The Premium Cloud Brief
Field-tested guidance on Microsoft 365 security, cloud cost, and Copilot — written by the engineers who run the engagements.
Autopilot ESP stuck at Apps (Identifying): find the Win32 that fails with 0x81036502
When Autopilot ESP sticks on Apps (Identifying), the blocker is usually one tracked Win32—wrong detection, a failed install returning 0x81036502, or apps racing ahead of their dependencies. Here is how to find that app and stop the permanent ESP ticket queue.
Read the article →
Intune app packaging: PSADT v4 to .intunewin without another Claude skill
Intune PSADT intunewin packaging is a folder wrap with IntuneWinAppUtil, then install/uninstall commands, independent detection, and a SYSTEM vs interactive choice—not another AI packaging skill.
Read the article →
Autopilot device association: export the DeviceLink CSV, stamp UEFI, then enroll
Autopilot device association binds a physical Windows 11 device to your tenant before enrollment via a TPM-backed DeviceLink CSV and UEFI tenant affinity—not a classic hardware-hash upload. Here is the admin loop and what still breaks it.
Read the article →
AADSTS5000224: Microsoft deauthenticated the whole tenant. The DR list is not a portal ticket.
AADSTS5000224 means authentication is blocked at STS for the whole tenant. Portal, Entra admin, and the in-tenant support ticket are gone. The list that still works is tenant ID, billing proof, accepted GDAP, and backup that does not live only in the tenant.
Read the article →
Microsoft’s Sept 1 passkey email omitted the Graph opt-out. It is only in the FAQ. Decide before Tuesday.
The Microsoft-managed passkey campaign for SMS and voice users starts September 1. The tenant email skipped the temporary Graph opt-out — optOutSettings.passkeyDynamicMigration — which lives in the Learn FAQ and does not move the February 2027 retirement.
Read the article →
Allowlist copilot.cloud.microsoft Before the August 18 Redirect — the Old Intune Mobile Key Will Not Save You
The Copilot web URL moves from m365.cloud.microsoft to copilot.cloud.microsoft starting August 18. Proxy allowlists still naming the old host, and the dying Intune Office Mobile key, are what actually break this week.
Read the article →
How Microsoft 365 Tenants Actually Get Breached in 2026 — and the Five Controls That Stop It
AiTM token theft, password spray against forgotten accounts, and legacy auth are behind most M365 compromises we see. Here's the attack chain and the exact controls that break it.
Read the article →Get the Brief in your inbox
One field-tested post a week. Unsubscribe any time.