Smokebomb

Just a quick heads-up for anyone using Smoothwall Cloud Filter. While working with Smoothwall support on a recent ticket, we discovered that the "Malware and Phishing" category is not currently supported by the Cloud Filter. This means that even if you add it to your blocklists, sites won’t be classified under this category in the browser extension — and as a result, they will still be allowed. According to Smoothwall, this is due to the size of the category causing performance issues within the browser extension so they have excluded it. It’s worth noting that this category does still work as expected on on-premise appliances, so traffic filtered there will be blocked correctly. In the meantime, you may want to: Add any known malicious URLs to a custom block category. Ensure you have other anti-malware/web protection controls in place to cover the gap. Hope that helps others avoid the same confusion.

Another tip, where possible apply configuration/apps to the built-in "All Devices" group, then use assignment filters (found under "Tenant Administration") to refine the targeting. For instance, we add an "exclude" filter for Personal Devices. Performance recommendations when using filters | Microsoft Learn

If you have access to the 365 admin centre, there is a current Intune health issue that could be responsible: https://admin.cloud.microsoft/?#/servicehealth/:/alerts/IT1142323 This has been affecting us since Friday, with no devices checking in and app/configuration deployments not updating in the admin dashboard (though there is some evidence from checking PCs locally that installs are still happening). Device check-ins started working again late last night, but app/configuration deployments are still not showing any new data in our tenant. Here's the full blurb: Some users' newly enrolled devices aren't appearing in the Microsoft Intune portal Issue ID: IT1142323 Affected services: Microsoft Intune Status: Service degradation Issue type: Advisory Start time: 22 Aug 2025, 17:00 BST User impact Users' newly enrolled devices aren't appearing in the Microsoft Intune portal. More info New devices enrolled after Friday 22 August 2025 at 17:00 BST , may not show in the Microsoft Intune portal. Additionally, users see stale data for co-managed Intune Advanced Analytics device reports based on certain scope tags. Scope of impact Your organization is affected by this event, and some users’ newly enrolled devices may be impacted. Root cause A section of infrastructure which reports newly enrolled devices is performing below acceptable performance thresholds. Current status 27 Aug 2025, 08:44 BST We’ve verified that the previously identified root cause is indeed responsible for impact. We’re continuing to work through the backlog to fully resolve the issue. Next update by: Wednesday 27 August 2025 at 19:30 BST

Looks like the August cumulative update will fix this issue. Listed under the “Improvements” section of the release notes: Authentication] Fixed: This update addresses an issue that caused delays during sign-in on new devices. The delay was due to certain preinstalled packages. https://support.microsoft.com/en-gb/topic/august-12-2025-kb5063878-os-build-26100-4946-e4b87262-75c8-4fef-9df7-4a18099ee294

Do the PCs have the July 2025 cumulative update installed? We're seeing this behaviour with new user logins since that was installed, and checking the event log we can see errors relating to universal app provisioning that seems to be slowing down the first login. I've seen this reference to similar behaviour in a reddit thread for the July patches:

We get around this exact situation using logon scripts. We store the powershell scripts in azure blob storage, then create a scheduled task (via a remediation script) that runs the script direct from that source at user logon. The scripts contain any reg values that we need in place straight away such as browser home pages, office settings, filter configuration, mapped drives, and printer mapping.

There are open source scripts out there. Bear in mind that these all use the webDAV protocol for the file transfers which is what Cloud Drive Mapper has just moved away from due to its limitations around speed, integration with File Explorer progress bars, file size limits, and inability to get around throttling that Microsoft may apply to your org: OneDriveMapper | Liebensraum. Here's some really useful techie info on the underlying tech that Cloud Drive Mapper is using in their product these days (as you can tell, I'm a fan!) Cloud Drive Mapper (CDM) overview

We've had something similar going on, but discovered the accounts in question did not have the "Intune plan 1" license assigned to them in the MS365 admin centre. Once we assigned that license to them the issue was resolved. Maybe something similar with this account?

There is a caveat to consider which could present an issue if you have multiple sites. If NPS is installed on a standalone server which is then registered with Active Directory, you cannot tell it which DC to use to authenticate requests. This has caused us problems in the past with radius authentication requests from devices at our primary site going to a remote site’s DC. As such, we install NPS on our DCs at each campus and configure our WiFi in such a way that specific NPS instances are used for auth/accounting at that site to localise the authentication.

For those who may not be aware, an issue has been identified with the Cloud Filter in Edge 130. Seems like something Microsoft have broke! Smoothwall have published a KB about it: Cloud Filter issues with Microsoft Edge v130+ – Help Centre

Yes, I raised a ticket requesting access now they have reached the pre-release phase of rollout. More info here: https://www.iamcloud.com/iam-blog/news-cdm-v3-pre-release-update/

I have been testing CDM v3 today. I copied a 7GB ISO file to my OneDrive in approx 20 seconds so certainly much faster!

We use Mojo Helpdesk which doesn't break the bank.

I agree that the RAM and storage upgrades are a rip off, but bear in mind with the M series Macs that you can’t upgrade the RAM or SSD as they are built into the chip - whatever you buy now, you’re stuck with for the life of the device.

I had a long chat with our supplier (Clevertouch) about this and they subsequently put this article together: Cyber Essentials, helping you guard your organisation against cyber attack. - Clevertouch Technologies