AZ-801 monitoring and troubleshooting for Windows Server, from Azure Monitor Agent, data collection rules, Log Analytics tables and alerts down to Performance Monitor, Event Viewer, Windows Event Forwarding, boot repair, pktmon and Azure VM boot diagnostics, with five KQL queries you can paste.
A diagnostic workflow for Defender for Identity, from sensor install failures and services stuck starting, through every documented health issue and its fix, to the audit policies that feed detections and why a known-bad action raised no alert.
The Intune diagnostic toolkit, the Troubleshooting blade, device sync, MDM diagnostic report, DeviceManagement event log, IME logs with CMTrace, Collect diagnostics, enrolment error codes, the Reports blade, Endpoint analytics, the data warehouse, exportJobs, and Log Analytics routing.