Notes from real tenants

Exchange Online Plan 1 vs Plan 2: what the extra licence buys

Intune licensing: what Plan 1, Plan 2 and the Suite cover

Intune Plan 1 vs Plan 2: what Plan 2 still adds after E3

Business Premium vs E5: what the step up actually buys

AADSTS50020: which tenant the account is in, and how to fix it

AADSTS error codes: what they mean, grouped by cause

AADSTS error codes grouped by what actually caused them, with the first sign-in log check for each group and the codes that are not failures at all.

Defender for Endpoint P1 vs P2: what Plan 2 adds and when it pays

Conditional Access App Control not working: where it breaks

The Entra policy is on, the session policy says Block download, and the file still downloads. Where Conditional Access App Control breaks, and the check for each layer.

Defender for Endpoint onboarding not working: where it stops

Intune says the EDR policy succeeded and the device is missing from Defender. The four layers onboarding breaks in, with the error codes and event IDs for each.

Endpoint Privilege Management not working: agent, rule or device

EPM fails in three layers: the agent, the rule match and the device. Each symptom mapped to its documented cause, and where Microsoft Learn stops.