Exam Bundle

This action is appropriate for a different case: A Teams Rooms device must run its supported collaboration client but the admin deploys a normal desktop Office suite installer to it. There, the targeted fix is 'Use the supported Teams Rooms app servicing and specialized device management path.' because specialty room devices can have different application deployment models. The current scenario instead requires 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' and verification that a new pilot Autopilot laptop has the intended Office apps after setup.

This action is appropriate for a different case: A corporate iPad should install a paid in-house app purchased through Apple Business Manager without personal Apple IDs. There, the targeted fix is 'Sync Apps and Books with Intune and assign the licensed application appropriately.' because organization-managed app licenses do not require each employee's personal purchase. The current scenario instead requires 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' and verification that a new pilot Autopilot laptop has the intended Office apps after setup.

This action is appropriate for a different case: An app catalog entry becomes available to the wrong security group and contractors download a licensed finance tool. There, the targeted fix is 'Correct required/available assignment and group exclusions to enforce app entitlement.' because app visibility and installation rights depend on correct user/device targeting. The current scenario instead requires 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' and verification that a new pilot Autopilot laptop has the intended Office apps after setup.

This action is appropriate for a different case: A technician selects a Windows remote 'wipe' operation but meant only to refresh device policies. There, the targeted fix is 'Choose Sync or other non-destructive action rather than wipe when the goal is policy refresh.' because destructive commands should be differentiated from check-in requests. The current scenario instead requires 'Report remote collection status accurately and use available last-seen telemetry rather than claiming successful capture.' and verification that the case notes pending or failed diagnostic collection instead of inventing a fresh log.

This action is appropriate for a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. There, the targeted fix is 'Use supported Intune bulk remote action with carefully verified group/device selection.' because bulk actions can multiply mistakes unless scoping is explicit. The current scenario instead requires 'Report remote collection status accurately and use available last-seen telemetry rather than claiming successful capture.' and verification that the case notes pending or failed diagnostic collection instead of inventing a fresh log.

This action is appropriate for a different case: A Windows device reports stale Defender signatures despite an update request and no connectivity to the signature service. There, the targeted fix is 'Check update action status and network/update-source health before repeatedly resending commands.' because a remote action request does not resolve service connectivity issues. The current scenario instead requires 'Report remote collection status accurately and use available last-seen telemetry rather than claiming successful capture.' and verification that the case notes pending or failed diagnostic collection instead of inventing a fresh log.

This action is appropriate for a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. There, the targeted fix is 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.' because personal devices should not inherit corporate supervised device restrictions. The current scenario instead requires 'Limit automatic MDM enrollment scope to the approved pilot users.' and verification that pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.

This action is appropriate for a different case: An Android dedicated kiosk has no compliant way to authenticate a normal employee with a personal work identity during setup. There, the targeted fix is 'Use the supported enrollment token and dedicated-device configuration rather than a user-driven sign-in flow.' because dedicated Android devices commonly enroll without user affinity. The current scenario instead requires 'Limit automatic MDM enrollment scope to the approved pilot users.' and verification that pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.

This action is appropriate for a different case: Android field phones must be entirely corporate managed rather than keeping a personal side on the handset. There, the targeted fix is 'Use Android Enterprise fully managed enrollment with the supported provisioning method.' because fully managed devices are intended for corporate-only mobile workloads. The current scenario instead requires 'Limit automatic MDM enrollment scope to the approved pilot users.' and verification that pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.

This observation would validate a different case: A Graph script changes compliance policy assignments in production without recording input or output. It would check 'Every actual assignment update is attributable to an approved request and measured result.' after 'Add dry-run mode, explicit change approval, logging and post-change verification.'. It does not establish success for the stated scenario; the needed evidence is 'The exception is documented and a prioritized remediation plan retains accountability.'.

This observation would validate a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. It would check 'The dry run rejects stale selections and records the updated approved device set.' after 'Add preflight freshness checks and compare identifiers before applying bulk changes.'. It does not establish success for the stated scenario; the needed evidence is 'The exception is documented and a prioritized remediation plan retains accountability.'.

This observation would validate a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. It would check 'The pilot returns a parseable evaluation and its compliance state matches test conditions.' after 'Return the supported JSON schema without extra stdout content and validate the rules file.'. It does not establish success for the stated scenario; the needed evidence is 'The exception is documented and a prioritized remediation plan retains accountability.'.

This action is appropriate for a different case: Windows clients are marked pending restart after the monthly cumulative patch, and compliance reports show older build versions. There, the targeted fix is 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.' because installed updates may require reboot to become fully effective. The current scenario instead requires 'Honor the effective device-assigned quality update policy when it overrides tenant hotpatch default.' and verification that a pilot's update diagnostics show the targeted hotpatch setting is effective.

This action is appropriate for a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. There, the targeted fix is 'Deploy supported macOS software update policy through the Intune Settings Catalog.' because managed macOS updates can be staged by compatible OS/device prerequisites. The current scenario instead requires 'Honor the effective device-assigned quality update policy when it overrides tenant hotpatch default.' and verification that a pilot's update diagnostics show the targeted hotpatch setting is effective.

This action is appropriate for a different case: A Windows device fails the feature update because of a safeguard hold while security fixes install normally. There, the targeted fix is 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.' because feature and quality update failure paths can be independent. The current scenario instead requires 'Honor the effective device-assigned quality update policy when it overrides tenant hotpatch default.' and verification that a pilot's update diagnostics show the targeted hotpatch setting is effective.

This observation would validate a different case: An endpoint team targets a deployment to 'all Windows devices' but includes personal and organization-owned machines with different requirements. It would check 'Group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.' after 'Refine Entra dynamic membership criteria using trusted ownership and platform attributes.'. It does not establish success for the stated scenario; the needed evidence is 'The Windows device reports both domain join and hybrid Entra registration after synchronization.'.

This observation would validate a different case: A device loses its Entra primary refresh token after a password reset and cloud application single sign-on stops functioning. It would check 'Sign-in succeeds with a refreshed valid token and the device keeps the expected join state.' after 'Inspect Entra sign-in/device diagnostics and refresh device authentication through supported steps.'. It does not establish success for the stated scenario; the needed evidence is 'The Windows device reports both domain join and hybrid Entra registration after synchronization.'.

This observation would validate a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. It would check 'The device registers for work access without appearing as a fully corporate-managed endpoint.' after 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.'. It does not establish success for the stated scenario; the needed evidence is 'The Windows device reports both domain join and hybrid Entra registration after synchronization.'.

This observation would validate a different case: A device receives a hotpatch month update but the team falsely claims it never needs another restart. It would check 'The maintenance schedule shows baseline reboots and hotpatch months are documented separately.' after 'Explain and plan baseline cumulative updates that require reboot alongside hotpatch months.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot's report matches installed build and documents its restart status.'.

This observation would validate a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. It would check 'Pilot Macs report the approved OS version after the assigned update window.' after 'Deploy supported macOS software update policy through the Intune Settings Catalog.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot's report matches installed build and documents its restart status.'.

This observation would validate a different case: A Windows quality update policy explicitly disables hotpatch while a tenant default enables it and the admin expects default precedence. It would check 'A pilot's update diagnostics show the targeted hotpatch setting is effective.' after 'Honor the effective device-assigned quality update policy when it overrides tenant hotpatch default.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot's report matches installed build and documents its restart status.'.

This observation would validate a different case: An analytics dashboard shows severe startup time regression on a model whose drivers changed last week. It would check 'A version-stratified comparison isolates the impacted model and verifies improvement after remediation.' after 'Correlate Advanced Analytics/Endpoint Analytics data with driver versions and recent deployment changes.'. It does not establish success for the stated scenario; the needed evidence is 'The gateway accepts the reissued client identity and rejects mismatched certificates.'.

This observation would validate a different case: A company uses Remote Help for employee laptops but wants sessions visible in audit logs without recording private chat content unnecessarily. It would check 'A sample support session has the required audit metadata and protected access to its records.' after 'Configure governed Remote Help logging and retention consistent with privacy policies.'. It does not establish success for the stated scenario; the needed evidence is 'The gateway accepts the reissued client identity and rejects mismatched certificates.'.

This observation would validate a different case: A security team needs to audit which EPM-elevated executables employees actually run across a pilot fleet. It would check 'An elevated test process creates an attributable report with application identity.' after 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'The gateway accepts the reissued client identity and rejects mismatched certificates.'.

This action is appropriate for a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. There, the targeted fix is 'Use supported app applicability rules plus appropriate assignment filters.' because being targeted does not make an incompatible OS able to install the app. The current scenario instead requires 'Manage Microsoft 365 Apps policy through Intune or Microsoft 365 Apps admin center as appropriate.' and verification that outlook shows the required security option and OS updates follow their existing ring.

This action is appropriate for a different case: An Android business app needs a private managed Google Play listing rather than a public consumer listing. There, the targeted fix is 'Publish/approve the private app through the supported managed Google Play process.' because enterprise app distribution can restrict visibility to organizational users. The current scenario instead requires 'Manage Microsoft 365 Apps policy through Intune or Microsoft 365 Apps admin center as appropriate.' and verification that outlook shows the required security option and OS updates follow their existing ring.

This action is appropriate for a different case: An iOS workforce requires scheduled silence for work-related app alerts while preserving emergency personal phone calls. There, the targeted fix is 'Apply supported iOS Quiet Time policy to the intended managed work apps.' because managed work notification controls should not silence unrelated personal services. The current scenario instead requires 'Manage Microsoft 365 Apps policy through Intune or Microsoft 365 Apps admin center as appropriate.' and verification that outlook shows the required security option and OS updates follow their existing ring.

This observation would validate a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. It would check 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.' after 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.'. It does not establish success for the stated scenario; the needed evidence is 'After resize the Cloud PC reports the intended capacity and retains approved work data.'.

This observation would validate a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. It would check 'OOBE finishes with essentials and remaining applications deploy after check-in.' after 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.'. It does not establish success for the stated scenario; the needed evidence is 'After resize the Cloud PC reports the intended capacity and retains approved work data.'.

This observation would validate a different case: A service desk wants to reset a problematic Autopilot-managed Windows laptop while preserving its approved management state. It would check 'After pilot reset the device returns to the expected managed ready state.' after 'Choose a supported Windows Autopilot reset or reprovisioning action suited to the deployment model.'. It does not establish success for the stated scenario; the needed evidence is 'After resize the Cloud PC reports the intended capacity and retains approved work data.'.

This observation would validate a different case: An administrator confuses Microsoft 365 Apps update channels with Windows OS feature update rings. It would check 'The Office client follows its app channel while the OS stays on its target version.' after 'Manage Microsoft 365 Apps channels separately from Windows device OS update policies.'. It does not establish success for the stated scenario; the needed evidence is 'The test client downloads content from allowed local peers and not prohibited external peers.'.

This observation would validate a different case: A Windows update ring has conflicting deferral settings with a feature update policy and machines move to a release that was not approved. It would check 'The corrected pilot remains on the approved target release through the test update cycle.' after 'Inspect effective update policies and correct overlapping feature controls.'. It does not establish success for the stated scenario; the needed evidence is 'The test client downloads content from allowed local peers and not prohibited external peers.'.

This observation would validate a different case: A macOS fleet reports inconsistent patch status because the management reporting sync hasn't completed after update. It would check 'The pilot's reported version converges with its verified local build after sync.' after 'Check device check-in, update reporting lag and local OS version before declaring failure.'. It does not establish success for the stated scenario; the needed evidence is 'The test client downloads content from allowed local peers and not prohibited external peers.'.