PM @Microsoft - Helping build tech to secure endpoints - thoughts here are mine and are not always based in reality
New York, USA
Joined July 2017
- Tweets1.8K
- Following174
- Followers3.1K
- Likes2.4K
I can take a look. Some of this stuff uses different enforcement mechanisms. We might send delete but the CSP might not do a great job cleaning up.
Interesting. We should send a delete automatically to the CSP when policy is untargeted. Are you using custom Oma? That’s a whole other ball of wax
Check the licensing of the user who is failing to register. The event logs should also give you the failure reason.
Check the MDM scope as well -> learn.microsoft.com/en-us/me…
I can ask. My perspective is that 200 keys on an object is a pretty reasonable higher limit, and it makes sense why we don’t let a device delete their keys.
Sounds like devices are “over-escrowing”. Curious, how many keys are active on the device?
Thanks for having me @mmsmoa and look forward to the next time!
There’s a lot of interest for @DeviceDeploy and @KrysOnTheNet session. So many want to hear what they have to say about “Intune Internals: Extreme Deep Dive”.
#MMSFlamingo #MMSMOA
Great read…
Why we are on the topic of token theft. Lets talk for a second around session hijacking with AiTM and 3rd party products like Fortinet and Palo Alto's.
Incredible advice here that you all should read and bookmark. Detection engineering in Sentinel is a hobby of mine and I love sharing advice.
techcommunity.microsoft.com/…
We can certainly work to update it. Likely it was added or created after the AV profile was created.
Not tracking anything. Maybe @IntuneSuppTeam is….
Seen this sort of behavior in the past when someone is tinkering with RBAC… but never been able to root cause it…
lol. The definitions we use come directly from the platform. We’ve tried various efforts to make them better with mixed results.
You’re right. I don’t love auto elevate based on reputation, but I do love reputation as a attribute to allow/deny elevation. Working on it… :)