Andy Kemp Consulting · Free tools
Practical tools for Microsoft 365, Zero Trust & Privileged Access
Free assessment and design tools built from hands-on consulting work. Find the gaps in your tenant, design the controls to close them, and plan the rollout — before you commit to a delivery plan.
Live · Run by Andy Kemp Consulting
Microsoft 365 Tenant Audit
A read-only audit of your real tenant: around 50 checks, scored and mapped to recognised frameworks. Request it, approve read-only access in your own Entra tenant, and receive a high-level report. Remove the app registration when it's done.
Focus area
Zero Trust
Assess where you stand against Microsoft's Zero Trust principles, then design the Conditional Access and authentication controls to close the gaps.
Zero Trust Scorecard
Assess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.
Zero Trust Remediation Planner
Generate a prioritised remediation plan with step-by-step actions, admin portal links, and effort estimates.
Conditional Access Policy Designer
Design a baseline set of Conditional Access policies aligned to Microsoft best practices for your environment.
Auth Guide
Step-by-step help for your users: passkeys, number-matching MFA and security keys, sign-in on Windows, Mac, iPhone and Android, and what to do after a new or lost phone.
Phish-Resistant MFA Rollout Planner
Plan a phased MFA rollout with communication templates, success criteria, and risk mitigation for each wave.
Focus area
Privileged Access
Design how admin access works in your tenant: who holds which roles, how they activate them, and what protects them.
PIM Role Designer
Design PIM around the Trust Level Framework (TL1–TL4). Analyse who holds each admin role in your tenant today, then deploy the design with a reviewed, reversible script.
Break-glass Account Builder
Design emergency access accounts properly: sign-in methods, custody, Conditional Access exclusions, alert queries, a test plan and a runbook, mapped to Microsoft, CIS, NCSC, NIST and ISM guidance.
App Permission Risk Checker
Coming soonPaste an app's Microsoft Graph permissions and see which ones put your tenant at risk, and why.
Privileged Access Maturity Assessment
Coming soonScore your privileged access programme across roles, authentication, devices, non-human identities and governance.
Focus area
Microsoft 365 Security
Audit your tenant's security and compliance configuration, directory hygiene, licensing and resilience.
Tenant Security Self-Assessment
Score your own Microsoft 365 tenant across eight security and compliance domains, using read-only access. For an audit of your real tenant, see Tenant Audit.
Entra ID Hygiene Scorecard
Score your directory hygiene across account lifecycle, guest management, app registrations, and group governance.
M365 Licence Optimiser
Identify redundant licences, consolidation opportunities, and estimated cost savings across your Microsoft 365 estate.
Backup & Recovery Readiness
Evaluate your Microsoft 365 backup posture across workload coverage, strategy, resilience targets, and operational maturity.
Focus area
Cloud Desktops
Choose between Windows 365 and Azure Virtual Desktop, size it and decide how users connect, then deploy it with W365 Deploy or AVD Deploy.
Cloud Desktop Advisor
Windows 365 or Azure Virtual Desktop? Get a recommendation with the reasons, AVD session host sizing, Windows 365 editions and sizes, and how users should connect, including Windows 365 Link and Boot.
W365 Deploy
Plan and deploy Windows 365 step by step, from licences and network to provisioning your Cloud PCs. Free with an Andy Kemp Consulting account.
AVD Deploy
Design and deploy Azure Virtual Desktop step by step: host pools, session hosts and the supporting Azure resources. Free with an Andy Kemp Consulting account.
Tenant Migration
Planning tools for tenant-to-tenant migrations: readiness, batching and domain cutover.
T2T Migration Readiness Assessment
Estimate migration complexity and identify key risks before committing to a tenant-to-tenant migration plan.
Migration Batch Planner
Group users into migration batches based on access patterns and dependency relationships to avoid breaking user experience.
DNS & Domain Cutover Checklist
Generate a prioritised, interactive checklist for domain cutover covering DNS, mail routing, certificates, and validation.
For full migration planning, automated dependency mapping and batch sequencing, TenantLift is in development — a product for consultants and IT teams running complex tenant-to-tenant migrations.
Windows Tools
Desktop utilities for Windows imaging, deployment, and device management. Open-source and available on GitHub.
Windows 11 Image & USB Creator
Native .NET 8 WPF desktop application (v4.4.1) for slipstreaming hardware drivers from MSI packages into Windows 11 ISOs, removing bloatware (Xbox, OneDrive, Teams, etc.), controlling which Windows editions are included, and creating UEFI-compatible bootable USB drives. Designed for Surface and other hardware. Single-file exe — no install required.
Why these tools exist
Most security improvement and migration projects start with incomplete information. Teams commit to timelines before understanding their real gaps — standing admin access, weak authentication, Conditional Access holes, and identity models that make change hard.
These tools are built from patterns seen across real consulting engagements. They give you a fast, honest read on where you stand and a practical design to work from. Everything runs in your browser — nothing you enter is sent anywhere.