Hybrid availability has two directions and several trust layers. Test a single mailbox pair, identify the failing direction and then follow Autodiscover, OAuth and routing evidence.
Article collection
Microsoft 365 and Exchange
Messaging, migration, coexistence and administration guidance across Exchange Server, Exchange Online and Microsoft 365.
Published guidance
A stalled move can be healthy workload protection, database pressure, replication lag or a permanent failure. The move report tells you which before you change throttling.
5.7.1 is a permanent rejection family, not one cause. Read the enhanced status text and message path before changing connectors, transport rules or spam policy.
A failed Win32 deployment can be assignment, applicability, download, installer, exit-code or detection failure. The Intune Management Extension logs show the stage.
Most Windows enrollment failures happen before policy delivery. Separate licensing, MDM scope, device limits, restrictions and stale enrollment state using local and cloud evidence.
A missing policy tip can be client configuration, policy scope, sensitive-information matching, threshold or service evaluation. Test one controlled message and follow the evidence.
Co-management lets Configuration Manager and Intune manage the same device. Each workload has exactly one authority, and moving a slider transfers it for every device in scope.
Six generations of Exchange, and the same four problems each time. The products changed completely; the design questions barely moved.
The last Exchange server is no longer a licensing footnote. Subscription Edition, the dedicated hybrid app and the Graph transition have changed what hybrid coexistence actually requires.
The detection rule is the part that decides whether an application is installed. Get it wrong and Intune reinstalls forever, or reports success for software that is not there.
Compliance is only a report until Conditional Access reads it. Connecting the two is a single checkbox and the most effective way to lock out your entire organisation.
The Intune portal tells you a device is non-compliant. It takes several clicks to learn which policy, and there is no clicking your way through nine hundred devices. A script that answers it in one pass.
Intune does not arbitrate conflicts. Two policies setting the same value differently means neither applies, which is the opposite of what most administrators assume.
Audits, incidents and reviews all ask the same questions about a tenant. Collecting the answers the same way every time turns an ad-hoc scramble into a comparable record.
A tenant move is an identity project wearing a migration costume. The mailboxes are the easy part; the domain name can only exist in one tenant at a time.
The defaults optimise for collaboration, which is the right default for Microsoft and the wrong one for most organisations. Six settings change the exposure considerably.
Three DNS records that only work in a specific order. Publishing a strict DMARC policy before the inventory is complete is how organisations stop their own invoices arriving.
Message trace answers where a message went. Getting a useful answer depends on knowing which tool covers which window, and on reading the event sequence rather than the final status.
Windows 10 reached end of support in October 2025. A script that reports, per device, which Windows 11 requirement it fails — and says plainly which answers it cannot give you.
Autopilot failures happen in front of the person receiving the device, which raises the stakes. Almost all of them fall into four categories, distinguishable within minutes.
A practical readiness plan for discovering EWS dependencies, controlling temporary access and moving Exchange Online integrations forward.
An architectural view of what changes across Microsoft platform generations, and the operational questions that still need an answer.