Andy Kemp Consulting · Free tools
Practical tools for Microsoft 365, Zero Trust & Privileged Access
Free assessment and design tools built from hands-on consulting work. Find the gaps in your tenant, design the controls to close them, and plan the rollout — before you commit to a delivery plan.
Live · Run by Andy Kemp Consulting
Microsoft 365 Tenant Audit
A read-only audit of your real tenant: around 50 checks, scored and mapped to recognised frameworks. Request it, approve read-only access in your own Entra tenant, and receive a high-level report. Remove the app registration when it's done.
Live · Installs into your Azure
Auth-Onboard: passkey campaigns
Move your users from SMS and codes to passkeys in batches, with invitations in your branding, automatic follow-up and a report leadership can read. Admins are never enrolled. Click around the live demo first.
Focus area
Zero Trust
Assess where you stand against Microsoft's Zero Trust principles, then design the Conditional Access and authentication controls to close the gaps.
Zero Trust Scorecard
Assess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.
Zero Trust Remediation Planner
Generate a prioritised remediation plan with step-by-step actions, admin portal links, and effort estimates.
Conditional Access Policy Builder
Build a persona-based Conditional Access policy set around the Trust Levels, edit each policy visually, and export Graph JSON with a script that deploys it in report-only.
Auth-Onboard
Run a passkey and MFA campaign for your users: find who's on SMS or codes, invite them in batches in your branding, follow up automatically and report progress. Installs into your own Azure. Try the live demo.
Auth Guide
Step-by-step help for your users: passkeys, number-matching MFA and security keys, sign-in on Windows, Mac, iPhone and Android, and what to do after a new or lost phone.
Phish-Resistant MFA Rollout Planner
Plan a phased MFA rollout with communication templates, success criteria, and risk mitigation for each wave.
Focus area
Privileged Access
Design how admin access works in your tenant: who holds which roles, how they activate them, and what protects them.
PIM Role Designer
Design PIM around the Trust Level Framework (TL1–TL4). Analyse who holds each admin role in your tenant today, then deploy the design with a reviewed, reversible script.
Break-glass Account Builder
Design emergency access accounts properly: sign-in methods, custody, Conditional Access exclusions, alert queries, a test plan and a runbook, mapped to Microsoft, CIS, NCSC, NIST and ISM guidance.
App Permission Risk Checker
Coming soonPaste an app's Microsoft Graph permissions and see which ones put your tenant at risk, and why.
Privileged Access Maturity Assessment
Coming soonScore your privileged access programme across roles, authentication, devices, non-human identities and governance.
Focus area
Microsoft 365 Security
Audit your tenant's security and compliance configuration, directory hygiene, licensing and resilience.
Tenant Security Self-Assessment
Score your own Microsoft 365 tenant across eight security and compliance domains, using read-only access. For an audit of your real tenant, see Tenant Audit.
Entra ID Hygiene Scorecard
Score your directory hygiene across account lifecycle, guest management, app registrations, and group governance.
M365 Licence Optimiser
Identify redundant licences, consolidation opportunities, and estimated cost savings across your Microsoft 365 estate.
Backup & Recovery Readiness
Evaluate your Microsoft 365 backup posture across workload coverage, strategy, resilience targets, and operational maturity.
Focus area
Cloud Desktops
Choose between Windows 365 and Azure Virtual Desktop, size it and decide how users connect, then deploy it with W365 Deploy or AVD Deploy.
Cloud Desktop Advisor
Windows 365 or Azure Virtual Desktop? Get a recommendation with the reasons, AVD session host sizing, Windows 365 editions and sizes, and how users should connect, including Windows 365 Link and Boot.
W365 Deploy
Set up Windows 365 Cloud PCs in your own tenant step by step: the provisioning policy, user settings, groups and licences, checked before anything changes, all from the browser. Try the live demo.
AVD Deploy
Design, check and deploy Azure Virtual Desktop into your own subscription step by step, then finish the Entra and Conditional Access setup, all from the browser. Try the live demo.
Tenant Migration
Planning tools for tenant-to-tenant migrations: readiness, batching and domain cutover.
T2T Migration Readiness Assessment
Estimate migration complexity and identify key risks before committing to a tenant-to-tenant migration plan.
Migration Batch Planner
Group users into migration batches based on access patterns and dependency relationships to avoid breaking user experience.
DNS & Domain Cutover Checklist
Generate a prioritised, interactive checklist for domain cutover covering DNS, mail routing, certificates, and validation.
For full migration planning, automated dependency mapping and batch sequencing, TenantLift is in development — a product for consultants and IT teams running complex tenant-to-tenant migrations.
Windows Tools
Desktop utilities for Windows imaging, deployment, and device management. Open-source and available on GitHub.
Win11 Image Prep
A Windows app that builds Windows 11 install media with your driver packs already in it: only the editions you deploy, built-in apps removed, unattended or Autopilot setup, and a bootable USB at the end. Try the live demo.
Why these tools exist
Most security improvement and migration projects start with incomplete information. Teams commit to timelines before understanding their real gaps — standing admin access, weak authentication, Conditional Access holes, and identity models that make change hard.
These tools are built from patterns seen across real consulting engagements. They give you a fast, honest read on where you stand and a practical design to work from. Everything runs in your browser — nothing you enter is sent anywhere.