Supported operating systems
The toolkit runs on the machine you install it on. It does not need to be a domain controller.
- Windows 10
- Windows 11
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025
Where it runs
365 Pro Toolkit is self-hosted. It installs on one Windows machine, runs as a Windows service, and serves a web interface that you and your team open in a browser. It does not need to be installed on a domain controller.
- Operating system. See the supported list above.
- No .NET install needed. The runtime ships inside the download.
- No SQL Server. The database is embedded and set up on first run.
- No IIS. The app hosts its own web server.
- Local administrator rights on that machine, to install the service and write to
%ProgramData%\ActiveDirectoryPro\365ProToolkit\, where the encrypted settings live.
Microsoft 365 connection
Connecting creates an app registration in your tenant and grants it the permissions below. To run that once, you need an account that can consent on behalf of the organization, which in practice means Global Administrator. Day-to-day use of the toolkit does not require that account.
Optional, per feature
- Mailbox features (mailbox list, permissions, forwarding, auto-reply, converting to shared) additionally need
Exchange.ManageAsAppand an Exchange administrator role assigned to the app. - OneDrive site access uses a certificate-based SharePoint app-only connection, enabled per tenant. Skip it and the rest of the toolkit is unaffected.
Graph permissions
These are the application permissions granted when you connect. This is the full list, so a security review can be done before anyone consents.
| Permission | What it is for |
|---|---|
| User.Read.All | Read user accounts for the user tools and reports |
| User.ReadWrite.All | Edit user properties, and enable or disable accounts |
| User-PasswordProfile.ReadWrite.All | Reset user passwords |
| Directory.Read.All | Read directory objects, licenses and tenant configuration |
| GroupMember.Read.All | Read group membership for the group reports |
| GroupMember.ReadWrite.All | Add and remove group members |
| Group.ReadWrite.All | Create and delete groups and teams |
| OrgContact.Read.All | Read mail contacts |
| AuditLog.Read.All | Read sign-in and audit logs for the logon and security reports |
| Policy.Read.All | Read per-user MFA state for the MFA reports |
| Reports.Read.All | Read the usage reports behind the SharePoint and OneDrive dashboards |
| Sites.Read.All | Read SharePoint and OneDrive site inventory |
| Application.Read.All | Read enterprise apps and app registrations for the application reports |
The Connections page checks the granted permissions against this same list and tells you if any are missing, which is usually what has happened when a report comes back empty.
Ports and network
On the machine running the toolkit
| Port | Direction | Purpose |
|---|---|---|
| 8082 | Inbound | The web interface, over HTTP. Configurable. |
| 443 | Inbound | The web interface over HTTPS, once you add a certificate. Port is configurable. |
| 5433 | Local only | The embedded database. Never needs to be open on the firewall. |
Outbound, to Microsoft and to us
| Host | Purpose |
|---|---|
| login.microsoftonline.com | Sign-in and token requests |
| graph.microsoft.com | All users, groups, licensing, reporting and security data |
| outlook.office365.com | Exchange Online administration, for the mailbox features |
| activedirectorypro.com | License activation |
Browser
Any current version of Edge, Chrome, Firefox or Safari. The interface is served from the machine you installed it on, so anyone you give access to reaches it over your own network.
Frequently Asked Questions
Does it have to run on a server?
No. Any supported Windows machine that stays on will do. It runs as a service, so it keeps syncing and running scheduled reports whether or not anyone is signed in.
Does anything get installed in my tenant?
Only an app registration, created when you connect. There are no agents and nothing is deployed to users.
Do I need to be Global Administrator to use it?
Only to connect the tenant the first time, because that step consents to the permissions. After that, access to the toolkit is controlled by its own roles.
Do I need SQL Server?
No. The database is embedded, created on first run, and needs no administration.
Can I restrict who sees what?
Yes. Access is granted per section, so help desk staff can be given the user tools without the security or licensing areas.