Troubleshooting guides, how-tos, deep dives and certification study plans for Microsoft Intune, Configuration Manager (SCCM), Microsoft Entra ID, Microsoft Defender, Exchange Online and Exchange Server, and Microsoft 365.
Showing all 497 articles
Trace a stuck Wi-Fi or VPN profile back through the certificate chain: trusted root, SCEP/PKCS profile, Certificate Connector and NDES, using the logs and event IDs Microsoft documents.
Outbound mail stuck in Retry with 441 4.4.1 or 421 4.4.2? Test port 25 and the smart host, read the send protocol log, fix the network or TLS cause and retry before 4.4.7 NDRs.
Upgrade Exchange Server 2019 CU14 or CU15 to Exchange Server SE in place: prerequisites, AD preparation, the Setup command, DAG maintenance mode, product keys and post-upgrade checks.
Mail stuck in Submission, event 1050 or EdgeTransport crashes after adding or updating an on-server mail security product? Find the agent, isolate it safely and prove the fix.
Use Purview Data Security Posture Management for AI to find overshared content before Copilot surfaces it, run data risk assessments, turn on one-click policies and fix the right sites first.
Configure single-app and multi-app kiosks with the Intune Kiosk template or Assigned Access XML, set up Shared PC mode, pair with Autopilot self-deploying mode, and fix kiosks that won't launch.
Enable third-party updates, choose how the WSUS signing certificate is managed, subscribe and publish catalogs, and fix the certificate and publishing errors that stop installs.
Trace a failed software update point sync from wsyncmgr.log to WCM.log and WSUS, fix the proxy, port, IIS and Microsoft Update causes, and prove the next sync succeeds.
A time-boxed first hour for a Defender XDR incident: claim it, read the attack story, scope users, devices and mailboxes with hunting, contain safely and document the hand-off.
Sign-ins requesting only openid, profile, email or User.Read are now subject to All resources policies with exclusions: who is affected, how to find the apps in sign-in logs, how to fix them, and the timeline.
Look up Defender for Endpoint sensor (SENSE) event IDs by area: start-up, onboarding, telemetry, connectivity, ETW and MDM, each with the usual cause and the first check.
The folders, processes and file extensions Microsoft says to exclude from antivirus on Exchange Server SE and 2019, how AMSI differs, and how to prove the exclusions work with Test-ExchAVExclusions.
A practical hardening pass for a Microsoft 365 tenant: track progress in Secure Score, then fix admin roles, app consent, legacy authentication, SMTP AUTH, risky defaults and auditing.
Run KQL in Intune against one Windows device in real time or across your fleet's inventory: licensing, permissions, the properties catalog policy and queries you can reuse.
Fix Windows Hello for Business PIN setup failures on Intune PCs: the 0x801C and 0x8009 codes, Event ID 360 prerequisite lines, conflicting policy sources and dsregcmd checks.
What the MFA-related AADSTS codes mean, how to read the Authentication details and Conditional Access tabs of a sign-in, and how to fix legacy clients, unregistered users and authentication strength mismatches.
Architecture differences, the Learn feature comparison, when each sync tool fits, and the documented pilot-OU migration from Connect Sync to Cloud Sync with cloudNoFlow and JoinNoFlow rules.
Prepare the site, get the update through the service connection point, pass the prerequisite check, install it, unstick downloads and installs, and finish the post-upgrade tasks.
What PXE-E52, PXE-E3B, PXE-T04, SMSPXE.log certificate errors, WDS start failures and boot image mount errors mean in Configuration Manager, and what to check first.
Build two cloud-only emergency access accounts with passkeys, keep them out of Conditional Access lockouts, alert on every sign-in and test them at least every 90 days.
Why Exchange Online can't find a recipient by SMTP address, from stale Auto-Complete entries and broken forwarding to accepted domain types and hybrid sync gaps, and how to fix each.
ContentIndexState Failed or Unknown, or users can't find mail? Separate client from server problems, reseed or rebuild the Exchange 2016 catalog, and fix search on Exchange 2019 and SE.
Look up a rejection or deferral from Mimecast, Barracuda, FortiMail or Cisco (IronPort) in front of Exchange Server, or Exchange's own reply to the gateway: meaning, who fixes it, first check.
Why did Exchange recycle an app pool or reboot itself? How probes, monitors and responders work, how to trace what Managed Availability did, and when an override is justified.
Messages in the poison queue, or a Submission queue that won't drain? Find what crashed or stalled transport, then export, resume or remove messages safely.
Get Windows devices into Purview endpoint DLP, decode the Configuration status and Policy sync status columns, fix Defender prerequisites and verify with advanced hunting.
Set up Windows LAPS end to end: enable it in Microsoft Entra ID, build the Intune account protection profile, retrieve and rotate passwords, and check the LAPS event log.
Proofpoint in front of Exchange Server: scope the receive connector, relay outbound through Proofpoint, fix TLS and recipient lists, and work out which side wrote each rejection.
Fix Android zero-touch devices that skip Intune: reseller registration, linking the zero-touch account, DPC extras JSON and tokens, and the checksum and Conditional Access errors.
A balanced look at Jamf Pro and Microsoft Intune for Apple devices in 2026: declarative management, scripting and inventory, Self Service vs Company Portal, compliance, identity and when to run both.
Export your Intune device inventory to CSV with the Microsoft Graph PowerShell SDK, spot stale and noncompliant devices, and run it unattended with certificate-based app-only sign-in.
Run a message trace in the Exchange admin center or with Get-MessageTraceV2, read the delivery status and events, and pull older data from downloadable reports.
Read the X-Forefront-Antispam-Report header (CAT, SFV, BCL, compauth) to see why a good message was junked, then fix it the supported way: submissions, Tenant Allow/Block List, sender authentication, not bypass rules.
How Intune security baseline versions work, how Update Version creates a side-by-side copy, how to pilot and move assignments, find conflicting settings and roll back safely.
Pilot Microsoft Entra hybrid join with a client-side SCP, get computer sync scope right, switch to the forest-wide SCP in Entra Connect and validate with dsregcmd and Graph.
How external collaboration settings and cross-tenant access settings fit together: default vs organizational settings, trusting partner MFA and devices, and B2B direct connect.
Every AADSTS code Microsoft lists from 90002 to 90130: tenant lookup, malformed requests, national clouds, WS-Federation, Graph, consent and endpoint errors, with cause and first check.
A safe runbook for renewing the public certificate behind hybrid mail flow: install it on every server, enable SMTP, update the connectors or rerun the HCW, then prove TLS works.
Look up an Exchange Online NDR code: what each 4.x.x and 5.x.x error means, the usual cause, the first thing to check and a link to the detailed guide where there is one.
Decode TLS problems on Exchange Server: what Schannel 36887, TLS alert 48, 0x80090331, RevocationCheckFailure and 45 more mean, the usual cause and the first thing to check.
A mail flow rule that should fire does nothing, or fires on the wrong mail? Check state, mode, priority and conditions, then prove the match with message tracking.
Samsung devices skipping KME, failing to enroll in Intune or ignoring Knox Service Plugin settings? Check the KME profile JSON, the token, device upload, network and the OEMConfig profile.
How organization, site and link settings combine to decide who can share what in SharePoint and OneDrive, with Set-SPOTenant and Set-SPOSite commands to audit and set them.
A six-stage MS-102 study plan built on the official Microsoft Learn paths, with extra Exchange Online practice, lab ideas and what the November 2026 retirement of the exam means for you.
Quick reference for Purview retention and label policy statuses, Teams and SharePoint retention messages, records and disposition, mailbox holds and audit search errors.
Look up 56 Microsoft Entra AADSTS codes by area, from passwords, lockout and MFA to consent, app registrations, tokens, B2B and hybrid sign-in, with the usual cause and the first check.
Answer 'who changed this?' and 'who opened that mailbox?' on Exchange Server: search the admin audit log, enable mailbox auditing and know what each log can't tell you.
Fix Ubuntu and RHEL devices that won't register, stay Not evaluated or Not compliant, or get blocked in Microsoft Edge: supported versions, compliance checks, journalctl logs and a clean reset.
Configure Purview Audit beyond the defaults: licenses and the Advanced Auditing plan, mailbox audit actions, search query events, audit retention policies and MailItemsAccessed.
Public folders missing, out of date or failing to open in Outlook? Check the public folder mailboxes, each user's hierarchy mailbox, hierarchy sync and folder permissions.
Route Exchange Server mail through Mimecast: regional smart hosts, authorized outbound IPs or SMTP authentication, a scoped receive connector, and the Mimecast replies that point to each fix.
Outlook can't build a profile or warns about an internal server name. Read the Test E-mail AutoConfiguration log, fix the SCP and DNS records, then clear 401, 404 and certificate failures.
Store processes holding most of the RAM is by design; sustained high CPU isn't. Map the busy process to its cause - search, IIS app pools, transport - and capture evidence with ExPerfWiz.
How 26H2 installs as an enablement package, the Intune feature update policy and rollout options to deploy it, the known issues listed at launch, how safeguard holds show up, and how to verify a device.
Install Microsoft 365 Apps from the Configuration Manager console, then update it through the software update point: products, client settings, channels, ADRs and the logs that prove it.
Every AADSTS code from 120000 to the end of Microsoft's table: password change and SSPR, Windows Hello (NGC) and device keys, device registration and the late app codes, with fixes.
Look up a Purview DLP message: default policy tips and notification emails, Teams flags, endpoint just-in-time events, diagnostic results and policy states, with cause and first check.
Decide which mobile devices may sync with Exchange Online: the organization default, device access rules, per-user allow and block lists, and the modern controls to move to.
When MX points to a non-Microsoft gateway, Exchange Online sees the gateway as the sender. Lock the inbound connector, turn on skip listing and prove it works in the headers.
Follow any email through Exchange Server SE or 2019: read the tracking event IDs, filter Get-MessageTrackingLog, search every server and set log retention.
Why Intune shell scripts and custom attributes don't run on Macs: the agent's 8-hour cycle, user vs root context, shebangs, exit codes and proxies, plus agent logs and Collect logs.
Add a WMI class to Configuration Manager hardware inventory, pilot it, and follow the data from InventoryAgent.log through MP_Hinv.log and dataldr.log to Resource Explorer.
Set up account-driven User Enrollment for personal iPhones and iPads in Intune: Managed Apple Accounts, the service discovery file, JIT registration, the enrollment profile and the user flow.
Dynamic group missing people, reaching the wrong ones or rejecting your filter? Fix the recipient container and OPATH filter, then preview members before anyone sends.
Deploy Microsoft 365 for Mac, Company Portal and Microsoft AutoUpdate with Jamf Pro: official packages, App Installers or policies, an MAU profile, activation and verification.
Look up Teams sign-in status codes such as 0xCAA20003, 0xCAA20004 and 0xCAA82EE2, plus the Entra ID codes behind Teams sign-in failures: meaning, usual cause and first check.
Decode MSExchange Common event 4999: which process failed, where and why, how to tell noise from real crashes, and how to match the report to bugs fixed in later updates.
Endpoint analytics stuck waiting for data or missing devices? Check prerequisites, the Intune data collection policy, restarts, proxy and SSL inspection, and the Configuration Manager upload.
A simple change routine for Microsoft 365: Message center preferences and digests, Planner sync, service health alerts, Targeted release and the Graph service communications API.
Purview retention policies vs retention labels vs Exchange MRM tags vs litigation hold: what each does, what wins in a conflict, licensing, how to set them up and how to prove a mailbox is really on hold.
NPS event IDs and reason codes, AzureMfa log messages, certificate, connectivity and VPN symptoms of the NPS extension for Microsoft Entra MFA, with cause and first check.
Group Policy processing errors in one place: System log events 1058, 1030, 1129, 1006, 1053 and 1097 with their error codes, gpupdate messages and SceCli 1202 warnings.
Edge keeps asking Windows users to sign in, or MAM never applies? Check prerequisites, the Conditional Access grant, the Edge profile and the Windows Security Center connector.
Why a custom domain won't verify or is already added to another Microsoft 365 organization, how to release or take it over, and how to add and check the MX, autodiscover and SPF records.
A field guide to Defender for Endpoint onboarding failures: onboarding script error codes, SENSE Operational event IDs, Intune error codes, and the registry and service checks that show where it broke.
Autopilot pre-provisioning for hybrid join fails in the technician flow when a policy such as a User Rights setting needs a domain controller. How to read the 0x800706FD event and fix the scoping.
Get Configuration Manager reports working again: verify Reporting Services, fix the reporting services point install, data source and permission errors, and explain empty reports.
Fix Intune macOS PKG and DMG app failures: the documented 0x87D3 error codes, LOB vs unmanaged PKG rules, Included apps detection, pre-install scripts, agent logs and verification.
Build one Patch Tuesday automatic deployment rule with pilot, early and broad deployments, an offset schedule and maintenance windows, then confirm each run in RuleEngine.log.
Find expiring app secrets and certificates with Graph PowerShell, lock down user consent, enable the admin consent workflow and track down over-privileged service principals.
Passive DAG copies falling behind? Learn what the copy and replay queues measure, find out whether the network, storage or a lagged copy is responsible, and watch the queues drain.
Outlook can't download the offline address book from Exchange Server? Check the OAB assignment, web distribution, generation mailbox and OAB URL, then force a clean download.
Exchange Web Services is being disabled in Exchange Online from October 2026. What changes, how EwsEnabled and EwsAllowedAppIDs work, how to find what still uses EWS and how to buy time safely.
Which mailbox permissions work between Exchange Server and Exchange Online, how to make objects ACLable, and how to grant Full Access, Send on Behalf and Send As correctly.
Every documented Defender for Identity health issue on the Global and Sensor tabs, with severity, sensor version, the usual cause and the fix that closes it.
Look up an Android error in Intune: DeviceCapReached, Company Portal Temporarily Unavailable, work profile and corporate enrollment blocks, Play Integrity and other compliance failures.
Use Intune's co-management settings policy to install the Configuration Manager client from the CMG during Autopilot, keep the ESP within its timeout and check each stage.
Find the message, read why it was quarantined, release it, and report it through Submissions so a scoped, expiring allow entry replaces risky mail flow rule bypasses.
A reused Autopilot device fails MDM enrollment with 0x80180014. Why it happens, and the documented fixes: unblock or remove the stale Intune record and check enrollment restrictions.
Why Exchange Online rejects mail with 550 5.4.1 at the perimeter, how Directory-Based Edge Blocking and the accepted domain type cause it, and how to fix each common cause.
Build one driver package per model, apply it with a WMI-conditioned Apply Driver Package step, keep boot images lean and prove every device got its drivers.
Licenses and roles, techniques, payloads, targeting, training and launch settings for a Microsoft phishing simulation, how to read the results, and where advanced delivery fits.
Renew the public SAN certificate on every Exchange server and rotate the Auth certificate before it expires, with the commands, the checks and the hybrid follow-up.
How Adaptive Protection turns Insider Risk Management signals into Elevated, Moderate and Minor risk levels that tighten DLP, Conditional Access and retention for risky users only.
A Windows device shows a stale last check-in in Intune and policies stop arriving. How check-in works, what to inspect on the device (service, tasks, certificate, network) and when to re-enroll.
Apple Business Manager apps assigned in Intune stay pending or fail on iPhones and iPads. How location (VPP) tokens and licenses work, what the 0x87D13B error codes mean, and what to check in order.
Decode the Intune encryption report: every BitLocker CSP status bit, key rotation status values, CSP errors and the BitLocker-API messages that stop silent encryption, with the first check.
Pick the right Intune remove-data action: what wipe, retire, Fresh Start and Autopilot Reset remove and keep, what they need to run, and why actions stay pending or fail.
Enable network protection from Intune, turn on web content filtering, build category policies scoped to device groups, add allow indicators, and read blocks in reports, Event Viewer and advanced hunting.
How Entra Connect Sync builds retire, the April 2027 application-based authentication deadline, what auto-upgrade won't do, and how to upgrade and verify safely.
What Built-in protection, Standard and Strict presets enforce, how they outrank custom threat policies, what you still have to configure for impersonation protection, and how to verify which policy handled a message.
Set up Defender for Endpoint live response with guardrails: advanced features, unified RBAC roles, a signed script library, evidence collection and the session command log.
A failed or interrupted Exchange CU or SU can leave services Disabled. Restore the original startup types, start the services and finish the update properly.
Set up Intune's new TeamViewer connector, delegate sessions with RBAC, prepare TeamViewer (client, Device Sync, SSO), fix common launch problems and compare it with Remote Help.
Queues stuck in Retry with 451 4.4.0 DNS query failed? Find the DNS servers transport really uses, test lookups from the Exchange server, and fix the resolver or connector.
Why Purview DLP blocked an email, what the sender sees, how to prove which rule did it, and how overrides, quarantine release and false-positive fixes work.
How access reviews and entitlement management fit together in Microsoft Entra ID Governance: licensing, creating reviews, catalogs and access packages, and a starter plan you can run this quarter.
What status messages 6701, 6702, 6704 to 6706, 5436 and 2302 mean, plus the WCM, wsyncmgr and DistMgr errors behind red components, with usual causes and first checks.
Publish one correct SPF record, turn on DKIM signing in the Defender portal, then move DMARC from p=none to p=reject without blocking your own legitimate mail.
A six-stage study plan for exam SC-300, mapped to the official Microsoft Learn learning paths, with hands-on labs for Conditional Access, authentication methods, PIM, access reviews, apps and Entra Connect.
Look up an Exchange Server event by ID and source: what 15004, 2142, 474, 1135, 4999 and 38 more events mean on Exchange SE and 2019, the usual cause and the first check.
Use Defender for Endpoint as your Cloud Discovery source, judge apps by risk, then warn on Monitored apps or block Unsanctioned ones on devices through network protection.
Set up Microsoft Entra certificate-based authentication correctly and fix its sign-in errors: untrusted CAs, CRL download, size and signature failures, revoked certificates and binding misses.
How Safe Links rewriting and time-of-click checks work, what the Safe Attachments actions do, how to find out why a click was blocked, and how to allow a legitimate URL without weakening protection.
Configure DLP alerts worth reading, triage them in Defender XDR or the Purview alerts dashboard, check the matched content and trace what the user did in activity explorer.
How to read Entra Connect export errors such as AttributeValueMustBeUnique, InvalidSoftMatch and LargeObject, fix matching problems with ms-DS-ConsistencyGuid, and find objects that filtering keeps out of Entra ID.
Why users can't see pages, devices or alerts in the Microsoft Defender portal: activate unified RBAC per workload, build custom roles with the right data sources and device groups, and verify.
Exchange 2016 can't be upgraded in place to SE. The side-by-side route step by step: prepare AD, add SE servers, move namespaces, mail flow and mailboxes, then remove 2016.
Force-install the Microsoft Purview extension in Chrome and Firefox with Intune or Group Policy, close the Incognito gap, adjust unallowed browsers and test that endpoint DLP enforces.
Enable sensitivity labels for Teams, Microsoft 365 groups and SharePoint sites, configure privacy, guest, sharing and Conditional Access settings, and apply them to containers.
Follow a failing Configuration Manager app through the client logs - evaluation, content, install and detection - and fix stuck installs, timeouts and 0x87D00324.
Outlook on iOS or Android ignoring your Intune app protection policy? Check targeting, licensing, the signed-in account, broker apps, check-in timing, reports and Edge diagnostics.
Deploy Intune Endpoint Privilege Management: the elevation settings policy, elevation rules by hash or certificate, the user experience, the elevation reports, and how to troubleshoot rules that don't match.
Why iPhone and iPad profiles show Error, Conflict, Pending or Not applicable in Intune, why supervised-only restrictions don't take effect, and how to check the device and prove the fix.
Use report-only mode, the sign-in logs, the insights workbook and the What If tool to prove a Conditional Access policy behaves as expected before you turn it on.
Look up a failed Windows feature update or upgrade: 0xC1900101 rollback extend codes, compatibility blocks, disk space and setup errors, with the usual cause and the first check.
A staged way to switch co-management workloads to Intune: what each slider really controls, pilot collections, the client logs to watch, rollback caveats and a sensible order.
What enhanced HTTP and PKI-based HTTPS each protect in Configuration Manager, why HTTP-only sites are deprecated, and how to check, switch and verify without stranding clients.
The Active Directory replication status codes Microsoft documents, from 1722 and 8524 to 8606 and 8614, with what each means, the usual cause and the first check to run.
Win32 app stuck downloading or failing with 0x87D30065, 1603 or 1618? Find the failing stage in AppWorkload.log, fix content delivery and installer exit codes, then verify.
Why Exchange Server security updates fail or break OWA and ECP, the documented fixes for the common errors, and the checks that prove an update really installed on every server.
OWA and the EAC loop at sign-in, Event ID 1003 appears or hybrid OAuth fails? Prove the Exchange Auth certificate is expired or missing, then replace it safely.
Kerberos result and failure codes from events 4768, 4769 and 4771, plus the KDC's RC4 and certificate-mapping events, with what each means, the usual cause and the first check.
How retention policies and holds fill the Preservation Hold library, how to measure it per site, what admins can't delete, and the safe ways to scope retention and reclaim storage.
Feature update policy assigned but nothing offered? Check licensing, join type, telemetry, update ring deferrals, WSUS and Group Policy, hardware readiness and safeguard holds.
What the Microsoft MVP Award recognizes, how nominations and reviews work, which contributions count (and which don't), and a simple log template to track your community work.
Event 2937 means an Exchange object still points into AD's Deleted Objects container. Find every affected object, then fix HomeMTA, RecipientContainer and connector links safely.
Decode SharePoint and OneDrive Access Denied, "You need permission" and sharing link errors: wrong account, guest mismatch, missing permissions or a policy block, with fixes.
Every documented Microsoft Entra Domain Services health alert from AADDS100 to AADDS600, with its message, usual cause and fix, plus the 15-day suspension clock and how to verify recovery.
A vendor-neutral design for sending Exchange Server mail through DLP and encryption gateways: forward vs return patterns, connectors, verdict headers, fail-open choices and tests.
A five-stage plan for Exam MD-102 and the Endpoint Administrator Associate certification: the current skills-measured domains, the Microsoft Learn paths to follow, lab exercises and exam-day tips.
A capability-by-capability comparison of distribution groups, dynamic groups, Microsoft 365 Groups and shared mailboxes, when to choose each, how to upgrade a DL and the PowerShell to answer the usual questions.
Look up an Entra Connect or Cloud Sync error: export errors like InvalidSoftMatch, hash sync and writeback event IDs, run statuses and quarantine, with the cause and first check.
Why Intune firewall rules fail or never reach Windows devices: find the bad rule in event 404, fix invalid values, conflicts and merge settings, and verify the active rules.
A phased plan for moving from Symantec DLP to Purview DLP: inventory, the migration assistant, a mapping table, parity testing, cutover by location, rollback and decommissioning.
What Conditional Access token protection binds, which platforms, apps and licenses it needs, and how to roll it out in report-only mode using the sign-in log status codes.
Why Exchange Online refuses outbound mail with 5.7.708, what to rule out before you ask Microsoft Support to lift the block, and how to prove sending works again.
The status and sub-status codes in events 4625 and 4776, from 0xC000006D to 0xC0000234, what each one means, and how to trace an account lockout (event 4740) back to its source.
Find the app or policy holding up the Enrollment Status Page, collect the right logs from OOBE, and fix the profile settings behind most Autopilot ESP timeouts.
A walkthrough of the Windows Autopilot known issues page as of October 2026: open and fixed items, deeper guidance on the January 2026 entries, and how to subscribe so new issues reach you first.
EMS fails with a WinRM error? Match the exact message to its cause - kerbauth and WSMan modules, Remote PowerShell access, the port 80 binding, Require SSL or a proxy - and fix it safely.
Outlook keeps asking for credentials against Exchange Server? Work through cached credentials, Autodiscover, virtual directory authentication, Kerberos, Extended Protection and modern auth.
ESE event 474 and error -1018 mean a database page failed its checksum. Why storage is the usual suspect, how DAG page patching helps, and when to reseed, restore or repair.
How Purview endpoint DLP settings and policy actions fit together: USB and printer groups, service domains, unallowed browsers and restricted apps, with a tested rollout.
Diagnose an unhealthy Configuration Manager management point with mpcontrol.log, status message 5436, mplist and mpcert tests, IIS and SQL checks, and the client-side logs.
Fix the errors you hit when FortiMail filters mail for Exchange Server: 550 5.7.1 Relay access denied, 451 Try again later, failed recipient verification, plus connectors, TLS and SPF.
Windows profile showing error 65000 or Remediation failed (0x87D1FDE8)? Decode the codes, read event 404 on the device, check edition, build and OMA-URI data, and fix the setting.
Allow Activation Lock on supervised iPhones and iPads so Intune keeps the bypass code, disable it safely before reuse, and use Lost Mode and Locate device when a device goes missing.
LDAP error 49 data codes (52e, 525, 530-533, 568, 701, 773, 775), the LDAP result codes domain controllers return, and signing or LDAPS failures, with cause and first check.
Why Microsoft 365 Apps shows Unlicensed Product or account errors: check the license, the signed-in account, the device and shared computer activation, then reset activation cleanly.
Build a two-tier Microsoft Cloud PKI hierarchy in Intune, deploy the trusted certificate and SCEP profiles, bind the certificate to Wi-Fi or VPN profiles, monitor and revoke, and fix the common SCEP errors.
Part 1 of the complete AADSTS list: every code from AADSTS16000 to AADSTS50079 in Microsoft's order, with its meaning, the usual cause and the first check.
Pure on-premises Exchange can accept OAuth tokens from AD FS instead of passwords. Prerequisites, the AD FS application group, auth policies, Exchange and Outlook settings, and testing.
Look up sensitivity label and encryption errors: SharePoint and OneDrive auto-labeling failure codes, missing-label checks, Rights Management and IRM status, with fixes.
Veeam jobs failing on the Microsoft Exchange Writer, or logs not truncating after a green job? Check application-aware settings, guest credentials, freeze timeouts and DAG job design.
The known issues Microsoft lists for the latest Exchange Server SE security update, the hybrid issues it fixed, how to confirm each one on your servers and where to watch for changes.
Working dynamic device rules for Autopilot, group tags, OS version, ownership and enrollment profiles, plus licensing, processing time, rule validation and when filters fit better.
Set up any load balancer for Exchange Server SE and 2019: per-protocol healthcheck.htm monitors, SSL bridging with Extended Protection, no affinity, SMTP and Kerberos, and bad-VIP symptoms.
Test-IRMConfiguration failing on Exchange Server with the Microsoft RMS connector? Find the failing step, then fix authorization, registry settings, IRM switches or the DRM cache.
Silent BitLocker not starting? Check TPM, UEFI, Secure Boot and WinRE, the required policy settings, startup authentication conflicts and recovery key backup to Microsoft Entra ID.
Why a hybrid joined PC also shows as Entra registered, what Pending really means, and how to clean up duplicates with dsregcmd, BlockAADWorkplaceJoin and Graph PowerShell.
Take a Purview DLP policy from template to enforcement: simulate with policy tips, tune out false positives, onboard devices for endpoint DLP, then switch it on in stages.
Turn an advanced hunting query into a custom detection rule: the columns it must return, frequency and lookback, automatic response actions, scope, testing and run failures.
Part 2 of the complete AADSTS list: every code from AADSTS50085 to AADSTS54005 in Microsoft's order, with its meaning, the usual cause and the first check.
How Purview auto-labeling policies behave in practice: simulation, which labels they overwrite, policy conflicts, Exchange and SharePoint specifics, limits and monitoring.
Why some Macs dropped out of Intune during MDM identity certificate renewal, Apple's fix in macOS 26.4, how to find and re-enroll affected devices, and how this differs from an expired Apple MDM push certificate.
A 10-minute checklist to rule out a service incident, a documented known issue or a gradual service release before you troubleshoot your tenant, plus what to collect for a support case and how to subscribe.
Why devices fail the built-in Is active, Enrolled user exists and Has a compliance policy assigned checks in Intune, and how to clear each one before Conditional Access blocks users.
Configure Delivery Optimization and Microsoft Connected Cache with Intune for Win32 apps and Windows updates, pick the right download mode and group ID, and prove where content came from.
Why the OneDrive sync app sits on "Processing changes" for hours, how to find the file, limit or sign-in problem behind it, reset the client safely and confirm sync health.
Why a Windows device fails "Require the device to be at or under the machine risk score", and how to check the connector, onboarding, device identity and active alerts in the right order.
Veeam Explorer can't open an Exchange database or restore items? Point it at the right ese.dll, replay logs on a Dirty Shutdown copy, grant restore rights, or fall back to a recovery database.
Why Purview exact data match uploads fail or never match: the EDM_DataUploaders group, schema and data validation, hash and upload commands, indexing and testing.
The four sign-in log types, the fields that matter, how to trace one failed sign-in end to end, KQL against the SigninLogs table, export and retention by license, and the misreads that waste hours.
Why Exchange databases never shrink, how to read AvailableNewMailboxSpace, and why moving mailboxes to a new database beats eseutil /d offline defragmentation.
Where the HCW log lives, how to find the line that really failed, and fixes for the usual causes: TLS, stale servers, Autodiscover, certificates, OAuth (HCW8064) and MRS.
User risk vs sign-in risk, the detections behind them, risk-based Conditional Access that lets users fix their own risk, and how to investigate, dismiss or confirm the false positives.
Settings stuck on Conflict in Intune? Find the competing policies, confirm what the device received with the MDM diagnostic report and event log, and rule out Group Policy.
Build a locked-down Android kiosk with Intune: dedicated device enrollment tokens, multi-app kiosk mode with Managed Home Screen, Entra shared device mode sign-in, and fixes for missing apps.
Tell inactive clients from unhealthy ones, read CcmEval results on the device, repair WMI and broken clients safely, and clean up stale records with the right maintenance tasks.
Every error code Microsoft documents for the Entra provisioning logs: SCIM app provisioning, Workday and SuccessFactors inbound, cross-tenant sync and quarantine, with cause and fix.
What 5.7.1 Delivery not authorized means in Exchange Online, how to tell a group restriction from a mail flow rule, and the settings and cmdlets that fix each cause.
Look up an ESE/JET error from eseutil, a failed mount or the event log: what -1018, -528, -550 and 36 more codes mean in Exchange Server, the usual cause and the first check.
Fix Microsoft Tunnel Gateway problems: stalled installs, Unhealthy health checks, TLS certificate issues, /dev/net/tun and Podman log errors, and devices that won't connect.
Configuring the Intune Connector for AD with your own gMSA can fail on the SeLogonAsServicePrivilege pre-check. The June 2026 known issue, the SkipByoMsaPrivilegeCheck fix and how to verify it.
What Azure Rights Management, BYOK, Double Key Encryption, Customer Key and Message Encryption each protect, how they work with labels, and what they mean for eDiscovery and Copilot.
How the HCW connectors, certificate name matching and header trust keep cross-premises mail internal, when centralized mail transport is worth it, and how to prove it all works.
Set up CMPivot and Run Scripts permissions, query online clients in real time, take a PowerShell fix through approval, then confirm it in Script Status and Scripts.log.
Cisco Secure Email Gateway (formerly IronPort) in front of Exchange: map listeners, HAT and RAT to Exchange connectors, fix relay, rate-limit and TLS errors, and trace mail in both logs.
After the September 2026 Windows 11 updates some domain-joined devices lose their secure channel because Machine Identity Isolation is now honored. How to find the policy, roll it back and verify.
What AADSTS7000215, 7000222, 700016, 50011, 700027 and 500011 mean, how to find the failing app in the sign-in logs, and how to fix the credential or setting and test it.
Edge Transport server not synchronizing? Check DNS, port 50636, services and certificates, re-create the Edge Subscription the supported way and prove it with Test-EdgeSynchronization.
Microsoft Store app (new) installs failing? Decode the WinGet 0x8A15 codes, check Store and App Installer policies, TLS inspection and install context, then test on the device.
How a Purview DLP policy is built, how rule and policy priority decide which action wins, and a starter set of policies you can simulate and tune.
How Defender for Endpoint security settings management pushes Intune endpoint security policies to devices not enrolled in Intune: prerequisites, enforcement scope, synthetic registration and pitfalls.
Why users or guests can't open a file encrypted by a sensitivity label, how to fix permissions and Entra settings, and how to recover content with the super user feature.
How automapping really works, why group-based Full Access never automaps, how to switch it off per user, and how to keep sent items in the shared mailbox.
Set up the Endpoint Protection point and client settings, build antimalware policies, choose security intelligence update sources and prove on the device that Defender got the settings.
Extend Intune compliance with your own checks: write a discovery script that returns compressed JSON, define rules in the JSON schema, upload both, and troubleshoot error codes 65007 to 65010.
Phones stop syncing or never start. Check the device access state and rules, fix the AD permission problem behind Event ID 1053, and read ActiveSync status codes in the IIS log.
Set up Windows driver update policies in Intune, choose automatic or manual approval, and fix the settings that leave the driver list empty or stop approved drivers installing.
Microsoft's response order for a compromised mailbox, cmdlets that find malicious inbox rules and forwarding across every mailbox, what to read in sign-in and audit logs, and how to harden afterwards.
Fix Jamf Device Compliance registration on Macs: Account not onboarded, Device is already enrolled, keychain prompts, duplicate Entra devices and registrations that never turn compliant.
Apps using EWS fail with 401, 503, ErrorServerBusy or ErrorImpersonateUserDenied. Check authentication, server health, throttling policies, impersonation rights and the EWS logs.
Choose between feature update deployments, servicing plans and an upgrade task sequence for Windows 11, gate upgrades with a compatibility scan and prove the new build.
Event 12014 means a connector has no usable certificate, so STARTTLS disappears. Line up the FQDN, certificate and TlsCertificateName, then prove TLS works again.
What Exchange Server SE supports: Windows Server 2019-2025, domain controllers, forest levels, .NET, Outlook clients and coexistence rules, plus a plan for moving to Windows Server 2025.
Build the Applicable and Compliance smart groups, run the Jamf Pro Device Compliance wizard, add the Intune compliance partner and require compliant Macs without blocking registration.
Install the ExchangeOnlineManagement module, connect to Security & Compliance PowerShell interactively or app-only, and fix the install, connection and eDiscovery session errors.
Five items Microsoft currently lists as Active on the Intune known issues page, what each looks like, what to tell users, how to work around it, and how to track the page and escalate properly.
Why Intune scripts on Microsoft Graph fail with 401, 403 Forbidden or 429 Too Many Requests: permission types, admin consent, Intune roles, the 2025 scripts permission change, paging and retries.
Signatures missing on some messages, added twice or causing loop NDRs? Find which agent, rule or service stamps your Exchange Server mail, fix it and prove it with message tracking.
AD FS Admin and audit events (364, 342, 411, 1200-1210, 512-516), certificate events 249-389, service events 102, 220 and 352, and MSIS7042 and MSIS7065, with cause and first check.
A 12-week, lab-based study plan for on-premises Exchange Server SE: deployment, mail flow, DAGs, client access, security, servicing and hybrid, with break-fix drills at every stage.
What each Intune policy type is for, how conflicts between them are resolved and reported, a recommended layering for a new tenant, and naming and assignment hygiene with filters.
Link Apple Business (formerly Apple Business Manager) to Microsoft Entra ID: approve, test and turn on federation, sync users, handle account conflicts and fix sign-in failures.
Move Macs off Jamf Pro's retired macOS Conditional Access integration: what changes, an order of steps that avoids lockouts, Jamf's migration script, verification and a realistic rollback plan.
SSPR prerequisites, password writeback through Connect Sync or Cloud Sync, the documented SSPR_00xx portal errors, the Windows sign-in screen Reset password link, and the event IDs behind writeback failures.
A methodical way to troubleshoot hybrid free/busy and calendar sharing: direction, Autodiscover, the OAuth trust and dedicated hybrid app, connectors and relationships, with cmdlets for each hop.
Look up the Windows Update, network and servicing codes Configuration Manager clients report for software updates: the meaning, the usual cause and the first check.
How Defender Antivirus picks active, passive or disabled mode when another antivirus is installed, what still works in each mode, and how EDR in block mode closes the gap.
Match an Exchange Management Shell or Active Directory error to its cause: object not found, matches multiple entries, proxy address in use, INSUFF_ACCESS_RIGHTS, WinRM failures and more.
Read dsregcmd /status for hybrid join failures, check the SCP and Entra Connect sync, use the User Device Registration log and clear devices stuck in Pending.
Intune says the antivirus policy succeeded but the device disagrees. Check the management channel, conflicts, passive mode, tamper protection and exclusion behavior to find out why.
Look up an Exchange ActiveSync status code: what 126, 129, 142, 177, Sync status 3 and 50 more mean, the usual cause on Exchange Server and the first thing to check.
POP3 or IMAP4 clients can't connect or sign in? Start the right services, check PopProxy/ImapProxy, LoginType and the certificate, then prove the fix with a test login and protocol logs.
All mailboxes are in Exchange Online but a server still runs just for recipient management? The supported ways to retire it, what you give up and the exact steps.
Connect Barracuda Email Gateway Defense or the Email Security Gateway to Exchange Server, and use message tracking plus Barracuda's Message Log to tell a Barracuda block from an Exchange fault.
What error 5.7.57 means, how SMTP AUTH client submission, SMTP relay and Direct Send differ, how to fix each cause, and where Basic authentication for SMTP AUTH stands.
Deleted or disabled the wrong mailbox? Find it among the disconnected mailboxes, reconnect it or merge it into another mailbox before the retention period runs out.
Look up an Apple enrollment error in Intune: NoEnrollmentPolicy, DeviceCapReached, APNs and ADE token sync errors, Profile Installation Failed and Mac messages, with the first check.
Copilot uses only what people can already open, so oversharing surfaces fast. Find it with data access governance reports, contain it, and fix it with site owners and labels.
Why the Sensitivity button or some labels are missing in Word, Excel, PowerPoint or Outlook, and how to check label policies, Office settings, the local cache and replication delays.
Classic v2.x or new v3.x sensor? Prerequisites, the Directory Service account and gMSA, the Health issues page and the fixes for the sensor health alerts you'll actually see.
How Configuration Manager evaluates collections, and how to design limiting collections, query rules and update schedules that keep membership fresh without overloading the site.
Outlook keeps showing a certificate name Security Alert? Find the host name Exchange or DNS hands out, then fix the Autodiscover SCP, virtual directory URLs, split DNS or SAN list.
Look up an Outlook, Autodiscover or OAB error against Exchange Server: what 0x8004010F, 0x80190194, GetLastError=12007 and 42 more codes mean, the usual cause and the first check.
Route browser sessions through Conditional Access app control, build session policies that block or protect downloads on unmanaged devices, and fix the errors admins and users hit.
What the monthly KB4052623 platform and engine updates are, how to assign Intune update channels in rings, how to read versions with Get-MpComputerStatus, and how to roll back with MpCmdRun.
Run Microsoft's Exchange Server Health Checker on every server, build the HTML report and fix the findings that come up most: missing updates, page file, TLS, KeepAlive and more.
Set up PIM for Microsoft Entra roles: role settings, eligible assignments, activation and approvals, PIM for Groups, alerts, access reviews, and the activation problems you'll hit.
Apps get 550 5.7.54 when relaying to external recipients. Build a dedicated Frontend receive connector, allow only specific IPs to relay, and test it without creating an open relay.
Follow the policy chain on a Configuration Manager client: registration, management point access, cloned GUIDs and site assignment, then trigger policy and prove it arrives.
How CAE revokes sessions in near real time, which clients support it, standard vs strict location enforcement, and how to find and fix IP mismatches in the Entra sign-in logs.
Senders get 554 5.2.2 mailbox full, or a user can't send or delete? Find which quota was hit, raise it or free space, deal with Recoverable Items and verify delivery.
Fix Android fully managed and corporate-owned work profile enrollments that fail during setup: device and token checks, QR code and afw#setup, Google downloads, Conditional Access and registration.
All 19 ASR rules with GUID, Intune and Configuration Manager names, Warn support and advanced hunting action types, plus rule modes and the Event Viewer IDs.
Read StatusDetail and the MRS report to tell throttling by design from real problems, then fix stalled or failed on-premises mailbox moves and resume them safely.
Decode Purview distribution errors such as PolicySyncTimeout and FailedToOpenContainer, fix the locations behind them, retry distribution and confirm the policy applies.
Domain-joined users getting password prompts again? Decode the 8100x sign-in errors, then check the intranet zone, klist and the AZUREADSSOACC account and key.
A vendor-neutral checklist for any gateway in front of Exchange: a scoped receive connector, InternalSMTPServers, the header firewall, TLS, a smart host connector and no mail loops.
Log volume filling up or databases dismounting? Find out why Exchange isn't truncating logs, free space safely with a backup or circular logging, and never delete logs by hand.
Domain controller event IDs in one reference: Directory Service replication and LDAP signing events, Netlogon secure channel events and DNS Server zone events, with cause and first check.
Blank OWA and ECP pages, EMS WinRM errors or Event 15021 after certificate work? Restore the self-signed Microsoft Exchange certificate on the Exchange Back End site's port 444 binding.
Microsoft Entra hybrid join Autopilot deployments can time out with 0x80004005 on older Windows 11 builds. How to confirm the known issue, which KBs fix it and how to get devices onto a fixed build.
Exchange answers 452 4.3.1 when back pressure kicks in. Find the resource under pressure, fix the cause or move the queue database, and confirm transport is back to normal.
How Exchange Server RBAC decides what an admin can do: roles, role groups, assignments and scopes, how to grant least privilege, and the usual causes of access-denied errors.
Prerequisites, SPN registration with Microsoft Graph PowerShell, EvoSTS and OAuth2ClientProfileEnabled, then proof that Outlook uses Bearer tokens for on-premises mailboxes.
Why DAG databases stay active on the wrong member after failovers or patching, what blocks automatic rebalancing, and how to move them back with RedistributeActiveDatabases.ps1.
Decode a stuck Exchange queue: what 441 4.4.1, Winsock 10061, 454 4.7.0 Temporary authentication failure, Retry, the Unreachable queue and 30 more mean, and the first check.
Intune will evaluate BitLocker, Secure Boot and code integrity compliance through Microsoft Azure Attestation. Which endpoints to allow, how to test from a device, and how to find affected policies.
Why Exchange Online blocks automatic forwarding to external addresses with 5.7.520, and how to allow it only for the mailboxes that need it instead of for everyone.
Mount-Database fails with ec=1108 and eseutil /mh says Dirty Shutdown? Find the logs Exchange needs, run soft recovery safely, and know when to restore or reach for eseutil /p.
Why cloud Kerberos trust is the recommended Windows Hello for Business model for hybrid tenants, how to create the Entra Kerberos server object, configure the Intune policy, and verify with dsregcmd and klist.
Why Exchange answers MAIL FROM with 530 5.7.1 Client was not authenticated, how to find the receive connector that answered, and how to fix scanners, apps and gateways safely.
Exchange setup stopped at Prerequisite Analysis? Match each readiness error to the missing piece (UCMA 4.0, Visual C++, .NET, URL Rewrite, Windows features, pending restart) and fix it.
Look up a VSS error from an Exchange backup: 0x800423F3, 0x800423F4, 0x800423F2, 0x8004230F and other VSS_E codes, vssadmin writer states and related events, with first checks.
What 0x80070002, 0x80070032, 0x80091007, 0x80040104, 0x80072EE7 and 39 more task sequence codes mean, the usual OS deployment cause and the first thing to check.
Look up a Windows Hello for Business failure: PIN creation codes (0x8009…, 0x801C…), provisioning events 358, 360 and 362, and sign-in errors, with the cause and first check.
The core Conditional Access policies to deploy first, how they map to Microsoft's templates and Microsoft-managed policies, and how to roll them out in report-only mode without locking anyone out.
How Configuration Manager clients use boundaries and boundary groups to pick a site, management point and content source, how fallback works, and how to verify it.
What the Exchange Hybrid Agent replaces, what still needs inbound access or classic hybrid, and how to check agent health, redundancy and the msappproxy.net endpoint.
Create and manage Exchange Online mailboxes from on-premises the supported way: New- and Enable-RemoteMailbox, the attributes that matter, ExchangeGuid fixes and common mistakes.
Find out why the Record or transcription option is missing in a Teams meeting, or why a recording never shows up, and fix it with policy, role, storage and license checks.
How the Primary Refresh Token powers single sign-on on Windows, how to check it with dsregcmd and the AAD event logs, and how to fix a missing or stale PRT.
Control who is a local administrator on Windows with Intune's local user group membership policy: Update vs Replace, Entra and AD members, conflicts, error 0x55b and verification.
How Microsoft Security Exposure Management works: licensing and permissions, critical assets, initiative scores and targets, attack paths and choke points, and how it relates to Secure Score.
Connect Microsoft 365, Google Workspace, Salesforce and other apps to Defender for Cloud Apps, decode the connector error messages, find missing activities and verify that data flows.
Configure user reported settings so phishing reports reach your SOC and Microsoft: the built-in Report button, a reporting mailbox that isn't filtered, triage and feedback.
Deploy Defender for Endpoint to Macs with Jamf Pro in the right order: onboarding plist, settings, permission profiles, a smart group gate and the package. Then read mdatp health and fix its errors.
Lookout, Zimperium or Check Point connected to Intune, yet devices are blocked, wrongly compliant or never report? Check the connector state, toggles, partner app and threat-level rules.
Install the ExchangeOnlineManagement module, connect interactively or with app-only certificate authentication, and run five quick reports with the fast Get-EXO cmdlets.
vssadmin shows the Microsoft Exchange Writer Failed or Retryable, or logs pile up after a 'successful' backup? Reset the writer, fix DAG conflicts and prove it with Windows Server Backup.
Deploy the modern unified solution (md4ws.msi) on Windows Server 2012 R2 and 2016: prerequisites, deployment options, moving off MMA, install errors and how to verify.
How Intune device cleanup rules work per platform, what they hide and what they leave behind, and how to pair them with a safe Entra ID stale-device routine that spares Autopilot.
Device control concepts (groups, rules, entries, access masks), the Intune Device Control profile with reusable settings, audit before block, printers, hunting queries and fixes when a USB stick stays writable.
Event IDs and messages for Entra Password Protection DC agents and proxies, pass-through authentication agents and Seamless SSO, with cause, first check and the health tests to run.
Internal mail bouncing to an IMCEAEX address with RESOLVER.ADR.ExRecipNotFound? Decode the old LegacyExchangeDN, add it back as an X500 proxy address and stop it happening again.
What Inactive, Impaired communications and No sensor data mean in the Defender device inventory, and how to check the sensor, onboarding state, proxy and duplicate device records.
Look up an Exchange Server NDR or queue status code: what each 4.x.x and 5.x.x code means, the usual on-premises or hybrid cause and the first cmdlet or setting to check.
Issue Intune SCEP certificates from DigiCert, Entrust, GlobalSign, Sectigo, SCEPman or another partner CA: the Entra app, profiles, challenge validation, Wi-Fi/VPN linkage and errors.
Use supersedence to update or replace Win32 apps and dependencies to install prerequisites first: update vs replace, targeting, auto-update, limits, conflicts and IME logs.
Configure the Passkey (FIDO2) policy and a passkey profile for Authenticator, pick the right registration flow, roll out in rings and fix the registration and sign-in failures users report.
A 12-week plan for Configuration Manager admins: cloud attach, co-management, moving workloads to Intune and cloud-native Windows with Autopilot, with labs and Microsoft Learn resources.
Jamf devices not reporting compliance to Entra ID? Check the Intune partner status, scoping, licenses, the Entra apps Jamf's wizard creates, Jamf Pro smart groups and legacy leftovers.
How Intune roles, role assignments and scope tags fit together, three delegation designs that work, the pitfalls that leak visibility, and how to audit and test what an admin can really do.
A hop count NDR means a message looped until a server gave up. Read the NDR, trace the loop with message tracking, and fix the accepted domain, connector or recipient behind it.
Why Exchange Online stops a user from sending with 550 5.1.8, why you secure the account before unblocking it, and how to unblock, tune outbound limits and verify.
DAG backups failing in NetBackup (status 156) or Commvault? Check the preferred server list, the passive copy and the Exchange writer, then prove which side is at fault.
Microsoft's prepare, set up and onboard phases applied to Symantec Endpoint Protection: exclusions both ways, passive mode, policy mapping, removing SEP safely, verification and rollback.
Which peer-to-peer and caching options Configuration Manager offers, what content each one serves, how clients pick a source, and how to prove where content came from.
Exchange setup won't remove a server that still hosts hidden system mailboxes or DAG copies. Find them, move them, fix connectors and uninstall cleanly.
Look up a failed Intune app install: what 0x87D1041C, 0x87D300C9, 0x80070643, 0x8A15001B, 0x87D13B7E, 0xC7D14FB5 and 50 more codes mean, the usual cause and the first check.
Find out which sensitive information type and rule matched, then cut Purview DLP false positives with confidence levels, instance counts, exceptions and better-tested SITs.
How Exchange Online evaluates mail flow rules, why the native External tag beats a subject-prefix rule, and how to test, order and audit rules without punching holes in EOP.
Purview DLP covers Exchange Online mail; Exchange Server has its own DLP and needs IRM for encrypted mail. What each engine sees on-premises and in hybrid, and how to prove it.
Declare records with Purview retention labels, build a file plan, start retention on business events and run multi-stage disposition reviews with proof of what was deleted.
How classic Outlook finds Exchange Online, how to read Test E-mail AutoConfiguration and the Remote Connectivity Analyzer, and the usual culprits: DNS, stale on-premises Autodiscover, old clients and broken profiles.
Connect Jamf's mobile threat defense to Intune: UEM Connect consent, the MTD connector, Jamf Trust activation, device threat level in compliance and app protection, and fixes when it fails.
Build a custom sensitive information type in Microsoft Purview: regex rules, keywords, proximity and confidence levels, rule package XML, limits, and how to test it.
What Exchange Server SE changes for on-premises Exchange: the Modern Lifecycle, entitlement-based licensing, how updates ship, and a practical checklist for planning your move.
How Teams external access (federation) differs from guest access, which Teams, Entra ID, Groups and SharePoint settings control each, and a safe baseline to apply.
Get a mailbox or a single folder back from backup without touching production: restore the files, bring them to Clean Shutdown, mount an RDB and merge the data.
Quick reference for Purview eDiscovery: partially indexed item behavior, encrypted content, export package messages and hold distribution codes such as PolicySyncTimeout, with first checks.
A practical checklist for failed Android personally owned work profile enrollments: Managed Google Play, restrictions, licenses, device requirements, existing profiles and logs.
Add a prepackaged Win32 app from the Enterprise App Catalog, understand the prefilled install and detection settings, choose between auto-update and guided supersedence, and troubleshoot failed installs.
Create room and equipment mailboxes, tune Set-CalendarProcessing (auto-accept, conflicts, booking window, delegates), build room lists and Set-Place metadata for Room Finder, and fix the usual booking complaints.
Every documented value in X-Forefront-Antispam-Report, X-Microsoft-Antispam and Authentication-Results, with what it means, the usual cause and where to act.
Delegates get a SendAsDenied NDR when sending from a shared mailbox? Grant the right permission, allow for replication and caching, and fix stale Outlook addresses.
Connect Intune to Microsoft Defender for Endpoint, onboard Windows devices with an EDR policy, then prove it worked on the device, in the Defender portal and with a detection test.
Why Teams messages or SharePoint and OneDrive files don't follow your Purview retention policy: wrong locations, timer jobs, holds, distribution and site prerequisites, and how to prove it.
Turn on SMTP protocol logging on the right connector, find the log files and read a session line by line to spot TLS, authentication and relay failures.
Why group-based license assignments fail for some members, where to see the errors, how to list affected users with Microsoft Graph PowerShell, and how to fix and reprocess them.
Answer who did what in Microsoft 365: audit retention by license, Purview audit search jobs, Search-UnifiedAuditLog for large result sets, and the operation names worth knowing.
Empty or stale Windows update reports in Intune or Windows Update for Business reports? Check the tenant Windows data toggle, Required diagnostic data, endpoints and latency, then verify.
Prerequisites, the update ring settings and their ranges, a pilot/broad ring design, expedite and driver update policies, the Intune and Windows Update for Business reports, and how to check a device locally.
What AADSTS53000, 53001 and 53003 actually mean, how to find the blocking policy in the sign-in logs, and how to fix compliance and browser device-identity gaps.
Fix Defender for Endpoint on Linux when the package, service or onboarding fails: read mdatp health, test cloud connectivity, handle real-time protection problems and verify.
DFS Replication and legacy FRS events for SYSVOL in one reference: 2213 dirty shutdowns, 4012 content freshness, partner errors, FRS 13508 and 13568, and FRS-to-DFSR migration errors.
Detect and repair folder view, folder count, search folder and other logical mailbox corruption online with New-MailboxRepairRequest, then track it with Get-MailboxRepairRequest.
Pick cutover or hybrid, move mailboxes in batches, cut over mail flow, then choose an end state: keep hybrid, keep one SE server, remove the last server or manage in the cloud.
Choose between OU, group and attribute filtering in Entra Connect Sync, preview every pending delete with csexport, and get past the accidental-delete threshold safely.
Every documented SSPR_00xx reset-page code and password writeback event ID from Entra Connect and Cloud Sync, with the meaning, the usual cause and the first check.
How the Exchange Emergency Mitigation service and AMSI integration protect Exchange Server SE between updates, what they need to work, and the checks that prove they're doing their job.
Why custom ADMX and ADML uploads fail in Intune (missing namespaces, combo boxes, language and size limits), how to fix each one and how to prove the settings reached the device.
Turn on Windows Backup for Organizations and the tenant-wide restore page in Intune so users get their Windows settings back during setup: requirements, steps and fixes.
What the Company Portal Sync button really does, why the app says a device isn't set up or belongs to another user, how the primary user drives it, and where the logs are.
Look up a move request status, StatusDetail or MRS exception: what Queued, StalledDueToTarget_*, TooManyBadItems and 30-plus more mean in Exchange Server and hybrid, and what to check first.
Windows MDM enrollment fails with 0x80180018 or a nearby 0x8018 code. What Microsoft documents for each code, which tenant setting is behind it, and how to confirm the fix in the enrollment event log.
Large messages bouncing with 5.3.4 ROUTING.SizeLimit or 5.2.3 RecipSizeLimit? Every Exchange size limit with its default, how they interact and how to raise them safely.
A map of the Jamf and Microsoft integrations in 2026: Device Compliance, the retired macOS integration, Platform SSO, Jamf Connect, Entra ID in Jamf Pro, threat defense and Defender.
How Workspace ONE, Ivanti, Citrix and other MDMs report compliance to Entra ID through Intune: partner setup, device registration, Conditional Access, migration and why devices stay N/A.
A phased sensitivity label rollout: design a small taxonomy, publish with default labels, enable SharePoint and OneDrive support, then auto-label safely using simulation.
Set up Windows Autopilot end to end: tenant prerequisites, collecting and importing hardware hashes, group tags and dynamic groups, a user-driven Entra join profile, an Enrollment Status Page and the first test device.
Deploy OneDrive Known Folder Move through the Intune settings catalog, roll it out at a safe pace, read the sync health dashboard, and fix the documented reasons a folder refuses to move.
Look up OneDrive sync app error codes and messages: what each means, the usual cause and the first check, from sign-in and proxy codes to Files On-Demand and disk errors.
Fix Configuration Manager Remote Control sessions that fail or get access denied: client settings, permitted viewers, role-based permissions, the firewall port and the logs to read.
Build the Intune settings catalog policy for macOS Platform SSO, pick Secure Enclave, smart card or password, get Macs registered and fix the failures you will actually meet.
Look up a Defender Antivirus event or error code: what 1116, 1119, 2001, 3002, 5007, 5013, 0x80508023 and 52 more mean, the usual cause and the first check.
Move legacy MFA and SSPR method settings into the authentication methods policy: the three migration states, how each setting maps, and how to prove nobody gets locked out.
Why Configuration Manager clients don't become co-managed: read CoManagementHandler.log and the MDM enrollment events, fix scope, license and MFA causes, and check who owns each workload.
Backup Exec failing with 0xE000FED1, skipping DAG databases or leaving logs untruncated? Fix the Exchange writer, passive-copy settings, backup method and GRT requirements.
Upload Configuration Manager devices to the Intune admin center with tenant attach: prerequisites, enabling the upload, what admins can do there, RBAC, and fixing missing devices or failed actions.
What 0x87D00324, 0x87D00607, 0x87D01106, 0x87D00213, 1603, 1618, 3010 and 40 more app deployment codes mean, how return codes map, and the first thing to check.
Mail flow or OWA down after an Exchange CU or SU? Check Get-ServerComponentState, find which requester holds ServerWideOffline Inactive, finish the update and reactivate safely.
Use built-in trainable classifiers or train your own with seed content, apply them in DLP, labels and retention, and find classified content in content explorer with the right roles.
A quick reference for Configuration Manager client installs: ccmsetup exit codes, client.msi results, push, download, certificate and WMI codes, each with a cause and first check.
Domain join failures decoded: NetSetup.log codes 0xaac, 0x8b0, 0x216d, 0x54b, 0x569, 0x6bf, 0x6d9, 0x40 and the DNS, network and logon messages, with cause and first check.
What device association writes to UEFI, the Windows 11 and TPM 2.0 requirements, exporting the DeviceLink CSV and pre-associating in Intune, lifecycle and removal, and how it coexists with classic Autopilot.
Why senders get 554 5.2.2 mailbox full, how to measure a mailbox and its hidden Recoverable Items folder, and the fix for each cause: user data, holds, calendar logging or the wrong license.
Work through a failing PXE boot in order: network and IP helpers, the PXE-enabled distribution point, boot images, deployments and unknown computers, reading SMSPXE.log at each step.
A structured compromise check for Exchange Server: Health Checker, Test-ProxyLogon, where web shells hide, the logs and Exchange settings attackers abuse, and what to do if you find something.
A Mac is compliant in Jamf Pro, yet Conditional Access returns AADSTS53000. Read the sign-in log, find the broken link (registration, compliance sync, browser or device ID) and fix it.
What trips admins up in Autopilot device preparation, the known issues and their status as of October 2026, how to read the deployment status report, and the documented steps for a failed deployment.
How exposure score, recommendations, software inventory and weaknesses fit together, and how a Request remediation in the Defender portal becomes a security task an Intune admin can close.
Enterprise Vault archiving tasks failing to log on, stalling or leaving shortcuts that won't open? Check the Vault Service account, system mailboxes, throttling policy and add-ins.
Grant and change calendar and folder permissions in Exchange Server with PowerShell, handle localized folder names, set up real delegates and fix the two common errors.
Why Purview DLP blocks SharePoint and OneDrive files after upload, what the warning and blocked icons mean, and how to override, report false positives and verify.
A device is onboarded to Defender but never shows up as MDE-managed in Intune. Read HKLM\SOFTWARE\Microsoft\SenseCM\EnrollmentStatus, map the code to its cause and fix it.
Build Purview adaptive scopes for users, groups and sites with OPATH and KQL, validate them in PowerShell, plan for the five-day population and fix scopes that stay empty.
Create file, IP, URL and certificate indicators in Defender for Endpoint: the prerequisites, actions, scoping, limits and precedence, why an indicator doesn't fire, and how to prove it.
Delegates can't open a mailbox or every message they send from it bounces? Match the error to the missing permission, fix it in PowerShell and prove it works.
The Windows LAPS Operational events Microsoft documents: policy cycle, Entra ID and Active Directory backup failures, password updates and post-authentication actions, with fixes.
How the Tenant Allow/Block List really behaves: what block entries do, why allow entries come from Submissions, spoofed sender domain pairs, expiry rules and PowerShell.
What automatic attack disruption contains and why, the Defender settings it depends on, and how to exclude critical assets, review its actions and undo them safely.
Why Outlook falls back to NTLM behind a load-balanced namespace, and the fix: create the ASA account, deploy it with RollAlternateServiceAccountPassword.ps1, register SPNs, verify with klist.
Outlook shows Disconnected or can't create a profile against Exchange Server. Check the user's MAPI settings, Autodiscover, the MAPI virtual directory, healthcheck.htm and load balancer probes.
Look up an Intune profile or compliance result: what 65000, 0x87D1FDE8, SyncML 404/500, iOS payload codes, compliance states and BitLocker status details mean, and the first check.
Set up Communication Compliance: role groups and reviewers, templates and channels (including Copilot), classifiers, privacy settings and the remediation actions reviewers use.
Install the Microsoft Purview Information Protection scanner, run discovery and enforcement scan jobs, and fix its token, policy, database and connection errors.
Why users see Need admin approval or AADSTS90094 and apps get AADSTS65001, and how to grant admin consent safely, set up the admin consent workflow and tune user consent.
Set consistent internal and external URLs on every Exchange virtual directory, then back up, reset or recreate a broken OWA, ECP, EWS or OAB directory safely.
Configure Intune Multi Admin Approval so wipes, scripts, app deployments and role changes need a second admin: approver groups, access policies, the request flow and audit.
Use orchestration groups to patch clustered or dependent servers one at a time or in batches, with approved pre and post scripts, sensible timeouts and a clean way to rerun a member.
Why users get AADSTS50053, how smart lockout counts failures, how it interacts with Active Directory lockouts under pass-through authentication, and how to find the source and unlock safely.
How PHS, pass-through authentication and AD FS federation work, what each depends on, how each fails, and a decision table for choosing and backing up your hybrid sign-in method.
Build configuration items from registry, WQL and script settings, bundle them into a baseline, deploy it with remediation and prove on the client and in reports that drift gets fixed.
Why Macs, iPhones and iPads don't update on time with Intune: legacy update policies that stopped working, DDM deadline settings, deferrals, the Apple updates reports and on-device checks.
Run a matter end to end in the unified eDiscovery experience: permissions, cases, data sources, holds, searches and statistics, review sets, exports and what changed from classic.
What the common Exchange Online PowerShell V3 errors mean (module install, execution policy, Connect-ExchangeOnline, legacy remote PowerShell and cmdlet failures) and what to check first.
Fix eDiscovery search failures, partially indexed items and exports that don't match the statistics in the Microsoft Purview portal, using Microsoft's documented errors and PowerShell checks.
Look up a Windows Update failure on an Intune-managed PC: what 0x8024 agent codes, network errors and 0x800F servicing codes mean, the usual cause and the first check.
Enable the Temporary Access Pass policy, issue passes in the portal or with Graph PowerShell, and use them to register passkeys, Authenticator and Windows Hello for Business.
How to wrap an installer with the Win32 Content Prep Tool, choose silent install and uninstall commands, set install behavior, return codes, requirement and detection rules, and pilot the app.
Plan a Jamf Pro to Intune move: map profiles and scripts, reassign ADE devices, choose OS 26 migration or a wipe, handle FileVault, Activation Lock and app licenses, and fix enrollment errors.
Why Purview DLP policy tips don't appear in Outlook: client versions and licenses, unsupported conditions, group scoping, mobile settings and legacy tips, plus how to test.
Get Macs into Purview endpoint DLP with Intune or Jamf Pro, then fix what keeps them out: missing permissions, the DLP feature key, user mapping and Not updated statuses.
Required deployments past their deadline but not installing? Check what windows the client sees, run time versus window length, window types and UTC, then prove the fix.
IMAP, cutover, Google Workspace and cross-tenant (MIGR, CTM and EXCH codes) migration errors in Exchange Online, with the usual cause and the first thing to check.
A practical checklist for Exchange Server SE and 2019 cumulative updates: backups, Health Checker, AD preparation, maintenance mode, elevated setup and the checks that prove it worked.
How a remote move batch works, what Syncing, Synced and Completing really mean, the documented errors (SMTP proxy, MRS Proxy 401, skipped items) and how to finish the cutover cleanly.
Encrypted device but no recovery key in Intune? Read BitLocker events 845 and 846, fix the join state and policy, re-escrow with BackupToAAD-BitLockerKeyProtector and prove it worked.
A passive DAG copy in FailedAndSuspended won't heal itself. Read the real error, fix the disk or log problem behind it, reseed with Update-MailboxDatabaseCopy and prove the copy is healthy.
How Intune app configuration reaches iOS and Android apps through the managed devices and managed apps channels, which keys and tokens to use, and how to prove what the app received.
Set up BitLocker management in Configuration Manager: recovery service, policy, portals and a clean move off stand-alone MBAM, plus the logs that prove recovery keys are escrowed.
Intune's new Deployments experience (preview): staging Win32 and Enterprise App Catalog apps, settings catalog and endpoint security policies across rings, permissions, how rings advance, and a ring design.
Exchange services failing with event 2142? Read event 2080's columns, fix site, DNS, firewall and SACL right (event 2112) causes, and keep static domain controllers as a last resort.
Test-MigrationServerAvailability or a new hybrid migration batch fails against your on-premises endpoint? Check MRSProxy, credentials, publishing and certificates, then prove the fix.
Look up an AADSTS code from a managed device: what 53000, 50155, 135011, 50076, 7000218 and 39 more mean for Intune and Jamf admins, the usual cause and the first check.
Connect Jamf Pro to Microsoft Entra ID as a cloud identity provider and fix what breaks: admin consent, Graph permissions, attribute mappings, nested groups and LDAP migration.
What Exchange Server SE and 2019 support for TLS 1.2 and TLS 1.3, the Schannel and .NET settings Microsoft documents, and how to find partners still on TLS 1.0 before you switch it off.
Manage Zebra Android devices in Intune: dedicated enrollment, Zebra OEMConfig profiles, LifeGuard OTA firmware deployments, and what Conflict, NOTAPPLICABLE and Failed to create mean.
What each Intune Management Extension log records, how to read them with CMTrace, what to search for, how to force a check-in, and how to collect the logs remotely.
Use the Microsoft 365 Copilot and Copilot Chat DLP location to keep labeled files and emails out of answers, block sensitive prompts and web searches, and test what users see.
Deleted email, a deleted user's mailbox and a leaver's mailbox on hold each need a different recovery method. Here's how to pick the right one, run it and confirm the data is back.
A stage-by-stage plan for exam SC-401 (Information Security Administrator Associate): the current skills-measured domains, the Microsoft Learn paths to follow, Purview labs and exam-day tips.
Why Apple ADE devices don't appear in Intune or enroll without the right policy: device assignment, token sync limits and renewal, default policies, and why a reset is needed.
Put an Exchange Server DAG member into maintenance mode the supported way: drain transport, move databases, pause the cluster node, patch, then bring it back and prove it's healthy.
Prepare hybrid join and automatic MDM enrollment, run the Cloud Attach wizard against a pilot collection, then prove on the device and in the Intune admin center that it is co-managed.
HTTP 500 or Server Error in '/ecp' on Exchange? Use the error text, IIS and HttpProxy logs to find the cause: a non-elevated update, a missing config file, certificates or app pools.
Fix Jamf Connect sign-in with Microsoft Entra ID: the app registration, ROPG password checks, Conditional Access after the June 2026 change, and the AADSTS errors at the Mac login window.
Check licensing and the one-way switch, enable auto-expanding archiving org-wide or per user, make sure items actually move, and confirm extra storage was provisioned.
Which 2011 Secure Boot certificates expire and when, the Settings catalog Secure Boot settings, model-based filters for a staged rollout, and the Intune report and remediation that track progress.
Combine Jamf Pro device compliance for iPhone and iPad with Intune app protection: the partner connector, smart groups, IntuneMAMUPN keys, Conditional Access and how to verify each piece.
Let SharePoint and OneDrive process labeled and encrypted files, add PDF support, turn on co-authoring for encrypted files, set library default labels, and know what changes for users.
Why Exchange Online blocks relayed mail with 5.7.750 when sender domains aren't registered in the tenant, and how to fix the domains or the connector and verify it.
An Intune platform script reports Failed or never runs. How the Intune Management Extension executes scripts, what the three script settings change, how retries and re-runs work, and where to look.
Set up Remote Help end to end: check licensing, enable the tenant settings, grant least-privilege helper roles, deploy the Windows app, handle Conditional Access, and fix sessions that won't connect.
A Cloud PC shows Provisioning failed in the Intune admin center. How provisioning works, what the Azure network connection health checks test, the documented failure reasons, and when to retry or reprovision.
Users blocked who shouldn't be, or not blocked when they should? Check the IB mode, segments, policies and application status, then Teams and SharePoint modes.
The Intune deployment for Defender for Endpoint on Mac in the documented order: system extensions, Full Disk Access, network filter, background services, the app, the onboarding package, mdatp checks and fixes.
Find smsts.log in every phase, keep the device on the error with F8, read the log from the failure upwards and fix driver, network, content and domain join failures.
Click-to-Run install codes such as 0-1011, 30174-4 and 30183-28, activation errors 0x8004FC12 and 0x80070005, and shared computer activation messages, each with the first check.
What *.endpoint.security.microsoft.com replaces and what it doesn't, the sensor prerequisites, how to migrate onboarded devices, EDR and antivirus proxy settings, and how to prove it worked.
Why B2B guests hit AADSTS90072, AADSTS50020, cross-tenant access blocks or tenant restrictions, and how to fix the account, the invitation or the policy and prove the guest can sign in.
Every AADSTS code Microsoft lists from 65001 to 81012: consent, client credentials and grants, SAML, pass-through authentication and Seamless SSO, with cause and first check.
A phase-by-phase runbook for replacing a third-party email gateway with EOP and Defender for Office 365: inventory, pilot, MX cutover, outbound, hybrid, decommissioning and rollback.
0x87D1041C means the installer finished but the detection rule found nothing. The usual causes (bitness, install context, version drift) and how to test detection on the device.
What Extended Protection does, the TLS, NTLM and load balancer prerequisites, enabling it with Microsoft's script, and fixing the clients and hybrid features that break.
Show ServiceNow incidents in Intune's Troubleshooting pane: licenses, roles, the ServiceNow OAuth app and CORS rule, the connector, what the help desk sees and the setup errors.
Why Macs don't encrypt or don't escrow a FileVault recovery key to Intune, what the encryption report's status details mean, and how to take over user-encrypted Macs and prove the key works.
Some Windows 11 24H2 devices ship without the Sense client, so Intune's EDR policy errors and the device never reaches Defender. How to detect it at scale with Remediations and add the capability.
Free space on Exchange Server SE and 2019 safely: which IIS, diagnostic and search ETL logs you can delete, which files you must never touch, and how to schedule the cleanup.
Move public folders from Exchange Server SE or 2019 to Exchange Online with Microsoft's batch scripts: prerequisites, lock-down, cutover and the errors that stall the batch.
Set up Insider Risk Management end to end: role groups, audit and analytics, privacy and indicators, the HR connector, your first policy and the first alerts.
A stage-by-stage study plan for exam SC-200 (Security Operations Analyst Associate): the current skills-measured domains, the Microsoft Learn paths to follow, hands-on labs and exam-day tips.
Every documented Entra hybrid join and device registration code from dsregcmd /status and the event logs, by phase: discovery, authentication, join and PRT, with cause and first check.
Migration batches, moderation, OAB generation or a CU upgrade failing? Check Exchange's seven arbitration mailboxes, then re-home or recreate broken and missing ones the supported way.
Route Intune audit, operational, compliance and device logs to Log Analytics, Event Hubs or storage, then on to Microsoft Sentinel or Splunk, with sample KQL and checks.
Look up a Windows Autopilot failure: what 0x800705B4, 0x801C03EA, 0x80070774, 0x81039001, event 807, import error 808 and more mean, the usual cause and the first check.
Exchange setup says it previously failed during Install or BuildToBuildUpgrade? Find the real error, resume with the same build and media, and treat Watermark cleanup as a last resort.
Third-party VPN profile failing in Intune? Pick profile vs app configuration per platform, fix the certificate chain, decode 2016281112 Remediation Failed and Conflict, and read client-side logs.
A low-risk path off AD FS: inventory relying parties and claim rules, enable password hash sync, pilot with staged rollout, convert the domain with Graph PowerShell, then decommission.
A phased plan from Configuration Manager to Entra joined, Intune-managed Windows devices: assess, co-manage, move workloads, provision with Autopilot and retire on-premises dependencies.
Every documented application proxy browser message, private network connector install and registration error, and KCD event (12008, 13016-13022), with cause and first check.
Event ID 1135 or 1177 on DAG members, databases dismounting or witness errors from Set-DatabaseAvailabilityGroup? See how DAG quorum works and fix the cluster, witness and network.
Deploy a Configuration Manager cloud management gateway on an Azure scale set, connect it to your site, bring internet clients onto it, and read the right logs when clients can't connect.
An email arrived an hour late? Read the Received headers bottom-up, convert every timestamp to UTC, find the slow hop and confirm it with Exchange message tracking.
Eight short KQL queries for the Defender portal using documented tables: OS builds, sensor health, app versions, CVE exposure, antivirus posture, who ran a tool, ASR audit hits and network destinations.
Follow content from the site server to a distribution point through distmgr.log, PkgXferMgr.log and smsdpprov.log, and know when to update, redistribute or validate.
Test-IRMConfiguration fails, the RMS template list is empty or mail goes out unencrypted? Check Azure Rights Management, the IRM configuration and your rules, then prove it works.
Deploy Defender for Endpoint on iOS and Android with Intune, use it as the threat source for compliance, fix sign-in, license and VPN problems, and verify each device.
Fix Exchange /PrepareSchema and /PrepareAD failures: missing Schema Admins or Enterprise Admins rights, wrong site or domain, unfinished replication and stale AD entries. Then verify AD versions.
Configure the Microsoft Enterprise SSO plug-in and Platform SSO from Jamf Pro: payload values, Company Portal first, Device Compliance registration, verification and the errors to expect.
Run the Defender for Endpoint client analyzer locally or through live response, read the HTML report and URL tests, fix proxy, TLS and sensor findings, and know what to send to support.
A phased plan for attack surface reduction rules in Intune: standard rules straight to Block, the rest in Audit, measured with advanced hunting, narrow exclusions, then enforce.
How Purview role groups relate to Microsoft Entra roles, which role group each job needs, and how to fix missing pages, read-only screens and content explorer errors.
Read UEFICA2023Status, the AvailableUpdates bitmask and TPM-WMI events 1795 to 1808 to see where a Secure Boot certificate update is stuck, interpret the Intune report, and clear the common blockers.
What tamper protection locks, the four places it can be managed and their precedence, how to see which one controls a device, and how to fix settings that won't apply or exclusions that aren't protected.
Trace a failed Configuration Manager client install from client push to site assignment: ccm.log, ccmsetup.log, client.msi.log, return codes, MP lookup and boundaries.
Set up SAML single sign-on from Microsoft Entra ID to Jamf Pro and Self Service, keep a working failover login, and fix the AADSTS50105, AADSTS50011 and AADSTS700016 sign-in errors.
Set up Intune Remediations end to end: licensing and tenant attestation, the exit-code contract, run context, schedules, on-demand runs and reading the results.
Look up a Windows enrollment or Entra join failure: what 0x80180018, 0x8018002b, 0x801c03f2 and dozens more codes mean, the usual cause in an Intune tenant and the first check.
Antimalware Service Executable eating CPU? Tell scans from real-time scanning, record with the performance analyzer, then fix it with the narrowest exclusion or a scan-setting change.
Licensing, prerequisites and registration for the Connect Health agents, sending alerts to people who act on them, and a playbook for the sync alerts you'll see most.
Exchange 2016 and 2019 left support on 14 October 2025 and paid ESUs end with October 2026. The real risks, a decision table and the order of work to move to SE or Exchange Online.
Send Exchange Server journal reports to a hosted archive: standard vs premium journaling, a hidden contact, a dedicated TLS send connector, JournalingReportNdrTo and proof of delivery.
What Teams users see when Purview DLP blocks or flags a message, how the Teams location really works with guests, external chats and shared channels, and why tips don't fire.
How automated investigation and response decides what to remediate, how device groups and automation levels control it, and how to approve, reject or undo an action in the Action center.
Build IP and country named locations for Conditional Access, mark trusted networks, migrate legacy MFA trusted IPs, handle IPv6, VPNs and proxies, and check matches in the sign-in logs.
Why Microsoft Entra ID keeps prompting users: sign-in frequency, persistent browser sessions, Stay signed in, Remember MFA and token lifetimes, plus how to find the cause and fix it.
Network Prevent for Email behind Exchange Server: why reflecting mode loops with 5.4.6, how to set forwarding mode, ports and relay, and what the queues show when it's down.
Autopatch groups and quality update policies, per-update-type approvals, deferrals and pausing for Windows and .NET Framework updates, quick machine recovery approvals, the reports and migration tips.
What mandatory MFA enforcement covers, the failures it causes for user-based automation and admin sign-ins, how to verify who is ready, moving scripts to workload identities, and MFA-capable break-glass accounts.
Keep your software update point healthy: enable the WSUS maintenance options, set supersedence rules, back up and reindex SUSDB on a schedule, and confirm it all in wsyncmgr.log.
Follow a Configuration Manager update from scan to install: WSUS location, WUAHandler.log scan errors, Group Policy conflicts, content download and maintenance windows.
Build an Entra Connect staging server from an exported configuration, prove what it would export with csexport, and switch the active server without surprises.
Try a different keyword, or .
Tell me what you're troubleshooting or which feature you'd like a guide for, and it may become the next article.
