Talls Talls

CODEX
/
Licensing changes often. Treat this as a quick-reference, always confirm the current SKU details in the admin center before relying on it.

License Overlap Analyser

Select every license a user holds. Anything two licenses both include is highlighted, that's usually money being spent twice.

Quick lookups for the stuff you end up googling every time: sign-in error codes, Intune enrollment errors, license SKU internal names, and the terminology that trips people up.

Error Decoder

Paste a whole error message, a screenshot transcription, a sign-in log row, anything. Any known code inside it gets decoded instantly.

Baseline Conditional Access policies worth having in most tenants, with the actual settings to configure. Treat these as a starting point, always test in report-only mode against a pilot group first.

Policy Simulator

Build a sign-in scenario and watch every baseline policy below evaluate against it the way Entra would. Click any policy row to toggle it out of the simulated tenant.

"I want to do X, what Graph permission do I actually need?" Delegated runs as the signed-in user with their own access; Application runs as the app itself with no signed-in user, and almost always needs admin consent. Always pick the narrowest scope that does the job.

Graph Query Builder

Pick what you're trying to do and get the ready-to-run PowerShell, raw endpoint, and curl, with the exact scope to consent.

Roles shown are the built-in Entra/M365 admin roles people actually assign day to day, not the full exhaustive list.

Least-Privilege Picker

Pick what the person actually needs to do, get the narrowest role that does it. Global Admin is almost never the answer.

Four different maps of the same tenant: how the services connect, how the security stack layers together, how a rollout actually happens, and where to look first when something breaks.
Full scripts, not one-liners. Read the notes on the side before running anything, most need a value or two changed first.
Category
Environment
Full walkthroughs, start to finish. No real screenshots here, exact menu paths and labels are given instead so you can follow along on your own screen.
How a Windows device's identity actually works, on-prem AD, Entra ID, or both at once. Pick a join type below and watch the process build itself, step by step.
Device Identity Journey
On-Prem  →  Hybrid  →  Entra Joined  →  Entra Registered  →  Intune Enrolled
Practice questions across three certification-style tracks, built from the content already in Codex. Fully offline, your scores are only ever saved in this browser.
Answer a few questions about the tenant you're building, and get back a personalized checklist pulling from the Scripts, Guides, and Conditional Access policies already in Codex.
Working utilities, all fully offline in this browser tab. Nothing you paste here ever leaves this page, tokens included.
Decode & convert

Token decoder

Paste an Entra ID / JWT access token. Decoded locally, never sent anywhere.

Base64 & URL encoding

Timestamp converter

Unix epoch (seconds or ms), Windows FileTime, or any ISO date.

ImmutableID converter

For AD Connect hard-matching. Paste an objectGUID or a base64 ImmutableID, get every form back.

Network

Subnet calculator

CIDR in, everything out.

Generate

GUID generator

For app registrations, custom attributes, correlation IDs.

Password generator

Generated with crypto.getRandomValues, ambiguous characters excluded.

Bulk user builder

Paste names from a spreadsheet, one per line ("First Last"). Get UPNs, display names, and strong temp passwords, as a CSV and as a ready-to-run New-MgUser script.

Intune

Intune compliance policy planner

Tick what the policy should enforce and get the portal path, the settings list, and the exact Graph JSON to create it programmatically (including the scheduledActionsForRule block Graph requires but the docs bury).

Win32 app packaging helper

Fill in what you know about the installer and get the full IntuneWinAppUtil workflow, silent install and uninstall commands, and the detection rule.

Autopilot hardware hash merger

Paste the contents of one or more Get-WindowsAutopilotInfo CSV files (append them all, headers included or not). Validates every row, removes duplicate serials, applies an optional Group Tag, and builds one clean file ready for the Intune import screen.

Hunting

KQL query builder

Ready-to-run hunting queries for Sentinel / Log Analytics. Pick a scenario, tune the window, copy.

Two halves. The domain checker makes real DNS-over-HTTPS lookups, the domain name you type is sent to Google/Cloudflare DNS and nowhere else. The header analyser is fully offline, pasted headers never leave this page.

Domain health checker

MX, SPF (with the 10-DNS-lookup limit actually counted, includes followed recursively), DMARC, DKIM selectors, autodiscover. Graded like an engineer would.

M365 DNS record generator + gap analysis

Onboarding a domain? Type it (and the tenant's onmicrosoft name for DKIM) and get every record to create. "Check live" then compares against what actually exists in DNS and only flags the gaps.

Message header analyser

Paste the full raw headers (Outlook: open message → File → Properties → Internet headers). Shows auth results, spoofing indicators, and which hop actually caused the delay.

A command line over everything in Codex: 10,000+ PowerShell commands, troubleshooting KBs, and the glossary. Type help to see what it can do. Fully offline, nothing typed here leaves the page.
codex>
Real requests, not a recording or a simulation. Every vehicle is a genuine HTTPS request this page just made, how far down the highway it gets before it flashes, and its final color, reflect exactly how long the real response actually took. This can only ever show requests Codex itself makes, a webpage can't see anything else on your network, on any site, ever.

Network Readiness Test

Fires one real request at every service M365 depends on and times it. Run this on a customer's network before you promise Teams calls will work.

Live log

Send a request to see it appear here.

Settings

Layout

Show tabs as a sidebar down the left instead of across the top. With this many tabs now, it's easy to not realise some are scrolled out of view.

Light theme instead of dark

Favorites

0 items favorited

Remove every favorite you've saved

About

Everything here lives in this browser's local storage only. Nothing is uploaded, nothing is tracked.