Exam Bundle

This observation would validate a different case: A corporate Wi-Fi system rejects Cloud PKI client certificates because the RADIUS server does not trust the new intermediate CA. It would check 'A test device authenticates to Wi-Fi and the server validates the full issued chain.' after 'Publish and validate the appropriate CA trust chain before onboarding clients.'. It does not establish success for the stated scenario; the needed evidence is 'A version-stratified comparison isolates the impacted model and verifies improvement after remediation.'.

This observation would validate a different case: A catalog application is assigned but its vendor's older custom package remains installed and causes detection confusion. It would check 'The pilot reports one supported application installation with the desired detected version.' after 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.'. It does not establish success for the stated scenario; the needed evidence is 'A version-stratified comparison isolates the impacted model and verifies improvement after remediation.'.

This observation would validate a different case: Advanced Analytics recommends a configuration change that could affect every endpoint, but the operations team plans immediate mass deployment. It would check 'The pilot exhibits improved metrics before rollout to later cohorts is approved.' after 'Validate the recommendation on a staged group before broad policy assignment.'. It does not establish success for the stated scenario; the needed evidence is 'A version-stratified comparison isolates the impacted model and verifies improvement after remediation.'.

This observation would validate a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. It would check 'The test user receives their licensed settings after the machine install.' after 'Separate machine installation from appropriate user-specific license or configuration deployment.'. It does not establish success for the stated scenario; the needed evidence is 'The installation completes in system context with no user prompt.'.

This observation would validate a different case: A user opens Company Portal but does not see the approved optional line-of-business app because it was assigned to a device group as Required only. It would check 'An eligible pilot user can locate and install the optional app.' after 'Create a correct Available assignment to the eligible user population.'. It does not establish success for the stated scenario; the needed evidence is 'The installation completes in system context with no user prompt.'.

This observation would validate a different case: Microsoft 365 Apps updates consume bandwidth at a remote site even though Windows Delivery Optimization is tuned. It would check 'Office updates complete under the chosen bandwidth and channel policy.' after 'Review Microsoft 365 Apps servicing configuration and distribution separately from Windows OS updates.'. It does not establish success for the stated scenario; the needed evidence is 'The installation completes in system context with no user prompt.'.

This observation would validate a different case: A macOS Mac enrolled through Company Portal fails to receive management after the user denies the required profile installation. It would check 'The Mac shows the management profile and responds to a scheduled check-in.' after 'Guide the user through supported macOS enrollment approval and verify the management profile.'. It does not establish success for the stated scenario; the needed evidence is 'A reset corporate iPad automatically returns to managed setup with the expected restrictions.'.

This observation would validate a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. It would check 'The portal separately shows the imported serial and its later enrolled management record.' after 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.'. It does not establish success for the stated scenario; the needed evidence is 'A reset corporate iPad automatically returns to managed setup with the expected restrictions.'.

This observation would validate a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. It would check 'The personal device enrolls with user-appropriate controls while the corporate device is supervised.' after 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.'. It does not establish success for the stated scenario; the needed evidence is 'A reset corporate iPad automatically returns to managed setup with the expected restrictions.'.

This action is appropriate for a different case: An application installation command prompts for interactive input and therefore times out under silent Intune deployment. There, the targeted fix is 'Use a documented silent unattended install switch or repackage for managed deployment.' because remote managed installs need noninteractive behavior. The current scenario instead requires 'Configure appropriate Intune dependency and restart handling for both packages.' and verification that the pilot installation sequences the restart safely and later installs the main app.

This action is appropriate for a different case: A specialized kiosk app must be deployed only to dedicated Android devices, not employee-owned Android work profiles. There, the targeted fix is 'Use a dedicated-device group and appropriate Android app assignment targeting.' because different Android ownership modes require distinct app availability and permissions. The current scenario instead requires 'Configure appropriate Intune dependency and restart handling for both packages.' and verification that the pilot installation sequences the restart safely and later installs the main app.

This action is appropriate for a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. There, the targeted fix is 'Separate machine installation from appropriate user-specific license or configuration deployment.' because install context and app entitlement can be independently scoped. The current scenario instead requires 'Configure appropriate Intune dependency and restart handling for both packages.' and verification that the pilot installation sequences the restart safely and later installs the main app.

This observation would validate a different case: An Intune app deployment succeeds in the device report, but the user cannot launch it because a required license assignment is missing. It would check 'A licensed pilot user launches the app and an unlicensed test gets a controlled denial.' after 'Verify application licensing and assigned user entitlement after confirming installation.'. It does not establish success for the stated scenario; the needed evidence is 'The employee signs into the new enrolled device and receives the intended application.'.

This observation would validate a different case: Apple Business Manager's Apps and Books token expires and new app assignments stop synchronizing. It would check 'Current app licenses sync into Intune and a pilot install succeeds.' after 'Renew the managed Apps and Books location token and verify license sync.'. It does not establish success for the stated scenario; the needed evidence is 'The employee signs into the new enrolled device and receives the intended application.'.

This observation would validate a different case: An enterprise uses the new Microsoft Store for its Windows app distribution and still relies on retired legacy store integration. It would check 'The test Store application becomes available and installs from its current source.' after 'Choose the supported Microsoft Store app deployment method within Intune.'. It does not establish success for the stated scenario; the needed evidence is 'The employee signs into the new enrolled device and receives the intended application.'.

This action is appropriate for a different case: A service desk assumes an Intune app failure is caused by compliance, but logs show the app executable detection path is inaccessible. There, the targeted fix is 'Inspect application deployment and Intune Management Extension logs separately from device compliance.' because app install telemetry and compliance are independent diagnostic channels. The current scenario instead requires 'Create role-scoped Microsoft 365 Apps deployment packages or configurations.' and verification that call-center pilots receive the approved subset and analysts receive their full suite.

This action is appropriate for a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. There, the targeted fix is 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.' because critical setup software must match the timing of group membership evaluation. The current scenario instead requires 'Create role-scoped Microsoft 365 Apps deployment packages or configurations.' and verification that call-center pilots receive the approved subset and analysts receive their full suite.

This action is appropriate for a different case: A packaged Win32 application uses a shared UNC path installer that remote laptops cannot reach off VPN. There, the targeted fix is 'Distribute packaged installation content through Intune rather than relying on an inaccessible internal share.' because cloud-managed remote deployments should not depend on unavailable local installation paths. The current scenario instead requires 'Create role-scoped Microsoft 365 Apps deployment packages or configurations.' and verification that call-center pilots receive the approved subset and analysts receive their full suite.

This action is appropriate for a different case: A user requests a local antivirus exception for a downloaded installer without validating its publisher or hash. There, the targeted fix is 'Verify software provenance and route any exclusion request through approved security policy.' because untrusted application exceptions can create a new malware execution path. The current scenario instead requires 'Investigate the Defender incident and affected endpoints using appropriate security workflows.' and verification that the alert has triage evidence and documented containment or false-positive disposition.

This action is appropriate for a different case: An ASR rule blocks a business-approved legacy app, and the service desk suggests turning off all ASR protections. There, the targeted fix is 'Create a tightly scoped policy exception or compatible application update after security review.' because broadly disabling protection creates unnecessary risk. The current scenario instead requires 'Investigate the Defender incident and affected endpoints using appropriate security workflows.' and verification that the alert has triage evidence and documented containment or false-positive disposition.

This action is appropriate for a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. There, the targeted fix is 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' because encryption management must preserve recovery information for authorized administrators. The current scenario instead requires 'Investigate the Defender incident and affected endpoints using appropriate security workflows.' and verification that the alert has triage evidence and documented containment or false-positive disposition.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Use managed-device app configuration targeting appropriate device groups.' and verification that the corporate app receives its server address and the BYOD version does not.

This action is appropriate for a different case: A user with a personal phone signs into a protected Outlook app, but Conditional Access requires Intune-compliant device status that BYOD phones cannot meet. There, the targeted fix is 'Require an approved app protection policy in Conditional Access where supported instead of full device compliance.' because app-protection grant controls can serve supported unmanaged devices. The current scenario instead requires 'Use managed-device app configuration targeting appropriate device groups.' and verification that the corporate app receives its server address and the BYOD version does not.

This action is appropriate for a different case: A personal iPhone with Outlook does not enroll in Intune MDM but must require an app PIN before company mail opens. There, the targeted fix is 'Configure Intune app protection policy with the required application PIN and reset behavior.' because app protection can enforce data access controls without MDM enrollment. The current scenario instead requires 'Use managed-device app configuration targeting appropriate device groups.' and verification that the corporate app receives its server address and the BYOD version does not.

This action is appropriate for a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. There, the targeted fix is 'Use Group Policy analytics to import and assess supported settings migration paths.' because analytics identifies candidate cloud-manageable settings before recreating GPOs. The current scenario instead requires 'Adjust only the conflicting setting within a scoped policy after accessibility testing.' and verification that screen-reader workflow works on the pilot while required security controls still apply.

This action is appropriate for a different case: Windows devices require a browser security setting available in the Intune settings catalog, but the admin creates an unrelated compliance rule. There, the targeted fix is 'Create a Windows device configuration profile using the supported settings catalog control.' because configuration settings and compliance evaluation serve different purposes. The current scenario instead requires 'Adjust only the conflicting setting within a scoped policy after accessibility testing.' and verification that screen-reader workflow works on the pilot while required security controls still apply.

This action is appropriate for a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. There, the targeted fix is 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' because some Apple configuration controls depend on supervision and ownership. The current scenario instead requires 'Adjust only the conflicting setting within a scoped policy after accessibility testing.' and verification that screen-reader workflow works on the pilot while required security controls still apply.

This observation would validate a different case: A help desk needs a newly assigned Windows compliance policy to take effect without waiting for normal device check-in. It would check 'The device checks in and reports its updated compliance state.' after 'Issue a supported Intune Sync remote action and verify policy evaluation.'. It does not establish success for the stated scenario; the needed evidence is 'An audit shows approved target IDs exactly match executed actions in a safe test.'.

This observation would validate a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. It would check 'The intended cohort restarts and unaffected device records show no remote action.' after 'Use supported Intune bulk remote action with carefully verified group/device selection.'. It does not establish success for the stated scenario; the needed evidence is 'An audit shows approved target IDs exactly match executed actions in a safe test.'.

This observation would validate a different case: A support agent cannot tell why a single user's two iPhones receive different configuration policies. It would check 'The resulting report shows the effective assignment and exclusion causing the difference.' after 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.'. It does not establish success for the stated scenario; the needed evidence is 'An audit shows approved target IDs exactly match executed actions in a safe test.'.

This observation would validate a different case: A Graph automation exceeds Intune service request limits and receives HTTP 429 responses. It would check 'A test workload recovers after throttling within the approved retry budget.' after 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.'. It does not establish success for the stated scenario; the needed evidence is 'The admin confirms affected IDs and only approved stale devices are offboarded.'.

This observation would validate a different case: An admin's PowerShell script queries Microsoft Graph but fails after the first 100 devices in a large tenant. It would check 'The script counts all expected inventory devices across multiple pages.' after 'Implement Graph pagination using the returned next-link sequence.'. It does not establish success for the stated scenario; the needed evidence is 'The admin confirms affected IDs and only approved stale devices are offboarded.'.

This observation would validate a different case: A developer records full device user names and confidential diagnostic strings in an automation job log shared across help desk staff. It would check 'A sample execution records IDs and outcomes but omits restricted personal attributes.' after 'Minimize Graph output and restrict diagnostic log retention and access.'. It does not establish success for the stated scenario; the needed evidence is 'The admin confirms affected IDs and only approved stale devices are offboarded.'.