Cloud and SaaS Administration Tools: Mail, Collaboration and Cost Control

This page is for sysadmins, MSP technicians and IT generalists who look after a mix of self-hosted mail, collaboration servers, Microsoft 365 or Google Workspace tenants and a handful of cloud servers. The short answer: keep mail and file sharing either fully in a SaaS suite or on a maintained self-hosted stack, script your tenant administration instead of clicking through admin portals, review licences and cloud bills every month, and put a health-checked load balancer in front of anything that must stay up.

The short list

Run your own mail server on Windows

If mail has to stay on premises and the team knows Windows, there are two serious free options. MailEnable Standard is free for personal and commercial use with unlimited domains and mailboxes, and it gives users AJAX webmail with calendar and contacts on day one. What it lacks in the free edition is filtering: greylisting, Bayesian filtering, inbound SPF checks and bundled ClamAV start at the paid editions. It needs the IIS role for webmail and does not support Server Core. Mailboxes and DKIM can be scripted with its PowerShell snap-in:

Add-PSSnapin MailEnable.Provision.Command
New-MailEnablePostoffice -Domain "example.com" -Postoffice "example.com" -UserName "support" -Password "<pwd>"
New-MailEnableDomainDkimSelector -Domain "example.com" -Selector "me2026" -Keysize 2048
Get-MailEnableDomainDkimDnsRecord -Domain "example.com" -Selector "me2026"

hMailServer is the opposite trade-off: no webmail, but SPF, greylisting, DKIM verification and, since 5.7, DMARC checks are all free. Releases resumed in September 2026 after a long pause; 5.7 is 64-bit only and 5.7.1 fixes a script-injection flaw in event scripts, so move 5.6 servers to it. Its COM API makes onboarding scripts easy, and it works well as an authenticated internal relay for printers, scanners and monitoring tools. Keep relaying to external addresses restricted to authenticated clients.

Whichever you pick, publish MX, SPF, DKIM and DMARC records and ask your provider for a PTR record that matches the server’s HELO name before go-live. Check that your network allows outbound port 25 at all; many cloud and residential networks block it, and in that case you need a smart host.

Filter and archive mail in front of Microsoft 365 or Exchange

Teams that moved mailboxes to Microsoft 365 but want their own filtering layer or an archive under their control can put Xeams in front. It runs on its own Linux or Windows host, the MX record points at it, and filtered mail is delivered to the downstream server. Lock the downstream side so it only accepts SMTP from the Xeams IP, otherwise spammers simply bypass the filter. Keep the admin console on port 5272 off the internet. Licensing matters here: the Community Edition is for personal and hobbyist use, with spam filtering for up to five users, so any business deployment needs the paid Enterprise Edition. Xeams can also sit in front of MailEnable Standard to fill its anti-spam gap.

Self-host mail on Linux with mailcow

On Linux, mailcow packages a full mail stack into Docker containers: Postfix, Dovecot, SOGo webmail with calendars and contacts, Rspamd, optional ClamAV, MariaDB and automatic Let’s Encrypt certificates. Upgrades and backups are scripted, which is the main reason to choose it over a hand-built Postfix and Dovecot server:

cd /opt/mailcow-dockerized
MAILCOW_BACKUP_LOCATION=/opt/backup ./helper-scripts/backup_and_restore.sh backup all --delete-days 3
./update.sh --check
./update.sh

Run the backup nightly from cron and copy it off the host. Self-hosting still means you own IP reputation and blocklist monitoring.

Replace an abandoned collaboration suite

Open365 was a free AGPL-3.0 alternative to Office 365 built by eyeOS from LibreOffice Online, Seafile, KDE Kontact and Jitsi. It never left beta, its repositories have not changed since December 2016, and there is no successor. If an old instance is still running, treat it as a security problem: list its containers with docker ps -a, cut it off from the internet, copy user files out, export mail over IMAP and only then remove it with sudo ./open365 destroy.

The usual replacement is Nextcloud with Nextcloud Office or ONLYOFFICE, plus a separately maintained mail server. Nextcloud All-in-One deploys the stack from one master container, and day-to-day administration goes through occ:

sudo -E -u www-data php occ user:add --display-name="Layla Smith" --group="users" layla
sudo -E -u www-data php occ user:lastseen --all
sudo -E -u www-data php occ user:disable layla
sudo -E -u www-data php occ maintenance:mode --on

user:lastseen --all is the quickest way to find accounts nobody uses before you plan storage or licences for add-ons.

Administer Microsoft 365 and Google Workspace from scripts

For anything repeatable (onboarding, offboarding, audits) use the command line rather than the admin portal. In Microsoft 365, the Microsoft Graph PowerShell SDK covers users and licences, and the Exchange Online module covers mailboxes. Two checks worth running monthly:

Connect-MgGraph -Scopes "User.Read.All","AuditLog.Read.All","Organization.Read.All"
Get-MgUser -All -Property DisplayName,UserPrincipalName,AccountEnabled,SignInActivity |
  Select-Object DisplayName,UserPrincipalName,AccountEnabled,
    @{n='LastSuccess';e={$_.SignInActivity.LastSuccessfulSignInDateTime}}

Connect-ExchangeOnline
Get-EXOMailbox -ResultSize Unlimited -Properties ForwardingSmtpAddress,ForwardingAddress |
  Where-Object { $_.ForwardingSmtpAddress -or $_.ForwardingAddress }

The first lists the last successful sign-in per user; reading it through Graph needs Microsoft Entra ID P1 or P2 and the Reports Reader role or higher. Microsoft’s guidance treats 90 to 180 days without sign-in as a reasonable threshold for an inactive account. The second finds mailboxes that forward mail elsewhere, a classic sign of a compromised account or a leaver’s data walking out. For access reviews and provisioning beyond this, see our identity and access management tools hub.

In Google Workspace, the Admin console does the same jobs interactively, and GAM, a free Apache-2.0 command-line tool, does them in bulk:

gam print users fields primaryemail,lastlogintime,suspended
gam update user jane@example.com suspended on

A sensible offboarding order on either platform: block sign-in or suspend, revoke sessions, transfer mailbox and files to the manager, remove the licence, then delete after your retention period.

Keep cloud and SaaS costs under control

Most SaaS overspend is unused seats. Compare purchased and assigned licences in Microsoft 365 with Get-MgSubscribedSku | Select-Object SkuPartNumber,ConsumedUnits,@{n='Enabled';e={$_.PrepaidUnits.Enabled}}, then cross-check the inactive-user list above. A licence assigned to a disabled account is money spent on nothing.

For infrastructure, set budgets with alerts in the provider’s own tools (AWS Budgets, Azure Cost Management, Google Cloud budgets) before anything else, and tag every resource with an owner and environment so the bill can be split. On AWS, the Cost Explorer CLI gives a per-service breakdown you can drop into a monthly report:

aws ce get-cost-and-usage 
  --time-period Start=2026-09-01,End=2026-10-01 
  --granularity MONTHLY 
  --metrics "UnblendedCost" 
  --group-by Type=DIMENSION,Key=SERVICE

The end date is exclusive. Kubernetes bills are harder, because one cluster serves many teams. OpenCost, a CNCF incubating project under Apache-2.0, allocates cluster cost down to namespaces, deployments and containers, pulls on-demand prices from AWS, Azure and GCP billing APIs, and supports custom pricing for on-premises clusters. It installs with its official Helm chart and also offers a kubectl cost plugin.

Balance traffic across servers

Inside a public cloud, use the provider’s managed load balancer unless you need features it lacks. On your own servers or VPS, HAProxy is the standard open-source choice for TCP and HTTP. Even-numbered branches get five years of maintenance; 3.4 is the current LTS. A minimal setup with active health checks:

frontend web
    bind :80
    default_backend app

backend app
    balance roundrobin
    option httpchk GET /health
    server app1 10.0.0.11:8080 check
    server app2 10.0.0.12:8080 check

Validate with haproxy -c -f /etc/haproxy/haproxy.cfg before every reload. Make the /health endpoint check real dependencies, such as the database connection, or the balancer will keep sending traffic to a backend that only looks alive. Run two balancer nodes with a floating IP so the balancer itself is not a single point of failure.

Run hosting infrastructure and test builds

Hosting providers selling VPS and container plans at high density are the audience for Virtuozzo Server. It installs on bare metal as its own OS, runs OpenVZ-based system containers and KVM virtual machines side by side under one CLI (prlctl), applies kernel fixes without reboots through ReadyKernel, and integrates with hosting panels and billing. It is licensed per physical server, the ISO comes through the vendor, and the 7.5 line receives maintenance hotfixes rather than big feature releases. For internal IT, Proxmox VE or OpenVZ are the usual free choices.

Before you push a cloud-init file or bootstrap script to production servers, test it on a throwaway VM. Multipass launches an official Ubuntu cloud image in one command on Windows, macOS or Linux; here web.yaml is a cloud-init file that installs nginx:

multipass launch 24.04 --name web --cpus 2 --memory 2G --disk 10G --cloud-init web.yaml
multipass exec web -- systemctl status nginx
multipass delete web
multipass purge

For configuration management and runbooks on top of this, see the sysadmin automation tools hub.

Monitor cloud servers without running a monitoring server

A small team with a dozen cloud VMs often does not want to patch and back up its own monitoring box. Xitoring Agent (Xitogent) pushes metrics from Linux and Windows Server hosts to the hosted Xitoring service, needs no inbound port, discovers running services and suggests integrations for databases and web servers. Run xitogent pause before planned maintenance and xitogent unpause after it. The agent is free to install but useless without a paid Xitoring account, and metrics live on the vendor’s infrastructure. If data must stay inside your network, Checkmk Community is a free, self-hosted alternative.

How to choose

1. Decide where mail lives. If users already have Microsoft 365 or Google Workspace, do not run a parallel mail server; add Xeams only if you need your own filtering or archive. If mail must stay on premises, choose MailEnable for webmail on Windows, hMailServer for free anti-spam and scripting, or mailcow on Linux.
2. Check maintenance status. Anything facing the internet must receive security fixes. Retire Open365 and any other suite that stopped updating.
3. Script the tenant. Pick Graph PowerShell or GAM, save the inactive-user, forwarding and licence reports as scheduled scripts, and review the output monthly.
4. Set budgets before you need them. Budget alerts and tags on day one; OpenCost once Kubernetes is shared by several teams.
5. Add redundancy where outages cost money. Two load balancer nodes or a managed balancer, real health checks, and external monitoring of the public endpoint.
6. Count your own time. Self-hosted free tools are cheaper only if someone patches, backs up and monitors them.

FAQ

What is the best free mail server for Windows Server?

MailEnable Standard if users need webmail and calendars; hMailServer if you want free SPF, greylisting and DMARC checks and can add a separate webmail client. Both are free for commercial use.

How do I find inactive users in Microsoft 365?

Read the signInActivity property with Microsoft Graph PowerShell, as shown above, or add the last sign-in column to the user list in the Microsoft Entra admin center. Reading the last successful sign-in through Graph needs Microsoft Entra ID P1 or P2.

Is there a free tool to manage Google Workspace from the command line?

Yes. GAM is free and open source under Apache-2.0 and covers users, groups and domain settings in bulk.

Is Open365 still available?

No. It was abandoned in 2016 and has no successor. Nextcloud with an online office suite and a separate mail server is the common replacement.

How do I track Kubernetes costs per team?

Install OpenCost with its Helm chart. It allocates cost by namespace, deployment and container using cloud billing prices or custom on-premises pricing.

Do I need HAProxy if I use a cloud load balancer?

Usually not. A managed load balancer covers health checks and redundancy for you. HAProxy makes sense on your own servers, across providers, or when you need routing rules the managed service does not offer.

Last updated: 1 October 2026 · AdminHub Plus editorial team. Licence, version and platform details are checked against each developer's official documentation.