[ OK ] Mounted /var/log/fieldnotes — write access enabled
[ OK ] Started entra-sync.service — tenants reachable
[ OK ] Loaded msp-toolkit.conf — Microsoft 365, Entra, Intune
# Field notes from a Cloud Engineer — "practical lessons from inside the tenant"
# Field notes from a Cloud Engineer at an MSP — Microsoft 365, Entra, Intune, and lessons learned keeping tenants running.
role: "Cloud Engineer @ MSP"
experience: "over a decade in managed services"
focus: "Microsoft 365 · Entra · Intune"
homelab: "built to test, break, and learn"
philosophy: "solve the problem. document the lesson."
PDFgear 2.1.20 installs silently with one straightforward command. Building an Intune Win32 app that detects correctly, uninstalls cleanly, and survives the next version takes a little more thought.
Converting a departed employee’s mailbox to a shared mailbox and forwarding it to a distribution group keeps their address alive without handing anyone a second inbox to monitor. Here’s the flow, the four steps, and the one setting to confirm before you close the ticket.
The three built-in quarantine policies differ on exactly two settings, and one of them is a silent ticket generator sitting in every tenant by default. Here’s the decision map, the override that ignores your permissions, and the PowerShell to audit it.
On September 1, 2026, Microsoft auto-enables passkeys and flips your registration campaign to Microsoft-managed. There is a tenant-level opt-out — passkeyDynamicMigration — that delays it. Here’s what it actually buys you, why setting it safely needed a script rather than a one-line PATCH, and why February 1, 2027 is the date that can’t be postponed.
A domain controller dies, it held every FSMO role, and there is no usable backup. It feels like the domain is gone. It usually isn’t — here’s the shape of the recovery, and the one mistake that turns a bad day into a rebuild.