Entra ID Toolkit — oeltayeb.com
===============================

Conditional Access, Primary Refresh Token, hybrid join and PIM checklists, walkthroughs for the AADSTS errors users actually report, Entra Connect sync errors, and a reference for reading sign-in logs like an engineer.

Every file in this folder is a self-contained HTML page: open it in any browser and use Print / save as PDF.
Each resource was derived from an article on https://www.oeltayeb.com and links back to it — read the article when you need
the reasoning behind a step.

Contents
--------
- conditional-access-deployment-checklist.html — Checklist: Conditional Access deployment checklist
    source: https://www.oeltayeb.com/articles/conditional-access-baseline-policies-every-tenant.html
- prt-troubleshooting-guide.html — Checklist: PRT troubleshooting guide
    source: https://www.oeltayeb.com/articles/primary-refresh-token-sso-troubleshooting.html
- hybrid-join-troubleshooting-checklist.html — Checklist: Hybrid join troubleshooting checklist
    source: https://www.oeltayeb.com/articles/hybrid-join-troubleshooting-dsregcmd.html
- pim-implementation-checklist.html — Checklist: PIM implementation checklist
    source: https://www.oeltayeb.com/articles/entra-privileged-identity-management-just-in-time-roles.html
- aadsts53000-aadsts53003-conditional-access-blocks-checklist.html — Checklist: AADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
    source: https://www.oeltayeb.com/articles/aadsts53000-aadsts53003-conditional-access-blocks.html
- aadsts50076-aadsts50079-aadsts50158-mfa-errors-checklist.html — Checklist: AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
    source: https://www.oeltayeb.com/articles/aadsts50076-aadsts50079-aadsts50158-mfa-errors.html
- entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch-checklist.html — Checklist: Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
    source: https://www.oeltayeb.com/articles/entra-connect-sync-errors-duplicate-attribute-invalidsoftmatch.html
- sign-in-log-reading-reference.html — Reference: Sign-in log reading reference
    source: https://www.oeltayeb.com/articles/entra-sign-in-logs-reading-like-an-engineer.html

Related PowerShell scripts (read-only by default, MIT licence)
--------------------------------------------------------------
- Export-EntraConditionalAccessPolicies.ps1: Backs up every Conditional Access policy to JSON and builds a human-readable CSV summary.
- Get-EntraAppCredentialExpiry.ps1: Reports app registration client secrets and certificates that are expired or expiring soon.
- Get-EntraMFARegistrationReport.ps1: Reports the MFA, passwordless and SSPR registration posture of users in Microsoft Entra ID.
- Get-EntraPrivilegedRoleMembers.ps1: Reports who holds Microsoft Entra directory roles, including active assignments and PIM-eligible assignments.
- Get-EntraStaleGuestUsers.ps1: Finds guest accounts that never signed in, have been inactive for a number of days, or never accepted their invitation.
  https://github.com/omer-eltayeb/M365-Intune-Admin-Scripts

Licence
-------
Free to use and share within your organisation; please link to www.oeltayeb.com when you redistribute.

© Omer Eltayeb · https://www.oeltayeb.com · Shared free for the Microsoft community. Verify settings in a test tenant first.
