Troubleshooting

Tenant connection

Graph errors 401 or 403, or panels that stay empty

MDO reaches a tenant through the admin consent granted when the tenant was connected. A 401 or 403 from Microsoft Graph usually means that consent was removed, or that it was granted before MDO asked for a permission it now uses. Settings › Connection shows which permissions the tenant’s token is missing, and what stops working without each.

A Global Administrator in the tenant opens Microsoft Entra ID → Enterprise applications → Modern Device Ops → Permissions.
They click Grant admin consent and accept.
In MDO, open Intune → Overview and click Sync with Intune.

This also applies when only some panels are empty, such as Health Scripts or PowerShell Scripts.

No data after connecting a tenant

MDO starts the first collection as soon as consent is granted, and then collects every night.

Open Deployments under Apps, tick Show system jobs, and look for the Intune Sync job for the tenant.
If it failed, open it to read the error. If it is still running, wait for it to finish.
To start a new collection, click Sync with Intune on Intune → Overview.

Deployment failures

Deploy is disabled on the Confirm step

MDO shows in red why it won’t build the package. The usual reasons are a per-user installer, an MSIX outside the Store, a zip-only download, or no uninstall command in the Winget manifest. For the last one you can tick Deploy without uninstall. Per-user apps sometimes exist as Microsoft Store apps instead; try the Microsoft Store source.

Per-app groups need the Group.Create permission. Open Settings › Connection, which lists every Microsoft Graph permission MDO asks for. If Group.Create shows Missing, an Owner or Admin clicks Re-consent and a tenant administrator accepts on Microsoft’s page. Entra can take a few minutes before MDO sees the new permission; reload the page then. Until it’s granted, MDO assigns the groups you choose directly.

A save on the app sheet says the app changed in Intune

Someone edited the app in the Intune portal after you opened the sheet. Close the sheet, reopen it to load the current version, and make your change again.

“The backup of this app to your storage account failed”

MDO backs an app up before changing its commands, detection or package, and stops if it can’t. Check the storage connection under Settings › Storage and backup (see Storage setup), then save again.

The package build failed

Open the failed job in Deployments and read the log. Common causes:

The Winget package ID doesn’t exist or is misspelled.
The installer couldn’t be downloaded from the vendor’s URL.
The installer file was malformed.

The upload to Intune failed

The package was built but couldn’t be uploaded.

Check that the tenant’s consent is current (see above).
Check for Intune service issues in the Microsoft 365 admin center.

The app is in Intune but doesn’t install

This is Intune delivery, not MDO. Intune’s install status can lag the device by minutes to hours, and a device installs a Required app at its next Intune Management Extension check-in.

In Intune, open Apps → the app → Device install status.
Check the install state on the affected devices.
Read the Intune Management Extension logs on a device in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\.

Drift detection

A change I made doesn’t show up

Drift events come from comparing collections. A change made in Intune appears after the next collection, which runs nightly. To see it sooner, click Sync with Intune on Home › Intune overview. Who made a change shows in Audit › Changes within about 15 minutes, before the next collection.

An acknowledged change is open again

Acknowledgements with an expiry re-open when the expiry passes, so a temporary exception doesn’t become permanent. To keep a change acknowledged, choose Indefinitely when you acknowledge it.

Getting help

Email [email protected] with:

The tenant name and domain.
Roughly when the problem started.
A screenshot of any error message.
The job ID, if it is about a failed deployment.