{
 "name": "Microsoft 365 error library",
 "url": "https://www.oeltayeb.com/microsoft-365-errors.html",
 "count": 169,
 "errors": [
  {
   "error": "0x801c001d",
   "where": "dsregcmd /status (Client ErrorCode)",
   "group": "Entra ID",
   "guide": "Troubleshooting Microsoft Entra hybrid join with dsregcmd /status",
   "url": "https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html",
   "also": [
    "-2145648611",
    "2149318685"
   ]
  },
  {
   "error": "0x801c03f2",
   "where": "dsregcmd /status (Client ErrorCode)",
   "group": "Entra ID",
   "guide": "Troubleshooting Microsoft Entra hybrid join with dsregcmd /status",
   "url": "https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html",
   "also": [
    "-2145647630",
    "2149319666"
   ]
  },
  {
   "error": "0x801c0021 / 0x80072ee2",
   "where": "dsregcmd /status (Client ErrorCode)",
   "group": "Entra ID",
   "guide": "Troubleshooting Microsoft Entra hybrid join with dsregcmd /status",
   "url": "https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html",
   "also": [
    "-2145648607",
    "2149318689",
    "-2147012894",
    "2147954402"
   ]
  },
  {
   "error": "0x80090016",
   "where": "dsregcmd /status (Client ErrorCode)",
   "group": "Entra ID",
   "guide": "Troubleshooting Microsoft Entra hybrid join with dsregcmd /status",
   "url": "https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html",
   "also": [
    "-2146893802",
    "2148073494"
   ]
  },
  {
   "error": "0xc000006d",
   "where": "dsregcmd /status (Attempt Status)",
   "group": "Entra ID",
   "guide": "Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts",
   "url": "https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html",
   "also": [
    "-1073741715",
    "3221225581"
   ]
  },
  {
   "error": "0xE0474352",
   "where": "Entra Connect Sync setup (2.6.84.0)",
   "group": "Entra ID",
   "guide": "Keeping Microsoft Entra Connect Sync supported: versions, auto-upgrade, in-place upgrades",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-upgrade-versions-auto-upgrade.html",
   "also": [
    "-532200622",
    "3762766674"
   ]
  },
  {
   "error": "1002 No Microsoft Entra device state",
   "where": "Microsoft Entra sign-in log (token protection)",
   "group": "Entra ID",
   "guide": "Token protection in Conditional Access: binding sign-in sessions to the device",
   "url": "https://www.oeltayeb.com/articles/conditional-access-token-protection-session-binding.html"
  },
  {
   "error": "1003 Device state doesn't meet requirements",
   "where": "Microsoft Entra sign-in log (token protection)",
   "group": "Entra ID",
   "guide": "Token protection in Conditional Access: binding sign-in sessions to the device",
   "url": "https://www.oeltayeb.com/articles/conditional-access-token-protection-session-binding.html"
  },
  {
   "error": "1004 Apple: registration isn't hardware-backed",
   "where": "Microsoft Entra sign-in log (token protection)",
   "group": "Entra ID",
   "guide": "Token protection in Conditional Access: binding sign-in sessions to the device",
   "url": "https://www.oeltayeb.com/articles/conditional-access-token-protection-session-binding.html"
  },
  {
   "error": "1006 OS version unsupported",
   "where": "Microsoft Entra sign-in log (token protection)",
   "group": "Entra ID",
   "guide": "Token protection in Conditional Access: binding sign-in sessions to the device",
   "url": "https://www.oeltayeb.com/articles/conditional-access-token-protection-session-binding.html"
  },
  {
   "error": "1008 Client isn't using the platform broker (WAM or the SSO plug-in)",
   "where": "Microsoft Entra sign-in log (token protection)",
   "group": "Entra ID",
   "guide": "Token protection in Conditional Access: binding sign-in sessions to the device",
   "url": "https://www.oeltayeb.com/articles/conditional-access-token-protection-session-binding.html"
  },
  {
   "error": "12002 / 12007 / 12029 / 12030 (WinHTTP)",
   "where": "dsregcmd /status (SSO State)",
   "group": "Entra ID",
   "guide": "Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts",
   "url": "https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html"
  },
  {
   "error": "50053",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Reading Microsoft Entra sign-in logs like an engineer",
   "url": "https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html"
  },
  {
   "error": "50058",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Reading Microsoft Entra sign-in logs like an engineer",
   "url": "https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html"
  },
  {
   "error": "50126",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Reading Microsoft Entra sign-in logs like an engineer",
   "url": "https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html"
  },
  {
   "error": "50140 / 50074 / 50125 / 50199",
   "where": "Microsoft Entra sign-in log (Interrupted)",
   "group": "Entra ID",
   "guide": "Reading Microsoft Entra sign-in logs like an engineer",
   "url": "https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html"
  },
  {
   "error": "70043 / 70046",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Reading Microsoft Entra sign-in logs like an engineer",
   "url": "https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html"
  },
  {
   "error": "81001",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone",
   "url": "https://www.oeltayeb.com/articles/seamless-sso-troubleshooting-azureadssoacc-kerberos.html"
  },
  {
   "error": "81002 / 81003 / 81008 / 81009",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone",
   "url": "https://www.oeltayeb.com/articles/seamless-sso-troubleshooting-azureadssoacc-kerberos.html"
  },
  {
   "error": "81004",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone",
   "url": "https://www.oeltayeb.com/articles/seamless-sso-troubleshooting-azureadssoacc-kerberos.html"
  },
  {
   "error": "81010",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone",
   "url": "https://www.oeltayeb.com/articles/seamless-sso-troubleshooting-azureadssoacc-kerberos.html"
  },
  {
   "error": "81011 / 81013",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone",
   "url": "https://www.oeltayeb.com/articles/seamless-sso-troubleshooting-azureadssoacc-kerberos.html"
  },
  {
   "error": "81012",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone",
   "url": "https://www.oeltayeb.com/articles/seamless-sso-troubleshooting-azureadssoacc-kerberos.html"
  },
  {
   "error": "500121",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Reading Microsoft Entra sign-in logs like an engineer",
   "url": "https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html"
  },
  {
   "error": "AADSTS50034 / 0xc000005f",
   "where": "dsregcmd /status (SSO State)",
   "group": "Entra ID",
   "guide": "Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts",
   "url": "https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html",
   "also": [
    "-1073741729",
    "3221225567"
   ]
  },
  {
   "error": "AADSTS50053",
   "where": "Sign-in page / Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Microsoft Entra ID Protection: risk policies, self-remediation and false positives",
   "url": "https://www.oeltayeb.com/articles/entra-id-protection-risk-policies-false-positives.html"
  },
  {
   "error": "AADSTS50072 UserStrongAuthEnrollmentRequiredInterrupt",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors",
   "url": "https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html"
  },
  {
   "error": "AADSTS50074 UserStrongAuthClientAuthNRequiredInterrupt",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors",
   "url": "https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html"
  },
  {
   "error": "AADSTS50076 UserStrongAuthClientAuthNRequired",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors",
   "url": "https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html"
  },
  {
   "error": "AADSTS50078 UserStrongAuthExpired",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors",
   "url": "https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html"
  },
  {
   "error": "AADSTS50079 UserStrongAuthEnrollmentRequired",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors",
   "url": "https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html"
  },
  {
   "error": "AADSTS50126: Error validating credentials due to invalid username or password.",
   "where": "dsregcmd /status (SSO State)",
   "group": "Entra ID",
   "guide": "Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts",
   "url": "https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html"
  },
  {
   "error": "AADSTS50155",
   "where": "dsregcmd /status (SSO State)",
   "group": "Entra ID",
   "guide": "Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts",
   "url": "https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html"
  },
  {
   "error": "AADSTS50158 ExternalSecurityChallenge",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors",
   "url": "https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html"
  },
  {
   "error": "AADSTS53000 DeviceNotCompliant",
   "where": "Sign-in page / Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks",
   "url": "https://www.oeltayeb.com/articles/aadsts53000-aadsts53003-conditional-access-blocks.html"
  },
  {
   "error": "AADSTS53001",
   "where": "Sign-in page / Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Troubleshooting Microsoft Entra hybrid join with dsregcmd /status",
   "url": "https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html"
  },
  {
   "error": "AADSTS53001 DeviceNotDomainJoined",
   "where": "Sign-in page / Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks",
   "url": "https://www.oeltayeb.com/articles/aadsts53000-aadsts53003-conditional-access-blocks.html"
  },
  {
   "error": "AADSTS53003 BlockedByConditionalAccess",
   "where": "Sign-in page / Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks",
   "url": "https://www.oeltayeb.com/articles/aadsts53000-aadsts53003-conditional-access-blocks.html"
  },
  {
   "error": "AADSTS53004",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "A Conditional Access baseline: the first policies every tenant should deploy",
   "url": "https://www.oeltayeb.com/articles/conditional-access-baseline-policies-every-tenant.html"
  },
  {
   "error": "AADSTS53004 ProofUpBlockedDueToRisk",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors",
   "url": "https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html"
  },
  {
   "error": "AttributeValueMustBeUnique",
   "where": "Synchronization Service Manager",
   "group": "Entra ID",
   "guide": "Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html"
  },
  {
   "error": "AzureAdPrt : NO AcquirePrtDiagnostics : PRESENT",
   "where": "dsregcmd /status (SSO State)",
   "group": "Entra ID",
   "guide": "Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts",
   "url": "https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html"
  },
  {
   "error": "completed-export-errors",
   "where": "Synchronization Service Manager (export run)",
   "group": "Entra ID",
   "guide": "Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html"
  },
  {
   "error": "Connection to Microsoft Entra ID failed due to authentication failure",
   "where": "Microsoft Entra Connect Health",
   "group": "Entra ID",
   "guide": "Microsoft Entra Connect Health: installing the agents and acting on sync alerts",
   "url": "https://www.oeltayeb.com/articles/entra-connect-health-agents-sync-alerts.html"
  },
  {
   "error": "Device is either disabled or deleted",
   "where": "dsregcmd /status (DeviceAuthStatus)",
   "group": "Entra ID",
   "guide": "Troubleshooting Microsoft Entra hybrid join with dsregcmd /status",
   "url": "https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html"
  },
  {
   "error": "DomainJoined : YES but AzureAdJoined : NO",
   "where": "dsregcmd /status",
   "group": "Entra ID",
   "guide": "Troubleshooting Microsoft Entra hybrid join with dsregcmd /status",
   "url": "https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html"
  },
  {
   "error": "Event ID 304 / 305 / 307 (User Device Registration)",
   "where": "Event Viewer (User Device Registration Admin)",
   "group": "Entra ID",
   "guide": "Troubleshooting Microsoft Entra hybrid join with dsregcmd /status",
   "url": "https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html"
  },
  {
   "error": "Event ID 1081 (AAD)",
   "where": "Event Viewer (AAD Operational)",
   "group": "Entra ID",
   "guide": "Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts",
   "url": "https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html"
  },
  {
   "error": "Event ID 1088 (AAD)",
   "where": "Event Viewer (AAD Operational)",
   "group": "Entra ID",
   "guide": "Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts",
   "url": "https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html"
  },
  {
   "error": "Event ID 6329 (ADSync): 0x80230619",
   "where": "Application log (Entra Connect server)",
   "group": "Entra ID",
   "guide": "Self-service password reset and password writeback: fixing the usual failures",
   "url": "https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html",
   "also": [
    "-2145188327",
    "2149778969"
   ]
  },
  {
   "error": "Event ID 32002 / 32009 (PasswordResetService)",
   "where": "Application log (Entra Connect server)",
   "group": "Entra ID",
   "guide": "Self-service password reset and password writeback: fixing the usual failures",
   "url": "https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html"
  },
  {
   "error": "Event ID 33004 / 33005 / 33006 / 33008 (PasswordResetService)",
   "where": "Application log (Entra Connect server)",
   "group": "Entra ID",
   "guide": "Self-service password reset and password writeback: fixing the usual failures",
   "url": "https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html"
  },
  {
   "error": "Existing Admin Role Conflict",
   "where": "Synchronization Service Manager",
   "group": "Entra ID",
   "guide": "Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html"
  },
  {
   "error": "Export to Microsoft Entra ID was Stopped. Accidental delete threshold was reached",
   "where": "Microsoft Entra Connect Health",
   "group": "Entra ID",
   "guide": "Microsoft Entra Connect Health: installing the agents and acting on sync alerts",
   "url": "https://www.oeltayeb.com/articles/entra-connect-health-agents-sync-alerts.html"
  },
  {
   "error": "FileLoadException for System.Diagnostics.DiagnosticSource",
   "where": "Sync cycle after a Connect Sync upgrade",
   "group": "Entra ID",
   "guide": "Keeping Microsoft Entra Connect Sync supported: versions, auto-upgrade, in-place upgrades",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-upgrade-versions-auto-upgrade.html"
  },
  {
   "error": "Health Service data is not up to date",
   "where": "Microsoft Entra Connect Health",
   "group": "Entra ID",
   "guide": "Microsoft Entra Connect Health: installing the agents and acting on sync alerts",
   "url": "https://www.oeltayeb.com/articles/entra-connect-health-agents-sync-alerts.html"
  },
  {
   "error": "IdentityDataValidationFailed / DataValidationFailed",
   "where": "Synchronization Service Manager",
   "group": "Entra ID",
   "guide": "Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html"
  },
  {
   "error": "InvalidHardMatch",
   "where": "Synchronization Service Manager",
   "group": "Entra ID",
   "guide": "Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html"
  },
  {
   "error": "InvalidSoftMatch",
   "where": "Synchronization Service Manager",
   "group": "Entra ID",
   "guide": "Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html"
  },
  {
   "error": "LargeObject / ExceededAllowedLength",
   "where": "Synchronization Service Manager",
   "group": "Entra ID",
   "guide": "Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html"
  },
  {
   "error": "ObjectTypeMismatch",
   "where": "Synchronization Service Manager",
   "group": "Entra ID",
   "guide": "Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html"
  },
  {
   "error": "Password Hash Synchronization has stopped working",
   "where": "Microsoft Entra Connect Health",
   "group": "Entra ID",
   "guide": "Microsoft Entra Connect Health: installing the agents and acting on sync alerts",
   "url": "https://www.oeltayeb.com/articles/entra-connect-health-agents-sync-alerts.html"
  },
  {
   "error": "Report-only: Failure",
   "where": "Microsoft Entra sign-in log (Report-only tab)",
   "group": "Entra ID",
   "guide": "Test before you enforce: Conditional Access What If and report-only mode",
   "url": "https://www.oeltayeb.com/articles/conditional-access-what-if-report-only.html"
  },
  {
   "error": "Report-only: User action required",
   "where": "Microsoft Entra sign-in log (Report-only tab)",
   "group": "Entra ID",
   "guide": "Test before you enforce: Conditional Access What If and report-only mode",
   "url": "https://www.oeltayeb.com/articles/conditional-access-what-if-report-only.html"
  },
  {
   "error": "reportOnlyFailure",
   "where": "Log Analytics (SigninLogs)",
   "group": "Entra ID",
   "guide": "Test before you enforce: Conditional Access What If and report-only mode",
   "url": "https://www.oeltayeb.com/articles/conditional-access-what-if-report-only.html"
  },
  {
   "error": "reportOnlyInterrupted",
   "where": "Log Analytics (SigninLogs)",
   "group": "Entra ID",
   "guide": "Test before you enforce: Conditional Access What If and report-only mode",
   "url": "https://www.oeltayeb.com/articles/conditional-access-what-if-report-only.html"
  },
  {
   "error": "Roles are being assigned outside of Privileged Identity Management",
   "where": "Privileged Identity Management alerts",
   "group": "Entra ID",
   "guide": "Privileged Identity Management: just-in-time Microsoft Entra roles done properly",
   "url": "https://www.oeltayeb.com/articles/entra-privileged-identity-management-just-in-time-roles.html"
  },
  {
   "error": "Sign-in was blocked by built-in protections due to high confidence of risk",
   "where": "Microsoft Entra sign-in log",
   "group": "Entra ID",
   "guide": "Microsoft Entra ID Protection: risk policies, self-remediation and false positives",
   "url": "https://www.oeltayeb.com/articles/entra-id-protection-risk-policies-false-positives.html"
  },
  {
   "error": "SSPR_0013",
   "where": "SSPR portal (aka.ms/sspr)",
   "group": "Entra ID",
   "guide": "Self-service password reset and password writeback: fixing the usual failures",
   "url": "https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html"
  },
  {
   "error": "SSPR_0014",
   "where": "SSPR portal (aka.ms/sspr)",
   "group": "Entra ID",
   "guide": "Self-service password reset and password writeback: fixing the usual failures",
   "url": "https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html"
  },
  {
   "error": "SSPR_0029",
   "where": "SSPR portal (aka.ms/sspr)",
   "group": "Entra ID",
   "guide": "Self-service password reset and password writeback: fixing the usual failures",
   "url": "https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html"
  },
  {
   "error": "SSPR_0030",
   "where": "SSPR portal (aka.ms/sspr)",
   "group": "Entra ID",
   "guide": "Self-service password reset and password writeback: fixing the usual failures",
   "url": "https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html"
  },
  {
   "error": "stopped-deletion-threshold-exceeded",
   "where": "Synchronization Service Manager (export run)",
   "group": "Entra ID",
   "guide": "Filtering Microsoft Entra Connect Sync by OU, group and attribute without deleting users",
   "url": "https://www.oeltayeb.com/articles/entra-connect-sync-filtering-ou-group-attribute.html"
  },
  {
   "error": "The passkey already exists",
   "where": "Microsoft Authenticator (passkey registration)",
   "group": "Entra ID",
   "guide": "Rolling out passkeys in Microsoft Authenticator: policy, registration and the errors users hit",
   "url": "https://www.oeltayeb.com/articles/passkeys-microsoft-authenticator-rollout-troubleshooting.html"
  },
  {
   "error": "The sync service isn't running",
   "where": "Microsoft Entra Connect Health",
   "group": "Entra ID",
   "guide": "Microsoft Entra Connect Health: installing the agents and acting on sync alerts",
   "url": "https://www.oeltayeb.com/articles/entra-connect-health-agents-sync-alerts.html"
  },
  {
   "error": "There are too many Global Administrators",
   "where": "Privileged Identity Management alerts",
   "group": "Entra ID",
   "guide": "Privileged Identity Management: just-in-time Microsoft Entra roles done properly",
   "url": "https://www.oeltayeb.com/articles/entra-privileged-identity-management-just-in-time-roles.html"
  },
  {
   "error": "Unfamiliar sign-in properties",
   "where": "ID Protection risk detections",
   "group": "Entra ID",
   "guide": "Microsoft Entra ID Protection: risk policies, self-remediation and false positives",
   "url": "https://www.oeltayeb.com/articles/entra-id-protection-risk-policies-false-positives.html"
  },
  {
   "error": "WorkplaceJoined : YES in User State",
   "where": "dsregcmd /status on a hybrid joined PC",
   "group": "Entra ID",
   "guide": "Dual state, Pending and duplicate device objects in Microsoft Entra ID: a clean-up guide",
   "url": "https://www.oeltayeb.com/articles/entra-device-registration-dual-state-pending-devices-troubleshooting.html"
  },
  {
   "error": "You can't get there from here",
   "where": "Sign-in page",
   "group": "Entra ID",
   "guide": "Dual state, Pending and duplicate device objects in Microsoft Entra ID: a clean-up guide",
   "url": "https://www.oeltayeb.com/articles/entra-device-registration-dual-state-pending-devices-troubleshooting.html"
  },
  {
   "error": "Your administrator has not enabled you to use this feature",
   "where": "SSPR portal (aka.ms/sspr)",
   "group": "Entra ID",
   "guide": "Self-service password reset and password writeback: fixing the usual failures",
   "url": "https://www.oeltayeb.com/articles/self-service-password-reset-password-writeback-troubleshooting.html"
  },
  {
   "error": "Your organization has deleted the device",
   "where": "Windows / Office sign-in prompt",
   "group": "Entra ID",
   "guide": "Dual state, Pending and duplicate device objects in Microsoft Entra ID: a clean-up guide",
   "url": "https://www.oeltayeb.com/articles/entra-device-registration-dual-state-pending-devices-troubleshooting.html"
  },
  {
   "error": "5.7.60 Client doesn't have permissions to send as this sender",
   "where": "SMTP response (device or app log)",
   "group": "Exchange Online",
   "guide": "Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57",
   "url": "https://www.oeltayeb.com/articles/smtp-auth-relay-printers-apps-error-5-7-57.html"
  },
  {
   "error": "530 5.7.57 SMTP; Client was not authenticated to send anonymous mail during MAIL FROM",
   "where": "SMTP response (device or app log)",
   "group": "Exchange Online",
   "guide": "Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57",
   "url": "https://www.oeltayeb.com/articles/smtp-auth-relay-printers-apps-error-5-7-57.html"
  },
  {
   "error": "535 5.7.139 Authentication unsuccessful, basic authentication is disabled",
   "where": "SMTP response (device or app log)",
   "group": "Exchange Online",
   "guide": "Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57",
   "url": "https://www.oeltayeb.com/articles/smtp-auth-relay-printers-apps-error-5-7-57.html"
  },
  {
   "error": "550 5.4.1 Recipient address rejected: Access denied. AS(201806281)",
   "where": "NDR",
   "group": "Exchange Online",
   "guide": "NDR 550 5.4.1 “Recipient address rejected: Access denied”: Directory-Based Edge Blocking",
   "url": "https://www.oeltayeb.com/articles/ndr-550-5-4-1-recipient-address-rejected-access-denied.html"
  },
  {
   "error": "550 5.7.57 Client not authenticated to send mail. Error: 535 5.7.139 Authentication unsuccessful, basic authentication is disabled",
   "where": "SMTP response (device or app log)",
   "group": "Exchange Online",
   "guide": "Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57",
   "url": "https://www.oeltayeb.com/articles/smtp-auth-relay-printers-apps-error-5-7-57.html"
  },
  {
   "error": "550 5.7.520 Access denied, Your organization does not allow external forwarding.",
   "where": "NDR",
   "group": "Exchange Online",
   "guide": "NDR 550 5.7.520: fixing “Your organization does not allow external forwarding”",
   "url": "https://www.oeltayeb.com/articles/ndr-550-5-7-520-external-forwarding-blocked.html"
  },
  {
   "error": "554 5.2.2 mailbox full; STOREDRV.Deliver.Exception:QuotaExceededException.MapiExceptionQuotaExceeded",
   "where": "NDR (diagnostic information for admins)",
   "group": "Exchange Online",
   "guide": "“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR",
   "url": "https://www.oeltayeb.com/articles/exchange-online-mailbox-full-quota-recoverable-items-ndr-5-2-2.html"
  },
  {
   "error": "AS(7555)",
   "where": "NDR",
   "group": "Exchange Online",
   "guide": "NDR 550 5.7.520: fixing “Your organization does not allow external forwarding”",
   "url": "https://www.oeltayeb.com/articles/ndr-550-5-7-520-external-forwarding-blocked.html"
  },
  {
   "error": "CAT:BULK with SRV:BULK",
   "where": "Message header (X-Forefront-Antispam-Report)",
   "group": "Exchange Online",
   "guide": "Legitimate email landing in Junk: how EOP decides and the right way to fix it",
   "url": "https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html"
  },
  {
   "error": "CAT:PHSH / CAT:HPHSH / CAT:SPOOF",
   "where": "Message header (X-Forefront-Antispam-Report)",
   "group": "Exchange Online",
   "guide": "Legitimate email landing in Junk: how EOP decides and the right way to fix it",
   "url": "https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html"
  },
  {
   "error": "CAT:SPM / CAT:HSPM",
   "where": "Message header (X-Forefront-Antispam-Report)",
   "group": "Exchange Online",
   "guide": "Legitimate email landing in Junk: how EOP decides and the right way to fix it",
   "url": "https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html"
  },
  {
   "error": "compauth=fail reason=001",
   "where": "Message header (Authentication-Results)",
   "group": "Exchange Online",
   "guide": "Legitimate email landing in Junk: how EOP decides and the right way to fix it",
   "url": "https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html"
  },
  {
   "error": "Creation of forwarding/redirect rule",
   "where": "Microsoft Defender portal (alert)",
   "group": "Exchange Online",
   "guide": "Investigating a compromised Exchange Online mailbox: rules, forwarding, sign-ins and audit",
   "url": "https://www.oeltayeb.com/articles/investigate-compromised-mailbox-exchange-online-inbox-rules-audit.html"
  },
  {
   "error": "permerror",
   "where": "SPF result (Authentication-Results header)",
   "group": "Exchange Online",
   "guide": "SPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide",
   "url": "https://www.oeltayeb.com/articles/spf-dkim-dmarc-microsoft-365-custom-domain.html"
  },
  {
   "error": "reason=000",
   "where": "Message header (Authentication-Results)",
   "group": "Exchange Online",
   "guide": "Legitimate email landing in Junk: how EOP decides and the right way to fix it",
   "url": "https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html"
  },
  {
   "error": "SFTY:9.19 or 9.20",
   "where": "Message header (X-Forefront-Antispam-Report)",
   "group": "Exchange Online",
   "guide": "Legitimate email landing in Junk: how EOP decides and the right way to fix it",
   "url": "https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html"
  },
  {
   "error": "SFV:BLK / SFV:SKB",
   "where": "Message header (X-Forefront-Antispam-Report)",
   "group": "Exchange Online",
   "guide": "Legitimate email landing in Junk: how EOP decides and the right way to fix it",
   "url": "https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html"
  },
  {
   "error": "SFV:SPM",
   "where": "Message header (X-Forefront-Antispam-Report)",
   "group": "Exchange Online",
   "guide": "Legitimate email landing in Junk: how EOP decides and the right way to fix it",
   "url": "https://www.oeltayeb.com/articles/legitimate-email-going-to-junk-tuning-anti-spam-exchange-online.html"
  },
  {
   "error": "Something went wrong and Outlook couldn't set up your account",
   "where": "Outlook (add account)",
   "group": "Exchange Online",
   "guide": "Outlook can't connect or set up the account: Autodiscover troubleshooting for Exchange Online",
   "url": "https://www.oeltayeb.com/articles/outlook-autodiscover-connectivity-exchange-online-troubleshooting.html"
  },
  {
   "error": "Suspicious email forwarding activity",
   "where": "Microsoft Defender portal (alert)",
   "group": "Exchange Online",
   "guide": "Investigating a compromised Exchange Online mailbox: rules, forwarding, sign-ins and audit",
   "url": "https://www.oeltayeb.com/articles/investigate-compromised-mailbox-exchange-online-inbox-rules-audit.html"
  },
  {
   "error": "The action couldn't be completed",
   "where": "Outlook on the web (when deleting items)",
   "group": "Exchange Online",
   "guide": "“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR",
   "url": "https://www.oeltayeb.com/articles/exchange-online-mailbox-full-quota-recoverable-items-ndr-5-2-2.html"
  },
  {
   "error": "The message store has reached its maximum size",
   "where": "Outlook (when deleting items)",
   "group": "Exchange Online",
   "guide": "“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR",
   "url": "https://www.oeltayeb.com/articles/exchange-online-mailbox-full-quota-recoverable-items-ndr-5-2-2.html"
  },
  {
   "error": "The recipient's mailbox is full and can't accept messages now. Please try resending this message later or contact the recipient directly.",
   "where": "NDR (user-facing text)",
   "group": "Exchange Online",
   "guide": "“Mailbox full” in Exchange Online: quotas, Recoverable Items and the 554 5.2.2 NDR",
   "url": "https://www.oeltayeb.com/articles/exchange-online-mailbox-full-quota-recoverable-items-ndr-5-2-2.html"
  },
  {
   "error": "User restricted from sending email",
   "where": "Microsoft Defender portal (alert)",
   "group": "Exchange Online",
   "guide": "Investigating a compromised Exchange Online mailbox: rules, forwarding, sign-ins and audit",
   "url": "https://www.oeltayeb.com/articles/investigate-compromised-mailbox-exchange-online-inbox-rules-audit.html"
  },
  {
   "error": "0x87D1FDE8",
   "where": "Intune admin center (EDR policy status)",
   "group": "Defender",
   "guide": "Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html",
   "also": [
    "-2016281112",
    "2278686184"
   ]
  },
  {
   "error": "0x87D1FDE8 (remediation failed)",
   "where": "Intune EDR policy (onboarding setting)",
   "group": "Defender",
   "guide": "Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)",
   "url": "https://www.oeltayeb.com/articles/onboard-defender-for-endpoint-with-intune.html",
   "also": [
    "-2016281112",
    "2278686184"
   ]
  },
  {
   "error": "0x87D101A9",
   "where": "Intune EDR policy (device status)",
   "group": "Defender",
   "guide": "Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)",
   "url": "https://www.oeltayeb.com/articles/onboard-defender-for-endpoint-with-intune.html",
   "also": [
    "-2016345687",
    "2278621609"
   ]
  },
  {
   "error": "0x87D101A9",
   "where": "Intune admin center (EDR policy status)",
   "group": "Defender",
   "guide": "Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html",
   "also": [
    "-2016345687",
    "2278621609"
   ]
  },
  {
   "error": "AsrOfficeChildProcessAudited",
   "where": "Advanced hunting (DeviceEvents)",
   "group": "Defender",
   "guide": "Rolling out ASR rules safely: audit mode, exclusions and advanced hunting",
   "url": "https://www.oeltayeb.com/articles/attack-surface-reduction-rules-audit-mode.html"
  },
  {
   "error": "Blocked by tenant admin",
   "where": "URL protection report (click action)",
   "group": "Defender",
   "guide": "Safe Links and Safe Attachments: troubleshooting blocked links, missing rewrites and delays",
   "url": "https://www.oeltayeb.com/articles/safe-links-safe-attachments-blocked-link-troubleshooting.html"
  },
  {
   "error": "CasbPolicy",
   "where": "Advanced hunting (ResponseCategory)",
   "group": "Defender",
   "guide": "Web content filtering in Defender for Endpoint: network protection, categories and indicators",
   "url": "https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html"
  },
  {
   "error": "compauth=fail",
   "where": "Message header (Authentication-Results)",
   "group": "Defender",
   "guide": "Handling false-positive quarantined email in Defender for Office 365 the right way",
   "url": "https://www.oeltayeb.com/articles/release-quarantined-email-defender-office-365.html"
  },
  {
   "error": "Connection blocked",
   "where": "Windows toast (network protection)",
   "group": "Defender",
   "guide": "Web content filtering in Defender for Endpoint: network protection, categories and indicators",
   "url": "https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html"
  },
  {
   "error": "CustomPolicy",
   "where": "Advanced hunting (ResponseCategory)",
   "group": "Defender",
   "guide": "Web content filtering in Defender for Endpoint: network protection, categories and indicators",
   "url": "https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html"
  },
  {
   "error": "Device is managed by SCCM Agent",
   "where": "MDE Enrollment status (code 4)",
   "group": "Defender",
   "guide": "Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes",
   "url": "https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html"
  },
  {
   "error": "Device is not enrolled and has never been enrolled",
   "where": "MDE Enrollment status (code 2)",
   "group": "Defender",
   "guide": "Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes",
   "url": "https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html"
  },
  {
   "error": "Directory services user credentials are incorrect",
   "where": "Defender portal (Global health issues)",
   "group": "Defender",
   "guide": "Defender for Identity sensors: installation and health issues on domain controllers",
   "url": "https://www.oeltayeb.com/articles/defender-for-identity-sensor-installation-health-issues.html"
  },
  {
   "error": "Event ID 4 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Moving Defender for Endpoint to streamlined connectivity: URLs, proxies and validation",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-streamlined-connectivity-migration-proxy.html"
  },
  {
   "error": "Event ID 5 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)",
   "url": "https://www.oeltayeb.com/articles/onboard-defender-for-endpoint-with-intune.html"
  },
  {
   "error": "Event ID 5 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Device shows \"Inactive\" or \"No sensor data\" in Microsoft Defender: how to troubleshoot",
   "url": "https://www.oeltayeb.com/articles/defender-device-inactive-no-sensor-data.html"
  },
  {
   "error": "Event ID 5 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html"
  },
  {
   "error": "Event ID 5 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Moving Defender for Endpoint to streamlined connectivity: URLs, proxies and validation",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-streamlined-connectivity-migration-proxy.html"
  },
  {
   "error": "Event ID 6 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html"
  },
  {
   "error": "Event ID 7 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html"
  },
  {
   "error": "Event ID 15 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)",
   "url": "https://www.oeltayeb.com/articles/onboard-defender-for-endpoint-with-intune.html"
  },
  {
   "error": "Event ID 15 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Device shows \"Inactive\" or \"No sensor data\" in Microsoft Defender: how to troubleshoot",
   "url": "https://www.oeltayeb.com/articles/defender-device-inactive-no-sensor-data.html"
  },
  {
   "error": "Event ID 15 (SENSE)",
   "where": "Event Viewer (Microsoft-Windows-SENSE)",
   "group": "Defender",
   "guide": "Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html"
  },
  {
   "error": "Event ID 15 (WDATPOnboarding)",
   "where": "Event Viewer (Application log)",
   "group": "Defender",
   "guide": "Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html"
  },
  {
   "error": "Event ID 30 (WDATPOnboarding)",
   "where": "Event Viewer (Application log)",
   "group": "Defender",
   "guide": "Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html"
  },
  {
   "error": "Event ID 1121 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Rolling out ASR rules safely: audit mode, exclusions and advanced hunting",
   "url": "https://www.oeltayeb.com/articles/attack-surface-reduction-rules-audit-mode.html"
  },
  {
   "error": "Event ID 1122 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Rolling out ASR rules safely: audit mode, exclusions and advanced hunting",
   "url": "https://www.oeltayeb.com/articles/attack-surface-reduction-rules-audit-mode.html"
  },
  {
   "error": "Event ID 1125 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Web content filtering in Defender for Endpoint: network protection, categories and indicators",
   "url": "https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html"
  },
  {
   "error": "Event ID 1126 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Web content filtering in Defender for Endpoint: network protection, categories and indicators",
   "url": "https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html"
  },
  {
   "error": "Event ID 1129 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Rolling out ASR rules safely: audit mode, exclusions and advanced hunting",
   "url": "https://www.oeltayeb.com/articles/attack-surface-reduction-rules-audit-mode.html"
  },
  {
   "error": "Event ID 5007 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Rolling out ASR rules safely: audit mode, exclusions and advanced hunting",
   "url": "https://www.oeltayeb.com/articles/attack-surface-reduction-rules-audit-mode.html"
  },
  {
   "error": "Event ID 5007 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Defender Antivirus settings not applying from Intune: a troubleshooting checklist",
   "url": "https://www.oeltayeb.com/articles/defender-antivirus-policy-not-applying.html"
  },
  {
   "error": "Event ID 5013 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Defender Antivirus settings not applying from Intune: a troubleshooting checklist",
   "url": "https://www.oeltayeb.com/articles/defender-antivirus-policy-not-applying.html"
  },
  {
   "error": "Event ID 5013 (Windows Defender)",
   "where": "Event Viewer (Windows Defender/Operational)",
   "group": "Defender",
   "guide": "Tamper protection and Intune: why a Defender setting won't change, and how to fix it",
   "url": "https://www.oeltayeb.com/articles/defender-tamper-protection-troubleshooting-intune.html"
  },
  {
   "error": "ExploitGuardNetworkProtectionBlocked",
   "where": "Advanced hunting (DeviceEvents ActionType)",
   "group": "Defender",
   "guide": "Web content filtering in Defender for Endpoint: network protection, categories and indicators",
   "url": "https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html"
  },
  {
   "error": "ExploitGuardNetworkProtectionBlocked",
   "where": "Advanced hunting (DeviceEvents)",
   "group": "Defender",
   "guide": "Shadow IT with Defender for Cloud Apps and Defender for Endpoint: discover, warn, block",
   "url": "https://www.oeltayeb.com/articles/defender-for-cloud-apps-shadow-it-discovery-block-apps.html"
  },
  {
   "error": "General Hybrid join failure",
   "where": "MDE Enrollment status (codes 10, 42)",
   "group": "Defender",
   "guide": "Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes",
   "url": "https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html"
  },
  {
   "error": "Hybrid error - Service Connection Point",
   "where": "MDE Enrollment status (codes 16, 17)",
   "group": "Defender",
   "guide": "Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes",
   "url": "https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html"
  },
  {
   "error": "Microsoft Entra Connect misconfiguration",
   "where": "MDE Enrollment status (codes 36, 37)",
   "group": "Defender",
   "guide": "Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes",
   "url": "https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html"
  },
  {
   "error": "Microsoft Intune Configuration issue",
   "where": "MDE Enrollment status (codes 8, 44)",
   "group": "Defender",
   "guide": "Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes",
   "url": "https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html"
  },
  {
   "error": "Misconfigured: Impaired communications",
   "where": "Microsoft Defender portal (Sensor health state)",
   "group": "Defender",
   "guide": "Device shows \"Inactive\" or \"No sensor data\" in Microsoft Defender: how to troubleshoot",
   "url": "https://www.oeltayeb.com/articles/defender-device-inactive-no-sensor-data.html"
  },
  {
   "error": "Misconfigured: No sensor data",
   "where": "Microsoft Defender portal (Sensor health state)",
   "group": "Defender",
   "guide": "Device shows \"Inactive\" or \"No sensor data\" in Microsoft Defender: how to troubleshoot",
   "url": "https://www.oeltayeb.com/articles/defender-device-inactive-no-sensor-data.html"
  },
  {
   "error": "No license found",
   "where": "Microsoft Defender app on macOS",
   "group": "Defender",
   "guide": "Onboarding macOS to Defender for Endpoint with Intune: profiles, app and onboarding package",
   "url": "https://www.oeltayeb.com/articles/defender-for-endpoint-macos-onboarding-intune.html"
  },
  {
   "error": "NTLM Auditing is not enabled",
   "where": "Defender portal (Identities › Health issues)",
   "group": "Defender",
   "guide": "Defender for Identity sensors: installation and health issues on domain controllers",
   "url": "https://www.oeltayeb.com/articles/defender-for-identity-sensor-installation-health-issues.html"
  },
  {
   "error": "Power mode isn't configured for optimal processor performance",
   "where": "Defender portal (Identities › Health issues)",
   "group": "Defender",
   "guide": "Defender for Identity sensors: installation and health issues on domain controllers",
   "url": "https://www.oeltayeb.com/articles/defender-for-identity-sensor-installation-health-issues.html"
  },
  {
   "error": "RemovableStoragePolicyTriggered",
   "where": "Advanced hunting (DeviceEvents)",
   "group": "Defender",
   "guide": "Controlling USB and removable storage with Defender device control and Intune",
   "url": "https://www.oeltayeb.com/articles/defender-device-control-usb-removable-storage-intune.html"
  },
  {
   "error": "Sensor has issues with packet capturing component",
   "where": "Defender portal (Identities › Health issues)",
   "group": "Defender",
   "guide": "Defender for Identity sensors: installation and health issues on domain controllers",
   "url": "https://www.oeltayeb.com/articles/defender-for-identity-sensor-installation-health-issues.html"
  },
  {
   "error": "Sensor reached a memory resource limit",
   "where": "Defender portal (Identities › Health issues)",
   "group": "Defender",
   "guide": "Defender for Identity sensors: installation and health issues on domain controllers",
   "url": "https://www.oeltayeb.com/articles/defender-for-identity-sensor-installation-health-issues.html"
  },
  {
   "error": "Sensor service failed to start",
   "where": "Defender portal (Identities › Health issues)",
   "group": "Defender",
   "guide": "Defender for Identity sensors: installation and health issues on domain controllers",
   "url": "https://www.oeltayeb.com/articles/defender-for-identity-sensor-installation-health-issues.html"
  },
  {
   "error": "Sensor stopped communicating",
   "where": "Defender portal (Identities › Health issues)",
   "group": "Defender",
   "guide": "Defender for Identity sensors: installation and health issues on domain controllers",
   "url": "https://www.oeltayeb.com/articles/defender-for-identity-sensor-installation-health-issues.html"
  },
  {
   "error": "Sensor v3.x RPC Audit Misconfigured",
   "where": "Defender portal (Identities › Health issues)",
   "group": "Defender",
   "guide": "Defender for Identity sensors: installation and health issues on domain controllers",
   "url": "https://www.oeltayeb.com/articles/defender-for-identity-sensor-installation-health-issues.html"
  },
  {
   "error": "SmartScreenUrlWarning",
   "where": "Advanced hunting (DeviceEvents)",
   "group": "Defender",
   "guide": "Shadow IT with Defender for Cloud Apps and Defender for Endpoint: discover, warn, block",
   "url": "https://www.oeltayeb.com/articles/defender-for-cloud-apps-shadow-it-discovery-block-apps.html"
  },
  {
   "error": "TamperingAttempt",
   "where": "Advanced hunting (DeviceEvents)",
   "group": "Defender",
   "guide": "Tamper protection and Intune: why a Defender setting won't change, and how to fix it",
   "url": "https://www.oeltayeb.com/articles/defender-tamper-protection-troubleshooting-intune.html"
  },
  {
   "error": "Tenant mismatch",
   "where": "MDE Enrollment status (code 15)",
   "group": "Defender",
   "guide": "Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes",
   "url": "https://www.oeltayeb.com/articles/defender-security-settings-management-sensecm-enrollment-errors.html"
  },
  {
   "error": "This content is blocked",
   "where": "Windows toast (network protection)",
   "group": "Defender",
   "guide": "Web content filtering in Defender for Endpoint: network protection, categories and indicators",
   "url": "https://www.oeltayeb.com/articles/web-content-filtering-network-protection-defender-intune.html"
  },
  {
   "error": "this website has been classified as malicious",
   "where": "Safe Links warning page",
   "group": "Defender",
   "guide": "Safe Links and Safe Attachments: troubleshooting blocked links, missing rewrites and delays",
   "url": "https://www.oeltayeb.com/articles/safe-links-safe-attachments-blocked-link-troubleshooting.html"
  },
  {
   "error": "Conflicting service plans",
   "where": "Microsoft 365 admin center (Errors & issues)",
   "group": "Microsoft 365",
   "guide": "Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes",
   "url": "https://www.oeltayeb.com/articles/microsoft-365-group-based-licensing-errors.html"
  },
  {
   "error": "CountViolation",
   "where": "Microsoft Graph (licenseAssignmentStates)",
   "group": "Microsoft 365",
   "guide": "Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes",
   "url": "https://www.oeltayeb.com/articles/microsoft-365-group-based-licensing-errors.html"
  },
  {
   "error": "DependencyViolation",
   "where": "Microsoft Graph (licenseAssignmentStates)",
   "group": "Microsoft 365",
   "guide": "Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes",
   "url": "https://www.oeltayeb.com/articles/microsoft-365-group-based-licensing-errors.html"
  },
  {
   "error": "LicenseAssignmentAttributeConcurrencyException",
   "where": "Microsoft Entra audit log",
   "group": "Microsoft 365",
   "guide": "Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes",
   "url": "https://www.oeltayeb.com/articles/microsoft-365-group-based-licensing-errors.html"
  },
  {
   "error": "MutuallyExclusiveViolation",
   "where": "Microsoft Graph (licenseAssignmentStates)",
   "group": "Microsoft 365",
   "guide": "Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes",
   "url": "https://www.oeltayeb.com/articles/microsoft-365-group-based-licensing-errors.html"
  },
  {
   "error": "Not enough licences",
   "where": "Microsoft 365 admin center (Errors & issues)",
   "group": "Microsoft 365",
   "guide": "Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes",
   "url": "https://www.oeltayeb.com/articles/microsoft-365-group-based-licensing-errors.html"
  },
  {
   "error": "ProhibitedInUsageLocationViolation",
   "where": "Microsoft Graph (licenseAssignmentStates)",
   "group": "Microsoft 365",
   "guide": "Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes",
   "url": "https://www.oeltayeb.com/articles/microsoft-365-group-based-licensing-errors.html"
  },
  {
   "error": "UniquenessViolation",
   "where": "Microsoft Graph (licenseAssignmentStates)",
   "group": "Microsoft 365",
   "guide": "Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes",
   "url": "https://www.oeltayeb.com/articles/microsoft-365-group-based-licensing-errors.html"
  }
 ]
}