Microsoft 365 security, Intune, and Entra ID
for businesses that run on Microsoft 365.
real production experience, documented from the field, so you skip the trial and error.
Himanshu Arora has spent 12+ years in the Microsoft ecosystem, from frontline cloud support at a Microsoft vendor to delivering enterprise-grade M365 security, Intune, and Entra ID projects for organisations globally. He documents everything: the real fixes, the actual scripts, and the root causes that never make it into the official docs.
Built from real production work.
Open source PowerShell tools for Microsoft 365 administrators. Free to use, documented, and published on GitHub.
Domain Tenant Lookup
Shows which Microsoft 365 tenant has already claimed a domain when your own tenant will not let you add it. Works in your browser, with no sign-in.
M365 Audit Toolkit
Scans your entire Microsoft 365 tenant and produces a report showing security gaps, misconfigured policies, unused licences, and email security issues. No manual checks needed.
Mailbox Cleanup
Finds and removes emails from specific senders across multiple Exchange Online mailboxes at once. Safe to run with a dry-run mode that shows what would be deleted before anything is touched.
Mailbox Size Report
Exports the size of every mailbox in your Exchange Online tenant into a sortable spreadsheet. Essential for planning migrations and identifying who is approaching their storage limit.
LAPS Fleet Audit
Checks every Windows device in your organisation to confirm that the local admin password is being rotated correctly by Windows LAPS. Flags devices that are not protected.
LAPS Hybrid Fix
Fixes Windows devices that are joined to both on-premises Active Directory and Entra ID but are not showing up in the LAPS recovery portal. Diagnoses and repairs the registration automatically.
Windows 11 UEFI Upgrade
Converts older devices from legacy BIOS to UEFI so they meet Windows 11 requirements without a full reinstall. Includes pre and post-upgrade checks and is tested for fleet-scale deployment via Intune.
From the blog.
Field notes from real production work on Microsoft 365, Intune, and Entra ID. Short, practical, no marketing fluff.
Domain already added to another Microsoft 365 organisation: find the tenant and release it.
A business domain would not verify because another tenant held it, and a free public lookup came back with my own name, on a tenant I set up in 2018 and forgot. Home realm discovery, the Microsoft Graph PowerShell release, a forceDelete that was accepted and still failed, and verification with no DNS change.
read post →BitLocker recovery keys missing from Entra ID after removing a third-party agent.
The encryption stays active. The key is not in Entra ID. Clicking Sync does nothing. The two-path platform script approach and the IME timing fact that explains why scripts do not run when expected.
read post →Microsoft 365 PowerShell authentication failures: three bugs, one fix.
The Graph SDK and Exchange Online module fight each other in three different ways: an MSAL assembly clash on PowerShell 5.1, a Graph SDK module load failure when the order is reversed, and a confirmed SDK bug where v2.34+ device-code tokens cache as null. A test matrix across PS 5.1 and PS 7, and the certificate-based fix that works in every order.
read post → New · M365 Audit Toolkit: PowerShell scripts for tenant security and mailbox auditing →