Read-only Microsoft Purview posture analyzer (modernized CAMP). Reads configuration metadata across Sensitivity Labels, DLP, Retention, Insider Risk, Audit, eDiscovery, Communication Compliance and DSPM for AI, and produces an HTML report (primary) plus a JSON export. Collectors call Get-* only; no tenant configuration is created, modified or delet... More info

Answers one question before December 2026: which mailboxes in this tenant can still send with a username and password, and will therefore stop when Microsoft disables SMTP AUTH Basic authentication by default at the end of that month. Printers, scanners, MFPs, NAS units and scripts are what break, and the error they will report is 535 5.7.139. Rea... More info

Read-only Microsoft Entra ID unmanaged and stale device reporting via Microsoft Graph. Generates CSV evidence for device-exposure assessment findings; performs no writes to any tenant.

Read-only Conditional Access policy inventory and unique-values catalogue module, built on the Microsoft Graph PowerShell SDK. Retrieves every Conditional Access policy in a tenant, normalises each into a flat per-policy record, and aggregates a deduplicated catalogue of the distinct values in use (workloads, grant controls, platforms, locations, c... More info

Read-only Microsoft Entra ID multifactor authentication registration reporting via Microsoft Graph. Generates CSV evidence identifying users without MFA registered, for MFA-coverage assessment findings; performs no writes to any tenant.

Read-only Microsoft Intune evidence explorer: why a policy or app did not apply, what changed, what a group change will affect, who can do what, and Scoped permissions readiness. Quick start: Install-Module -Name IntuneAccess -Scope CurrentUser; Start-IntuneAccess

Read-only inventory of unassigned, mis-assigned and leftover Windows Intune objects, and optionally owner-scoped Entra ID assignment groups. Produces an Excel decision tracker. Issues GET requests only and never modifies a tenant.

Orchestration engine for the Ultimate Modular Windows Server Discovery Toolkit. The interactive entry point is Discover-WindowsServer.ps1; this module exposes the engine functions it drives.

Free, read-only Microsoft 365 admin scans. Invoke-LicenseScan cross-checks every assigned license against real sign-in or usage activity and shows the seats you pay for that nobody uses, in dollars. Invoke-OffboardingCheck finds accounts that look like leavers and shows what they still hold: licenses, group memberships, and mailboxes never converte... More info

Lists every Intune-managed Windows device with its version, edition and the last day of security updates for that edition, and exports the result to CSV. Windows 11 support is split by edition, not by build. 24H2 is build 26100 on every edition, but Home and Pro lose support on 13 October 2026 while Enterprise and Education keep it until 12 Octobe... More info

Lists Intune devices that haven't checked in for $StaleDays days, cross-checked against the Entra ID activity timestamp, plus Entra-only devices that have gone quiet. Flags duplicate records left behind by a re-enrolment, devices with BitLocker keys stored in Entra, Autopilot devices and hybrid joined devices, so you know what is safe to delete bef... More info

Lists the Apple MDM push certificate, every ADE enrolment token and every Apps and Books (VPP) token in Intune, with expiry date, days left and the Apple ID behind each one. Exports a CSV. Changes nothing in your tenant, so there is no WhatIf switch. https://atliso.com/blog/intune-apple-mdm-push-certificate-expired

SqlCertForge (audit edition) -- READ-ONLY inventory and verification of SQL Server and Reporting Services (SSRS/PBIRS) certificate configuration: TLS bindings and HTTPS endpoints, estate-wide certificate inventory, TDE, backup encryption, mirroring/AG/Service Broker endpoint authentication, Always Encrypted column master keys, cell-level key hierar... More info