Admin Lens

Explains Entra, Intune and Windows codes, Microsoft GUIDs, Azure resource IDs, tokens and Graph permission risk where they appear.

Admin Lens explains the codes, IDs and permissions Microsoft cloud admins run into every day, right where they appear: in the Azure, Entra and Intune portals, Microsoft Learn, and (if you choose) your ticketing tools and log viewers. Hover over anything it underlines and a card tells you what it is, what it means and what to do, with a button to copy a clean summary into your ticket. ERRORS AND EVENTS • Entra sign-in errors: AADSTS codes, including a bare "errorCode": 50076 in sign-in log JSON, with the cause and the fix. • Intune and Autopilot codes: hex enrolment and deployment codes. Unknown hex values are left alone, so random numbers don't light up. • Windows events: event IDs, logon status codes such as 0xC000006A, logon types and Kerberos failure codes, with the log they come from and what to check. IDS, MADE READABLE • Over 5,000 Microsoft GUIDs: Microsoft first-party apps, Entra role template IDs, Azure built-in role IDs, Graph permission IDs, licence SKU IDs and service plans. • Licence part numbers such as SPE_E5 and EMSPREMIUM, with the product name and what's included. • Azure resource IDs split into subscription, resource group, type and name, with a button to open the resource in the Azure portal. • UTC times in logs shown in your own time zone, with how long ago they were. TOKENS AND PERMISSIONS • Access token decoder: hover a JWT in a log, or paste one into the popup, to see who it's for, which app, the audience, the scopes and roles with their risk, any directory roles, and whether it has expired. Decoded on your device and never sent anywhere. • Microsoft Graph permission risk: application and delegated permissions coloured by risk on consent prompts and API permission screens, with why it matters and a lower-privilege alternative where there is one. QUICK WAYS IN • Right-click selected text on any site and choose "Explain with Admin Lens". It only looks at what you selected. • Type "al", a space, then a code, GUID, role, licence or permission in the address bar. • Alt+Shift+L opens the popup. • The toolbar badge counts Microsoft retirements and changes due in the next 30 days. The popup lists them, plus new posts from azureblog.co.uk, and searches everything by code or name. • Pause it on any site with one click. PRIVACY • All matching and decoding happens inside your browser. The pages you look at and the tokens you decode are never stored or sent anywhere. • The only network requests download public reference data from azureblog.co.uk every 12 hours. • No accounts, no analytics, no tracking. • Password fields, text boxes and anything you type are skipped. Graph permission risk ratings are azureblog.co.uk's own guidance. Error codes, roles and deadlines link to Microsoft's documentation or to azureblog.co.uk reference pages that cite it. Admin Lens is an independent project and is not made or endorsed by Microsoft.