blumira-msp

# Blumira MSP Operations ## Overview Blumira's MSP path group (`/msp/*`) enables managed service providers to operate across multiple client organizations from a single set of credentials. This skill covers account management, cross-account queries, and per-account operations. ## Anti-triggers - **Working inside a single organization with org-level credentials** — the `/msp/*` tools need an MSP-scoped JWT and an `account_id` on every call. Use `blumira-findings`, `blumira-agents`, or `blumira-users`. - **"MSP" meaning the multi-tenant view of another vendor** — an M365-tenant portfolio is `cipp-tenants` or `inforcer-tenant-management`; a CompassOne partner sweep is `blackpoint-multi-tenant-operations`. - **Resolution-type semantics** — the codes behave identically at MSP and org level and are documented once, in `blumira-resolutions`. ## Key Concepts ### MSP vs Org Paths | Feature | Org Path (`/org/*`) | MSP Path (`/msp/*`) | |---------|-------------------|---------------------| | Scope | Single organization | Multiple managed accounts | | Findings | Own findings only | All accounts or per-account | | Devices | Own devices only | Per-account device lists | | Users | Own users only | Per-account user lists | | Auth | Org-level JWT | MSP-level JWT | ### Account Context MSP tools require an `account_id` parameter to target a specific client account. Use `blumira_msp_accounts_list` to enumerate available accounts. ## API Patterns ### List Managed Accounts...