Hi r/Proxmox,

I built a PowerShell automation that creates ready to enroll Windows 11 test VMs on Proxmox and automatically registers them with Windows Autopilot.

I regularly need multiple Windows devices for testing Microsoft Intune policies, applications and deployment scenarios. Creating every VM manually, collecting the hardware hash and uploading it to Autopilot became repetitive and time-consuming.

The automation runs as a PowerShell Azure Automation Runbook on a Windows Hybrid Runbook Worker and communicates directly with the Proxmox API.

It automatically:

• Finds the configured Windows 11 template in the Proxmox cluster
• Allocates the next available VM ID
• Creates a full clone, including EFI and TPM state disks
• Generates and applies a unique SMBIOS serial number
• Configures CPU, memory and the final disk size
• Starts the VM and waits for the QEMU Guest Agent
• Expands the Windows C: partition
• Recreates and enables the Windows Recovery partition
• Collects the Autopilot hardware hash through the QEMU Guest Agent
• Imports the device into Windows Autopilot using a Managed Identity
• Monitors the Autopilot import
• Reboots the VM through Proxmox after registration

My test system is a Lenovo ThinkStation P520 with 256 GB RAM and a 1 TB NVMe drive for VM storage. Even with its older Xeon W-2123, I have successfully run up to eight Windows 11 test VMs. In most cases, a new VM is cloned, prepared and registered with Autopilot in around five minutes.

I know Azure Automation is probably not the first tool most people here would choose for Proxmox provisioning. In my case, it provides a convenient interface for triggering deployments while keeping the Proxmox environment local.

I’d be interested in your feedback, especially regarding the Proxmox API implementation, permission model and storage handling. If you find a bug or have an improvement, feel free to open an issue.

GitHub repository:

https://github.com/Mau2rice0/World-of-M365/tree/main/Intune/Automation/New-ProxmoxWindowsAutopilotVM

Hi r/Intune,

we’ve been seeing some issues with BitLocker and Windows Hello for Business (WHfB) since deploying the August 2026 Patch Tuesday updates, and I wanted to check if anyone else is experiencing the same behavior.

The affected updates are KB5120994 and KB5123607, which are being deployed via Hotpatch in our environment.

On some devices, the following happens after the update:

1. The update is installed via Hotpatch.
2. After the next reboot, the end user is unexpectedly prompted for their BitLocker Recovery Key.
3. After entering the recovery key successfully, Windows boots normally.
4. At the WHfB sign-in screen, the user’s PIN no longer works. Windows shows an error stating that something went wrong and the PIN isn’t available, with a recommendation to restart the device.
5. A reboot sometimes resolves the WHfB issue, but unfortunately not in all cases.

For devices where rebooting doesn’t help, the only reliable solution we’ve found so far has been to completely reimage/reinstall the device, which obviously isn’t ideal.

Has anyone else experienced similar issues after deploying KB5120994 or KB5123607?

If so, I’d be interested to hear:

• How widespread is the issue in your environment?
• Have you identified the root cause?
• Have you found a reliable workaround or remediation that doesn’t require reimaging the device?
• Have you made any changes to your Intune, BitLocker, WHfB, or update policies as a result?

Would be great to exchange findings and possible solutions with anyone else affected.

Hi r/Intune ,

I ran into a very strange issue/possible bug with Remediation scripts last night, and I’m wondering if anyone else is experiencing the same behavior.

When I trigger a Remediation script manually from the device view, everything seems to work as expected. The script runs successfully and the action eventually shows “Remediation complete.” The overview also indicates that a device has completed the remediation, either with or without errors.

However, when I check the Device Status for the Remediation afterward, the list is completely empty, even though the devices clearly ran the script.

This happens both when checking through the Intune portal and when querying the status through the Microsoft Graph API. The Graph API request itself succeeds, but the value array is completely empty as well.

I’ve been using Remediation scripts for a while and never had this issue before. What makes it even stranger is that everything was still working correctly yesterday around noon. The problem only started sometime yesterday evening.

So I’m wondering:

Is anyone else currently seeing the same issue with Remediation/Platform Script reporting?

If multiple people are affected, it might be worth opening a Microsoft support ticket and reporting it as a broader service-side issue rather than an isolated tenant problem.

Thanks!

Hi everyone,

A while back I showed you my local Microsoft 365 SOC tool built in PowerShell. Back then it was limited to a single-user setup:
https://github.com/Mau2rice0/World-of-M365/tree/main/Security/SOC/M365%20Compromise%20Response%20Console

Well… I’ve been pulling all-nighters and completely rebuilt it from the ground up. It’s no longer PowerShell, it’s now a full JavaScript application and it’s absolutely fire.

You can see pictures in another Reddit post:
https://www.reddit.com/r/microsoft365/comments/1ulw3hz/i_rebuilt_my_local_m365_soc_tool_from_powershell/

You can now self-host it wherever you want:

• On-prem
• Azure
• Any web server with at least 2 cores and 4 GB RAM

I’ll be releasing it in the next few days so you can host and test it yourselves.

What’s new & improved:

• SSO support for additional users → no more manual logins
• Full RBAC permission system
• More RBAC roles coming: Analyst, Responder, Reader, Administrator
• Azure Files Share integration for storing evidence and data
• Significantly better performance
• Security hardening
• Fully automatic setup script that does the entire deployment for you

GCC / GCC-High compatibility is unfortunately not possible yet. I don’t have access to that environment and being based in Germany makes it pretty hard to get one.

If anyone has a GCC tenant they’d be willing to test with, I’d love to collaborate!

I’m planning to sink at least 35 hours into this project again this weekend.

If you have feature requests or ideas for what a proper M365 SOC tool should have, drop them in the comments. You guys know better than anyone what’s actually needed in the field.

Huge thanks to everyone who tested the earlier version:)

Can’t wait to get this into your hands.

Hey

Over the past few weeks I’ve built a tool I wanted to share with you.

It’s a SOC solution for Microsoft 365. It currently runs on a local PowerShell web server, but the plan is to make it fully self-hosted or deployable in Azure in the future.

What it does:

You enter a compromised user and the approximate compromise date, and the tool gives you:

• All devices the user was logged into
• Suspicious sign-ins
• Mail traffic after the breach
• Additional aggregated signals from multiple M365 data sources

The goal is to give you fast and clear visibility into a potential incident. Results can be exported or automatically sent via email.

More features are coming soon. I’m developing this after work in my spare time because I want to give something useful back to the community and make our jobs a bit easier (and a lot more secure).

Version 0.1 is now live on GitHub.
I’d love your feedback, test results, improvement ideas, or bug reports. Feel free to comment here or open an issue in the repo.

→ GitHub Link: https://github.com/Mau2rice0/World-of-M365/tree/main/Security/SOC/M365%20Compromise%20Response%20Console

Thanks in advance, looking forward to your thoughts!

Hey

Over the past few weeks I’ve built a tool I wanted to share with you.

It’s a SOC solution for Microsoft 365. It currently runs on a local PowerShell web server, but the plan is to make it fully self-hosted or deployable in Azure in the future.

What it does:

You enter a compromised user and the approximate compromise date, and the tool gives you:

• All devices the user was logged into
• Suspicious sign-ins
• Mail traffic after the breach
• Additional aggregated signals from multiple M365 data sources

The goal is to give you fast and clear visibility into a potential incident. Results can be exported or automatically sent via email.

More features are coming soon. I’m developing this after work in my spare time because I want to give something useful back to the community and make our jobs a bit easier (and a lot more secure).

Version 0.1 is now live on GitHub.
I’d love your feedback, test results, improvement ideas, or bug reports. Feel free to comment here or open an issue in the repo.

→ GitHub Link: https://github.com/Mau2rice0/World-of-M365/tree/main/Security/SOC/M365%20Compromise%20Response%20Console

Thanks in advance, looking forward to your thoughts!

Hi

Over the past few weeks I’ve built a tool I wanted to share with you.

It’s a SOC solution for Microsoft 365. It currently runs on a local PowerShell web server, but the plan is to make it fully self-hosted or deployable in Azure in the future.

What it does:

You enter a compromised user and the approximate compromise date, and the tool gives you:

• All devices the user was logged into
• Suspicious sign-ins
• Mail traffic after the breach
• Additional aggregated signals from multiple M365 data sources

The goal is to give you fast and clear visibility into a potential incident. Results can be exported or automatically sent via email.

More features are coming soon. I’m developing this after work in my spare time because I want to give something useful back to the community and make our jobs a bit easier (and a lot more secure).

Version 0.1 is now live on GitHub.
I’d love your feedback, test results, improvement ideas, or bug reports. Feel free to comment here or open an issue in the repo.

→ GitHub Link: https://github.com/Mau2rice0/World-of-M365/tree/main/Security/SOC/M365%20Compromise%20Response%20Console

Thanks in advance, looking forward to your thoughts!

Hey r/cybersecurity

Over the past few weeks I’ve built a tool I wanted to share with you.

It’s a SOC solution for Microsoft 365. It currently runs on a local PowerShell web server, but the plan is to make it fully self-hosted or deployable in Azure in the future.

What it does:

You enter a compromised user and the approximate compromise date, and the tool gives you:

• All devices the user was logged into
• Suspicious sign-ins
• Mail traffic after the breach
• Additional aggregated signals from multiple M365 data sources

The goal is to give you fast and clear visibility into a potential incident. Results can be exported or automatically sent via email.

More features are coming soon. I’m developing this after work in my spare time because I want to give something useful back to the community and make our jobs a bit easier (and a lot more secure).

Version 0.1 is now live on GitHub.
I’d love your feedback, test results, improvement ideas, or bug reports. Feel free to comment here or open an issue in the repo.

→ GitHub Link: https://github.com/Mau2rice0/World-of-M365/tree/main/Security/SOC/M365%20Compromise%20Response%20Console

Thanks in advance, looking forward to your thoughts!

Hey everyone,

It’s the weekend, which finally gave me time to clean this up and share it.

Most of us have probably asked ourselves at some point: Do you actually know what Edge Extensions are being used in your environment?
In most cases the honest answer is: “Uhhh… no idea, never really thought about it.”

Manually checking is painful, and tools like Microsoft Vulnerability Management can get expensive quickly when you have many users.

So I built a straightforward PowerShell script that solves exactly this:

Edge Extension Inventory

• Automatically finds all installed Microsoft Edge extensions on the devices
• Collects useful info (Name, Version, Extension ID, Profile, etc.)
• Sends everything nicely into an Azure Log Analytics table
• Designed to run perfectly as an Intune Remediation Script (system context, robust, always exits cleanly)

It’s deliberately kept simple, reliable, and production-ready.

The best part? It only costs you a Log Analytics Workspace which is extremely cheap compared to other solutions.

Full code, simple documentation and step-by-step Intune deployment guide are here:

👉 https://github.com/Mau2rice0/World-of-M365/tree/main/Security/Reporting/EdgeExtensions

Just drop in your Workspace ID + Shared Key, deploy it via Intune, and you’re done.

If you try it out or have ideas / feedback, let me know always happy to improve it!

#MicrosoftIntune #MicrosoftEdge #PowerShell #Azure #M365 #Intune #EndpointManagement

Hello r/microsoft365

We already have the incredibly useful and truly helpful OpenIntuneBaseline so how about creating an OpenEntraBaseline as well?

The goal is to build a baseline aligned with the CIS Benchmark, enforcing security recommendations in a consistent and transparent way. This would allow us to harden new environments quickly or spin up secure test environments without starting from scratch every time.

And honestly, who could build this better than all of you? You work with these services every single day, you know every trick, every bug, every quirk.

So let’s combine our collective knowledge and create the OpenEntraBaseline together. Let’s merge the CIS Benchmark with our real‑world experience and deliver something valuable for all Microsoft admins out there. In the end, we all benefit from a stronger, shared foundation.

If you’re interested, drop a comment I appreciate every bit of help 😄

If enough people join in, I’ll set up a Discord channel and a Git repo so we can collaborate properly

It’s the weekend, which finally gives me time to finish things I’ve been building for way too long.
I’ve been working on this Azure Automation Runbook on and off for quite a while, and today I finally wrapped it up. Of course, I wanted to share it with you all.

In short:
The Runbook automatically identifies inactive Enterprise Apps (Service Principals) in your Entra tenant.
It checks the Microsoft Graph Beta sign‑in logs to see which tenant‑created apps had zero sign‑in activity in the last 30 days.
If inactive apps are found, it generates a clean HTML report and sends it via email.
If everything is healthy and no unused apps exist, it stays quiet, no unnecessary notifications 😉

As always, the full code is available in my GitHub repository, which I’ve linked below.

https://github.com/Mau2rice0/World-of-M365/tree/main/Entra/Reporting/UnusedEnterpriseAppsReport

If you have ideas, feedback, or want to see additional features, let me know, maybe that’ll be my next weekend project.

#Azure #M365 #Entra

Most of us have been there: users suddenly report issues with a Microsoft 365 service, and as an admin you’re left wondering whether the problem is on your side or if Microsoft is having an outage.

Checking the M365 Admin Center can help, but it takes time and many helpdesk staff don’t even have access to it.

To solve this, I created an Azure Automation Runbook that regularly checks the Microsoft 365 service health status and sends an email only when there’s an actual issue (degradation or outage).

Key benefits:

• No personal admin access to the Microsoft 365 portal required
• Notifications can go directly into your ticketing system
• Issues are often detected before users notice them
• A quick look at your inbox in the morning is enough
• No unnecessary notifications only real incidents

The script is available in my Git repository:
https://github.com/Mau2rice0/ServiceHealthNotificationService/tree/main

If you’re interested, feel free to try it out and share your feedback.

#Microsoft365 #AzureAutomation #M365Admin #Helpdesk