New and improved tools, guides and reports, in plain language. Dates are when the change was published. Items marked OpsPilot belong to Cloudek’s owner-only workspace, which is not open to the public.
Updated · Last reviewed
OpsPilot adds a Conditional Access gap check
A read-only report in OpsPilot, the owner-only workspace, that checks Conditional Access policies for missing MFA, open legacy authentication and heavy exclusions, from policy names and counts only.
New: ask for a conditional access review (or conditional access gaps, mfa for admins policy, legacy authentication blocked) and OpsPilot reads each policy's state, grant control names and counts, then shows a graded report with a fix-first list and a table of policies.
It flags no switched-on policy that requires MFA for all users or for administrator roles, legacy authentication that no policy blocks, report-only policies that are not enforcing, policies that exclude many users or groups, and a tenant where nothing is enforcing. Only counts and control names are read: no user, group, role or app identifiers.
It says plainly what it cannot see: named locations, what an authentication strength allows, effective access per person and Microsoft security defaults. Anything it could not check is shown as not checked, never as a pass. Results can be exported as the same branded report as the other OpsPilot reports.
Email authentication study: SPF, DKIM and DMARC across well-known domains
A dated snapshot of public SPF, DKIM, DMARC, MTA-STS and TLS-RPT records across several groups of well-known domains, published as aggregates only with the method and limits.
New: the aggregate data as a JSON file, and the scan script in the repository that reproduces it from a domain list.
OpsPilot adds a hybrid identity sync review
A read-only report in OpsPilot, the owner-only workspace, that shows how healthy Microsoft Entra Connect directory sync looks from Microsoft 365.
New: ask for a hybrid sync review (or Entra Connect sync errors, directory sync health, or why a user is not syncing) and OpsPilot reads synced and cloud-only accounts and shows a graded report with a fix-first list.
It groups provisioning errors by kind (duplicate sign-in name, duplicate email address, invalid characters, other), flags sync that looks stale, disabled synced accounts and synced accounts that have not been updated for a long time, and hints at cloud-only accounts that may belong in sync. Only the error category and property name are read, never the conflicting value.
It says plainly what it cannot see: on-premises Active Directory, the Entra Connect server, replication, connectors and hybrid Exchange need the planned on-premises script. Unknown is never treated as stale. Results can be exported as the same branded report as the other OpsPilot reports.
Three guides to setting up AI coding agents for admin automation
Documentation-based guides to Codex and Claude Code for admin automation, plus a neutral side-by-side comparison, each with a dated source list.
A read-only report in OpsPilot, the owner-only workspace, that lists who holds each Microsoft Entra admin role and what to tighten.
New: ask for a privileged access review (or an admin roles review, or who your global admins are) and OpsPilot reads the active and just-in-time admin role assignments and shows a role-by-role member table with a graded score.
It flags too many or too few Global Administrators, guests and apps that hold admin roles, disabled or idle admins, roles held through groups, generic-looking shared admin accounts, and admin roles that are permanently active when they could be eligible through PIM.
It lists what it could not check, for example group members and MFA, and never guesses. If the permission or licence it needs is missing, that check says so and the rest still run. Results can be exported as the same branded report as the other OpsPilot reports.
New IP address lookup and blocklist check
A new free tool shows your public IP address and looks up any IP address or domain: reverse DNS, network owner and, optionally, a check against a few public DNS blocklists.
New: look up an IP address or a domain for reverse DNS (PTR), forward-confirmed reverse DNS, and the network owner, ASN and registry country from Team Cymru DNS data. The country is where the address block was allocated, not where a device is. Private and reserved ranges are explained and skipped.
New: an optional blocklist check against four free lists. A refused or failed answer is shown as could not check and never as not listed, and the wording never says clean or safe. If the check is switched off, the rest of the page still works.
New: Check mail servers finds a domain’s MX and single SPF addresses and checks them. The email domain health score links to it; blocklist checks are still not part of that score.
One email domain health score
The Email Health Check now gives a domain a score out of 100 with an A to F grade, a fix-first list and a breakdown of every check, and the other email tools link to it with the domain filled in.
New: the score covers SPF (including void lookups), DKIM at common selectors, DMARC, MX with provider detection, MTA-STS, TLS-RPT and the name servers. BIMI, CAA, DNSSEC and Microsoft 365 hints are shown for information and never change the score.
Changed: anything that cannot be checked, such as DKIM when no common selector has a key, is shown as could not check and left out of the score. It is never counted as a pass or a failure, and the page reports how much of the score could be checked.
Changed: the SPF, DMARC, DKIM, DNS checker and header tools keep their pages and addresses, now share the same DNS engine as the score, and offer a box that opens the score for the domain you enter. The domain stays in your browser.
The score is about email authentication and DNS configuration, not a guarantee of inbox placement. Blocklist checks are not part of this score yet. Suggested records are starting points to review with your mail providers, not verified fixes.
OpsPilot checks for MFA gaps
The read-only identity security review in OpsPilot, the owner-only workspace, now looks for people who have not set up multi-factor authentication.
New: MFA gap checks list administrators with no MFA method, accounts that rely on a phone call or text message, member accounts with no MFA method, and how many accounts can sign in without a password. Each finding comes with a plain-English explanation, a recommended next step and the exact points it takes off the grade.
Type “mfa gaps”, “who does not have mfa” or “mfa registration report” for an MFA-only review, or “identity security review” for the full one. Both can be downloaded as a branded report.
Read-only. It shows who has registered a method, not whether MFA is required at sign-in, and each check reads up to 100 accounts, so large organizations are sampled and the report says so.
OpsPilot adds an app registration and credential review
A read-only report in OpsPilot, the owner-only workspace, for expiring app secrets and powerful app permissions.
New: ask for an app credentials review to see client secrets and certificates that have expired or expire within 30, 60 and 90 days, in an expiry calendar sorted by date.
It also flags apps with no owner, secrets valid for more than 24 months, apps open to other organizations, and apps holding powerful Microsoft Graph permissions such as Mail.ReadWrite or Directory.ReadWrite.All.
Secret values are never read. The report is graded A to F, can be downloaded as a branded file, and says plainly what it could not check.
OpsPilot adds a guest access and collaboration sprawl review
A one-click, read-only report in OpsPilot, the owner-only workspace, on guests and Teams that nobody is looking after.
Finds guest invitations that were never accepted, guests who have not signed in for 90 or 180 days, and guests with personal mail addresses inside Teams and groups.
Finds Microsoft 365 groups and Teams with no owner or only one, public groups that contain guests, empty or long-unrenewed groups, and near-duplicate names.
Gives a grade, a plain-English summary for a small company, a fix-first list and a branded download. It lists what it could not check, and changes nothing.
New free tool: Email header analyzer
Paste the raw headers of a message to see where it was delayed, why it failed DMARC or why it went to Junk. Everything runs in your browser.
Every free tool page and blog post now ends with a small Was this helpful? control, so you can tell us about a wrong result or an error without a public comment thread.
Two analysis-grade guides show the method, the sources and the sensitivities behind a Microsoft 365 plan choice and a server platform choice, with every assumption labelled.
A new page shows where Cloudek AI is heading, with every idea labelled Live today, In development, Planned or Concept, and the home page now covers the datacentre as well as the cloud.
The enquiry forms now send your details to Cloudek by email instead of opening a draft in your email app, with the same clear limits on what to include.
Licence calculators now show Microsoft list prices
The Microsoft 365 and Windows Server calculators start from Microsoft's published list prices, dated and linked to their source, and every price can still be edited.
A short notice now asks before Google Analytics loads. Accept or Decline, and change your mind at any time from “Cookie and privacy settings” in the footer.
Privacy and Cookie and privacy settings links now appear in the footer of public pages.
Resources, Trust and What’s new links now appear in the header and footer of public pages.
OpsPilot reports can be downloaded and shared
In OpsPilot, Cloudek’s owner-only workspace, each report can now be saved as a branded file or copied as text.
Download a report as a branded HTML file, or copy it as Markdown, for the mailbox health, Microsoft 365 scorecard, sign-in diagnosis, offboarding and licence reports.
An optional customer name can be added to the report. It is used only in your browser.
Better DKIM results and three new free tools
The Email Health Check now explains a DKIM record that is published but not working yet, and three new tools join the directory.
A plain-English explanation of a result is now one button away on selected free tools. It is off until you press it.
Nothing is sent until you press the button, and an “exactly what will be sent” preview shows the masked text first.
Email addresses, IP addresses, tokens and similar values are masked before sending. Limits on size and request rate apply, and the model is given no tools.
OpsPilot adds mailbox health, Microsoft 365 scorecard and sign-in diagnosis
Three one-click, read-only reports in OpsPilot, the owner-only workspace.
Mailbox health report: a fixed set of read-only mailbox checks, with items that need attention listed first.
Microsoft 365 health scorecard: a graded summary that shows how the grade was worked out and what could not be checked.
Sign-in diagnosis for a named user: five fixed steps covering account status, MFA registration, recent sign-ins, Conditional Access results and service health.
Seven new guides
Practical guides on hybrid identity, mail flow, profiles, tenant security, AI audit logs, CIDR and email domain records.
