The Premium Cloud Brief
Field-tested guidance on Microsoft 365 security, cloud cost, and Copilot — written by the engineers who run the engagements.
Autopilot hash import stuck at Syncing: why the device never gets its profile
Autopilot hash import stuck at Syncing? Check service health, the registration error, then group tag and profile assignment before re-uploading.
Read the article →
Autopilot ESP timeout 0x800705b4: TPM attestation and Device Preparation before you wipe again
Autopilot ESP 0x800705b4 is a timeout, not a root cause. Separate TPM attestation, required-app waits, and hybrid hangs before another wipe.
Read the article →
Autopilot pre-provision fails with Windows App 0x80244018: Store CDN vs required apps in the technician flow
Autopilot pre-provision Windows App 0x80244018: separate Store CDN / HTTP 403 intermittency from required-app design in the technician flow.
Read the article →
Autopilot pre-provision reseal failing after KB5089549: check ESP updates and BitLocker before you wipe the lab
Autopilot pre-provision reseal failing after KB5089549? It is usually ESP Windows updates racing BitLocker key backup. Prove the seal path first.
Read the article →
Autopilot ESP stuck at Apps (Identifying): find the Win32 that fails with 0x81036502
Autopilot ESP stuck at Apps (Identifying) is usually one Win32: bad detection, an install failing 0x81036502, or dependency races. Find that app.
Read the article →
Intune app packaging: PSADT v4 to .intunewin without another Claude skill
Intune PSADT .intunewin packaging: wrap with IntuneWinAppUtil, set install and uninstall commands, detection, and SYSTEM vs user context.
Read the article →
Autopilot device association: export the DeviceLink CSV, stamp UEFI, then enroll
Autopilot device association binds a device to your tenant via a TPM-backed DeviceLink CSV and UEFI affinity, not a hash upload. The admin loop.
Read the article →
AADSTS5000224: Microsoft deauthenticated the whole tenant. The DR list is not a portal ticket.
AADSTS5000224 blocks sign-in for the whole tenant, so portals and support tickets are gone. The DR list that still works: tenant ID, billing, GDAP, backup.
Read the article →
Microsoft Graph passkey opt-out: the setting the campaign email omitted
The email omitted the Graph passkey opt-out, optOutSettings.passkeyDynamicMigration. It is in the Learn FAQ and does not move the February 2027 retirement.
Read the article →
Allowlist copilot.cloud.microsoft Before the August 18 Redirect — the Old Intune Mobile Key Will Not Save You
Allowlist copilot.cloud.microsoft before the Aug 18 redirect. Proxies still naming m365.cloud.microsoft and the old Intune key are what break.
Read the article →
How Microsoft 365 Tenants Actually Get Breached in 2026 — and the Five Controls That Stop It
How Microsoft 365 tenants get breached in 2026: AiTM token theft, password spray, legacy auth. The attack chain and five controls that stop it.
Read the article →Get the Brief in your inbox
One field-tested post a week. Unsubscribe any time.