Tenant Audit
A read-only review of your Microsoft 365 tenant: around 50 checks across identity, privileged access, apps, Exchange, devices and collaboration, with a scored report.
How it worksProducts that set things up in your own tenant, free design and assessment tools, and fixed-scope packages when you'd rather have it done for you.
Each one runs against your tenant, not ours. Try the demo first, use it yourself, or have us do it with you.
A read-only review of your Microsoft 365 tenant: around 50 checks across identity, privileged access, apps, Exchange, devices and collaboration, with a scored report.
How it worksAzure Virtual Desktop in your own subscription, set up from your browser: host pool, session hosts, FSLogix storage and access.
Windows 365 Enterprise Cloud PCs: provisioning policy on the Microsoft-hosted network, user settings, groups and licences.
Passkey and MFA enrolment campaigns for your standard users, deployed into your own Azure subscription.
The deploy tools are free while they're new: AKC approves each organisation first, because they change your tenant. Request access from My Account.
Nineteen free tools for Zero Trust, privileged access, Microsoft 365 security, cloud desktops, tenant migration and Windows, built from real consulting work. They run in your browser, and the design tools produce scripts and documents you can use straight away.
Every tool runs without signing in. Downloads (Word, PDF, scripts and the rest) need a free account.
Browse all free tools
Assess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.
Open on tools.andykemp.comGenerate a prioritised remediation plan with step-by-step actions, admin portal links, and effort estimates.
Open on tools.andykemp.comBuild a persona-based Conditional Access policy set around the Trust Levels, edit each policy visually, and export Graph JSON with a script that deploys it in report-only.
Open on tools.andykemp.comRun a passkey and MFA campaign for your users: find who's on SMS or codes, invite them in batches in your branding, follow up automatically and report progress. Installs into your own Azure. Try the live demo.
Open on tools.andykemp.comStep-by-step help for your users: passkeys, number-matching MFA and security keys, sign-in on Windows, Mac, iPhone and Android, and what to do after a new or lost phone.
Open on tools.andykemp.comPlan a phased MFA rollout with communication templates, success criteria, and risk mitigation for each wave.
Open on tools.andykemp.comDesign PIM around the Trust Level Framework (TL1–TL4). Analyse who holds each admin role in your tenant today, then deploy the design with a reviewed, reversible script.
Open on tools.andykemp.comDesign emergency access accounts properly: sign-in methods, custody, Conditional Access exclusions, alert queries, a test plan and a runbook, mapped to Microsoft, CIS, NCSC, NIST and ISM guidance.
Open on tools.andykemp.comScore your own Microsoft 365 tenant across eight security and compliance domains, using read-only access. For an audit of your real tenant, see Tenant Audit.
Open on tools.andykemp.comScore your directory hygiene across account lifecycle, guest management, app registrations, and group governance.
Open on tools.andykemp.comIdentify redundant licences, consolidation opportunities, and estimated cost savings across your Microsoft 365 estate.
Open on tools.andykemp.comEvaluate your Microsoft 365 backup posture across workload coverage, strategy, resilience targets, and operational maturity.
Open on tools.andykemp.comWindows 365 or Azure Virtual Desktop? Get a recommendation with the reasons, AVD session host sizing, Windows 365 editions and sizes, and how users should connect, including Windows 365 Link and Boot.
Open on tools.andykemp.comSet up Windows 365 Cloud PCs in your own tenant step by step: the provisioning policy, user settings, groups and licences, checked before anything changes, all from the browser. Try the live demo.
Open on tools.andykemp.comDesign, check and deploy Azure Virtual Desktop into your own subscription step by step, then finish the Entra and Conditional Access setup, all from the browser. Try the live demo.
Open on tools.andykemp.comEstimate migration complexity and identify key risks before committing to a tenant-to-tenant migration plan.
Open on tools.andykemp.comGroup users into migration batches based on access patterns and dependency relationships to avoid breaking user experience.
Open on tools.andykemp.comGenerate a prioritised, interactive checklist for domain cutover covering DNS, mail routing, certificates, and validation.
Open on tools.andykemp.comA Windows app that builds Windows 11 install media with your driver packs already in it: only the editions you deploy, built-in apps removed, unattended or Autopilot setup, and a bootable USB at the end. Try the live demo.
Open on tools.andykemp.comNew tools appear on tools.andykemp.com first. See every tool
Products for tenant migration and tenant visibility, built from the same consulting work.
Tenant-to-tenant migration orchestration designed to reduce manual effort and improve visibility across Exchange Online, OneDrive, SharePoint, Teams and identity.
Learn moreTenant intelligence, configuration visibility and actionable insight across Microsoft 365 environments for proactive governance.
Learn moreContractor-focused financial visibility, bookkeeping and insight tool designed to make self-employed accounting clearer.
Learn moreWhen you'd rather have it done: a defined scope, a runbook of what's configured and how, delivered with your team.
Assess, design, deploy and adopt Windows LAPS for servers and clients, on Intune or Group Policy.
Move service accounts to gMSAs: the quick wins done, and a framework for the rest.
A Cyber Essentials-aligned Microsoft 365 baseline for Business Premium, E3, E5 and E7, useful whether or not you certify.
Tenant-to-tenant migration orchestration that reduces manual effort, improves visibility and helps organisations deliver complex Microsoft 365 migrations with confidence.
TenantLift orchestrates and automates tenant-to-tenant migrations across identity, Exchange Online, OneDrive, SharePoint, Teams and configuration. It provides visibility, control and automation throughout the migration lifecycle.
TenantLift is currently in development. Early access may be available for selected migration projects. Contact Andy to discuss your requirements.
Enquire about TenantLiftA read-only review of your Microsoft 365 tenant, run by Andy Kemp Consulting, that turns configuration data into scored findings and a prioritised roadmap.
Around 50 checks across the whole tenant, with findings mapped to recognised frameworks such as Cyber Essentials, the NCSC Cyber Assessment Framework and the CIS Microsoft 365 Foundations Benchmark.
The audit uses read-only Microsoft Graph permissions, so it can't change anything in your tenant. Nothing is installed and no agents are deployed. Andy Kemp Consulting runs the audit; your tenant data is only read, never modified.
If your organisation doesn't allow one-click consent, your security team can create the app registration and assign the read-only permissions manually. There is a documented process for this, and we will work with you to get it set up.
A high-level report is provided when the audit completes. If you want something deeper, such as detailed remediation guidance, a full roadmap or a walkthrough with your team, we can discuss scope and commercials.
Tenant intelligence and configuration visibility that helps organisations understand, govern and optimise Microsoft 365 environments proactively.
TenantIQ provides continuous tenant intelligence, configuration monitoring and actionable insights across Microsoft 365 environments, enabling proactive governance and reducing configuration drift.
TenantIQ is currently in development. Early access will be made available to selected advisory clients in 2026.
Express interestContractor-focused financial visibility and bookkeeping tool that makes self-employed accounting, tax planning and business insight clearer.
Finlytics provides real-time financial visibility, automated bookkeeping and tax insight for contractors and consultants, helping self-employed professionals manage their business finances with confidence.
Finlytics is an internal tool developed for Andy Kemp Consulting's own financial management. It is not currently available for external use.
A 30-minute discovery call: what you're trying to change, which of these fits, and whether to do it yourself or with us.