Every post, filtered by topic: Intune and Copilot error fixes, Azure cost explainers, .NET guides and homelab notes. Written after the thing was actually fixed, in a tenant with real users in it.
New in service release 2607. A shell script that emits JSON, a rules file that judges it, and strict data types that fail quietly when you get them wrong.
Edge 149 brought the Copilot governance policies into the settings catalog. Two of them decide whether page content is read. The rest just change what a tab looks like.
New in preview: Intune-delivered Defender settings can now override Group Policy, Configuration Manager and local scripts. Useful, and not something to switch on tenant-wide.
Most of the comparison is noise. Three capabilities genuinely stop at E3, and the largest saving is usually in the opposite direction entirely.
Version 2609 moves ConfigMgr to one release a year. That is a maintenance signal, not a deprecation notice, and permanent co-management remains supported.
What Microsoft 365 E3 actually covers, where it stops, and the two gaps that remove protection without telling you.
The app limit went to twenty five, managed installer stopped skipping Win32 apps, and Windows 365 automatic mode reached GA. Hybrid join still is not supported.
Sensitivity labels, Graph permissions and the three settings that decide the outcome.
Wiring OpenTelemetry into a .NET 10 service so the traces are worth reading.
The newsletter
Subscribe and get my 8-page PDF: 13 common Intune problems, the order to check them in, and the fix for each. Then Microsoft 365 fixes from the field, about twice a month. From G.R Badhon, Microsoft MVP.
