Matt Call

PM @Microsoft - Helping build tech to secure endpoints - thoughts here are mine and are not always based in reality

[Matt Call @DeviceDeploy]

@AdamGrossTX @IntuneSuppTeam The limit is more than 1 a day. I’ll look at it for you :).

[Matt Call @DeviceDeploy]

@BrianGadeWI I can take a look. Some of this stuff uses different enforcement mechanisms. We might send delete but the CSP might not do a great job cleaning up.

[Matt Call @DeviceDeploy]

@BruceSaaaa You know it.

[Matt Call @DeviceDeploy]

@rock_digga Check the licensing of the user who is failing to register. The event logs should also give you the failure reason.

Check the MDM scope as well -> https://t.co/lAP8E9hMtK

[Matt Call @DeviceDeploy]

@rem_ch @IntuneSuppTeam @brookspeppin @AasawariNavathe I can ask. My perspective is that 200 keys on an object is a pretty reasonable higher limit, and it makes sense why we don’t let a device delete their keys.

Sounds like devices are “over-escrowing”. Curious, how many keys are active on the device?

[Matt Call @DeviceDeploy]

Thanks for having me @mmsmoa and look forward to the next time!

[MMS Minnesota @mmsmoa]

There’s a lot of interest for @DeviceDeploy and @KrysOnTheNet session. So many want to hear what they have to say about “Intune Internals: Extreme Deep Dive”.

#MMSFlamingo #MMSMOA

[Matt Call @DeviceDeploy]

Come see us at this afternoon at @wpninjasummit https://t.co/uT1Gp4oiOR

[Matt Call @DeviceDeploy]

@gwblok @echoRelay We’re in the process of completing ARM support. No date yet.

[Matt Call @DeviceDeploy]

Great read…

[rootsecdev @rootsecdev]

Why we are on the topic of token theft. Lets talk for a second around session hijacking with AiTM and 3rd party products like Fortinet and Palo Alto's.

Incredible advice here that you all should read and bookmark. Detection engineering in Sentinel is a hobby of mine and I love sharing advice.

https://t.co/f9WmgToU9d

[Matt Call @DeviceDeploy]

@inthecloud_247 @SkipToEndpoint @MSIntune @MikeDanoski For sure - no argument from me there.

[Matt Call @DeviceDeploy]

@SkipToEndpoint @inthecloud_247 @MSIntune @MikeDanoski We can certainly work to update it. Likely it was added or created after the AV profile was created.

[Matt Call @DeviceDeploy]

@0x80070001 @NathanMcNulty @MikeDanoski @Mister_MDM @inthecloud_247 @syst_and_deploy @MMelkersen @AdamGrossTX Check to make sure your devices aren’t going in and out of the groups you use to assign scope tags.

[Matt Call @DeviceDeploy]

@0x80070001 @MikeDanoski @Mister_MDM @inthecloud_247 @syst_and_deploy @NathanMcNulty @MMelkersen @AdamGrossTX Not tracking anything. Maybe @IntuneSuppTeam is….

Seen this sort of behavior in the past when someone is tinkering with RBAC… but never been able to root cause it…

[Matt Call @DeviceDeploy]

@GraemeCE @NathanMcNulty @MikeDanoski has stories.

[Matt Call @DeviceDeploy]

@GraemeCE @NathanMcNulty lol. The definitions we use come directly from the platform. We’ve tried various efforts to make them better with mixed results.

[Matt Call @DeviceDeploy]

@SwiftOnSecurity The romantic language of the 21st century…

[Matt Call @DeviceDeploy]

@Scott_wi_badger @abetterpc Fixed for most. Still working on a few. We will send a mail when we’re all good.

[Matt Call @DeviceDeploy]

This will be fun -> https://t.co/f57FnUwD4u #MMSMOA #Intune

Might need a bigger room @abetterpc :)

[Matt Call @DeviceDeploy]

@acjuelich @MyNameIsMurray You’re right. I don’t love auto elevate based on reputation, but I do love reputation as a attribute to allow/deny elevation. Working on it… :)

[Matt Call @DeviceDeploy]

@abetterpc @RadissonBlu Wait, you like wine?