Talls Talls

LEXICON
/
Hello
What's new
Did you know?
Licensing changes often. Treat this as a quick-reference, always confirm the current SKU details in the admin center before relying on it.

License Overlap Analyser

Select every license a user holds. Anything two licenses both include is highlighted, that's usually money being spent twice.

Quick lookups for the stuff you end up googling every time: sign-in error codes, Intune enrollment errors, license SKU internal names, and the terminology that trips people up.

Error Decoder

Paste a whole error message, a screenshot transcription, a sign-in log row, anything. Any known code inside it gets decoded instantly.

Baseline Conditional Access policies worth having in most tenants, with the actual settings to configure. Treat these as a starting point, always test in report-only mode against a pilot group first.

Policy Simulator

Build a sign-in scenario and watch every baseline policy below evaluate against it the way Entra would. Click any policy row to toggle it out of the simulated tenant.

What Conditional Access sees about you

Real lookup, not a guess, this browser's actual public IP and the geolocation Entra would evaluate a location-based policy against right now. Handy for sanity-checking a named location or troubleshooting "why did this get blocked".

Roles shown are the built-in Entra/M365 admin roles people actually assign day to day, not the full exhaustive list.

Least-Privilege Picker

Pick what the person actually needs to do, get the narrowest role that does it. Global Admin is almost never the answer.

Full scripts, not one-liners. Read the notes on the side before running anything, most need a value or two changed first.
Category
Environment
Full walkthroughs, start to finish. No real screenshots here, exact menu paths and labels are given instead so you can follow along on your own screen.
How a Windows device's identity actually works, on-prem AD, Entra ID, or both at once. Pick a join type below and watch the process build itself, step by step.
Device Identity Journey
On-Prem  →  Hybrid  →  Entra Joined  →  Entra Registered  →  Intune Enrolled
Answer a few questions about the tenant you're building, and get back a personalized checklist pulling from the Scripts, Guides, and Conditional Access policies already in Lexicon.
Working utilities, all fully offline in this browser tab. Nothing you paste here ever leaves this page, tokens included.
Decode & convert

Token decoder

Paste an Entra ID / JWT access token. Decoded locally, never sent anywhere.

Base64 & URL encoding

Timestamp converter

Unix epoch (seconds or ms), Windows FileTime, or any ISO date.

ImmutableID converter

For AD Connect hard-matching. Paste an objectGUID or a base64 ImmutableID, get every form back.

Network

Subnet calculator

CIDR in, everything out.

Generate

GUID generator

For app registrations, custom attributes, correlation IDs.

Password generator

Generated with crypto.getRandomValues, ambiguous characters excluded.

Bulk user builder

Paste names from a spreadsheet, one per line ("First Last"). Get UPNs, display names, and strong temp passwords, as a CSV and as a ready-to-run New-MgUser script.

Intune

Intune compliance policy planner

Tick what the policy should enforce and get the portal path, the settings list, and the exact Graph JSON to create it programmatically (including the scheduledActionsForRule block Graph requires but the docs bury).

Autopilot hardware hash merger

Paste the contents of one or more Get-WindowsAutopilotInfo CSV files (append them all, headers included or not). Validates every row, removes duplicate serials, applies an optional Group Tag, and builds one clean file ready for the Intune import screen.

Hunting

KQL query builder

Ready-to-run hunting queries for Sentinel / Log Analytics. Pick a scenario, tune the window, copy.

Drop a Win32 installer (.exe or .msi) and get every Intune "Add App" field pre-filled — install command, uninstall command, detection rule, the lot. Reads the file itself (PE version info, installer-engine fingerprint) rather than asking you to guess.
.exe

Drop your installer here

Or an .msi. Everything runs in this browser tab — the file is never uploaded anywhere.

Two halves. The domain checker makes real DNS-over-HTTPS lookups, the domain name you type is sent to Google/Cloudflare DNS and nowhere else. The header analyser is fully offline, pasted headers never leave this page.

Domain health checker

MX, SPF (with the 10-DNS-lookup limit actually counted, includes followed recursively), DMARC, DKIM selectors, autodiscover. Graded like an engineer would.

Multi-resolver DNS check

Queries Google and Cloudflare public DNS at the same time for the same record, side by side, real lookups against both. Catches propagation lag or a resolver quietly serving something stale.

Blocklist (RBL) checker

Real DNS lookups against Spamhaus ZEN, SORBS, and Barracuda, the same technique MXToolbox uses. Check your sending IP before you spend an afternoon wondering why mail is landing in spam.

M365 DNS record generator + gap analysis

Onboarding a domain? Type it (and the tenant's onmicrosoft name for DKIM) and get every record to create. "Check live" then compares against what actually exists in DNS and only flags the gaps.

Message header analyser

Paste the full raw headers (Outlook: open message → File → Properties → Internet headers). Shows auth results, spoofing indicators, and which hop actually caused the delay.

Bandwidth Autobahn Engine off · parked
Run complete
0Mbps down

Settings

Layout

Show tabs as a sidebar down the left instead of across the top. With this many tabs now, it's easy to not realise some are scrolled out of view.

Light theme instead of dark

Accent color

Changes the accent everywhere, the logo included. Seasonal shifts automatically through the year.

Favorites

0 items favorited

Remove every favorite you've saved

About

Everything here lives in this browser's local storage only. Nothing is uploaded, nothing is tracked.

Quick tips

Press / anywhere to jump straight to search.

Star any card to favorite it, favorites get their own tab once you save one.

The Terminal tab runs commands over everything in here, 10,000+ PowerShell commands, KBs, and the glossary. Type help in it to see what it can do.

Click straight through any Admin Portal card to open that portal in a new tab.

Layout and theme (light/dark, sidebar tabs) live in Settings, the gear next to this.

What's in here

Reference

  • Admin Portals — every M365 admin center, one click away.
  • Licensing — every plan and SKU, feature breakdown, and an overlap analyser.
  • PowerShell — 10,000+ ready-to-run commands, organized by module.
  • Troubleshooting — common issues, symptom straight to the fix.
  • Glossary — error codes, acronyms, and terms decoded.
  • Conditional Access — real-world policy examples plus a live simulator.
  • Graph Permissions — scopes, consent type, and sample queries.
  • Admin Roles — least-privilege picker with colour-coded risk tiers.
  • Map — an interactive diagram of how every service connects.

Builders & simulators

  • Scripts — full copy-paste PowerShell for common admin jobs.
  • How To — step-by-step walkthroughs, exact menu paths instead of screenshots.
  • Identity Journey — a visual walk through the sign-in and auth flow.
  • Configurator — answer a few questions, get a tailored tenant setup checklist.
  • Toolbox — token decoder, subnet calc, password/GUID generators, bulk user builder, Autopilot hash merger, KQL builder, and more.

Live & practice

  • Practice Exams — three certification-style question tracks, scored locally.
  • Terminal — a command line over everything in Lexicon.
  • Mail Flow — real DNS-over-HTTPS domain health checks and a header analyser.
  • Bandwidth Autobahn — real network latency and a live download speed test, visualized as traffic on a highway.
Talls Talls Lexicon

What's new

Spotted something wrong, or want a tool added? Drop an email.

support@talls.co.uk