365 Pro Toolkit is a self-hosted Microsoft 365 administration and reporting application. This page explains how the pieces fit together, which is worth five minutes before you start using it.
Features
- Reports. Hundreds of them, covering users, groups, security, licensing, Exchange, Teams, SharePoint, OneDrive, devices, applications and Copilot. Choose your columns, filter, save your own versions, and export to Excel, CSV or PDF.
- Dashboards. Eleven summary views, from licensing and MFA to sign-in trends and Copilot adoption.
- Tools. Day to day administration of users, groups, licenses, mailboxes, OneDrive and Teams, plus password resets, stale account cleanup and offboarding.
- Scheduled reports. Any report delivered by email or to SharePoint on a timetable.
- Alerts. Conditions the toolkit watches for, and an email when one is met.
- Automations. Rules that act on the tenant on a schedule, with a Report only mode that tells you what they would have done before you let them do it.
- Administration. Several tenants from one install, nine access roles, and log forwarding to a SIEM.
It is self-hosted
The toolkit is a Windows service with a built-in web server and its own database. Install it on a server and the whole team reaches it through a browser, or install it on your own desktop if you are the only one using it. Either way it is the same product, and you can move it later.
Nothing is hosted by us. Your tenant data is read directly from Microsoft by the machine you installed it on and stored in the database there. There is no account to create with us beyond your license key, and no copy of your directory anywhere but your own machine.
The database is installed and managed by the toolkit. There is no separate database server to set up, license or back up by hand.
It connects to your tenant with its own app registration
Connecting a tenant creates an app registration in your Microsoft 365 directory, with a specific set of permissions and a client secret. Everything the toolkit reads or changes goes through that registration, so you can see exactly what it is allowed to do, and revoke it in one step by deleting the registration.
You can connect several tenants to one install and switch between them. See Connect a tenant.
It syncs first, then reports from what it synced
The toolkit does not query Microsoft each time you open a report. Background jobs pull your directory, mailboxes, sites and usage data into the local database on a schedule, and the reports read from there.
| Data | How often |
|---|---|
| Users, groups, devices, roles, licenses and the rest of the directory | Every 15 minutes |
| Directory detail that is slower to gather | Hourly |
| Sign-in logs | Every 15 minutes |
| Exchange, SharePoint, OneDrive and Copilot | Daily |
You can manually run a sync anytime by opening the sync manager.
Tools act on Microsoft directly
Reports read from the database. The Tools pages are different: when you reset a password, disable an account, change a group's membership or offboard someone, that is sent to Microsoft immediately.
The list you are looking at on a Tools page comes from the synced data, but the action does not wait for a sync. The change takes effect in Microsoft 365 straight away, and appears in reports after the next sync.
Who can sign in is controlled by the toolkit
People sign in with their Microsoft 365 account, but access is decided by the toolkit's own list under Settings > Access Control, not by Microsoft 365 roles. Being a Global Administrator does not grant access by itself, and somebody with no admin rights at all can be given it.
Roles range from full control down to a helpdesk role that can do nothing but reset passwords. See Access control and roles.
Automation runs on the same engine
Three features run in the background on the same schedule machinery as the syncs:
- Alerts watch for conditions you define and email you when one is met.
- Scheduled reports deliver a report by email or to SharePoint on a timetable.
- Automations carry out actions, with a Report only mode that emails what they would have done without changing anything.
Alerts and automations run whether or not email is set up: findings are recorded on the Alerts page and every automation run is kept with its results, and email is an optional extra on each rule. A scheduled report is the exception, since delivering it is the whole point. Set up the email server when you want any of it to reach an inbox.
Security and architecture
Most of the questions a security review asks are answered by where the toolkit runs and who does the authenticating.
Your data stays on your machine. The toolkit reads your tenant directly from Microsoft and stores it in its own database on the machine you installed it on. Nothing is hosted by us, and there is no copy of your directory anywhere else. The only outbound connections are to Microsoft and to our license server.
Microsoft does the authenticating. Sign-in is OAuth with PKCE against Entra ID. The toolkit never sees or stores a password, and because Entra does the work, your MFA, Conditional Access and sign-in risk policies all apply unchanged. The returned token is validated on audience, tenant, nonce and expiry, and the account must belong to a tenant this install has connected.
Access is an explicit list. Microsoft 365 roles grant nothing here. Only the people on Settings > Access Control can sign in, with a role each, from full control down to a helpdesk role that can do nothing but reset passwords, and optionally limited to named tenants. The Owner cannot be removed or demoted, so no combination of clicks locks everyone out.
The tenant connection is yours and revocable. The toolkit works through an app registration in your own directory, holding a set of named Graph permissions you can read and audit at any time. Revoking all of its access is a matter of deleting that registration.
Secrets are encrypted at rest. Client secrets and mail server passwords are encrypted using a master key stored outside the database, so a stolen database or backup cannot be read on its own. The key can be exported under a passphrase and kept separately.
Every change made through the toolkit is recorded. Any action that writes to Microsoft 365 from here is logged with who did it, what it was, which object it affected, and whether it succeeded, viewable under Settings > Logs and forwardable to your SIEM. Changes made elsewhere, such as in the Microsoft admin center, are not: those live in Microsoft's own audit log.
Transport is yours to secure. HTTPS runs with your own certificate or one the toolkit generates, and the sign-in cookie is marked Secure automatically once HTTPS is on.