Exam Bundle

This action is appropriate for a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. There, the targeted fix is 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.' because hybrid enrollment depends on reachable domain services at the required stage. The current scenario instead requires 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.' and verification that a controlled restore retrieves the intended Cloud PC state without affecting another tenant.

This action is appropriate for a different case: A service desk wants to reset a problematic Autopilot-managed Windows laptop while preserving its approved management state. There, the targeted fix is 'Choose a supported Windows Autopilot reset or reprovisioning action suited to the deployment model.' because reset workflows differ from full destructive wipe and can retain certain enrollment state. The current scenario instead requires 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.' and verification that a controlled restore retrieves the intended Cloud PC state without affecting another tenant.

This action is appropriate for a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. There, the targeted fix is 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' because compatibility holds should be investigated rather than treated as arbitrary policy failures. The current scenario instead requires 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.' and verification that a controlled restore retrieves the intended Cloud PC state without affecting another tenant.

This action is appropriate for a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. There, the targeted fix is 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.' because endpoint data protection and cloud device trust require separate response actions. The current scenario instead requires 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.' and verification that only the active security record is used for triage after stale-record verification.

This action is appropriate for a different case: A business requires separate security baseline configurations for kiosks and ordinary employee laptops. There, the targeted fix is 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.' because endpoint risk and application compatibility differ by device role. The current scenario instead requires 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.' and verification that only the active security record is used for triage after stale-record verification.

This action is appropriate for a different case: An organization wants automatic BitLocker device encryption during provisioning but users become local administrators without escrow verification. There, the targeted fix is 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.' because BitLocker policy needs coordinated provisioning and secure recovery. The current scenario instead requires 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.' and verification that only the active security record is used for triage after stale-record verification.

This action is appropriate for a different case: Android work-profile devices must not be interrupted by a forced OS update during a defined maintenance freeze. There, the targeted fix is 'Use supported Android system-update policies or OEM configuration suited to the ownership mode.' because Android update controls vary by management mode and manufacturer. The current scenario instead requires 'Manage Microsoft 365 Apps channels separately from Windows device OS update policies.' and verification that the Office client follows its app channel while the OS stays on its target version.

This action is appropriate for a different case: A long-offline laptop rejoins and receives many updates at once, creating avoidable branch congestion. There, the targeted fix is 'Use supported update deadlines, Delivery Optimization and staged release policies for returning devices.' because catch-up servicing should respect bandwidth and security targets. The current scenario instead requires 'Manage Microsoft 365 Apps channels separately from Windows device OS update policies.' and verification that the Office client follows its app channel while the OS stays on its target version.

This action is appropriate for a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. There, the targeted fix is 'Deploy supported macOS software update policy through the Intune Settings Catalog.' because managed macOS updates can be staged by compatible OS/device prerequisites. The current scenario instead requires 'Manage Microsoft 365 Apps channels separately from Windows device OS update policies.' and verification that the Office client follows its app channel while the OS stays on its target version.

This action is appropriate for a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. There, the targeted fix is 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.' because managed application trust differs from MDM device compliance trust. The current scenario instead requires 'Use Intune multi-admin approval for the protected change type.' and verification that a protected change remains pending until an authorized independent approver approves it.

This action is appropriate for a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. There, the targeted fix is 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.' because hardware-backed key sign-in reduces reliance on exposed reusable passwords. The current scenario instead requires 'Use Intune multi-admin approval for the protected change type.' and verification that a protected change remains pending until an authorized independent approver approves it.

This action is appropriate for a different case: A regional administrator accidentally modifies another unit's Windows 365 provisioning policy because their administrative rights are global. There, the targeted fix is 'Scope Windows 365 and Intune administrative roles to the intended administrative boundary.' because Cloud PC rights should follow the same minimum-access governance as physical devices. The current scenario instead requires 'Use Intune multi-admin approval for the protected change type.' and verification that a protected change remains pending until an authorized independent approver approves it.

This action is appropriate for a different case: A user complains that an optional productivity tool installs on every corporate phone without consent. There, the targeted fix is 'Change the Intune app assignment from Required to Available where appropriate.' because required and available assignments create different deployment experiences. The current scenario instead requires 'Configure the application's supported install context and elevation requirements.' and verification that the pilot standard-user device receives the app without gaining local admin rights.

This action is appropriate for a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. There, the targeted fix is 'Use supported app applicability rules plus appropriate assignment filters.' because being targeted does not make an incompatible OS able to install the app. The current scenario instead requires 'Configure the application's supported install context and elevation requirements.' and verification that the pilot standard-user device receives the app without gaining local admin rights.

This action is appropriate for a different case: A business relies on a legacy Windows 32-bit app that fails silently on a Windows 11 machine and shows an Intune error. There, the targeted fix is 'Collect Intune Management Extension logs and app installer exit codes before modifying detection.' because an installation failure must be distinguished from platform incompatibility. The current scenario instead requires 'Configure the application's supported install context and elevation requirements.' and verification that the pilot standard-user device receives the app without gaining local admin rights.

This action is appropriate for a different case: An organization wants automatic BitLocker device encryption during provisioning but users become local administrators without escrow verification. There, the targeted fix is 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.' because BitLocker policy needs coordinated provisioning and secure recovery. The current scenario instead requires 'Deploy Intune EDR endpoint security policies with supported Defender integration.' and verification that selected Windows devices show the expected EDR configuration and sensor health.

This action is appropriate for a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. There, the targeted fix is 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.' because firmware and TPM changes can affect boot trust and recovery without indicating absent encryption. The current scenario instead requires 'Deploy Intune EDR endpoint security policies with supported Defender integration.' and verification that selected Windows devices show the expected EDR configuration and sensor health.

This action is appropriate for a different case: A device firewall rule appears correctly assigned but does not take effect on machines using the public network profile. There, the targeted fix is 'Inspect the profile-specific rule settings and effective network category on the endpoint.' because a firewall rule can depend on the active domain/private/public context. The current scenario instead requires 'Deploy Intune EDR endpoint security policies with supported Defender integration.' and verification that selected Windows devices show the expected EDR configuration and sensor health.

This action is appropriate for a different case: A user complains that an optional productivity tool installs on every corporate phone without consent. There, the targeted fix is 'Change the Intune app assignment from Required to Available where appropriate.' because required and available assignments create different deployment experiences. The current scenario instead requires 'Configure Microsoft 365 Apps language selections or deployment XML appropriately.' and verification that the pilot Office UI and installed language packs match the approved configuration.

This action is appropriate for a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. There, the targeted fix is 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.' because critical setup software must match the timing of group membership evaluation. The current scenario instead requires 'Configure Microsoft 365 Apps language selections or deployment XML appropriately.' and verification that the pilot Office UI and installed language packs match the approved configuration.

This action is appropriate for a different case: A user-based app assignment should follow an employee to a replacement device rather than remain on the original hardware ID. There, the targeted fix is 'Assign supported apps to the appropriate Entra user group rather than only a stale device group.' because user targeting is appropriate when access should travel with the worker. The current scenario instead requires 'Configure Microsoft 365 Apps language selections or deployment XML appropriately.' and verification that the pilot Office UI and installed language packs match the approved configuration.

This action is appropriate for a different case: A field team reports enrollment failures only on outdated Android versions not supported by the corporate platform baseline. There, the targeted fix is 'Apply documented platform minimum-version enrollment restrictions and communicate upgrade requirements.' because enrollment requirements must match the supported operating-system policy. The current scenario instead requires 'Renew the Apple device enrollment program token and verify the server assignment and sync.' and verification that a new test serial number syncs and receives the configured automated enrollment profile.

This action is appropriate for a different case: A company permits personal apps on its corporate Android phones but wants firm separation of employee and enterprise data. There, the targeted fix is 'Deploy Android Enterprise corporate-owned devices with work profile (COPE) enrollment.' because cOPE separates personal space while retaining corporate device ownership and policy. The current scenario instead requires 'Renew the Apple device enrollment program token and verify the server assignment and sync.' and verification that a new test serial number syncs and receives the configured automated enrollment profile.

This action is appropriate for a different case: Company-owned Windows laptops are Entra joined but none appear in Intune after first sign-in because automatic MDM enrollment is not enabled. There, the targeted fix is 'Configure Microsoft Intune MDM user scope and required automatic enrollment prerequisites.' because directory join alone does not guarantee Intune management enrollment. The current scenario instead requires 'Renew the Apple device enrollment program token and verify the server assignment and sync.' and verification that a new test serial number syncs and receives the configured automated enrollment profile.

This action is appropriate for a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. There, the targeted fix is 'Separate machine installation from appropriate user-specific license or configuration deployment.' because install context and app entitlement can be independently scoped. The current scenario instead requires 'Assign supported apps to the appropriate Entra user group rather than only a stale device group.' and verification that the employee signs into the new enrolled device and receives the intended application.

This action is appropriate for a different case: A company wants a semiannual Microsoft 365 Apps channel but devices keep updating from a different channel. There, the targeted fix is 'Set the correct Microsoft 365 Apps update channel through approved app management policy.' because Office update channel is separate from Windows feature update version. The current scenario instead requires 'Assign supported apps to the appropriate Entra user group rather than only a stale device group.' and verification that the employee signs into the new enrolled device and receives the intended application.

This action is appropriate for a different case: Microsoft 365 Apps are installed with an undesired language despite an assigned corporate default. There, the targeted fix is 'Configure Microsoft 365 Apps language selections or deployment XML appropriately.' because Office deployment settings determine installation language and component choice. The current scenario instead requires 'Assign supported apps to the appropriate Entra user group rather than only a stale device group.' and verification that the employee signs into the new enrolled device and receives the intended application.

This observation would validate a different case: An Intune device record shows 'retire pending' yet security operations claims corporate data has been removed from an offline phone. It would check 'A test report tracks pending and completed states separately with last contact time.' after 'Distinguish queued retirement from confirmed device-side completion.'. It does not establish success for the stated scenario; the needed evidence is 'The case notes pending or failed diagnostic collection instead of inventing a fresh log.'.

This observation would validate a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. It would check 'A test action is performed only on the exact approved device identity.' after 'Require verified Intune managed device ID, serial and ownership before destructive actions.'. It does not establish success for the stated scenario; the needed evidence is 'The case notes pending or failed diagnostic collection instead of inventing a fresh log.'.

This observation would validate a different case: A Windows laptop's Intune diagnostics are too old to explain a policy deployment failure after the latest OS upgrade. It would check 'The support case includes post-upgrade logs tied to the affected profile ID.' after 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.'. It does not establish success for the stated scenario; the needed evidence is 'The case notes pending or failed diagnostic collection instead of inventing a fresh log.'.

This action is appropriate for a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. There, the targeted fix is 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.' because capacity and entitlement errors cannot be repaired by changing Windows Defender policy. The current scenario instead requires 'Inspect the Win32 detection rule and ESP app installation status before disabling enrollment security.' and verification that after correcting detection, the same application is recognized and setup proceeds.

This action is appropriate for a different case: Users complain that newly provisioned Cloud PCs are created in the wrong geographic location for data residency requirements. There, the targeted fix is 'Review provisioning policy region and supported placement settings before creating new Cloud PCs.' because Cloud PC regional placement must align with location policy and service availability. The current scenario instead requires 'Inspect the Win32 detection rule and ESP app installation status before disabling enrollment security.' and verification that after correcting detection, the same application is recognized and setup proceeds.

This action is appropriate for a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. There, the targeted fix is 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' because compatibility holds should be investigated rather than treated as arbitrary policy failures. The current scenario instead requires 'Inspect the Win32 detection rule and ESP app installation status before disabling enrollment security.' and verification that after correcting detection, the same application is recognized and setup proceeds.