The toolbox
Tools & Resources
60 working tools built into the field guides — interactive decision builders, readiness assessments, checklists and PowerShell scripts you can download and run. Free, no signup.
Decision builders(9)
Security & Compliance
Sensitivity Labels Decision Builder 2026: Classification Is Governance, Not Just Marking
Interactive sensitivity labels decision builder for 2026. Design label taxonomies for Microsoft Purview, configure encryption and rights management, set up container labels for sites and teams, plan auto-labeling policies, align labels with DLP, prepare for Copilot, and roll out labeling with user adoption. Includes a 10-input scoring engine, baseline taxonomies, rollout phases, and 16 common labeling mistakes from real tenants.
13 May 2026
Security & Compliance
Microsoft 365 Admin Roles Builder 2026: Global Admin Should Be the Exception
Build a least-privilege Microsoft 365 admin role model using PIM, Conditional Access, break-glass accounts, scoped roles and regular access reviews.
12 May 2026
Security & Compliance
SharePoint External Sharing Policy Builder 2026: Tenant and Site Sharing Controls
Build a practical SharePoint external sharing policy covering tenant and site controls, guest access, anonymous links, sensitivity labels, DLP and Copilot risk.
10 May 2026
Security & Compliance
Microsoft Defender for Office 365 Policy Builder 2026: Standard, Strict or Custom
Interactive Microsoft Defender for Office 365 policy builder for Microsoft 365 admins, Exchange Online admins and security teams. Design email security policies with a 7-input protection scoring engine, Standard vs Strict vs Custom decision framework, persona-based baselines for executives, finance, HR and customer-facing users, anti-phishing and impersonation recommendations, Safe Links and Safe Attachments guidance, quarantine workflow, Tenant Allow/Block List review, mail flow alignment, safe rollout phases, and 18 common Defender mistakes from real tenants.
8 May 2026
Security & Compliance
Microsoft Purview DLP Policy Builder 2026: A Practical Guide for Microsoft 365 Admins
Interactive Microsoft Purview DLP policy builder for Microsoft 365 admins and security teams. Design DLP policies with a 7-input risk scoring engine, baseline policies for Exchange, SharePoint, OneDrive, Teams and Endpoint, location-specific tuning guidance, safe rollout phases, policy naming conventions, sensitivity labels integration, Copilot readiness alignment, and 18 common DLP mistakes from real tenants.
7 May 2026
Security & Compliance
Microsoft 365 Licensing Decision Builder: Business Premium, E3, E5 or Add-ons?
Interactive Microsoft 365 licensing decision builder for IT admins. Compare Business Premium, E3, E5 and add-ons by scenario. Persona-based licensing, feature decision matrix, security and compliance licensing, Copilot readiness, and practical field-tested advice for 2026.
6 May 2026
Exchange Online
Exchange Online Mail Flow Decision Builder: Rules, Connectors and Sending Patterns for 2026
Interactive Exchange Online mail flow decision builder for Microsoft 365. Covers transport rules, connectors, SMTP AUTH with OAuth, High Volume Email, Graph sendMail, Azure Communication Services Email, Defender for Office 365, DLP, external forwarding, spoofing, naming conventions, and rollout guidance for 2026.
6 May 2026
Microsoft Intune
Microsoft Intune Compliance Policy Builder: A Practical Guide for 2026
Interactive Intune compliance policy builder for Microsoft 365. Decision tool with six inputs, ten baseline policies, platform-specific recommendations for Windows, macOS, iOS and Android, rollout phases, and field-tested advice for connecting device compliance to Conditional Access.
5 May 2026
Security & Compliance
Microsoft 365 Conditional Access Policy Builder: A Practical Guide for 2026
Interactive Conditional Access policy builder for Microsoft 365. Decision tool with six inputs, ten baseline policies, naming convention, phased rollout sequence, and field-tested advice from real deployments.
5 May 2026
Assessments(3)
Security & Compliance
Microsoft 365 Security Assessment for SMBs: The 30 Checks I Run in Every Tenant (2026)
The 30-check Microsoft 365 security assessment for SMBs (2026): identity, email, devices, data, monitoring and governance — with evidence pack and cadence.
11 June 2026
Microsoft 365 Copilot
Microsoft 365 Copilot Readiness Scorecard 2026: Permissions, Security and Governance
Interactive Microsoft 365 Copilot readiness scorecard for IT admins and security teams. Assess SharePoint permissions, external sharing, sensitivity labels, DLP, audit readiness, and user adoption before Copilot rollout. Persona-based rollout planning, pilot vs broad rollout decision framework, and practical governance checklists for 2026.
7 May 2026
Security & Compliance
Microsoft 365 Tenant Health Scorecard: 40 Practical Checks for Security and Governance
Score your Microsoft 365 tenant across 40 checkpoints in four pillars: identity, device, data protection, and operations. Interactive assessment based on real tenant reviews — not Secure Score.
4 May 2026
Checklists(4)
Security & Compliance
Microsoft 365 Business Premium Security Baseline 2026: Updated Checklist
The 24-control Microsoft 365 Business Premium security baseline for 2026: SKU-aware checklist for SMBs, gaps vs E5, and a week-by-week rollout cadence.
15 June 2026
Exchange Online
Exchange Online Mail Flow Audit Checklist: 32 Checks Before You Change Anything (2026)
The 20-check Exchange Online mail flow audit for 2026: SPF / DKIM / DMARC, connectors, mail flow rules, anti-spam, SMTP AUTH and the rollback evidence pack.
12 June 2026
Security & Compliance
NIS2 and Microsoft 365: The Practical Admin Checklist for SMBs (2026)
2026 NIS2 framework for Microsoft 365 admins in SMBs: scope check, 10 Article 21 measures mapped to M365, gaps, 24h/72h reporting, governance.
9 June 2026
Security & Compliance
EU AI Act + Microsoft 365: 2026 Admin Compliance Framework
2026 EU AI Act framework for Microsoft 365 admins: what the May Omnibus changed, Microsoft Purview mapping, gaps, and an interactive self-assessment.
3 June 2026
Downloads(10)
Exchange Online
Troubleshooting Exchange Online Mail Flow Rules: From Report to Root Cause
From user report to root cause: Message Trace V2, the Extended report, audit mode, rule identity, and safe Exchange Online mail flow testing.
26 August 20261 file to download
Security & Compliance
Sensitivity Labels vs DLP vs Retention: Which One?
A decision matrix for Microsoft Purview: which problem sensitivity labels solve, which DLP solves, which retention solves, and the traps in between.
11 August 20261 file to download
Microsoft Intune
ASR Rules: Audit-to-Block Rollout with Intune (2026)
Roll out attack surface reduction rules without breaking line-of-business apps: audit baselines, all 19 rules, exclusions that work, Intune deployment.
7 August 20261 file to download
Azure & Entra ID
Conditional Access Change Control: Export, Diff & Rollback
A practical process to export, diff, review and roll back Conditional Access policies using Graph, audit logs, report-only mode and Entra Backup.
4 August 20261 file to download
Azure & Entra ID
Entra ID Protection Risk Policies Retire in October: The Conditional Access Migration Guide (2026)
Entra ID Protection legacy risk policies retire 1 October 2026, no automatic migration. Rebuild them in Conditional Access: steps, gotchas, free playbook PDF.
15 July 20261 file to download
Scripts & Automation
Complete Microsoft 365 PowerShell Environment Setup
A PowerShell script that installs and updates all essential Microsoft 365 modules, removes conflicting legacy modules, and configures your profile with Connect-M365 — from a blank machine to a ready environment in a single run.
13 April 20261 file to download
Scripts & Automation
Audit Conditional Access Exclusions with PowerShell
Free PowerShell script for Microsoft 365 administrators. Audits all Conditional Access policy exclusions, resolves GUIDs to display names, flags high-privilege role exclusions and guest bypasses, and exports a sortable HTML report with risk levels.
8 April 20261 file to download
Scripts & Automation
Intune Device Compliance Report with PowerShell & Microsoft Graph
Generate an Intune device compliance report with PowerShell and Microsoft Graph. This script identifies failed policies, risk scoring, severity, and delta changes in an HTML dashboard with CSV export
23 March 20261 file to download
Scripts & Automation
Audit Your Microsoft 365 Security Posture with PowerShell
Use this PowerShell script to audit your Microsoft 365 security baseline across Identity, Conditional Access, Email, Intune, and Monitoring. Includes HTML report and executive summary.
20 March 20261 file to download
Scripts & Automation
Automate Microsoft 365 Guest User Lifecycle Management with PowerShell
Learn how to automate the cleanup and lifecycle management of Microsoft 365 Guest Users using PowerShell and Microsoft Graph. This step-by-step guide shows how to detect inactive guest accounts, reduce tenant risk, and deploy a secure production-ready automation workflow
17 November 20251 file to download
Interactive guides(34)
Microsoft Intune
How to Troubleshoot Intune Policy Conflicts in 2026: A Repeatable Diagnostic Workflow
Troubleshoot Intune policy conflicts with a seven-step workflow covering precedence, assignment filters, reporting latency, targeting and Windows MDM logs.
3 August 2026
Microsoft Intune
Managing Macs with Intune in 2026: Enrollment, Compliance and the Gaps Nobody Mentions
Manage Macs with Intune in 2026: Apple Business enrollment, Platform SSO with Secure Enclave, DDM updates, app deployment, and the honest gaps vs Jamf.
13 July 2026
Microsoft Intune
Shadow AI on Company Devices: Detect and Control Unsanctioned AI with Intune, Defender and Purview (2026)
Discover unsanctioned AI on company devices with Defender and Intune, block or warn with network protection, and protect sanctioned AI apps with Purview DLP.
13 July 2026
Security & Compliance
NIS2 Compliance with Microsoft 365: Mapping Article 21 to the Tools You Already Own
Map NIS2 Article 21 to Microsoft 365 tools you already own: MFA, Defender, Intune, Purview, backup. Plus the 24/72-hour reporting reality and a 90-day plan.
13 July 2026
Exchange Online
Decommissioning Your Last Exchange Server in 2026: The SE CU2 Deadline and the Hybrid Exit Plan
Retire your last hybrid Exchange server in 2026: the eligibility test, Management Tools with no server, SMTP relay migration, and the SE CU2 deadline.
11 July 2026
Security & Compliance
Microsoft 365 Backup: What It Covers, What It Does Not, and When You Still Need a Third Party (2026)
Microsoft 365 Backup honestly reviewed: 10-minute restore points, 1-year retention cap, per-GB cost model, restore gotchas and when a third party still wins.
10 July 2026
Microsoft 365 Copilot
AI Agent Governance in Microsoft 365: Agent 365, Entra Agent ID and the First 30 Days (2026)
Govern AI agents in Microsoft 365: the Entra Agent ID object model, sponsors, access packages with expiry, Conditional Access for agents and a 30-day plan.
10 July 2026
Microsoft 365 Copilot
After the Copilot Rollout: Usage Reports, Dormant Licences and Proving ROI to the Board (2026)
Measure Microsoft 365 Copilot after deployment: usage reports, the free Copilot Dashboard, a Graph dormancy script and a board report that proves ROI.
10 July 2026
Microsoft Intune
Windows 10 ESU Year Two: Renew, Migrate or Retire? The October 2026 Decision
Windows 10 ESU year two costs $122 per device from October 2026. The decision framework for IT teams: renew, migrate to Windows 11, or replace, with the maths.
10 July 2026
Security & Compliance
SharePoint OTP Retirement: Why External Users See Access Denied and How to Fix It (2026)
SharePoint OTP retirement is breaking external access now: find exposed guests, create Entra B2B accounts in bulk, fix Conditional Access before 31 August.
9 July 2026
Security & Compliance
Microsoft Sentinel to Defender Portal Migration: A Field Guide for Lean Security Teams (2026)
Move Microsoft Sentinel to the Defender portal before March 2027: unified RBAC, automation rule fixes, incident changes and a lean-team migration runbook.
8 July 2026
Security & Compliance
Purview DLP Validation Guide: How to Prove Your Policy Works Before Enforcement (2026)
Practitioner runbook for validating Microsoft Purview DLP policies before enforcement: Simulation, Audit, Block-with-override, Block, metrics, readiness checklist.
30 June 2026
Security & Compliance
Microsoft 365 Incident Response Runbook: First 60 Minutes After a Compromised Account (2026)
Practitioner runbook for the first 60 minutes after a compromised Microsoft 365 account: triage, containment, blast radius, evidence and communication.
30 June 2026
Microsoft 365 Copilot
Copilot Governance Operating Model: Who Owns Permissions, Labels, DLP and Oversharing After Go-Live (2026)
Practitioner field notes on Microsoft 365 Copilot governance: five domains, three archetypes, RACI realism, five ownership wars, post-go-live cadence.
29 June 2026
Security & Compliance
Microsoft 365 Renewal Review: How to Avoid Paying for Licences You Do Not Use (2026)
The 25-check Microsoft 365 renewal review (2026): inactive users, over-assigned SKUs, Copilot + Agent 365 usage, NCE rules, per-licence evidence pack.
29 June 2026
Exchange Online
Graph API Migration for Exchange Admins: Replacing Legacy EWS Scripts (2026)
Migrate EWS scripts to Microsoft Graph (2026): three Graph surfaces, OAuth + permissions, EWS to Graph cookbook, side-by-side PowerShell examples and runbook.
23 June 2026
Microsoft 365 Copilot
Agent 365 vs Copilot Studio vs Security Copilot: What Admins Actually Need to Know (2026)
What Microsoft Agent 365, Copilot Studio and Security Copilot actually do in 2026 — comparison matrix, decision framework, licensing landmines for admins
17 June 2026
Exchange Online
EWS Retirement 2026: How to Find Legacy Exchange Integrations Before They Break
2026 playbook to find every EWS integration before the October retirement: discovery methods, Allow List, Microsoft Graph migration, checklist.
9 June 2026
Exchange Online
Exchange Online Mail Flow Architecture 2026: HVE, SMTP AUTH retirement, and the modern connector playbook
2026 Exchange Online playbook: HVE general availability, SMTP AUTH retirement timeline, DMARC enforcement, connectors and Defender baseline.
5 June 2026
Security & Compliance
Microsoft 365 Backup vs Third-Party: 2026 Decision Framework
2026 decision framework: Microsoft 365 Backup vs third-party tools. Scope, pricing, gaps, hybrid pattern, and when each makes architectural sense.
2 June 2026
Azure & Entra ID
Phishing-Resistant MFA with Authentication Strengths: 2026 Rollout Guide
Microsoft Entra Authentication Strengths and phishing-resistant MFA migration guide for 2026. Built-in strengths, TAP bootstrap, rollout traps, validation checklist.
29 May 2026
Azure & Entra ID
Token Protection in Conditional Access: 2026 Rollout and Troubleshooting Guide
Practical 2026 guide to Microsoft Entra Token Protection: compatibility surface, configuration traps, report-only rollout, and sign-in log status codes.
28 May 2026
Microsoft 365 Copilot
Microsoft Agent 365 Admin Field Guide 2026: The Control Plane for AI Agents
Practical Microsoft Agent 365 admin guide for 2026. Registry, Shadow AI, policy templates, BYOAI governance and operational model after GA.
28 May 2026
Microsoft Intune
Secure Boot 2026 Certificate Transition: Field Guide for Windows IT Admins
Microsoft Secure Boot 2011 certificates expire from June 2026. Field guide: inventory, OEM firmware, 2023 cert family rollout, validation, monitoring.
26 May 2026
Microsoft Intune
Group Policy to Intune Migration Guide 2026: Inventory, Mapping and Cutover
Practical Group Policy to Microsoft Intune migration guide for 2026. Inventory GPOs, run Group Policy analytics, map to Settings catalog, decide co-management vs cloud-native, phase the rollout, validate compliance and Conditional Access, and decommission cleanly.
21 May 2026
Microsoft 365 Copilot
SharePoint Advanced Management for Copilot Readiness 2026: SAM Features and Decision Guide
Practical SharePoint Advanced Management guide for 2026. Understand SAM licensing, Data Access Governance, Restricted Access Control, Restricted Content Discovery, Restricted SharePoint Search, Copilot readiness and the operating model after purchase.
20 May 2026
Scripts & Automation
Microsoft Graph PowerShell Field Guide 2026: Authentication, Permissions and Production Patterns
Practical Microsoft Graph PowerShell field guide for 2026. Authentication methods, delegated vs application permissions, app registrations, throttling, paging, beta vs v1.0, secret management, and production patterns.
20 May 2026
Microsoft Intune
Microsoft Defender for Endpoint Onboarding with Intune 2026: Practical Field Guide
Practical Microsoft Defender for Endpoint onboarding guide for 2026. Deploy with Intune, enable the Defender connector, configure EDR in block mode, ASR, macOS onboarding, compliance risk signals and Conditional Access validation.
19 May 2026
Microsoft Intune
Intune Targeting Guide 2026: Assignment Filters, Device Categories and Dynamic Groups
Practical Intune targeting guide for 2026 covering assignment filters, device categories, dynamic groups, static groups, exclusions, rollout models and troubleshooting. Includes a 10-input governance scoring engine, targeting decision framework, filter syntax guidance, naming conventions and 16 common targeting mistakes from real tenants.
11 May 2026
Security & Compliance
Zero Trust for SMBs vs Enterprise: Same Principles, Different Reality
Right-size your Zero Trust implementation for your org. Phased SMB approach, enterprise framework, complexity thresholds, what not to copy, and recommendations by org size.
4 May 2026
Security & Compliance
Identity, Device, Session: How Conditional Access Actually Makes Decisions
How Conditional Access evaluates identity, device, and session signals. Authentication strength, compliance, sign-in frequency, CAE, token protection, and policy stacking.
4 May 2026
Security & Compliance
Zero Trust in the Real World: The Gaps You Cannot Ignore
Every Zero Trust deployment has gaps. BYOD browser access, legacy apps, IoT devices, VPN bypass, service accounts, and guest lifecycle. Honest assessment with mitigations.
4 May 2026
Security & Compliance
Zero Trust with Intune: How to Turn Device Compliance into Access Control
How Conditional Access evaluates identity, device, and session signals. Authentication strength, compliance, sign-in frequency, CAE, token protection, and policy stacking.
3 May 2026
Security & Compliance
Zero Trust in Microsoft 365: What It Actually Means (and What Most Get Wrong)
Zero Trust is everywhere — in vendor pitches, compliance checklists, and security strategies. But most organisations treat it as a product to buy rather than a model to implement. This article cuts through the marketing: what Zero Trust actually is (and is not), the six technology pillars mapped to your Microsoft 365 stack, why Conditional Access is the policy engine that connects everything, why MFA alone does not equal Zero Trust, and what the 2026 "All resources" enforcement change means for your tenant. Includes a visual mental model and a practical framework for getting started.
30 April 2026
Every tool ships inside its field guide with full context — no gated content, no forms.