[Petra Security] Get the BLOCKED-attack summary for one tenant: totals by country, by day and by attack type, plus the most-targeted users with the countries their attackers came from. This is the client-reporting and QBR material — attacks that Petra stopped, as opposed to petra_list_incidents, which reports compromises that succeeded. It is an aggregate report, not a raw event list, so there is no paging and no per-event detail. tenantId is REQUIRED and only one tenant is covered per call; Petra allows 10 requests per minute on this endpoint, so a sixty-tenant sweep takes about six minutes. Get tenant ids from petra_list_tenants.

[Petra Security] List identity-compromise incidents detected in Microsoft 365, newest first. OMIT tenantId to sweep every client tenant in the organization — that is the cross-tenant view most questions want ("what is live across my whole book right now?"). Each incident carries isLive, dwellTimeMinutes, remediationStatus, the affected user, and a url that deep-links into the Petra dashboard, so hand that url to a person for anything beyond the list row. remediationStatus values are SCREAMING_SNAKE (REMEDIATED, PARTIALLY_REMEDIATED, UNREMEDIATED, INCORRECT, LOCKED_AWAITING_PASSWORD_RESET, UNCOVERED_IN_BASELINING, REMEDIATED_PRIOR_TO_ONBOARDING, PEN_TEST, ATTACKER_RETAINS_PASSWORD). There is NO incident-detail endpoint and NO cursor: the forensic timeline is dashboard-only, and history deeper than one page is reached by moving startDate back, not by paging. Use petra_list_tenants for tenant ids and petra_get_failed_attacks for attacks that were blocked rather than successful.

[Petra Security] Get the whole-organization Petra billing snapshot in ONE call: for every tenant, the service (Monitoring or Autopsy), billableStatus (Trial, Active, NFR or Deleted), totalLicensedUsers, billableUsersThisMonth, proratingPercentageThisMonth and firstBillableDate. This is the monthly billing-reconciliation tool, and it is the fan-out-free alternative to petra_list_billable_users — prefer it whenever you need counts rather than the names behind them, because it covers every tenant without one call per tenant. Usage is a point-in-time snapshot, not a stream. PAUSED tenants are included here too, so filter on isPaused before counting. Enum casing is deliberately mixed across this response: service and billableStatus are TitleCase while incident statuses elsewhere are SCREAMING_SNAKE.

[Petra Security] List the individual billable users for ONE tenant — the user-level detail behind the count petra_get_usage reports. Reach for it when a client disputes an invoice and you need names, not totals. Each user carries displayName, userPrincipalName, mail, accountEnabled and assignedLicenseSkuIds; a user is billable when that SKU list is non-empty and the account is not deleted. Unpaginated: the whole list comes back in one body. This is a one-tenant-per-call endpoint on a 10-request-per-minute budget, so it is the LAST tool to reach for across many tenants — use petra_get_usage for organization-wide counts instead.

[Petra Security] List every client tenant in your Petra organization. Start here: the other tenant-scoped tools need an id from this list, and guessing one is refused. Each row carries BOTH id namespaces — petraTenantId (Petra's own) and microsoftTenantId (the Entra tenant GUID) — plus name, onboardingDate and isPaused. petra_list_incidents and petra_get_failed_attacks accept either id; petra_list_billable_users accepts only the Petra id. Deleted tenants are excluded, but PAUSED tenants ARE returned with isPaused set to true, so filter on that before reporting a tenant count. Takes no parameters and returns every tenant in one call.