INFOtemper
Harden your data. Refine your workforce.
A desktop app for Microsoft 365 admins. Create new starters from role templates, see exactly how anyone differs from their role, and put it right. Every change is snapshotted first, so every change can be undone.
Coming soon for macOS. Buy it once, from £99. No subscription.
Hot: missing 3 of the role's groups
- SalesMicrosoft 365 group
- All StaffDistribution list
- CRM Usersmissing
- Sales Drivemissing
- Sales Announcemissing
Is this person set up right? And if not, what exactly is different?
The Entra portal makes that surprisingly hard to answer. INFOtemper answers it for one person, two side by side, up to five in a grid, or a whole team against the role they are meant to have, and says it in three words.
- Hot
- Missing at least one of the groups their role needs. Something to do. A new starter, or someone who has drifted.
- Forged
- Has every group the role needs, plus extras it does not list. Working, not yet refined. Often a mover still carrying an old job's access.
- Tempered
- An exact match. Every group the role needs and nothing beyond it. Where everyone should end up.
Read everything. Change only what you mean to.
Half of INFOtemper works signed in with a read-only role such as Global Reader, which makes it a proper access-audit tool before it ever changes a thing. The other half uses the admin roles you already hold, and nothing more.
Reading
Works with Global Reader.
- Inspect
- Anyone's groups, direct and inherited, each labelled by type and by where it is mastered: Entra, Exchange, on-premises AD or a dynamic rule. Every licence, and whether it comes from a group or was assigned directly.
- Compare
- Two people as a three-way difference: what matches, what is missing, what should not be there. Up to five in a grid. Anyone against a role template.
- Team
- Line a team up against its role and see who is hot, forged or tempered, worst first.
- Work orders
- Export any difference as a CSV for whoever has the rights. Groups synced from on-premises AD come out as a PowerShell script to run on a domain controller.
Changing
Uses the admin roles you already hold.
- Templates
- A role in one place: groups, licensing group, manager, usage location and attributes such as job title and department. Capture one from a correctly set-up person, then trim off what was only theirs.
- Create
- One new starter, or a batch from a CSV whose column names do not have to be exact. Every row is previewed before anything is written, and an existing account is never overwritten.
- Apply and fix
- Bring one person or a whole team into line with their role. Add only by default; removing access is a separate choice behind a typed confirmation.
- Exchange and licences
- Distribution lists and mail-enabled security groups, written through Exchange Online with the same sign-in. Licences assigned with live seat counts, and direct copies tidied once a group licence has taken over.
A new starter, built in the right order
Welcome emails fire when a mailbox appears, and distribution lists cannot be written until Exchange can see the person. So INFOtemper builds every starter in the same order, waits where it has to, and stops loudly if something is not ready.
- AccountCreated from the template, with manager and attributes. An existing account is a hard stop.
- LicenceOptionally assigned directly, with live seat counts, so the mailbox arrives quickly.
- Licensing groupAdded first, and on its own.
- MailboxWaits for it, and for Exchange to see the person, before going on.
- Every other groupThrough Graph or Exchange. On-premises and dynamic groups are listed as manual work.
- TidyIf you choose, the direct licence is removed once the group's copy is active.
Nothing changes without a way back
A tool that can change access across a tenant has to earn trust. INFOtemper does the same things, in the same order, on every change, whether it is one group for one person or a role applied to a whole team.
- Check there is somewhere to saveIf a snapshot cannot be written, nothing changes. Not a single group.
- Snapshot the person as they areWritten all-or-nothing, with a checksum, and tagged with the tenant and the person's account ID. Saved on your machine, and on a shared folder too if you set one.
- Read live from MicrosoftThe plan is rebuilt from current facts, so a screen left open for an hour cannot cause a surprise.
- Show you the differenceA list you tick. Adds only, unless you choose otherwise.
- Make removals deliberateTaking access away needs the word REMOVE typed in. Removing a licence needs that and more.
- ApplyEach group goes to whichever service owns it. On-premises groups are never attempted.
- Write it downOne line per action in the audit log, including the ones that changed nothing and the ones that failed.
An audit log you can check
Every line carries a fingerprint of the line before it. Edit, delete or insert a line and the chain breaks at that point. Settings, Check audit log, and it tells you where.
- add CRM Users to j.maddox applied
follows 4e1b..90c2 - add Sales Drive to j.maddox applied
follows a7d0..1f3e - add Sales Announce to j.maddox applied
follows 9f3c..e1a4
Microsoft's own Entra audit log records every change as well, under your name and your app registration. INFOtemper cannot touch that one.
Restore any snapshot
Pick a point in someone's history and either add back what they have lost, or make them match it exactly. A restore is snapshotted first, so a restore can be undone too.
A snapshot that has been edited or cut short is refused, as is one from another tenant or another person. History follows the account, so renaming someone does not lose it.
No server. No telemetry. No ScryMarc in the middle.
INFOtemper talks to Microsoft and nothing else. There is no INFOtemper account to sign up for and nothing of ours that could lapse, leak or be switched off.
Your app registration
You register INFOtemper in your own tenant, once, in about five minutes. Your registration, your consent, your directory. No partner account, no third-party app to approve.
It acts as you
Everything happens as the signed-in admin. What it can do is the overlap of what you consented to and the role you hold right now. It can never exceed you.
Behind your MFA
Setup includes a Conditional Access policy that makes everyone who uses it complete multifactor authentication. Snapshots and logs stay in your Documents folder, and on your own shared folder if you want your team to see them.
Compared with the usual ways
The portal and PowerShell can do most of this, given time and care. INFOtemper's point is that the care is built in.
| Task | Entra and Exchange admin centres | Your own PowerShell | INFOtemper |
|---|---|---|---|
| See how someone differs from their role | By eye, one group at a time | If you write and maintain it | A three-way difference, for one person or a team |
| A snapshot before every change | No | If you remember to | Always, checked, and nothing changes without one |
| Put someone back as they were | From memory | If you kept the output | Any snapshot, previewed before it is applied |
| Distribution lists alongside security groups | A separate admin centre | A separate module and session | Same screen, same sign-in |
| A batch of new starters | No | Yes, with a script | From a CSV, previewed row by row |
| A log you can prove was not edited | Entra audit log, kept 30 days by default | If you build one | A chained log, checked in one click, plus Entra's own |
Buy it once. It is yours.
Every licence includes every feature. You are choosing who uses it and where.
Personal
For a homelab, study, or your own household tenant.
- Every feature
- Non-commercial use only
Commercial
For one admin working on an employer's or a client's tenant.
- Every feature
- Commercial use
Commercial 5-pack
Five Commercial licences for an IT team.
- Five separate licence keys
- 20% off five singles
Looking after several client tenants? A licence for MSPs and consultants is planned. Tell us you are interested.
Questions
What do I need to set it up?
An app registration in your own Entra tenant, created once in about five minutes, and admin consent for it. The setup guide walks through both, plus a Conditional Access policy that requires MFA for everyone who uses INFOtemper.
Can I use it without write access?
Yes. Signed in with a read-only role such as Global Reader, you can inspect anyone, compare people and roles, check whole teams, and export work orders. Only applying, creating and restoring need write access, and they say clearly when you do not have it.
Can it change groups synced from on-premises AD?
No cloud tool can, including the Microsoft portal. INFOtemper spots them, tells you, and writes a PowerShell script to run on a domain controller instead. Dynamic groups are never written either, because their membership comes from a rule.
Where do the snapshots and logs go?
Always into an INFOtemper folder in your Documents, which you can always write to. Optionally, a second copy goes to a shared folder such as a network share, so your team sees them. If the share is offline, work carries on and you are told where the snapshot went.
Can I use a Personal licence at work?
No. Personal is for a homelab, study or your own household. Any work on an employer's or a client's tenant needs a Commercial licence.
Does it send anything to ScryMarc?
No. It talks to Microsoft's own services, as you, and nothing else. There is no telemetry, and we never see a token, a user or a group.
Which platforms does it run on?
macOS. If you need it on Windows, get notified and say so; it shapes what comes next.
Be first to hear when it is ready.
Get notified at launchMore from ScryMarc Software
Small, local-first desktop tools that each do one job properly. Bought once, no subscriptions.