Exam Bundle

This action is appropriate for a different case: A device loses its Entra primary refresh token after a password reset and cloud application single sign-on stops functioning. There, the targeted fix is 'Inspect Entra sign-in/device diagnostics and refresh device authentication through supported steps.' because token and device identity failures should be isolated before reimaging. The current scenario instead requires 'Correlate device IDs and lifecycle state before removing a verified stale registration.' and verification that one active device identity remains after the stale entry is retired and no active access breaks.

This action is appropriate for a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. There, the targeted fix is 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.' because shared-use devices should not inherit an arbitrary employee's personal management scope. The current scenario instead requires 'Correlate device IDs and lifecycle state before removing a verified stale registration.' and verification that one active device identity remains after the stale entry is retired and no active access breaks.

This action is appropriate for a different case: A technician attempts to Entra join company devices using an account that is not permitted to join additional devices. There, the targeted fix is 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' because authentication alone does not override tenant device join restrictions. The current scenario instead requires 'Correlate device IDs and lifecycle state before removing a verified stale registration.' and verification that one active device identity remains after the stale entry is retired and no active access breaks.

This observation would validate a different case: An administrator needs to deploy browser restrictions to Windows devices but wants to avoid conflict with an existing security baseline. It would check 'The test endpoint reports one effective value and no unresolved configuration conflict.' after 'Compare overlapping settings and select one authoritative assignment for each control.'. It does not establish success for the stated scenario; the needed evidence is 'The Mac reports encryption status and the approved escrowed recovery information.'.

This observation would validate a different case: A macOS Wi-Fi profile installs but certificate trust prompts interrupt seamless enterprise Wi-Fi authentication. It would check 'A Mac connects without an untrusted certificate warning under approved policy.' after 'Configure the required trust and identity certificate payloads through supported management profiles.'. It does not establish success for the stated scenario; the needed evidence is 'The Mac reports encryption status and the approved escrowed recovery information.'.

This observation would validate a different case: An organization needs a new ADMX-backed policy in Intune that is not yet included in its ordinary settings catalog. It would check 'The policy applies to supported Windows pilot devices and reports an effective value.' after 'Import the supported ADMX definition and publish the associated configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'The Mac reports encryption status and the approved escrowed recovery information.'.

This action is appropriate for a different case: An ASR rule blocks a business-approved legacy app, and the service desk suggests turning off all ASR protections. There, the targeted fix is 'Create a tightly scoped policy exception or compatible application update after security review.' because broadly disabling protection creates unnecessary risk. The current scenario instead requires 'Deploy a Windows Defender Firewall policy for the applicable network profiles.' and verification that unauthorized inbound file sharing is denied on public and private networks.

This action is appropriate for a different case: A company combines Intune antivirus settings and security baseline policies with incompatible scan schedules. There, the targeted fix is 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' because duplicate management intent can create inconsistent endpoint protection. The current scenario instead requires 'Deploy a Windows Defender Firewall policy for the applicable network profiles.' and verification that unauthorized inbound file sharing is denied on public and private networks.

This action is appropriate for a different case: An admin wants to enforce App Control on all endpoints at once without understanding what legitimate binaries would be blocked. There, the targeted fix is 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.' because audit mode reduces unexpected production disruption. The current scenario instead requires 'Deploy a Windows Defender Firewall policy for the applicable network profiles.' and verification that unauthorized inbound file sharing is denied on public and private networks.

This observation would validate a different case: A Windows Win32 app detection rule checks only a registry key that remains after uninstall, causing false positives. It would check 'A removed app shows not installed despite the leftover registry entry.' after 'Use a reliable detection strategy reflecting actual installed application state.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot device runs the new VPN client and the retired version is removed as planned.'.

This observation would validate a different case: A business application requires an older runtime library that is missing on new Windows endpoints. It would check 'A clean pilot installs the runtime before the business app starts.' after 'Configure the prerequisite runtime as an Intune Win32 app dependency.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot device runs the new VPN client and the retired version is removed as planned.'.

This observation would validate a different case: An enterprise needs every new laptop to install Microsoft 365 Apps automatically during initial Windows deployment. It would check 'A new pilot Autopilot laptop has the intended Office apps after setup.' after 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot device runs the new VPN client and the retired version is removed as planned.'.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Test the app selective wipe threshold and document user communication before enforcing it.' and verification that the test work identity is removed at the threshold without deleting personal apps.

This action is appropriate for a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. There, the targeted fix is 'Create an Intune app configuration policy using supported managed app configuration settings.' because app configuration can deliver managed settings through a governed assignment. The current scenario instead requires 'Test the app selective wipe threshold and document user communication before enforcing it.' and verification that the test work identity is removed at the threshold without deleting personal apps.

This action is appropriate for a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. There, the targeted fix is 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.' because identity grants can restrict access to clients enforcing enterprise app data controls. The current scenario instead requires 'Test the app selective wipe threshold and document user communication before enforcing it.' and verification that the test work identity is removed at the threshold without deleting personal apps.

This action is appropriate for a different case: A Win32 installer succeeds under an administrator account but fails when assigned to standard users. There, the targeted fix is 'Configure the application's supported install context and elevation requirements.' because some installers require system context instead of user context. The current scenario instead requires 'Change the Intune app assignment from Required to Available where appropriate.' and verification that the pilot user chooses whether to install the optional app from the approved portal.

This action is appropriate for a different case: A business application requires an older runtime library that is missing on new Windows endpoints. There, the targeted fix is 'Configure the prerequisite runtime as an Intune Win32 app dependency.' because dependency relationships ensure necessary software is installed before the dependent app. The current scenario instead requires 'Change the Intune app assignment from Required to Available where appropriate.' and verification that the pilot user chooses whether to install the optional app from the approved portal.

This action is appropriate for a different case: A service desk assumes an Intune app failure is caused by compliance, but logs show the app executable detection path is inaccessible. There, the targeted fix is 'Inspect application deployment and Intune Management Extension logs separately from device compliance.' because app install telemetry and compliance are independent diagnostic channels. The current scenario instead requires 'Change the Intune app assignment from Required to Available where appropriate.' and verification that the pilot user chooses whether to install the optional app from the approved portal.

This action is appropriate for a different case: A Windows endpoint has encryption enabled but compliance reports failure because its recovery key has not been backed up. There, the targeted fix is 'Check BitLocker escrow and policy reporting rather than disabling the compliance requirement.' because encrypted state and verifiable key escrow are related but distinct requirements. The current scenario instead requires 'Use supervised risk triage and human approval rather than executing destructive actions based solely on automated suggestions.' and verification that an analyst confirms affected device IDs and approves narrowly scoped containment with audit evidence.

This action is appropriate for a different case: A company combines Intune antivirus settings and security baseline policies with incompatible scan schedules. There, the targeted fix is 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' because duplicate management intent can create inconsistent endpoint protection. The current scenario instead requires 'Use supervised risk triage and human approval rather than executing destructive actions based solely on automated suggestions.' and verification that an analyst confirms affected device IDs and approves narrowly scoped containment with audit evidence.

This action is appropriate for a different case: App Control for Business enforcement blocks an essential finance application after a vendor update changed its signing certificate. There, the targeted fix is 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.' because overly narrow allow rules can unintentionally block updated legitimate software. The current scenario instead requires 'Use supervised risk triage and human approval rather than executing destructive actions based solely on automated suggestions.' and verification that an analyst confirms affected device IDs and approves narrowly scoped containment with audit evidence.

This action is appropriate for a different case: An enterprise needs every new laptop to install Microsoft 365 Apps automatically during initial Windows deployment. There, the targeted fix is 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' because Office app deployment can be managed alongside Windows enrollment provisioning. The current scenario instead requires 'Use a dedicated-device group and appropriate Android app assignment targeting.' and verification that the kiosk receives the app while a test BYOD work profile does not.

This action is appropriate for a different case: A line-of-business app uses a dependency installer that requires a reboot before the main install can work. There, the targeted fix is 'Configure appropriate Intune dependency and restart handling for both packages.' because an incomplete reboot can leave prerequisite components unavailable. The current scenario instead requires 'Use a dedicated-device group and appropriate Android app assignment targeting.' and verification that the kiosk receives the app while a test BYOD work profile does not.

This action is appropriate for a different case: An enterprise needs to remove a vulnerable app version before assigning a patched replacement, avoiding two conflicting versions. There, the targeted fix is 'Coordinate app supersedence or uninstall and replacement assignments with detection tests.' because lifecycle transitions should not leave multiple incompatible releases. The current scenario instead requires 'Use a dedicated-device group and appropriate Android app assignment targeting.' and verification that the kiosk receives the app while a test BYOD work profile does not.

This observation would validate a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. It would check 'The portal separately shows the imported serial and its later enrolled management record.' after 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.'. It does not establish success for the stated scenario; the needed evidence is 'A registered Samsung handset automatically enters managed enrollment on first boot.'.

This observation would validate a different case: An enrollment error appears during iPad provisioning immediately after the Apple enrollment token was refreshed, but the profile assignment is missing. It would check 'The iPad receives its intended company enrollment profile during a clean setup.' after 'Check the token synchronization and automated enrollment profile mapping for the actual device.'. It does not establish success for the stated scenario; the needed evidence is 'A registered Samsung handset automatically enters managed enrollment on first boot.'.

This observation would validate a different case: Windows enrollment fails after Autopilot because the assigned user lacks the required Intune license. It would check 'The next supported enrollment attempt succeeds without an unlicensed bypass.' after 'Assign and verify the correct eligible Intune entitlement for the affected user.'. It does not establish success for the stated scenario; the needed evidence is 'A registered Samsung handset automatically enters managed enrollment on first boot.'.

This action is appropriate for a different case: Windows devices require a browser security setting available in the Intune settings catalog, but the admin creates an unrelated compliance rule. There, the targeted fix is 'Create a Windows device configuration profile using the supported settings catalog control.' because configuration settings and compliance evaluation serve different purposes. The current scenario instead requires 'Correct the imported ADMX metadata and related dependencies using supported Intune import rules.' and verification that the corrected template imports and a pilot setting can be created without schema errors.

This action is appropriate for a different case: Two Android departments share a device group, but only warehouse devices should receive a barcode-scanning restriction. There, the targeted fix is 'Split assignments using trusted device attributes and supported filters or group membership.' because broad assignments can apply vendor-specific controls to the wrong devices. The current scenario instead requires 'Correct the imported ADMX metadata and related dependencies using supported Intune import rules.' and verification that the corrected template imports and a pilot setting can be created without schema errors.

This action is appropriate for a different case: A HoloLens 2 headset is used for guided industrial work and must have management settings applied without modifying desktops. There, the targeted fix is 'Assign supported HoloLens device configuration policies to its dedicated managed group.' because mixed-reality endpoints have platform-specific management settings. The current scenario instead requires 'Correct the imported ADMX metadata and related dependencies using supported Intune import rules.' and verification that the corrected template imports and a pilot setting can be created without schema errors.

This observation would validate a different case: An endpoint admin wants an operational baseline for acceptable device startup time before an OS upgrade. It would check 'The post-upgrade cohort can be assessed against the saved pre-upgrade distribution.' after 'Measure representative Endpoint Analytics startup metrics and record target thresholds in advance.'. It does not establish success for the stated scenario; the needed evidence is 'The post-remediation model reports fewer unexpected restarts under comparable usage.'.

This observation would validate a different case: A service desk needs to identify whether Windows endpoints have slow startup caused by a new login agent rather than simple user complaints. It would check 'The agent-installed cohort shows its startup score compared with the previous baseline.' after 'Review Endpoint Analytics startup performance reports and compare deployment cohorts.'. It does not establish success for the stated scenario; the needed evidence is 'The post-remediation model reports fewer unexpected restarts under comparable usage.'.

This observation would validate a different case: Endpoint Analytics reports poor application reliability but the team monitors only Windows boot speed. It would check 'A targeted report identifies the affected app crash trend separately from boot duration.' after 'Use application reliability metrics alongside startup performance in Endpoint Analytics.'. It does not establish success for the stated scenario; the needed evidence is 'The post-remediation model reports fewer unexpected restarts under comparable usage.'.