Skip to content
Andy Kemp Consulting
TOOLS

Tools, products and services

Products that set things up in your own tenant, free design and assessment tools, and fixed-scope packages when you'd rather have it done for you.

PRODUCTS

Products for your own tenant

Each one runs against your tenant, not ours. Try the demo first, use it yourself, or have us do it with you.

Live

AVD Deploy

Azure Virtual Desktop in your own subscription, set up from your browser: host pool, session hosts, FSLogix storage and access.

Live

W365 Deploy

Windows 365 Enterprise Cloud PCs: provisioning policy on the Microsoft-hosted network, user settings, groups and licences.

The deploy tools are free while they're new: AKC approves each organisation first, because they change your tenant. Request access from My Account.

FREE TOOLS

Free tools at tools.andykemp.com

Nineteen free tools for Zero Trust, privileged access, Microsoft 365 security, cloud desktops, tenant migration and Windows, built from real consulting work. They run in your browser, and the design tools produce scripts and documents you can use straight away.

Browse all free tools
Atlas, the Andy Kemp Consulting robot, working at a laptop

Zero Trust

Free

Zero Trust Scorecard

Assess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.

Open on tools.andykemp.com
Free

Zero Trust Remediation Planner

Generate a prioritised remediation plan with step-by-step actions, admin portal links, and effort estimates.

Open on tools.andykemp.com
Free

Conditional Access Policy Builder

Build a persona-based Conditional Access policy set around the Trust Levels, edit each policy visually, and export Graph JSON with a script that deploys it in report-only.

Open on tools.andykemp.com
Free

Auth-Onboard

Run a passkey and MFA campaign for your users: find who's on SMS or codes, invite them in batches in your branding, follow up automatically and report progress. Installs into your own Azure. Try the live demo.

Open on tools.andykemp.com
Free

Auth Guide

Step-by-step help for your users: passkeys, number-matching MFA and security keys, sign-in on Windows, Mac, iPhone and Android, and what to do after a new or lost phone.

Open on tools.andykemp.com
Free

Phish-Resistant MFA Rollout Planner

Plan a phased MFA rollout with communication templates, success criteria, and risk mitigation for each wave.

Open on tools.andykemp.com

Privileged Access

Free

PIM Role Designer

Design PIM around the Trust Level Framework (TL1–TL4). Analyse who holds each admin role in your tenant today, then deploy the design with a reviewed, reversible script.

Open on tools.andykemp.com
Free

Break-glass Account Builder

Design emergency access accounts properly: sign-in methods, custody, Conditional Access exclusions, alert queries, a test plan and a runbook, mapped to Microsoft, CIS, NCSC, NIST and ISM guidance.

Open on tools.andykemp.com

Microsoft 365 Security

Free

Tenant Security Self-Assessment

Score your own Microsoft 365 tenant across eight security and compliance domains, using read-only access. For an audit of your real tenant, see Tenant Audit.

Open on tools.andykemp.com
Free

Entra ID Hygiene Scorecard

Score your directory hygiene across account lifecycle, guest management, app registrations, and group governance.

Open on tools.andykemp.com
Free

M365 Licence Optimiser

Identify redundant licences, consolidation opportunities, and estimated cost savings across your Microsoft 365 estate.

Open on tools.andykemp.com
Free

Backup & Recovery Readiness

Evaluate your Microsoft 365 backup posture across workload coverage, strategy, resilience targets, and operational maturity.

Open on tools.andykemp.com

Cloud Desktops

Free

Cloud Desktop Advisor

Windows 365 or Azure Virtual Desktop? Get a recommendation with the reasons, AVD session host sizing, Windows 365 editions and sizes, and how users should connect, including Windows 365 Link and Boot.

Open on tools.andykemp.com
Free

W365 Deploy

Set up Windows 365 Cloud PCs in your own tenant step by step: the provisioning policy, user settings, groups and licences, checked before anything changes, all from the browser. Try the live demo.

Open on tools.andykemp.com
Free

AVD Deploy

Design, check and deploy Azure Virtual Desktop into your own subscription step by step, then finish the Entra and Conditional Access setup, all from the browser. Try the live demo.

Open on tools.andykemp.com

Tenant Migration

Free

T2T Migration Readiness Assessment

Estimate migration complexity and identify key risks before committing to a tenant-to-tenant migration plan.

Open on tools.andykemp.com
Free

Migration Batch Planner

Group users into migration batches based on access patterns and dependency relationships to avoid breaking user experience.

Open on tools.andykemp.com
Free

DNS & Domain Cutover Checklist

Generate a prioritised, interactive checklist for domain cutover covering DNS, mail routing, certificates, and validation.

Open on tools.andykemp.com

Windows Tools

Free

Win11 Image Prep

A Windows app that builds Windows 11 install media with your driver packs already in it: only the editions you deploy, built-in apps removed, unattended or Autopilot setup, and a bootable USB at the end. Try the live demo.

Open on tools.andykemp.com

New tools appear on tools.andykemp.com first. See every tool

IN DEVELOPMENT

Coming next

Products for tenant migration and tenant visibility, built from the same consulting work.

In Development

TenantLift

Tenant-to-tenant migration orchestration designed to reduce manual effort and improve visibility across Exchange Online, OneDrive, SharePoint, Teams and identity.

Learn more
In Development

TenantIQ

Tenant intelligence, configuration visibility and actionable insight across Microsoft 365 environments for proactive governance.

Learn more
Internal Tool

Finlytics

Contractor-focused financial visibility, bookkeeping and insight tool designed to make self-employed accounting clearer.

Learn more
PACKAGES

Fixed-scope packages

When you'd rather have it done: a defined scope, a runbook of what's configured and how, delivered with your team.

In Development

TenantLift

Tenant-to-tenant migration orchestration that reduces manual effort, improves visibility and helps organisations deliver complex Microsoft 365 migrations with confidence.

What it does

TenantLift orchestrates and automates tenant-to-tenant migrations across identity, Exchange Online, OneDrive, SharePoint, Teams and configuration. It provides visibility, control and automation throughout the migration lifecycle.

Key capabilities

  • Pre-migration assessment and planning
  • Identity and user migration orchestration
  • Mailbox and archive migration automation
  • OneDrive and SharePoint content migration
  • Teams and collaboration migration
  • Configuration carryover and remediation
  • Progress tracking and reporting
  • Post-migration validation and testing

Availability

TenantLift is currently in development. Early access may be available for selected migration projects. Contact Andy to discuss your requirements.

Enquire about TenantLift
Live · v2.0.0

Tenant Audit

A read-only review of your Microsoft 365 tenant, run by Andy Kemp Consulting, that turns configuration data into scored findings and a prioritised roadmap.

What it checks

Around 50 checks across the whole tenant, with findings mapped to recognised frameworks such as Cyber Essentials, the NCSC Cyber Assessment Framework and the CIS Microsoft 365 Foundations Benchmark.

  • Identity and access: Conditional Access, MFA registration, authentication methods and security defaults
  • Privileged access: directory and PIM role assignments, standing admin access and break-glass accounts
  • External exposure: guests, cross-tenant access, SharePoint and OneDrive sharing, stale accounts
  • Apps and consents: app registrations, enterprise apps, OAuth grants, expiring secrets and over-privileged apps
  • Exchange Online: delegation, forwarding, inbox rules and transport rules
  • Devices, data and collaboration: Intune and app protection, sensitivity labels, retention, Teams and groups
  • Licensing and readiness: licence usage and migration complexity for tenant moves

Read-only by design

The audit uses read-only Microsoft Graph permissions, so it can't change anything in your tenant. Nothing is installed and no agents are deployed. Andy Kemp Consulting runs the audit; your tenant data is only read, never modified.

How it works

  1. Request: fill in the form at audit.andykemp.com with your organisation and tenant details.
  2. Approve access: you receive a custom link. Sign in to your own Microsoft Entra tenant and approve the read-only permissions on Microsoft's consent screen.
  3. Audit: once access is approved, Andy runs the audit against your tenant.
  4. Report: you receive a high-level report of the findings on completion.
  5. Remove access: once the audit is complete, delete the app registration created in Microsoft Entra ID. This is your responsibility as the tenant owner, and you can remove it at any time.

Prefer to set up the permissions yourself?

If your organisation doesn't allow one-click consent, your security team can create the app registration and assign the read-only permissions manually. There is a documented process for this, and we will work with you to get it set up.

Need more depth?

A high-level report is provided when the audit completes. If you want something deeper, such as detailed remediation guidance, a full roadmap or a walkthrough with your team, we can discuss scope and commercials.

In Development

TenantIQ

Tenant intelligence and configuration visibility that helps organisations understand, govern and optimise Microsoft 365 environments proactively.

What it does

TenantIQ provides continuous tenant intelligence, configuration monitoring and actionable insights across Microsoft 365 environments, enabling proactive governance and reducing configuration drift.

Key capabilities

  • Configuration visibility and inventory
  • Drift detection and alerting
  • Policy compliance monitoring
  • Change tracking and audit
  • Security posture dashboards
  • Licensing and consumption insight
  • Automated reporting and notifications

Availability

TenantIQ is currently in development. Early access will be made available to selected advisory clients in 2026.

Express interest
Internal Tool

Finlytics

Contractor-focused financial visibility and bookkeeping tool that makes self-employed accounting, tax planning and business insight clearer.

What it does

Finlytics provides real-time financial visibility, automated bookkeeping and tax insight for contractors and consultants, helping self-employed professionals manage their business finances with confidence.

Key capabilities

  • Real-time financial dashboards
  • Income and expense tracking
  • VAT and tax calculation
  • Invoice management
  • Profitability and margin analysis
  • Year-end reporting and preparation

Availability

Finlytics is an internal tool developed for Andy Kemp Consulting's own financial management. It is not currently available for external use.

Not sure where to start?

A 30-minute discovery call: what you're trying to change, which of these fits, and whether to do it yourself or with us.