CLOUDEK · RESOURCES
Free tools and guides
for the admin day.
Practical checks for Microsoft 365, Azure and email, grouped by the job you are doing. Most tools work in your browser, each says what it does not verify, and the guides explain the reasoning. New items appear here as they are published.
Updated · Last reviewed
✓ 44 free tools✓ 28 guides✓ No sign-in
Start here: a path for a new Microsoft 365 admin
- See where the tenant stands. Work through a read-first security baseline you can check in an afternoon. Tenant security baseline
- Get email authentication right. Check SPF, DKIM and DMARC for your domain, learn what each record does, then plan enforcement in stages. Email Health Check · Email DNS guide · DMARC rollout plan
- Understand sign-in problems. Look up an error code, then review Conditional Access for gaps such as missing MFA or legacy authentication. Error code explainer · AADSTS codes guide · Conditional Access checklist
- Follow mail when it goes missing. Use a fixed order of checks instead of guessing. Mail flow troubleshooting
- Keep licence spend honest. Enter your own seat counts and prices, then review candidates for unused licences. Licence cost calculator · Licence audit guide · Windows Server licensing calculator · Windows Server licensing guide
- Automate with care. Review a script for risky patterns before you run it, and keep a checklist for the rest. PowerShell script risk reviewer · PowerShell safety checklist
- Know where your data goes. Read what stays in your browser, what is optional and what Cloudek never does. Trust centre
These are starting points, not a complete checklist. Check consequential results against your own tenant and your organisation’s procedures.
Free tools by job
Email and domain
Check what a domain publishes and what a message reports about itself.
- Email health check, DMARC report analyzer and .eml checkerCheck email DNS for a domain in one click: MX, SPF, DMARC, common DKIM selectors, MTA-STS, TLS-RPT and BIMI with a transparent score.
- Domain & mail DNS checkerEmail domain lookup and MX lookup: query public MX, SPF, DKIM, DMARC, DNSSEC and related records.
- SPF record checker and lookup counterLook up a domain's SPF record, follow every include, redirect, a and mx term, and count DNS lookups against the limit of 10 and void lookups against…
- SPF record explainerBreak down a pasted SPF policy into mechanisms and qualifiers.
- DKIM public-key record explainerRead common tags from a pasted DKIM selector TXT record.
- DMARC record inspectorExplain common tags in a pasted DMARC TXT record locally.
- Email authentication and flowReview reported SPF, DKIM and DMARC results plus Received hops from pasted test-message headers.
- Domain, email & URLCheck common domain, email or website URL formatting rules.
Microsoft 365 and identity
Make sense of sign-in errors, policies, licences and tickets.
- Microsoft error code explainerLook up Microsoft error codes like AADSTS50126, 0x80070005 or 550 5.7.509: meaning, usual causes, first checks and safest fix.
- Entra Conditional Access policy reviewerReview exported Microsoft Entra Conditional Access policy JSON for missing MFA, legacy authentication, admin coverage, risky exclusions and…
- JWT claims inspectorDecode selected JWT header and payload claims locally.
- Microsoft 365 licence cost calculatorEnter your own seat counts and per-seat prices for users, shared mailboxes and guests to see monthly and annual totals, an unused-seats what-if and…
- Windows Server licensing calculatorEstimate Windows Server core licences per Hyper-V host, how many Standard sets you would stack for your VMs, whether Datacenter is cheaper, and how…
- IT ticket reply writer for MSPsPaste a support ticket to get the kind of request, a checklist of clarifying questions and a reply template with fill-in fields, built in your…
Azure and networking
Plan address ranges and estimate log and storage costs.
- IPv4 subnet calculatorCalculate an IPv4 network address, mask, usable range and broadcast details from an address and CIDR prefix.
- IPv4 subnet splitterSplit a parent IPv4 CIDR range into equal-sized child subnets.
- IPv6 subnet calculatorCalculate an IPv6 subnet from an address and prefix length: network prefix, first and last address and total addresses, using exact 128-bit…
- IPv6 subnet splitterDivide an IPv6 parent prefix into equal-sized child prefixes using exact 128-bit arithmetic.
- CIDR to IP range calculatorConvert CIDR notation to an IP range: first and last address, netmask, wildcard mask, total and usable hosts for IPv4 and IPv6.
- IP range to CIDR summarizerConvert an IP address range to CIDR notation: enter a start and end address to get the exact IPv4 or IPv6 CIDR blocks.
- CIDR overlap checkerCompare up to 64 IPv4 and IPv6 CIDR ranges for overlaps locally.
- Subnet mask and prefix length chartSearchable /0 to /32 IPv4 subnet mask chart with wildcard masks, address counts and usable hosts, plus common IPv6 prefix lengths.
- Reverse DNS name generatorGenerate the in-addr.arpa or ip6.arpa reverse-mapping owner name from an IPv4 or IPv6 address without making a DNS query.
- SIEM log volume and cost estimatorEstimate monthly and annual SIEM log costs from GB per day by source, then model filtering or archiving to reduce SIEM costs.
- AI agent audit log checkerCheck pasted JSON audit log entries for the fields an AI agent audit trail needs: identity, delegation, action, result, time, correlation, approval…
- Storage size converterConvert bytes through terabytes using decimal or binary units.
Scripting and automation
Review scripts and queries before they run, and tidy the text you work with.
- PowerShell script risk reviewerScan a pasted PowerShell script for risky patterns such as Invoke-Expression, encoded commands, disabled Defender and hard-coded passwords.
- Natural language to KQL and PowerShell helperDescribe what you want to find and get a reviewed read-only KQL or PowerShell template for Entra, Defender, Azure, Exchange or Graph.
- Log secret redactorMask common credentials in a pasted log or configuration snippet locally.
- AI Prompt Debugger & Token CounterDraft prompts, fill template variables, and compare clearly labeled local token estimates.
- JSON formatterFormat or minify JSON online.
- CSV to JSON converterConvert a small CSV table to JSON online.
- Text & config diffCompare two text or configuration snippets in your browser.
- Base64 text converterEncode or decode UTF-8 text as Base64 in your browser.
- UUID v4 generatorGenerate random UUID v4 identifiers locally for development, tests and documentation.
- Timestamp converterConvert Unix seconds, milliseconds or an ISO 8601 date to UTC and local time, with an optional IANA time zone.
- Time-zone meeting plannerConvert a proposed local meeting time to another IANA time zone, including daylight-saving gaps and repeated times.
- Unix permissions calculatorConvert chmod octal modes such as 755, 644 or 4755 into readable owner, group and other permissions, including setuid, setgid and sticky bits.
- URL & query inspectorInspect a URL and decode query parameters locally without connecting to it.
Certificates and web security
Check certificates, headers and keys.
- Website SSL/TLS quick checkPrepare an optional public Qualys SSL Labs scan link for a hostname you own or are authorized to check.
- Website security headersReview common security-header presence and selected policy warnings from pasted response headers.
- Certificate expiry plannerEstimate time until a certificate expiry date and check whether a chosen renewal window has started.
- CSR and private-key generatorCreate a PKCS#10 certificate signing request and matching passphrase-encrypted private key locally in your browser.
- SSH public-key fingerprintCalculate the SHA-256 fingerprint of an OpenSSH public key locally.
Latest guides
- Conditional Access Review Checklist: 12 Things to Check in Your Tenant · Twelve Conditional Access checks: break-glass accounts, report-only mode, legacy authentication, admin MFA, device compliance, guests and ownership.
- DMARC Rollout Plan: From p=none to p=reject Without Losing Mail · A staged DMARC rollout plan from p=none to p=reject: find senders, read aggregate reports, fix alignment, then quarantine and reject safely.
- Microsoft Entra AADSTS Error Codes: The Ones You Will See and How to Fix Them · Fifteen common Microsoft Entra AADSTS error codes with the usual cause and first check for each, and how to read the sign-in log before changing anything.
- Before You Run That PowerShell Script: A Safety Checklist for Admins · A practical PowerShell script safety checklist: why execution policy is not a security boundary, reading before running, -WhatIf, test tenants and signing.
- Windows Server Licensing Explained: Standard vs Datacenter, Hyper-V and CALs · Windows Server licensing explained: core licenses, Standard vs Datacenter for Hyper-V VMs, user and device CALs, RDS CALs and Azure Hybrid Benefit.
- AI Agent Audit Logs: What to Record and Example Log Entries · An AI agent audit log schema, field by field, with a synthetic JSON example: actor, delegation, tool, result, approval, policy and correlation ID.
Tools and guides on this page give general information. They do not replace a review of your own environment, and AI-assisted explanations can be wrong. For how data is handled, see the trust centre.