Sentinel Identity
Microsoft Entra and Microsoft 365 articles for IT teams.
Troubleshooting, architecture notes, and how-to guides for admins working with Conditional Access, MFA, passkeys, hybrid identity, shared mailboxes, and DNS.
Topics
All topics →Authentication
12 articlesProtocols, tokens, sign-in flows, federation patterns, and the backend mechanics behind authentication systems.
Conditional Access
9 articlesConditional Access policy behavior, device checks, browser support, and operational troubleshooting.
Passkeys
8 articlesPasskey architecture, registration, attestation, compatibility, rollout planning, and troubleshooting in Microsoft Entra.
Tenant Operations
5 articlesTenant recovery, device join, Primary Refresh Token behavior, and day-to-day Microsoft Entra operations.
Microsoft Entra
4 articlesGeneral Microsoft Entra architecture, operations, and identity platform articles.
Domains and DNS
2 articlesCustom domains, DNS records, MX, SPF, DKIM, DMARC, and Microsoft 365 domain onboarding.
Agent ID
1 articleMicrosoft Entra Agent ID coverage, including security architecture, governance, and network controls for agents.
Latest articles
30 published · search by title, error code, or topic
Shared Mailbox Not Showing Up in Outlook (Microsoft 365): Why It Happens and How to Fix It Properly
Your user has Full Access to a shared mailbox but it isn't appearing in Outlook. Walk the five-step diagnostic — auto-mapping, replication, profile cache, mailbox type, and manual add — and fix the underlying cause, not the symptom.
Shared Mailbox 'You Don't Have Permission' Error in Microsoft 365: Diagnostic Path and Fixes
The user clicks the shared mailbox and Outlook says 'You don't have permission.' Walk the access-flag hierarchy, deny-permission precedence, ACL inheritance, and the licensing trap that produces the same error message.
Send As Permission Not Working in Microsoft 365: Why the Grant Looks Right but the Send Still Fails
Send As is granted, propagation has completed, the user still gets 'The message could not be sent.' Walk the difference between Send As and Send on Behalf, the auto-complete cache that breaks new addresses, the From-field display rule, and the 60-minute permission-cache window.
Microsoft 365 Distribution List or Dynamic Group Membership Not Updating: Diagnosing the Cache, Filter, and Sync Layers
Members were added but mail isn't reaching them. Dynamic group filter was changed but the group looks the same. Walk the three sync clocks (Entra Connect, EXO directory, EXO recipient cache) and the filter scope gotchas that produce these failures.
Out of Office Not Sending in Microsoft 365: Why Automatic Replies Stop Working and How to Fix Them
OOF is turned on but external senders aren't getting replies. Walk the external-replies toggle, the once-per-sender rule, the spam-filter override, transport rules that suppress OOFs, and the remote domain configuration that controls everything.
Conditional Access Browser Support: A Field Guide to Edge, Chrome, Safari, and the Failure Modes Nobody Explains
Why Conditional Access fails per-browser, what device evidence each browser actually sends, the private-mode trap, and the diagnostic sequence to convert 'works in Chrome but not Safari' into a real root cause.
Microsoft 365 Custom Domains and Email Authentication: SPF, DKIM, DMARC Done Right
An operator's guide to onboarding a custom domain to Microsoft 365 and configuring SPF, DKIM, and DMARC — including the seven anti-patterns that break enterprise mail, a verification command toolkit, and the cutover sequence that prevents delivery incidents.
Outlook Keeps Asking for Password in Microsoft 365: The Modern Auth, MFA, and Credential Cache Diagnostic
Outlook keeps prompting for credentials in a loop, the user enters the right password, the prompt comes back. Walk the modern auth check, credential manager state, MFA enrolment, broken WAM token cache, and the registry keys that resolve the persistent loop.
OneDrive and SharePoint Access Denied in Microsoft 365: The Sharing Model Diagnostic
Access denied after a sharing change, broken inheritance, external sharing disabled at the tenant level, and the Conditional Access policy that produces the same error. Walk the four layers of SharePoint permission and the OneDrive sync states that surface as access errors.
Troubleshooting Microsoft Entra Conditional Access with Sign-in Logs: A Field Guide
How to read the Microsoft Entra sign-in log, decode the Conditional Access tab, and use KQL against SigninLogs in Log Analytics to find why a policy blocked a user.
Microsoft Entra Passkey Registration on Windows, iOS, and Android: A Practitioner's Playbook
How passkey registration in Microsoft Entra ID actually works at the credential-issuance layer, what differs across Windows Hello, iOS Authenticator, Android Keystore, and FIDO2 keys, the platform-specific failure modes, and a Graph-driven inventory of what your users have registered.
When the Passkey Option Won't Appear in Microsoft Entra Security Info: Diagnostic Script and Prevention Design
The Microsoft Entra passkey option is missing or fails silently in Security info. Walk the seven-layer diagnostic, run the included Graph-based check script, and apply the policy-design pattern that prevents the failure mode at scale.
Rolling Out MFA in Microsoft 365 Without Breaking Production: Conditional Access + Authentication Strengths
An engineer-level rollout plan for Microsoft 365 multifactor authentication using Conditional Access, Authentication Strength policies, staged user rings, and exception handling for service accounts and B2B.
Microsoft Entra Backup and Recovery: Operating Model, Incident Playbook, and the Limits Microsoft Doesn't Lead With
An operator's view of Microsoft Entra Backup and Recovery — what it can and cannot do, where it differs from on-prem AD backup, an incident response playbook for accidental bulk changes, and a separation-of-duties workflow for multi-team recovery approval.
Token Lifetimes, Revocation, and Continuous Access Evaluation in Microsoft Entra
An engineering explanation of access, refresh, and ID token lifetimes in Microsoft Entra, how revocation actually propagates, and what Continuous Access Evaluation (CAE) changes for CAE-capable clients.
Hybrid Microsoft Sign-In Architectures Compared: PHS, PTA, Federation, and AD FS
A technical guide to Password Hash Synchronization, Pass-Through Authentication, and federation with AD FS or PingFederate, centered on where validation really happens.
Federation and Token Protocols Explained: SAML, WS-Fed, OAuth 2.0, and OpenID Connect for Microsoft Entra
A technical guide to SAML, WS-Federation, OAuth 2.0, and OpenID Connect, focused on trust transfer, actor roles, and what the backend is validating.
Core Authentication Methods in Microsoft Identity: Kerberos, NTLM, LDAP, Passkeys, Certificates, and Windows Hello
A technical guide to Kerberos, NTLM, LDAP bind, passkeys, certificate-based authentication, and Windows Hello for Business, focused on what each method proves and how the backend validates it.
Microsoft Authentication Protocols and Sign-In Models: From Kerberos to OpenID Connect on Microsoft Entra
A technical guide to the major authentication protocols and sign-in models used in Microsoft environments, including Kerberos, NTLM, LDAP bind, SAML, WS-Federation, OAuth 2.0, OpenID Connect, passkeys, certificate-based authentication, AD FS, and Microsoft Entra sign-in models.
Microsoft Entra Agent ID: Security Architecture, Conditional Access, and Governance for AI Agents
A technical guide to Microsoft Entra Agent ID, including the agent identity model, Conditional Access enforcement, identity governance, risk detection, and network-level controls for AI agents.
Microsoft Entra Passkey Sign-In Compatibility: Browser, OS, and Cross-Device Matrix for Rollout Planning
A technical guide to Microsoft Entra passkey sign-in, including same-device and cross-device flows, compatibility dependencies, and rollout design.
Microsoft Entra Passkey Policy in Practice: Profiles, AAGUID Allowlists, and Attestation Trade-offs
A technical guide to Microsoft Entra passkey profiles, AAGUID restrictions, attestation behavior, and the control-plane logic behind passkey governance.
AADSTS50020: Why External User Sign-Ins Fail in Microsoft Entra and How to Fix Them
A detailed technical guide to AADSTS50020 in Microsoft Entra ID, including resource-tenant identity resolution, invitation redemption, cross-tenant access, and external identity design.
Windows Device Join and Registration Failures in Microsoft Entra: A Diagnostic Walkthrough
A detailed technical guide to Microsoft Entra join and registration failures on Windows, including device registration service flow, pending objects, dsregcmd analysis, and downstream impact on compliance and PRT.
Microsoft Entra Primary Refresh Token (PRT) Failures on Windows: Reading dsregcmd Output and Fixing the Common Causes
A detailed technical guide to Microsoft Entra Primary Refresh Token failures on Windows, including dsregcmd analysis, device trust, broker behavior, network dependencies, and remediation design.
Why a Compliant Device Still Gets Blocked by Microsoft Entra Conditional Access — and How to Diagnose It
A detailed technical guide to why Microsoft Entra can block a sign-in from an Intune-compliant device, including device identity proof, browser support, client certificate behavior, and Conditional Access evaluation.
How Microsoft Entra Passkeys Work: Architecture, Registration, and Policy Controls
A technical guide to Microsoft Entra passkeys for administrators, including passkey types, registration flows, Authentication Methods policy, Conditional Access, and deployment design.
Microsoft Entra Passkey Troubleshooting: Common Sign-In Failures and Their Root Causes
A technical troubleshooting guide for Microsoft Entra passkeys covering registration failures, Conditional Access loops, Bluetooth issues, orphaned passkeys, compatibility gaps, and Authenticator-specific problems.
Access Tokens vs Refresh Tokens in Microsoft Entra: Lifetime, Storage, and Trust Boundaries
An engineering-level explanation of access tokens and refresh tokens in Microsoft Entra ID, including token ownership, lifetime, renewal, revocation, and common troubleshooting patterns.
Inside the Microsoft Entra Conditional Access Evaluation Pipeline: How Policies Decide Token Issuance
A top-to-bottom engineering explanation of how Microsoft Entra Conditional Access evaluates scope, combines controls, and influences token issuance.
New posts by email
Get notified when a new article goes up. No marketing, no third-party lists.
One email per new article. Unsubscribe anytime. See our privacy policy.