m365-eligibility-renew

name: m365-eligibility-renew

description: Renews all expired and expiring M365 eligibilities for the current user via the M365 Pulse Identity Hub. Use when the user wants to renew their access eligibilities.

disable-model-invocation: true

allowed-tools: mcp__playwright__browser_navigate, mcp__playwright__browser_snapshot, mcp__playwright__browser_take_screenshot, mcp__playwright__browser_click, mcp__playwright__browser_type, mcp__playwright__browser_wait_for, mcp__playwright__browser_tabs, mcp__playwright__browser_evaluate, mcp__playwright__browser_press_key

Renew all expired and expiring M365 eligibilities for the current user.

Arguments

Parse $ARGUMENTS for the following flags:

--help — print usage information and stop. No browser actions are taken.
--list — only display the expired and expiring eligibilities without renewing anything. No flyouts, no clicks. Just report the list grouped by status and stop.
--first — only process the first expired or expiring eligibility in the list, then stop.
--name <value> — only process the eligibility whose name exactly matches <value>. If found but not expired/expiring, report it as skipped with its current status. If not found at all, report it as not found.
--batch — renew all expired and expiring eligibilities at once using the bulk checkbox approach (check all rows, click Renew Eligibility, then click Renew in the flyout).
--check-pending-manager — navigate to the Eligibility Dashboard, find the Pending section, and list all eligibilities with status PendingManagerApproval. No renewals are performed.

--help takes priority over all other flags. --list takes priority over all remaining flags. --check-pending-manager takes priority over renewal flags. --name takes priority over --first. --batch is mutually exclusive with --name and --first.

Steps

0. Handle `--help`

If --help was passed, do not open any browser or perform any actions. Print the following and stop:


Usage: /m365-eligibility-renew [options]



Renews expired and expiring M365 eligibilities via M365 Pulse Identity Hub.



Options:

  (no flags)               Renew ALL expired and expiring eligibilities one by one

  --list                   Display expired/expiring eligibilities without renewing

  --first                  Renew only the first expired or expiring eligibility

  --name <value>           Renew the eligibility whose name exactly matches <value>

  --batch                  Renew all expired/expiring eligibilities using bulk checkbox

  --check-pending-manager  List eligibilities pending manager approval (no renewals)

  --help                   Show this help message



Priority: --help > --list > --check-pending-manager > --name > --first

Note: --batch is mutually exclusive with --name and --first.

0b. Handle `--check-pending-manager`

If --check-pending-manager was passed, skip all renewal steps entirely and do the following:

Navigate to:


https://m365pulse.microsoft.com/idm/identity/access/Eligibilities/EligibilityDashboard

Take a screenshot. Handle login if needed (same as Step 2 below).
Wait for the page to load. Take a snapshot and look for a section titled Pending (or similar).
Within that section, identify all eligibilities whose status is PendingManagerApproval.
Scroll down if needed to capture the full list.
Report the results (see Step 5 — --check-pending-manager report).
After reporting, send a Teams message to Muhammad Kapasi with the list (see Step 0c below). Do not proceed to any renewal steps.

0c. Send Teams Message (after `--check-pending-manager`)

After collecting and reporting the pending eligibilities list, open Microsoft Teams in a new browser tab and send a message to Muhammad Kapasi (alias: mukapasi):

Open a new tab and navigate to:
```
https://teams.microsoft.com
```
Wait for Teams to fully load — do NOT use a fixed time wait. Instead, wait for a specific UI element to appear (e.g. the "Chat" heading or the compose/filter toolbar). Take a screenshot to confirm Teams has loaded.
First, check for an existing chat with Muhammad Kapasi in the chat list on the left. Scan the visible chat entries for "Muhammad Kapasi". If found, click directly into that existing conversation — skip steps 4–6.
If no existing chat is found, click the "New items" button (the + icon with a dropdown arrow, in the Chat header toolbar). A dropdown menu will appear with options: New message, New channel, etc.
Click "New message" from the dropdown. A new compose view will open with a "To:" field.
In the "To:" field, type mukapasi (the alias) and wait for search results. Take a screenshot. From the results, click on Muhammad Kapasi — skip any result marked "(You)". If no result matches, try typing Muhammad Kapasi as a fallback.
Click into the message compose box at the bottom of the chat.
Compose the following message using the clipboard paste method for reliability:
- Use mcp__playwright__browser_evaluate to write the full message text to the clipboard via navigator.clipboard.writeText(...), then use mcp__playwright__browser_press_key with Meta+v (macOS) or Control+v (Windows) to paste it into the compose box.
- The message text (substitute the actual list):
```
Hi Muhammad, here's a summary of my eligibilities currently pending your manager approval:



- <eligibility name 1>

- <eligibility name 2>

...



Could you please approve them when you get a chance? Thanks!
```
Before sending, take a screenshot and show the user the composed message for confirmation. Ask:

"Ready to send this Teams message to Muhammad Kapasi. Shall I proceed?"
Wait for the user to confirm. Once confirmed, press Meta+Enter (macOS) or Control+Enter (Windows) to send the message.
Take a screenshot to confirm the message was sent (compose box should be empty and message should appear in the chat).

1. Open the Eligibilities Page

Use the Playwright MCP tool to navigate to:


https://m365pulse.microsoft.com/idm/identity/access/Eligibilities/MyEligibility

Take a screenshot after navigation.

2. Handle Login if Needed

If the page shows a Microsoft login screen (i.e. the URL contains login.microsoftonline.com or login.live.com), inform the user:

"The browser needs you to log in. Please complete the login in the Playwright browser window, then let me know when you're done."

Wait for the user to confirm they've logged in, then take a screenshot to confirm the eligibilities page is loaded before continuing.

3. Find All Eligible Items to Renew

Take a screenshot and snapshot of the page. Scroll down if needed to capture all items.

If --list was provided: identify all rows where Status is Expired or Expiring (Inactivity), then skip directly to step 5 (List Report) without opening any flyouts or clicking Renew.
If --name was provided: locate the single row whose name matches exactly. If not found, stop and report it as not found.
Otherwise: identify all rows where the Status is Expired (red) or Expiring (Inactivity) (yellow/orange) and collect the full list before starting renewals.

4. Renew Each Eligibility

If --name was passed, --first was passed, or no flags were passed (default), use the individual flyout approach — one eligibility at a time:

For --name: process only that one matching eligibility.
For --first: process only the first expired or expiring eligibility in the list.
For no flags (renewing all): iterate through every expired or expiring eligibility one by one, in list order.

For each eligibility to process:

Click on the eligibility name in the grid to open the flyout panel on the right.
Take a screenshot to confirm the flyout opened.
Check if a Renew button is present at the bottom of the flyout.
- If Renew button exists: Click it. Check whether the UI shows a success message (e.g. "Request submitted successfully for approval.") or an error. Take a screenshot. Record the outcome as submission succeeded or submission failed based on what the UI shows — do not wait for the actual approval to complete.
  - If the error mentions a prerequisite eligibility (e.g. "The prerequisite eligibility 'X' exists but is not active or pending provisioning"): extract the prerequisite name X from the error message and record a suggestion to run /m365-eligibility-renew --name "X" first, then retry this one.
- If no Renew button (or button is disabled/grayed out): Record the eligibility name, status, and any visible reason as could not start renewal. Close the flyout and move on.
Close the flyout (or it may close automatically) before moving to the next item.

If --batch was passed, use the bulk checkbox approach:

Check the checkbox for every row whose Status is Expired or Expiring (Inactivity). Do not use "Select all items" — check them individually so you have explicit control over which ones are selected.
Take a screenshot, then click the Renew Eligibility button/link above the table.
A bulk flyout/panel should open. Take a screenshot to confirm.
Check whether the Renew button inside the bulk flyout is enabled or disabled:
- If enabled: Click it. Wait for the result. Take a screenshot. Record all checked eligibilities as submission succeeded or submission failed based on what the UI shows.
- If disabled (one or more eligibilities are blocking the action):
  
  a. Look for any indication in the flyout of which eligibilities are problematic (e.g. validation errors, red indicators, or "prerequisite" messages). Note their names.
  
  b. Close the flyout.
  
  c. Uncheck the problematic eligibilities from the grid.
  
  d. Click Renew Eligibility again for the remaining checked items.
  
  e. Repeat until either the Renew button becomes enabled or no items remain checkable.
  
  f. Record skipped/problematic ones separately with any visible reason, including prerequisite suggestions where applicable.
After bulk renewal, if any eligibilities could not be included due to prerequisite errors, for each one extract the prerequisite name from any error text and record a suggestion to run /m365-eligibility-renew --name "<prerequisite>" first.

5. Report Results

If --check-pending-manager was passed, report only the pending manager approvals — no renewal actions were taken:


## M365 Eligibility — Pending Manager Approval



- EligibilityName — Requested On: <date> (if visible)

If none are found, say: "No eligibilities are currently pending manager approval."

Remind the user they can run /m365-eligibility-renew --name "<name>" to retry submitting a specific one if needed.

If --list was passed, report only the list — no renewal actions were taken:


## M365 Eligibility Status



### Expired

- EligibilityName — Expired On: <date>



### Expiring (Inactivity)

- EligibilityName — Expires On: <date>

Remind the user they can run /m365-eligibility-renew --name <name> to renew a specific one.

Otherwise, provide a renewal summary. Clarify that results reflect whether the renewal request was successfully submitted, not whether it was approved.

Renewal Request Submitted - list each eligibility name and its previous status.

Could Not Submit Renewal - list each eligibility name with the reason visible in the UI, or "No Renew button available" if none was shown. For prerequisite errors, include a suggestion:

To fix: run /m365-eligibility-renew --name "<prerequisite name>" first, then retry this eligibility.

If all submissions succeeded, say so clearly. If any failed, explain what was visible in the UI for each failure.