Andy Kemp Consulting · Free tools
Practical tools for Microsoft 365, Zero Trust & Privileged Access
Free assessment and design tools built from hands-on consulting work. Find the gaps in your tenant, design the controls to close them, and plan the rollout — before you commit to a delivery plan.
Focus area
Zero Trust
Assess where you stand against Microsoft's Zero Trust principles, then design the Conditional Access and authentication controls to close the gaps.
Zero Trust Scorecard
Assess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.
Zero Trust Remediation Planner
Generate a prioritised remediation plan with step-by-step actions, admin portal links, and effort estimates.
Conditional Access Policy Designer
Design a baseline set of Conditional Access policies aligned to Microsoft best practices for your environment.
Auth Guide
Step-by-step help for your users: passkeys, number-matching MFA and security keys, sign-in on Windows, Mac, iPhone and Android, and what to do after a new or lost phone.
Phish-Resistant MFA Rollout Planner
Plan a phased MFA rollout with communication templates, success criteria, and risk mitigation for each wave.
Focus area
Privileged Access
Design how admin access works in your tenant: who holds which roles, how they activate them, and what protects them.
PIM Role Designer
Design PIM around the Trust Level Framework (TL1–TL4). Analyse who holds each admin role in your tenant today, then deploy the design with a reviewed, reversible script.
Break-glass Account Builder
Coming soonDesign emergency access accounts properly: the accounts, the Conditional Access exclusions they need, and the alerts that watch them.
App Permission Risk Checker
Coming soonPaste an app's Microsoft Graph permissions and see which ones put your tenant at risk, and why.
Privileged Access Maturity Assessment
Coming soonScore your privileged access programme across roles, authentication, devices, non-human identities and governance.
Focus area
Microsoft 365 Security
Audit your tenant's security and compliance configuration, directory hygiene, licensing and resilience.
Tenant Security & Compliance Audit
Comprehensive eight-domain audit of your Microsoft 365 tenant — designed to be performed with least-privilege, read-only permissions.
Entra ID Hygiene Scorecard
Score your directory hygiene across account lifecycle, guest management, app registrations, and group governance.
M365 Licence Optimiser
Identify redundant licences, consolidation opportunities, and estimated cost savings across your Microsoft 365 estate.
Backup & Recovery Readiness
Evaluate your Microsoft 365 backup posture across workload coverage, strategy, resilience targets, and operational maturity.
Tenant Migration
Planning tools for tenant-to-tenant migrations: readiness, batching and domain cutover.
T2T Migration Readiness Assessment
Estimate migration complexity and identify key risks before committing to a tenant-to-tenant migration plan.
Migration Batch Planner
Group users into migration batches based on access patterns and dependency relationships to avoid breaking user experience.
DNS & Domain Cutover Checklist
Generate a prioritised, interactive checklist for domain cutover covering DNS, mail routing, certificates, and validation.
For full migration planning, automated dependency mapping and batch sequencing, TenantLift is in development — a product for consultants and IT teams running complex tenant-to-tenant migrations.
Windows Tools
Desktop utilities for Windows imaging, deployment, and device management. Open-source and available on GitHub.
Windows 11 Image & USB Creator
Native .NET 8 WPF desktop application (v4.4.1) for slipstreaming hardware drivers from MSI packages into Windows 11 ISOs, removing bloatware (Xbox, OneDrive, Teams, etc.), controlling which Windows editions are included, and creating UEFI-compatible bootable USB drives. Designed for Surface and other hardware. Single-file exe — no install required.
Why these tools exist
Most security improvement and migration projects start with incomplete information. Teams commit to timelines before understanding their real gaps — standing admin access, weak authentication, Conditional Access holes, and identity models that make change hard.
These tools are built from patterns seen across real consulting engagements. They give you a fast, honest read on where you stand and a practical design to work from. Everything runs in your browser — nothing you enter is sent anywhere.