QuickPost – disabling the Run command (without killing everything else) – JAMES-RANKIN.COM -> Threatlocker -> AppLocker ->Defender -> Disable Windows Run – https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/

We were trying to whitelist Claude MCP from a conditional access policy that restricts 365 Apps to Company Enrolled Devices M365 MCP Server for Claude was accessing […]

There are specific permissions the account would require – and these are the Purview Roles (steps below) that would need to be assigned: Assigning Purview Roles The Purview roles […]

Whitelist the below apps from any policy Microsoft Intune Microsoft Intune Enrollment

All the guides online said to check in App Data Real Location for MSI

https://security.microsoft.com/reportsubmission This builds an exchange rule to take the names out the defender impersonation list and creates a rule

IMPORTANT: Careful update any Ignite solutions, as this will revert changes to the internal monitors. 

LicenseServiceNonTransientException: Service resource is gone. Exception details : Status code returned: ‘Gone’, HTTP request error: Unknown, Message: Gone – error returned. Response body: “[AuthenticationHandler.AcquireTokenSilentWithLoginHintAsync with certificate] threw […]

Azure Monitor Agent (mdsd) hit a fatal config error (malformed base64 storage credential in the Data Collection Rule) and crash-looped continuously until the extension was removed from […]

Problem: During the earlier disk-full incident, the agent’s local cache files got truncated to 0 bytes while trying to write to a full disk: The agent kept […]

Fix Delete the “%LOCALAPPDATA%\Microsoft\Windows\TaskManager” folder