365 Pro Toolkit Release Notes

v2.3.3

October 29, 2026

New

Alerts. Rules that watch the tenant and raise an alert when something needs looking at: repeated failed sign-ins, a sign-in from a new country, an admin signing in without MFA, a sign-in Conditional Access blocked, legacy authentication, a failed or stalled sync, an app certificate or secret about to expire, a mailbox nearly full, and more privileged role assignments than you allow. Each rule has its own severity, thresholds and time window, and can email a list of recipients as well as raising the alert in the app. Automation > Alerts lists what has been raised, with Alert rules alongside it.
Log forwarding. Settings > Log Forwarding sends the audit trail on to your SIEM or log collector as it happens, over syslog (TLS, TCP or UDP) or an HTTPS webhook, formatted as CEF or JSON. Each destination can take every audit entry, only the failures, or only the actions you pick, and there is a Test button plus a last sent and last error status on each one.
Copilot reports. Reports > Copilot has Copilot Usage, Seats Not Used and Active Users: who holds a Copilot license, how much each person is using it across Teams, Outlook, Word, Excel, PowerPoint and chat, and which seats have gone unused and can be reclaimed.
Copilot dashboard. Dashboards > Copilot shows licensed and active seats, unused seats and usage by app at a glance, with a link through to the reports behind each figure.
Teams reports. Reports > Teams has nine reports over the synced groups: All Teams, Teams Without Owners, Teams With One Owner, Empty Teams, Public Teams, Teams With Guests, Recently Created Teams, Teams Expiring Soon and Dynamic Teams. No extra sync is involved, so they cost nothing to run.
Certificates Expiring Soon and Secrets Expiring Soon. Two application reports with their own window picker: already expired, within 7, 30, 60 or 90 days, or any expiry date, soonest first. Certificates and secrets are kept apart because renewing one is a different job from renewing the other, and a single combined column could never say which was running out.
Admin-consented Apps. The applications an administrator granted on behalf of everyone, beside the existing User-consented list.
Users with Privileged Roles. A report of everyone holding a role Microsoft classifies as privileged, alongside Role Assignments, All Global Admins, Disabled Accounts with Roles and Guests with Roles.
Sync log. Settings > Logs has a second tab showing what the background syncs have been doing, one line per pass and one line per changed object, with the user or group named. The last 14 days are kept; the full history stays in the downloadable log files.
Redesigned Data sync dialog. Each source is a row showing what it brings in, when it last ran and when it runs next, with a link to the sync log.

Improved

Applications report rebuilt. Enterprise Apps is now Applications, and its columns are named and worded the way the Entra portal names them, so you can read the two screens side by side without translating: Activation status showing Activated or Deactivated, Visible to users, Assignment required, Supported account types spelled out in words rather than Graph's raw enum, Application ID and Object ID. Certificate expires and Secret expires are separate columns, and each report starts on the columns that suit the question it answers.
The invented permission grading is gone. The old Permissions level, score, Flags and High-privilege columns were the toolkit's own guesses dressed up as facts, on the report and on the dashboard. They have been removed. The Applications dashboard is now four tiles plus a table of the credentials expiring soonest.
App permissions are accurate and much faster. Permissions are now read from the API's side, asking each service who holds roles on it, instead of asking every application what it holds. On a tenant with around 700 applications that pass went from 17 seconds to under one. Each API's permission catalog is stored, so role IDs no longer have to be looked up again to be turned into names.
Reports navigation is a tree. The reports sidebar nests category, then subcategory, then the reports themselves, so every report in the catalog is reachable from the sidebar instead of only the first one in each group.
Tools pages keep their filter. The filter you set on a Tools grid stays put while you move around the app and comes back when you return to that page.
Tools pages load from the synced data. The lists on the Users, Groups, Teams, Mailboxes, OneDrive and Cleanup tools now come from the toolkit's own database instead of calling Microsoft 365 each time you open them, so they open straight away on tenants of any size. They also gained the report grid's column chooser, so you can add any of the synced columns, and the multi condition filter, so you can pick exactly the accounts you want to act on.
Offboard several users at once. Offboarding takes a list of accounts rather than one, added by searching or from a CSV of sign-in names. The steps you pick are applied to each account in turn, in the same safe order, and a failure on one account does not stop the rest.
Reports scroll instead of paging. Reports now load rows as you scroll rather than a page at a time. Large reports with a lot of columns selected are much faster, and the page size dropdown is gone because you no longer need it.
Complete data on the first sync. Users, groups, devices and contacts are now read from Microsoft's full endpoints rather than its change feed, which silently leaves some fields empty. Columns such as on-premises user principal name and manager now arrive on the first sync instead of staying blank.
Syncs do far less work when nothing has changed. A sync that finds no changes now stops immediately instead of reading every record to reach the same conclusion. Large tenants will also see lower memory use during the hourly detail sync.
Setup shows what it is doing. The setup wizard names the step each source is on rather than showing a count that sits still for minutes.
Entra Data runs every 15 minutes, with the slower detail sync (sign-in activity, MFA registration, roles) on the hour.
New application icon, and a clearer report toolbar: the record count is larger and column headings are lighter.

Fixed

MFA, sign-in, role and Member of columns went blank. Changing anything about a user emptied those columns until the next detail sync, up to an hour later.
A temporary Microsoft error could remove a user from your reports. A throttled or failed lookup was treated as a deletion. Only a genuine "not found" now counts, and anything else retries.
Applications report was missing last sign-in for apps that had not changed recently. Last sign-in is now recomputed every run, since it moves without the application itself changing, and an empty value never overwrites a stored date.
A sync could get stuck retrying an expired change-tracking token. Microsoft returns one error code for an aged-out token and the app only recognized another, so the sync retried instead of starting a full read. All the change-tracked sources now share one test and fall back correctly.
A failed manager lookup could leave an install permanently without managers. The change-tracking token was saved before the manager pass ran, so every later sync went incremental and never went back for them.
Sources that were skipped reported as synced in the Data sync dialog.
Copilot and the other usage reports could come back empty without saying so. They now ask Microsoft for CSV explicitly, and a response that cannot be read is logged instead of quietly producing no rows.
The Data sync dialog read "Failed never" for a source that was stopped part way through a run.

v2.3.2

September 28, 2026

New

Automations. Rules that find the users matching a set of conditions and act on them on a schedule: add or remove a group, set or clear an attribute, disable an account. New automations start in Report only mode, so they email what they would do and change nothing until you make them active. Automation > Automations, with a run history under Logs.
Offboarding records. Offboarding can save a record of the account first: its groups, licenses, mailbox settings, owned groups and apps, profile and direct reports. The records are listed on the offboarding page and download as a single Excel file, so they are still there after the account is deleted.
Export reports to PDF. Reports export to PDF as well as Excel and CSV, laid out landscape with the report name, tenant and date.
Bulk update preview. The preview now shows each account's current value beside the new one, and marks rows as No change, Skipped or Not found before anything is applied.
Clear a value in bulk update. Put {clear} in a cell to empty that attribute. A blank cell still means "leave it alone".
Filter on more reports. The multi condition filter is now on Membership, Group members and five other reports that were missing it.

Improved

Automation and Scheduled reports are one section. The Scheduler tab is gone; scheduled reports sit under Automation beside automations. Existing links still work.
My Reports. The sidebar lists your saved reports instead of the whole report catalog, and the page heading names the saved report you opened.
Offboarding. Numbered step cards: select the user, choose the steps, then run and watch each result. Delete the account is set apart and marked.
Usage location is a dropdown. Pick the country on the user's Account tab instead of typing a two-letter code that Graph accepts even when it is wrong.
Exports keep your columns. Exported reports now include every selected column, and the file is named after the report.
Filter fields are grouped and searchable. The field list is grouped by what the field is about, with Account and Identity first.
Settings menu. Grouped into General, Configuration, Security and Auditing, without icons.

Fixed

Settings > Logs showed UTC. Times are shown in the server's local time.
The filter's field list was cut off. Opening the field picker inside the filter dialog showed a sliver of the list with a scrollbar.
A removed group stayed on screen. The groups dialog no longer shows a group that was just removed until you reopen it.
Confirmation dialogs looked greyed out behind the slide-out panel.

v2.3.1

September 20, 2026

New

Sign in from any connected tenant. Previously only the first tenant's users could sign in. Access is still controlled by Settings > Access Control.
Limit a user to certain tenants. Set which tenants each person can work in, on Settings > Access Control. Defaults to all tenants.
Save scheduled reports to SharePoint. A schedule can deliver to a SharePoint library instead of, or as well as, email. Pick the site and library on the schedule form, with the option to keep a dated copy of each run.
Cleanup columns. Cleanup now offers the same columns as the Users report, with the same Columns picker.
Filter on Cleanup. The multi condition filter from the reports is now on Cleanup too.

Improved

Faster reports with multiple tenants connected. Reports no longer read other tenants' records to find yours. The first start after upgrading may take slightly longer.
Settings > Users is now Access Control.
Cleanup. Checks sit across the top as cards, results get the full width, and the bar above the grid is three cards: threshold, what was found, and the actions.
Cleanup threshold. Type the exact number of days instead of picking from a list.
Cleanup actions. Disable, Remove license and Delete stay switched off until rows are ticked.
Supported columns. Bulk create and bulk update list their CSV columns in a dialog instead of on the page.
Groups dialog. Add and remove groups in one list, with a filter and Remove on each row. Nothing applies until you click Apply.
Tools menu. Cleanup, Password reset and OneDrive copy sit below a divider.
Reports. User reports and Group reports are now called General.
New color scheme. The mint green is now a deeper teal.
Overview dashboard. Redesigned cards, with MFA coverage as a donut chart.
Settings pages. Flat, without the card frames and drop shadows.

Fixed

Groups dialog. A removed group stayed on the list after Apply until the dialog was reopened.
Export on Cleanup > Stale devices did nothing.
Customer name and email on Settings > License were never filled in.

v2.3.0

September 13, 2026

Action required

Reconnect your tenant. This release adds the OneDrive copy tool, which needs a new Microsoft 365 permission (Files.ReadWrite.All). Go to Settings > Connections and reconnect to grant it. Everything else keeps working until you do; only the copy tool is affected.

New

OneDrive copy. Pick a source account and a target account and copy one person's OneDrive into the other's, into a folder of your choosing. Microsoft does the copying inside Microsoft 365, so nothing downloads through the toolkit and the copy continues if you close the page. Found under Tools > OneDrive copy.
Password reset page. Search for an account and reset its password from one screen, with the things that make a reset fail shown first: whether the account is disabled, whether its password is set never to expire, and whether it holds an admin role.
Password Reset role. A helpdesk role that can reach the password reset page and nothing else. No user list, no reports, no settings.
Set a password when resetting. Reset password now lets you type one instead of generating it, and defaults to typing it.
Cleanup. The old Stale accounts screen is now Tools > Cleanup, covering stale users, never signed in, stale guests, disabled accounts holding licenses, inactive mailboxes, stale OneDrive and, new in this release, stale devices.
Bulk edit properties. Set the same attributes on many accounts at once from Tools > Users. Tick the fields to change; a ticked field left empty clears the attribute, and the number of attributes about to be cleared is shown before you apply.
Add to Groups and Remove from Groups. Change group membership for one account or forty in a single dialog, with each group carrying its own direction.
Clone user. Opens New user with the selected account already copied in.
App search. A search box in the title bar covering every report, dashboard and tool.
Report row details. Clicking a display name in a report opens a panel with the whole record, without leaving the list.
Geo location column. New on the SharePoint reports, for tenants using Multi-Geo. It is empty on single-region tenants, and switched off by default.

Improved

Sidebar. Now an icon rail with a panel for the selected section, and it collapses to give the grid around 240px back. Your choice is remembered.
Reports reorganized. The grey subheadings inside categories are gone, and those groups are now categories of their own under Users, Security, Groups, Exchange, Sites and storage, and Devices and apps. No report has moved address, so saved links still work.
Tools > Users. Accounts can be selected in bulk, and Enable, Disable and Delete act on the whole selection with a per account result. The actions panel is grouped by what each action affects.
User properties. These now open in a panel over the list instead of a separate page, so the list, your selection and your scroll position are all still there when you close it. Account details are editable directly rather than through a separate edit step.
Scheduled reports. The new schedule form is a full page with a searchable report picker, rather than a dialog with two dependent dropdowns.
Settings > Access. Settings > Users is renamed, and now lists who can sign in with each role's description shown while you choose it.
Settings. Clicking it opens Connections instead of an empty page.
Report pages. Flat and full width, without the card frame and drop shadow around the grid.
User search. Tools > Users now returns up to 100 matches instead of 25, so a common first name no longer comes back empty when Cloud only is ticked.

Fixed

Licenses tab. Selecting a license did not fill in its apps, so there was nothing to turn on or off. The apps list now covers every license in the tenant and shows the ones belonging to the licenses you have selected.

v2.2.6

September 1, 2026

New

User details: the manager can now be set, changed or removed from Edit job information.

Improved

Syncs are substantially faster. Exchange dropped from around 90 seconds to 25, users from 73 seconds to 22, and groups from 100 seconds to 40 on a test tenant of 12,000 users.
First-time setup: users and groups now appear on screen within seconds instead of after a long pause, so the sync no longer looks stuck while it works.
Sync progress is now recorded in the logs while a sync runs, not only when it finishes.

Fixed

Changing a user's manager in Microsoft 365 could clear the manager in the app instead of updating it.
Group membership changes were not always picked up between full syncs.
The user sync could run twice at the same time, doubling the work and slowing both runs.
Exchange errors were not being written to the log, so a sync could fail quietly and leave fields blank.
Mailboxes without an online archive no longer cause an error during the Exchange sync.

v2.2.4

August 27, 2026

Improved

User details: the Overview and Mailbox tabs now show their actions in a left-hand panel with color-coded icons.
User details: the Overview tab now shows the user's profile photo.
User details: account status now appears as an Enabled or Disabled label with a matching icon, in the style of the Entra admin center.
Tools > Users: the list now shows a loading spinner while the grid loads.

Fixed

User details: Overview fields now stack into a single column on narrow screens instead of overlapping, and long values (emails, IDs, license lists) wrap within their column.
User details: removed a faint drop shadow that appeared along the right edge of the page.

v2.2.3

August 25, 2026

New

Force Password Change report: lists every user who must change their password at next sign-in. Found under Reports > Security > Passwords, with a Run button so it only queries when you ask.
Reset password: a new option to require the user to change their password at next sign-in, on by default.

Improved

Bulk update users: a new forceChangePassword column to set or clear the "must change password at next sign-in" flag.
Bulk update users: the downloaded template now includes every supported column with a sample value.
License activation, deactivation, update checks, the download-update button, and the pricing and purchase links now use store.activedirectorypro.com.

v2.2.2

August 15, 2026

Improved

Stale Passwords report: added 7, 14, 30 and 60 day options to the “Not changed in” filter.
Created Users report: added a “Last 30 days” option to the created-within filter.

Fixed

OneDrive and Mailboxes report exports no longer come out blank. CSV and Excel now include every column’s value.

v2.2.1

August 13, 2026

New

Turn individual apps (service plans) on or off within a license, on both the New User form and a user’s Licenses tab. App choices can be saved into a template, so bulk create applies the same apps to every user.
Bulk create: an optional password column - leave it blank to auto-generate a password (and download them after the run).

Improved

License errors now name the apps involved (for example a service-plan dependency conflict) instead of showing raw ids.
Bulk create shows a live “Creating X of N” count while it runs, and its template download now includes every supported column with a sample value.

v2.2.0

August 11, 2026

New

Advanced report filter: a multi-condition AND/OR filter builder, rolled out across report categories (Users, Groups, and more), replacing the per-column filter menus.
Saved reports (My Reports): save a report’s advanced filter and view, then reopen it later from My Reports. A Save button was added to the report categories that support it.
Email Activity dashboard: daily sent, received and read trends, plus top senders and recipients, sourced from Microsoft 365 usage reports.
Sign-in Trends dashboard: successful versus failed sign-ins over time, with the top failure reasons and the users failing most.
Bulk create users from a CSV: one row per user, with a saved template supplying licenses, groups and shared defaults, and auto-generated passwords you can download after the run.
Copy from user when creating a user: prefill org and location attributes, group memberships and licenses from an existing user.
Restore deleted users: browse the 30-day recycle bin from Tools > Users and restore an account in one click.
Notifications: a bell in the title bar shows background activity, such as group memberships being applied after a user is created.
About page.

Improved

Create user: usage location is now a required country dropdown that auto-detects the tenant’s country; group search shows group type, email and source; selected groups move to the top; and mail-enabled groups are added through a background job that retries until the new mailbox exists.
License counts now reflect pending assignments and removals right away, instead of waiting for the next sync.
Mailbox action panels open faster and reopen instantly showing the value you just saved.
Quotas and retention now saves only the fields you changed, so turning on litigation hold no longer trips a plan’s quota limits.
The new schedule dialog warns when email server settings are not configured, and its Create button enables as soon as the form is valid.

Fixed

Licenses tab no longer re-checks a license right after you remove it.
Removing a mailbox delegate no longer fails when the address matches more than one directory object.
Group member and owner search boxes now clear after a successful add.

v2.1.2

August 2, 2026

New

Enterprise Apps governance - dashboard and reports for enterprise apps, with consented permissions, credential expiry, and a computed permissions level to permission levels.
OneDrive dashboard - storage used, activity, external sharing, accounts nearing quota, and cleanup candidates.
MFA dashboard - adoption, registered methods, real MFA usage, and users signing in without MFA (with an exportable report).
MFA sign-in reporting - sign-in reports now show MFA requirement and methods used.
SharePoint dashboard - sites, document libraries, lists, storage used, and stale/empty sites.
Last successful sign-in - now tracked per user alongside last interactive sign-in.

Improved

More reliable background sync - syncs can no longer overlap and collide, fixing app freezes and stuck “Syncing” states.
Sync Manager shows local time instead of UTC.
Inactivity reports - now use last successful sign-in for more accurate results.
Security dashboard - inactive-user focus, MFA coverage over licensed users, and a legacy authentication card.
Dashboards menu - is now in alphabetical order.
Installer - Moved the stop service custom action in the installer so the service stops early in the upgrade/uninstall process.

Fixed

Stuck sync states clear automatically after an unexpected restart.
Enterprise Apps setup count - no longer shows “None found” when data has synced.

v2.1.0

July 28, 2026

New: SharePoint & OneDrive management

OneDrive accounts: browse every OneDrive in the tenant with a full properties page (owner, storage, files, activity, site URL with copy).
Grant access to a OneDrive: give another user full access to someone’s OneDrive, and see and revoke who has access. Available from Tools > OneDrive and the Users > OneDrive tab.
Storage & access controls: set a OneDrive’s storage limit and lock it to read-only or no access.
External sharing controls: view and change a OneDrive’s external sharing level.
Enable per company: SharePoint and OneDrive advanced features are turned on with a one-time admin consent under Settings > Connections.

New reports

Externally Shared Files: pick a user and see the files in their OneDrive shared outside the organization, with who they are shared with. A Verify links option shows each file’s current link type, expiry date, and whether the share is still active.
SharePoint Site Permissions: who has what permission level on a site.
SharePoint Site Membership: members of a site’s Owners, Members, and Visitors groups.

Access control

New OneDrive Admin role: a scoped role that grants access to the OneDrive tools only, alongside the existing User, Group, and Mailbox admin roles.

Other

Connections now shows each company’s advanced-features certificate expiry, with a warning before it lapses and a one-click renew.

v2.0.5

July 23, 2026

New

Create group page (Tools > Groups > Create group): build any group type from one screen, covering all four types (Microsoft 365, Security, Distribution list, Mail-enabled security).
Group email address with domain picker for mail-enabled group types.
Microsoft 365 style slide-out picker for choosing owners and members: search by name or UPN, check people from the list, and review your choices in the Selected panel.

Improved

Bulk update members runs in parallel: a 120 member run that took nearly two minutes now finishes in around 30 seconds, and it keeps scaling for larger jobs.
Remove selected on Groups > members is parallelized too, turning a multi minute job into seconds.
Group Members export drops straight in: the bulk importer matches columns by header name (Group, Member, Action) and ignores the rest.
Flexible member matching: members resolve by display name, user principal name, email address, or object ID.
Add or Remove toggle: if a bulk file has no Action column, pick the action once and it applies to the whole file. Semicolon separated members in one cell are still supported.

v2.0.4

July 22, 2026

New

Remove multiple group members at once. The Members tab in Tools > Groups now has checkboxes and a “Remove selected” button, so you can remove several members in one action instead of one at a time.

Improved

Bulk update members is smarter about existing membership: adding a user who is already in a group (or removing one who isn’t) now counts as a success instead of an error, so re-running a file no longer reports false failures.
Failed rows in Bulk update members now show the actual reason from Exchange (and log the full detail), instead of a generic message.
Clicking Apply on Bulk update members now shows a spinner and updates each row as it completes, so it no longer looks frozen while it works.

v2.0.2

July 21, 2026

New

Convert to shared mailbox: Convert a user mailbox to shared right from Tools > Mailboxes (and in bulk from Stale Accounts), with an option to remove the user’s license in the same step to free up the seat.
Stale Accounts, new views: Added Inactive Mailboxes and Stale OneDrive alongside the existing user views, so you can find unused mailboxes and OneDrive accounts by inactivity.
Stale Accounts, remove license: Select disabled or inactive accounts still holding a license and remove it in bulk to reclaim seats.

Improved

Stale Accounts now handles very large tenants efficiently, loading results a page at a time instead of pulling every account into memory.
Sync all in the Sync Manager runs sources in parallel again, so a full sync completes faster and shows progress instead of appearing to hang.

Fixed

Disabling or deleting an account on the Stale Accounts page now updates its status immediately, without a page refresh.
The user count on report pages no longer drifts to the far right when a filter sits next to the search box.
Fresh installs could fail to start the database on servers missing the Microsoft Visual C++ runtime. The runtime is now included with the installer.

v2.0.1

July 21, 2026

Automatic update notifications
Added bulk group members. This tool lets you bulk add or remove users to groups

v2.0

July 19, 2026

Major update with new interface, more reports and more tools

v1.1.17

August 25, 2025

Updated the authorization page and moved the GCC checkbox below the “Authorize Now” button.

v1.1.16

July 28, 2025

Fixed - Error input string was not in a correct format. This error would randomly popup. It has been fixed.

v1.1.15

July 2, 2025

Added support for GCC High Tenants