# azureblog.co.uk

> What's new in Entra ID, Intune and Azure, what it means in practice, and the steps and scripts to act on it. Written for administrators of Microsoft Entra ID, Intune and Azure. British English. Every news post links to Microsoft's own documentation.

## Machine-readable data
- [Full text of every post](https://azureblog.co.uk/llms-full.txt)
- [Open data JSON index](https://azureblog.co.uk/open/v1/index.json): deadlines, posts, AADSTS and Intune error codes, event IDs, Graph permission risk, licence SKUs, glossary
- [MCP server and docs](https://azureblog.co.uk/open-data/): lets AI assistants query this site directly

## Posts
- [Azure Arc for servers: the complete setup guide, and why it changes how you run everything outside Azure](https://azureblog.co.uk/posts/azure-arc-servers-complete-setup/): One agent turns any Windows or Linux server, in your datacentre, a branch office or another cloud, into an Azure resource you can patch, protect, monitor and govern from one place. How it works, how to plan it, every onboarding method, what to switch on, day-two operations and troubleshooting, plus a planner that builds your firewall list and onboarding script.
- [Every Entra default user permission, what it does, and how to check yours in one command](https://azureblog.co.uk/posts/entra-default-user-permissions-review/): The agent blueprints toggle is the newest switch under Default user role permissions, but it isn't the only one. Here's what each setting controls, its Graph name, and a short PowerShell check to see where your tenant stands.
- [From November, every user can create agent blueprints in Entra unless you turn it off](https://azureblog.co.uk/posts/users-can-create-agent-blueprints/): Message Center MC1506733: starting in early November 2026, default users can create agent identity blueprints unless an admin switches off a new user setting. What a blueprint controls, who's affected, and how to turn it off before the rollout.
- [What's actually inside an Azure region? From the planet to one server, then we break it](https://azureblog.co.uk/posts/inside-an-azure-region/): Pick UK South from a dropdown and you're choosing a real place: zones, buildings, fences, generators, racks and hosts. Here's what's inside, layer by layer, using only what Microsoft publishes. Then choose how your app is deployed, knock out a server, a zone or the whole region, and see what survives.
- [Microsoft's deadline week: four products retire tomorrow, and Secure Boot's last 2011 certificate expires next Monday](https://azureblog.co.uk/posts/secure-boot-certificates-and-october-retirements/): 13 October 2026 ends support for Windows 11 24H2 Home and Pro, Windows 10 2016 LTSB and Office LTSC 2021, and moves Windows Server 2022 into extended support. On 19 October the Windows Production PCA 2011 certificate expires. Pick what you run for your own action list, and check any device's Secure Boot status in seconds.
- [Windows Server 2012 and 2012 R2: the last security update ships tomorrow](https://azureblog.co.uk/posts/windows-server-2012-esu-ends/): Extended Security Updates for Windows Server 2012 and 2012 R2 end with the October 2026 Patch Tuesday. There's no fourth year, not even on Azure. Here's what stops, who's still running these servers and why, how to find yours, and what to do with them.
- [Governing AI agent identities in Entra: sponsors, access packages and expiry](https://azureblog.co.uk/posts/governing-ai-agent-identities-in-entra/): Every AI agent with an Entra Agent ID needs a human who answers for it, access that runs out, and a plan for when its sponsor leaves. Here's how to set up sponsors, access packages and Lifecycle Workflows so agents don't become the next generation of orphaned service principals.
- [Domainless SAML federation: let partners sign in with their own IdP, whatever their email domain](https://azureblog.co.uk/posts/domainless-saml-federation-b2b/): SAML/WS-Fed federation for B2B guests used to depend on the guest's email domain matching the partner's IdP. Domainless federation is now generally available, and it routes sign-in by the IdP's Issuer URI instead.
- [How a Tube gate gets paid: half a second at the edge, the maths in the back office](https://azureblog.co.uk/posts/how-a-tube-gate-gets-paid/): You tap a bank card, the gate opens, and your bank hasn't approved anything yet. Here's how London's contactless system works, why it's built that way, and the cloud design lesson inside it.
- [SOC Identity Responder: contain a compromised account without handing out admin roles](https://azureblog.co.uk/posts/entra-soc-identity-responder-role/): A new built-in Entra role lets security analysts disable users, revoke sessions and reset passwords from Microsoft Defender, and nothing else. Here's what it can and can't do, and how to set it up with PIM.
- [Road to 50: how this blog runs for about £1 a month](https://azureblog.co.uk/posts/road-to-50-running-this-blog-for-1-a-month/): Fifty posts in, here's exactly how azureblog.co.uk is built, hosted and published, and why the whole thing costs less than a coffee each month.
- [Intune in September: deployment rings, faster compliance and stricter automation](https://azureblog.co.uk/posts/intune-september-2026-roundup/): Five recent Intune changes that affect how you roll out, how quickly devices become compliant, and whether your automation keeps working.
- [Lock down app consent without blocking your users](https://azureblog.co.uk/posts/admin-consent-workflow-and-user-consent/): Illicit consent grants are a favourite way to steal mailbox data. Restricting user consent and turning on the admin consent workflow closes the door without making life miserable.
- [Unattended Graph PowerShell scripts with certificate authentication](https://azureblog.co.uk/posts/graph-powershell-app-only-certificate/): Scheduled scripts can't answer an MFA prompt. App-only authentication with a certificate is the right way to run Microsoft Graph PowerShell unattended.
- [Microsoft is retiring its own SMS and voice MFA. Here's your plan.](https://azureblog.co.uk/posts/entra-sms-voice-mfa-retirement/): Microsoft-provided text and phone call authentication in Entra ID ends for most users on 1 February 2027. Passkeys are already being switched on. What changes, when, and what to do now.
- [Intune in August: unattended Remote Help, DDM app installs and eSIM](https://azureblog.co.uk/posts/intune-august-2026-roundup/): Helpdesk agents can now support Windows devices with nobody at the keyboard, Apple VPP apps can install through declarative device management, and corporate Android gets eSIM control.
- [Stop surprise Azure bills with budgets and anomaly alerts](https://azureblog.co.uk/posts/azure-budgets-and-cost-anomaly-alerts/): Azure won't stop you spending, but it will tell you early if you set it up. Two features take five minutes and catch most surprises.
- [Private endpoints and DNS: why your private endpoint isn't being used](https://azureblog.co.uk/posts/private-endpoints-dns/): You created a private endpoint, but traffic still goes to the public IP. It's almost always DNS. How private endpoint name resolution works and how to fix it.
- [Key Vault: move from access policies to Azure RBAC](https://azureblog.co.uk/posts/key-vault-rbac-vs-access-policies/): Key Vault has two permission models. Azure RBAC is the recommended one, and switching is simpler than it looks if you plan the role mapping first.
- [Intune in July: macOS custom compliance and Defender settings that finally win](https://azureblog.co.uk/posts/intune-july-2026-roundup/): Custom compliance comes to macOS, a preview stops Group Policy overriding your Defender settings, and Store app search goes regional.
- [Windows LAPS with Intune: unique local admin passwords in minutes](https://azureblog.co.uk/posts/windows-laps-with-intune/): If every PC shares the same local administrator password, one compromised machine means all of them. Windows LAPS fixes that, and it's built into Windows and Intune.
- [Microsoft Authenticator now blocks jailbroken and rooted devices](https://azureblog.co.uk/posts/authenticator-jailbreak-root-detection/): Authenticator now refuses to add or use work and school accounts on jailbroken or rooted phones. There's nothing to configure, but your service desk should know.
- [BYOD Windows access with Entra registration is now GA](https://azureblog.co.uk/posts/byod-windows-entra-registration-ga/): Users, partners and internal guests can now reach corporate resources from personal Windows devices using Entra registration, without joining them to anything.
- [Entra Connect Sync is on its way out. Start planning for Cloud Sync.](https://azureblog.co.uk/posts/connect-sync-to-cloud-sync/): Microsoft has started a phased move of identity sync from Entra Connect Sync to Cloud Sync, and has closed a privilege takeover route in hybrid sync. Here's what both changes mean for you.
- [Intune's advanced features are coming to Microsoft 365 E3 and E5](https://azureblog.co.uk/posts/intune-suite-in-m365-e3-e5/): Remote Help, Endpoint Privilege Management, Cloud PKI and more are moving into the main Microsoft 365 licences. If you've been holding off because of the add-on cost, it's time to look again.
- [Entra Backup and Recovery is here: an undo button for your tenant](https://azureblog.co.uk/posts/entra-backup-and-recovery/): Entra ID now keeps daily backups of your critical directory objects and lets you compare and roll back changes. It's on by default, but you need to know how it works before you need it.
- [Account Discovery: find the accounts your SaaS apps forgot to tell you about](https://azureblog.co.uk/posts/entra-account-discovery-ga/): Account Discovery reports the accounts that exist inside connected applications, including orphaned ones that nobody in Entra was ever assigned. It's now generally available.
- [Soft delete for Entra device objects: a safety net for device clean-ups](https://azureblog.co.uk/posts/entra-device-soft-delete-preview/): Deleted device objects can now go into a recoverable state instead of disappearing instantly. A small preview feature that takes the fear out of stale device clean-ups.
- [Cross-tenant group sync is GA: one group, many tenants](https://azureblog.co.uk/posts/cross-tenant-group-sync-ga/): Multi-tenant organisations can now sync security groups from a source tenant into target tenants, alongside the users already synced with cross-tenant sync.
- [System-preferred authentication now picks the first factor too](https://azureblog.co.uk/posts/system-preferred-first-factor-passwordless/): Users with a passkey may now sign in without being asked for a password at all, and registration campaigns can prompt for passkeys. Two changes that quietly push tenants towards passwordless.
- [Rolling out "require compliant device" without a flood of tickets](https://azureblog.co.uk/posts/rolling-out-require-compliant-device/): Requiring a compliant device is one of the strongest Conditional Access controls you can apply. It's also one of the easiest to get wrong. A step-by-step rollout.
- [Packaging Win32 apps for Intune: detection rules and return codes](https://azureblog.co.uk/posts/win32-app-packaging-detection-rules/): Most Win32 app failures in Intune come down to two things: a detection rule that doesn't match reality, and return codes Intune doesn't understand.
- [Entra Agent ID: giving AI agents real identities](https://azureblog.co.uk/posts/entra-agent-id-identities-for-ai-agents/): AI agents now get first-class identities in Entra, with Conditional Access and lifecycle controls following. Here's why identity teams should get involved early.
- [Configurable token lifetimes are GA: when to shorten them (and when not to)](https://azureblog.co.uk/posts/configurable-token-lifetimes-ga/): You can now set the lifetime of access, ID and SAML tokens per application. Useful for sensitive apps, but there are better tools for most session problems.
- [Require phishing-resistant MFA on every PIM activation](https://azureblog.co.uk/posts/pim-activation-conditional-access-context/): PIM can now require a Conditional Access authentication context every time someone activates a role, and it's generally available. Here's how to set it up properly.
- [Intune Remediations: find and fix problems before users notice](https://azureblog.co.uk/posts/intune-remediations-scripts/): Remediations pair a detection script with a fix script and run them on a schedule. It's one of the most useful and underused features in Intune.
- [Tenant configuration management: snapshot your Entra config and catch drift](https://azureblog.co.uk/posts/entra-tenant-configuration-management/): New APIs let you snapshot tenant configuration as JSON and monitor it for drift. Configuration as code for Entra just got much more practical.
- [Hybrid join without Entra Connect: hybrid join using Entra Kerberos](https://azureblog.co.uk/posts/hybrid-join-with-entra-kerberos-preview/): A new preview lets Windows devices become Entra hybrid joined during provisioning, without device sync through Entra Connect or AD FS.
- [Clean up guest accounts with access reviews](https://azureblog.co.uk/posts/guest-access-reviews/): Guest accounts pile up quietly. Access reviews ask the right people whether each guest still needs access, and can remove them automatically if nobody says yes.
- [Synced passkeys and passkey profiles are now GA in Entra ID](https://azureblog.co.uk/posts/synced-passkeys-and-passkey-profiles/): Entra ID now supports passkeys stored in password managers and phone platforms, and lets you set different passkey rules for different groups. Here's how to use both sensibly.
- [Six KQL queries for Entra sign-in logs every admin should keep](https://azureblog.co.uk/posts/kql-queries-for-entra-sign-in-logs/): Once sign-in logs flow into Log Analytics, a few queries answer most of the questions you'll get. Copy these into a workbook or saved searches.
- [Why Edge suddenly switched language on a whole office](https://azureblog.co.uk/posts/edge-switched-language-intune-language-pack/): Users in one office reported Edge and LinkedIn appearing in another language. Nobody had touched Edge. The cause was an Intune app assignment.
- [External MFA is GA: third-party MFA without giving up Conditional Access](https://azureblog.co.uk/posts/external-mfa-ga/): Entra ID now officially supports external MFA providers, with Entra still evaluating policy and risk. It's the proper replacement for custom controls.
- [Resource locks: a cheap insurance policy against the wrong click](https://azureblog.co.uk/posts/azure-resource-locks/): A delete lock takes seconds to add and can save a production outage. Here's how locks work, and the ReadOnly gotchas to avoid.
- [Group-based licensing: finding and fixing assignment errors](https://azureblog.co.uk/posts/group-based-licensing-errors/): Group-based licensing is the right way to assign Microsoft 365 licences, until a user silently doesn't get one. Here's where the errors hide.
- [Azure Policy guardrails every subscription should have](https://azureblog.co.uk/posts/azure-policy-allowed-locations-and-guardrails/): A handful of built-in Azure Policy assignments stop the most common mistakes before they happen. Start with these at the management group level.
- [Converting synced users to cloud-managed: Source of Authority is GA](https://azureblog.co.uk/posts/convert-synced-users-to-cloud-source-of-authority/): You can now switch an individual Active Directory-synced user to be managed in the cloud, without deleting and recreating it. A big step towards shrinking on-premises AD.
- [Deploy from GitHub Actions to Azure without storing a single secret](https://azureblog.co.uk/posts/github-actions-to-azure-without-secrets/): Workload identity federation lets GitHub Actions sign in to Azure with short-lived tokens instead of a stored client secret. Here's the full setup.
- [AADSTS75011: when the app insists on how you signed in](https://azureblog.co.uk/posts/aadsts75011-requested-authn-context/): Users click a link in an email, land on a SAML app, and get an error page. The fix is not in Entra at all.
- [Managed identities vs service principals: which should your workload use?](https://azureblog.co.uk/posts/managed-identities-vs-service-principals/): Both let code authenticate to Azure and Microsoft Graph. One needs you to manage secrets; the other doesn't. A simple guide to choosing.
- [Named locations: getting IP ranges and countries right in Conditional Access](https://azureblog.co.uk/posts/named-locations-in-conditional-access/): Named locations look simple, but trusted IPs and country blocks are easy to get subtly wrong. What they can and can't do, and how to use them well.
- [Authentication strengths: requiring the right kind of MFA](https://azureblog.co.uk/posts/authentication-strengths-explained/): Requiring MFA treats an SMS code and a passkey as equals. Authentication strengths let you say which methods are good enough for which resources.
- [Turning on Defender CSPM across a landing zone](https://azureblog.co.uk/posts/defender-cspm-at-scale/): Foundational CSPM is free and already on. Defender CSPM adds attack paths and agentless scanning. Here's how I'd roll it out across many subscriptions.
- [Test Conditional Access safely with report-only mode and What If](https://azureblog.co.uk/posts/conditional-access-report-only-and-what-if/): Most Conditional Access outages come from a policy that did something nobody expected. Two built-in tools let you see exactly what a policy would do before it does it.
- [SCIM provisioning when every target is its own app](https://azureblog.co.uk/posts/scim-one-app-per-library/): Some SaaS platforms need a separate Enterprise App for each instance or library. A few habits keep that manageable.
- [Break-glass accounts done right](https://azureblog.co.uk/posts/break-glass-accounts-done-right/): Emergency access accounts are the one thing you hope never to use and must never get wrong. A practical checklist for setting them up and keeping them safe.
- [Activate PIM roles from PowerShell with Microsoft Graph](https://azureblog.co.uk/posts/activate-pim-roles-with-powershell/): The portal is fine for occasional use, but if you activate roles every day, a few lines of Graph PowerShell are faster. Here's how to list eligible roles and activate one.
- [Find expiring app secrets and certificates before they bite](https://azureblog.co.uk/posts/find-expiring-app-secrets-graph/): Expired client secrets cause some of the most avoidable outages in Entra. A short Graph script shows what's about to expire across the tenant.
- [Rolling a SAML signing certificate without an outage](https://azureblog.co.uk/posts/saml-certificate-rollover/): Entra SAML signing certificates expire after three years by default. Here's the cutover plan I use so nobody notices the change.
- [Temporary Access Pass: onboarding users without a password](https://azureblog.co.uk/posts/temporary-access-pass-onboarding/): A Temporary Access Pass lets a new starter, or someone who's lost their phone, sign in once and set up a passkey or Authenticator. No temporary passwords sent by email.

## Learning paths
- [Conditional Access from zero](https://azureblog.co.uk/paths/conditional-access/): Build a Conditional Access setup you can trust: safe testing, emergency access, the right MFA, locations and device compliance.
- [Passwordless rollout](https://azureblog.co.uk/paths/passwordless/): Move users from passwords and text messages to passkeys, from the first sign-in to retiring SMS.
- [Intune for Windows, start to finish](https://azureblog.co.uk/paths/intune-windows/): Apps, scripts, local admin passwords and compliance, in the order most teams roll them out.
- [Locking down admin access](https://azureblog.co.uk/paths/privileged-access/): Emergency accounts, just-in-time roles, strong activation and safer app permissions.
- [Automating Entra and Azure safely](https://azureblog.co.uk/paths/automation/): Scripts and pipelines without stored secrets, and the queries to keep an eye on them.
- [Azure landing zone guardrails](https://azureblog.co.uk/paths/azure-governance/): The cheap, high-value controls every Azure estate should have before it grows.
- [Shrinking hybrid identity](https://azureblog.co.uk/paths/hybrid-identity/): Plan the move from Connect Sync, convert users to the cloud and rethink hybrid join.
- [Entra ID foundations for new admins](https://azureblog.co.uk/paths/entra-foundations/): The everyday Entra jobs done properly: onboarding, Conditional Access testing, licensing, app consent, guests and recovery.
- [Identity security operations](https://azureblog.co.uk/paths/identity-secops/): Spot trouble in the logs, contain compromised accounts and close the gaps attackers use: apps, tokens and agents.
- [Ready for the 2026 and 2027 retirements](https://azureblog.co.uk/paths/retirement-readiness/): The Microsoft changes with hard dates coming up, and what to do about each one before it bites.

## Free tools (run in the browser)
- [Sign-in Investigator](https://azureblog.co.uk/tools/investigator/): Replay sign-in logs on a 3D globe and catch password spray, MFA fatigue and impossible travel.
- [Sign-in log explainer](https://azureblog.co.uk/tools/signin/): Paste a sign-in event from Entra and get a plain-English account of what happened and why.
- [SAML decoder](https://azureblog.co.uk/tools/saml/): Decode a SAMLRequest or SAMLResponse and spot common SSO problems.
- [JWT decoder](https://azureblog.co.uk/tools/jwt/): Decode an Entra access or ID token and see what each claim means.
- [Troubleshooting wizards](https://azureblog.co.uk/tools/troubleshoot/): Step-by-step paths for sign-in failures, non-compliant devices and SSO errors.
- [Conditional Access visualiser](https://azureblog.co.uk/tools/ca/): Load your policies as JSON, see each in plain English and check them against a baseline.
- [Certificate decoder](https://azureblog.co.uk/tools/cert/): Decode a PEM, CER or SAML metadata certificate: expiry, thumbprints, SANs and key usage.
- [Email header analyser](https://azureblog.co.uk/tools/headers/): Paste message headers to see the route, SPF, DKIM, DMARC and Microsoft 365's spam verdict.
- [IP range checker](https://azureblog.co.uk/tools/ip-check/): Test IPs against named location ranges, and spot private, overlapping or invalid ranges.
- [Intune and Autopilot error codes](https://azureblog.co.uk/tools/intune-errors/): 0x87D1… and 0x8018… codes from app installs, enrolment and Autopilot, explained with what to check.
- [Event ID lookup](https://azureblog.co.uk/tools/event-ids/): 4625, 4771, PRT, hybrid join, LAPS and BitLocker event IDs, explained with what to check.
- [Tenant ID lookup](https://azureblog.co.uk/tools/tenant/): Find any domain's Entra tenant ID, cloud and region, and whether sign-in is managed or federated.
- [GUID lookup](https://azureblog.co.uk/tools/guid/): Identify any Microsoft app, Entra role or Graph permission GUID from a log or token.
- [AADSTS error lookup](https://azureblog.co.uk/tools/aadsts/): Common sign-in error codes, explained with what to check.
- [Graph permission explainer](https://azureblog.co.uk/tools/permissions/): What a permission allows, how risky it is, and a least-privilege alternative.
- [Which licence do I need?](https://azureblog.co.uk/tools/licences/): Find which Entra and Intune licences include a feature.
- [MSOnline & AzureAD to Graph](https://azureblog.co.uk/tools/graph-powershell/): Translate retired PowerShell cmdlets to Microsoft Graph PowerShell.
- [Timestamp converter](https://azureblog.co.uk/tools/timestamps/): Convert lastLogonTimestamp, pwdLastSet, Unix time and ISO dates, with what each attribute means.
- [Private endpoint DNS zones](https://azureblog.co.uk/tools/private-dns/): The private DNS zone and on-premises forwarder for each Azure private endpoint.
- [Licence SKU lookup](https://azureblog.co.uk/tools/skus/): Turn SKU part numbers like SPE_E5 into product names and see every service plan.
- [VM size decoder](https://azureblog.co.uk/tools/vm-sizes/): What each part of an Azure VM size name means, from family to feature letters.
- [Least-privilege role finder](https://azureblog.co.uk/tools/roles/): Tick the permissions someone needs and find the smallest Azure or Entra built-in role that grants them.
- [Identity converter](https://azureblog.co.uk/tools/id-convert/): Convert between objectGUID, ImmutableId, Entra object ID, SID and LDAP hex.
- [Resource ID parser](https://azureblog.co.uk/tools/resource-id/): Split an Azure resource ID or portal URL into its parts, with CLI, PowerShell and KQL to target it.
- [Tenant health check](https://azureblog.co.uk/tools/health/): Run a read-only script, load the result here and get a scored security report.
- [Email security checker](https://azureblog.co.uk/tools/email-security/): Grade a domain's SPF, DKIM, DMARC and MX records and get the records to fix them.
- [App permission risk check](https://azureblog.co.uk/tools/app-risk/): Find the apps in your tenant that can read every mailbox or change admin roles.
- [Access Map](https://azureblog.co.uk/tools/access-map/): Who holds which Entra PIM roles and Azure roles at every scope, with groups expanded and risky access flagged.
- [Am I affected?](https://azureblog.co.uk/tools/affected/): Answer a few questions and get a dated action plan for upcoming Microsoft changes.
- [Deadline calendar](https://azureblog.co.uk/timeline/): Every Microsoft deadline on the timeline, as a calendar you can subscribe to.
- [Azure subnet planner](https://azureblog.co.uk/tools/subnets/): Lay out VNet subnets with Azure's reserved addresses and minimum gateway, firewall and Bastion sizes.
- [Azure naming generator](https://azureblog.co.uk/tools/naming/): Consistent resource names from Cloud Adoption Framework abbreviations, checked against each type's rules.
- [Microsoft 365 DNS checker](https://azureblog.co.uk/tools/m365-dns/): Check a domain's MX, Autodiscover, DKIM, Teams and Intune enrolment records against what Microsoft expects.
- [Conditional Access policy builder](https://azureblog.co.uk/tools/ca-builder/): Build a policy from a template or form and get the JSON and Graph PowerShell to create it.
- [Deadline widget](https://azureblog.co.uk/tools/embed/): Show upcoming Microsoft deadlines on your SharePoint intranet or in a Teams tab.
- [User comms templates](https://azureblog.co.uk/tools/comms/): Ready-to-send emails for passkeys, MFA changes, compliance and more.
- [Change request generator](https://azureblog.co.uk/tools/change/): Fill in a short form and get a complete change request with risk and rollback.
- [Win32 app command builder](https://azureblog.co.uk/tools/win32/): Packaging, silent install and uninstall commands, detection rules and return codes for Intune.
- [Sign-in KQL builder](https://azureblog.co.uk/tools/kql-builder/): Pick filters and get a ready-to-run KQL query for Entra sign-in logs.
- [Graph query builder](https://azureblog.co.uk/tools/graph-query/): Build $filter and $select queries for users, groups, devices and sign-ins, with Graph PowerShell.
- [Script library](https://azureblog.co.uk/tools/scripts/): Every PowerShell, CLI, Graph and KQL snippet on this site, searchable, with a copy button.
- [KQL library](https://azureblog.co.uk/tools/kql/): Ready-to-use Log Analytics queries from posts on this site.
- [Practice quiz](https://azureblog.co.uk/tools/quiz/): Test yourself on Entra ID, Intune and Azure, or study with flashcards.

## Reference
- [Entra ID sign-in error codes](https://azureblog.co.uk/errors/): what 61 AADSTS errors mean and how to fix them
- [Change feed](https://azureblog.co.uk/changes/): recent Microsoft changes, with those needing action flagged
- [Deadlines](https://azureblog.co.uk/timeline/): upcoming Microsoft retirements
- [Glossary](https://azureblog.co.uk/glossary/)