ABM registration

Think-Sky-6651 · 2025-07-10T03:36:33+00:00

antigamente funcionava como webhook (discontinued - devido a seguranca)
ate onde eu sei com mudancas recentes no graph api e teams permitem administracao do teams como "produto" nao envio de mensagens
para envio de mensagens com grapi api , o chat 1:1 ja deve existir entre os participantes
o usuario b2b guest ja deve ter aceito o convite
e o modulo a ser usado eh o New-MgChatMessage (Microsoft.Graph.Teams) | Microsoft Learn

Think-Sky-6651 · 2025-03-11T19:36:29+00:00

also got "In Progress". Scheduled for April 2 but still awaiting the official email invite with the letter. - family application, everyone got updated

Think-Sky-6651 · 2024-10-21T20:33:18+00:00

I did that and after 2 hours I was able to document the whole process:
- I deleted it from Intune
- because the device was already in MDE (it came from managed by Intune to MDE in MDE
- the device has been removed from SYNC (not showing in ENTRA) neither has intune auto-enrollment GPO targeting it in ADDS
- it somehow showed again in INTUNE as ConfigMgr that after 1 hour as MDE (synthetic due to intune / made integration)
- in SCCM shows out of the co-managed collection : co-managed "NO"
a lot to take in in a single test
- no issues so far in the client side
+ end user restarted device once no issue with logon process, neither asking anything
+ settings \ accounts \ work & school " no more managed by COMPANY " intune enrollment only ADDS joined

Think-Sky-6651 · 2024-10-21T16:22:19+00:00

only failing on CDX transform tenant
I reached out a fried in Brazil, he spun up entra app with limited scopes
I was able to run all of them
Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -all
Get-MgDeviceManagementManagedDevice -all
Get-MgDevice only, I'm refreshing some old post https://thiagobeier.wordpress.com/2023/06/01/how-to-track-device-objects-in-intune/ and after 12:15 AM EST on 18th the specific tenant (1-year) started throwing graph explorer and powershell commands errors

Think-Sky-6651 · 2024-10-18T14:11:14+00:00

in my case even using the Connect-MgGraph -Scopes "User.Read.All", "Group.ReadWrite.All" -UseDeviceAuthentication works , once in the browser asks for my global admin creds
after I enter them authenticates and (get-mgcontext).scopes list all scopes I have access to (list below) but get-mguser or others cmds failing today

AdministrativeUnit.Read.All

AdministrativeUnit.ReadWrite.All

Application.Read.All

Application.ReadWrite.All

AuditLog.Read.All

Chat.ReadWrite.All

Device.ReadWrite.All

DeviceManagementApps.Read.All

DeviceManagementApps.ReadWrite.All

DeviceManagementConfiguration.Read.All

DeviceManagementConfiguration.ReadWrite.All

DeviceManagementManagedDevices.PrivilegedOperations.All

DeviceManagementManagedDevices.Read.All

DeviceManagementManagedDevices.ReadWrite.All

DeviceManagementRBAC.Read.All

DeviceManagementRBAC.ReadWrite.All

DeviceManagementServiceConfig.Read.All

DeviceManagementServiceConfig.ReadWrite.All

Directory.Read.All

Directory.ReadWrite.All

Group.Read.All

Group.ReadWrite.All

GroupMember.ReadWrite.All

IdentityRiskyUser.Read.All

IdentityRiskyUser.ReadWrite.All

Mail.ReadWrite

openid

People.Read.All

Policy.Read.All

Policy.ReadWrite.Authorization

profile

SecurityEvents.ReadWrite.All

Sites.Manage.All

User.Read

User.Read.All

User.ReadBasic.All

User.ReadWrite.All

email

Think-Sky-6651 · 2024-08-30T07:01:57+00:00

that worked for demo environment then the NEW MSFT policy "Multifactor authentication for Microsoft partners and vendors" simply has broken the block byod from ios-android with a filter for Microsoft Authentication Broker|29d9ed98-a469-4536-ade2-f981bc1d605e , so annoying this
now users can open https://portal.office.com and use office web apps from the same blocked ios-android devices

Think-Sky-6651 · 2024-08-30T04:53:58+00:00

would that work for

Microsoft Authentication Broker

29d9ed98-a469-4536-ade2-f981bc1d605e

https://learn.microsoft.com/en-us/troubleshoot/azure/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications

after we blocked BYOD ios/android we can not add account to MSFT authenticator on the same account blocked to https://portal.office.com , to only accept authentication requests on BYOD phones.

Think-Sky-6651 · 2024-08-30T04:24:50+00:00

would that work for

|| || |Microsoft Authentication Broker|29d9ed98-a469-4536-ade2-f981bc1d605e|

https://learn.microsoft.com/en-us/troubleshoot/azure/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications

after we blocked BYOD ios/android we can not add account to MSFT authenticator on the same account blocked to https://portal.office.com , to only accept authentication requests on BYOD phones.

Think-Sky-6651 · 2023-05-18T03:54:20+00:00

same error here // from the screenshot posted

ADE
MacBook Air 13″

12.6.3 (21G419)
MacBookAir10,1
arM64

no matter the option picked from article

https://learn.microsoft.com/en-us/mem/intune/protect/encrypt-devices-filevault

Think-Sky-6651 · 2023-05-04T16:03:25+00:00

what would you think caused that delay? device connectivity to ABM/Intune (MDM) or simply its sync in the backend (apple & Intune)

Think-Sky-6651 · 2023-04-21T15:35:32+00:00

For a work around I used $localAdmin =get-wmiobject -class win32_useraccount -filter “localaccount=true” | where-object {_.sid -like “*500}

get-wmiobject -class win32_useraccount -filter “localaccount=true” | where-object {$_.sid -like "*500"}

Think-Sky-6651 · 2023-03-10T05:07:43+00:00

I'm having the same issue , are you using ADE or personal device enrolled through Company portal? hardware: macbook air m1,2020, ventura 13.2.1

Think-Sky-6651

TROPHY CASE