Guides

Why Intune-managed devices need certificates, how SCEP and PKCS delivery work, and your options when you don't want to run NDES and ADCS.

How SCEP and PKCS certificate delivery differ in Intune — key generation, infrastructure, renewal behaviour, and when each one fits.

Why Android Enterprise EAP-TLS Wi-Fi fails with certificates that work everywhere else, how Android selects client certificates, and what to put in your SAN.

How Intune certificate renewal actually works, why offline devices miss their window, what happens at expiry, and how to monitor before users notice.

An 802.1X primer, why NPS is disappearing from cloud-first estates, the cloud RADIUS options landscape, and why EAP-TLS is the end state.

A systematic method for diagnosing EAP-TLS Wi-Fi failures — client cert, chains on both sides, server cert, Windows event logs and reason codes.

Why config drift in Entra and Azure goes unnoticed, what audit log retention actually gives you, what good change tracking looks like, and what NIS2 and DORA really expect.

Concrete Entra ID drift scenarios — CA policy edits, consent grants, role changes — and three detection approaches: audit logs, export-and-diff, and IaC.

The always-on tax, the highest-value Azure cost wins ordered by effort — orphaned resources, scheduling, right-sizing, storage tiers — and a monthly review habit.

Office-hours, follow-the-team and on-demand scheduling patterns for Azure dev/test VMs, Azure-native options vs scheduling products, and honest savings math.