Checklist
Autopilot ESP troubleshooting checklist
Find the app or policy holding up the Enrollment Status Page, collect the right logs from OOBE, and fix the profile settings behind most Autopilot ESP timeouts.
Downloadable toolkits
Troubleshooting toolkits you can print and reuse
Checklists, log references and decision trees distilled from the guides on this site — free for the Microsoft community. Every resource links back to the full article it came from, so you can trust the steps and go deeper when you need to.
37resources
4toolkits
38source articles
Intune · 15 resources
Intune Troubleshooting Toolkit
Checklists for the enrollment, Win32 app, compliance, BitLocker, script and device-sync problems that fill an Intune admin's week, plus the Intune Management Extension log reference and an enrollment decision tree — each distilled from a full guide on this site.
12 checklists · 2 references · 1 decision tree
Checklist
Win32 app troubleshooting checklist
0x87D1041C means the installer finished but the detection rule found nothing. The usual causes (bitness, install context, version drift) and how to test detection on the device.
Checklist
Windows Autopilot error 0x80180014 when redeploying a device: cause and fix
A reused Autopilot device fails MDM enrollment with 0x80180014. Why it happens, and the documented fixes: unblock or remove the stale Intune record and check enrollment restrictions.
Checklist
Windows enrollment error 0x80180018 and its neighbours: what to check, and where
Windows MDM enrollment fails with 0x80180018 or a nearby 0x8018 code. What Microsoft documents for each code, which tenant setting is behind it, and how to confirm the fix in the enrollment event log.
Checklist
Compliance policy troubleshooting checklist
Why devices fail the built-in Is active, Enrolled user exists and Has a compliance policy assigned checks in Intune, and how to clear each one before Conditional Access blocks users.
Checklist
Android enrollment troubleshooting checklist
A practical checklist for failed Android personally owned work profile enrollments: Managed Google Play, restrictions, licences, device requirements, existing profiles and logs.
Checklist
iOS/iPadOS & Apple ADE troubleshooting checklist
Why Apple ADE devices don't appear in Intune or enroll without the right policy: device assignment, token sync limits and renewal, default policies, and why a reset is needed.
Checklist
Intune device not checking in: diagnosing a Windows device that stopped syncing
A Windows device shows a stale last check-in in Intune and policies stop arriving. How check-in works, what to inspect on the device (service, tasks, certificate, network) and when to re-enroll.
Checklist
BitLocker silent encryption not starting on Intune-managed devices: causes and fixes
Silent BitLocker not starting? Check TPM, UEFI, Secure Boot and WinRE, the required policy settings, startup authentication conflicts and recovery key backup to Microsoft Entra ID.
Checklist
Intune PowerShell scripts not running: execution context, 64-bit, signing and where to look
An Intune platform script reports Failed or never runs. How the Intune Management Extension executes scripts, what the three script settings change, how retries and re-runs work, and where to look.
Checklist
Hybrid join Autopilot deployments time out with 0x80004005: the 2026 known issue and the fix
Microsoft Entra hybrid join Autopilot deployments can time out with 0x80004005 on older Windows 11 builds. How to confirm the known issue, which KBs fix it and how to get devices onto a fixed build.
Checklist
Graph API / inventory export checklist
Export your Intune device inventory to CSV with the Microsoft Graph PowerShell SDK, spot stale and noncompliant devices, and run it unattended with certificate-based app-only sign-in.
Reference
IME log reference
What each Intune Management Extension log records, how to read them with CMTrace, what to search for, how to force a check-in, and how to collect the logs remotely.
Reference
Intune log collection & MDM diagnostics guide
Settings stuck on Conflict in Intune? Find the competing policies, confirm what the device received with the MDM diagnostic report and event log, and rule out Group Policy.
Decision tree
Enrollment & Autopilot troubleshooting decision tree
Start from what you see on the device and follow the branches to the guide that fixes it — 9 enrollment and Autopilot failures on one printable page.
Open / print
9 source articles
Defender · 7 resources
Defender Toolkit
Onboarding, antivirus policy, attack surface reduction, tamper protection and sensor-health checklists for Microsoft Defender for Endpoint on Windows and macOS, including the Sense event IDs you need when onboarding goes wrong.
7 checklists
Checklist
MDE onboarding checklist
Connect Intune to Microsoft Defender for Endpoint, onboard Windows devices with an EDR policy, then prove it worked on the device, in the Defender portal and with a detection test.
Checklist
Defender Antivirus troubleshooting checklist
Intune says the antivirus policy succeeded but the device disagrees. Check the management channel, conflicts, passive mode, tamper protection and exclusion behaviour to find out why.
Checklist
ASR rules rollout & troubleshooting guide
A phased plan for attack surface reduction rules in Intune: standard rules straight to Block, the rest in Audit, measured with advanced hunting, narrow exclusions, then enforce.
Checklist
Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
What Inactive, Impaired communications and No sensor data mean in the Defender device inventory, and how to check the sensor, onboarding state, proxy and duplicate device records.
Checklist
MDE onboarding validation: Sense event IDs
A field guide to Defender for Endpoint onboarding failures: onboarding script error codes, SENSE Operational event IDs, Intune error codes, and the registry and service checks that show where it broke.
Checklist
Tamper protection and Intune: why a Defender setting won't change, and how to fix it
What tamper protection locks, the four places it can be managed and their precedence, how to see which one controls a device, and how to fix settings that won't apply or exclusions that aren't protected.
Checklist
Onboarding macOS to Defender for Endpoint with Intune: profiles, app and onboarding package
The Intune deployment for Defender for Endpoint on Mac in the documented order: system extensions, Full Disk Access, network filter, background services, the app, the onboarding package, mdatp checks and fixes.
Entra ID · 8 resources
Entra ID Toolkit
Conditional Access, Primary Refresh Token, hybrid join and PIM checklists, walkthroughs for the AADSTS errors users actually report, Entra Connect sync errors, and a reference for reading sign-in logs like an engineer.
7 checklists · 1 reference
Checklist
Conditional Access deployment checklist
The core Conditional Access policies to deploy first, how they map to Microsoft's templates and Microsoft-managed policies, and how to roll them out in report-only mode without locking anyone out.
Checklist
PRT troubleshooting guide
How the Primary Refresh Token powers single sign-on on Windows, how to check it with dsregcmd and the AAD event logs, and how to fix a missing or stale PRT.
Checklist
Hybrid join troubleshooting checklist
Read dsregcmd /status for hybrid join failures, check the SCP and Entra Connect sync, use the User Device Registration log and clear devices stuck in Pending.
Checklist
PIM implementation checklist
Set up PIM for Microsoft Entra roles: role settings, eligible assignments, activation and approvals, PIM for Groups, alerts, access reviews, and the activation problems you'll hit.
Checklist
AADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
What AADSTS53000, 53001 and 53003 actually mean, how to find the blocking policy in the sign-in logs, and how to fix compliance and browser device-identity gaps.
Checklist
AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
What the MFA-related AADSTS codes mean, how to read the Authentication details and Conditional Access tabs of a sign-in, and how to fix legacy clients, unregistered users and authentication strength mismatches.
Checklist
Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
How to read Entra Connect export errors such as AttributeValueMustBeUnique, InvalidSoftMatch and LargeObject, fix matching problems with ms-DS-ConsistencyGuid, and find objects that filtering keeps out of Entra ID.
Reference
Sign-in log reading reference
The four sign-in log types, the fields that matter, how to trace one failed sign-in end to end, KQL against the SigninLogs table, export and retention by licence, and the misreads that waste hours.
Exchange Online · 7 resources
Exchange Online Toolkit
Mail-flow checklists for message trace, SPF/DKIM/DMARC, the NDRs admins meet most often, compromised-mailbox investigation and anti-spam tuning, plus the SMTP AUTH relay reference for printers and apps.
6 checklists · 1 reference
Checklist
Email never arrived? Using message trace in Exchange Online to find out why
Run a message trace in the Exchange admin center or with Get-MessageTraceV2, read the delivery status and events, and pull older data from downloadable reports.
Checklist
SPF/DKIM/DMARC setup checklist
Publish one correct SPF record, turn on DKIM signing in the Defender portal, then move DMARC from p=none to p=reject without blocking your own legitimate mail.
Checklist
NDR 550 5.7.520: fixing “Your organization does not allow external forwarding”
Why Exchange Online blocks automatic forwarding to external addresses with 5.7.520, and how to allow it only for the mailboxes that need it instead of for everyone.
Checklist
NDR 550 5.4.1 “Recipient address rejected: Access denied”: Directory-Based Edge Blocking
Why Exchange Online rejects mail with 550 5.4.1 at the perimeter, how Directory-Based Edge Blocking and the accepted domain type cause it, and how to fix each common cause.
Checklist
Compromised mailbox investigation checklist
Microsoft's response order for a compromised mailbox, cmdlets that find malicious inbox rules and forwarding across every mailbox, what to read in sign-in and audit logs, and how to harden afterwards.
Checklist
Legitimate email landing in Junk: how EOP decides and the right way to fix it
Read the X-Forefront-Antispam-Report header (CAT, SFV, BCL, compauth) to see why a good message was junked, then fix it the supported way: submissions, Tenant Allow/Block List, sender authentication, not bypass rules.
Reference
Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
What error 5.7.57 means, how SMTP AUTH client submission, SMTP relay and Direct Send differ, how to fix each cause, and where Basic authentication for SMTP AUTH stands.
Suggest a resource
Missing a checklist you'd use every week?
Tell me which problem you keep solving by hand — the next checklist, log reference or decision tree may come from your suggestion.