Exam Bundle

This observation would validate a different case: An organization needs a new ADMX-backed policy in Intune that is not yet included in its ordinary settings catalog. It would check 'The policy applies to supported Windows pilot devices and reports an effective value.' after 'Import the supported ADMX definition and publish the associated configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Android device receives the certificate and connects to the secure SSID.'.

This observation would validate a different case: A device configuration profile is changed but its rollout has no staged group, causing an immediate company-wide restriction. It would check 'The pilot proves the setting and later cohorts remain unchanged until promotion.' after 'Apply controlled phased assignments and monitored pilot rings for Intune settings.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Android device receives the certificate and connects to the secure SSID.'.

This observation would validate a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. It would check 'Supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.' after 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Android device receives the certificate and connects to the secure SSID.'.

This action is appropriate for a different case: A company-owned Android dedicated scanner needs restricted settings but the assigned profile exposes the complete Settings app. There, the targeted fix is 'Use a supported Android Enterprise dedicated-device restriction profile and approved kiosk configuration.' because dedicated-device security must match the allowed user interactions. The current scenario instead requires 'Inspect per-setting status and revise overlapping profile assignments or definitions.' and verification that the pilot reports one intended applied password policy and no setting conflict.

This action is appropriate for a different case: An administrator assigns a corporate VPN profile to every iOS device but wants it only on devices with a supported OS version. There, the targeted fix is 'Use appropriate Intune assignment filters alongside group targeting.' because filters can refine assignment eligibility using supported device properties. The current scenario instead requires 'Inspect per-setting status and revise overlapping profile assignments or definitions.' and verification that the pilot reports one intended applied password policy and no setting conflict.

This action is appropriate for a different case: A device receives the wrong Wi-Fi profile because its enrollment-time platform group membership has not been evaluated yet. There, the targeted fix is 'Plan enrollment-time grouping and assignment precedence for critical first-login configurations.' because enrollment assignments may need target resolution before full inventory processing. The current scenario instead requires 'Inspect per-setting status and revise overlapping profile assignments or definitions.' and verification that the pilot reports one intended applied password policy and no setting conflict.

This observation would validate a different case: A device enrolls but its compliance policy never arrives because it is placed in an unexpectedly excluded dynamic group. It would check 'A corrected pilot membership receives compliance policies without enrolling again.' after 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'The device initializes in kiosk policy without requiring an employee's account credentials.'.

This observation would validate a different case: A personally owned iPhone needs Outlook data protection without corporate control of the entire device. It would check 'The employee uses protected Outlook with company data restrictions and keeps personal settings unmanaged.' after 'Use an approved app-protection-only enrollment strategy when full MDM enrollment is unnecessary.'. It does not establish success for the stated scenario; the needed evidence is 'The device initializes in kiosk policy without requiring an employee's account credentials.'.

This observation would validate a different case: An Apple push notification service certificate is allowed to expire, and existing managed iPads stop accepting updates. It would check 'After renewal an existing iPad checks in again without a mass re-enrollment.' after 'Renew the existing Intune Apple MDM push certificate with the original Apple account.'. It does not establish success for the stated scenario; the needed evidence is 'The device initializes in kiosk policy without requiring an employee's account credentials.'.

This action is appropriate for a different case: An attacker uses Office macros to launch credential theft from a managed Windows laptop. There, the targeted fix is 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' because ASR reduces specific abuse paths beyond ordinary malware signatures. The current scenario instead requires 'Use appropriate Defender incident-response containment and coordinate with Intune management actions.' and verification that the infected pilot loses unauthorized network access while forensic evidence is preserved.

This action is appropriate for a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. There, the targeted fix is 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' because encryption management must preserve recovery information for authorized administrators. The current scenario instead requires 'Use appropriate Defender incident-response containment and coordinate with Intune management actions.' and verification that the infected pilot loses unauthorized network access while forensic evidence is preserved.

This action is appropriate for a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. There, the targeted fix is 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.' because removing a policy is not the same as changing existing disk encryption state. The current scenario instead requires 'Use appropriate Defender incident-response containment and coordinate with Intune management actions.' and verification that the infected pilot loses unauthorized network access while forensic evidence is preserved.

This observation would validate a different case: A managed app must block access on rooted Android devices and the administrator assumes an MDM compliance setting alone protects unenrolled devices. It would check 'An at-risk test device is blocked inside the managed app while an eligible device opens.' after 'Apply supported app protection device-health conditions for BYOD apps.'. It does not establish success for the stated scenario; the needed evidence is 'The work browser opens the approved home page while personal browsing remains untouched.'.

This observation would validate a different case: An app protection policy deletes work data after repeated PIN failures, but IT has never validated its impact on personal data. It would check 'The test work identity is removed at the threshold without deleting personal apps.' after 'Test the app selective wipe threshold and document user communication before enforcing it.'. It does not establish success for the stated scenario; the needed evidence is 'The work browser opens the approved home page while personal browsing remains untouched.'.

This observation would validate a different case: Employees bring personal phones to work and the company must prevent corporate documents from being copied into unmanaged messaging apps. It would check 'A protected document cannot be pasted into a personal chat app.' after 'Create an Intune app protection policy restricting transfer of organizational data to unmanaged apps.'. It does not establish success for the stated scenario; the needed evidence is 'The work browser opens the approved home page while personal browsing remains untouched.'.

This observation would validate a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. It would check 'The protected app removes corporate documents but the user's personal content remains.' after 'Trigger selective corporate app data wipe for the managed identity where supported.'. It does not establish success for the stated scenario; the needed evidence is 'The app reads its approved endpoint and tenant options without exposing them in user emails.'.

This observation would validate a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. It would check 'Work content pastes into an approved work app but not an unprotected personal app.' after 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.'. It does not establish success for the stated scenario; the needed evidence is 'The app reads its approved endpoint and tenant options without exposing them in user emails.'.

This observation would validate a different case: A protected iOS app shows a user-facing error because its app protection SDK integration is not supported by the installed app version. It would check 'The updated compatible app receives and enforces the intended policy.' after 'Verify the app's Intune MAM compatibility and deploy a supported build.'. It does not establish success for the stated scenario; the needed evidence is 'The app reads its approved endpoint and tenant options without exposing them in user emails.'.

This action is appropriate for a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. There, the targeted fix is 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.' because selective restrictions can preserve personal usability while preventing leakage. The current scenario instead requires 'Require an approved app protection policy in Conditional Access where supported instead of full device compliance.' and verification that the protected BYOD app signs in and an unsupported unprotected client is denied.

This action is appropriate for a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. There, the targeted fix is 'Use managed-device app configuration targeting appropriate device groups.' because corporate managed device settings should not be broadcast to personal installations. The current scenario instead requires 'Require an approved app protection policy in Conditional Access where supported instead of full device compliance.' and verification that the protected BYOD app signs in and an unsupported unprotected client is denied.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Require an approved app protection policy in Conditional Access where supported instead of full device compliance.' and verification that the protected BYOD app signs in and an unsupported unprotected client is denied.

This observation would validate a different case: Two Android departments share a device group, but only warehouse devices should receive a barcode-scanning restriction. It would check 'The restriction appears only on warehouse devices in the test cohort.' after 'Split assignments using trusted device attributes and supported filters or group membership.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint reports one effective value and no unresolved configuration conflict.'.

This observation would validate a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. It would check 'A migration report distinguishes supported controls from ones needing redesign.' after 'Use Group Policy analytics to import and assess supported settings migration paths.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint reports one effective value and no unresolved configuration conflict.'.

This observation would validate a different case: An enterprise iPad must receive a private Wi-Fi credential without storing it in a plain text user note. It would check 'The enrolled corporate iPad connects automatically and no credential is displayed in instructions.' after 'Deploy a supported managed Wi-Fi profile and secure credential/certificate provisioning.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint reports one effective value and no unresolved configuration conflict.'.

This action is appropriate for a different case: A Graph script changes compliance policy assignments in production without recording input or output. There, the targeted fix is 'Add dry-run mode, explicit change approval, logging and post-change verification.' because high-impact automation needs auditability and rollback evidence. The current scenario instead requires 'Implement a fail-safe discovery result and explicit error handling for missing data.' and verification that a simulated missing service yields the intended noncompliant result with diagnostic context.

This action is appropriate for a different case: An admin's PowerShell script queries Microsoft Graph but fails after the first 100 devices in a large tenant. There, the targeted fix is 'Implement Graph pagination using the returned next-link sequence.' because collection endpoints may return paged results rather than the entire tenant. The current scenario instead requires 'Implement a fail-safe discovery result and explicit error handling for missing data.' and verification that a simulated missing service yields the intended noncompliant result with diagnostic context.

This action is appropriate for a different case: A Graph automation exceeds Intune service request limits and receives HTTP 429 responses. There, the targeted fix is 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.' because uncontrolled retries can amplify throttling and service disruption. The current scenario instead requires 'Implement a fail-safe discovery result and explicit error handling for missing data.' and verification that a simulated missing service yields the intended noncompliant result with diagnostic context.

This observation would validate a different case: A Windows device reports stale Defender signatures despite an update request and no connectivity to the signature service. It would check 'Signature version advances after the correct network source becomes accessible.' after 'Check update action status and network/update-source health before repeatedly resending commands.'. It does not establish success for the stated scenario; the needed evidence is 'A corrected query returns the expected records from a controlled device sample.'.

This observation would validate a different case: A mobile device enrollment is failing and the help desk needs actionable logs before wiping the phone. It would check 'The log bundle identifies the enrollment failure class for the affected device.' after 'Collect available Intune enrollment and device diagnostic logs for the specific record.'. It does not establish success for the stated scenario; the needed evidence is 'A corrected query returns the expected records from a controlled device sample.'.

This observation would validate a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. It would check 'A test action is performed only on the exact approved device identity.' after 'Require verified Intune managed device ID, serial and ownership before destructive actions.'. It does not establish success for the stated scenario; the needed evidence is 'A corrected query returns the expected records from a controlled device sample.'.

This action is appropriate for a different case: A Windows laptop's Intune diagnostics are too old to explain a policy deployment failure after the latest OS upgrade. There, the targeted fix is 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.' because old data can misrepresent the current failure mechanism. The current scenario instead requires 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' and verification that the resulting report shows the effective assignment and exclusion causing the difference.

This action is appropriate for a different case: A remote kiosk is frozen after an application update and operations needs a controlled reboot, not a factory reset. There, the targeted fix is 'Use the Restart remote device action with authorization and user-impact assessment.' because restart and wipe have drastically different data effects. The current scenario instead requires 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' and verification that the resulting report shows the effective assignment and exclusion causing the difference.

This action is appropriate for a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. There, the targeted fix is 'Use the supported Intune device query with valid KQL and an appropriate scope.' because Intune device query can answer targeted state questions without collecting all device images. The current scenario instead requires 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' and verification that the resulting report shows the effective assignment and exclusion causing the difference.