Reading paths that build the full picture
Each series groups related guides in the order they're best read — from first setup, through the errors you'll meet, to verification. Pick a topic and start with part 1.
Windows Autopilot, end to end
Set Autopilot up from nothing, then work through the errors that stop a deployment: the Enrollment Status Page, redeployments and enrollment blocks.
-
1
IntuneHow-to
Windows Autopilot from scratch: register devices, build a user-driven profile and assign it
Set up Windows Autopilot end to end: tenant prerequisites, collecting and importing hardware hashes, group tags and dynamic groups, a user-driven Entra join profile, an Enrollment Status Page and the first test device.
-
2
IntuneTroubleshooting
Enrollment Status Page timing out during Autopilot: a step-by-step troubleshooting guide
Find the app or policy holding up the Enrollment Status Page, collect the right logs from OOBE, and fix the profile settings behind most Autopilot ESP timeouts.
-
3
IntuneTroubleshooting
Windows Autopilot error 0x80180014 when redeploying a device: cause and fix
A reused Autopilot device fails MDM enrollment with 0x80180014. Why it happens, and the documented fixes: unblock or remove the stale Intune record and check enrollment restrictions.
-
4
IntuneTroubleshooting
Windows enrollment error 0x80180018 and its neighbours: what to check, and where
Windows MDM enrollment fails with 0x80180018 or a nearby 0x8018 code. What Microsoft documents for each code, which tenant setting is behind it, and how to confirm the fix in the enrollment event log.
-
5
IntuneTroubleshooting
Intune device not checking in: diagnosing a Windows device that stopped syncing
A Windows device shows a stale last check-in in Intune and policies stop arriving. How check-in works, what to inspect on the device (service, tasks, certificate, network) and when to re-enroll.
-
6
IntuneHow-to
Windows Backup for Organizations with Intune: restore user settings on new devices
Turn on Windows Backup for Organizations and the tenant-wide restore page in Intune so users get their Windows settings back during setup: requirements, steps and fixes.
Win32 apps and the Intune Management Extension
Package an app, understand how the IME installs and detects it, read its logs, and move on to scripts and remediations.
-
1
IntuneHow-to
Packaging a Win32 app for Intune: .intunewin, install commands, detection and requirement rules
How to wrap an installer with the Win32 Content Prep Tool, choose silent install and uninstall commands, set install behaviour, return codes, requirement and detection rules, and pilot the app.
-
2
IntuneHow-to
Win32 app supersedence and dependencies in Intune: upgrade chains that don't break
Use supersedence to update or replace Win32 apps and dependencies to install prerequisites first: update vs replace, targeting, auto-update, limits, conflicts and IME logs.
-
3
IntuneTroubleshooting
Win32 app error 0x87D1041C: the app installed but Intune can't detect it
0x87D1041C means the installer finished but the detection rule found nothing. The usual causes (bitness, install context, version drift) and how to test detection on the device.
-
4
IntuneDeep dive
Reading Intune Management Extension logs: IME, AppWorkload and AgentExecutor explained
What each Intune Management Extension log records, how to read them with CMTrace, what to search for, how to force a check-in, and how to collect the logs remotely.
-
5
IntuneTroubleshooting
Intune PowerShell scripts not running: execution context, 64-bit, signing and where to look
An Intune platform script reports Failed or never runs. How the Intune Management Extension executes scripts, what the three script settings change, how retries and re-runs work, and where to look.
-
6
IntuneHow-to
Intune Remediations: detect and fix common Windows issues at scale
Set up Intune Remediations end to end: licensing and tenant attestation, the exit-code contract, run context, schedules, on-demand runs and reading the results.
Securing Windows with Intune
Choose the right policy type, then roll out BitLocker, Windows LAPS and Defender settings without conflicts.
-
1
IntuneDeep dive
Settings catalog, templates, baselines or endpoint security? Choosing the right Intune policy type
What each Intune policy type is for, how conflicts between them are resolved and reported, a recommended layering for a new tenant, and naming and assignment hygiene with filters.
-
2
IntuneTroubleshooting
BitLocker silent encryption not starting on Intune-managed devices: causes and fixes
Silent BitLocker not starting? Check TPM, UEFI, Secure Boot and WinRE, the required policy settings, startup authentication conflicts and recovery key backup to Microsoft Entra ID.
-
3
IntuneHow-to
Deploying Windows LAPS with Intune and backing up passwords to Microsoft Entra ID
Set up Windows LAPS end to end: enable it in Microsoft Entra ID, build the Intune account protection profile, retrieve and rotate passwords, and check the LAPS event log.
-
4
IntuneTroubleshooting
Finding and fixing Intune policy conflicts with the MDM diagnostic report
Settings stuck on Conflict in Intune? Find the competing policies, confirm what the device received with the MDM diagnostic report and event log, and rule out Group Policy.
-
5
IntuneTroubleshooting
Importing custom ADMX templates into Intune: upload errors, dependencies and fixes
Why custom ADMX and ADML uploads fail in Intune (missing namespaces, combo boxes, language and size limits), how to fix each one and how to prove the settings reached the device.
-
6
DefenderTroubleshooting
Defender Antivirus settings not applying from Intune: a troubleshooting checklist
Intune says the antivirus policy succeeded but the device disagrees. Check the management channel, conflicts, passive mode, tamper protection and exclusion behaviour to find out why.
Conditional Access, from zero to enforced
Deploy a safe baseline, test it in report-only mode, then decode the sign-in errors users hit when a policy blocks them.
-
1
Entra IDHow-to
A Conditional Access baseline: the first policies every tenant should deploy
The core Conditional Access policies to deploy first, how they map to Microsoft's templates and Microsoft-managed policies, and how to roll them out in report-only mode without locking anyone out.
-
2
Entra IDHow-to
Test before you enforce: Conditional Access What If and report-only mode
Use report-only mode, the sign-in logs, the insights workbook and the What If tool to prove a Conditional Access policy behaves as expected before you turn it on.
-
3
IntuneTroubleshooting
Noncompliant on the Default Device Compliance Policy? The three built-in checks explained
Why devices fail the built-in Is active, Enrolled user exists and Has a compliance policy assigned checks in Intune, and how to clear each one before Conditional Access blocks users.
-
4
Entra IDTroubleshooting
AADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
What AADSTS53000, 53001 and 53003 actually mean, how to find the blocking policy in the sign-in logs, and how to fix compliance and browser device-identity gaps.
-
5
Entra IDTroubleshooting
AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
What the MFA-related AADSTS codes mean, how to read the Authentication details and Conditional Access tabs of a sign-in, and how to fix legacy clients, unregistered users and authentication strength mismatches.
Device identity: hybrid join, PRT and Windows Hello
The identity plumbing behind every Intune device — how to check it, fix it and build passwordless sign-in on top.
-
1
Entra IDTroubleshooting
Troubleshooting Microsoft Entra hybrid join with dsregcmd /status
Read dsregcmd /status for hybrid join failures, check the SCP and Entra Connect sync, use the User Device Registration log and clear devices stuck in Pending.
-
2
Entra IDDeep dive
Primary Refresh Token (PRT) explained: fixing SSO and repeated sign-in prompts
How the Primary Refresh Token powers single sign-on on Windows, how to check it with dsregcmd and the AAD event logs, and how to fix a missing or stale PRT.
-
3
Entra IDHow-to
Deploying Windows Hello for Business with cloud Kerberos trust using Intune
Why cloud Kerberos trust is the recommended Windows Hello for Business model for hybrid tenants, how to create the Entra Kerberos server object, configure the Intune policy, and verify with dsregcmd and klist.
-
4
Entra IDHow-to
Temporary Access Pass: onboarding users to passwordless and Windows Hello for Business
Enable the Temporary Access Pass policy, issue passes in the portal or with Graph PowerShell, and use them to register passkeys, Authenticator and Windows Hello for Business.
-
5
Entra IDHow-to
Dynamic device groups for Intune: membership rules that actually work
Working dynamic device rules for Autopilot, group tags, OS version, ownership and enrollment profiles, plus licensing, processing time, rule validation and when filters fit better.
Defender for Endpoint with Intune
Onboard devices, fix the ones that don't report, manage settings everywhere, then roll out ASR rules and hunt across the fleet.
-
1
DefenderHow-to
Onboarding Windows devices to Defender for Endpoint with Intune (and proving it worked)
Connect Intune to Microsoft Defender for Endpoint, onboard Windows devices with an EDR policy, then prove it worked on the device, in the Defender portal and with a detection test.
-
2
DefenderTroubleshooting
Defender for Endpoint onboarding failures: SENSE event IDs, script errors and what they mean
A field guide to Defender for Endpoint onboarding failures: onboarding script error codes, SENSE Operational event IDs, Intune error codes, and the registry and service checks that show where it broke.
-
3
DefenderTroubleshooting
Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
What Inactive, Impaired communications and No sensor data mean in the Defender device inventory, and how to check the sensor, onboarding state, proxy and duplicate device records.
-
4
DefenderHow-to
Managing Defender settings on devices not enrolled in Intune: security settings management explained
How Defender for Endpoint security settings management pushes Intune endpoint security policies to devices not enrolled in Intune: prerequisites, enforcement scope, synthetic registration and pitfalls.
-
5
DefenderHow-to
Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
A phased plan for attack surface reduction rules in Intune: standard rules straight to Block, the rest in Audit, measured with advanced hunting, narrow exclusions, then enforce.
-
6
DefenderHow-to
Advanced hunting for Intune admins: KQL queries that answer everyday device questions
Eight short KQL queries for the Defender portal using documented tables: OS builds, sensor health, app versions, CVE exposure, antivirus posture, who ran a tool, ASR audit hits and network destinations.
Email authentication and mail flow
Get SPF, DKIM and DMARC right, trace messages that never arrive, and fix the NDRs and relay problems admins see most.
-
1
Exchange OnlineHow-to
SPF, DKIM and DMARC for your Microsoft 365 custom domain: a practical setup guide
Publish one correct SPF record, turn on DKIM signing in the Defender portal, then move DMARC from p=none to p=reject without blocking your own legitimate mail.
-
2
Exchange OnlineHow-to
Email never arrived? Using message trace in Exchange Online to find out why
Run a message trace in the Exchange admin center or with Get-MessageTraceV2, read the delivery status and events, and pull older data from downloadable reports.
-
3
Exchange OnlineTroubleshooting
NDR 550 5.4.1 “Recipient address rejected: Access denied”: Directory-Based Edge Blocking
Why Exchange Online rejects mail with 550 5.4.1 at the perimeter, how Directory-Based Edge Blocking and the accepted domain type cause it, and how to fix each common cause.
-
4
Exchange OnlineTroubleshooting
NDR 550 5.7.520: fixing “Your organization does not allow external forwarding”
Why Exchange Online blocks automatic forwarding to external addresses with 5.7.520, and how to allow it only for the mailboxes that need it instead of for everyone.
-
5
Exchange OnlineTroubleshooting
Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
What error 5.7.57 means, how SMTP AUTH client submission, SMTP relay and Direct Send differ, how to fix each cause, and where Basic authentication for SMTP AUTH stands.
-
6
Exchange OnlineHow-to
Mail flow rules that don't backfire: external sender tagging, priorities and exceptions
How Exchange Online evaluates mail flow rules, why the native External tag beats a subject-prefix rule, and how to test, order and audit rules without punching holes in EOP.
Intune and Autopilot known issues, 2026 edition
The problems Microsoft has documented this year — what they look like on a device, how to confirm you're hitting them, and the fix or workaround.
-
1
IntuneTroubleshooting
Windows Autopilot known issues in 2026: what's open, what's fixed and how to stay informed
A walkthrough of the Windows Autopilot known issues page as of October 2026: open and fixed items, deeper guidance on the January 2026 entries, and how to subscribe so new issues reach you first.
-
2
IntuneTroubleshooting
Hybrid join Autopilot deployments time out with 0x80004005: the 2026 known issue and the fix
Microsoft Entra hybrid join Autopilot deployments can time out with 0x80004005 on older Windows 11 builds. How to confirm the known issue, which KBs fix it and how to get devices onto a fixed build.
-
3
IntuneTroubleshooting
Pre-provisioning hybrid join fails when a policy needs a domain controller (0x800706FD)
Autopilot pre-provisioning for hybrid join fails in the technician flow when a policy such as a User Rights setting needs a domain controller. How to read the 0x800706FD event and fix the scoping.
-
4
IntuneTroubleshooting
Intune Connector for AD fails with SeLogonAsServicePrivilege when you bring your own gMSA
Configuring the Intune Connector for AD with your own gMSA can fail on the SeLogonAsServicePrivilege pre-check. The June 2026 known issue, the SkipByoMsaPrivilegeCheck fix and how to verify it.
-
5
IntuneTroubleshooting
Windows Autopilot device preparation: known issues and how to troubleshoot a failed run
What trips admins up in Autopilot device preparation, the known issues and their status as of October 2026, how to read the deployment status report, and the documented steps for a failed deployment.
-
6
IntuneTroubleshooting
Domain trust failures after KB5124008: Machine Identity Isolation explained for Intune admins
After the September 2026 Windows 11 updates some domain-joined devices lose their secure channel because Machine Identity Isolation is now honoured. How to find the policy, roll it back and verify.
-
7
IntuneTroubleshooting
Current Intune known issues that aren't your fault: Company Portal, Store apps, compliance messages
Five items Microsoft currently lists as Active on the Intune known issues page, what each looks like, what to tell users, how to work around it, and how to track the page and escalate properly.
-
8
IntuneTroubleshooting
Macs unexpectedly unenrolled from Intune: the MDM certificate renewal issue and how to recover
Why some Macs dropped out of Intune during MDM identity certificate renewal, Apple's fix in macOS 26.4, how to find and re-enroll affected devices, and how this differs from an expired Apple MDM push certificate.
-
9
IntuneHow-to
Is it me or is it Intune? Check service health, known issues and release notes first
A 10-minute checklist to rule out a service incident, a documented known issue or a gradual service release before you troubleshoot your tenant, plus what to collect for a support case and how to subscribe.
Compliance signals from Defender for Endpoint and health attestation
Why devices go noncompliant for reasons that have nothing to do with the user — risk scores, missing Sense clients and attestation endpoints — and how to fix each.
-
1
IntuneTroubleshooting
Noncompliant on the Defender "machine risk score" setting: the end-to-end checklist
Why a Windows device fails "Require the device to be at or under the machine risk score", and how to check the connector, onboarding, device identity and active alerts in the right order.
-
2
IntuneTroubleshooting
Windows 11 24H2 won't onboard to Defender for Endpoint: the missing Sense client (KB5043950)
Some Windows 11 24H2 devices ship without the Sense client, so Intune's EDR policy errors and the device never reaches Defender. How to detect it at scale with Remediations and add the capability.
-
3
IntuneTroubleshooting
Intune health attestation is moving to Azure Attestation: prepare before compliance breaks
Intune will evaluate BitLocker, Secure Boot and code integrity compliance through Microsoft Azure Attestation. Which endpoints to allow, how to test from a device, and how to find affected policies.
-
4
IntuneTroubleshooting
Noncompliant on the Default Device Compliance Policy? The three built-in checks explained
Why devices fail the built-in Is active, Enrolled user exists and Has a compliance policy assigned checks in Intune, and how to clear each one before Conditional Access blocks users.
-
5
DefenderTroubleshooting
Security settings management enrollment errors: decoding SenseCM EnrollmentStatus codes
A device is onboarded to Defender but never shows up as MDE-managed in Intune. Read HKLM\SOFTWARE\Microsoft\SenseCM\EnrollmentStatus, map the code to its cause and fix it.
Deadlines you can't ignore: 2026–2027 changes
Secure Boot certificates, EWS retirement, Azure Attestation, Windows 11 26H2 and mandatory MFA — what changes, when, and what to do before the date.
-
1
IntuneHow-to
Rolling out the 2023 Secure Boot certificates with Intune before the last 2011 CA expires
Which 2011 Secure Boot certificates expire and when, the Settings catalog Secure Boot settings, model-based filters for a staged rollout, and the Intune report and remediation that track progress.
-
2
IntuneTroubleshooting
Secure Boot certificate update not applying: registry values, event IDs and the Intune report
Read UEFICA2023Status, the AvailableUpdates bitmask and TPM-WMI events 1795 to 1808 to see where a Secure Boot certificate update is stuck, interpret the Intune report, and clear the common blockers.
-
3
Exchange OnlineTroubleshooting
EWS switch-off in Exchange Online: EwsEnabled, the app allow list and finding EWS usage
Exchange Web Services is being disabled in Exchange Online from October 2026. What changes, how EwsEnabled and EwsAllowedAppIDs work, how to find what still uses EWS and how to buy time safely.
-
4
IntuneTroubleshooting
Intune health attestation is moving to Azure Attestation: prepare before compliance breaks
Intune will evaluate BitLocker, Secure Boot and code integrity compliance through Microsoft Azure Attestation. Which endpoints to allow, how to test from a device, and how to find affected policies.
-
5
IntuneHow-to
Rolling out Windows 11 26H2 with Intune: feature update policy, known issues, safeguard holds
How 26H2 installs as an enablement package, the Intune feature update policy and rollout options to deploy it, the known issues listed at launch, how safeguard holds show up, and how to verify a device.
-
6
Entra IDTroubleshooting
Mandatory MFA for Azure and admin portals: fix scripts, service accounts and break-glass accounts
What mandatory MFA enforcement covers, the failures it causes for user-based automation and admin sign-ins, how to verify who is ready, moving scripts to workload identities, and MFA-capable break-glass accounts.
-
7
Entra IDTroubleshooting
Conditional Access now evaluates OIDC-only sign-ins: the 2026 baseline scopes change
Sign-ins requesting only openid, profile, email or User.Read are now subject to All resources policies with exclusions: who is affected, how to find the apps in sign-in logs, how to fix them, and the timeline.
Intune Suite and advanced capabilities
Beyond the basics: the Enterprise App Catalog, Cloud PKI, Endpoint Privilege Management, Remote Help, custom compliance and phased deployments — set up and troubleshot.
-
1
IntuneHow-to
Enterprise App Catalog in Intune: deploying third-party apps and keeping them updated
Add a prepackaged Win32 app from the Enterprise App Catalog, understand the prefilled install and detection settings, choose between auto-update and guided supersedence, and troubleshoot failed installs.
-
2
IntuneHow-to
Microsoft Cloud PKI: issuing device certificates for Wi-Fi and VPN without NDES
Build a two-tier Microsoft Cloud PKI hierarchy in Intune, deploy the trusted certificate and SCEP profiles, bind the certificate to Wi-Fi or VPN profiles, monitor and revoke, and fix the common SCEP errors.
-
3
IntuneHow-to
Endpoint Privilege Management in Intune: elevation settings, rules and user experience
Deploy Intune Endpoint Privilege Management: the elevation settings policy, elevation rules by hash or certificate, the user experience, the elevation reports, and how to troubleshoot rules that don't match.
-
4
IntuneHow-to
Remote Help in Intune: licensing, setup, helper roles, deployment and troubleshooting
Set up Remote Help end to end: check licensing, enable the tenant settings, grant least-privilege helper roles, deploy the Windows app, handle Conditional Access, and fix sessions that won't connect.
-
5
IntuneHow-to
Custom compliance in Intune: writing the discovery script and JSON rules
Extend Intune compliance with your own checks: write a discovery script that returns compressed JSON, define rules in the JSON schema, upload both, and troubleshoot error codes 65007 to 65010.
-
6
IntuneHow-to
Intune deployments (preview): stage Win32 apps and policies across deployment rings
Intune's new Deployments experience (preview): staging Win32 and Enterprise App Catalog apps, settings catalog and endpoint security policies across rings, permissions, how rings advance, and a ring design.
-
7
IntuneHow-to
Multi Admin Approval in Intune: protect wipes, scripts, apps and role changes
Configure Intune Multi Admin Approval so wipes, scripts, app deployments and role changes need a second admin: approver groups, access policies, the request flow and audit.
-
8
IntuneHow-to
Device query in Intune: KQL answers about one device or your whole fleet
Run KQL in Intune against one Windows device in real time or across your fleet's inventory: licensing, permissions, the properties catalog policy and queries you can reuse.
Identity governance and protection
Least privilege with PIM, access reviews that people actually complete, risk policies without the false positives, SSPR that works — and how to read the sign-in logs when it doesn't.
-
1
Entra IDHow-to
Privileged Identity Management: just-in-time Microsoft Entra roles done properly
Set up PIM for Microsoft Entra roles: role settings, eligible assignments, activation and approvals, PIM for Groups, alerts, access reviews, and the activation problems you'll hit.
-
2
Entra IDHow-to
Access reviews and entitlement management basics: a starter plan for Entra ID Governance
How access reviews and entitlement management fit together in Microsoft Entra ID Governance: licensing, creating reviews, catalogs and access packages, and a starter plan you can run this quarter.
-
3
Entra IDTroubleshooting
Microsoft Entra ID Protection: risk policies, self-remediation and false positives
User risk vs sign-in risk, the detections behind them, risk-based Conditional Access that lets users fix their own risk, and how to investigate, dismiss or confirm the false positives.
-
4
Entra IDTroubleshooting
Self-service password reset and password writeback: fixing the usual failures
SSPR prerequisites, password writeback through Connect Sync or Cloud Sync, the documented SSPR_00xx portal errors, the Windows sign-in screen Reset password link, and the event IDs behind writeback failures.
-
5
Entra IDDeep dive
Reading Microsoft Entra sign-in logs like an engineer
The four sign-in log types, the fields that matter, how to trace one failed sign-in end to end, KQL against the SigninLogs table, export and retention by licence, and the misreads that waste hours.
Hardening Windows endpoints with Defender and Intune
Close the gaps attackers use: vulnerability remediation through Intune, USB device control, tamper protection, web content filtering and attack surface reduction.
-
1
DefenderHow-to
Defender Vulnerability Management: from security recommendation to Intune security task
How exposure score, recommendations, software inventory and weaknesses fit together, and how a Request remediation in the Defender portal becomes a security task an Intune admin can close.
-
2
DefenderHow-to
Controlling USB and removable storage with Defender device control and Intune
Device control concepts (groups, rules, entries, access masks), the Intune Device Control profile with reusable settings, audit before block, printers, hunting queries and fixes when a USB stick stays writable.
-
3
DefenderTroubleshooting
Tamper protection and Intune: why a Defender setting won't change, and how to fix it
What tamper protection locks, the four places it can be managed and their precedence, how to see which one controls a device, and how to fix settings that won't apply or exclusions that aren't protected.
-
4
DefenderHow-to
Web content filtering in Defender for Endpoint: network protection, categories and indicators
Enable network protection from Intune, turn on web content filtering, build category policies scoped to device groups, add allow indicators, and read blocks in reports, Event Viewer and advanced hunting.
-
5
DefenderHow-to
Rolling out ASR rules safely: audit mode, exclusions and advanced hunting
A phased plan for attack surface reduction rules in Intune: standard rules straight to Block, the rest in Audit, measured with advanced hunting, narrow exclusions, then enforce.
Exchange Online administration essentials
The recipient and retention decisions every Microsoft 365 admin makes — groups vs shared mailboxes, rooms, archives, holds — plus the Outlook connectivity issues behind most mailbox tickets.
-
1
Exchange OnlineDeep dive
Distribution groups vs Microsoft 365 Groups vs shared mailboxes: which one to use and how to convert
A capability-by-capability comparison of distribution groups, dynamic groups, Microsoft 365 Groups and shared mailboxes, when to choose each, how to upgrade a DL and the PowerShell to answer the usual questions.
-
2
Exchange OnlineDeep dive
Shared mailbox automapping in Outlook: why it appears (or doesn't) and how to control it
How automapping really works, why group-based Full Access never automaps, how to switch it off per user, and how to keep sent items in the shared mailbox.
-
3
Exchange OnlineHow-to
Room and equipment mailboxes in Exchange Online: creation, booking policies and Room Finder
Create room and equipment mailboxes, tune Set-CalendarProcessing (auto-accept, conflicts, booking window, delegates), build room lists and Set-Place metadata for Room Finder, and fix the usual booking complaints.
-
4
Exchange OnlineHow-to
Retention policies, labels, MRM and litigation hold in Exchange Online: which one does what
Purview retention policies vs retention labels vs Exchange MRM tags vs litigation hold: what each does, what wins in a conflict, licensing, how to set them up and how to prove a mailbox is really on hold.
-
5
Exchange OnlineHow-to
Enabling and troubleshooting auto-expanding archiving in Exchange Online
Check licensing and the one-way switch, enable auto-expanding archiving org-wide or per user, make sure items actually move, and confirm extra storage was provisioned.
-
6
Exchange OnlineTroubleshooting
Outlook can't connect or set up the account: Autodiscover troubleshooting for Exchange Online
How classic Outlook finds Exchange Online, how to read Test E-mail AutoConfiguration and the Remote Connectivity Analyzer, and the usual culprits: DNS, stale on-premises Autodiscover, old clients and broken profiles.
Configuration Manager essentials: clients, content and deployments
Get clients installed and healthy, understand boundary groups and management points, then fix content distribution and application deployments.
-
1
Configuration ManagerTroubleshooting
Configuration Manager client won't install: reading ccmsetup.log and fixing common causes
Trace a failed Configuration Manager client install from client push to site assignment: ccm.log, ccmsetup.log, client.msi.log, return codes, MP lookup and boundaries.
-
2
Configuration ManagerTroubleshooting
Inactive and unhealthy Configuration Manager clients: CcmEval, client check and cleanup
Tell inactive clients from unhealthy ones, read CcmEval results on the device, repair WMI and broken clients safely, and clean up stale records with the right maintenance tasks.
-
3
Configuration ManagerDeep dive
Boundaries and boundary groups explained: site assignment, content location and fallback
How Configuration Manager clients use boundaries and boundary groups to pick a site, management point and content source, how fallback works, and how to verify it.
-
4
Configuration ManagerTroubleshooting
Management point unhealthy: mpcontrol.log, IIS checks and clients that can't find an MP
Diagnose an unhealthy Configuration Manager management point with mpcontrol.log, status message 5436, mplist and mpcert tests, IIS and SQL checks, and the client-side logs.
-
5
Configuration ManagerTroubleshooting
Content not reaching distribution points: distmgr.log, PkgXferMgr.log and validation
Follow content from the site server to a distribution point through distmgr.log, PkgXferMgr.log and smsdpprov.log, and know when to update, redistribute or validate.
-
6
Configuration ManagerTroubleshooting
Application stuck installing or failing detection: AppDiscovery, AppEnforce and CAS logs
Follow a failing Configuration Manager app through the client logs - evaluation, content, install and detection - and fix stuck installs, timeouts and 0x87D00324.
-
7
Configuration ManagerDeep dive
Collections that perform: query rules, incremental updates and collection evaluation
How Configuration Manager evaluates collections, and how to design limiting collections, query rules and update schedules that keep membership fresh without overloading the site.
-
8
Configuration ManagerHow-to
Extending hardware inventory: adding WMI classes and troubleshooting InventoryAgent.log
Add a WMI class to Configuration Manager hardware inventory, pilot it, and follow the data from InventoryAgent.log through MP_Hinv.log and dataldr.log to Resource Explorer.
Patching and OS deployment with Configuration Manager
Keep the software update point healthy, automate Patch Tuesday with ADRs, fix updates that won't install, keep the site current, then troubleshoot PXE and task sequences.
-
1
Configuration ManagerHow-to
Software update point and WSUS maintenance: cleanup, reindexing and supersedence
Keep your software update point healthy: enable the WSUS maintenance options, set supersedence rules, back up and reindex SUSDB on a schedule, and confirm it all in wsyncmgr.log.
-
2
Configuration ManagerHow-to
Automatic deployment rules for Patch Tuesday: a ring-based setup in Configuration Manager
Build one Patch Tuesday automatic deployment rule with pilot, early and broad deployments, an offset schedule and maintenance windows, then confirm each run in RuleEngine.log.
-
3
Configuration ManagerTroubleshooting
Updates not installing from Configuration Manager: WUAHandler.log, UpdatesDeployment.log
Follow a Configuration Manager update from scan to install: WSUS location, WUAHandler.log scan errors, Group Policy conflicts, content download and maintenance windows.
-
4
Configuration ManagerHow-to
Deploying and updating Microsoft 365 Apps with Configuration Manager
Install Microsoft 365 Apps from the Configuration Manager console, then update it through the software update point: products, client settings, channels, ADRs and the logs that prove it.
-
5
Configuration ManagerHow-to
Configuration Manager current branch upgrades: prerequisites, servicing and stuck installs
Prepare the site, get the update through the service connection point, pass the prerequisite check, install it, unstick downloads and installs, and finish the post-upgrade tasks.
-
6
Configuration ManagerTroubleshooting
PXE boot failing in Configuration Manager: SMSPXE.log, boundaries and the PXE responder
Work through a failing PXE boot in order: network and IP helpers, the PXE-enabled distribution point, boot images, deployments and unknown computers, reading SMSPXE.log at each step.
-
7
Configuration ManagerTroubleshooting
Reading smsts.log: troubleshooting Configuration Manager task sequence failures
Find smsts.log in every phase, keep the device on the error with F8, read the log from the failure upwards and fix driver, network, content and domain join failures.
Securing devices with Configuration Manager
BitLocker management, Defender Antivirus policies, configuration baselines, real-time queries with CMPivot and secure client communication.
-
1
Configuration ManagerHow-to
BitLocker management in Configuration Manager: replacing MBAM and escrowing recovery keys
Set up BitLocker management in Configuration Manager: recovery service, policy, portals and a clean move off stand-alone MBAM, plus the logs that prove recovery keys are escrowed.
-
2
Configuration ManagerHow-to
Managing Microsoft Defender Antivirus with Configuration Manager antimalware policies
Set up the Endpoint Protection point and client settings, build antimalware policies, choose security intelligence update sources and prove on the device that Defender got the settings.
-
3
Configuration ManagerHow-to
Configuration baselines in Configuration Manager: build, deploy and remediate drift
Build configuration items from registry, WQL and script settings, bundle them into a baseline, deploy it with remediation and prove on the client and in reports that drift gets fixed.
-
4
Configuration ManagerHow-to
CMPivot and Run Scripts: real-time queries and remediation in Configuration Manager
Set up CMPivot and Run Scripts permissions, query online clients in real time, take a PowerShell fix through approval, then confirm it in Script Status and Scripts.log.
-
5
Configuration ManagerDeep dive
Enhanced HTTP vs HTTPS: securing Configuration Manager client communication
What enhanced HTTP and PKI-based HTTPS each protect in Configuration Manager, why HTTP-only sites are deprecated, and how to check, switch and verify without stranding clients.
Co-management and cloud attach: from Configuration Manager to Intune
Enable co-management, fix enrollment, move workloads, connect through a cloud management gateway and tenant attach — then plan the move to cloud-native Intune.
-
1
Configuration ManagerHow-to
Enabling co-management on existing Configuration Manager clients: pilot and verification
Prepare hybrid join and automatic MDM enrollment, run the Cloud Attach wizard against a pilot collection, then prove on the device and in the Intune admin center that it is co-managed.
-
2
Configuration ManagerTroubleshooting
Co-management not working? CoManagementHandler.log, enrollment errors and workload status
Why Configuration Manager clients don't become co-managed: read CoManagementHandler.log and the MDM enrollment events, fix scope, licence and MFA causes, and check who owns each workload.
-
3
Configuration ManagerHow-to
Moving co-management workloads from Configuration Manager to Intune without surprises
A staged way to switch co-management workloads to Intune: what each slider really controls, pilot collections, the client logs to watch, rollback caveats and a sensible order.
-
4
Configuration ManagerHow-to
Cloud management gateway: deploying a CMG and fixing client connectivity
Deploy a Configuration Manager cloud management gateway on an Azure scale set, connect it to your site, bring internet clients onto it, and read the right logs when clients can't connect.
-
5
Configuration ManagerHow-to
Tenant attach: managing Configuration Manager devices from the Intune admin center
Upload Configuration Manager devices to the Intune admin center with tenant attach: prerequisites, enabling the upload, what admins can do there, RBAC, and fixing missing devices or failed actions.
-
6
Configuration ManagerHow-to
Autopilot into co-management: installing the Configuration Manager client during the ESP
Use Intune's co-management settings policy to install the Configuration Manager client from the CMG during Autopilot, keep the ESP within its timeout and check each stage.
-
7
Configuration ManagerDeep dive
From Configuration Manager to cloud-native Intune: a phased migration plan
A phased plan from Configuration Manager to Entra joined, Intune-managed Windows devices: assess, co-manage, move workloads, provision with Autopilot and retire on-premises dependencies.
-
8
Configuration ManagerTraining path
Training path: from Configuration Manager admin to co-management and cloud-native Intune
A 12-week plan for Configuration Manager admins: cloud attach, co-management, moving workloads to Intune and cloud-native Windows with Autopilot, with labs and Microsoft Learn resources.
Hybrid identity with Microsoft Entra Connect
Choose the sign-in method, run Entra Connect safely — staging mode, filtering, upgrades and health monitoring — fix sync errors and Seamless SSO, and move off AD FS.
-
1
Entra IDDeep dive
Password hash sync, pass-through authentication or federation: choosing hybrid sign-in
How PHS, pass-through authentication and AD FS federation work, what each depends on, how each fails, and a decision table for choosing and backing up your hybrid sign-in method.
-
2
Entra IDHow-to
Microsoft Entra Connect staging mode: swing migrations, disaster recovery and safe upgrades
Build an Entra Connect staging server from an exported configuration, prove what it would export with csexport, and switch the active server without surprises.
-
3
Entra IDHow-to
Filtering Microsoft Entra Connect Sync by OU, group and attribute without deleting users
Choose between OU, group and attribute filtering in Entra Connect Sync, preview every pending delete with csexport, and get past the accidental-delete threshold safely.
-
4
Entra IDHow-to
Keeping Microsoft Entra Connect Sync supported: versions, auto-upgrade, in-place upgrades
How Entra Connect Sync builds retire, the April 2027 application-based authentication deadline, what auto-upgrade won't do, and how to upgrade and verify safely.
-
5
Entra IDHow-to
Microsoft Entra Connect Health: installing the agents and acting on sync alerts
Licensing, prerequisites and registration for the Connect Health agents, sending alerts to people who act on them, and a playbook for the sync alerts you'll see most.
-
6
Entra IDTroubleshooting
Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
How to read Entra Connect export errors such as AttributeValueMustBeUnique, InvalidSoftMatch and LargeObject, fix matching problems with ms-DS-ConsistencyGuid, and find objects that filtering keeps out of Entra ID.
-
7
Entra IDTroubleshooting
Seamless SSO not working: the AZUREADSSOACC account, Kerberos and the intranet zone
Domain-joined users getting password prompts again? Decode the 8100x sign-in errors, then check the intranet zone, klist and the AZUREADSSOACC account and key.
-
8
Entra IDHow-to
Moving from AD FS to cloud authentication: inventory, staged rollout and domain cutover
A low-risk path off AD FS: inventory relying parties and claim rules, enable password hash sync, pilot with staged rollout, convert the domain with Graph PowerShell, then decommission.
-
9
Entra IDHow-to
Configuring Microsoft Entra hybrid join: SCP, targeted deployment and validation
Pilot Microsoft Entra hybrid join with a client-side SCP, get computer sync scope right, switch to the forest-wide SCP in Entra Connect and validate with dsregcmd and Graph.
Hardening Microsoft Entra ID
Emergency access accounts, the authentication methods policy, token protection, app registration hygiene and cross-tenant access.
-
1
Entra IDHow-to
Emergency access (break-glass) accounts in Microsoft Entra ID: set up, exclude and monitor
Build two cloud-only emergency access accounts with passkeys, keep them out of Conditional Access lockouts, alert on every sign-in and test them at least every 90 days.
-
2
Entra IDHow-to
Migrating to the authentication methods policy: retiring legacy MFA and SSPR settings
Move legacy MFA and SSPR method settings into the authentication methods policy: the three migration states, how each setting maps, and how to prove nobody gets locked out.
-
3
Entra IDHow-to
Token protection in Conditional Access: binding sign-in sessions to the device
What Conditional Access token protection binds, which platforms, apps and licences it needs, and how to roll it out in report-only mode using the sign-in log status codes.
-
4
Entra IDHow-to
App registrations and service principals: secrets, consent and over-privileged apps
Find expiring app secrets and certificates with Graph PowerShell, lock down user consent, enable the admin consent workflow and track down over-privileged service principals.
-
5
Entra IDDeep dive
B2B guest access and cross-tenant access settings: inbound, outbound and trust
How external collaboration settings and cross-tenant access settings fit together: default vs organizational settings, trusting partner MFA and devices, and B2B direct connect.
Exchange hybrid, end to end
Run the Hybrid Configuration Wizard, understand hybrid mail flow and certificates, enable modern authentication, manage remote mailboxes and migrate — then decide what happens to the last server.
-
1
Exchange ServerTroubleshooting
Hybrid Configuration Wizard failures: reading the HCW log and fixing common errors
Where the HCW log lives, how to find the line that really failed, and fixes for the usual causes: TLS, stale servers, Autodiscover, certificates, OAuth (HCW8064) and MRS.
-
2
Exchange ServerDeep dive
Exchange hybrid mail flow: connectors, TLS certificates and centralized mail transport
How the HCW connectors, certificate name matching and header trust keep cross-premises mail internal, when centralized mail transport is worth it, and how to prove it all works.
-
3
Exchange ServerHow-to
Renewing the Exchange hybrid certificate without breaking mail flow
A safe runbook for renewing the public certificate behind hybrid mail flow: install it on every server, enable SMTP, update the connectors or rerun the HCW, then prove TLS works.
-
4
Exchange ServerHow-to
Hybrid Modern Authentication for Exchange Server: enable HMA and validate Outlook sign-in
Prerequisites, SPN registration with Microsoft Graph PowerShell, EvoSTS and OAuth2ClientProfileEnabled, then proof that Outlook uses Bearer tokens for on-premises mailboxes.
-
5
Exchange ServerDeep dive
Exchange modern hybrid and the Hybrid Agent: when to use it and how to troubleshoot it
What the Exchange Hybrid Agent replaces, what still needs inbound access or classic hybrid, and how to check agent health, redundancy and the msappproxy.net endpoint.
-
6
Exchange ServerTroubleshooting
Hybrid free/busy not working: OAuth, the dedicated hybrid app and Test-OAuthConnectivity
A methodical way to troubleshoot hybrid free/busy and calendar sharing: direction, Autodiscover, the OAuth trust and dedicated hybrid app, connectors and relationships, with cmdlets for each hop.
-
7
Exchange ServerHow-to
Remote mailboxes in Exchange hybrid: Enable-RemoteMailbox, attributes and common mistakes
Create and manage Exchange Online mailboxes from on-premises the supported way: New- and Enable-RemoteMailbox, the attributes that matter, ExchangeGuid fixes and common mistakes.
-
8
Exchange ServerDeep dive
Cross-premises permissions in Exchange hybrid: Full Access, Send As and delegates
Which mailbox permissions work between Exchange Server and Exchange Online, how to make objects ACLable, and how to grant Full Access, Send on Behalf and Send As correctly.
-
9
Exchange ServerTroubleshooting
Hybrid mailbox migration batches: reading statuses, fixing common errors and completing the move
How a remote move batch works, what Syncing, Synced and Completing really mean, the documented errors (SMTP proxy, MRS Proxy 401, skipped items) and how to finish the cutover cleanly.
-
10
Exchange ServerTroubleshooting
Hybrid migration endpoint "could not be completed": fixing MRSProxy and 401 errors
Test-MigrationServerAvailability or a new hybrid migration batch fails against your on-premises endpoint? Check MRSProxy, credentials, publishing and certificates, then prove the fix.
-
11
Exchange ServerHow-to
Migrating public folders to Exchange Online: the batch steps and the errors that stop them
Move public folders from Exchange Server SE or 2019 to Exchange Online with Microsoft's batch scripts: prerequisites, lock-down, cutover and the errors that stall the batch.
-
12
Exchange ServerDeep dive
Removing the last Exchange server in hybrid: what's supported and how to manage recipients
All mailboxes are in Exchange Online but a server still runs just for recipient management? The supported ways to retire it, what you give up and the exact steps.
Exchange Server SE: lifecycle, upgrades and migrations
What Subscription Edition changes, your options now that 2016 and 2019 are out of support, how to upgrade or migrate to SE, which platforms it supports and what's currently known to break.
-
1
Exchange ServerDeep dive
Exchange Server Subscription Edition (SE): licensing, servicing and upgrade planning
What Exchange Server SE changes for on-premises Exchange: the Modern Lifecycle, entitlement-based licensing, how updates ship, and a practical checklist for planning your move.
-
2
Exchange ServerDeep dive
Exchange 2016 and 2019 are out of support: the risks, the ESU deadline and your options
Exchange 2016 and 2019 left support on 14 October 2025 and paid ESUs end with October 2026. The real risks, a decision table and the order of work to move to SE or Exchange Online.
-
3
Exchange ServerDeep dive
Exchange Server SE on Windows Server 2025: supported platforms, coexistence and planning
What Exchange Server SE supports: Windows Server 2019-2025, domain controllers, forest levels, .NET, Outlook clients and coexistence rules, plus a plan for moving to Windows Server 2025.
-
4
Exchange ServerHow-to
In-place upgrade from Exchange Server 2019 to Exchange Server SE, step by step
Upgrade Exchange Server 2019 CU14 or CU15 to Exchange Server SE in place: prerequisites, AD preparation, the Setup command, DAG maintenance mode, product keys and post-upgrade checks.
-
5
Exchange ServerHow-to
Exchange 2016 to Exchange Server SE migration: coexistence, namespaces and decommissioning
Exchange 2016 can't be upgraded in place to SE. The side-by-side route step by step: prepare AD, add SE servers, move namespaces, mail flow and mailboxes, then remove 2016.
-
6
Exchange ServerTroubleshooting
Exchange Server known issues in 2026: what's open, what's fixed and how to stay informed
The known issues Microsoft lists for the latest Exchange Server SE security update, the hybrid issues it fixed, how to confirm each one on your servers and where to watch for changes.
-
7
Exchange ServerTraining path
Training path: Exchange Server administrator, from deployment to troubleshooting
A 12-week, lab-based study plan for on-premises Exchange Server SE: deployment, mail flow, DAGs, client access, security, servicing and hybrid, with break-fix drills at every stage.
Security operations with Defender XDR
Handle an incident's first hour, understand automatic attack disruption, collect evidence with live response, keep identity sensors healthy, reduce exposure and train users.
-
1
DefenderHow-to
Your first hour with a Defender XDR incident: triage, scoping and containment
A time-boxed first hour for a Defender XDR incident: claim it, read the attack story, scope users, devices and mailboxes with hunting, contain safely and document the hand-off.
-
2
DefenderDeep dive
Automatic attack disruption in Defender XDR: what it does and how to prepare
What automatic attack disruption contains and why, the Defender settings it depends on, and how to exclude critical assets, review its actions and undo them safely.
-
3
DefenderHow-to
Live response in Defender for Endpoint: collecting evidence and running scripts safely
Set up Defender for Endpoint live response with guardrails: advanced features, unified RBAC roles, a signed script library, evidence collection and the session command log.
-
4
DefenderTroubleshooting
Defender for Identity sensors: installation and health issues on domain controllers
Classic v2.x or new v3.x sensor? Prerequisites, the Directory Service account and gMSA, the Health issues page and the fixes for the sensor health alerts you'll actually see.
-
5
DefenderDeep dive
Microsoft Security Exposure Management: initiatives, scores and attack paths explained
How Microsoft Security Exposure Management works: licensing and permissions, critical assets, initiative scores and targets, attack paths and choke points, and how it relates to Secure Score.
-
6
DefenderHow-to
Shadow IT with Defender for Cloud Apps and Defender for Endpoint: discover, warn, block
Use Defender for Endpoint as your Cloud Discovery source, judge apps by risk, then warn on Monitored apps or block Unsanctioned ones on devices through network protection.
-
7
DefenderHow-to
Attack simulation training in Defender for Office 365: a phishing campaign done right
Licences and roles, techniques, payloads, targeting, training and launch settings for a Microsoft phishing simulation, how to read the results, and where advanced delivery fits.
Managing Apple devices with Intune
Automated Device Enrollment, BYOD with account-driven User Enrollment, Platform SSO, app deployment, Defender onboarding and keeping Macs enrolled.
-
1
IntuneTroubleshooting
Apple ADE devices missing in Intune or stuck without an enrollment policy
Why Apple ADE devices don't appear in Intune or enroll without the right policy: device assignment, token sync limits and renewal, default policies, and why a reset is needed.
-
2
IntuneHow-to
Account-driven User Enrollment for iOS/iPadOS BYOD with Intune: setup and user flow
Set up account-driven User Enrollment for personal iPhones and iPads in Intune: Managed Apple Accounts, the service discovery file, JIT registration, the enrollment profile and the user flow.
-
3
IntuneHow-to
Platform SSO for macOS with Intune: setup, registration and troubleshooting
Build the Intune settings catalog policy for macOS Platform SSO, pick Secure Enclave, smart card or password, get Macs registered and fix the failures you will actually meet.
-
4
IntuneTroubleshooting
iOS/iPadOS apps not installing from Intune: VPP tokens, licences and installs stuck pending
Apple Business Manager apps assigned in Intune stay pending or fail on iPhones and iPads. How location (VPP) tokens and licences work, what the 0x87D13B error codes mean, and what to check in order.
-
5
IntuneTroubleshooting
Macs unexpectedly unenrolled from Intune: the MDM certificate renewal issue and how to recover
Why some Macs dropped out of Intune during MDM identity certificate renewal, Apple's fix in macOS 26.4, how to find and re-enroll affected devices, and how this differs from an expired Apple MDM push certificate.
-
6
DefenderHow-to
Onboarding macOS to Defender for Endpoint with Intune: profiles, app and onboarding package
The Intune deployment for Defender for Endpoint on Mac in the documented order: system extensions, Full Disk Access, network filter, background services, the app, the onboarding package, mdatp checks and fixes.
-
7
IntuneTroubleshooting
iOS/iPadOS configuration profiles failing in Intune: supervision, errors and conflicts
Why iPhone and iPad profiles show Error, Conflict, Pending or Not applicable in Intune, why supervised-only restrictions don't take effect, and how to check the device and prove the fix.
-
8
IntuneTroubleshooting
macOS PKG and DMG apps failing in Intune: 0x87D30137, 0x87D3013E and agent log fixes
Fix Intune macOS PKG and DMG app failures: the documented 0x87D3 error codes, LOB vs unmanaged PKG rules, Included apps detection, pre-install scripts, agent logs and verification.
-
9
IntuneTroubleshooting
macOS shell scripts and custom attributes not running in Intune: agent logs and fixes
Why Intune shell scripts and custom attributes don't run on Macs: the agent's 8-hour cycle, user vs root context, shebangs, exit codes and proxies, plus agent logs and Collect logs.
-
10
IntuneTroubleshooting
FileVault in Intune: enabling encryption, escrowing recovery keys and fixing 0x87D1138D
Why Macs don't encrypt or don't escrow a FileVault recovery key to Intune, what the encryption report's status details mean, and how to take over user-encrypted Macs and prove the key works.
-
11
IntuneTroubleshooting
macOS and iOS updates not installing in Intune: DDM settings, deadlines and fixes
Why Macs, iPhones and iPads don't update on time with Intune: legacy update policies that stopped working, DDM deadline settings, deferrals, the Apple updates reports and on-device checks.
Microsoft 365 tenant administration
Licensing, hardening, change management, audit and collaboration settings — the tenant-wide decisions every Microsoft 365 admin owns.
-
1
Microsoft 365How-to
A Microsoft 365 tenant hardening checklist: Secure Score, admin roles and risky defaults
A practical hardening pass for a Microsoft 365 tenant: track progress in Secure Score, then fix admin roles, app consent, legacy authentication, SMTP AUTH, risky defaults and auditing.
-
2
Microsoft 365Troubleshooting
Group-based licensing errors in Microsoft 365: conflicts, usage location and fixes
Why group-based licence assignments fail for some members, where to see the errors, how to list affected users with Microsoft Graph PowerShell, and how to fix and reprocess them.
-
3
Microsoft 365How-to
Microsoft 365 change management: Message center, service health and release preferences
A simple change routine for Microsoft 365: Message center preferences and digests, Planner sync, service health alerts, Targeted release and the Graph service communications API.
-
4
Microsoft 365How-to
Searching the audit log in Microsoft Purview: who did what, and when
Answer who did what in Microsoft 365: audit retention by licence, Purview audit search jobs, Search-UnifiedAuditLog for large result sets, and the operation names worth knowing.
-
5
Microsoft 365Deep dive
External access vs guest access in Microsoft Teams: configuring federation safely
How Teams external access (federation) differs from guest access, which Teams, Entra ID, Groups and SharePoint settings control each, and a safe baseline to apply.
-
6
Microsoft 365Deep dive
SharePoint and OneDrive external sharing explained: tenant, site and link settings
How organization, site and link settings combine to decide who can share what in SharePoint and OneDrive, with Set-SPOTenant and Set-SPOSite commands to audit and set them.
Data protection and Copilot readiness
Label and protect sensitive content, stop it leaking with DLP, and fix oversharing before Microsoft 365 Copilot surfaces it.
-
1
Microsoft 365How-to
Rolling out sensitivity labels in Microsoft Purview: policies, defaults and auto-labeling
A phased sensitivity label rollout: design a small taxonomy, publish with default labels, enable SharePoint and OneDrive support, then auto-label safely using simulation.
-
2
Microsoft 365How-to
Data loss prevention in Microsoft Purview: from simulation mode to enforcement
Take a Purview DLP policy from template to enforcement: simulate with policy tips, tune out false positives, onboard devices for endpoint DLP, then switch it on in stages.
-
3
Microsoft 365How-to
Preparing for Microsoft 365 Copilot: finding and fixing SharePoint oversharing
Copilot uses only what people can already open, so oversharing surfaces fast. Find it with data access governance reports, contain it, and fix it with site owners and labels.
Exchange Server mail flow: from NDR to fix
Decode the NDR, trace the message, read the protocol logs, then work through the queue errors and NDRs admins search for most — DNS, timeouts, back pressure, relay, authentication, loops, size limits and TLS.
-
1
Exchange ServerDeep dive
Exchange Server NDR and SMTP status codes: a quick reference with causes and fixes
Look up an Exchange Server NDR or queue status code: what each 4.x.x and 5.x.x code means, the usual on-premises or hybrid cause and the first cmdlet or setting to check.
-
2
Exchange ServerHow-to
Message tracking on Exchange Server: following an email with Get-MessageTrackingLog
Follow any email through Exchange Server SE or 2019: read the tracking event IDs, filter Get-MessageTrackingLog, search every server and set log retention.
-
3
Exchange ServerHow-to
SMTP protocol logging on Exchange: reading send and receive logs to debug connections
Turn on SMTP protocol logging on the right connector, find the log files and read a session line by line to spot TLS, authentication and relay failures.
-
4
Exchange ServerTroubleshooting
451 4.4.0 DNS query failed: fixing Exchange queues stuck in Retry
Queues stuck in Retry with 451 4.4.0 DNS query failed? Find the DNS servers transport really uses, test lookups from the Exchange server, and fix the resolver or connector.
-
5
Exchange ServerTroubleshooting
441 4.4.1 connection timed out and 421 4.4.2 connection dropped: stuck outbound queues
Outbound mail stuck in Retry with 441 4.4.1 or 421 4.4.2? Test port 25 and the smart host, read the send protocol log, fix the network or TLS cause and retry before 4.4.7 NDRs.
-
6
Exchange ServerTroubleshooting
452 4.3.1 Insufficient system resources: Exchange back pressure explained and fixed
Exchange answers 452 4.3.1 when back pressure kicks in. Find the resource under pressure, fix the cause or move the queue database, and confirm transport is back to normal.
-
7
Exchange ServerTroubleshooting
550 5.7.54 Unable to relay: configuring anonymous relay on Exchange Server safely
Apps get 550 5.7.54 when relaying to external recipients. Build a dedicated Frontend receive connector, allow only specific IPs to relay, and test it without creating an open relay.
-
8
Exchange ServerTroubleshooting
530 5.7.1 Client was not authenticated: fixing anonymous SMTP submission to Exchange
Why Exchange answers MAIL FROM with 530 5.7.1 Client was not authenticated, how to find the receive connector that answered, and how to fix scanners, apps and gateways safely.
-
9
Exchange ServerTroubleshooting
554 5.4.6 and 5.4.14 Hop count exceeded: finding and fixing Exchange mail loops
A hop count NDR means a message looped until a server gave up. Read the NDR, trace the loop with message tracking, and fix the accepted domain, connector or recipient behind it.
-
10
Exchange ServerTroubleshooting
550 5.1.1 RESOLVER.ADR.ExRecipNotFound and IMCEAEX NDRs: fixing them with X500 addresses
Internal mail bouncing to an IMCEAEX address with RESOLVER.ADR.ExRecipNotFound? Decode the old LegacyExchangeDN, add it back as an X500 proxy address and stop it happening again.
-
11
Exchange ServerTroubleshooting
550 5.3.4 ROUTING.SizeLimit and 5.2.3: every Exchange message size limit in one place
Large messages bouncing with 5.3.4 ROUTING.SizeLimit or 5.2.3 RecipSizeLimit? Every Exchange size limit with its default, how they interact and how to raise them safely.
-
12
Exchange ServerTroubleshooting
Event ID 12014: Exchange can't find a TLS certificate for a connector FQDN
Event 12014 means a connector has no usable certificate, so STARTTLS disappears. Line up the FQDN, certificate and TlsCertificateName, then prove TLS works again.
-
13
Exchange ServerTroubleshooting
Poison message queue and a stuck Submission queue in Exchange: causes and safe fixes
Messages in the poison queue, or a Submission queue that won't drain? Find what crashed or stalled transport, then export, resume or remove messages safely.
-
14
Exchange ServerTroubleshooting
EdgeSync failing with "The LDAP server is unavailable": re-creating the Edge Subscription
Edge Transport server not synchronizing? Check DNS, port 50636, services and certificates, re-create the Edge Subscription the supported way and prove it with Test-EdgeSynchronization.
Exchange Server databases and DAGs
Mount failures, corruption, runaway transaction logs, unhealthy copies, search indexes, replication queues, quorum, activation and mailbox moves — and how to patch a DAG without downtime.
-
1
Exchange ServerTroubleshooting
Exchange database won't mount: Dirty Shutdown, ec=1108, eseutil /mh and soft recovery
Mount-Database fails with ec=1108 and eseutil /mh says Dirty Shutdown? Find the logs Exchange needs, run soft recovery safely, and know when to restore or reach for eseutil /p.
-
2
Exchange ServerTroubleshooting
JET error -1018 and ESE event 474: page checksum corruption in an Exchange database
ESE event 474 and error -1018 mean a database page failed its checksum. Why storage is the usual suspect, how DAG page patching helps, and when to reseed, restore or repair.
-
3
Exchange ServerTroubleshooting
Exchange transaction logs filling the disk: backups, circular logging and safe recovery
Log volume filling up or databases dismounting? Find out why Exchange isn't truncating logs, free space safely with a backup or circular logging, and never delete logs by hand.
-
4
Exchange ServerTroubleshooting
Database copy FailedAndSuspended in an Exchange DAG: find the cause and reseed safely
A passive DAG copy in FailedAndSuspended won't heal itself. Read the real error, fix the disk or log problem behind it, reseed with Update-MailboxDatabaseCopy and prove the copy is healthy.
-
5
Exchange ServerTroubleshooting
Exchange content index Failed or Unknown: fixing search on Exchange 2016, 2019 and SE
ContentIndexState Failed or Unknown, or users can't find mail? Separate client from server problems, reseed or rebuild the Exchange 2016 catalog, and fix search on Exchange 2019 and SE.
-
6
Exchange ServerTroubleshooting
High CopyQueueLength or ReplayQueueLength in an Exchange DAG: causes and fixes
Passive DAG copies falling behind? Learn what the copy and replay queues measure, find out whether the network, storage or a lagged copy is responsible, and watch the queues drain.
-
7
Exchange ServerTroubleshooting
DAG cluster problems: lost quorum, file share witness errors and Event ID 1135
Event ID 1135 or 1177 on DAG members, databases dismounting or witness errors from Set-DatabaseAvailabilityGroup? See how DAG quorum works and fix the cluster, witness and network.
-
8
Exchange ServerHow-to
Unbalanced DAG? Fix activation preference and run RedistributeActiveDatabases.ps1
Why DAG databases stay active on the wrong member after failovers or patching, what blocks automatic rebalancing, and how to move them back with RedistributeActiveDatabases.ps1.
-
9
Exchange ServerHow-to
Patching a DAG without downtime: Exchange Server maintenance mode step by step
Put an Exchange Server DAG member into maintenance mode the supported way: drain transport, move databases, pause the cluster node, patch, then bring it back and prove it's healthy.
-
10
Exchange ServerTroubleshooting
StalledDueToTarget_MdbReplication and failed moves: fixing stuck Exchange mailbox moves
Read StatusDetail and the MRS report to tell throttling by design from real problems, then fix stalled or failed on-premises mailbox moves and resume them safely.
-
11
Exchange ServerHow-to
New-MailboxRepairRequest: fixing logical corruption in Exchange mailboxes
Detect and repair folder view, folder count, search folder and other logical mailbox corruption online with New-MailboxRepairRequest, then track it with Get-MailboxRepairRequest.
-
12
Exchange ServerDeep dive
Reclaiming Exchange database white space: new database vs offline defrag (eseutil /d)
Why Exchange databases never shrink, how to read AvailableNewMailboxSpace, and why moving mailboxes to a new database beats eseutil /d offline defragmentation.
Exchange Server setup, updates and upgrade errors
Get through prerequisites and AD preparation, install cumulative and security updates safely, and recover when setup fails, services stay disabled or components are left inactive.
-
1
Exchange ServerHow-to
Installing an Exchange cumulative update without surprises: a pre-flight checklist
A practical checklist for Exchange Server SE and 2019 cumulative updates: backups, Health Checker, AD preparation, maintenance mode, elevated setup and the checks that prove it worked.
-
2
Exchange ServerTroubleshooting
Exchange setup prerequisite errors: UCMA, Visual C++, .NET, URL Rewrite, pending restart
Exchange setup stopped at Prerequisite Analysis? Match each readiness error to the missing piece (UCMA 4.0, Visual C++, .NET, URL Rewrite, Windows features, pending restart) and fix it.
-
3
Exchange ServerTroubleshooting
Exchange PrepareSchema and PrepareAD errors: permissions, schema master and AD versions
Fix Exchange /PrepareSchema and /PrepareAD failures: missing Schema Admins or Enterprise Admins rights, wrong site or domain, unfinished replication and stale AD entries. Then verify AD versions.
-
4
Exchange ServerTroubleshooting
Setup previously failed while performing the action: recovering a failed Exchange upgrade
Exchange setup says it previously failed during Install or BuildToBuildUpgrade? Find the real error, resume with the same build and media, and treat Watermark cleanup as a last resort.
-
5
Exchange ServerTroubleshooting
Exchange components stuck Inactive after an update: ServerWideOffline and requesters
Mail flow or OWA down after an Exchange CU or SU? Check Get-ServerComponentState, find which requester holds ServerWideOffline Inactive, finish the update and reactivate safely.
-
6
Exchange ServerTroubleshooting
Exchange services disabled or not starting after a CU or security update (error 1058)
A failed or interrupted Exchange CU or SU can leave services Disabled. Restore the original startup types, start the services and finish the update properly.
-
7
Exchange ServerTroubleshooting
Installing Exchange Server security updates: preparation, failures and post-install checks
Why Exchange Server security updates fail or break OWA and ECP, the documented fixes for the common errors, and the checks that prove an update really installed on every server.
-
8
Exchange ServerTroubleshooting
Missing Exchange arbitration mailboxes: the errors they cause and how to recreate them
Migration batches, moderation, OAB generation or a CU upgrade failing? Check Exchange's seven arbitration mailboxes, then re-home or recreate broken and missing ones the supported way.
-
9
Exchange ServerTroubleshooting
Uninstalling an old Exchange server: mailboxes, connectors and errors that block removal
Exchange setup won't remove a server that still hosts hidden system mailboxes or DAG copies. Find them, move them, fix connectors and uninstall cleanly.
Exchange Server client access: OWA, Outlook, ActiveSync and EWS
When users can't connect: OWA and ECP errors, password prompts, Autodiscover, MAPI over HTTP, mobile devices, EWS apps, the offline address book, public folders and send permissions.
-
1
Exchange ServerTroubleshooting
OWA and ECP HTTP 500 errors on Exchange Server: usual causes and how to tell them apart
HTTP 500 or Server Error in '/ecp' on Exchange? Use the error text, IIS and HttpProxy logs to find the cause: a non-elevated update, a missing config file, certificates or app pools.
-
2
Exchange ServerTroubleshooting
OWA and ECP broken after certificate changes: fixing the Exchange Back End 444 binding
Blank OWA and ECP pages, EMS WinRM errors or Event 15021 after certificate work? Restore the self-signed Microsoft Exchange certificate on the Exchange Back End site's port 444 binding.
-
3
Exchange ServerTroubleshooting
Outlook keeps prompting for a password with Exchange Server: the usual causes and fixes
Outlook keeps asking for credentials against Exchange Server? Work through cached credentials, Autodiscover, virtual directory authentication, Kerberos, Extended Protection and modern auth.
-
4
Exchange ServerTroubleshooting
Autodiscover failing on Exchange Server: fixing SCP, DNS, 401 and certificate errors
Outlook can't build a profile or warns about an internal server name. Read the Test E-mail AutoConfiguration log, fix the SCP and DNS records, then clear 401, 404 and certificate failures.
-
5
Exchange ServerTroubleshooting
"The connection to Microsoft Exchange is unavailable": fixing Outlook on Exchange Server
Outlook shows Disconnected or can't create a profile against Exchange Server. Check the user's MAPI settings, Autodiscover, the MAPI virtual directory, healthcheck.htm and load balancer probes.
-
6
Exchange ServerHow-to
Exchange virtual directories: setting the URLs and resetting a broken one
Set consistent internal and external URLs on every Exchange virtual directory, then back up, reset or recreate a broken OWA, ECP, EWS or OAB directory safely.
-
7
Exchange ServerTroubleshooting
ActiveSync not syncing on Exchange Server: quarantine, Event ID 1053 and HTTP errors
Phones stop syncing or never start. Check the device access state and rules, fix the AD permission problem behind Event ID 1053, and read ActiveSync status codes in the IIS log.
-
8
Exchange ServerTroubleshooting
EWS errors on Exchange Server: 401, 503, ErrorServerBusy and impersonation failures
Apps using EWS fail with 401, 503, ErrorServerBusy or ErrorImpersonateUserDenied. Check authentication, server health, throttling policies, impersonation rights and the EWS logs.
-
9
Exchange ServerTroubleshooting
Offline address book not downloading in Outlook: fixing 0x8004010F and 0x80190194
Outlook can't download the offline address book from Exchange Server? Check the OAB assignment, web distribution, generation mailbox and OAB URL, then force a clean download.
-
10
Exchange ServerTroubleshooting
Public folders missing or not accessible in Outlook: hierarchy, mailboxes and permissions
Public folders missing, out of date or failing to open in Outlook? Check the public folder mailboxes, each user's hierarchy mailbox, hierarchy sync and folder permissions.
-
11
Exchange ServerTroubleshooting
554 5.2.0 SendAsDenied on Exchange Server: fixing Send As and Send on Behalf errors
Delegates get a SendAsDenied NDR when sending from a shared mailbox? Grant the right permission, allow for replication and caching, and fix stale Outlook addresses.
-
12
Exchange ServerTroubleshooting
POP3 and IMAP4 on Exchange Server: fixing NO LOGIN failed, missing banners and TLS errors
POP3 or IMAP4 clients can't connect or sign in? Start the right services, check PopProxy/ImapProxy, LoginType and the certificate, then prove the fix with a test login and protocol logs.
-
13
Exchange ServerHow-to
Exchange Server behind F5, Kemp or NetScaler: health checks, SSL and bad-VIP errors
Set up any load balancer for Exchange Server SE and 2019: per-protocol healthcheck.htm monitors, SSL bridging with Extended Protection, no affinity, SMTP and Kerberos, and bad-VIP symptoms.
Securing Exchange Server: certificates, TLS and authentication
Certificates and the Auth certificate, TLS hardening, Kerberos, modern authentication, Extended Protection, antivirus exclusions, Emergency Mitigation and checking a server for compromise.
-
1
Exchange ServerHow-to
Exchange Server certificates: renewing the SAN certificate and the Auth certificate
Renew the public SAN certificate on every Exchange server and rotate the Auth certificate before it expires, with the commands, the checks and the hybrid follow-up.
-
2
Exchange ServerTroubleshooting
Expired Exchange Auth certificate: OWA/EAC redirect loops, Event ID 1003 and hybrid errors
OWA and the EAC loop at sign-in, Event ID 1003 appears or hybrid OAuth fails? Prove the Exchange Auth certificate is expired or missing, then replace it safely.
-
3
Exchange ServerTroubleshooting
Outlook “The name on the security certificate is invalid”: Exchange URLs vs SAN names
Outlook keeps showing a certificate name Security Alert? Find the host name Exchange or DNS hands out, then fix the Autodiscover SCP, virtual directory URLs, split DNS or SAN list.
-
4
Exchange ServerHow-to
TLS hardening on Exchange Server: TLS 1.2, TLS 1.3 and ciphers without breaking mail flow
What Exchange Server SE and 2019 support for TLS 1.2 and TLS 1.3, the Schannel and .NET settings Microsoft documents, and how to find partners still on TLS 1.0 before you switch it off.
-
5
Exchange ServerHow-to
Kerberos for load-balanced Exchange Server: setting up the alternate service account (ASA)
Why Outlook falls back to NTLM behind a load-balanced namespace, and the fix: create the ASA account, deploy it with RollAlternateServiceAccountPassword.ps1, register SPNs, verify with klist.
-
6
Exchange ServerHow-to
Modern authentication for Exchange Server without hybrid: AD FS-based OAuth for Outlook
Pure on-premises Exchange can accept OAuth tokens from AD FS instead of passwords. Prerequisites, the AD FS application group, auth policies, Exchange and Outlook settings, and testing.
-
7
Exchange ServerHow-to
Extended Protection on Exchange Server: enabling it safely and fixing broken clients
What Extended Protection does, the TLS, NTLM and load balancer prerequisites, enabling it with Microsoft's script, and fixing the clients and hybrid features that break.
-
8
Exchange ServerHow-to
Antivirus on Exchange Server: the exclusions Microsoft documents and how to test them
The folders, processes and file extensions Microsoft says to exclude from antivirus on Exchange Server SE and 2019, how AMSI differs, and how to prove the exclusions work with Test-ExchAVExclusions.
-
9
Exchange ServerDeep dive
Exchange Emergency Mitigation service and AMSI: how they protect on-premises servers
How the Exchange Emergency Mitigation service and AMSI integration protect Exchange Server SE between updates, what they need to work, and the checks that prove they're doing their job.
-
10
Exchange ServerDeep dive
Is my Exchange server compromised? Checking with Microsoft's CSS-Exchange scripts
A structured compromise check for Exchange Server: Health Checker, Test-ProxyLogon, where web shells hide, the logs and Exchange settings attackers abuse, and what to do if you find something.
Running Exchange Server: shell, health and monitoring
Keep the server healthy: the Exchange Management Shell, RBAC, Health Checker, Managed Availability, the event IDs that matter, CPU and memory, and disk space.
-
1
Exchange ServerTroubleshooting
Exchange Management Shell: fixing WinRM 'Connecting to remote server failed' errors
EMS fails with a WinRM error? Match the exact message to its cause - kerbauth and WSMan modules, Remote PowerShell access, the port 80 binding, Require SSL or a proxy - and fix it safely.
-
2
Exchange ServerHow-to
Exchange Server RBAC: roles, scopes and "access denied" in the EAC and shell
How Exchange Server RBAC decides what an admin can do: roles, role groups, assignments and scopes, how to grant least privilege, and the usual causes of access-denied errors.
-
3
Exchange ServerHow-to
Running the Exchange Server Health Checker and fixing what it finds
Run Microsoft's Exchange Server Health Checker on every server, build the HTML report and fix the findings that come up most: missing updates, page file, TLS, KeepAlive and more.
-
4
Exchange ServerDeep dive
Managed Availability in Exchange Server: health sets, probes and why services restart
Why did Exchange recycle an app pool or reboot itself? How probes, monitors and responders work, how to trace what Managed Availability did, and when an override is justified.
-
5
Exchange ServerTroubleshooting
Topology discovery failed (event 2142): reading event 2080 and fixing Exchange DC access
Exchange services failing with event 2142? Read event 2080's columns, fix site, DNS, firewall and SACL right (event 2112) causes, and keep static domain controllers as a last resort.
-
6
Exchange ServerTroubleshooting
Event ID 2937 MSExchange ADAccess: fixing HomeMTA and other links to deleted objects
Event 2937 means an Exchange object still points into AD's Deleted Objects container. Find every affected object, then fix HomeMTA, RecipientContainer and connector links safely.
-
7
Exchange ServerTroubleshooting
Event ID 4999 on Exchange Server: reading MSExchange Common Watson crash reports
Decode MSExchange Common event 4999: which process failed, where and why, how to tell noise from real crashes, and how to match the report to bugs fixed in later updates.
-
8
Exchange ServerTroubleshooting
High CPU or memory on Exchange Server: what's normal and how to find the real cause
Store processes holding most of the RAM is by design; sustained high CPU isn't. Map the busy process to its cause - search, IIS app pools, transport - and capture evidence with ExPerfWiz.
-
9
Exchange ServerHow-to
Exchange Server running out of disk space: cleaning IIS, ETL and diagnostic logs safely
Free space on Exchange Server SE and 2019 safely: which IIS, diagnostic and search ETL logs you can delete, which files you must never touch, and how to schedule the cleanup.
Jamf Pro and Intune: integration, compliance and troubleshooting
How Jamf Pro and Microsoft Intune work together, then set up Device Compliance, migrate from the legacy integration and fix registration, Conditional Access and connector errors.
-
1
IntuneDeep dive
Jamf Pro and Microsoft Intune in 2026: how the integrations fit together
A map of the Jamf and Microsoft integrations in 2026: Device Compliance, the retired macOS integration, Platform SSO, Jamf Connect, Entra ID in Jamf Pro, threat defense and Defender.
-
2
IntuneHow-to
Set up Jamf Pro Device Compliance with Microsoft Entra ID and Intune, step by step
Build the Applicable and Compliance smart groups, run the Jamf Pro Device Compliance wizard, add the Intune compliance partner and require compliant Macs without blocking registration.
-
3
IntuneHow-to
Migrating from the legacy Jamf macOS Intune integration to Jamf Pro Device Compliance
Move Macs off Jamf Pro's retired macOS Conditional Access integration: what changes, an order of steps that avoids lockouts, Jamf's migration script, verification and a realistic rollback plan.
-
4
IntuneTroubleshooting
Mac registration fails from Jamf Self Service: Company Portal, jamfAAD and Entra ID errors
Fix Jamf Device Compliance registration on Macs: Account not onboarded, Device is already enrolled, keychain prompts, duplicate Entra devices and registrations that never turn compliant.
-
5
IntuneTroubleshooting
AADSTS53000 on a Jamf-managed Mac: compliant in Jamf Pro, blocked by Conditional Access
A Mac is compliant in Jamf Pro, yet Conditional Access returns AADSTS53000. Read the sign-in log, find the broken link (registration, compliance sync, browser or device ID) and fix it.
-
6
IntuneTroubleshooting
Jamf Device Compliance connector in Intune: partner status, permissions and sync errors
Jamf devices not reporting compliance to Entra ID? Check the Intune partner status, scoping, licences, the Entra apps Jamf's wizard creates, Jamf Pro smart groups and legacy leftovers.
-
7
IntuneHow-to
Jamf Pro iPhone and iPad with Intune: device compliance and app protection (IntuneMAMUPN)
Combine Jamf Pro device compliance for iPhone and iPad with Intune app protection: the partner connector, smart groups, IntuneMAMUPN keys, Conditional Access and how to verify each piece.
-
8
IntuneHow-to
Jamf mobile threat defense with Intune: MTD connector setup, device threat level and fixes
Connect Jamf's mobile threat defense to Intune: UEM Connect consent, the MTD connector, Jamf Trust activation, device threat level in compliance and app protection, and fixes when it fails.
-
9
IntuneDeep dive
Jamf Pro vs Intune for Mac and iPhone in 2026: strengths, gaps and when to run both
A balanced look at Jamf Pro and Microsoft Intune for Apple devices in 2026: declarative management, scripting and inventory, Self Service vs Company Portal, compliance, identity and when to run both.
Jamf and Microsoft: identity, apps and moving to Intune
Platform SSO, Jamf Connect and Entra ID sign-in, Entra ID as Jamf Pro's identity provider and SSO, deploying Defender and Microsoft 365 apps with Jamf, and moving devices to Intune.
-
1
IntuneHow-to
Platform SSO and the Microsoft Enterprise SSO plug-in on Jamf Pro-managed Macs
Configure the Microsoft Enterprise SSO plug-in and Platform SSO from Jamf Pro: payload values, Company Portal first, Device Compliance registration, verification and the errors to expect.
-
2
IntuneTroubleshooting
Jamf Connect with Microsoft Entra ID: app registration, login window and AADSTS errors
Fix Jamf Connect sign-in with Microsoft Entra ID: the app registration, ROPG password checks, Conditional Access after the June 2026 change, and the AADSTS errors at the Mac login window.
-
3
IntuneTroubleshooting
Jamf Pro with Entra ID as cloud identity provider: setup, group lookups and Graph errors
Connect Jamf Pro to Microsoft Entra ID as a cloud identity provider and fix what breaks: admin consent, Graph permissions, attribute mappings, nested groups and LDAP migration.
-
4
IntuneHow-to
Jamf Pro SSO with Microsoft Entra ID (SAML): setup, failover login and AADSTS errors
Set up SAML single sign-on from Microsoft Entra ID to Jamf Pro and Self Service, keep a working failover login, and fix the AADSTS50105, AADSTS50011 and AADSTS700016 sign-in errors.
-
5
IntuneHow-to
Deploy Microsoft Defender for Endpoint on Macs with Jamf Pro (and fix mdatp health errors)
Deploy Defender for Endpoint to Macs with Jamf Pro in the right order: onboarding plist, settings, permission profiles, a smart group gate and the package. Then read mdatp health and fix its errors.
-
6
IntuneHow-to
Deploy Microsoft 365 apps, Company Portal and Microsoft AutoUpdate to Macs with Jamf Pro
Deploy Microsoft 365 for Mac, Company Portal and Microsoft AutoUpdate with Jamf Pro: official packages, App Installers or policies, an MAU profile, activation and verification.
-
7
IntuneHow-to
Migrating Macs and iPhones from Jamf Pro to Intune: ADE reassignment and a cut-over plan
Plan a Jamf Pro to Intune move: map profiles and scripts, reassign ADE devices, choose OS 26 migration or a wipe, handle FileVault, Activation Lock and app licences, and fix enrollment errors.
Exchange Server with email security gateways
Put FortiMail, Barracuda, Mimecast, Proofpoint or Cisco Secure Email in front of Exchange without breaking mail flow — connectors, TLS, loops, rejection codes, transport agents and signature services.
-
1
Exchange ServerHow-to
Email gateway in front of Exchange Server: connectors, InternalSMTPServers and loops
A vendor-neutral checklist for any gateway in front of Exchange: a scoped receive connector, InternalSMTPServers, the header firewall, TLS, a smart host connector and no mail loops.
-
2
Exchange ServerTroubleshooting
FortiMail with Exchange Server: 550 5.7.1 Relay access denied, 451 and recipient checks
Fix the errors you hit when FortiMail filters mail for Exchange Server: 550 5.7.1 Relay access denied, 451 Try again later, failed recipient verification, plus connectors, TLS and SPF.
-
3
Exchange ServerTroubleshooting
Barracuda Email Protection with Exchange Server: connectors, smart host and 550 rejections
Connect Barracuda Email Gateway Defense or the Email Security Gateway to Exchange Server, and use message tracking plus Barracuda's Message Log to tell a Barracuda block from an Exchange fault.
-
4
Exchange ServerTroubleshooting
Mimecast with Exchange Server: 451 Open relay not allowed, connectors and rejection codes
Route Exchange Server mail through Mimecast: regional smart hosts, authorized outbound IPs or SMTP authentication, a scoped receive connector, and the Mimecast replies that point to each fix.
-
5
Exchange ServerTroubleshooting
Proofpoint with Exchange Server: connectors, TLS and the rejections admins see
Proofpoint in front of Exchange Server: scope the receive connector, relay outbound through Proofpoint, fix TLS and recipient lists, and work out which side wrote each rejection.
-
6
Exchange ServerTroubleshooting
Cisco Secure Email Gateway (IronPort) with Exchange Server: HAT, RAT and SMTP errors
Cisco Secure Email Gateway (formerly IronPort) in front of Exchange: map listeners, HAT and RAT to Exchange connectors, fix relay, rate-limit and TLS errors, and trace mail in both logs.
-
7
Exchange ServerDeep dive
Email gateway rejection codes (Mimecast, Cisco IronPort): a quick reference for Exchange
Look up a rejection or deferral from Mimecast, Barracuda, FortiMail or Cisco (IronPort) in front of Exchange Server, or Exchange's own reply to the gateway: meaning, who fixes it, first check.
-
8
Exchange ServerTroubleshooting
Third-party transport agents breaking Exchange mail flow (Trend Micro, ESET, Kaspersky)
Mail stuck in Submission, event 1050 or EdgeTransport crashes after adding or updating an on-server mail security product? Find the agent, isolate it safely and prove the fix.
-
9
Exchange ServerTroubleshooting
Email signatures on Exchange Server (Exclaimer, CodeTwo): routing, duplicates and NDRs
Signatures missing on some messages, added twice or causing loop NDRs? Find which agent, rule or service stamps your Exchange Server mail, fix it and prove it with message tracking.
Backup, archiving and DLP around Exchange Server
VSS and the Exchange Writer, Veeam, Backup Exec, NetBackup and Commvault, Enterprise Vault and journaling archives, IRM, Purview and Symantec DLP — and the errors each one throws.
-
1
Exchange ServerTroubleshooting
Microsoft Exchange Writer failed or Retryable error: fixing Exchange Server VSS backups
vssadmin shows the Microsoft Exchange Writer Failed or Retryable, or logs pile up after a 'successful' backup? Reset the writer, fix DAG conflicts and prove it with Windows Server Backup.
-
2
Exchange ServerTroubleshooting
Veeam Backup & Replication with Exchange Server: VSS writer errors and logs not truncating
Veeam jobs failing on the Microsoft Exchange Writer, or logs not truncating after a green job? Check application-aware settings, guest credentials, freeze timeouts and DAG job design.
-
3
Exchange ServerTroubleshooting
Veeam Explorer for Microsoft Exchange: ese.dll, Dirty Shutdown and permission errors
Veeam Explorer can't open an Exchange database or restore items? Point it at the right ese.dll, replay logs on a Dirty Shutdown copy, grant restore rights, or fall back to a recovery database.
-
4
Exchange ServerTroubleshooting
Veritas Backup Exec and Exchange Server: 0xE000FED1 writer errors, GRT and DAG backups
Backup Exec failing with 0xE000FED1, skipping DAG databases or leaving logs untruncated? Fix the Exchange writer, passive-copy settings, backup method and GRT requirements.
-
5
Exchange ServerTroubleshooting
NetBackup and Commvault with Exchange DAGs: passive copies, status 156 and VSS errors
DAG backups failing in NetBackup (status 156) or Commvault? Check the preferred server list, the passive copy and the Exchange writer, then prove which side is at fault.
-
6
Exchange ServerDeep dive
Exchange Server VSS backup error codes: writer states, VSS_E codes and first fixes
Look up a VSS error from an Exchange backup: 0x800423F3, 0x800423F4, 0x800423F2, 0x8004230F and other VSS_E codes, vssadmin writer states and related events, with first checks.
-
7
Exchange ServerTroubleshooting
Enterprise Vault and Exchange Server: event 3305, archiving tasks, throttling, shortcuts
Enterprise Vault archiving tasks failing to log on, stalling or leaving shortcuts that won't open? Check the Vault Service account, system mailboxes, throttling policy and add-ins.
-
8
Exchange ServerHow-to
Exchange Server journaling to Mimecast, Barracuda or Proofpoint: rules, connectors, NDRs
Send Exchange Server journal reports to a hosted archive: standard vs premium journaling, a hidden contact, a dedicated TLS send connector, JournalingReportNdrTo and proof of delivery.
-
9
Exchange ServerDeep dive
Purview DLP and sensitivity labels with Exchange Server: what works on-prem and in hybrid
Purview DLP covers Exchange Online mail; Exchange Server has its own DLP and needs IRM for encrypted mail. What each engine sees on-premises and in hybrid, and how to prove it.
-
10
Exchange ServerTroubleshooting
Exchange Server IRM with the RMS connector: fixing Test-IRMConfiguration failures
Test-IRMConfiguration failing on Exchange Server with the Microsoft RMS connector? Find the failing step, then fix authorization, registry settings, IRM switches or the DRM cache.
-
11
Exchange ServerTroubleshooting
Symantec DLP Network Prevent for Email with Exchange Server: modes, loops and queue errors
Network Prevent for Email behind Exchange Server: why reflecting mode loops with 5.4.6, how to set forwarding mode, ports and relay, and what the queues show when it's down.
-
12
Exchange ServerHow-to
DLP and encryption gateways for Exchange Server (Forcepoint, Trellix): routing and loops
A vendor-neutral design for sending Exchange Server mail through DLP and encryption gateways: forward vs return patterns, connectors, verdict headers, fail-open choices and tests.
Exchange Server error code references
One-page references for the codes Exchange admins search for: NDRs, ESE database errors, VSS and backup codes, Outlook and Autodiscover codes, gateway rejections, event IDs, shell errors and migration errors.
-
1
Exchange ServerDeep dive
Exchange Server NDR and SMTP status codes: a quick reference with causes and fixes
Look up an Exchange Server NDR or queue status code: what each 4.x.x and 5.x.x code means, the usual on-premises or hybrid cause and the first cmdlet or setting to check.
-
2
Exchange ServerDeep dive
Exchange database (ESE/JET) error codes: a quick reference with meanings and first fixes
Look up an ESE/JET error from eseutil, a failed mount or the event log: what -1018, -528, -550 and 36 more codes mean in Exchange Server, the usual cause and the first check.
-
3
Exchange ServerDeep dive
Exchange Server VSS backup error codes: writer states, VSS_E codes and first fixes
Look up a VSS error from an Exchange backup: 0x800423F3, 0x800423F4, 0x800423F2, 0x8004230F and other VSS_E codes, vssadmin writer states and related events, with first checks.
-
4
Exchange ServerDeep dive
Outlook, Autodiscover and OAB error codes with Exchange Server: a quick reference
Look up an Outlook, Autodiscover or OAB error against Exchange Server: what 0x8004010F, 0x80190194, GetLastError=12007 and 42 more codes mean, the usual cause and the first check.
-
5
Exchange ServerDeep dive
Email gateway rejection codes (Mimecast, Cisco IronPort): a quick reference for Exchange
Look up a rejection or deferral from Mimecast, Barracuda, FortiMail or Cisco (IronPort) in front of Exchange Server, or Exchange's own reply to the gateway: meaning, who fixes it, first check.
-
6
Exchange ServerDeep dive
Exchange Server event IDs by source: a quick reference for Transport, ESE, DAG and AD
Look up an Exchange Server event by ID and source: what 15004, 2142, 474, 1135, 4999 and 38 more events mean on Exchange SE and 2019, the usual cause and the first check.
-
7
Exchange ServerDeep dive
Exchange Management Shell and Active Directory errors: a quick reference with fixes
Match an Exchange Management Shell or Active Directory error to its cause: object not found, matches multiple entries, proxy address in use, INSUFF_ACCESS_RIGHTS, WinRM failures and more.
-
8
Exchange ServerDeep dive
Mailbox move and migration errors (MRS): a quick reference for Exchange Server and hybrid
Look up a move request status, StatusDetail or MRS exception: what Queued, StalledDueToTarget_*, TooManyBadItems and 30-plus more mean in Exchange Server and hybrid, and what to check first.
Intune third-party integrations
Connect Intune to the rest of your stack: threat defense, third-party certificate authorities, ServiceNow, Samsung Knox, Zebra, VPN clients, TeamViewer, compliance partners, SIEM, Android zero-touch and Apple Business Manager.
-
1
IntuneTroubleshooting
Intune MTD connectors (Lookout, Zimperium, Check Point): setup, threat levels and errors
Lookout, Zimperium or Check Point connected to Intune, yet devices are blocked, wrongly compliant or never report? Check the connector state, toggles, partner app and threat-level rules.
-
2
IntuneHow-to
Jamf mobile threat defense with Intune: MTD connector setup, device threat level and fixes
Connect Jamf's mobile threat defense to Intune: UEM Connect consent, the MTD connector, Jamf Trust activation, device threat level in compliance and app protection, and fixes when it fails.
-
3
IntuneHow-to
Intune SCEP with third-party CAs (DigiCert, Entrust, Sectigo, SCEPman): setup and errors
Issue Intune SCEP certificates from DigiCert, Entrust, GlobalSign, Sectigo, SCEPman or another partner CA: the Entra app, profiles, challenge validation, Wi-Fi/VPN linkage and errors.
-
4
IntuneHow-to
Intune ServiceNow connector: setup, incidents in the Troubleshooting pane and errors
Show ServiceNow incidents in Intune's Troubleshooting pane: licences, roles, the ServiceNow OAuth app and CORS rule, the connector, what the help desk sees and the setup errors.
-
5
IntuneTroubleshooting
Samsung Knox Mobile Enrollment and Knox Service Plugin with Intune: setup and errors
Samsung devices skipping KME, failing to enroll in Intune or ignoring Knox Service Plugin settings? Check the KME profile JSON, the token, device upload, network and the OEMConfig profile.
-
6
IntuneHow-to
Zebra devices with Intune: LifeGuard OTA firmware updates, OEMConfig and errors to watch
Manage Zebra Android devices in Intune: dedicated enrollment, Zebra OEMConfig profiles, LifeGuard OTA firmware deployments, and what Conflict, NOTAPPLICABLE and Failed to create mean.
-
7
IntuneTroubleshooting
Cisco, GlobalProtect, Zscaler and F5 VPN profiles in Intune: per-app VPN and errors
Third-party VPN profile failing in Intune? Pick profile vs app configuration per platform, fix the certificate chain, decode 2016281112 Remediation Failed and Conflict, and read client-side logs.
-
8
IntuneHow-to
TeamViewer with Intune: the new connector, sessions, common problems and Remote Help
Set up Intune's new TeamViewer connector, delegate sessions with RBAC, prepare TeamViewer (client, Device Sync, SSO), fix common launch problems and compare it with Remote Help.
-
9
IntuneHow-to
Third-party compliance partners in Intune (Workspace ONE, Ivanti, Citrix): setup and fixes
How Workspace ONE, Ivanti, Citrix and other MDMs report compliance to Entra ID through Intune: partner setup, device registration, Conditional Access, migration and why devices stay N/A.
-
10
IntuneHow-to
Intune diagnostic settings: send audit and device logs to Sentinel, Splunk or any SIEM
Route Intune audit, operational, compliance and device logs to Log Analytics, Event Hubs or storage, then on to Microsoft Sentinel or Splunk, with sample KQL and checks.
-
11
IntuneTroubleshooting
Android zero-touch enrollment with Intune: reseller setup, DPC extras and common errors
Fix Android zero-touch devices that skip Intune: reseller registration, linking the zero-touch account, DPC extras JSON and tokens, and the checksum and Conditional Access errors.
-
12
IntuneHow-to
Federating Apple Business Manager with Microsoft Entra ID: Managed Apple Accounts and sync
Link Apple Business (formerly Apple Business Manager) to Microsoft Entra ID: approve, test and turn on federation, sync users, handle account conflicts and fix sign-in failures.
Intune and Autopilot error code references
One-page references for Windows enrollment, Autopilot, app install, Apple, Android, profile and compliance codes, plus the Entra sign-in errors device admins meet.
-
1
IntuneDeep dive
Windows enrollment error codes in Intune (0x8018…, 0x801C… and more): a quick reference
Look up a Windows enrollment or Entra join failure: what 0x80180018, 0x8018002b, 0x801c03f2 and dozens more codes mean, the usual cause in an Intune tenant and the first check.
-
2
IntuneDeep dive
Windows Autopilot error codes (0x800705B4, 0x801C03EA, 0x80070774…): a quick reference
Look up a Windows Autopilot failure: what 0x800705B4, 0x801C03EA, 0x80070774, 0x81039001, event 807, import error 808 and more mean, the usual cause and the first check.
-
3
IntuneDeep dive
Intune app installation error codes (Win32, MSI, Store, iOS, Android): a quick reference
Look up a failed Intune app install: what 0x87D1041C, 0x87D300C9, 0x80070643, 0x8A15001B, 0x87D13B7E, 0xC7D14FB5 and 50 more codes mean, the usual cause and the first check.
-
4
IntuneDeep dive
iPhone, iPad and Mac enrollment and MDM errors in Intune: a quick reference
Look up an Apple enrollment error in Intune: NoEnrollmentPolicy, DeviceCapReached, APNs and ADE token sync errors, Profile Installation Failed and Mac messages, with the first check.
-
5
IntuneDeep dive
Android Enterprise enrollment and management errors in Intune: a quick reference
Look up an Android error in Intune: DeviceCapReached, Company Portal Temporarily Unavailable, work profile and corporate enrollment blocks, Play Integrity and other compliance failures.
-
6
IntuneDeep dive
Intune profile and compliance error codes (65000, 0x87D1FDE8 and more): a quick reference
Look up an Intune profile or compliance result: what 65000, 0x87D1FDE8, SyncML 404/500, iOS payload codes, compliance states and BitLocker status details mean, and the first check.
-
7
IntuneDeep dive
Microsoft Entra AADSTS sign-in errors on Intune and Jamf devices: a quick reference
Look up an AADSTS code from a managed device: what 53000, 50155, 135011, 50076, 7000218 and 39 more mean for Intune and Jamf admins, the usual cause and the first check.
Intune troubleshooting beyond the basics
Error 65000 and remediation failures, Windows Hello provisioning, BitLocker key escrow, Store and Win32 download errors, MAM for Windows, Graph automation errors, Microsoft Tunnel, drivers, Linux, Android COPE and device actions.
-
1
IntuneTroubleshooting
Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes
Windows profile showing error 65000 or Remediation failed (0x87D1FDE8)? Decode the codes, read event 404 on the device, check edition, build and OMA-URI data, and fix the setting.
-
2
IntuneTroubleshooting
Windows Hello for Business provisioning errors in Intune: 0x801C03ED, Event 360 and more
Fix Windows Hello for Business PIN setup failures on Intune PCs: the 0x801C and 0x8009 codes, Event ID 360 prerequisite lines, conflicting policy sources and dsregcmd checks.
-
3
IntuneTroubleshooting
BitLocker recovery key not in Microsoft Entra ID (event 846): escrow failures and fixes
Encrypted device but no recovery key in Intune? Read BitLocker events 845 and 846, fix the join state and policy, re-escrow with BackupToAAD-BitLockerKeyProtector and prove it worked.
-
4
IntuneTroubleshooting
Win32 app errors in Intune: 0x87D30065 downloads, exit code 1603 and Delivery Optimization
Win32 app stuck downloading or failing with 0x87D30065, 1603 or 1618? Find the failing stage in AppWorkload.log, fix content delivery and installer exit codes, then verify.
-
5
IntuneTroubleshooting
Microsoft Store apps failing in Intune: WinGet 0x8A15… codes, 0x87D1041C and fixes
Microsoft Store app (new) installs failing? Decode the WinGet 0x8A15 codes, check Store and App Installer policies, TLS inspection and install context, then test on the device.
-
6
IntuneTroubleshooting
Intune app protection for Windows (MAM in Edge): setup, Conditional Access and errors
Edge keeps asking Windows users to sign in, or MAM never applies? Check prerequisites, the Conditional Access grant, the Edge profile and the Windows Security Center connector.
-
7
IntuneTroubleshooting
Intune automation with Microsoft Graph: fixing 401, 403 and 429 throttling errors
Why Intune scripts on Microsoft Graph fail with 401, 403 Forbidden or 429 Too Many Requests: permission types, admin consent, Intune roles, the 2025 scripts permission change, paging and retries.
-
8
IntuneTroubleshooting
Microsoft Tunnel for Intune: installation, mst-cli, health checks and connection errors
Fix Microsoft Tunnel Gateway problems: stalled installs, Unhealthy health checks, TLS certificate issues, /dev/net/tun and Podman log errors, and devices that won't connect.
-
9
IntuneHow-to
Windows driver and firmware updates in Intune: approvals and why drivers don't show up
Set up Windows driver update policies in Intune, choose automatic or manual approval, and fix the settings that leave the driver list empty or stop approved drivers installing.
-
10
IntuneTroubleshooting
Linux devices in Intune (Ubuntu, RHEL): enrollment, compliance and common errors
Fix Ubuntu and RHEL devices that won't register, stay Not evaluated or Not compliant, or get blocked in Microsoft Edge: supported versions, compliance checks, journalctl logs and a clean reset.
-
11
IntuneTroubleshooting
Android fully managed and COPE enrollment errors in Intune: tokens, QR codes and sign-in
Fix Android fully managed and corporate-owned work profile enrollments that fail during setup: device and token checks, QR code and afw#setup, Google downloads, Conditional Access and registration.
-
12
IntuneHow-to
Intune wipe, retire, Fresh Start and Autopilot Reset: what each removes and why they fail
Pick the right Intune remove-data action: what wipe, retire, Fresh Start and Autopilot Reset remove and keep, what they need to run, and why actions stay pending or fail.
Certification study plans
Stage-by-stage training paths for the Microsoft exams that matter to endpoint, identity, security and Microsoft 365 admins.
-
1
IntuneTraining path
Training path: becoming a Microsoft Intune administrator (MD-102 study plan)
A five-stage plan for Exam MD-102 and the Endpoint Administrator Associate certification: the current skills-measured domains, the Microsoft Learn paths to follow, lab exercises and exam-day tips.
-
2
Entra IDTraining path
Training path: Microsoft Entra ID for administrators (SC-300 study plan)
A six-stage study plan for exam SC-300, mapped to the official Microsoft Learn learning paths, with hands-on labs for Conditional Access, authentication methods, PIM, access reviews, apps and Entra Connect.
-
3
DefenderTraining path
Training path: SC-200 Security Operations Analyst study plan (Defender XDR and Sentinel)
A stage-by-stage study plan for exam SC-200 (Security Operations Analyst Associate): the current skills-measured domains, the Microsoft Learn paths to follow, hands-on labs and exam-day tips.
-
4
Exchange OnlineTraining path
Training path: MS-102 Microsoft 365 Administrator study plan with Exchange Online depth
A six-stage MS-102 study plan built on the official Microsoft Learn paths, with extra Exchange Online practice, lab ideas and what the November 2026 retirement of the exam means for you.
Want a series on something else?
Tell me which Microsoft 365 workload or problem area you'd like covered end to end, and it may become the next reading path.