I noticed that none of my proactive remediations are running anymore. It's not just the reports not updating as I can see that none of the scripts are executing any more. Is this just a me thing or a service issue? My last run was on 1/27.

Is Microsoft Sentinel integration into the Microsoft Defender (security.microsoft.com)--unified SecOps--really not available in GCC? The feature I am referring to is the one that lets you view and query Microsoft Sentinel in Advanced Hunting. Microsoft Sentinel will appear in the left hand Navigation once the integration has been turned on. Microsoft Support claims the feature isn't available in GCC. The documentation makes it seem like it should be available for all GCC and GCC-H tenants.

So I was directed to treat our users as customers and reminded that our mission is to give them great customer service. So, I looked over how our customer support team supports our customers and borrowed a few ideas for the IT help desk.

I will implement the following:

1. Base SLAs off the purchased support tier. I will offer various support tiers to all departments then charge them back for the price of the support tier they choose.

2. Upsell products and services to customers. If a user calls into the helpdesk for an issue, we should also pitch them new equipment and software upgrades. If they complain about how long tickets are taking, we should upsell higher tier support offerings.

Loving all these prompts right above the toolbars offering help for things I'm rarely, if ever, going to do. "Need help moving this VM to a new region?" No, it's already where it's supposed to be.

Say you have 1000 devices enrolled into Intune via Zero-Touch and now you need to point them to another Intune tenant. How do they expect this to be done? There don't seem to be any official docs explaining moving devices between MDMs or Intune tenants. Supposedly you can only have one instance Zero-Touch connected to an MDM at a time and disconnecting it from an MDM immediately triggers a retire lment of those devices. Does anyone have any experience doing with this? If so, what did you do?

The use-case is:

Roughly 150 staff want to apply a digital signature backed by a publicly trusted certificate to the reports they author. They are primarily going to be signing their own documents as the author of the document without requiring anyone else to sign it afterward. The workflow could be summed as: Create report. Sign report. Give customer report.

IT does not want to get into the run our own PKI game and does not have a need to perform device or user authentication using certificates. Our organization is Azure AD-only (no AD domain and not Azure AD-DS) and only uses SaaS apps.

Does anyone know of some good services to fulfill this request or does anyone have any experience wit

I got a barrage of tickets this morning saying the system is down. I looked at my VMs and they're all powered on. So I promptly closed all the tickets. Some manager comes by and starts yelling at me about lost productivity. I show him the systems being on so there is no problem to fix. He shows me his laptop with a 403 error. I tell him, I'm a sysadmin, not a net admin or desktop support. I also tell him that if he wants net admin support or desktop support then he and his team need to put the tickets into the right queue so the appropriate staff can handle them. He starts yelling at me saying how ridiculous it is and going off about how there is only one person in IT. I tell him that we're

So going down this rabbithole for fun. The goal was to see--with minimal infrstructure--what kind of MFA option is achievable using Microsoft solutions. While Microsoft considers Hello as MFA, I would argue that it's just a convenience login with some security perks because you can always skip using it and go straight to the password. There is little point to MFA if you can opt out of going through it on any login.

It turns out you can actually disable password sign ins using one of two policies. It works but it leaves you with a rather serious issue. You can no longer sign in if you don't have WHfB already configured. On an autopilot device this isn't an issue for the first user because yo

So in Feb the VA added a bunch of cybersecurity VAAR clauses. Reading through it, it seems to have this chain:

1. If you have VA information (information that comes from the VA) then the FAR basic safeguarding clause is required.
2. If the FAR basic safeguarding clause is required then the new VAAR basic safeguarding clause is required.
3. If the VAAR basic safeguarding clause is required then VAAR 852.204-71 is required.
4. VAAR 852.204-71 states you must comply with VA Directive 6500 which is the VA's internal cybersecurity program.
5. 6500 mandates NIST 800-171 if there is CUI or "VA sensitive information"

So all contracts from the VA are now potentially in scope of NIST 800-171? The

I am not referring to GCC-High.

If you move from M365 E5 to M365 G5 in GCC, will that trigger a tenant-to-tenant migration for Intune? I have 100% of all my endpoints in ABM, Android Enterprise, Autopilot and they're all in Intune with the Windows devices being AADJ-Only (not hybrid). I'm trying to figure out if a Commerical to GCC migration is going to result in me having to wipe and reenroll every single device in my company.

Has anyone done this migration before? If so, care to share anything about your experience?

It seems it also wiped out:

1. target.lnk files contained within any Network Locations
2. Some start up items are now missing (likely linked to the missing app shortcuts)
3. Public desktop shortcuts for various applications may be missing.
4. Start Menu items (user or system level) may now be missing.
5. Pinned documents and recent lists may be missing items

Has anyone noticed any others? Is there a log of what it removed? I can't seem to find any logged entries for ALL of the .lnk files it wiped.

I'm not sure where to start on this one but I found an AADJ-only device that has about 40 different bit locker keys. The device is only two years old. Any ideas on what to even look at to figure out why it is rotating so much?

Scenario

You installed Windows on a device registered in Autopilot and had to add a storage driver during the installation. You issue a wipe command at some point in the future. The device begins Windows Reset as usual and drops out of the device list in MEM once Windows Reset begins. When you check on the device itself, it's on the OS recovery screen. Restarting the device brings you back to the login screen. The device is no longer managed in MEM and nothing was erased.

Cause

Windows Recovery Environment is missing the storage controller and thus cannot access the storage drive during Windows Reset.

Solution

Add the needed storage controller driver to the Windows Recovery Enviro

On 4/27/2022 there were several back to back AMAs with some of the product team for MEM. Here are the recordings listed under past events for anyone interested:

Microsoft Endpoint Manager - Microsoft Tech Community

It may give a better understanding of how they envision using MEM and what their gaps are. A good example of a gap being the lack of understanding of why admins would need to directly set registry keys.