Exam Bundle

This observation would validate a different case: A user-based app assignment should follow an employee to a replacement device rather than remain on the original hardware ID. It would check 'The employee signs into the new enrolled device and receives the intended application.' after 'Assign supported apps to the appropriate Entra user group rather than only a stale device group.'. It does not establish success for the stated scenario; the needed evidence is 'A licensed pilot user launches the app and an unlicensed test gets a controlled denial.'.

This observation would validate a different case: An app catalog entry becomes available to the wrong security group and contractors download a licensed finance tool. It would check 'The finance test user can install the tool and contractor accounts cannot see it.' after 'Correct required/available assignment and group exclusions to enforce app entitlement.'. It does not establish success for the stated scenario; the needed evidence is 'A licensed pilot user launches the app and an unlicensed test gets a controlled denial.'.

This observation would validate a different case: An Intune Win32 app reports 'installed' even though its executable is absent because the detection rule checks the wrong file path. It would check 'A missing application fails detection and a correctly installed test app reports installed.' after 'Correct the Win32 app detection rules to verify a reliable product file, registry key or MSI ID.'. It does not establish success for the stated scenario; the needed evidence is 'A licensed pilot user launches the app and an unlicensed test gets a controlled denial.'.

This action is appropriate for a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. There, the targeted fix is 'Create an Intune app configuration policy using supported managed app configuration settings.' because app configuration can deliver managed settings through a governed assignment. The current scenario instead requires 'Verify the app's Intune MAM compatibility and deploy a supported build.' and verification that the updated compatible app receives and enforces the intended policy.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Verify the app's Intune MAM compatibility and deploy a supported build.' and verification that the updated compatible app receives and enforces the intended policy.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Verify the app's Intune MAM compatibility and deploy a supported build.' and verification that the updated compatible app receives and enforces the intended policy.

This observation would validate a different case: A security tool must be automatically installed on every company laptop and should not be treated as user-optional. It would check 'The app installs on a newly joined eligible laptop without manual selection.' after 'Assign the application as Required to the verified corporate device group.'. It does not establish success for the stated scenario; the needed evidence is 'A clean pilot installs the runtime before the business app starts.'.

This observation would validate a different case: An organization replaces an outdated VPN client with a new version and wants the old package removed reliably. It would check 'A pilot device runs the new VPN client and the retired version is removed as planned.' after 'Configure Intune app supersedence with the intended replacement and uninstall behavior.'. It does not establish success for the stated scenario; the needed evidence is 'A clean pilot installs the runtime before the business app starts.'.

This observation would validate a different case: A user opens Company Portal but does not see the approved optional line-of-business app because it was assigned to a device group as Required only. It would check 'An eligible pilot user can locate and install the optional app.' after 'Create a correct Available assignment to the eligible user population.'. It does not establish success for the stated scenario; the needed evidence is 'A clean pilot installs the runtime before the business app starts.'.

This observation would validate a different case: A corporate Mac is registered under an employee's account, but its manager expects Entra join behavior identical to a Windows PC. It would check 'The Mac obtains the expected registered identity and conditional access evaluates its applicable state.' after 'Use the supported Entra registration or platform-supported join approach rather than assuming Windows join semantics.'. It does not establish success for the stated scenario; the needed evidence is 'The missing laptop no longer satisfies device access policy while permitted personal account workflows remain.'.

This observation would validate a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. It would check 'The device registers for work access without appearing as a fully corporate-managed endpoint.' after 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.'. It does not establish success for the stated scenario; the needed evidence is 'The missing laptop no longer satisfies device access policy while permitted personal account workflows remain.'.

This observation would validate a different case: New company laptops unexpectedly enroll under personal ownership when users register work accounts manually. It would check 'The next enrolled test laptop records corporate ownership and receives only the intended policies.' after 'Use the approved corporate provisioning and ownership recognition workflow.'. It does not establish success for the stated scenario; the needed evidence is 'The missing laptop no longer satisfies device access policy while permitted personal account workflows remain.'.

This observation would validate a different case: A Teams Rooms device should receive meeting-room configuration without a user signing into Company Portal. It would check 'A newly provisioned room device gets its assigned policies and is centrally visible.' after 'Use supported Teams Rooms specialized-device enrollment and configuration targeting.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible iOS pilot gets the VPN and the unsupported version is excluded.'.

This observation would validate a different case: An iOS configuration update is queued but employees report it has not arrived despite healthy device enrollment. It would check 'A pilot check-in applies the revised iOS configuration and status updates in the portal.' after 'Inspect profile assignment, latest device check-in and pending policy sync status.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible iOS pilot gets the VPN and the unsupported version is excluded.'.

This observation would validate a different case: A company wants one kiosk policy for Teams Rooms and Android scanners and finds platform targeting failures. It would check 'Each test device receives only its supported policy payload.' after 'Create separate specialty-device configuration profiles aligned to each platform.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible iOS pilot gets the VPN and the unsupported version is excluded.'.

This observation would validate a different case: A HoloLens 2 headset is used for guided industrial work and must have management settings applied without modifying desktops. It would check 'An enrolled headset receives only its intended kiosk and enterprise configuration.' after 'Assign supported HoloLens device configuration policies to its dedicated managed group.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Zebra scanner receives the intended profile and other Android phones are unaffected.'.

This observation would validate a different case: A Windows configuration profile shows 'conflict' for password length because two profiles target the same device with different values. It would check 'The pilot reports one intended applied password policy and no setting conflict.' after 'Inspect per-setting status and revise overlapping profile assignments or definitions.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Zebra scanner receives the intended profile and other Android phones are unaffected.'.

This observation would validate a different case: A company wants one kiosk policy for Teams Rooms and Android scanners and finds platform targeting failures. It would check 'Each test device receives only its supported policy payload.' after 'Create separate specialty-device configuration profiles aligned to each platform.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Zebra scanner receives the intended profile and other Android phones are unaffected.'.

This action is appropriate for a different case: An enterprise wants Defender for Endpoint incidents correlated with Intune device management status. There, the targeted fix is 'Configure Intune and Defender for Endpoint integration with supported data-sharing and licensing.' because security incident response benefits from matching managed-device context. The current scenario instead requires 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.' and verification that the application connects to the approved API and unrelated destinations remain blocked.

This action is appropriate for a different case: An ASR rule blocks a business-approved legacy app, and the service desk suggests turning off all ASR protections. There, the targeted fix is 'Create a tightly scoped policy exception or compatible application update after security review.' because broadly disabling protection creates unnecessary risk. The current scenario instead requires 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.' and verification that the application connects to the approved API and unrelated destinations remain blocked.

This action is appropriate for a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. There, the targeted fix is 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.' because removing a policy is not the same as changing existing disk encryption state. The current scenario instead requires 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.' and verification that the application connects to the approved API and unrelated destinations remain blocked.

This action is appropriate for a different case: A corporate Mac needs zero-touch setup tied to Apple Business Manager but its serial is not assigned to the Intune MDM server. There, the targeted fix is 'Assign the Mac to the right ABM server and sync its automated enrollment profile.' because automated macOS enrollment depends on an ABM device-to-MDM relationship. The current scenario instead requires 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.' and verification that the portal separately shows the imported serial and its later enrolled management record.

This action is appropriate for a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. There, the targeted fix is 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.' because personal devices should not inherit corporate supervised device restrictions. The current scenario instead requires 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.' and verification that the portal separately shows the imported serial and its later enrolled management record.

This action is appropriate for a different case: A bring-your-own Android user accidentally enrolls the whole phone instead of a separate work profile. There, the targeted fix is 'Retire the inappropriate enrollment and re-enroll using approved personally owned work-profile setup.' because full management can exceed the organization's permitted control over employee devices. The current scenario instead requires 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.' and verification that the portal separately shows the imported serial and its later enrolled management record.

This action is appropriate for a different case: An organization sees repeated unexpected restarts on one hardware model after a new driver rollout. There, the targeted fix is 'Correlate restart frequency with device model and driver deployment history.' because reliability changes should be investigated by cohort and change timing. The current scenario instead requires 'Review Endpoint Analytics startup performance reports and compare deployment cohorts.' and verification that the agent-installed cohort shows its startup score compared with the previous baseline.

This action is appropriate for a different case: The Intune message center announces a change to a management service and the help desk wants to assess business impact. There, the targeted fix is 'Track service notifications against affected endpoint platforms, dependencies and owned runbooks.' because service communications require translation into operational readiness decisions. The current scenario instead requires 'Review Endpoint Analytics startup performance reports and compare deployment cohorts.' and verification that the agent-installed cohort shows its startup score compared with the previous baseline.

This action is appropriate for a different case: An admin dashboard shows compliance percentages but hides the tenant's oldest policy evaluation timestamp. There, the targeted fix is 'Expose freshness and evaluation-time metadata in monitoring reports.' because a stale compliance observation cannot be treated as a live security fact. The current scenario instead requires 'Review Endpoint Analytics startup performance reports and compare deployment cohorts.' and verification that the agent-installed cohort shows its startup score compared with the previous baseline.

This observation would validate a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. It would check 'Cloud requests fail for the missing device and management records capture the requested data removal.' after 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.'. It does not establish success for the stated scenario; the needed evidence is 'A Defender incident links to the expected Intune device and risk/compliance data.'.

This observation would validate a different case: A corporate application fails because a security admin created an outbound firewall rule that blocks its authorized API endpoint. It would check 'The application connects to the approved API and unrelated destinations remain blocked.' after 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.'. It does not establish success for the stated scenario; the needed evidence is 'A Defender incident links to the expected Intune device and risk/compliance data.'.

This observation would validate a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. It would check 'The device remains protected until an explicitly approved decryption task completes.' after 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.'. It does not establish success for the stated scenario; the needed evidence is 'A Defender incident links to the expected Intune device and risk/compliance data.'.

This action is appropriate for a different case: An attacker uses Office macros to launch credential theft from a managed Windows laptop. There, the targeted fix is 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' because ASR reduces specific abuse paths beyond ordinary malware signatures. The current scenario instead requires 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' and verification that the pilot shows the required secure value without outstanding setting conflicts.

This action is appropriate for a different case: A service desk user can retrieve BitLocker recovery keys for every subsidiary despite being responsible for one region. There, the targeted fix is 'Limit recovery key access and Intune/Entra role scope to authorized device populations.' because recovery secrets are highly sensitive and require least privilege. The current scenario instead requires 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' and verification that the pilot shows the required secure value without outstanding setting conflicts.

This action is appropriate for a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. There, the targeted fix is 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.' because removing a policy is not the same as changing existing disk encryption state. The current scenario instead requires 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' and verification that the pilot shows the required secure value without outstanding setting conflicts.