Microsoft 365 Support Pro: Devices, Apps and Activation

What's inside

1. Level 1: The Device Service on One PageFree
   Learn what a user sees on a work device and which services sit behind it: Microsoft Entra ID for identity, Intune for management, Autopilot for setup and Microsoft 365 Apps for Office. The lesson also states that the course is independent of Microsoft.
2. Level 2: Who Can Do What: The Smallest Role for Each JobFree
   Match each common support job to the smallest Entra or Intune role that can do it, such as Intune Read Only Operator for looking, Help Desk Operator for remote actions and Entra Helpdesk Administrator for password resets.
3. Level 3: Reading Licences and Service Plans for Device Work
   Read a user's assigned licences and the service plans inside them to confirm they are entitled to Intune, Entra ID P1 features and Microsoft 365 Apps before you troubleshoot anything else.
4. Level 4: Admin Centres and Read-Only Checks, Dated
   Find your way around the Intune, Entra and Microsoft 365 admin centres and the read-only device commands, so that every investigation starts by looking and every screen you rely on is dated and checked against current documentation.
5. Level 5: A New User's First Windows Sign-In
   Follow what happens when a new user signs in to an Entra-joined Windows device for the first time, from the out-of-box screens through join, automatic MDM enrolment, the Primary Refresh Token and Windows Hello for Business setup.
6. Level 6: Autopilot from Support's Side: Records and Profiles
   Understand classic Windows Autopilot and Autopilot device preparation as support sees them: device registration, the hardware hash, group tags, and how a deployment profile or device preparation policy reaches a device.
7. Level 7: Watching a Deployment Run: ESP and Progress
   Read the Enrollment Status Page and the device preparation progress screens as the user sees them, and match them to the deployment reports in Intune so you can tell normal waiting from a real stall.
8. Level 8: Intune Enrolment Paths and Reading Enrolment State
   Know the ways a Windows device can end up in Intune (Entra join with automatic enrolment, Autopilot, adding a work account, co-management) and read a device record to see how and when it enrolled.
9. Level 9: Company Portal on Windows: User Self-Service
   Support users through the Company Portal on Windows: installing available apps, syncing the device, checking device status and access, and knowing what the Portal can and cannot fix.
10. Level 10: Fault: Autopilot Profile Missing or Wrong Setup
    Work through the fault where a new device shows the ordinary Windows setup, the wrong company branding or the wrong join type instead of the expected Autopilot experience: symptom, likely causes in order, check, fix, confirm and what to tell the user.
11. Level 11: Fault: Stuck or Failed Enrollment Status Page
    Diagnose a deployment that stalls or times out at the Enrollment Status Page or device preparation stage, usually because of a failing required app, script or policy, and fix it or hand it over.
12. Level 12: Fault: Enrolment Blocked or Failed
    Resolve Windows enrolment failures caused by enrolment restrictions, device limits, MDM user scope, missing licences or stale device records, working from the error message through to a confirmed enrolment.
13. Level 13: Reading Compliance: Why a Device Is Non-Compliant
    Read a device's compliance results down to the single failing setting, understand grace periods and states such as 'not evaluated' and 'in grace period', and tell the user exactly what to do to become compliant.
14. Level 14: Reading Tenant-Wide Policy to Explain Its Effect
    Read Conditional Access, configuration profiles and their assignments to explain why a user is blocked or a setting is applied, using sign-in logs and the What If tool, without changing anything, and escalate with a clear account of the cause.
15. Level 15: Microsoft 365 Apps: What Gets Installed and How
    Understand Microsoft 365 Apps as support sees them: Click-to-Run, the difference between installing from the portal, through Intune and with the Office Deployment Tool, and how to read what is installed on a device.
16. Level 16: Installing and Updating Microsoft 365 Apps for a User
    Install Microsoft 365 Apps for a user through the route the tenant allows (portal, Company Portal or Intune assignment) and run and confirm a manual update without fighting tenant update policy.
17. Level 17: Activation, Licence and Sign-In States
    Read how Microsoft 365 Apps activate under current licensing, what each licence and sign-in state shown to the user means, and how installation limits per user work.
18. Level 18: Shared Computer Activation
    Support shared computer activation on multi-user devices such as Remote Desktop hosts, Azure Virtual Desktop and shared PCs: when it applies, how per-user licence tokens work, and how to confirm it is on.
19. Level 19: Update Channels as Support Sees Them
    Understand Current Channel and Monthly Enterprise Channel, and the July 2026 change that moved Semi-Annual Enterprise Channel onto monthly updates, so you can read a device's channel, explain when features arrive and know who sets the channel.
20. Level 20: Fault: Activation Errors and 'Unlicensed Product'
    Work through Microsoft 365 Apps activation faults in a fixed order: the symptom, the likely causes (missing or wrong licence, signed in with the wrong account, install limit reached, broken sign-in token), the read-only checks, the fix, how to confirm it worked and what to tell the user.
21. Level 21: Fault: Office Sign-in Prompts and Wrong Accounts
    Diagnose Office apps that keep asking for a password, show 'Need password' or sign in with the wrong work or personal account, by reading the Windows device join state and the accounts saved on the device.
22. Level 22: Fault: Stuck Updates and the Wrong Update Channel
    Explain why a device is behind on Microsoft 365 Apps updates or on an unexpected update channel, including the July 2026 change that moved Semi-Annual Enterprise Channel devices onto monthly feature updates, and fix it without changing tenant-wide policy.
23. Level 23: Fault: Broken Installs, Crashes and Failed Repairs
    Handle Microsoft 365 Apps that won't install, crash on launch or fail to repair, working up from a Quick Repair to an Online Repair and then a full removal and reinstall, and stopping to check add-ins and installs blocked by security software.
24. Level 24: iPhone and iPad Enrolment Options
    Recognise which iOS/iPadOS enrolment route applies to a device: Automated Device Enrollment for company-bought devices, device enrolment through Company Portal, account-driven User Enrollment for personal devices, or no enrolment at all with app protection only. Learn what each route lets support see and do.
25. Level 25: Android Enrolment Options
    Recognise the Android Enterprise routes (personally-owned work profile, fully managed, dedicated, and corporate-owned work profile) and what each looks like to the user and to support.
26. Level 26: Setting Up a User's New Phone
    Walk a user through setting up a phone for work end to end: Authenticator first, then the enrolment or app-protection route, then Outlook, Teams and OneDrive, checking each step from the admin side.
27. Level 27: Reading App Protection Policies
    Read the app protection policy that applies to a user's apps, on enrolled and on personal phones, and explain in plain words what it blocks, such as copy and paste, Save As, backups, PIN rules and conditional launch checks.
28. Level 28: Fault: App Protection Blocks and Wipes
    Work through app protection faults: 'Your organization's data cannot be pasted here', apps blocked because they are out of date or the operating system is too old, PIN loops, and work data that has unexpectedly disappeared after a selective wipe.
29. Level 29: Fault: Company Portal Problems on Phones
    Diagnose Company Portal failures on iOS and Android: enrolment refused, device limit reached, management profile not installing, a device stuck at 'Checking status', and versions too old to launch.
30. Level 30: Fault: Authenticator and Sign-in on New or Lost Phones
    Resolve Microsoft Authenticator problems: notifications that never arrive, an old phone that was wiped, lost or replaced, broken number matching, and passkey or phone sign-in set-up faults. Use the smallest role that can manage a user's sign-in methods.
31. Level 31: Edge Profiles: Work, Personal and Sync
    Explain how Edge separates a work profile from a personal one, how signing in links a profile to the work account, and what syncs. Then fix mixed-up profiles where work data has landed in a personal profile or the other way round.
32. Level 32: Fault: Browser Sign-in Loops and Access Blocks
    Diagnose browser sign-in loops, 'You can't get there from here' messages and single sign-on not working in Edge or Chrome, by separating device problems (join state, browser extension, cookies) from Conditional Access sign-in rules.
33. Level 33: Replacing a User's Windows Device
    Plan and run a Windows device swap from support's side: confirm the user's data is in OneDrive, set up the new device through Autopilot, check apps and policy have arrived, and only then retire the old device.
34. Level 34: Retiring Lost, Stolen and Departing Devices
    Safely handle a device that is lost, stolen or leaving the business: pick between Retire, Wipe and selective app wipe, and clean up the device's records in Intune, Entra ID and Autopilot in the right order.
35. Level 35: Windows Device Tools and Logs
    Collect and read the logs support is allowed to use on a Windows device: dsregcmd, MdmDiagnosticsTool, the Intune Management Extension logs, Event Viewer MDM channels, and Collect diagnostics from the Intune admin center.
36. Level 36: Office and Mobile Diagnostics
    Use the diagnostic sources for Microsoft 365 Apps and phones: the Get Help troubleshooters, Office and Click-to-Run logs, Company Portal and Authenticator log upload, Edge's Intune diagnostics, and the Microsoft 365 service health page.
37. Level 37: Where First and Second Line Stop
    Draw the escalation line clearly: what first and second line fix, what is a tenant-wide policy question for third line, and what is a product defect for Microsoft or the hardware vendor.
38. Level 38: Building the Evidence Packet
    Put together an escalation packet that third line or Microsoft can act on straight away: a timeline, scope, steps already tried, IDs, timestamps, logs and screenshots, with personal data minimised.
39. Level 39: Final Challenge: The Device and App Ticket Queue Exam
    Work a queue of realistic tickets drawn from the whole course (new-user setup, Autopilot and enrolment, compliance, Office activation and updates, phones and app protection, browsers, device swaps), and decide for each whether to resolve or escalate, with a written note.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →