0000-0000-0000-000000000000/signins/ca-policies?start=2026-01-01&end=2026-01-31
Authorization: Bearer <token>
Accept: application/json

msc licenses¶

View the license inventory for a tenant, broken down by SKU.

mysecutec msc licenses <tenant_id> [flags]

Flags¶

Flag	Type	Default	Description
`--output`, `-o`	string		Output format (json, text)

API¶

1	`GET /msc/v1/tenants/{tenant_id}/license-inventory`

Request Example¶

mysecutec msc licenses 00000000-0000-0000-0000-000000000000 --output json

GET /msc/v1/tenants/00000000-0000-0000-0000-000000000000/license-inventory
Authorization: Bearer <token>
Accept: application/json