Insider Builds
I have been an avid Microsoft user for many years with only a couple of small issues every now and again. The 6 weeks have been unbelievably stressful and disheartening. I thought trying samples of New Insider builds and enlisting in Azure for some up to date training for myself to help with what I wanted to roll out for my business. This has been the worst experience i have ever been apart of. I now have multiple computers and hardware in disarray but more importantly the loss of time and patience is paramount . I have come to realise the repetitive responses and requests for data collection on feedback or issues is one-sided The amount of user data submissions is not the issue though. It is the assistance from Microsoft regarding issue via portals, help-desk etc. The inclusion of many backend functions for the purpose of better user experience is heavily flawed. Unless end-user inadvertently has or encounters issues in there OS life is good. Heavily automated program tiggers sit through all OS builds for example. One drive. Regardless whether this is declined or removed it will always be running in the background. If you system had been compromised this is a perfect place for root-kit other Malware to spread. Xcopy: A Microsoft background function which has the ability clone and copy 99% of drivers of operating info structure. Can be controlled by ghost script directives or embedded dll to aid malware. Anti-virus or defender find difficulties identifying or distinguishing authentic and re-pro-ducted data. In time this type of incursion can mimic a vast amount of OS functionality. Microsoft OS validity. I have trailed numerous builds with all sharing this characteristic. Invalid or expired software and driver certificates & TPM flaws even after a full clean reset and TPM turned off in bios. Inevitably this can introduce compromised software without end-user knowledge. The impact leads to unauthorised access in many elements of the OS platform especially data access and embedded .dll which can run inline or above elevated authorisation. A lot of this is undetectable. Once embedded in OS and bios this is impossible to clean without expert assistance and can be very costly. For the most part the inclusion of new AI functionality across the OS platform is very welcomed. Unfortunately there are a large amount of bugs to be ironed out especially in the platform navigation. Advice provided via OS AI can be mis-leading or incorrect. .Live response sessions and Zscaler
Has anyone managed to get live response sessions from Defender XDR working with Zscaler enabled? I have bypassed all necessary URLs from SSL inspection but still getting blocked from performing actions on live response. It is definitely Zscaler as when it's disabled live response works perfectly.
Old .NET versions automatic uninstallation/removal
Hello, How are you removing old versions of .NET from your devices? Is there a way to automate this? To better clarify our issue, please see the screenshot below. We just installed the latest version (6.0.35) for both: .NET Runtime and Desktop Runtime but older 6.0.33 versions are still there. We need to automate those older versions removal. I appreciate your response and help. Thanks, Mark
Blocking Personal Outlook and Gmail Accounts on Corporate Device
Hello Community, In my organization, we use the Microsoft 365 environment. We have a hybrid infrastructure, but we aim to deploy as many policies as possible through Microsoft 365 (Intune, Purview, Defender, etc.). One of our goals is to limit the use of corporate devices for personal purposes. We use Outlook as our corporate email service, and we would like to block employees from signing into their personal email accounts (either via web or desktop application). Additionally, we would like to block access to other email services, such as Gmail, both via web and desktop apps. Could you provide guidance on how to achieve this? I would greatly appreciate any help or suggestions. Thank you very much! Juan Rojas
Unable to Restrict Sensitive Data Access by Microsoft Edge via Endpoint DLP Policy
Hello everyone, I've been running into a peculiar issue where actions we have configured to be blocked via our Endpoint DLP policies do not apply to the Microsoft Edge browser. Currently, we have a DLP policy configured to block attempts to access protected files by a list of restricted apps. Our restricted apps include "firefox.exe", "chrome.exe", "msedge.exe" and "msedgewebview2.exe". When the sensitive content is accessed by either Chrome or Firefox, the DLP policy works correctly (Block with override), but the policy completely refuses to work in any scenario that involves Edge. The data we are using as an example is able to be accessed by the Edge executables without restriction. Has anyone else run into this issue? It's strange to me that for some reason Edge is just completely exempt from the DLP policy actions we have implemented. Thank you!
How much time does it takes to update secure score on Defender portal?
Hi Folks, I have marked some of the recommended actions on secure score as "third party" or "alternate mitigation". Even after 10 hours I can see action is still marked as "to be addressed". How much time does it take for changes to show up there? And also, how much time will it take to get this add up to my cumulative secure score?
Whenever login into the office applications different OTP needs to be applied Outlook and teams
When signing into Office applications, adifferent OTP is required for both Outlook and Teams. To address this issue, there is any resolution this issue supports or a supporting document as proof to confirm that this is a standard procedure.Revoking elevated privileges in Endpoint Privilege Management
I found a thread from last year asking this question. When I revoke someone's elevated access in IntuneEndpoint Privilege Management (removing them from the AD group linked to an Intune EPM policy) the "run with elevated access" option remains in the right click context menu. The post from last year said it can take hours for access to be removed but that the app was still in preview mode. This was over a year ago so I'm wondering if anyone from Microsoft or anyone can advise if this is now quicker or if there is a way to speed it up? We want to start a secondary proof of concept with multiple policies with different levels of access, but testing this would take so long if we're waiting 8+ hours each time we remove access. Thanks all
