u/klorgasia

Started about 24h ago, we see some general require compliant device policies that has specific apps exluded still triggering.

Anyone else seeing this?

Is this even possible? ive felt ive tried most things.

Computer Config → Admin Templates → Windows Components → Windows Update → Manage updates offered → Specify Target Feature Update Version (Product = Windows 11, Target = 25H2

Above works good for 24H2 to 25H2.

But my 23H2 cant seem to move to 24H2 or 25H2.

Any advice on what to try? Just replacing them is not really an option at the moment due to users installing to much crap...

I have the following scenario:

Azure expressroute configured so that azure resources can reach on-prem an vice versa, its deployed over a gateway not vwan.

Now i need to be able to allow a small subset of clients using azure vpn to reach on-prem resources. My thoughts was to deploy a azure vpn gateway for this and use a route server to make the routing work.

Deploying a vwan is not an option as it stands now, it would be smoother but not in-scope.

Does anyone have a better idea on how to make this work with azure vpn and the expressroute?

We have switched from a EA to MCA and now it seems get-AzConsumptionUsageDetail stopped working, it only returns Get-AzConsumptionUsageDetail: Operation returned an invalid status code 'BadRequest'.

Not sure if i should dig deeper or open a ticket with MS, does MCA support the command?

I want to build spaceships! Honestly not really needed to be able to fly/walk around. Just want some space-build suggestions. Any tips are helpful!

So we have successfully onboarded our Sentinel to Defender.
It states its connected but every click in the portal like "search", "tables", "Data connectors" etc leads us to "Settings > Microsoft Sentinel" and the "SIEM workspaces".

Its been over 24h, from what i can tell all XDR is configured correctly, even tried a admin role that grants it all along with all workspaces etc. Global admin role is being used, owner on the subscription where Sentinel resides but still the defender integration does not seem to work.

From the Azure sentinel perspective XDR seems onboarded, UEBA configured etc.. Any advice?

Hello everyone.

Wondering if anyone has seen this before. We have a partner that has sent delegated access requests for defender. Setting up the relationship went without any problem but we can not accept any requests they send. They all fail with:

Error: Failed to create GDAP group role assignments

Ive gone trough our side and cant see any issues, account that tries to accept is GA and has user admin on alla subscriptions. We have tried multiple browsers, break the glass accounts etc. But always the same.

They claim it works fine on everyone else but them so i am wondering if anyone has seen this before or knows some place i should check?

Hi
We setup a new sentinel instance and connected entra id, everything looks good, diagnostic settings are created and such but no logs stream to the workspace.

tried recreating the diag. setting but its still not streaming.

There is no limit right on how many workspaces you can stream to right? We have another test sentinel streaming logs but its another workspace and both should be able to get it right?

So we turned on Sharepoint archive to start doing this but no sites have been archived yet but i still have 200 euro note in my charges:

Syntex Archive - Data stored - EU West

Anyone know why/and/or if this is expected just by turning it on?