Exam Bundle

This observation would validate a different case: A device firewall rule appears correctly assigned but does not take effect on machines using the public network profile. It would check 'The pilot blocks the intended port when the connection is classified public.' after 'Inspect the profile-specific rule settings and effective network category on the endpoint.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows the required secure value without outstanding setting conflicts.'.

This observation would validate a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. It would check 'Cloud requests fail for the missing device and management records capture the requested data removal.' after 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows the required secure value without outstanding setting conflicts.'.

This observation would validate a different case: An admin wants to enforce App Control on all endpoints at once without understanding what legitimate binaries would be blocked. It would check 'The reviewed audit log shows impacted signed apps and the staged block policy works.' after 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows the required secure value without outstanding setting conflicts.'.

This action is appropriate for a different case: A company wants managed iOS and Android apps to receive a company tenant identifier without requiring users to type it every launch. There, the targeted fix is 'Use supported app configuration policies for managed apps or devices according to enrollment.' because managed configuration delivers controlled parameters without hardcoded user instructions. The current scenario instead requires 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.' and verification that work content pastes into an approved work app but not an unprotected personal app.

This action is appropriate for a different case: A contractor has two organizational accounts on the same phone and one department must be unable to access the other's protected app data. There, the targeted fix is 'Plan per-identity app protection and access boundaries with separate Conditional Access scopes.' because work identity context matters when a device has multiple tenants or accounts. The current scenario instead requires 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.' and verification that work content pastes into an approved work app but not an unprotected personal app.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.' and verification that work content pastes into an approved work app but not an unprotected personal app.

This action is appropriate for a different case: A mobile team pushes an Android Wi-Fi profile that references an enterprise certificate missing on the target devices. There, the targeted fix is 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.' because enterprise wireless access depends on correct certificate and EAP prerequisites. The current scenario instead requires 'Use supported Teams Rooms specialized-device enrollment and configuration targeting.' and verification that a newly provisioned room device gets its assigned policies and is centrally visible.

This action is appropriate for a different case: A macOS Wi-Fi profile installs but certificate trust prompts interrupt seamless enterprise Wi-Fi authentication. There, the targeted fix is 'Configure the required trust and identity certificate payloads through supported management profiles.' because eAP configuration requires correct server trust and client identity material. The current scenario instead requires 'Use supported Teams Rooms specialized-device enrollment and configuration targeting.' and verification that a newly provisioned room device gets its assigned policies and is centrally visible.

This action is appropriate for a different case: A fleet of macOS laptops uses manually configured local profiles that drift from centrally required settings. There, the targeted fix is 'Replace ad hoc local changes with a supported managed macOS configuration profile.' because centralized policy offers consistent targeting and reporting. The current scenario instead requires 'Use supported Teams Rooms specialized-device enrollment and configuration targeting.' and verification that a newly provisioned room device gets its assigned policies and is centrally visible.

This action is appropriate for a different case: New company laptops unexpectedly enroll under personal ownership when users register work accounts manually. There, the targeted fix is 'Use the approved corporate provisioning and ownership recognition workflow.' because manual account association can differ from organization-controlled provisioning. The current scenario instead requires 'Confirm directory synchronization and membership processing before manually adding a permanent exception.' and verification that the updated attributes place the endpoint in the group without a standing manual workaround.

This action is appropriate for a different case: An Entra-registered personal phone is replaced, but the old device remains in the account's list long after retirement. There, the targeted fix is 'Use a verified stale registration cleanup process respecting user and enrollment ownership.' because orphaned identities distort device inventory and risk decisions. The current scenario instead requires 'Confirm directory synchronization and membership processing before manually adding a permanent exception.' and verification that the updated attributes place the endpoint in the group without a standing manual workaround.

This action is appropriate for a different case: A Windows device appears twice in Entra after it was rebuilt and renamed, confusing asset ownership and conditional access reports. There, the targeted fix is 'Correlate device IDs and lifecycle state before removing a verified stale registration.' because display-name similarity is insufficient to distinguish an active device from an orphan. The current scenario instead requires 'Confirm directory synchronization and membership processing before manually adding a permanent exception.' and verification that the updated attributes place the endpoint in the group without a standing manual workaround.

This action is appropriate for a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. There, the targeted fix is 'Separate machine installation from appropriate user-specific license or configuration deployment.' because install context and app entitlement can be independently scoped. The current scenario instead requires 'Define valid architecture applicability or separate packages according to supported platform.' and verification that each test device receives a compatible binary and unsupported versions are excluded.

This action is appropriate for a different case: A packaged Win32 application uses a shared UNC path installer that remote laptops cannot reach off VPN. There, the targeted fix is 'Distribute packaged installation content through Intune rather than relying on an inaccessible internal share.' because cloud-managed remote deployments should not depend on unavailable local installation paths. The current scenario instead requires 'Define valid architecture applicability or separate packages according to supported platform.' and verification that each test device receives a compatible binary and unsupported versions are excluded.

This action is appropriate for a different case: A managed Android app must suppress work notifications outside working hours for employee well-being. There, the targeted fix is 'Configure supported Android Quiet Time policy for eligible managed applications.' because quiet Time can limit work app interruptions without blocking personal phone use. The current scenario instead requires 'Define valid architecture applicability or separate packages according to supported platform.' and verification that each test device receives a compatible binary and unsupported versions are excluded.

This observation would validate a different case: A Windows 365 Cloud PC image contains an old line-of-business client and every new device inherits the obsolete version. It would check 'A new pilot Cloud PC starts with the approved application release.' after 'Update and validate the governed Cloud PC image or approved provisioning app deployment pipeline.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows deployment progress and installs its selected required apps without maintaining an image.'.

This observation would validate a different case: A business moves employees between Windows 365 Cloud PCs but misinterprets reprovisioning as a simple reboot. It would check 'A nonproduction reprovision creates the intended fresh image with documented user-data handling.' after 'Use the supported Cloud PC reprovisioning lifecycle only after confirming expected data impact.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows deployment progress and installs its selected required apps without maintaining an image.'.

This observation would validate a different case: An employee's Windows 365 Cloud PC is deleted accidentally and the team has no documented recovery plan. It would check 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.' after 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows deployment progress and installs its selected required apps without maintaining an image.'.

This action is appropriate for a different case: A security tool must be automatically installed on every company laptop and should not be treated as user-optional. There, the targeted fix is 'Assign the application as Required to the verified corporate device group.' because mandatory controls need device-wide automatic assignment. The current scenario instead requires 'Use supported app applicability rules plus appropriate assignment filters.' and verification that supported endpoints install and incompatible ones are reported as not applicable.

This action is appropriate for a different case: An organization must centrally configure Outlook security settings while leaving Windows device OS update rings unchanged. There, the targeted fix is 'Manage Microsoft 365 Apps policy through Intune or Microsoft 365 Apps admin center as appropriate.' because application policy and OS update management have different targets. The current scenario instead requires 'Use supported app applicability rules plus appropriate assignment filters.' and verification that supported endpoints install and incompatible ones are reported as not applicable.

This action is appropriate for a different case: A Teams Rooms device must run its supported collaboration client but the admin deploys a normal desktop Office suite installer to it. There, the targeted fix is 'Use the supported Teams Rooms app servicing and specialized device management path.' because specialty room devices can have different application deployment models. The current scenario instead requires 'Use supported app applicability rules plus appropriate assignment filters.' and verification that supported endpoints install and incompatible ones are reported as not applicable.

This observation would validate a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. It would check 'The protected app removes corporate documents but the user's personal content remains.' after 'Trigger selective corporate app data wipe for the managed identity where supported.'. It does not establish success for the stated scenario; the needed evidence is 'Switching to the targeted work account activates the intended data protection controls.'.

This observation would validate a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. It would check 'The protected supported app connects and an unprotected native app cannot access mail.' after 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.'. It does not establish success for the stated scenario; the needed evidence is 'Switching to the targeted work account activates the intended data protection controls.'.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'Switching to the targeted work account activates the intended data protection controls.'.

This observation would validate a different case: An application installation command prompts for interactive input and therefore times out under silent Intune deployment. It would check 'The installation completes in system context with no user prompt.' after 'Use a documented silent unattended install switch or repackage for managed deployment.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot user can locate and install the optional app.'.

This observation would validate a different case: A business application requires an older runtime library that is missing on new Windows endpoints. It would check 'A clean pilot installs the runtime before the business app starts.' after 'Configure the prerequisite runtime as an Intune Win32 app dependency.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot user can locate and install the optional app.'.

This observation would validate a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. It would check 'A targeted Windows device installs the accounting app silently and Intune reports success.' after 'Package it as a supported Intune Win32 app and configure the required install command.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot user can locate and install the optional app.'.

This observation would validate a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. It would check 'The intended cohort restarts and unaffected device records show no remote action.' after 'Use supported Intune bulk remote action with carefully verified group/device selection.'. It does not establish success for the stated scenario; the needed evidence is 'A limited operator sees only permitted query fields while sensitive details stay restricted.'.

This observation would validate a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. It would check 'A test action is performed only on the exact approved device identity.' after 'Require verified Intune managed device ID, serial and ownership before destructive actions.'. It does not establish success for the stated scenario; the needed evidence is 'A limited operator sees only permitted query fields while sensitive details stay restricted.'.

This observation would validate a different case: An employee leaves and IT must remove organizational data from their personally owned phone without deleting family photos. It would check 'Corporate accounts and managed data disappear while personal photos remain.' after 'Select Retire or selective corporate data removal where supported, not full device wipe.'. It does not establish success for the stated scenario; the needed evidence is 'A limited operator sees only permitted query fields while sensitive details stay restricted.'.

This action is appropriate for a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. There, the targeted fix is 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.' because hybrid enrollment depends on reachable domain services at the required stage. The current scenario instead requires 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.' and verification that a controlled restore retrieves the intended Cloud PC state without affecting another tenant.

This action is appropriate for a different case: A service desk wants to reset a problematic Autopilot-managed Windows laptop while preserving its approved management state. There, the targeted fix is 'Choose a supported Windows Autopilot reset or reprovisioning action suited to the deployment model.' because reset workflows differ from full destructive wipe and can retain certain enrollment state. The current scenario instead requires 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.' and verification that a controlled restore retrieves the intended Cloud PC state without affecting another tenant.

This action is appropriate for a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. There, the targeted fix is 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' because compatibility holds should be investigated rather than treated as arbitrary policy failures. The current scenario instead requires 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.' and verification that a controlled restore retrieves the intended Cloud PC state without affecting another tenant.