Pre-release

August 365 Toolkit

GUIDE · UPDATED 1 NOVEMBER 2026

A Windows desktop app that puts everyday Microsoft 365 administration on one dashboard. Each task is a tile that does one job, and every change it makes is recorded in an audit log you own.

The toolkit is still before its first release, so details here can change. Each tile in the app also has its own help page (the ? at the top right of every tile) that is written from what that tile actually does.

How it works

The toolkit signs in to your tenant as an app, not as you. You register one app in Entra ID (the toolkit can do this for you), give it the permissions your tiles need, and enter its details once. After that, tiles read and change things in your tenant through Microsoft Graph, and for a few mailbox tasks through Exchange Online.

Nothing runs in the cloud on our side. The app runs on your PC and talks directly to Microsoft. The activity log, settings and error logs all live on your PC (or in a shared folder you choose).

Before you start

• A Windows PC.
• A Microsoft 365 tenant, and someone who can grant an app permissions in it. A Global Administrator can do everything in one step. Otherwise the toolkit can make a script for your admin to run once (see below).
• For the Exchange mailbox tools, either the app gets Exchange access of its own (recommended, set up automatically), or an Exchange admin signs in when a tile asks.
• For Content Search, whoever uses it needs the eDiscovery Manager role in Microsoft Purview. Global Administrator alone is not enough.

Connecting to your tenant

The first time you run the toolkit, a setup wizard opens. On its Connections step you have three routes.

Route 1: let the toolkit set it up (easiest)

1. Press Sign in as admin and set it up.
2. Sign in once in your browser as a Global Administrator (or Application Administrator plus Privileged Role Administrator).
3. The toolkit creates an app registration called “August 365 Toolkit”, grants the Graph permissions the tiles use with admin consent, assigns the Exchange, Password and Authentication Administrator roles, and uploads a certificate for this PC.

The certificate’s private key stays in your Windows certificate store and cannot be exported. To undo the whole thing, delete the app in Entra ID under App registrations. Every setup step is written to the audit log.

Route 2: I’m not an admin

Press I’m not an admin: ask my admin. The toolkit saves a script for your admin to run once. It writes a small reply file with the tenant ID and app ID, and no secrets. Send that back and use Load my admin’s reply.

Route 3: by hand

1. In Entra ID, create an app registration (single tenant) and note the Application (client) ID and Directory (tenant) ID.
2. Create a client secret and copy its value straight away. It is shown once.
3. Add the Graph application permissions below and press Grant admin consent.
4. Enter the three values in the wizard and press Test Connection.

Permissions

The toolkit uses Graph application permissions, not delegated ones. Only add what the tiles you will use need. Check Permissions in the app shows what is granted and which tiles are missing something.

Entra roles for the app

Some writes also need a directory role on the app, as Microsoft requires. Resetting passwords needs Password Administrator (or User Administrator); without it every reset returns 403 even with User.ReadWrite.All granted. Removing MFA methods needs Authentication Administrator. Resetting the password of an account that holds an admin role needs a higher role still, which is a Microsoft rule.

Exchange app-only (optional)

Give the app Exchange.ManageAsApp and the Exchange Administrator role and the Exchange tools (Mailbox Access, Set Forwarding, Message Trace, Teams Call Audit and the Offboarding Wizard’s mailbox steps) just work. Without it, they ask an Exchange admin to sign in, and changes are logged against that admin. A new app’s role can take several minutes to be noticed by Exchange.

A tour of the app

• Home is your dashboard. Snapshot cards show a live count; action tiles open a tool. You choose which tiles appear in Settings, and how big the cards are.
• Quick user lookup on Home: type part of a name or address and open the person in User Lookup.
• The sidebar groups every tile by the job it does (the seven areas below), including tiles that are not on your dashboard.
• The dot on each card: green means connected and ready, amber means it will ask an admin to sign in when you open it, red is a connection error, grey is not configured.
• Tiles marked SIGN-IN ask for an admin sign-in the first time you open one in a session (Exchange for mailbox tools, Purview for Content Search). Nothing is stored, and the session ends when you close the toolkit.
• Audit shows the toolkit’s own record of every change, plus Microsoft’s directory audit log for reference.
• User Templates keeps saved new-starter setups for Create User.
• Settings has six tabs: General, Connections, Mail, Dashboard, Appearance and Preferences. Changes save as you make them.
• There are themes, including a plain standard-Windows one with no humor.
• Help and the ? on every tile open the built-in guide. Keyboard: Ctrl+H for Home, Ctrl+S for Settings, Ctrl+R to refresh the dashboard.

The seven areas

Click the planets on the home page for the same list. Each tile’s help page says exactly what it changes and whether that can be undone.

Walkthrough: offboarding someone

The Offboarding Wizard runs every leaving step for one person in a fixed, safe order and keeps a report. It has five stages: pick the user, choose the steps, review, run, save the report.

1. Pick the person. Search and click them. Check the account card: manager, licenses, mailbox, groups.
2. Choose steps. Disable account is always on. Optional steps include revoking sign-in sessions and MFA methods, removing licenses, marking OneDrive for deletion after a retention you choose, reassigning group and Teams ownership, renaming the display name with a prefix, clearing the manager field and removing all group memberships (the full list is logged first). With Exchange access you can also apply litigation hold, convert to a shared mailbox, hide from the address book, grant mailbox access to a delegate and set an out-of-office reply. Customize defaults saves your usual choices.
3. Review. A plain-English summary of exactly what will happen.
4. Execute and confirm. Each step reports as it finishes. A failed step does not stop the run: it is marked with an Error ID and the others carry on.
5. Keep the report with Export CSV or Export HTML.

Undoing it: disable, licenses, manager, display name, group memberships and ownership are put back by hand (the report and audit log list exactly what was removed). The user signs in again and re-registers MFA. Mailbox changes are reversible in Exchange admin. Litigation hold should only be removed with your legal team’s agreement.

Audit and safety

• Every change is recorded. The audit log stores what changed, the before and after values, who did it (the account you work as, and your Windows user and PC), and whether it succeeded.
• Stored locally. One file per day under %APPDATA%\August365Toolkit\Logs, or a folder you choose. Default retention is 90 days.
• Readable. The built-in viewer under Audit, with Export CSV, Export HTML and Open folder.
• Explained before you act. Each tile’s help page lists what it changes and what cannot be undone. The Offboarding Wizard asks you to confirm before it runs.
• Red means it changes your tenant. Buttons that remove, delete, disable or dismiss things are red; read-only and queue-only buttons are not.

The toolkit performs real administrative actions on your production tenant. Review what a tile will do before you confirm it, and read the terms.

Working as a team

Several admins can share one setup through a shared folder, a file share or a synced OneDrive or SharePoint folder. Everyone gets the same tenant, defaults and templates, and one admin’s change reaches the others.

• Shared: tenant and app ID, organization, UPN rules, default password, mail settings, password policy, Create User fields, offboarding defaults, templates, audit log folder and retention.
• Never shared: your client secret or certificate, theme, window position and dashboard layout.
• With a shared audit folder each admin writes their own log files and the viewer shows them together, newest first.
• Two admins changing different settings keep both changes. If both change the same one, the last save wins.
• If the folder is unreachable the toolkit starts from the last copy it read and says so.

Share from Settings > Connections > Team settings. Join from the setup wizard’s Connections step with Load team settings.

When something goes wrong

Every error the toolkit shows carries an Error ID such as E-3FA9C2. The full detail (what was being done, Microsoft’s exact message, versions) is in the error log on your PC under that ID, with passwords, tokens and secrets removed.

1. Note the Error ID, and use What does this mean? on the message.
2. Settings > Connections > Export support bundle packs the recent logs and version details into one zip. Tick Hide email addresses to swap addresses for codes.
3. Email the zip and the Error ID to support@outsidecontextsoftware.com.

There is also an optional Send error reports automatically setting, off by default. Preview what is sent shows the exact content first.

Privacy in one paragraph

The toolkit has no telemetry and does not phone home. It talks to Microsoft, in your own tenant, and nowhere else, unless you opt in to error reports. The privacy page has the details.