Microsoft 365 and Entra ID Diagnostic Center
Microsoft 365 Center
A quick diagnostic center for Exchange Online, Entra ID, Intune, OneDrive, SharePoint and SMTP.
Check plan
Priority checks
- Check whether SMTP AUTH is allowed for the mailbox and tenant
- Check port 587 + STARTTLS
- Compare the From address with the authenticated account
- Prefer OAuth 2.0 or a connector when the application supports it
Center mission
8 playbooksQuickly separate identity, licensing, Exchange, SharePoint/OneDrive, Intune and guest-access issues, checking service health and logs before changing accounts.
Quick triage
- Check Microsoft 365 service health and any global incident.
- Confirm UPN, license, account status and authentication method.
- Define whether issue affects one user, a group or the whole tenant.
- Record time, application, browser/client and exact error code.
- Before MFA/CA changes, inspect Entra sign-in logs.
Decision tree
Start with sign-in logs, MFA and Conditional Access.
Check license, provisioning and relevant role/service.
Move to message trace, rules, quarantine and connectors.
Check permission, sync, quota and site state.
Intervention playbooks
Start read-only, collect evidence, then change one variable at a time.
01Cannot sign in / MFAControlled change
User is blocked at sign-in, MFA loops or fails after approval.
Checks
- Read error code and applied policy in sign-in logs.
- Check account status and registered MFA methods.
- Confirm date/time and client application.
Commands / evidence
Get-MgUser -UserId <UPN>Get-MgUserAuthenticationMethod -UserId <UPN>Connect-MgGraph -Scopes "AuditLog.Read.All,User.Read.All"Expected result
Log clearly identifies success, MFA failure or responsible Conditional Access rule.
Corrective actions
- Fix only the responsible method or policy after validation.
- Use Temporary Access Pass if recovery procedure allows it.
Escalate when
Critical admin account, globally misconfigured CA or unavailable break-glass access.
02Incoming mail not receivedRead-only
An expected message does not arrive while other mail works.
Checks
- Run Message Trace for sender, recipient and time window.
- Check quarantine, mailbox and transport rules.
- Check MX/connectors if all recipients are affected.
Commands / evidence
Get-MessageTrace -RecipientAddress <mail> -StartDate <date> -EndDate <date>Get-InboxRule -Mailbox <UPN>Get-HostedContentFilterPolicyExpected result
Message is found with Delivery/Quarantine/Failed status and an actionable reason.
Corrective actions
- Fix rule/quarantine/connector according to trace.
- Do not change SPF/DNS if trace shows Microsoft already received the mail.
Escalate when
Trace is absent despite proven SMTP receipt, Microsoft incident or critical hybrid connector.
03Outgoing mail rejectedRead-only
NDR on external send or messages blocked by policy.
Checks
- Read full SMTP/NDR code.
- Check message trace and outbound spam restriction.
- Check domain, connector and authentication for applications.
Commands / evidence
Get-MessageTrace -SenderAddress <mail> -StartDate <date> -EndDate <date>Get-HostedOutboundSpamFilterPolicyGet-OutboundConnectorExpected result
Rejection is tied to an identifiable destination, policy or configuration.
Corrective actions
- Address exact NDR cause before creating an exception.
- If account compromise is suspected, secure account before unblocking outbound mail.
Escalate when
Tenant is spam-blocked, critical partner connector issue or external rejection beyond local control.
04OneDrive no longer syncsControlled change
Error icon, blocked files or synchronization stuck pending.
Checks
- Check quota, local disk space and client state.
- Identify exact name/path/file causing blockage.
- Test web access to the same file.
Commands / evidence
%localappdata%\Microsoft\OneDrive\OneDrive.exe /resetGet-Process OneDrivedsregcmd /statusExpected result
Account is connected, file is accessible on web and sync queue progresses.
Corrective actions
- Fix name/path/quota before resetting client.
- Reset OneDrive only after protecting any unsynced local files.
Escalate when
Very large library, Known Folder Move conflict or recurring corruption on multiple endpoints.
05SharePoint — access deniedControlled change
Signed-in user is denied access to a site, folder or file.
Checks
- Identify exact level where permission inheritance changes.
- Check M365/SharePoint group and direct sharing.
- Check Conditional Access or sensitivity label for external access.
Commands / evidence
Get-MgGroupMember -GroupId <id>Get-MgUser -UserId <UPN>Connect-SPOService -Url https://<tenant>-admin.sharepoint.comExpected result
An explicit or inherited permission explains granted/denied access.
Corrective actions
- Grant minimum access through the appropriate group rather than persistent individual sharing.
- Document inheritance breaks.
Escalate when
Sensitive site, compliance policies, external guests or large-scale permission inconsistency.
06Intune — device non-compliantControlled change
Device marked non-compliant, CA access blocked or policy not applied.
Checks
- Read exact non-compliance rule.
- Check last check-in, ownership and Entra join.
- Compare configuration profile and compliance policy.
Commands / evidence
dsregcmd /statusGet-MgDevice -Filter "displayName eq '<PC>'"Get-ScheduledTask -TaskPath "\Microsoft\Windows\EnterpriseMgmt\"Expected result
Device checks in and each compliance rule has an explainable state.
Corrective actions
- Fix local setting or failing policy assignment.
- Force a sync before full re-enrollment.
Escalate when
Enrollment broken across fleet, token/MDM authority or global policy conflict.
07Missing license or serviceControlled change
User can sign in but an application or mailbox is not provisioned.
Checks
- Check SKU and enabled service plans.
- Check usage location and dynamic license group.
- Check provisioning delay before reassigning.
Commands / evidence
Get-MgUserLicenseDetail -UserId <UPN>Get-MgSubscribedSkuGet-MgUser -UserId <UPN> -Property UsageLocation,AssignedLicensesExpected result
Correct SKU and expected service are enabled without plan conflict.
Corrective actions
- Fix assignment or usage location and wait for normal provisioning.
- Avoid removing/readding a mailbox license without understanding impact.
Escalate when
Provisioning is stuck for hours, backend error or conflicting group/direct license.
08External guest cannot accessControlled change
Invitation accepted but resource is unavailable, authentication loops or wrong tenant is used.
Checks
- Check guest object, redemption state and actual address.
- Check cross-tenant policy, CA and SharePoint settings.
- Confirm user authenticates in the correct tenant.
Commands / evidence
Get-MgUser -Filter "userType eq 'Guest'"Get-MgInvitationConnect-MgGraph -Scopes "User.Read.All,Policy.Read.All"Expected result
Guest exists, is redeemed and has both resource access and cross-tenant permission.
Corrective actions
- Fix guest object or minimum permission without duplicating accounts.
- Reinvite only after identifying why current object fails.
Escalate when
Complex B2B cross-tenant setup, multiple partner domains or compliance policy blocks access.
End-of-intervention checklist
- Retest with the actual affected user and client.
- Confirm the error code is absent from new logs.
- Verify no overly broad security exception was created.
- Document changed license/policy/group or setting.
- Monitor propagation and provisioning if action is asynchronous.