Exam Bundle

This action is appropriate for a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. There, the targeted fix is 'Use supported app applicability rules plus appropriate assignment filters.' because being targeted does not make an incompatible OS able to install the app. The current scenario instead requires 'Verify application licensing and assigned user entitlement after confirming installation.' and verification that a licensed pilot user launches the app and an unlicensed test gets a controlled denial.

This action is appropriate for a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. There, the targeted fix is 'Package it as a supported Intune Win32 app and configure the required install command.' because Win32 app packaging supports installation of traditional desktop software with monitoring. The current scenario instead requires 'Verify application licensing and assigned user entitlement after confirming installation.' and verification that a licensed pilot user launches the app and an unlicensed test gets a controlled denial.

This action is appropriate for a different case: An organization replaces an outdated VPN client with a new version and wants the old package removed reliably. There, the targeted fix is 'Configure Intune app supersedence with the intended replacement and uninstall behavior.' because supersedence can coordinate upgrade or replacement of related Win32 applications. The current scenario instead requires 'Verify application licensing and assigned user entitlement after confirming installation.' and verification that a licensed pilot user launches the app and an unlicensed test gets a controlled denial.

This action is appropriate for a different case: An Entra-registered personal phone is replaced, but the old device remains in the account's list long after retirement. There, the targeted fix is 'Use a verified stale registration cleanup process respecting user and enrollment ownership.' because orphaned identities distort device inventory and risk decisions. The current scenario instead requires 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' and verification that a designated enrollment account joins an allowed device and an unauthorized account remains blocked.

This action is appropriate for a different case: A fleet of laptops is shared among shifts and a user-based Entra group causes the same device to receive inconsistent assignments. There, the targeted fix is 'Use the appropriate device-based targeting strategy for settings that must persist across users.' because user-based membership follows sign-in identity rather than the stable shared endpoint. The current scenario instead requires 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' and verification that a designated enrollment account joins an allowed device and an unauthorized account remains blocked.

This action is appropriate for a different case: A corporate Mac is registered under an employee's account, but its manager expects Entra join behavior identical to a Windows PC. There, the targeted fix is 'Use the supported Entra registration or platform-supported join approach rather than assuming Windows join semantics.' because device identity capabilities differ across operating systems and deployment models. The current scenario instead requires 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' and verification that a designated enrollment account joins an allowed device and an unauthorized account remains blocked.

This action is appropriate for a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. There, the targeted fix is 'Create the narrowest Intune RBAC role with only required remote-action permissions.' because endpoint administration should separate limited support tasks from policy ownership. The current scenario instead requires 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.' and verification that a compliant test device accesses mail while an unmanaged test device is blocked.

This action is appropriate for a different case: A compliance check requires BitLocker but a freshly enrolled Windows device has not finished encryption. There, the targeted fix is 'Configure appropriate grace period and evaluate encryption deployment state before enforcing device access.' because a compliance deadline should account for permitted remediation timing. The current scenario instead requires 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.' and verification that a compliant test device accesses mail while an unmanaged test device is blocked.

This action is appropriate for a different case: A compliance policy requires an OS version but most devices report noncompliant because the version constraint is misconfigured. There, the targeted fix is 'Review supported platform minimum OS versions and assignments within the Intune compliance policy.' because compliance evaluations depend on accurate policy thresholds and platform scope. The current scenario instead requires 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.' and verification that a compliant test device accesses mail while an unmanaged test device is blocked.

This observation would validate a different case: A device loses its Entra primary refresh token after a password reset and cloud application single sign-on stops functioning. It would check 'Sign-in succeeds with a refreshed valid token and the device keeps the expected join state.' after 'Inspect Entra sign-in/device diagnostics and refresh device authentication through supported steps.'. It does not establish success for the stated scenario; the needed evidence is 'The retired phone registration disappears without affecting the replacement device's sign-in.'.

This observation would validate a different case: A help desk sees an Entra join error on Windows after the user's account is disabled but assumes the network firewall is the problem. It would check 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.' after 'Verify identity/account eligibility and sign-in diagnostics before changing firewall rules.'. It does not establish success for the stated scenario; the needed evidence is 'The retired phone registration disappears without affecting the replacement device's sign-in.'.

This observation would validate a different case: A Windows endpoint is missing from an Entra dynamic group because its directory attributes have not synchronized. It would check 'The updated attributes place the endpoint in the group without a standing manual workaround.' after 'Confirm directory synchronization and membership processing before manually adding a permanent exception.'. It does not establish success for the stated scenario; the needed evidence is 'The retired phone registration disappears without affecting the replacement device's sign-in.'.

This action is appropriate for a different case: A service desk assumes an Intune app failure is caused by compliance, but logs show the app executable detection path is inaccessible. There, the targeted fix is 'Inspect application deployment and Intune Management Extension logs separately from device compliance.' because app install telemetry and compliance are independent diagnostic channels. The current scenario instead requires 'Choose one authoritative Microsoft 365 Apps deployment method and remove overlapping assignments.' and verification that pilot devices report one approved Office installation and channel after cleanup.

This action is appropriate for a different case: An enterprise needs to remove a vulnerable app version before assigning a patched replacement, avoiding two conflicting versions. There, the targeted fix is 'Coordinate app supersedence or uninstall and replacement assignments with detection tests.' because lifecycle transitions should not leave multiple incompatible releases. The current scenario instead requires 'Choose one authoritative Microsoft 365 Apps deployment method and remove overlapping assignments.' and verification that pilot devices report one approved Office installation and channel after cleanup.

This action is appropriate for a different case: A specialized kiosk app must be deployed only to dedicated Android devices, not employee-owned Android work profiles. There, the targeted fix is 'Use a dedicated-device group and appropriate Android app assignment targeting.' because different Android ownership modes require distinct app availability and permissions. The current scenario instead requires 'Choose one authoritative Microsoft 365 Apps deployment method and remove overlapping assignments.' and verification that pilot devices report one approved Office installation and channel after cleanup.

This action is appropriate for a different case: The company wants SCEP or PKCS certificates without maintaining its own full on-premises certificate authority. There, the targeted fix is 'Plan Microsoft Cloud PKI and required Intune certificate profiles and trust chains.' because Cloud PKI supports managed certificate issuance while preserving trust requirements. The current scenario instead requires 'Enable eligible Intune Advanced Analytics capabilities and review supported anomaly or risk insights.' and verification that the dashboard reports an explainable endpoint performance anomaly for a known test cohort.

This action is appropriate for a different case: A company wants standard users to elevate one approved IT utility without granting permanent local administrator access. There, the targeted fix is 'Configure Intune Endpoint Privilege Management (EPM) elevation policies for that signed and approved app.' because just-in-time elevation narrows privilege compared with standing administrator membership. The current scenario instead requires 'Enable eligible Intune Advanced Analytics capabilities and review supported anomaly or risk insights.' and verification that the dashboard reports an explainable endpoint performance anomaly for a known test cohort.

This action is appropriate for a different case: An enterprise needs to deploy a commonly used third-party Windows app and does not want to maintain every vendor installer version manually. There, the targeted fix is 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.' because the catalog can simplify packaging and update lifecycle for supported applications. The current scenario instead requires 'Enable eligible Intune Advanced Analytics capabilities and review supported anomaly or risk insights.' and verification that the dashboard reports an explainable endpoint performance anomaly for a known test cohort.

This action is appropriate for a different case: A compliance team wants device diagnostics from a stolen laptop but the device has been offline for weeks. There, the targeted fix is 'Report remote collection status accurately and use available last-seen telemetry rather than claiming successful capture.' because remote actions require device connectivity and cannot guarantee results from offline endpoints. The current scenario instead requires 'Use supported Intune bulk remote action with carefully verified group/device selection.' and verification that the intended cohort restarts and unaffected device records show no remote action.

This action is appropriate for a different case: An administrator starts a bulk wipe on a large group and discovers the request was aimed at a preview dynamic group. There, the targeted fix is 'Use a validated static snapshot or controlled approval gate for high-impact bulk targeting.' because dynamic membership can change between intention and execution. The current scenario instead requires 'Use supported Intune bulk remote action with carefully verified group/device selection.' and verification that the intended cohort restarts and unaffected device records show no remote action.

This action is appropriate for a different case: A technician selects a Windows remote 'wipe' operation but meant only to refresh device policies. There, the targeted fix is 'Choose Sync or other non-destructive action rather than wipe when the goal is policy refresh.' because destructive commands should be differentiated from check-in requests. The current scenario instead requires 'Use supported Intune bulk remote action with carefully verified group/device selection.' and verification that the intended cohort restarts and unaffected device records show no remote action.

This observation would validate a different case: A developer records full device user names and confidential diagnostic strings in an automation job log shared across help desk staff. It would check 'A sample execution records IDs and outcomes but omits restricted personal attributes.' after 'Minimize Graph output and restrict diagnostic log retention and access.'. It does not establish success for the stated scenario; the needed evidence is 'The dry run rejects stale selections and records the updated approved device set.'.

This observation would validate a different case: A support team uses Security Copilot to summarize device performance but mistakes an anomaly prediction for a completed repair. It would check 'After an approved fix, endpoint metrics improve and the recorded work item shows the change.' after 'Treat AI device performance analysis as a recommendation requiring verified action and measurable outcome.'. It does not establish success for the stated scenario; the needed evidence is 'The dry run rejects stale selections and records the updated approved device set.'.

This observation would validate a different case: A Graph script changes compliance policy assignments in production without recording input or output. It would check 'Every actual assignment update is attributable to an approved request and measured result.' after 'Add dry-run mode, explicit change approval, logging and post-change verification.'. It does not establish success for the stated scenario; the needed evidence is 'The dry run rejects stale selections and records the updated approved device set.'.

This action is appropriate for a different case: The Intune Vulnerability Remediation Agent ranks devices by risk but a business-critical host cannot be patched this week. There, the targeted fix is 'Evaluate the agent's prioritization with business context and compensating control planning.' because automated risk scoring requires human operational decisions. The current scenario instead requires 'Implement supported custom compliance discovery scripts and JSON rule evaluation on eligible platforms.' and verification that the eligible pilot is marked noncompliant when the service is absent and compliant when present.

This action is appropriate for a different case: An admin's PowerShell script queries Microsoft Graph but fails after the first 100 devices in a large tenant. There, the targeted fix is 'Implement Graph pagination using the returned next-link sequence.' because collection endpoints may return paged results rather than the entire tenant. The current scenario instead requires 'Implement supported custom compliance discovery scripts and JSON rule evaluation on eligible platforms.' and verification that the eligible pilot is marked noncompliant when the service is absent and compliant when present.

This action is appropriate for a different case: A Graph automation exceeds Intune service request limits and receives HTTP 429 responses. There, the targeted fix is 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.' because uncontrolled retries can amplify throttling and service disruption. The current scenario instead requires 'Implement supported custom compliance discovery scripts and JSON rule evaluation on eligible platforms.' and verification that the eligible pilot is marked noncompliant when the service is absent and compliant when present.

This observation would validate a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. It would check 'The device restarts normally with its protected drive after authorized recovery.' after 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot appears active in Defender with expected device telemetry.'.

This observation would validate a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. It would check 'The device remains protected until an explicitly approved decryption task completes.' after 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot appears active in Defender with expected device telemetry.'.

This observation would validate a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. It would check 'A newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.' after 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot appears active in Defender with expected device telemetry.'.

This observation would validate a different case: An employee's Windows 365 Cloud PC is deleted accidentally and the team has no documented recovery plan. It would check 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.' after 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk reaches its managed configuration without binding to a named employee.'.

This observation would validate a different case: A company provisions Windows 365 Enterprise Cloud PCs but the chosen provisioning policy uses a network that lacks required connectivity. It would check 'A pilot Cloud PC provisions successfully and reaches approved corporate resources.' after 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk reaches its managed configuration without binding to a named employee.'.

This observation would validate a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. It would check 'OOBE finishes with essentials and remaining applications deploy after check-in.' after 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk reaches its managed configuration without binding to a named employee.'.