Conditional Access, device identity, hybrid join, PRT and passwordless — the identity layer every Intune fix depends on.
Sign-ins requesting only openid, profile, email or User.Read are now subject to All resources policies with exclusions: who is affected, how to find the apps in sign-in logs, how to fix them, and the timeline.
What the MFA-related AADSTS codes mean, how to read the Authentication details and Conditional Access tabs of a sign-in, and how to fix legacy clients, unregistered users and authentication strength mismatches.
Architecture differences, the Learn feature comparison, when each sync tool fits, and the documented pilot-OU migration from Connect Sync to Cloud Sync with cloudNoFlow and JoinNoFlow rules.
Build two cloud-only emergency access accounts with passkeys, keep them out of Conditional Access lockouts, alert on every sign-in and test them at least every 90 days.
Pilot Microsoft Entra hybrid join with a client-side SCP, get computer sync scope right, switch to the forest-wide SCP in Entra Connect and validate with dsregcmd and Graph.
How external collaboration settings and cross-tenant access settings fit together: default vs organizational settings, trusting partner MFA and devices, and B2B direct connect.
Deploy a safe baseline, test it in report-only mode, then decode the sign-in errors users hit when a policy blocks them.
Start the series 5 partsThe identity plumbing behind every Intune device — how to check it, fix it and build passwordless sign-in on top.
Start the series 5 partsLeast privilege with PIM, access reviews that people actually complete, risk policies without the false positives, SSPR that works — and how to read the sign-in logs when it doesn't.
Start the series 9 partsChoose the sign-in method, run Entra Connect safely — staging mode, filtering, upgrades and health monitoring — fix sync errors and Seamless SSO, and move off AD FS.
Start the series 5 partsEmergency access accounts, the authentication methods policy, token protection, app registration hygiene and cross-tenant access.
Start the seriesSymptom, root cause, fix — and how to verify it.
Step-by-step setup guides with the exact settings.
How a feature really works, and how to choose.
Study plans for MD-102, SC-300, SC-200 and MS-102.
Tell me which error or task you'd like covered next — new guides come from readers' questions.
