Author: Eswar Koneti

Azure Active Directory (Azure AD) Conditional Access is a powerful feature that allows administrators to control access to cloud applications based on specific conditions. These conditions can include factors such as location, device type, and network status. By using Conditional Access, administrators can ensure that only authorized users are able to access sensitive resources, and that these users are doing so from a secure location or device. This helps to protect the organization from potential security threats, such as cyber attacks or data breaches. Conditional Access can be configured for specific users, groups, or entire organizations, and can be applied…

Co-management is a feature that allows organizations to manage their devices using both Microsoft Intune and System Center Configuration Manager (ConfigMgr). This enables organizations to take advantage of the latest security features and cloud capabilities, such as conditional access and device compliance policies, while also being able to manage certain client actions without the need for access to the ConfigMgr console. Some of the key benefits of co-management are: Seamless transition: Co-management allows organizations to gradually transition from traditional management methods to modern management methods without disrupting their current workflow. Increased security: Co-management enables organizations to take advantage of the…

Recently, while working on an office 365 hardening project, I came across an issue that was causing problems for many users in verifying the 2nd factor authentication (Azure MFA). During the 2nd factor authentication process, users were presented with the following screen. As you can see, the user has the option to verify their identity using SMS, but no call-based option is available. By design, if a user has configured Azure MFA using their mobile number, they should have the option to choose between SMS and call-based verification (TwoWayVoiceMobile).However, in this case, the call-based option was missing. So, how do…

The following SQL query can be used to query the list of collections that doesn't have any deployments. you can review the number of collections with no deployments and you can further extend the query to exclude certain folders where you use these exception collections for troubleshooting or other purpose. select Col.Name, col.CollectionID, case when col.CollectionType='2' then 'Device Based' when col.CollectionType='1' then 'Used Based' Else 'Others' end as 'Collection Type', col.MemberCount, coll.ObjectPath from dbo.v_Collection Col inner join v_Collections coll on coll.SiteID=col.CollectionID Where Col.CollectionID not in (select CollectionID from dbo.v_Advertisement) order by Col.Name

This is a quick blog post on an issue that I recently looked at regarding the client issue with content download from the distribution point. Clients in one specific boundary could not able to download the content from its assigned distribution point. Though the client was healthy, the inventory cycle is up to date but content download from DP having issues. Looking at the client logs, especially the DataTransferService.log which is responsible for tracking the information about the content download from the distribution point. Following the error code from the DataTransferService.log [CCMHTTP] ERROR INFO: StatusCode=503 StatusText= GetDirectoryList_HTTP Error sending DAV…

I was recently working on an assignment to manage windows 10 devices using Microsoft Intune. One of the ask is to Block the write access to the mobile storage devices when the user plugs into the windows device and Allow write access to the removal data drives (thumb drives) if they are bitlocker protected. I started looking into the intune device configuration policy to find the relevant settings. 1. Block the write access to the mobile storage devices on windows device To block write access to mobile storage, I have found 2 settings under the device restriction, in general tab,…

We all know that Microsoft BitLocker Administration and Monitoring (MBAM) is an administrative tool for managing BitLocker Drive Encryption for windows devices that are on-prem domain joined. MBAM mainstream support ended on July 2019 and is currently in extended support until April 2026. To know more about mainstream support and extended support, please read the article https://learn.microsoft.com/en-us/lifecycle/policies/fixed. Considering the support for MBAM, what other alternative tools/products do we have to manage the BitLocker feature? Microsoft has incorporated the MBAM features into Configuration Manager (SCCM) starting in version 1910, since then it has improved a lot with new features and improvements.…

Did you ever had difficulties importing, exporting or migrating the SSRS reports from one Configuration infra to other ConfigMgr infra? If so, how do you migrate reports ? When i work with my customers on the hardware migration of the SCCM and especially the SSRS reports, i always use the tool rather powershell scripts. To get the SSRS Reports from the Configuration Manager , you can either run the SSRS reports,download the reports manually into rdl format and upload to other SSRS report server. This is applicable when you have single digit reports. What if you have large number of…