IT Toolbox
IT Toolbox

Microsoft 365 Center

Cloud Microsoft

Microsoft 365 Center

A quick diagnostic center for Exchange Online, Entra ID, Intune, OneDrive, SharePoint and SMTP.

Plan de contrôle

Field troubleshooting

Center mission

8 playbooks

Quickly separate identity, licensing, Exchange, SharePoint/OneDrive, Intune and guest-access issues, checking service health and logs before changing accounts.

Quick triage

  • Check Microsoft 365 service health and any global incident.
  • Confirm UPN, license, account status and authentication method.
  • Define whether issue affects one user, a group or the whole tenant.
  • Record time, application, browser/client and exact error code.
  • Before MFA/CA changes, inspect Entra sign-in logs.

Decision tree

Sign-in denied→

Start with sign-in logs, MFA and Conditional Access.

Sign-in works but feature is missing→

Check license, provisioning and relevant role/service.

Only mail is affected→

Move to message trace, rules, quarantine and connectors.

Only SharePoint/OneDrive→

Check permission, sync, quota and site state.

Intervention playbooks

Start read-only, collect evidence, then change one variable at a time.

01Cannot sign in / MFAControlled change
Symptom

User is blocked at sign-in, MFA loops or fails after approval.

Checks

  • Read error code and applied policy in sign-in logs.
  • Check account status and registered MFA methods.
  • Confirm date/time and client application.

Commands / evidence

Get-MgUser -UserId <UPN>Get-MgUserAuthenticationMethod -UserId <UPN>Connect-MgGraph -Scopes "AuditLog.Read.All,User.Read.All"

Expected result

Log clearly identifies success, MFA failure or responsible Conditional Access rule.

Corrective actions

  • Fix only the responsible method or policy after validation.
  • Use Temporary Access Pass if recovery procedure allows it.

Escalate when

Critical admin account, globally misconfigured CA or unavailable break-glass access.

02Incoming mail not receivedRead-only
Symptom

An expected message does not arrive while other mail works.

Checks

  • Run Message Trace for sender, recipient and time window.
  • Check quarantine, mailbox and transport rules.
  • Check MX/connectors if all recipients are affected.

Commands / evidence

Get-MessageTrace -RecipientAddress <mail> -StartDate <date> -EndDate <date>Get-InboxRule -Mailbox <UPN>Get-HostedContentFilterPolicy

Expected result

Message is found with Delivery/Quarantine/Failed status and an actionable reason.

Corrective actions

  • Fix rule/quarantine/connector according to trace.
  • Do not change SPF/DNS if trace shows Microsoft already received the mail.

Escalate when

Trace is absent despite proven SMTP receipt, Microsoft incident or critical hybrid connector.

03Outgoing mail rejectedRead-only
Symptom

NDR on external send or messages blocked by policy.

Checks

  • Read full SMTP/NDR code.
  • Check message trace and outbound spam restriction.
  • Check domain, connector and authentication for applications.

Commands / evidence

Get-MessageTrace -SenderAddress <mail> -StartDate <date> -EndDate <date>Get-HostedOutboundSpamFilterPolicyGet-OutboundConnector

Expected result

Rejection is tied to an identifiable destination, policy or configuration.

Corrective actions

  • Address exact NDR cause before creating an exception.
  • If account compromise is suspected, secure account before unblocking outbound mail.

Escalate when

Tenant is spam-blocked, critical partner connector issue or external rejection beyond local control.

04OneDrive no longer syncsControlled change
Symptom

Error icon, blocked files or synchronization stuck pending.

Checks

  • Check quota, local disk space and client state.
  • Identify exact name/path/file causing blockage.
  • Test web access to the same file.

Commands / evidence

%localappdata%\Microsoft\OneDrive\OneDrive.exe /resetGet-Process OneDrivedsregcmd /status

Expected result

Account is connected, file is accessible on web and sync queue progresses.

Corrective actions

  • Fix name/path/quota before resetting client.
  • Reset OneDrive only after protecting any unsynced local files.

Escalate when

Very large library, Known Folder Move conflict or recurring corruption on multiple endpoints.

05SharePoint — access deniedControlled change
Symptom

Signed-in user is denied access to a site, folder or file.

Checks

  • Identify exact level where permission inheritance changes.
  • Check M365/SharePoint group and direct sharing.
  • Check Conditional Access or sensitivity label for external access.

Commands / evidence

Get-MgGroupMember -GroupId <id>Get-MgUser -UserId <UPN>Connect-SPOService -Url https://<tenant>-admin.sharepoint.com

Expected result

An explicit or inherited permission explains granted/denied access.

Corrective actions

  • Grant minimum access through the appropriate group rather than persistent individual sharing.
  • Document inheritance breaks.

Escalate when

Sensitive site, compliance policies, external guests or large-scale permission inconsistency.

06Intune — device non-compliantControlled change
Symptom

Device marked non-compliant, CA access blocked or policy not applied.

Checks

  • Read exact non-compliance rule.
  • Check last check-in, ownership and Entra join.
  • Compare configuration profile and compliance policy.

Commands / evidence

dsregcmd /statusGet-MgDevice -Filter "displayName eq '<PC>'"Get-ScheduledTask -TaskPath "\Microsoft\Windows\EnterpriseMgmt\"

Expected result

Device checks in and each compliance rule has an explainable state.

Corrective actions

  • Fix local setting or failing policy assignment.
  • Force a sync before full re-enrollment.

Escalate when

Enrollment broken across fleet, token/MDM authority or global policy conflict.

07Missing license or serviceControlled change
Symptom

User can sign in but an application or mailbox is not provisioned.

Checks

  • Check SKU and enabled service plans.
  • Check usage location and dynamic license group.
  • Check provisioning delay before reassigning.

Commands / evidence

Get-MgUserLicenseDetail -UserId <UPN>Get-MgSubscribedSkuGet-MgUser -UserId <UPN> -Property UsageLocation,AssignedLicenses

Expected result

Correct SKU and expected service are enabled without plan conflict.

Corrective actions

  • Fix assignment or usage location and wait for normal provisioning.
  • Avoid removing/readding a mailbox license without understanding impact.

Escalate when

Provisioning is stuck for hours, backend error or conflicting group/direct license.

08External guest cannot accessControlled change
Symptom

Invitation accepted but resource is inaccessible, authentication loops or wrong tenant is used.

Checks

  • Check guest object, redemption state and actual address.
  • Check cross-tenant policy, CA and SharePoint settings.
  • Confirm user authenticates in the correct tenant.

Commands / evidence

Get-MgUser -Filter "userType eq 'Guest'"Get-MgInvitationConnect-MgGraph -Scopes "User.Read.All,Policy.Read.All"

Expected result

Guest exists, is redeemed and has both resource access and cross-tenant permission.

Corrective actions

  • Fix guest object or minimum permission without duplicating accounts.
  • Reinvite only after identifying why current object fails.

Escalate when

Complex B2B cross-tenant setup, multiple partner domains or compliance policy blocks access.

End-of-intervention checklist

  • Retest with the actual affected user and client.
  • Confirm the error code is absent from new logs.
  • Verify no overly broad security exception was created.
  • Document changed license/policy/group or setting.
  • Monitor propagation and provisioning if action is asynchronous.

Continue in BAOI

Related cheat sheetMicrosoft 365 — administration IT toolsCalculate, inspect or generate without leaving the workflow. ProceduresFollow a controlled implementation procedure. Known failuresCross-check the symptom with known failure patterns.

See also:. SMTP 550 5.7.705.

♡ 0