Admin tools
Free tools for the jobs that come up every week. They all run in your browser, so tokens, logs and SAML never leave your machine.
Decode and diagnose
Sign-in Investigator
Replay sign-in logs on a 3D globe and catch password spray, MFA fatigue and impossible travel.
Sign-in log explainer
Paste a sign-in event from Entra and get a plain-English account of what happened and why.
SAML decoder
Decode a SAMLRequest or SAMLResponse and spot common SSO problems.
JWT decoder
Decode an Entra access or ID token and see what each claim means.
Troubleshooting wizards
Step-by-step paths for sign-in failures, non-compliant devices and SSO errors.
Conditional Access visualiser
Load your policies as JSON, see each in plain English and check them against a baseline.
Certificate decoder
Decode a PEM, CER or SAML metadata certificate: expiry, thumbprints, SANs and key usage.
Email header analyser
Paste message headers to see the route, SPF, DKIM, DMARC and Microsoft 365's spam verdict.
IP range checker
Test IPs against named location ranges, and spot private, overlapping or invalid ranges.
Intune and Autopilot error codes
0x87D1… and 0x8018… codes from app installs, enrolment and Autopilot, explained with what to check.
Event ID lookup
4625, 4771, PRT, hybrid join, LAPS and BitLocker event IDs, explained with what to check.
Look it up
Tenant ID lookup
Find any domain's Entra tenant ID, cloud and region, and whether sign-in is managed or federated.
GUID lookup
Identify any Microsoft app, Entra role or Graph permission GUID from a log or token.
AADSTS error lookup
Common sign-in error codes, explained with what to check.
Graph permission explainer
What a permission allows, how risky it is, and a least-privilege alternative.
Which licence do I need?
Find which Entra and Intune licences include a feature.
MSOnline & AzureAD to Graph
Translate retired PowerShell cmdlets to Microsoft Graph PowerShell.
Timestamp converter
Convert lastLogonTimestamp, pwdLastSet, Unix time and ISO dates, with what each attribute means.
Private endpoint DNS zones
The private DNS zone and on-premises forwarder for each Azure private endpoint.
Licence SKU lookup
Turn SKU part numbers like SPE_E5 into product names and see every service plan.
VM size decoder
What each part of an Azure VM size name means, from family to feature letters.
Least-privilege role finder
Tick the permissions someone needs and find the smallest Azure or Entra built-in role that grants them.
Identity converter
Convert between objectGUID, ImmutableId, Entra object ID, SID and LDAP hex.
Resource ID parser
Split an Azure resource ID or portal URL into its parts, with CLI, PowerShell and KQL to target it.
Plan and check
Tenant health check
Run a read-only script, load the result here and get a scored security report.
Email security checker
Grade a domain's SPF, DKIM, DMARC and MX records and get the records to fix them.
App permission risk check
Find the apps in your tenant that can read every mailbox or change admin roles.
Access Map
Who holds which Entra PIM roles and Azure roles at every scope, with groups expanded and risky access flagged.
Am I affected?
Answer a few questions and get a dated action plan for upcoming Microsoft changes.
Deadline calendar
Every Microsoft deadline on the timeline, as a calendar you can subscribe to.
Azure subnet planner
Lay out VNet subnets with Azure's reserved addresses and minimum gateway, firewall and Bastion sizes.
Azure naming generator
Consistent resource names from Cloud Adoption Framework abbreviations, checked against each type's rules.
Microsoft 365 DNS checker
Check a domain's MX, Autodiscover, DKIM, Teams and Intune enrolment records against what Microsoft expects.
Save time
Conditional Access policy builder
Build a policy from a template or form and get the JSON and Graph PowerShell to create it.
Deadline widget
Show upcoming Microsoft deadlines on your SharePoint intranet or in a Teams tab.
User comms templates
Ready-to-send emails for passkeys, MFA changes, compliance and more.
Change request generator
Fill in a short form and get a complete change request with risk and rollback.
Win32 app command builder
Packaging, silent install and uninstall commands, detection rules and return codes for Intune.
Sign-in KQL builder
Pick filters and get a ready-to-run KQL query for Entra sign-in logs.
Graph query builder
Build $filter and $select queries for users, groups, devices and sign-ins, with Graph PowerShell.
Script library
Every PowerShell, CLI, Graph and KQL snippet on this site, searchable, with a copy button.
KQL library
Ready-to-use Log Analytics queries from posts on this site.
Practice quiz
Test yourself on Entra ID, Intune and Azure, or study with flashcards.
Reference
Built-in roles explained
All 640 Azure and Entra built-in roles: every permission, the risks and how to assign each one.
Event IDs explained
Windows, Entra and Intune event IDs with what to check, plus PowerShell and KQL to find them.
AADSTS errors explained
A page for every common Entra sign-in error code, with the fix.
Graph permissions explained
Every Microsoft Graph permission: IDs, risk, least-privilege options and which apps have it.
Licence SKUs explained
Every Microsoft licence SKU, from SPE_E5 down, with its GUID and service plans.
Intune error codes explained
Enrolment, Autopilot and app install error codes, each with the fix.