The Enrollment Status Page closes while my user’s blocking app is still InProgress, and only AppWorkload.log records it. IntuneScriptLab reads the agent’s four CMTrace logs as objects and timelines.

Microsoft’s own cpuArchitecture filter example saves without complaint and drops every x64 Windows device, which reports amd64. My command checks a rule locally the way the service parsed and matched it.

A file rule set to “does not exist” saves in the portal and Graph, and the Intune agent never counts the app as installed. My harness checks Win32 detection, requirements and installs the way devices did.

My remediation prints success and exits 0 over a Set-ItemProperty error, and Intune calls it Failed. My harness runs scripts the way the agent does, as me, as SYSTEM or as another account, and now agrees.

Microsoft’s sample detection for expired certificates returns a count before its exit 1, so it exits 0 and the remediation never runs. My linter flags that, and every rule cites the device test behind it.

Intune runs my scripts in Windows PowerShell 5.1, from system32, often as SYSTEM. My console is none of those, so I built a module that tests scripts the way the agent will, from what real devices did.

OneLogin gives a role, a group and a policy nothing but a name, and a Smart Hook not even that. Teardown still has to delete only what my seed made, so each object is proved by what it holds.

The first PingOne seed I ran from Windows PowerShell 5.1 turned every accented and Han name into question marks. The fault was in how 5.1 encodes a request body, and all six providers in the module had it.

My seed asks the FreeIPA realm’s own CA for ten real certificates, and a CA has no delete. Teardown revokes them, so every seeded realm keeps a record of the run, next to HBAC and sudo rules built to be misread.

Authentik was already in my homelab doing single sign-on, so there was no license cap to design around. Of everything the provider seeds, the three hundred users are the least interesting.