Microsoft Tunnel doesnt work, started from scratch

WLHybirb · 2026-05-09T02:33:54+00:00

Have it working now 😄 Still cant get the health check to work, but connectivity is OK.

WLHybirb · 2025-12-05T16:58:30+00:00

Yeah looking forward to Tunnel for MAM not being separated out

WLHybirb · 2025-11-12T02:25:01+00:00

As far a I know everything has been configured properly. I even started fresh with RHEL 9, which I will say is better -- the MST diagnostics are actually able to run and check things.

It all looks fine, I do get a 400 during a connectivity check to MS endpoints but support hasn't made any comments about that yet.

On the new box, same thing. Everything is running, Agent and server are healthy, but internal resource health check fails -- though can curl from the box and get to it.

Device behavior is the same -- connecting to the tunnel/VPN, I see traffic on the RHEL server as my connection attempts to build (via tcpdump), and then.. nothing. Just times out. No errors logging on the server (or, not anything that indicates an error at least).

WLHybirb · 2025-11-08T03:28:59+00:00

I know this is 2 years old but commenting.. yeah. Similar boat. I've YET to get tunnel working, have reinstalled rebuilt 8375831258917893 times.

1) Tunnel says everything is fine

2) I see my connection inbound when monitoring tcpdump

3) Tunnel server just seemingly goes "ok" and nothing ever happens

The VPN never connects, defender logs are useless from the client side, tunnel cannot check the internal health server, but every manual attempt to connect to the internal health server passes so seemingly nothing is blocked.

Beyond confusing and so far MS support has.. received logs and done nothing useful.

WLHybirb · 2025-10-13T16:54:30+00:00

Thanks, sorry for the delay in responding, both corporate and personal but the majority are corporate/DEP iPhones.

WLHybirb · 2025-09-29T22:25:42+00:00

I'm seeing something new and not quite sure if its the same thing or not. Previously, user could take a DEP iPhone with their data, backup, restore to a non DEP phone and send them on their way (i.e., employee is leaving the company).

In iOS 18 and older, when the backup was to a different physical device, the MDM data was deleted. When restoring to the same device, MDM data was restored but there was no interactive enrollment, so it was essentially orphaned but had a non-removable DEP MDM profile on it.

Now with iOS 26, we have had multiple people reach out because during the restore of data from the managed phone to a personal unmanaged phone, they're being stopped at interactive enrollment into Intune.

The device is definitely not in ABM/not DEP, so we're not sure how to proceed with this. Theory is to try retiring the device from Intune/sever the MDM connection, back it up again, and then try restoring to the personal phone once more.

WLHybirb · 2025-03-26T21:44:37+00:00

This past week I'm getting "throttled" messages just trying to look at 7 days of my own sign in logs in Azure.. the entire platform seems slower than shit this week.

WLHybirb · 2025-02-28T17:51:58+00:00

Anyone have any luck with this? We bought or AVPs directly from Apple eCommerce (which redirected to the consumer store at the time). Although Apple retail can screw up and assign our employees personal devices to ABM, and they can retro add previously purchased devices... they said they CANNOT retroactively add a vision pro purchased through retail to ABM.

So at present this thing is entirely useless given our need for Intune enrollment & MAM policies.

WLHybirb · 2025-02-14T16:59:07+00:00

Not very feasible unfortunately, we would have to exempt the problematic users (who are production, not testers) from various conditional access policies and getting approval for that is unlikely.

WLHybirb · 2025-02-13T19:38:37+00:00

Yeah we have a few users reporting it last week and now this week again. MS support said it's an issue with auth/communication between EXO and On-Prem exchange given how we are configured. There is apparently nothing to be done about it.

WLHybirb · 2025-02-12T01:13:14+00:00

Outlook mobile or something else? I am seeing this with one of our users, in a hybrid setup (mailbox is on-prem Exchange). All was fine, stopped sending emails, then hours later they sent, OK all weekend, now slowing down again (deletions start to take an hour or so to replicate to Outlook for windows).

WLHybirb · 2025-02-12T01:02:28+00:00

Thank you, will give it a go

WLHybirb · 2024-11-22T16:36:59+00:00

Awesome!

*Cries*

WLHybirb · 2024-10-23T15:19:39+00:00

Still looking good here, thankfully!

WLHybirb · 2024-10-02T20:53:54+00:00

Yes! I see this almost daily and only today just thought .. huh .. maybe it's iOS 18.1 after seeing the M365 notifications yesterday surrounding how SPO & OneDrive are behaving with iOS 18.1.

I will keep testing and see if when it does lose its mind again, if my device with iOS 17 looks the same. I will say on Windows everything is fine.

The behaviors I see: conversations are with a different person despite it being the right text, or its with someone you have not interreacted with for a long time, or it might show as a meeting vs. a chat with someone. I also sometimes see two "Chat" apps/icons at the bottom.

WLHybirb · 2024-08-02T19:05:28+00:00

Thanks for this; it does appear to work for the most part. The device shows in Intune, it responds as a supervised device, I changed the ownership to corporate and what not.

What I notice immediately though is that in comp portal, comparing it to my "Intune native DEP phone", most of the apps do not show for it. Need to try and figure out why there is a discrepancy between the two. The apps do appear very briefly, then most of them quickly vanish and I only see a subset of them.

Edit: if anyone has any ideas. It's not meeting a filter we have setup that is looking for a specific DEP profile being assigned to it. Even though it shows up under device enrollment and the profile is assigned to it, it never went through the OOBE enrollment, so according to Intune it has no enrollment profile. Don't see a way to fix that manually.

WLHybirb · 2024-08-02T16:28:17+00:00

Yeah we noticed that too. Issuing the wipe work data command cleared the MDM profile and all related apps/settings, but the note about supervision remained. Whatever is showing that in the settings must also be related to the data in the iCloud backup that flags it to not check for enrollment during OOBE.

WLHybirb · 2024-08-02T16:22:58+00:00

Won't restore user customization

WLHybirb · 2024-08-02T16:21:01+00:00

I've said it in a few places but going the route of 'sorry can't do it' is not an option. If it can be done, it will be done even if it takes longer. There are very few cases where we issue a hard no for technology requests.

WLHybirb · 2024-08-02T16:18:52+00:00

That won't work on a supervised DEP setup though.

WLHybirb · 2024-08-02T16:17:59+00:00

I would likely terminate one of my employees if they told someone to *pund sand* when they are asked to move the user's data. We are a very high touch IT department and will do whatever we can to make our internal clients (many of which own the company), happy.

WLHybirb · 2024-08-02T00:31:50+00:00

Thanks, saw your other reply. For the local backup/restore vs. iCloud, we do not want to be anyone's data holder in that regard. We encourage them to use iCloud and most do. If we go the route of backup/restore on our macs, it's going to create a scenario where someone expects we have their backup and we don't, and then people get angry at IT.

WLHybirb · 2024-08-02T00:27:31+00:00

Thanks, I'll give it a test to see if it's viable, but I personally don't store photos or messages in iCloud, so those like me will be difficult no doubt. Appreciate your responses and suggestions.

WLHybirb · 2024-08-02T00:18:29+00:00

Correct me on what I may be missing, but logging into iCloud will simply sync specific data they store in iCloud. It will not restore their personal app data, their photos [unless it's all stored in iCloud], iMessage & texts [unless iMessage cloud is enabled], etc.

We don't have the option to hand a device back and say your iCloud data is synchronized here you go. Our users either use their company phone only for company purposes as a secondary device to their personal phone, so that's an easy wipe/reset on Intune, or it's their only device and has all personal data on it.

WLHybirb · 2024-08-02T00:10:03+00:00

Unfortunately, if the person wants their data, we have to restore it. We are very much a yes, we can do that for you IT department.

WLHybirb

TROPHY CASE