One window instead of three
Users, groups, devices, contacts, subscriptions, admin roles, mailboxes and OneDrive, each with a full editing card — not a read-only list that sends you back to a portal.
CloudSergeant
Microsoft 365 admin,
in one window.
Users, groups, devices, contacts, licences, admin roles, mailboxes and OneDrive — plus safe mailbox and OneDrive cleanup and migration tools — in one Windows app. It works with your own Microsoft 365 permissions, and customer or mailbox data never reaches us.
Why it exists
Stop hopping between three admin portals
Routine Microsoft 365 work is spread across the Microsoft 365 admin center, the Entra portal and the Exchange admin center — and the mailbox jobs nobody wants to do are spread across PowerShell. CloudSergeant puts the day-to-day work in one place, and shows you what it is about to do before it does it.
See it before you touch it
Mailbox cleanup calculates exactly how many messages match before it can run, and OneDrive cleanup lists every matching file with its folder, size and modification time. Destructive work reaches a read-only summary and a confirmation first.
Deletion you can explain
Four actions, each with its recoverability stated plainly — Deleted Items, hard delete, permanent delete, or move to a folder. No guessing which one the user can undo.
Customer data stays on the machine
The desktop talks directly to Microsoft Graph, Exchange and SharePoint. No customer directory data, OneDrive detail, mailbox address, subject, folder name or count is ever sent to us — by design, not by policy.
Built for partners
With a Partner licence and a GDAP relationship, switch into a customer tenant and manage its directory, mailbox configuration and OneDrive tenant settings without a second sign-in.
Installs in seconds, updates itself
One self-contained .exe behind a per-user installer that needs no
administrator rights. No .NET prerequisite, new versions install from inside the app once
you accept, and an encrypted token cache survives every update so the next launch signs
you in silently.
How it works
There is no service account, no application permission and no consent to a background process. CloudSergeant acts as you, using delegated permissions, and can never do anything your own account could not.
-
Sign in
Your Microsoft 365 work or school account, through the normal Microsoft sign-in — MFA and conditional access included.
-
Choose the tenant
Your own, or — with a Partner licence — one of your GDAP customer tenants from the switcher.
-
Do the work
Edit directory objects directly, or set up a mailbox run and check its numbers before executing.
-
Check the log
Every change, sign-in and run is appended to a local daily activity log you can open from Settings.
What's in it
The app is organised by workload: Entra, Exchange and OneDrive, each with its object lists first and its tools after them, plus the tenant as a whole.
Entra
Users (including a create wizard and a guided offboarding flow), groups of all four types, devices with BitLocker key reveal and mail contacts. One search box finds any object in the tenant by name, address, alias, username, object id or the value of a custom extension attribute, and Compare shows two users or groups side by side.
Exchange
Mailboxes with nine sections of Exchange settings. Secure and unblock one or many restricted senders, and review Microsoft 365 quarantine to release or permanently delete marked messages. Cleanup, Copy / Move and Export / Import are step-by-step wizards with filters, mandatory previews and detached run windows.
OneDrive
Every OneDrive in the tenant, with storage, sharing, access and lock settings. Cleanup, Copy / Move and Export / Import for files and folders: copy between drives or tenants with separate session-only sign-ins, preserve a folder tree in ZIP, and preview age/size/type cleanup matches before deleting anything.
Tenant
The organisation's Microsoft 365 profile and verified domains, the licences it holds and who holds them, the admin-role catalogue with who holds each role, and the roles you hold yourself.
Every action says how reversible it is
The reason mailbox cleanup gets put off is that it is hard to be sure what you are about to destroy. CloudSergeant names the destination and the way back for each action, and asks for confirmation before it starts.
The mailbox tools work on email only — calendar items, contacts, tasks and notes are never touched. Read how each mailbox tool works → OneDrive cleanup has its own recycle-bin and permanent-delete rules in the OneDrive tools guide.
Permissions
It uses the rights people already have
CloudSergeant has no permission model of its own. Every action runs with the signed-in user's delegated Microsoft Graph, Exchange and SharePoint permissions, so what someone can do is decided by their Microsoft roles — there is no parallel set of rights to audit.
An end user
Can clean, copy and export their own mailbox and OneDrive, plus content another identity has explicitly allowed them to open. They can browse the directory, but administrative writes are refused.
A tenant administrator
Gets the whole app in their own tenant, to the extent their Entra, Exchange and SharePoint roles allow — and can work in any mailbox they hold access to.
A delegated partner admin
Manages a customer's users, groups, devices, mailbox configuration and OneDrive tenant settings through GDAP. Mailbox content and OneDrive file actions require the tools' separate sign-in as a customer-tenant identity that can already reach the content.
The boundary
What actually leaves the machine
CloudSergeant is a tool you point at your customers' tenants. The moment anything about those customers reached our servers, it would acquire a data-processing story it does not need to have — so it does not. Directory, OneDrive and mailbox traffic goes straight from your machine to Microsoft. Our service exists only to answer two questions: is your licence valid, and is there a newer version.
Never sent
A customer tenant id or name, a mailbox address, a subject, a folder name, any count derived from customer data, or the result of an operation.
Never used
Application permissions and service accounts. There is no background process with standing access to anything.
Kept locally
An encrypted token cache, the licence state, and the daily activity log — all under your own Windows profile. Read the details →
Get started
Everything has its own page
Download the Beta
Check the current release, Windows requirements and signing information before downloading.
Read the documentation
Learn how sign-in, tenant switching, administration, mailbox tools and OneDrive tools work.
Manage your account
Sign in to view and manage your CloudSergeant subscription and account details.
