[ OK ] Mounted /var/log/fieldnotes — write access enabled
[ OK ] Started entra-sync.service — tenants reachable
[ OK ] Loaded msp-toolkit.conf — Microsoft 365, Entra, Intune
# Field notes from a Cloud Engineer — "the examined network is worth running"
# Field notes from a Cloud Engineer at an MSP — Microsoft 365, Entra, Intune, and lessons learned keeping tenants running.
role: "Cloud Engineer @ MSP"
experience: "over a decade in managed services"
focus: "Microsoft 365 · Entra · Intune"
homelab: "always running"
philosophy: "all systems tend toward chaos. tend back."
Microsoft is making passkeys the default sign-in and retiring native SMS and voice MFA. MC1426371 sets the clock: passkeys auto-enable September 1, 2026, and Microsoft-provided telecom delivery ends February 1, 2027. Here’s what changes on its own, what quietly changes underneath you, and the two decisions every MSP has to make before the dates arrive.
Most MSPs patch Windows through their RMM — detect, push, force a reboot. Intune’s hotpatch does the same monthly security work in-memory, no reboot, honoring your rings. Here’s the case for moving Windows quality updates off the RMM and onto the platform built for them.
Disabling Chrome’s built-in password manager through Intune’s settings catalog takes about a minute. Understanding what it actually does — and the two ways it quietly doesn’t do what people assume — is the part that saves you a ticket later.
When a client says they can’t attach files to an external Teams chat, it usually isn’t broken — it’s working exactly as Microsoft intended. Here’s what’s really happening, and why the fix lives in PowerShell instead of the admin center.
When Intune asks for a Bundle ID to apply an App Protection Policy to a third-party Android app, here’s exactly where to find it — using Vonage as a real-world example.