Name: setup-auth
Rating: 72 (1 reviews)
Author: microsoft

setup-auth

Use when the user asks to "set up authentication", "add login", "add logout", "add sign in", "enable auth", "add role-based access", "add authorization", "protect routes", "configure identity provider", "configure Entra ID", "configure Entra External ID", "configure OpenID Connect", "add OIDC", "set up SAML", "set up WS-Federation", "set up local login", "add Facebook login", "add Google sign in", "add Microsoft Account", or otherwise wants to set up authentication (login/logout) and role-based authorization for their Power Pages code site using any supported identity provider. Also sets up the IdP app registration for OIDC providers (Okta, Auth0, Entra External ID, and other OIDC) -- reads the provider's docs first, then either guides the user through the provider's console or, when the provider supports it, configures it for the user -- and wires the client ID, authority, and claims mapping into Power Pages.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and workflow-rich, with strong validation checkpoints and well-signaled references to real bundle files. Its main weakness is conciseness — the sheer length and verbatim-repeated blocks (e.g. the multi-tenant contact-linking warning) could be consolidated into the reference files.

Suggestions

Consolidate the four verbatim repeats of the multi-tenant AllowContactMappingWithEmail warning into a single shared note in authorization-reference.md and link to it from each provider section.

Move the large per-provider site-setting tables and IdP walkthrough steps (Phase 2.1 / 8.1) into the existing reference files, keeping SKILL.md as an overview that links out.

Trim repeated 'IMPORTANT/CRITICAL' preamble paragraphs that restate the same server-side-auth / no-secret-flow points across multiple phases.

Dimension	Reasoning	Score
Conciseness	At ~30k words / 3000 lines the body is very large, and several blocks are repeated verbatim (the multi-tenant AllowContactMappingWithEmail warning appears four times); while the content is domain-specific rather than basic-concept padding, the volume and redundancy could be tightened. This sits above score 2 (not heavily padded with concepts Claude knows) but below score 4 (still has noticeable repetition and bulk).	3 / 5
Actionability	Highly executable throughout — exact site-setting names, copy-paste CLI invocations with full argument lists, form-POST endpoints, file paths, and concrete code/type declarations covering the common provider cases.	5 / 5
Workflow Clarity	Eight clearly sequenced phases with explicit validation checkpoints — regex 'Validate ... re-prompt on mismatch', 'execute sequentially and verify each step. Never one-shot', Phase 7 build/UI verification, and fix-and-retry feedback loops for destructive/batch operations (site settings, git commits, IDP provisioning).	5 / 5
Progressive Disclosure	Clear overview with well-signaled one-level-deep references to three real skill-local files (authentication-reference.md, authorization-reference.md, idp-provisioning-reference.md), each introduced with 'Reference:' / 'See ... for ...'. Held below 5 because the SKILL.md itself inlines a large volume of per-provider detail and referenceable tables that could live in the bundle files.	4 / 5
	Total	17 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: specific concrete actions, an exhaustive set of natural trigger phrases, explicit what-and-when guidance, and a clearly distinct niche. No vague fluff or over-claims.

Dimension	Reasoning	Score
Specificity	Names the domain (Power Pages) and lists multiple concrete actions — 'set up authentication (login/logout) and role-based authorization', 'sets up the IdP app registration', 'wires the client ID, authority, and claims mapping' — with comprehensive coverage, matching the score-5 anchor.	5 / 5
Completeness	Explicitly answers both 'what' (auth/RBAC for a Power Pages code site, IdP app registration, claims wiring) and 'when' via an explicit 'Use when the user asks to...' clause with concrete trigger phrases.	5 / 5
Trigger Term Quality	Comprehensive natural trigger phrases users would actually say — 'set up authentication', 'add login', 'add logout', 'add sign in', 'enable auth', 'protect routes', 'configure identity provider', 'configure Entra ID', 'add OIDC', 'set up SAML', 'add Facebook login', 'add Google sign in' — including synonyms and provider names.	5 / 5
Distinctiveness Conflict Risk	Tightly scoped to 'Power Pages code site' with named identity providers, giving it a clear niche and minimal conflict risk with other skills.	5 / 5
	Total	20 / 20 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (3058 lines); consider splitting into references/ and linking	Warning
allowed_tools_field	'allowed-tools' contains unusual tool name(s)	Warning
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	13 / 16 Passed

Repository: microsoft/power-platform-skills
Path: plugins/power-pages/skills/setup-auth/SKILL.md
Commit: 4c284ab

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.