Notes from real tenants

Copilot oversharing: the controls that actually work

Intune enrollment status page: what it actually blocks, and why it hangs

Intune scope tags: what they scope and the failure modes

Intune management extension: what installs it, where it logs, and why it goes missing

Conditional Access device filter: why yours matches nothing, and what it cannot protect

An unregistered device has null for every property, so a positive operator can never match it. The mode and operator pairs that hold, and the ones that quietly let devices past.

Intune policy conflict: which policy actually wins, and how to find the other one

Compliance beats configuration, two compliance policies resolve to the most restrictive value, and two configuration profiles resolve to nothing at all. The report calls all of it Conflict.

Intune wipe vs retire: which action to use, and the order that stops data being orphaned

Retire, wipe, delete, Fresh Start and Autopilot Reset do five different things to a device and to three separate records. Delete is the one that catches people.

Conditional Access policy design: the failure modes the documentation leaves out

Create sensitivity labels in Microsoft Purview: the publishing step everyone misses

Forcing an Intune sync, and the three problems that look exactly like a sync failure

The admin centre Sync action got fuller in 2607, and the properties catalog can now read the registry. Neither fixes a policy that was never going to apply.