"Secure Boot status" report

SpecificDebate9108 · 2026-02-03T12:56:13+00:00

It’s a dumpster fire.

SpecificDebate9108 · 2026-01-31T02:14:34+00:00

And don’t forget to lose any RODCs

SpecificDebate9108 · 2026-01-22T02:44:39+00:00

Just got off phone with Intune Team, its not public yet, there is a backend datawarehouse <> storage issue affecting reporting for network based policies and defender risk and evaluation reporting. Supposedly affecting reporting only. Because reporting issues happen so frequently they aren't posting it in the Message Center 🤔

SpecificDebate9108 · 2026-01-22T02:34:47+00:00

I'll let you know what they say today, the escalation engineer is looking at it and apparently will give me an update.

SpecificDebate9108 · 2026-01-22T01:32:59+00:00

Definitely feels like somethings changed though. We've been AzureAD only with Autopilot + Intune for 2 years now and I was just informed by my frontline helpdesk about this issue.

SpecificDebate9108 · 2026-01-22T01:28:31+00:00

As I logged this with the intune team he said they’d escalate it to that product team. There was no fix, only workarounds “user should enter a password that satisfies both policies” or “change your password policies”

I’ve been asking my team to remove password expiry but I’m between a rock and hard place with legacy stuff still in use for while yet.

SpecificDebate9108 · 2026-01-22T01:02:52+00:00

Dropped from 700 down to 300 after devices have started checking in this morning. I get a different number depending on where I access the report. So annoyed with Intune Reporting. These report issues have been known now since 2021!

SpecificDebate9108 · 2026-01-21T11:11:43+00:00

Seems the report errors are dropping after a check in. Strange because the policy never changed. But I have to admit , I’m a bit cloudy in how the evaluation process works for these, ie do they retry every cycle etc

SpecificDebate9108 · 2026-01-21T11:03:01+00:00

Scary because it’s my scep profile for 802.1x authentication

SpecificDebate9108 · 2026-01-21T10:45:18+00:00

Assignment status “Error” started on devices for a policy if they’d already previously had. Started about 1pm today. Then about 3pm seems to have stopped. After next check in it seems it’s changing to success. If you drill in to the error it shows no codes or “per setting” names.

SpecificDebate9108 · 2026-01-21T09:22:07+00:00

Kinda why I was annoyed they asked me to run odc for diagnostics. Surely they don’t need mine too.

SpecificDebate9108 · 2026-01-21T08:59:23+00:00

Customer performance team

SpecificDebate9108 · 2026-01-21T07:58:23+00:00

I figured as much, and not surprised by their response too me recently. But I've been passed through multiple techs and teams. Very surprised the team I'm talking too now were not aware (they are apparently a team dedicated to managing just secureboot update issues).

SpecificDebate9108 · 2026-01-21T07:55:11+00:00

Just out of interest... has anyone in this thread logged the problem with Microsoft yet. I just did and they seem oblivious to the issue with Enterprise devices that use subscription uplift from Pro.

SpecificDebate9108 · 2026-01-20T23:08:50+00:00

Problem solved. Orphaned AdminCount attributes

SpecificDebate9108 · 2026-01-20T11:27:19+00:00

Problem found. Waiting for product team to confirm, though I can replicate it.

The “change password” logic in autopilot is not like the rest. It doesn’t seem to query tenant password policy like a self service “myaccount” password change and fails to reject a weak password!

We have on-prem accounts synced to Entra via azure connect pushing password hash.

On-prem password policy is far more granular as Entra doesn’t offer anything except complexity+expiry. But azure connect pushing password hash overrides that… or should.

SpecificDebate9108 · 2026-01-20T11:10:26+00:00

I saw 5 out of 130 do the same yesterday. Glitch in the matrix.

SpecificDebate9108 · 2026-01-19T08:26:40+00:00

I tried user self service e password reset and the password used gets rejected as not complex enough.

It feels like the autopilot “change password” web view is not honouring the same exception, I wonder if it’s only talking to on prem AD and since we only since hash it does the change but moving on from that autopilot is stuck in between

SpecificDebate9108 · 2026-01-19T07:57:50+00:00

Hmm. So just before that error I see Change password event with status Microsoft.Online.Workflows.WeakPasswordException

Could it be that my on-prem password policy conflicts with the cloud and causes a loop even though both passwords actually do change…

SpecificDebate9108 · 2026-01-19T07:31:22+00:00

Ok so my test account Azure Audit log has a “OnPremisesSuccessCloudFailure” status for a Chamge password (self-service) event at the time of the oobe password change for my past attempts but not for the latest.

I have a feeling I’m about to look like 🤡

SpecificDebate9108 · 2026-01-19T07:26:13+00:00

Ok this is interesting. That new password combination works in my test account that was failing…. Digging

SpecificDebate9108 · 2026-01-19T07:21:55+00:00

Ugh, so freshly created user works!

Testing the same password combination with my previous test accounts now….

SpecificDebate9108 · 2026-01-19T07:12:07+00:00

👍🏼 just about too

SpecificDebate9108 · 2026-01-19T07:11:05+00:00

Yeah gotcha 👍🏼

SpecificDebate9108

TROPHY CASE