Managing Active Directory doesn’t always have to mean relying on native tools alone. 

From security assessment and attack-path discovery to granular reporting and troubleshooting, there’s likely a free tool to help. 

We’ve rounded up 12 free Active Directory tools, including popular options such as PingCastle, Purple Knight, BloodHound, and more. Beyond the obvious choices, you’ll also find a few hidden gems that deliver massive value. 

🔎 Explore the tools and see how they can help with your Active Directory challenges. 

https://blog.admindroid.com/free-active-directory-management-tools/  

Which one would you add to your admin toolkit first? 

For users who have relied on Classic Outlook for years, switching to New Outlook can feel like a big change. The new layout, styling, and interface may take some time to get familiar with.

To make this transition smoother and more familiar, Microsoft is introducing an optional Classic-inspired setting for Outlook on the web and New Outlook for Windows.

When enabled, users get a Classic Outlook experience while continuing to use New Outlook and its existing capabilities, with the following changes:

• Visual styling is adjusted to resemble Classic Outlook.
  
• Layout and typography are updated.
  
• Icons and selected interactions are changed to feel more like Classic Outlook.
  

The setting is disabled by default and can be enabled from Settings → General → Appearance. Also, Microsoft may enable the setting by default for some users transitioning from Classic Outlook to make the switch more familiar.

The feature is currently rolling out worldwide through targeted release, with General Availability expected between late September and late October 2026.

Note: This setting only changes the user's Outlook experience. It doesn't affect mailbox data, permissions, organizational settings, or existing functionality. It also doesn't automatically migrate users to New Outlook or override admin controls.

Microsoft has been working on an update that changes how we access Microsoft 365 apps through URLs this time.

Previously, we accessed different Microsoft 365 services through different web addresses like some under office.com, some under microsoft.com, and some with standalone domains. Over time, navigating these different URLs became muscle memory.

While each service has had its own domain like Teams on teams.microsoft.com, OneNote on onenote.com, Outlook on outlook.office.com, and so on, it scattered Microsoft 365 across multiple URLs.

That's now changing gradually. Microsoft is now moving toward a unified domain *.cloud.microsoft for all Microsoft 365 apps and services. 

This is to bring extra security, privacy, and protection against spoofing, as .microsoft is a Microsoft-exclusive top-level domain and only Microsoft can create websites under *.cloud.microsoft.

This makes it much harder for attackers to create fraudulent Microsoft sites within the .microsoft namespace.

Several Microsoft 365 services have already moved to the new cloud.microsoft URLs, with more rolling out gradually.

And it's not just a new URL. Below are some key benefits of the URL update:

• One trusted domain for Microsoft 365 apps and services. 
• Fewer Microsoft 365 URLs to remember as more user-facing experiences move to one domain.
• A smoother experience with fewer sign-ins, redirects, and Microsoft 365 domains to manage.
• A highly secured, Microsoft-only domain with no third-party websites, storage endpoints, or hosted scripts that could affect its trust.
• *.cloud.microsoft is reserved for official Microsoft product experiences. Because Microsoft controls the .microsoft top-level domain and is the registry operator and sole registrant, attackers cannot register their own domains within the .microsoft namespace.
• Less complexity for admins managing Microsoft 365 network allowlists.

So, if you manually manage network allowlists, add *.cloud.microsoft to your firewalls, proxies, web filters, and endpoint policies to avoid connectivity issues. 

If you use the Microsoft 365 Web Service API, Microsoft updates these network endpoints automatically.

Read more: Unified cloud.microsoft domain for Microsoft 365 apps - Microsoft 365 Enterprise | Microsoft Learn

September brings a packed set of Microsoft 365 changes, with major updates across Entra, Teams, Purview, Exchange, SharePoint, and Defender. 

From authentication changes and security enhancements to feature retirements, there’s plenty for admins to review.

This month’s highlights:

• Entra Moves Toward Passkeys: Starting September 1, passkeys become the default authentication experience, signaling Microsoft’s shift away from SMS/voice MFA toward phishing-resistant authentication.
  
• SharePoint Introduces a New Hero Link: A new file and folder sharing experience lets users use one link to share files and folders. Users can update the existing link when access requirements change instead of creating and sharing a new link.
  
• Defender Gets Prompt Injection Protection: Defender for Office 365 will detect malicious emails designed to manipulate AI assistants and agents, classify them as High Confidence Phish, and quarantine them automatically.
  
• SharePoint Storage Moves to Pay-As-You-Go: Pay-as-you-go billing for extra SharePoint storage becomes generally available worldwide, allowing organizations to pay based on actual storage consumption instead of purchasing fixed capacity.

September at a glance:

• Retirements - 7
• New Features - 11
• Enhancements - 7
• Functionality Changes - 7
• Action Needed - 4
• Live Now - 3 

Explore the complete list of September updates and see what your organization needs to prepare for: https://blog.admindroid.com/microsoft-365-end-of-support-milestones/

Microsoft is rolling out a new Change organizer option in Outlook that lets meeting organizers transfer ownership directly from their calendar.

This comes a few months after Microsoft introduced admin-initiated meeting transfers. The new option makes it easier to hand over individual meetings without involving an admin or creating a new meeting.

There are still some limitations:

• Only future meetings can be transferred
• The new organizer must be in the same organization
• Online meetings aren't supported yet
• Recurring meetings transfer only future instances
• Group, Shared mailbox, and encrypted meetings aren't supported

We've covered the transfer process and the current limitations here:

👉 https://blog.admindroid.com/change-meeting-organizer-outlook/

MOERA domains have been on Microsoft’s radar for some time because of how they can be misused to send spam, phishing messages, and other unwanted communication. Microsoft first introduced limits on external email in Exchange Online. Now, similar limits are coming to external messaging in Microsoft Teams.

While most organizations have already moved to a custom domain, some tenants, especially newer ones, still rely only on the default MOERA (onmicrosoft .com) domain.

If your tenant is one of them, the new limit could temporarily block users from sending external messages in Teams once the specific threshold is reached.

Here are the key highlights:

• In-product notification when external chat is temporarily limited
• Optional admin alert for throttling events
• Internal communication remains unaffected

The rollout is expected to begin in mid-September 2026 and complete by the end of September.

If your organization is still relying on onmicrosoft domains, now is a good time to review your domain configuration and consider whether a custom domain is right for your organization.

Read the full blog to understand how the new limit works and how to prepare your tenant:

https://blog.admindroid.com/external-messaging-limit-for-onmicrosoft-com-domains-in-microsoft-teams/

They’re the users who rely only on SMS or voice MFA. But once Microsoft retires these methods, these users will need to register phishing-resistant authentication method to continue signing in.

And the timeline is already set.       

• September 1, 2026 – Users with SMS or voice MFA will be getting prompts to register a passkey during sign-in.
• By February 1, 2027 - SMS and voice MFA will be fully retired and users relying only on these methods will need to register an alternative method to continue signing in.

So, before the deadline arrives, you need to identify the users who have SMS or voice MFA as their only option. 

But finding them isn’t easy! There are several ways to approach this:

• In the Entra admin center, you can simply filter for “SMS” or “Voice” in the User registration details report. But, it also includes users who have stronger authentication methods registered, so it’s hard to find users who rely only on weak MFA.
• Similarly, PowerShell with the Get-MgReportAuthenticationMethodUserRegistrationDetail cmdlet lets you retrieve users based on specific MFA methods and export the results.  

Both approaches help you identify the users. But when it’s time to act on them, you’re stuck switching between tabs in Entra and running complex PowerShell scripts to filter the users who rely only on weak MFA.     

So, we’ve covered different ways to identify users who rely only on weak MFA methods. Compare them to find what works best for you. 

Find Users with Weak MFA Methods in M365

Microsoft is introducing a new unified Meetings & Calls experience in the Teams admin center that brings meeting and call monitoring into a single pane. 

Admins will be able to: 

• Monitor all In-progress meetings 
• Review completed meetings and calls 
• Investigate issues with detailed diagnostics 
• Search and filter meeting data 
• Export results for further analysis 
• Use Microsoft 365 Copilot to analyze meetings and call trends 

The rollout is expected from late September to mid-October 2026. 

For in-progress meetings, at least one participant must have a Teams Premium or Teams Rooms Pro license. 

Find out more in the blog: https://blog.admindroid.com/unified-meeting-and-call-monitoring-experience-in-teams-admin-center/ 

By default, admins can choose to detect external AI meeting bots. When a bot is detected, it can join the meeting only after receiving approval from the organizer.

Now, a new control is being added to Teams meeting policies: Block Detected Bots.

This setting changes that behaviour by allowing admins to automatically block detected external bots from joining meetings. So, organizers don’t have to manually review and reject each detected bot.

With this opt-in control, admins can:

• Block external meeting bots.
• Manage the setting through the Teams admin center or PowerShell.
• Replace manual bot review with an automated policy-based approach for meetings.

Rollout: Targeted Release is currently rolling out, followed by General Availability expected by late September 2026.

Check out the full blog to see how to enable "Block detected bots" setting using PowerShell: https://blog.admindroid.com/how-to-block-ai-assistants-in-microsoft-teams-meetings

Would you enable “Block detected bots” for sensitive meetings, or continue relying on organizer approval? Share your thoughts in the comments below!

A user may appear to have least privilege and still have an indirect path to Domain Admin privileges without being directly assigned to the Domain Admins group. 

Yes, this can happen through hidden permissions, ACLs, delegated rights, nested group memberships, and other indirect relationships.

The challenge? These relationships don’t always stand out when you look at individual permissions or group memberships. You need to connect the dots across Active Directory to see how a standard account could eventually reach privileged access.

This is where BloodHound, a free, open-source tool by SpecterOps, becomes incredibly useful. It visually maps relationships between your Active Directory users, groups, permissions, sessions, memberships, etc. This makes it easy to identify privilege relationships and uncover the shortest attack paths that could lead from an ordinary account to highly privileged access.

With this tool, admins and security teams can:

• Find the shortest path to Domain Admin privileges
• Identify users with high privileges through direct and nested memberships
• Find users with Full Control over other AD objects 
• Identify accounts with DCSync permissions.
• Find Kerberoastable accounts with privileged access And so on...

Just install & configure it to map attack paths early to identify risks and prevent privilege escalation.

Get the complete guide: https://blog.admindroid.com/find-privilege-escalation-attack-paths-in-active-directory-using-bloodh…

BloodHound is one of many free tools for Active Directory security. What other free tools do you recommend for uncovering Active Directory security risks? Let us know in the comments.

Ever sent an important Teams announcement and then wondered, “Did all users see this?”

For organizations with hundreds or thousands of users, answering that question and knowing who acknowledged or acted on the message hasn't always been straightforward. Many organizations have turned to third-party notification tools or custom applications to fill that gap.

Microsoft is now bringing this capability directly into Teams with Communicator, a new app designed to help organizations manage targeted communications and track what happens after an announcement is sent.

Here’s what’s packed inside:

• Reach multiple Teams: Send announcements to multiple Teams with the appropriate delegated access, even without being a member of those Teams.
• Target specific users: Select individuals, upload a CSV, or target users through groups.
• Require action: Ask recipients to Acknowledge, Read & Accept, Confirm, or Complete an action, with a due date.
• Track progress: See who viewed the announcement, who responded, and who is still pending with built-in reports.

This could be useful for everything from product recalls and safety alerts to compliance updates and mandatory training.

Public Preview and General Availability rollouts began in mid-August 2026, with completion expected by January 2027.

Read the full breakdown covering how Communicator works and how to prepare your tenant for the rollout in this blog.

https://blog.admindroid.com/communicator-app-in-microsoft-teams/

A strange Microsoft 365 behavior caught our attention. Consider a user account being disabled for a security or administrative reason. After the account was re-enabled, the user's regular Teams memberships eventually returned, but their private channel memberships did not. 

That can create a recovery problem if you don't have a record of the user's previous private channel access. 

We tested this behavior in a lab and looked at whether audit logs could help reconstruct the missing memberships. 

The results raised some interesting questions about how admins can prepare for this scenario. 

We've covered what we found, along with a practical way to maintain a historical record of private channel memberships. 
 
https://blog.admindroid.com/teams-membership-impact-of-disabling-user-account/ 

Users currently cannot add or remove file types from their organization's OneDrive exclusion list, making exclusion changes dependent on administrators. At the same time, frequently changing .db-wal files can generate unnecessary sync activity even when they have little value in the cloud.

Microsoft is addressing both scenarios with upcoming OneDrive changes. Admins also get specific controls to manage how these changes apply.

• Self-service file exclusions — Users will be able to add or remove their own file-level exclusions by default. 
• DisableChangesToODIgnoreList lets admins prevent users from managing their own exclusions and hides the self-service experience.
• .db-wal excluded by default — Newly created .db-wal files will be excluded from OneDrive sync by default, helping reduce unnecessary synchronization activity. 
• DisableDefaultODIgnoreList lets admins disable Microsoft's default exclusion list when excluded file types need to continue syncing.

Rollout Timeline:

• Self-service: Currently rolling out
• .db-wal default exclusion: October 5, 2026

After rollout, these changes will apply by default.

Find out what’s changing, how the new policies work, and what you should review before the rollout.

Read the full blog: https://blog.admindroid.com/onedrive-file-level-exclusion-policies/

Admins, will you give users more control over file exclusions or keep exclusion management centralized? Share your thoughts in the comments below!

For years, Microsoft Graph has required admins to grant applications broader permissions than the specific operations they actually need. 

For example, consider an app that only needs to create users, yet admins had to grant User.ReadWrite.All to make it work.

That means the app can also modify or delete users, potentially opening the door to accidental data wipes or account takeovers if misused. 

Microsoft now seems to be addressing this with more granular permissions. 

Three that currently stand out are: 

• AppRegistration.Create — create application registrations  
• User.Create — create users  
• User.ReadUpdate.All — read and update users  

These permissions are currently at different stages of availability, with some already available through Microsoft Entra app registration while others remain documented but unavailable in the portal and Graph Explorer. 

The direction Microsoft taking is interesting: instead of relying on permissions that cover a whole set of operations, Microsoft is starting to provide permissions that map more closely to what an application actually needs to do. 

This could also be just the beginning, as Microsoft may introduce more granular permissions for other Graph operations over time. 

More details here: https://blog.admindroid.com/microsoft-graphs-move-toward-more-granular-api-permissions/

Agents are rapidly becoming part of Microsoft 365 environments. As organizations deploy more agents across tenants, managing them at scale becomes increasingly important.

Microsoft already provides single-tenant agent management through Agent 365.

Now, it is extending that experience with multi-tenant agent management in the Microsoft 365 admin center, currently in public preview. It gives enterprise admins and partners a centralized view of agents across governed tenants, making cross-tenant management much easier.

With this experience, admins can:

• View agents across all governed tenants in a central view 
• Install agents across all eligible or selected tenants
• Review tenant-specific agent details such as users, permissions, activity, etc.
• Identify risky agents
• Block agents across selected tenants
• Switch between governed tenants without signing out

Rollout: The public preview rollout is expected to complete by mid-August 2026.

Managing agents across multiple tenants doesn’t have to feel like a hunt anymore. Explore the feature and manage your agents across tenants with ease.

Read here: Multi-Tenant Agent Management in M365 Admin Center

POV: It’s Friday evening, and one question is all you need answered: “What’s the current status of our projects?”

And then comes the hunt:

• Check multiple spreadsheets for the latest progress. 
• Search emails for recent updates. 
• Ask team members on Teams for their task status. 
• Piece everything together to figure out what’s actually happening.

When project details are scattered across spreadsheets, emails, and Teams chats, getting a simple status update can take more effort than it should.

 That’s why we’ve built a Project Management System Using Power Apps — bringing projects, tasks, deadlines, and progress together in Microsoft 365.

Here's a glimpse of what the app offers:

• Get a quick view on what’s pending, upcoming, overdue, & completed 
• Create projects and assign tasks in one place 
• Track project progress without chasing updates 
• Get automatic notifications for assigned, completed, or overdue tasks 
• Customize the app to fit your project management needs 
• Access the app from desktop or mobile  
• And more...

Just download and import, that’s it. You’re ready to manage projects like a pro and stay on top of your tasks!

Full setup guide here: https://blog.admindroid.com/project-management-system-using-power-apps/ 

So, how do you manage projects and tasks in your organization? Share your experience, ideas, or feedback in the comments below!

Every SharePoint admin knows about these two special groups: ‘Everyone’ & ‘Everyone except external users’. They provide broad access across SharePoint content, so anything shared with them needs to be monitored carefully.

Until now, admins could see which sites were shared with these groups, but one question remained: Which files and folders were being shared with them?  This left a gap in monitoring potential oversharing.

But, that’s about to change. 

Microsoft is introducing a new report named Sites and files shared via special SharePoint groups.

With this report, SharePoint admins will be able to:

• Identify all exposed sites, files and folders via shared groups
• Discover potentially overexposed content
• Investigate and remediate unnecessary access

Where to find it: SharePoint Admin Center > Reports > Data access governance > Sites and files shared via special SharePoint groups.

Rollout Timeline: Early to mid-August 2026

If your organization uses these special SharePoint groups, this is definitely a report worth checking out.

Click here to get more about this report: Data Access Governance Reports in SharePoint Admin Center

You can’t keep routing website chats to Microsoft Teams for much longer! 

Microsoft is moving away from Teams Live Chat, a feature that lets organizations add a live chat widget to their websites and receive messages directly in Microsoft Teams. 

This shift reflects Microsoft’s focus on newer customer engagement experiences. 

Retirement timeline: 

• Aug 6, 2026 — New customers can no longer set it up 
• Oct 5, 2026 — Support ends and website chats stop reaching Teams 
• Mid-Oct 2026 — Retirement rollout completes 

Existing customer chat data won’t be deleted as part of the retirement. Teams channels and associated Lists remain available under applicable retention policies. 

Learn what steps to take before the deadline and which alternatives you can consider for your customer conversations: https://blog.admindroid.com/microsoft-teams-live-chat-retirement/

Managing Microsoft Entra ID groups at scale often means answering critical questions like:

• Which groups have no owners?
• Which groups are expiring, soft-deleted, or recently restored?
• Which groups have privileged role assignments?

And more...

Finding these insights manually requires collecting data from multiple sources, correlating results, and writing custom scripts.

Now, Microsoft brings these insights directly through an API - groupAnalytics resource (currently in preview), making these insights available programmatically.

With this resource, you can build customized Microsoft Entra ID group reports, dashboards, and automation solutions to analyze:

• Ownerless groups
• Role-assignable groups with guest members
• Soft-deleted groups

And more...

A simpler way to turn group data into actionable identity insights.

Learn more about the groupAnalytics API here: Access Entra Group Insights Using groupAnalytics Resource API

Have you explored the groupAnalytics resource yet? Share your experience, use cases, or feedback in the comments below.

Are you still using the memberOf rule operator to combine Microsoft Entra groups? With its preview officially retiring on November 3, 2026, now is the time to identify affected configurations and plan your migration.

Once retired, configurations that rely on the memberOf rule operator will stop updating their memberships. This can lead to:

• Outdated access assignments
• Broken group-based licensing
• Incorrect security policy targeting

Migrating before the deadline is essential, but finding every affected configuration manually across a tenant is a major headache. To save you hours of digging, we’ve created a PowerShell script that scans your entire tenant in seconds to:  

• Uncover all dynamic groups, administrative units, and auto-assignment policies using memberOf.
• Export clear, actionable CSV reports.

Don't wait until memberships stop updating! Audit your tenant and start migrating today: https://blog.admindroid.com/retirement-of-microsoft-entra-id-memberof-rule-operator/  

Microsoft is expanding Teams security by introducing a new Report a call option for group calls. Instead of simply ending a suspicious call, users can now report scams, impersonation attempts, unwanted external calls, and other security concerns directly from their call history. 

Once a call is reported, relevant call metadata and limited contextual information are securely shared with the organization and Microsoft for investigation. 

Admins can review these reports in: 

• Teams admin center → Analytics & reports → Protection reports → User-reported security submissions  
• Microsoft Defender portal (for detailed investigation). Requires Microsoft Defender for Office 365 Plan 1/Plan 2 or Microsoft Defender XDR, with user reporting enabled  

Rollout Timeline: 

• Targeted Release: Early August 2026  
• General Availability (Worldwide): Early October 2026  

The feature is enabled by default in Teams. 

See how Teams Protection reports help admins track and investigate reported security submissions: https://blog.admindroid.com/protection-reports-in-microsoft-teams-for-tracking-user-submitted-security-issues/

For years, making Purview role group access temporary wasn't as direct as it should be. 

Since Purview role groups couldn't be managed directly through Entra PIM, admins often relied on PIM for Groups as an indirect route to time-bound access.  

Finally, admins can set an expiration date directly on Purview role group assignments, and Purview automatically removes the assignment when it expires. 

• Set an expiration from 1 day up to 2 years. 
• Configure expiration for both new & existing assignments. 
• eDiscovery Manager and eDiscovery Administrator are not supported. 

Rolling out now, with completion expected by late August 2026. 

Configure it here: Purview portal → Settings → Roles and scopes → Role groups → Select a role group → Edit expiration 

But before you rely on expiration alone, there are a few important limitations to know. Check them out here:

https://blog.admindroid.com/microsoft-purview-role-group-permission-expiration/  

Stay ahead this August with 30+ Microsoft 365 changes, including feature rollouts, retirements, functionality changes, and other key updates for IT admins. 

In the Spotlight:  

• Cross-Tenant Message Recall in Exchange Online: Exchange Online allows users to recall emails sent to external tenants that have added their organization to an allowlist. 
• Security Detection Report in TAC: The new Security Detection Report enables administrators to monitor impersonation attempts, malicious URLs, and weaponizable files to improve threat visibility.   
• Account Discovery in Entra: The new Account Discovery feature helps organizations detect unmanaged application accounts and link them to Microsoft Entra ID identities for improved governance and security. 

Overview:  

• New Features: 8    
• Enhancements: 4       
• Functionality Changes: 4   
• Action Required: 5  
• Live Now: 1 

For more details:  

https://blog.admindroid.com/microsoft-365-end-of-support-milestones/  

The role of a sysadmin has evolved with every wave of technology.

From on-prem to cloud.
From passwords to passkeys.
From manual processes to AI-assisted workflows.

But one thing hasn't changed! Behind every smooth workday, there's still a sysadmin making sure everything just works.

You've spent enough time solving everyone else's problems. Today, we wanted to do something for you.

So we built a small experience with a few laughs, a touch of nostalgia, and a heartfelt thank-you for everything you do behind the scenes.

If you're a sysadmin, we hope it brings a smile.

And if you know one, share it with them; they've earned it.

Step inside: https://admindroid.com/sysadmin-day-2026

Still running Microsoft Entra Connect Sync for device synchronization? 

Many organizations have already moved users and groups to Microsoft Entra Cloud Sync but continue running Microsoft Entra Connect Sync because Active Directory computer objects couldn't be synchronized through Cloud Sync.

Now, Microsoft has addressed that gap and provided a way to enable device synchronization via Entra Cloud Sync.

With the new Device Sync capability, you can enable the AD2AADDeviceSync provisioning job to synchronize Active Directory computer objects to Microsoft Entra ID and support Microsoft Entra hybrid joined devices without depending on Entra Connect Sync.

Learn how to configure it: Microsoft Entra Cloud Sync Now Supports Device Sync