https://www.oeltayeb.com/ Practical troubleshooting guides and how-tos for Microsoft Intune, Entra ID, Defender and Exchange Online. en https://www.oeltayeb.com/articles/enrollment-status-page-timeout-troubleshooting.html https://www.oeltayeb.com/articles/enrollment-status-page-timeout-troubleshooting.html Microsoft Intune Find the app or policy holding up the Enrollment Status Page, collect the right logs from OOBE, and fix the profile settings behind most Autopilot ESP timeouts. https://www.oeltayeb.com/articles/win32-app-0x87d1041c-not-detected.html https://www.oeltayeb.com/articles/win32-app-0x87d1041c-not-detected.html Microsoft Intune 0x87D1041C means the installer finished but the detection rule found nothing. The usual causes (bitness, install context, version drift) and how to test detection on the device. https://www.oeltayeb.com/articles/autopilot-error-0x80180014-reenrollment.html https://www.oeltayeb.com/articles/autopilot-error-0x80180014-reenrollment.html Microsoft Intune A reused Autopilot device fails MDM enrollment with 0x80180014. Why it happens, and the documented fixes: unblock or remove the stale Intune record and check enrollment restrictions. https://www.oeltayeb.com/articles/intune-management-extension-logs-guide.html https://www.oeltayeb.com/articles/intune-management-extension-logs-guide.html Microsoft Intune What each Intune Management Extension log records, how to read them with CMTrace, what to search for, how to force a check-in, and how to collect the logs remotely. https://www.oeltayeb.com/articles/default-device-compliance-policy-noncompliant.html https://www.oeltayeb.com/articles/default-device-compliance-policy-noncompliant.html Microsoft Intune Why devices fail the built-in Is active, Enrolled user exists and Has a compliance policy assigned checks in Intune, and how to clear each one before Conditional Access blocks users. https://www.oeltayeb.com/articles/bitlocker-silent-encryption-not-starting.html https://www.oeltayeb.com/articles/bitlocker-silent-encryption-not-starting.html Microsoft Intune Silent BitLocker not starting? Check TPM, UEFI, Secure Boot and WinRE, the required policy settings, startup authentication conflicts and recovery key backup to Microsoft Entra ID. https://www.oeltayeb.com/articles/windows-laps-intune-entra-backup.html https://www.oeltayeb.com/articles/windows-laps-intune-entra-backup.html Microsoft Intune Set up Windows LAPS end to end: enable it in Microsoft Entra ID, build the Intune account protection profile, retrieve and rotate passwords, and check the LAPS event log. https://www.oeltayeb.com/articles/intune-remediations-fix-issues-at-scale.html https://www.oeltayeb.com/articles/intune-remediations-fix-issues-at-scale.html Microsoft Intune Set up Intune Remediations end to end: licensing and tenant attestation, the exit-code contract, run context, schedules, on-demand runs and reading the results. https://www.oeltayeb.com/articles/intune-policy-conflicts-mdm-diagnostics.html https://www.oeltayeb.com/articles/intune-policy-conflicts-mdm-diagnostics.html Microsoft Intune Settings stuck on Conflict in Intune? Find the competing policies, confirm what the device received with the MDM diagnostic report and event log, and rule out Group Policy. https://www.oeltayeb.com/articles/windows-11-feature-update-not-offered-intune.html https://www.oeltayeb.com/articles/windows-11-feature-update-not-offered-intune.html Microsoft Intune Feature update policy assigned but nothing offered? Check licensing, join type, telemetry, update ring deferrals, WSUS and Group Policy, hardware readiness and safeguard holds. https://www.oeltayeb.com/articles/app-protection-policy-not-applying-outlook-mobile.html https://www.oeltayeb.com/articles/app-protection-policy-not-applying-outlook-mobile.html Microsoft Intune Outlook on iOS or Android ignoring your Intune app protection policy? Check targeting, licensing, the signed-in account, broker apps, check-in timing, reports and Edge diagnostics. https://www.oeltayeb.com/articles/apple-ade-devices-not-syncing-intune.html https://www.oeltayeb.com/articles/apple-ade-devices-not-syncing-intune.html Microsoft Intune Why Apple ADE devices don't appear in Intune or enroll without the right policy: device assignment, token sync limits and renewal, default policies, and why a reset is needed. https://www.oeltayeb.com/articles/android-work-profile-enrollment-failures.html https://www.oeltayeb.com/articles/android-work-profile-enrollment-failures.html Microsoft Intune A practical checklist for failed Android personally owned work profile enrollments: Managed Google Play, restrictions, licences, device requirements, existing profiles and logs. https://www.oeltayeb.com/articles/co-management-workloads-switch-to-intune.html https://www.oeltayeb.com/articles/co-management-workloads-switch-to-intune.html Microsoft Intune A staged way to switch co-management workloads to Intune: what each slider really controls, pilot collections, the client logs to watch, rollback caveats and a sensible order. https://www.oeltayeb.com/articles/export-intune-device-inventory-graph-powershell.html https://www.oeltayeb.com/articles/export-intune-device-inventory-graph-powershell.html Microsoft Intune Export your Intune device inventory to CSV with the Microsoft Graph PowerShell SDK, spot stale and noncompliant devices, and run it unattended with certificate-based app-only sign-in. https://www.oeltayeb.com/articles/intune-device-cleanup-rules.html https://www.oeltayeb.com/articles/intune-device-cleanup-rules.html Microsoft Intune How Intune device cleanup rules work per platform, what they hide and what they leave behind, and how to pair them with a safe Entra ID stale-device routine that spares Autopilot. https://www.oeltayeb.com/articles/windows-enrollment-error-0x80180018-not-authorized.html https://www.oeltayeb.com/articles/windows-enrollment-error-0x80180018-not-authorized.html Microsoft Intune Windows MDM enrollment fails with 0x80180018 or a nearby 0x8018 code. What Microsoft documents for each code, which tenant setting is behind it, and how to confirm the fix in the enrollment event log. https://www.oeltayeb.com/articles/intune-device-not-checking-in-sync-troubleshooting.html https://www.oeltayeb.com/articles/intune-device-not-checking-in-sync-troubleshooting.html Microsoft Intune A Windows device shows a stale last check-in in Intune and policies stop arriving. How check-in works, what to inspect on the device (service, tasks, certificate, network) and when to re-enroll. https://www.oeltayeb.com/articles/intune-powershell-scripts-not-running.html https://www.oeltayeb.com/articles/intune-powershell-scripts-not-running.html Microsoft Intune An Intune platform script reports Failed or never runs. How the Intune Management Extension executes scripts, what the three script settings change, how retries and re-runs work, and where to look. https://www.oeltayeb.com/articles/ios-apps-not-installing-vpp-tokens-intune.html https://www.oeltayeb.com/articles/ios-apps-not-installing-vpp-tokens-intune.html Microsoft Intune Apple Business Manager apps assigned in Intune stay pending or fail on iPhones and iPads. How location (VPP) tokens and licences work, what the 0x87D13B error codes mean, and what to check in order. https://www.oeltayeb.com/articles/package-win32-app-intunewin-content-prep-tool.html https://www.oeltayeb.com/articles/package-win32-app-intunewin-content-prep-tool.html Microsoft Intune How to wrap an installer with the Win32 Content Prep Tool, choose silent install and uninstall commands, set install behaviour, return codes, requirement and detection rules, and pilot the app. https://www.oeltayeb.com/articles/windows-autopilot-setup-hardware-hash-deployment-profile.html https://www.oeltayeb.com/articles/windows-autopilot-setup-hardware-hash-deployment-profile.html Microsoft Intune Set up Windows Autopilot end to end: tenant prerequisites, collecting and importing hardware hashes, group tags and dynamic groups, a user-driven Entra join profile, an Enrollment Status Page and the first test device. https://www.oeltayeb.com/articles/windows-update-rings-expedite-intune.html https://www.oeltayeb.com/articles/windows-update-rings-expedite-intune.html Microsoft Intune Prerequisites, the update ring settings and their ranges, a pilot/broad ring design, expedite and driver update policies, the Intune and Windows Update for Business reports, and how to check a device locally. https://www.oeltayeb.com/articles/settings-catalog-vs-templates-vs-baselines.html https://www.oeltayeb.com/articles/settings-catalog-vs-templates-vs-baselines.html Microsoft Intune What each Intune policy type is for, how conflicts between them are resolved and reported, a recommended layering for a new tenant, and naming and assignment hygiene with filters. https://www.oeltayeb.com/articles/training-path-md-102-intune-endpoint-administrator.html https://www.oeltayeb.com/articles/training-path-md-102-intune-endpoint-administrator.html Microsoft Intune A five-stage plan for Exam MD-102 and the Endpoint Administrator Associate certification: the current skills-measured domains, the Microsoft Learn paths to follow, lab exercises and exam-day tips. https://www.oeltayeb.com/articles/intune-noncompliant-machine-risk-score-defender-for-endpoint.html https://www.oeltayeb.com/articles/intune-noncompliant-machine-risk-score-defender-for-endpoint.html Microsoft Intune Why a Windows device fails "Require the device to be at or under the machine risk score", and how to check the connector, onboarding, device identity and active alerts in the right order. https://www.oeltayeb.com/articles/windows-11-24h2-defender-for-endpoint-sense-client-missing-intune.html https://www.oeltayeb.com/articles/windows-11-24h2-defender-for-endpoint-sense-client-missing-intune.html Microsoft Intune Some Windows 11 24H2 devices ship without the Sense client, so Intune's EDR policy errors and the device never reaches Defender. How to detect it at scale with Remediations and add the capability. https://www.oeltayeb.com/articles/intune-health-attestation-azure-attestation-migration-compliance.html https://www.oeltayeb.com/articles/intune-health-attestation-azure-attestation-migration-compliance.html Microsoft Intune Intune will evaluate BitLocker, Secure Boot and code integrity compliance through Microsoft Azure Attestation. Which endpoints to allow, how to test from a device, and how to find affected policies. https://www.oeltayeb.com/articles/machine-identity-isolation-domain-trust-sign-in-failures-september-2026.html https://www.oeltayeb.com/articles/machine-identity-isolation-domain-trust-sign-in-failures-september-2026.html Microsoft Intune After the September 2026 Windows 11 updates some domain-joined devices lose their secure channel because Machine Identity Isolation is now honoured. How to find the policy, roll it back and verify. https://www.oeltayeb.com/articles/autopilot-hybrid-join-timeout-0x80004005-2026.html https://www.oeltayeb.com/articles/autopilot-hybrid-join-timeout-0x80004005-2026.html Microsoft Intune Microsoft Entra hybrid join Autopilot deployments can time out with 0x80004005 on older Windows 11 builds. How to confirm the known issue, which KBs fix it and how to get devices onto a fixed build. https://www.oeltayeb.com/articles/autopilot-pre-provisioning-hybrid-join-policy-conflict-domain-controller.html https://www.oeltayeb.com/articles/autopilot-pre-provisioning-hybrid-join-policy-conflict-domain-controller.html Microsoft Intune Autopilot pre-provisioning for hybrid join fails in the technician flow when a policy such as a User Rights setting needs a domain controller. How to read the 0x800706FD event and fix the scoping. https://www.oeltayeb.com/articles/intune-connector-active-directory-gmsa-selogonasservice-error.html https://www.oeltayeb.com/articles/intune-connector-active-directory-gmsa-selogonasservice-error.html Microsoft Intune Configuring the Intune Connector for AD with your own gMSA can fail on the SeLogonAsServicePrivilege pre-check. The June 2026 known issue, the SkipByoMsaPrivilegeCheck fix and how to verify it. https://www.oeltayeb.com/articles/windows-autopilot-known-issues-2026-roundup.html https://www.oeltayeb.com/articles/windows-autopilot-known-issues-2026-roundup.html Microsoft Intune A walkthrough of the Windows Autopilot known issues page as of October 2026: open and fixed items, deeper guidance on the January 2026 entries, and how to subscribe so new issues reach you first. https://www.oeltayeb.com/articles/windows-autopilot-device-preparation-known-issues-troubleshooting.html https://www.oeltayeb.com/articles/windows-autopilot-device-preparation-known-issues-troubleshooting.html Microsoft Intune What trips admins up in Autopilot device preparation, the known issues and their status as of October 2026, how to read the deployment status report, and the documented steps for a failed deployment. https://www.oeltayeb.com/articles/secure-boot-certificate-expiration-intune-rollout.html https://www.oeltayeb.com/articles/secure-boot-certificate-expiration-intune-rollout.html Microsoft Intune Which 2011 Secure Boot certificates expire and when, the Settings catalog Secure Boot settings, model-based filters for a staged rollout, and the Intune report and remediation that track progress. https://www.oeltayeb.com/articles/secure-boot-certificate-update-not-applying-troubleshooting.html https://www.oeltayeb.com/articles/secure-boot-certificate-update-not-applying-troubleshooting.html Microsoft Intune Read UEFICA2023Status, the AvailableUpdates bitmask and TPM-WMI events 1795 to 1808 to see where a Secure Boot certificate update is stuck, interpret the Intune report, and clear the common blockers. https://www.oeltayeb.com/articles/windows-11-26h2-rollout-with-intune-feature-update-policy.html https://www.oeltayeb.com/articles/windows-11-26h2-rollout-with-intune-feature-update-policy.html Microsoft Intune How 26H2 installs as an enablement package, the Intune feature update policy and rollout options to deploy it, the known issues listed at launch, how safeguard holds show up, and how to verify a device. https://www.oeltayeb.com/articles/intune-known-issues-company-portal-apps-remediation-message-2026.html https://www.oeltayeb.com/articles/intune-known-issues-company-portal-apps-remediation-message-2026.html Microsoft Intune Five items Microsoft currently lists as Active on the Intune known issues page, what each looks like, what to tell users, how to work around it, and how to track the page and escalate properly. https://www.oeltayeb.com/articles/macos-devices-unenrolled-mdm-certificate-renewal-intune.html https://www.oeltayeb.com/articles/macos-devices-unenrolled-mdm-certificate-renewal-intune.html Microsoft Intune Why some Macs dropped out of Intune during MDM identity certificate renewal, Apple's fix in macOS 26.4, how to find and re-enroll affected devices, and how this differs from an expired Apple MDM push certificate. https://www.oeltayeb.com/articles/when-intune-is-the-problem-service-health-known-issues-checklist.html https://www.oeltayeb.com/articles/when-intune-is-the-problem-service-health-known-issues-checklist.html Microsoft Intune A 10-minute checklist to rule out a service incident, a documented known issue or a gradual service release before you troubleshoot your tenant, plus what to collect for a support case and how to subscribe. https://www.oeltayeb.com/articles/intune-phased-deployments-preview-rings.html https://www.oeltayeb.com/articles/intune-phased-deployments-preview-rings.html Microsoft Intune Intune's new Deployments experience (preview): staging Win32 and Enterprise App Catalog apps, settings catalog and endpoint security policies across rings, permissions, how rings advance, and a ring design. https://www.oeltayeb.com/articles/windows-autopilot-device-association-tpm-tenant-affinity.html https://www.oeltayeb.com/articles/windows-autopilot-device-association-tpm-tenant-affinity.html Microsoft Intune What device association writes to UEFI, the Windows 11 and TPM 2.0 requirements, exporting the DeviceLink CSV and pre-associating in Intune, lifecycle and removal, and how it coexists with classic Autopilot. https://www.oeltayeb.com/articles/windows-autopatch-approvals-pausing-recovery-updates-intune.html https://www.oeltayeb.com/articles/windows-autopatch-approvals-pausing-recovery-updates-intune.html Microsoft Intune Autopatch groups and quality update policies, the per-update-type automatic or manual approvals, deferrals and pausing rolling out in autumn 2026, quick machine recovery approvals, the reports, and migration tips. https://www.oeltayeb.com/articles/intune-enterprise-app-catalog-deploy-update-apps.html https://www.oeltayeb.com/articles/intune-enterprise-app-catalog-deploy-update-apps.html Microsoft Intune Add a prepackaged Win32 app from the Enterprise App Catalog, understand the prefilled install and detection settings, choose between auto-update and guided supersedence, and troubleshoot failed installs. https://www.oeltayeb.com/articles/microsoft-cloud-pki-intune-certificates-wifi-vpn.html https://www.oeltayeb.com/articles/microsoft-cloud-pki-intune-certificates-wifi-vpn.html Microsoft Intune Build a two-tier Microsoft Cloud PKI hierarchy in Intune, deploy the trusted certificate and SCEP profiles, bind the certificate to Wi-Fi or VPN profiles, monitor and revoke, and fix the common SCEP errors. https://www.oeltayeb.com/articles/intune-endpoint-privilege-management-elevation-rules.html https://www.oeltayeb.com/articles/intune-endpoint-privilege-management-elevation-rules.html Microsoft Intune Deploy Intune Endpoint Privilege Management: the elevation settings policy, elevation rules by hash or certificate, the user experience, the elevation reports, and how to troubleshoot rules that don't match. https://www.oeltayeb.com/articles/remote-help-intune-setup-troubleshooting.html https://www.oeltayeb.com/articles/remote-help-intune-setup-troubleshooting.html Microsoft Intune Set up Remote Help end to end: check licensing, enable the tenant settings, grant least-privilege helper roles, deploy the Windows app, handle Conditional Access, and fix sessions that won't connect. https://www.oeltayeb.com/articles/intune-custom-compliance-policy-json-script.html https://www.oeltayeb.com/articles/intune-custom-compliance-policy-json-script.html Microsoft Intune Extend Intune compliance with your own checks: write a discovery script that returns compressed JSON, define rules in the JSON schema, upload both, and troubleshoot error codes 65007 to 65010. https://www.oeltayeb.com/articles/intune-rbac-scope-tags-delegated-administration.html https://www.oeltayeb.com/articles/intune-rbac-scope-tags-delegated-administration.html Microsoft Intune How Intune roles, role assignments and scope tags fit together, three delegation designs that work, the pitfalls that leak visibility, and how to audit and test what an admin can really do. https://www.oeltayeb.com/articles/windows-365-cloud-pc-provisioning-failed-troubleshooting.html https://www.oeltayeb.com/articles/windows-365-cloud-pc-provisioning-failed-troubleshooting.html Microsoft Intune A Cloud PC shows Provisioning failed in the Intune admin center. How provisioning works, what the Azure network connection health checks test, the documented failure reasons, and when to retry or reprovision. https://www.oeltayeb.com/articles/windows-kiosk-shared-pc-intune-configuration.html https://www.oeltayeb.com/articles/windows-kiosk-shared-pc-intune-configuration.html Microsoft Intune Configure single-app and multi-app kiosks with the Intune Kiosk template or Assigned Access XML, set up Shared PC mode, pair with Autopilot self-deploying mode, and fix kiosks that won't launch. https://www.oeltayeb.com/articles/company-portal-sync-errors-device-not-enrolled-troubleshooting.html https://www.oeltayeb.com/articles/company-portal-sync-errors-device-not-enrolled-troubleshooting.html Microsoft Intune What the Company Portal Sync button really does, why the app says a device isn't set up or belongs to another user, how the primary user drives it, and where the logs are. https://www.oeltayeb.com/articles/intune-wifi-vpn-profile-not-applying-scep-pkcs-certificates.html https://www.oeltayeb.com/articles/intune-wifi-vpn-profile-not-applying-scep-pkcs-certificates.html Microsoft Intune Trace a stuck Wi-Fi or VPN profile back through the certificate chain: trusted root, SCEP/PKCS profile, Certificate Connector and NDES, using the logs and event IDs Microsoft documents. https://www.oeltayeb.com/articles/onedrive-known-folder-move-intune-deployment-troubleshooting.html https://www.oeltayeb.com/articles/onedrive-known-folder-move-intune-deployment-troubleshooting.html Microsoft Intune Deploy OneDrive Known Folder Move through the Intune settings catalog, roll it out at a safe pace, read the sync health dashboard, and fix the documented reasons a folder refuses to move. https://www.oeltayeb.com/articles/android-enterprise-dedicated-devices-managed-home-screen.html https://www.oeltayeb.com/articles/android-enterprise-dedicated-devices-managed-home-screen.html Microsoft Intune Build a locked-down Android kiosk with Intune: dedicated device enrollment tokens, multi-app kiosk mode with Managed Home Screen, Entra shared device mode sign-in, and fixes for missing apps. https://www.oeltayeb.com/articles/aadsts53000-aadsts53003-conditional-access-blocks.html https://www.oeltayeb.com/articles/aadsts53000-aadsts53003-conditional-access-blocks.html Microsoft Entra ID What AADSTS53000, 53001 and 53003 actually mean, how to find the blocking policy in the sign-in logs, and how to fix compliance and browser device-identity gaps. https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html Microsoft Entra ID Read dsregcmd /status for hybrid join failures, check the SCP and Entra Connect sync, use the User Device Registration log and clear devices stuck in Pending. https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html Microsoft Entra ID How the Primary Refresh Token powers single sign-on on Windows, how to check it with dsregcmd and the AAD event logs, and how to fix a missing or stale PRT. https://www.oeltayeb.com/articles/conditional-access-what-if-report-only.html https://www.oeltayeb.com/articles/conditional-access-what-if-report-only.html Microsoft Entra ID Use report-only mode, the sign-in logs, the insights workbook and the What If tool to prove a Conditional Access policy behaves as expected before you turn it on. https://www.oeltayeb.com/articles/temporary-access-pass-passwordless-onboarding.html https://www.oeltayeb.com/articles/temporary-access-pass-passwordless-onboarding.html Microsoft Entra ID Enable the Temporary Access Pass policy, issue passes in the portal or with Graph PowerShell, and use them to register passkeys, Authenticator and Windows Hello for Business. https://www.oeltayeb.com/articles/dynamic-device-groups-intune-rules.html https://www.oeltayeb.com/articles/dynamic-device-groups-intune-rules.html Microsoft Entra ID Working dynamic device rules for Autopilot, group tags, OS version, ownership and enrollment profiles, plus licensing, processing time, rule validation and when filters fit better. https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html Microsoft Entra ID What the MFA-related AADSTS codes mean, how to read the Authentication details and Conditional Access tabs of a sign-in, and how to fix legacy clients, unregistered users and authentication strength mismatches. https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html Microsoft Entra ID How to read Entra Connect export errors such as AttributeValueMustBeUnique, InvalidSoftMatch and LargeObject, fix matching problems with ms-DS-ConsistencyGuid, and find objects that filtering keeps out of Entra ID. https://www.oeltayeb.com/articles/conditional-access-baseline-policies-every-tenant.html https://www.oeltayeb.com/articles/conditional-access-baseline-policies-every-tenant.html Microsoft Entra ID The core Conditional Access policies to deploy first, how they map to Microsoft's templates and Microsoft-managed policies, and how to roll them out in report-only mode without locking anyone out. https://www.oeltayeb.com/articles/windows-hello-for-business-cloud-kerberos-trust-intune.html https://www.oeltayeb.com/articles/windows-hello-for-business-cloud-kerberos-trust-intune.html Microsoft Entra ID Why cloud Kerberos trust is the recommended Windows Hello for Business model for hybrid tenants, how to create the Entra Kerberos server object, configure the Intune policy, and verify with dsregcmd and klist. https://www.oeltayeb.com/articles/training-path-sc-300-identity-access-administrator.html https://www.oeltayeb.com/articles/training-path-sc-300-identity-access-administrator.html Microsoft Entra ID A six-stage study plan for exam SC-300, mapped to the official Microsoft Learn learning paths, with hands-on labs for Conditional Access, authentication methods, PIM, access reviews, apps and Entra Connect. https://www.oeltayeb.com/articles/conditional-access-oidc-scope-enforcement-change-2026.html https://www.oeltayeb.com/articles/conditional-access-oidc-scope-enforcement-change-2026.html Microsoft Entra ID Sign-ins requesting only openid, profile, email or User.Read are now subject to All resources policies with exclusions: who is affected, how to find the apps in sign-in logs, how to fix them, and the timeline. https://www.oeltayeb.com/articles/mandatory-mfa-admin-portals-automation-service-accounts.html https://www.oeltayeb.com/articles/mandatory-mfa-admin-portals-automation-service-accounts.html Microsoft Entra ID What mandatory MFA enforcement covers, the failures it causes for user-based automation and admin sign-ins, how to verify who is ready, moving scripts to workload identities, and MFA-capable break-glass accounts. https://www.oeltayeb.com/articles/entra-device-registration-dual-state-pending-devices-troubleshooting.html https://www.oeltayeb.com/articles/entra-device-registration-dual-state-pending-devices-troubleshooting.html Microsoft Entra ID Why a hybrid joined PC also shows as Entra registered, what Pending really means, and how to clean up duplicates with dsregcmd, BlockAADWorkplaceJoin and Graph PowerShell. https://www.oeltayeb.com/articles/passkeys-microsoft-authenticator-rollout-troubleshooting.html https://www.oeltayeb.com/articles/passkeys-microsoft-authenticator-rollout-troubleshooting.html Microsoft Entra ID Configure the Passkey (FIDO2) policy and a passkey profile for Authenticator, pick the right registration flow, roll out in rings and fix the registration and sign-in failures users report. https://www.oeltayeb.com/articles/entra-privileged-identity-management-just-in-time-roles.html https://www.oeltayeb.com/articles/entra-privileged-identity-management-just-in-time-roles.html Microsoft Entra ID Set up PIM for Microsoft Entra roles: role settings, eligible assignments, activation and approvals, PIM for Groups, alerts, access reviews, and the activation problems you'll hit. https://www.oeltayeb.com/articles/entra-access-reviews-entitlement-management-basics.html https://www.oeltayeb.com/articles/entra-access-reviews-entitlement-management-basics.html Microsoft Entra ID How access reviews and entitlement management fit together in Microsoft Entra ID Governance: licensing, creating reviews, catalogs and access packages, and a starter plan you can run this quarter. https://www.oeltayeb.com/articles/entra-id-protection-risk-policies-false-positives.html https://www.oeltayeb.com/articles/entra-id-protection-risk-policies-false-positives.html Microsoft Entra ID User risk vs sign-in risk, the detections behind them, risk-based Conditional Access that lets users fix their own risk, and how to investigate, dismiss or confirm the false positives. https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html Microsoft Entra ID SSPR prerequisites, password writeback through Connect Sync or Cloud Sync, the documented SSPR_00xx portal errors, the Windows sign-in screen Reset password link, and the event IDs behind writeback failures. https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html Microsoft Entra ID The four sign-in log types, the fields that matter, how to trace one failed sign-in end to end, KQL against the SigninLogs table, export and retention by licence, and the misreads that waste hours. https://www.oeltayeb.com/articles/entra-cloud-sync-vs-connect-sync-choosing-migrating.html https://www.oeltayeb.com/articles/entra-cloud-sync-vs-connect-sync-choosing-migrating.html Microsoft Entra ID Architecture differences, the Learn feature comparison, when each sync tool fits, and the documented pilot-OU migration from Connect Sync to Cloud Sync with cloudNoFlow and JoinNoFlow rules. https://www.oeltayeb.com/articles/onboard-defender-for-endpoint-with-intune.html https://www.oeltayeb.com/articles/onboard-defender-for-endpoint-with-intune.html Microsoft Defender Connect Intune to Microsoft Defender for Endpoint, onboard Windows devices with an EDR policy, then prove it worked on the device, in the Defender portal and with a detection test. https://www.oeltayeb.com/articles/attack-surface-reduction-rules-audit-mode.html https://www.oeltayeb.com/articles/attack-surface-reduction-rules-audit-mode.html Microsoft Defender A phased plan for attack surface reduction rules in Intune: standard rules straight to Block, the rest in Audit, measured with advanced hunting, narrow exclusions, then enforce. https://www.oeltayeb.com/articles/defender-antivirus-policy-not-applying.html https://www.oeltayeb.com/articles/defender-antivirus-policy-not-applying.html Microsoft Defender Intune says the antivirus policy succeeded but the device disagrees. Check the management channel, conflicts, passive mode, tamper protection and exclusion behaviour to find out why. https://www.oeltayeb.com/articles/defender-device-inactive-no-sensor-data.html https://www.oeltayeb.com/articles/defender-device-inactive-no-sensor-data.html Microsoft Defender What Inactive, Impaired communications and No sensor data mean in the Defender device inventory, and how to check the sensor, onboarding state, proxy and duplicate device records. https://www.oeltayeb.com/articles/release-quarantined-email-defender-office-365.html https://www.oeltayeb.com/articles/release-quarantined-email-defender-office-365.html Microsoft Defender Find the message, read why it was quarantined, release it, and report it through Submissions so a scoped, expiring allow entry replaces risky mail flow rule bypasses. https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html Microsoft Defender A field guide to Defender for Endpoint onboarding failures: onboarding script error codes, SENSE Operational event IDs, Intune error codes, and the registry and service checks that show where it broke. https://www.oeltayeb.com/articles/defender-security-settings-management-non-intune-devices.html https://www.oeltayeb.com/articles/defender-security-settings-management-non-intune-devices.html Microsoft Defender How Defender for Endpoint security settings management pushes Intune endpoint security policies to devices not enrolled in Intune: prerequisites, enforcement scope, synthetic registration and pitfalls. https://www.oeltayeb.com/articles/advanced-hunting-kql-queries-for-intune-admins.html https://www.oeltayeb.com/articles/advanced-hunting-kql-queries-for-intune-admins.html Microsoft Defender Eight short KQL queries for the Defender portal using documented tables: OS builds, sensor health, app versions, CVE exposure, antivirus posture, who ran a tool, ASR audit hits and network destinations. https://www.oeltayeb.com/articles/preset-security-policies-standard-strict-defender-office-365.html https://www.oeltayeb.com/articles/preset-security-policies-standard-strict-defender-office-365.html Microsoft Defender What Built-in protection, Standard and Strict presets enforce, how they outrank custom threat policies, what you still have to configure for impersonation protection, and how to verify which policy handled a message. https://www.oeltayeb.com/articles/training-path-sc-200-security-operations-analyst.html https://www.oeltayeb.com/articles/training-path-sc-200-security-operations-analyst.html Microsoft Defender A stage-by-stage study plan for exam SC-200 (Security Operations Analyst Associate): the current skills-measured domains, the Microsoft Learn paths to follow, hands-on labs and exam-day tips. https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html Microsoft Defender A device is onboarded to Defender but never shows up as MDE-managed in Intune. Read HKLM\SOFTWARE\Microsoft\SenseCM\EnrollmentStatus, map the code to its cause and fix it. https://www.oeltayeb.com/articles/defender-for-endpoint-streamlined-connectivity-migration-proxy.html https://www.oeltayeb.com/articles/defender-for-endpoint-streamlined-connectivity-migration-proxy.html Microsoft Defender What *.endpoint.security.microsoft.com replaces and what it doesn't, the sensor prerequisites, how to migrate onboarded devices, EDR and antivirus proxy settings, and how to prove it worked. https://www.oeltayeb.com/articles/defender-antivirus-platform-engine-updates-gradual-rollout-rollback.html https://www.oeltayeb.com/articles/defender-antivirus-platform-engine-updates-gradual-rollout-rollback.html Microsoft Defender What the monthly KB4052623 platform and engine updates are, how to assign Intune update channels in rings, how to read versions with Get-MpComputerStatus, and how to roll back with MpCmdRun. https://www.oeltayeb.com/articles/defender-xdr-automated-investigation-remediation-levels-device-groups.html https://www.oeltayeb.com/articles/defender-xdr-automated-investigation-remediation-levels-device-groups.html Microsoft Defender How automated investigation and response decides what to remediate, how device groups and automation levels control it, and how to approve, reject or undo an action in the Action center. https://www.oeltayeb.com/articles/defender-vulnerability-management-remediate-with-intune.html https://www.oeltayeb.com/articles/defender-vulnerability-management-remediate-with-intune.html Microsoft Defender How exposure score, recommendations, software inventory and weaknesses fit together, and how a Request remediation in the Defender portal becomes a security task an Intune admin can close. https://www.oeltayeb.com/articles/defender-device-control-usb-removable-storage-intune.html https://www.oeltayeb.com/articles/defender-device-control-usb-removable-storage-intune.html Microsoft Defender Device control concepts (groups, rules, entries, access masks), the Intune Device Control profile with reusable settings, audit before block, printers, hunting queries and fixes when a USB stick stays writable. https://www.oeltayeb.com/articles/defender-tamper-protection-troubleshooting-intune.html https://www.oeltayeb.com/articles/defender-tamper-protection-troubleshooting-intune.html Microsoft Defender What tamper protection locks, the four places it can be managed and their precedence, how to see which one controls a device, and how to fix settings that won't apply or exclusions that aren't protected. https://www.oeltayeb.com/articles/safe-links-safe-attachments-blocked-link-troubleshooting.html https://www.oeltayeb.com/articles/safe-links-safe-attachments-blocked-link-troubleshooting.html Microsoft Defender How Safe Links rewriting and time-of-click checks work, what the Safe Attachments actions do, how to find out why a click was blocked, and how to allow a legitimate URL without weakening protection. https://www.oeltayeb.com/articles/defender-for-endpoint-macos-onboarding-intune.html https://www.oeltayeb.com/articles/defender-for-endpoint-macos-onboarding-intune.html Microsoft Defender The Intune deployment for Defender for Endpoint on Mac in the documented order: system extensions, Full Disk Access, network filter, background services, the app, the onboarding package, mdatp checks and fixes. https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html Microsoft Defender Enable network protection from Intune, turn on web content filtering, build category policies scoped to device groups, add allow indicators, and read blocks in reports, Event Viewer and advanced hunting. https://www.oeltayeb.com/articles/exchange-online-message-trace-troubleshooting.html https://www.oeltayeb.com/articles/exchange-online-message-trace-troubleshooting.html Exchange Online Run a message trace in the Exchange admin center or with Get-MessageTraceV2, read the delivery status and events, and pull older data from downloadable reports. https://www.oeltayeb.com/articles/spf-dkim-dmarc-microsoft-365-custom-domain.html https://www.oeltayeb.com/articles/spf-dkim-dmarc-microsoft-365-custom-domain.html Exchange Online Publish one correct SPF record, turn on DKIM signing in the Defender portal, then move DMARC from p=none to p=reject without blocking your own legitimate mail. https://www.oeltayeb.com/articles/ndr-550-5-7-520-external-forwarding-blocked.html https://www.oeltayeb.com/articles/ndr-550-5-7-520-external-forwarding-blocked.html Exchange Online Why Exchange Online blocks automatic forwarding to external addresses with 5.7.520, and how to allow it only for the mailboxes that need it instead of for everyone. https://www.oeltayeb.com/articles/shared-mailbox-automapping-outlook.html https://www.oeltayeb.com/articles/shared-mailbox-automapping-outlook.html Exchange Online How automapping really works, why group-based Full Access never automaps, how to switch it off per user, and how to keep sent items in the shared mailbox. https://www.oeltayeb.com/articles/auto-expanding-archiving-exchange-online.html https://www.oeltayeb.com/articles/auto-expanding-archiving-exchange-online.html Exchange Online Check licensing and the one-way switch, enable auto-expanding archiving org-wide or per user, make sure items actually move, and confirm extra storage was provisioned. https://www.oeltayeb.com/articles/ndr-550-5-4-1-recipient-address-rejected-access-denied.html https://www.oeltayeb.com/articles/ndr-550-5-4-1-recipient-address-rejected-access-denied.html Exchange Online Why Exchange Online rejects mail with 550 5.4.1 at the perimeter, how Directory-Based Edge Blocking and the accepted domain type cause it, and how to fix each common cause. https://www.oeltayeb.com/articles/smtp-auth-relay-printers-apps-error-5-7-57.html https://www.oeltayeb.com/articles/smtp-auth-relay-printers-apps-error-5-7-57.html Exchange Online What error 5.7.57 means, how SMTP AUTH client submission, SMTP relay and Direct Send differ, how to fix each cause, and where Basic authentication for SMTP AUTH stands. https://www.oeltayeb.com/articles/exchange-online-powershell-v3-connect-automate-reports.html https://www.oeltayeb.com/articles/exchange-online-powershell-v3-connect-automate-reports.html Exchange Online Install the ExchangeOnlineManagement module, connect interactively or with app-only certificate authentication, and run five quick reports with the fast Get-EXO cmdlets. https://www.oeltayeb.com/articles/mail-flow-rules-best-practices-external-tag-exceptions.html https://www.oeltayeb.com/articles/mail-flow-rules-best-practices-external-tag-exceptions.html Exchange Online How Exchange Online evaluates mail flow rules, why the native External tag beats a subject-prefix rule, and how to test, order and audit rules without punching holes in EOP. https://www.oeltayeb.com/articles/training-path-ms-102-microsoft-365-administrator-exchange.html https://www.oeltayeb.com/articles/training-path-ms-102-microsoft-365-administrator-exchange.html Exchange Online A six-stage MS-102 study plan built on the official Microsoft Learn paths, with extra Exchange Online practice, lab ideas and what the November 2026 retirement of the exam means for you. https://www.oeltayeb.com/articles/exchange-online-ews-retirement-ewsenabled-allowlist-october-2026.html https://www.oeltayeb.com/articles/exchange-online-ews-retirement-ewsenabled-allowlist-october-2026.html Exchange Online Exchange Web Services is being disabled in Exchange Online from October 2026. What changes, how EwsEnabled and EwsAllowedAppIDs work, how to find what still uses EWS and how to buy time safely. https://www.oeltayeb.com/articles/exchange-online-mailbox-full-quota-recoverable-items-ndr-5-2-2.html https://www.oeltayeb.com/articles/exchange-online-mailbox-full-quota-recoverable-items-ndr-5-2-2.html Exchange Online Why senders get 554 5.2.2 mailbox full, how to measure a mailbox and its hidden Recoverable Items folder, and the fix for each cause: user data, holds, calendar logging or the wrong licence. https://www.oeltayeb.com/articles/exchange-hybrid-free-busy-calendar-sharing-not-working.html https://www.oeltayeb.com/articles/exchange-hybrid-free-busy-calendar-sharing-not-working.html Exchange Online A methodical way to troubleshoot hybrid free/busy and calendar sharing: direction, Autodiscover, the OAuth trust and dedicated hybrid app, connectors and relationships, with cmdlets for each hop. https://www.oeltayeb.com/articles/investigate-compromised-mailbox-exchange-online-inbox-rules-audit.html https://www.oeltayeb.com/articles/investigate-compromised-mailbox-exchange-online-inbox-rules-audit.html Exchange Online Microsoft's response order for a compromised mailbox, cmdlets that find malicious inbox rules and forwarding across every mailbox, what to read in sign-in and audit logs, and how to harden afterwards. https://www.oeltayeb.com/articles/retention-policies-litigation-hold-exchange-online-purview.html https://www.oeltayeb.com/articles/retention-policies-litigation-hold-exchange-online-purview.html Exchange Online Purview retention policies vs retention labels vs Exchange MRM tags vs litigation hold: what each does, what wins in a conflict, licensing, how to set them up and how to prove a mailbox is really on hold. https://www.oeltayeb.com/articles/exchange-hybrid-mailbox-migration-batches-errors.html https://www.oeltayeb.com/articles/exchange-hybrid-mailbox-migration-batches-errors.html Exchange Online How a remote move batch works, what Syncing, Synced and Completing really mean, the documented errors (SMTP proxy, MRS Proxy 401, skipped items) and how to finish the cutover cleanly. https://www.oeltayeb.com/articles/outlook-autodiscover-connectivity-exchange-online-troubleshooting.html https://www.oeltayeb.com/articles/outlook-autodiscover-connectivity-exchange-online-troubleshooting.html Exchange Online How classic Outlook finds Exchange Online, how to read Test E-mail AutoConfiguration and the Remote Connectivity Analyzer, and the usual culprits: DNS, stale on-premises Autodiscover, old clients and broken profiles. https://www.oeltayeb.com/articles/distribution-groups-vs-microsoft-365-groups-vs-shared-mailboxes.html https://www.oeltayeb.com/articles/distribution-groups-vs-microsoft-365-groups-vs-shared-mailboxes.html Exchange Online A capability-by-capability comparison of distribution groups, dynamic groups, Microsoft 365 Groups and shared mailboxes, when to choose each, how to upgrade a DL and the PowerShell to answer the usual questions. https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html Exchange Online Read the X-Forefront-Antispam-Report header (CAT, SFV, BCL, compauth) to see why a good message was junked, then fix it the supported way: submissions, Tenant Allow/Block List, sender authentication, not bypass rules. https://www.oeltayeb.com/articles/room-resource-mailboxes-booking-policies-exchange-online.html https://www.oeltayeb.com/articles/room-resource-mailboxes-booking-policies-exchange-online.html Exchange Online Create room and equipment mailboxes, tune Set-CalendarProcessing (auto-accept, conflicts, booking window, delegates), build room lists and Set-Place metadata for Room Finder, and fix the usual booking complaints. https://www.oeltayeb.com/articles/microsoft-mvp-award-contributions-explained.html https://www.oeltayeb.com/articles/microsoft-mvp-award-contributions-explained.html Community & career What the Microsoft MVP Award recognises, how nominations and reviews work, which contributions count (and which don't), and a simple log template to track your community work.