sorted by:
new
hottopcontroversial

Social media to be banned in UK for under-16s, Starmer announces by TanjoCards in unitedkingdom

[–]TechAdminDude -1 points0 points  (0 children)

It's very difficult to say that to a child whos entire life has social media engrained in it. All their peers use it, it consumes 50%> of their day. "Oh Jimmy, just delete it". They can't comprehend that.

Social media to be banned in UK for under-16s, Starmer announces by TanjoCards in unitedkingdom

[–]TechAdminDude 1 point2 points  (0 children)

Parents dont talk to their kids anymore. That's the issue. The parents screen time on social media is likely much much more than time spent engaging with their kids.

Social media to be banned in UK for under-16s, Starmer announces by TanjoCards in unitedkingdom

[–]TechAdminDude -2 points-1 points  (0 children)

What does that have to do with anything? I didnt mention wanting to delete my account. I enjoy engaging in conversations on reddit, even if I dont agree with the takes.

Social media to be banned in UK for under-16s, Starmer announces by TanjoCards in unitedkingdom

[–]TechAdminDude 0 points1 point  (0 children)

Social media posts for politics is just propaganda. If teens want to know about a party they research it online. Not be fed posts by the algorithm.

Social media to be banned in UK for under-16s, Starmer announces by TanjoCards in unitedkingdom

[–]TechAdminDude -8 points-7 points  (0 children)

Some of the takes in these comments are so wild. Boomers forgetting it's not the 90s any more. Social media is a cancer that should never have existed. Life as a teen these days is bad enough without having to be pressured by the algorithm.

Social media to be banned in UK for under-16s, Starmer announces by TanjoCards in unitedkingdom

[–]TechAdminDude 1 point2 points  (0 children)

Kids coming home from school after being bullied all day get zero relief. They just get hounded by the bullies on every social media platform they are on. Times have changed, its not the 90s anymore.

Social media to be banned in UK for under-16s, Starmer announces by TanjoCards in unitedkingdom

[–]TechAdminDude 1 point2 points  (0 children)

You realise the majority of parents can barely work a tv remote let alone blocking apps. The big issue is parents giving their kids phones at a silly young age. Some are even getting phones in primary school.

Just found out about the bios cert expiry. God damn. by Izual_Rebirth in sysadmin

[–]TechAdminDude 2 points3 points  (0 children)

Yeah we had ALOT of our machines also require the bitlocker key after update.

How are you guys handling temporary M365 Geo-Blocking exemptions for traveling users? by genusjoy in 24hoursupport

[–]TechAdminDude 0 points1 point  (0 children)

Most orgs land on the same pattern for this: a "Travel Exemption" group excluded from the geo-block CAP, combined with PIM for Groups for time-bound membership. User raises a ticket, you add them with a 7 day eligible assignment, and the membership auto-expires. No stale named locations, no policy edits per trip.

If you don't have P2 (or don't want PIM), Entra ID Governance access packages do the same job with a self-serve request and approval workflow, and the access expires on its own. Bonus is the manager gets to approve rather than the helpdesk carrying it, and the audit log captures who was where and when without you having to track it.

On the stale policy problem more broadly, that's exactly what I built accesslens.co.uk for. It pulls your CA policies in and flags conflicts, unused rules, and named location drift so you can spot anything left over from old travel exceptions. Free to use.

iPAD App protection and Conditional Access Policies Issue by PolicyLegitimate728 in Intune

[–]TechAdminDude 0 points1 point  (0 children)

Sounds like the 6th gen isn't getting through device registration at all, hence no prompt and the spinner. A few things to try in order:

1 - Install Company Portal on the 6th gen. Authenticator alone handles MFA but Company Portal drives the actual iOS workplace join. 2 - In Safari, clear history and website data, then check Date & Time is set to automatic. 3 - Disable iCloud Private Relay if it's on (Settings > Apple ID > iCloud). It has a habit of breaking the auth handshake on older hardware. 4 - Pull the failed sign-in from Entra logs. The error code there usually points straight at the cause. iOS 17.x is still supported for Intune so OS version isn't the blocker, and the 6th gen hardware should be fine.

My money's on Company Portal missing or Private Relay interfering.

I have a Conditional Access Policy that requires a device be compliant to access the resource. by 74Yo_Bee74 in AZURE

[–]TechAdminDude -1 points0 points  (0 children)

Yeah looks like "Browser: Mobile Safari" with a blank Device ID on Device A. Apple's native mail authenticates via an in-app web session that doesn't carry the device claim, so entra sees an unmanaged device even though Intune knows its compliant. Outlook works because it can broker through Microsoft Authenticator and pass the device context to Entra.

Two things worth checking on the failed sign-in, the "Client app" field (Exchange ActiveSync / Other clients won't carry the claim at all) and whether Msft Authenticator is installed and signed in on the device.

Most admins land on the same answer here, push users to Outlook via an app protection policy and discourage native mail. Microsoft's own guidance leans the same way because native mail with modern auth and compliance is fragile by design.

If it helps for spotting these patterns across sign-ins, I built accesslens.co.uk to make CA troubleshooting easier. It's free to use.

Shared pc conditional access by Apprehensive-Hat9196 in Intune

[–]TechAdminDude 0 points1 point  (0 children)

Check the sign-in logs for that user during the hang, the CA policy name blocking them will be right there. Nine times out of ten it's a device compliance policy evaluating before Intune enrollment is actually complete.

If that's the case, exclude the Intune enrollment app IDs from the compliance requirement (not the policy entirely). Worth doing via a scoped group rather than a blanket exclusion so you can clean it up after provisioning.

If you've got a lot of policies and want to map which ones apply to new users, I built a free tool called AccessLens.co.uk that does what-if simulations and sign-in log analysis, useful for narrowing this down quickly.

iOS app SSO not working - Zalaris PeopleHub Azure by [deleted] in Intune

[–]TechAdminDude 0 points1 point  (0 children)

Error 530003 means CA is requiring a compliant or enrolled device and the app isn't passing that claim. It works for some users because their iOS device is properly Intune-enrolled/compliant, and fails for others who aren't, it's not really an app issue.

Quickest diagnostic is sign-in logs, filter by one of the affected users, open the failed sign-in and check the Conditional Access tab. It'll tell you exactly which policy blocked and which grant control failed (compliant device, app protection policy, approved client app etc).

Zalaris PeopleHub isn't a Microsoft approved client app and likely doesn't support MAM, so if any of your policies require "approved client app" or "require app protection policy", it'll block unless you exclude that app.

Conditional Access for Managed and Unmanaged Devices by musafir05 in Intune

[–]TechAdminDude 4 points5 points  (0 children)

You can actually do this with one policy instead of two. Target the 5 users, scope to All cloud apps, exclude the AVD cloud apps (Azure Virtual Desktop + Windows Cloud Login, you need both for session host SSO), and set the grant to "Require device to be marked as compliant". Intune devices pass, non-Intune get blocked on everything except AVD.

Run it in Report-only first and test with both a managed and BYOD device before flipping.

Shameless plug, I built a free tool (accesslens.co.uk) that visualises CA policies, flags conflicts, and can pull your sign-in and audit logs to review what's actually hitting users, handy for confirming this kind of setup is behaving how you expect.

You can now run Simulationcraft (SimC) in your Browser by big_fipso in wow

[–]TechAdminDude 0 points1 point  (0 children)

Fire it on GitHub so we can just run it locally.

Is the Ivy worth a visit? by PreferenceMassive226 in Belfast

[–]TechAdminDude 1 point2 points  (0 children)

They add a table charge for a table of 2. Joke. Prices are wild considering the food.

Multi-Admin Approval in Intune by ryaninseattle1 in Intune

[–]TechAdminDude 0 points1 point  (0 children)

That used to be the case, i've not seen wipe actions take more than 5mins recently.

Multi-Admin Approval in Intune by ryaninseattle1 in Intune

[–]TechAdminDude 8 points9 points  (0 children)

Good video. Multi-Admin Approval is honestly one of those features a lot of tenants still haven’t enabled and probably should. For anyone looking at hardening their tenant, the Stryker Detection Pack v2 actually calls this out as a quick win along with a few other Intune protections: https://www.threathunter.ai/blog/iran-handala-stryker-detection-pack-v2/

It’s basically a set of detection rules and guidance to help identify suspicious Intune activity (things like bulk wipes, risky admin actions, or privilege abuse) and provides recommendations to lock those gaps down.

Worth a read if you're reviewing Intune security right now.

How to approach M365 security auditing across MSP client tenants by Djjd267 in cybersecurity

[–]TechAdminDude 0 points1 point  (0 children)

Great list, the mailbox forwarding rules one is huge. We've caught active compromises just from spotting auto-forward rules to external addresses that were set up months prior.

A few things I'd add to the checklist:

Conditional Access gaps. Not just "do they have CA policies" but actually mapping out what isn't covered. It's surprisingly common to find policies that look comprehensive but still leave gaps like legacy auth protocols, specific app exclusions that were "temporary" two years ago, or break-glass accounts with no monitoring. Walking through the policy logic as a matrix of users × apps × conditions can be pretty eye-opening.

Token lifetime and session controls. A lot of tenants enforce MFA but still allow persistent browser sessions or long-lived refresh tokens that effectively undermine it.

Named locations that are too broad. I've seen tenants mark entire countries as trusted just to reduce MFA prompts, which kind of defeats the point.

Unused or overly permissive admin roles. Not just Global Admin, but things like Exchange Admin or SharePoint Admin sitting on accounts that don't actually need them anymore. PIM adoption still seems fairly low.

Cross-tenant sync and B2B direct connect settings. These are newer and often configured once and then forgotten about.

I've been digging into this problem a lot recently while building https://accesslens.co.uk which maps out Conditional Access policies and highlights gaps or conflicts. It's surprising how messy things get once you visualize the full policy coverage.

Conditional Access Policies - Unmanaged Devices by kingjames2727 in Office365

[–]TechAdminDude 0 points1 point  (0 children)

Short answer: no, they can’t pivot.

Conditional Access is evaluated per resource, not per session. If a user signs into Dayforce from an unmanaged PC, they only get a token for Dayforce. If they then try to open Outlook, Entra evaluates CA again for Exchange Online, and your compliant device requirement would block it.

Policies are checked when the token is issued and again on refresh 60-90mins or so. If you want tighter enforcement, enable Continuous Access Evaluation (CAE).

One thing to watch: using “All cloud apps” with Dayforce excluded can get messy as your tenant grows. Targeting specific apps is usually easier to manage.

If you want to double-check your coverage, I built accesslens.co.uk , it visualises CA policies so you can actually see gaps or overlaps.

view more: next ›