Exam Bundle

This observation would validate a different case: An Entra-registered personal phone is replaced, but the old device remains in the account's list long after retirement. It would check 'The retired phone registration disappears without affecting the replacement device's sign-in.' after 'Use a verified stale registration cleanup process respecting user and enrollment ownership.'. It does not establish success for the stated scenario; the needed evidence is 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.'.

This observation would validate a different case: A manufacturer issues company-owned Windows laptops and wants device-based single sign-on without maintaining on-premises domain join. It would check 'A new laptop shows Entra joined ownership and its permitted user signs in with organization credentials.' after 'Choose Microsoft Entra join for cloud-native corporate devices and assign managed enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.'.

This observation would validate a different case: An Entra device dynamic group stops updating after an administrator changes the membership rule syntax. It would check 'The corrected group evaluates test device properties to the expected membership outcome.' after 'Validate the rule syntax and supported device attributes, then inspect membership processing results.'. It does not establish success for the stated scenario; the needed evidence is 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.'.

This observation would validate a different case: A business application requires an older runtime library that is missing on new Windows endpoints. It would check 'A clean pilot installs the runtime before the business app starts.' after 'Configure the prerequisite runtime as an Intune Win32 app dependency.'. It does not establish success for the stated scenario; the needed evidence is 'The app installs on a newly joined eligible laptop without manual selection.'.

This observation would validate a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. It would check 'A targeted Windows device installs the accounting app silently and Intune reports success.' after 'Package it as a supported Intune Win32 app and configure the required install command.'. It does not establish success for the stated scenario; the needed evidence is 'The app installs on a newly joined eligible laptop without manual selection.'.

This observation would validate a different case: A Win32 installer succeeds under an administrator account but fails when assigned to standard users. It would check 'The pilot standard-user device receives the app without gaining local admin rights.' after 'Configure the application's supported install context and elevation requirements.'. It does not establish success for the stated scenario; the needed evidence is 'The app installs on a newly joined eligible laptop without manual selection.'.

This action is appropriate for a different case: An executive wants email access blocked from unmanaged devices even when their passwords and MFA succeed. There, the targeted fix is 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.' because identity authentication alone does not prove required endpoint compliance. The current scenario instead requires 'Configure appropriate grace period and evaluate encryption deployment state before enforcing device access.' and verification that the pilot becomes compliant after encryption, and an unencrypted device past grace is blocked.

This action is appropriate for a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. There, the targeted fix is 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.' because hardware-backed key sign-in reduces reliance on exposed reusable passwords. The current scenario instead requires 'Configure appropriate grace period and evaluate encryption deployment state before enforcing device access.' and verification that the pilot becomes compliant after encryption, and an unencrypted device past grace is blocked.

This action is appropriate for a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. There, the targeted fix is 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.' because managed application trust differs from MDM device compliance trust. The current scenario instead requires 'Configure appropriate grace period and evaluate encryption deployment state before enforcing device access.' and verification that the pilot becomes compliant after encryption, and an unencrypted device past grace is blocked.

This action is appropriate for a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. There, the targeted fix is 'Use the supported Intune device query with valid KQL and an appropriate scope.' because Intune device query can answer targeted state questions without collecting all device images. The current scenario instead requires 'Run the supported Defender Antivirus security intelligence update action in Intune.' and verification that pilot devices report newer signature versions with unchanged OS release.

This action is appropriate for a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. There, the targeted fix is 'Require verified Intune managed device ID, serial and ownership before destructive actions.' because friendly names can collide and should not identify wipe targets alone. The current scenario instead requires 'Run the supported Defender Antivirus security intelligence update action in Intune.' and verification that pilot devices report newer signature versions with unchanged OS release.

This action is appropriate for a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. There, the targeted fix is 'Use an authorized Wipe action on the verified device record with incident tracking.' because a full wipe is appropriate for a lost corporate endpoint when approved. The current scenario instead requires 'Run the supported Defender Antivirus security intelligence update action in Intune.' and verification that pilot devices report newer signature versions with unchanged OS release.

This action is appropriate for a different case: A Windows update ring has conflicting deferral settings with a feature update policy and machines move to a release that was not approved. There, the targeted fix is 'Inspect effective update policies and correct overlapping feature controls.' because multiple policy types influence Windows Update behavior. The current scenario instead requires 'Deploy supported macOS software update policy through the Intune Settings Catalog.' and verification that pilot Macs report the approved OS version after the assigned update window.

This action is appropriate for a different case: A branch's slow WAN saturates whenever 200 Windows laptops download the same monthly update independently. There, the targeted fix is 'Configure Windows Delivery Optimization policies using supported peer caching and bandwidth settings.' because peer delivery can reduce duplicate internet traffic during widespread patching. The current scenario instead requires 'Deploy supported macOS software update policy through the Intune Settings Catalog.' and verification that pilot Macs report the approved OS version after the assigned update window.

This action is appropriate for a different case: A long-offline laptop rejoins and receives many updates at once, creating avoidable branch congestion. There, the targeted fix is 'Use supported update deadlines, Delivery Optimization and staged release policies for returning devices.' because catch-up servicing should respect bandwidth and security targets. The current scenario instead requires 'Deploy supported macOS software update policy through the Intune Settings Catalog.' and verification that pilot Macs report the approved OS version after the assigned update window.

This observation would validate a different case: An enterprise needs to deploy a commonly used third-party Windows app and does not want to maintain every vendor installer version manually. It would check 'A pilot app installs from the catalog and updates to an approved newer release.' after 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot reports one supported application installation with the desired detected version.'.

This observation would validate a different case: An Intune Cloud PKI certificate is nearing expiry but the team has no monitoring or lifecycle renewal plan. It would check 'Pilot devices renew without breaking VPN or Wi-Fi authentication.' after 'Configure certificate health monitoring and appropriate renewal/rotation planning.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot reports one supported application installation with the desired detected version.'.

This observation would validate a different case: A security administrator assumes the Intune Suite capabilities are included in every base Intune license without checking the tenant. It would check 'The pilot environment can open and use the licensed feature while an unlicensed environment reports its limitation.' after 'Verify add-on entitlement and feature availability before creating a critical dependency.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot reports one supported application installation with the desired detected version.'.

This action is appropriate for a different case: A security group uses a device display-name prefix to decide privileged access, and users can influence the machine name. There, the targeted fix is 'Base privileged targeting on controlled device properties and separate authorization, not an untrusted name.' because a mutable name string alone is a weak proof of managed device trust. The current scenario instead requires 'Refine Entra dynamic membership criteria using trusted ownership and platform attributes.' and verification that group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.

This action is appropriate for a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. There, the targeted fix is 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.' because shared-use devices should not inherit an arbitrary employee's personal management scope. The current scenario instead requires 'Refine Entra dynamic membership criteria using trusted ownership and platform attributes.' and verification that group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.

This action is appropriate for a different case: A corporate Mac is registered under an employee's account, but its manager expects Entra join behavior identical to a Windows PC. There, the targeted fix is 'Use the supported Entra registration or platform-supported join approach rather than assuming Windows join semantics.' because device identity capabilities differ across operating systems and deployment models. The current scenario instead requires 'Refine Entra dynamic membership criteria using trusted ownership and platform attributes.' and verification that group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.

This action is appropriate for a different case: An organization must centrally configure Outlook security settings while leaving Windows device OS update rings unchanged. There, the targeted fix is 'Manage Microsoft 365 Apps policy through Intune or Microsoft 365 Apps admin center as appropriate.' because application policy and OS update management have different targets. The current scenario instead requires 'Deploy the application using the appropriate Intune LOB/Win32 app packaging approach.' and verification that an enrolled Windows pilot receives the MSI and the application launches successfully.

This action is appropriate for a different case: An organization replaces an outdated VPN client with a new version and wants the old package removed reliably. There, the targeted fix is 'Configure Intune app supersedence with the intended replacement and uninstall behavior.' because supersedence can coordinate upgrade or replacement of related Win32 applications. The current scenario instead requires 'Deploy the application using the appropriate Intune LOB/Win32 app packaging approach.' and verification that an enrolled Windows pilot receives the MSI and the application launches successfully.

This action is appropriate for a different case: An enterprise uses the new Microsoft Store for its Windows app distribution and still relies on retired legacy store integration. There, the targeted fix is 'Choose the supported Microsoft Store app deployment method within Intune.' because modern store integration replaces older Microsoft Store for Business workflows. The current scenario instead requires 'Deploy the application using the appropriate Intune LOB/Win32 app packaging approach.' and verification that an enrolled Windows pilot receives the MSI and the application launches successfully.

This observation would validate a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. It would check 'A test action is performed only on the exact approved device identity.' after 'Require verified Intune managed device ID, serial and ownership before destructive actions.'. It does not establish success for the stated scenario; the needed evidence is 'The device is reset/marked appropriately and its management lifecycle is recorded.'.

This observation would validate a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. It would check 'The intended cohort restarts and unaffected device records show no remote action.' after 'Use supported Intune bulk remote action with carefully verified group/device selection.'. It does not establish success for the stated scenario; the needed evidence is 'The device is reset/marked appropriately and its management lifecycle is recorded.'.

This observation would validate a different case: A help desk needs a newly assigned Windows compliance policy to take effect without waiting for normal device check-in. It would check 'The device checks in and reports its updated compliance state.' after 'Issue a supported Intune Sync remote action and verify policy evaluation.'. It does not establish success for the stated scenario; the needed evidence is 'The device is reset/marked appropriately and its management lifecycle is recorded.'.

This observation would validate a different case: Defender Antivirus is reporting passive mode on certain devices because another antivirus provider is installed. It would check 'A test machine shows the expected security provider mode without incompatible dual scanning.' after 'Inspect provider coexistence and Defender operating mode before forcing duplicate antivirus engines.'. It does not establish success for the stated scenario; the needed evidence is 'A test group meets the new settings without loss of required business application behavior.'.

This observation would validate a different case: App Control for Business enforcement blocks an essential finance application after a vendor update changed its signing certificate. It would check 'The approved application executes and the untrusted test binary remains denied.' after 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.'. It does not establish success for the stated scenario; the needed evidence is 'A test group meets the new settings without loss of required business application behavior.'.

This observation would validate a different case: A corporate application fails because a security admin created an outbound firewall rule that blocks its authorized API endpoint. It would check 'The application connects to the approved API and unrelated destinations remain blocked.' after 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.'. It does not establish success for the stated scenario; the needed evidence is 'A test group meets the new settings without loss of required business application behavior.'.

This action is appropriate for a different case: A Teams Rooms device must run its supported collaboration client but the admin deploys a normal desktop Office suite installer to it. There, the targeted fix is 'Use the supported Teams Rooms app servicing and specialized device management path.' because specialty room devices can have different application deployment models. The current scenario instead requires 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' and verification that a new pilot Autopilot laptop has the intended Office apps after setup.

This action is appropriate for a different case: A corporate iPad should install a paid in-house app purchased through Apple Business Manager without personal Apple IDs. There, the targeted fix is 'Sync Apps and Books with Intune and assign the licensed application appropriately.' because organization-managed app licenses do not require each employee's personal purchase. The current scenario instead requires 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' and verification that a new pilot Autopilot laptop has the intended Office apps after setup.

This action is appropriate for a different case: An app catalog entry becomes available to the wrong security group and contractors download a licensed finance tool. There, the targeted fix is 'Correct required/available assignment and group exclusions to enforce app entitlement.' because app visibility and installation rights depend on correct user/device targeting. The current scenario instead requires 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' and verification that a new pilot Autopilot laptop has the intended Office apps after setup.