Practical knowledge for IT professionals

A practical collection of short, copy-paste KQL queries for the everyday investigation questions that come up across Intune, Microsoft Defender, and Entra ID. These starters cover non-compliant devices, risky sign-ins, vulnerability status, and sensor health so you can get answers faster and spend more time on the actual work.

Most CA failures aren’t missing features; they’re misconfigurations that create lockouts, MFA fatigue, and shadow IT. This post breaks down the real-world mistakes that keep policies in report-only forever, then shows the practical fixes: proper break-glass, Intune device compliance that actually works, and friction-reducing patterns that get adopted instead of bypassed.

Agentic AI is finally moving past demos and into the real work of IT operations—triaging incidents, provisioning access, remediating vulnerabilities, and watching the environment so humans don’t have to. Done right, it reduces on-call load. Done wrong, it creates new incidents. This is the practical version.

AI has permanently reset Patch Tuesday volume. With back-to-back months above 1,000 CVEs and models finding (and helping weaponize) bugs faster than most organizations can deploy fixes, the old monthly change window is dead. Here’s a practical survival guide: prioritize with Defender Vulnerability Management, tighten Autopatch rings, handle third-party, and use containment when you can’t patch fast enough.