01
The Script Wizard
Generate a PowerShell script to audit inactive AD accounts
Prompt 1
Write a PowerShell script to find all Active Directory accounts that have
been inactive for more than 90 days, including their last logon date, department, and manager.
Export the results to a CSV file.
Prompt 2
Now add error handling, verbose logging to a log file, and wrap it in a
try/catch block. Also add a parameter for the number of inactive days so it's configurable.
Prompt 3
Add email notification functionality — when the script completes,
send an HTML email to the IT admin team with a summary table showing the total count, breakdown
by department, and the top 10 longest-inactive accounts.
02
The Troubleshoot Master
Diagnose a cryptic Azure error and get a step-by-step fix
Prompt 1
Explain this Azure error and tell me exactly what went wrong: 'The client
with object id 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' does not have authorization to perform
action 'Microsoft.Compute/virtualMachines/write' over scope
'/subscriptions/xxxxxxxx/resourceGroups/Production-RG/providers/Microsoft.Compute/virtualMachines/WebServer-01'
or the scope is invalid.'
Prompt 2
What's the minimum RBAC role I need to fix this? Compare the built-in roles
that would work, and recommend the one that follows least-privilege.
Prompt 3
Write me the exact Azure CLI commands to: (1) assign that role to my user,
(2) verify the assignment worked, and (3) retry the failed operation.
03
The KQL Query Builder
Build Sentinel KQL queries from plain English
Prompt 1
Write a KQL query for Microsoft Sentinel that finds all failed sign-in
attempts from IP addresses outside the United States in the last 24 hours. Include the username,
IP address, location, failure reason, and timestamp.
Prompt 2
Now add a summarization that creates a bar chart showing failed attempts by
country and by hour. Include a threshold line at 10 attempts to highlight anomalies.
Prompt 3
Take those suspicious IPs and write a second query that correlates them
against successful logins — I want to find any IP that had both failed AND successful
sign-ins, which could indicate password spraying that succeeded.
04
The Security Reviewer
Review Terraform for security issues
Prompt 1
Review this Terraform configuration for security vulnerabilities and
misconfigurations:
resource "azurerm_network_security_group" "web_nsg" {
name = "web-nsg"
location = azurerm_resource_group.main.location
resource_group_name = azurerm_resource_group.main.name
security_rule {
name = "AllowAll"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "*"
source_port_range = "*"
destination_port_range = "*"
source_address_prefix = "*"
destination_address_prefix = "*"
}
}
resource "azurerm_storage_account" "data" {
name = "appdatastorage"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
account_tier = "Standard"
account_replication_type = "LRS"
min_tls_version = "TLS1_0"
}
Prompt 2
Which CIS Azure benchmarks does this configuration violate? List each
violation with the specific CIS control number and what needs to change.
Prompt 3
Now rewrite both resources following least-privilege and CIS benchmark
compliance. Add comments explaining each security decision you made.
05
The Incident Commander
Turn raw incident details into professional communications
Prompt 1
Draft a P2 incident notification email for internal stakeholders. Here are
the raw details:
- Started: 2:47 PM MST today
- Service: Customer portal (portal.contoso.com)
- Impact: ~30% of users getting 503 errors on login
- Cause: Connection pool exhaustion on backend API servers
- Mitigation: Team is scaling up API server instances
- ETA: 45 minutes to full resolution
Prompt 2
Now write a customer-facing version of this incident notification. Keep it
professional but non-technical — no jargon, no internal details. Include what they're
experiencing, that we're working on it, and when they can expect resolution.
Prompt 3
Generate a Root Cause Analysis (RCA) template for this incident. Include:
incident timeline, root cause analysis section, impact assessment, contributing factors, action
items with owners and due dates, and lessons learned. Pre-fill what you can from the details I
gave you.
06
The Regex Whisperer
Build, explain, and test complex regex patterns in plain English
Prompt 1
Write a regex pattern that validates Azure resource IDs. It should match
the format: /subscriptions/{guid}/resourceGroups/{name}/providers/{namespace}/{type}/{name}
— and explain each part of the pattern in plain English so a junior admin can understand
it.
Prompt 2
Now write a second regex that parses log entries in this format and
extracts the timestamp, severity, source, and message into named capture groups:
2026-04-09T14:32:01.445Z [ERROR] (AuthService) Failed login attempt for user jdoe@contoso.com
from IP 192.168.1.45
Prompt 3
Give me 5 test strings that should match and 5 that should NOT match that
log regex. Then write a PowerShell one-liner that uses that regex to parse a log file and output
only ERROR entries from the last hour as a formatted table.
07
The Bicep Builder
Generate Azure infrastructure-as-code from a plain English description
Prompt 1
Write an Azure Bicep template that deploys a secure web application
environment with: a VNet with 3 subnets (web, app, data), an App Service Plan on P1v3, a Web App
with managed identity enabled, a Key Vault that only the Web App can access, and an Azure SQL
database. Follow security best practices throughout.
Prompt 2
Add diagnostic logging for all resources — send to a Log Analytics
workspace. Also add a private endpoint for the SQL database so it's not exposed to the public
internet. Make sure all connections use private DNS zones.
Prompt 3
Now generate the az CLI deployment commands for this Bicep template,
including creating the resource group, setting up parameter files for dev/staging/prod
environments with different SKUs and sizes, and a what-if dry run command so I can preview
changes before deploying.
08
The Change Request Machine
Draft a complete CAB-ready change request from a few bullet points
Prompt 1
Draft a formal IT change request for our Change Advisory Board. Here are
the details:
- What: Migrate on-prem Exchange 2019 mailboxes to Exchange Online
- Who: 500 users in the Sales and Marketing departments
- When: Saturday April 19, 10 PM — Sunday April 20, 6 AM MST
- Why: End of extended support, reduce infrastructure costs
- Risk: Email downtime during migration window, possible Outlook profile reconfiguration
Include sections for: description, business justification, risk assessment, rollback plan,
testing plan, communication plan, and approval signatures.
Prompt 2
Now write three email templates I'll need for this change: (1) a
pre-migration notice to affected users 1 week before, (2) a reminder the day before with
specific instructions, and (3) a post-migration "all clear" email confirming completion and what
to do if something isn't working.
Prompt 3
Create a detailed migration runbook with step-by-step instructions for the
night of the migration. Include pre-flight checks, the migration commands, validation steps
after each batch, go/no-go decision points, and the exact rollback procedure if we need to
abort. Format it as a numbered checklist the migration team can print out.
09
The On-Call Companion
Triage alerts, diagnose issues, and draft responses at 2 AM
Prompt 1
I just got paged at 2 AM with these Azure Monitor alerts firing
simultaneously:
- High CPU (95%) on 3 of 5 app servers in the web-prod pool
- Memory utilization at 92% on the same servers
- HTTP 5xx error rate spiked to 15% (normal is <0.5%)
- Average response time jumped from 200ms to 4500ms
- No recent deployments in the last 48 hours
What's most likely going on? Walk me through a triage process — what should I check first,
second, third? Give me the specific Azure CLI or PowerShell commands to investigate each step.
Prompt 2
I investigated and found a runaway SQL query from a background job that's
locking tables and causing connection pool exhaustion. Write me the commands to: (1) identify
and kill the blocking SQL sessions, (2) scale up the app servers temporarily to handle the
backlog, and (3) set up an alert rule so this specific pattern triggers a warning before it
becomes critical next time.
Prompt 3
It's 3:30 AM and the issue is resolved. Write me: (1) a quick Teams message
to post in the #incidents channel right now confirming resolution, (2) a handoff note for the
morning team summarizing what happened, what I did, and what still needs follow-up, and (3) a
draft Jira ticket for the dev team to fix the runaway query with all the technical details
they'll need.