Exam Bundle

This action is appropriate for a different case: A manufacturer issues company-owned Windows laptops and wants device-based single sign-on without maintaining on-premises domain join. There, the targeted fix is 'Choose Microsoft Entra join for cloud-native corporate devices and assign managed enrollment.' because Entra join establishes organization-owned cloud identity without requiring local Active Directory. The current scenario instead requires 'Distinguish device identity registration from Intune enrollment and compliance policy evaluation.' and verification that the portal shows registration separately from management and compliance state after enrollment.

This action is appropriate for a different case: A corporate Mac is registered under an employee's account, but its manager expects Entra join behavior identical to a Windows PC. There, the targeted fix is 'Use the supported Entra registration or platform-supported join approach rather than assuming Windows join semantics.' because device identity capabilities differ across operating systems and deployment models. The current scenario instead requires 'Distinguish device identity registration from Intune enrollment and compliance policy evaluation.' and verification that the portal shows registration separately from management and compliance state after enrollment.

This action is appropriate for a different case: A contractor loses the company laptop and IT must prevent continued device-based cloud access without deleting the contractor's unrelated personal account. There, the targeted fix is 'Disable the compromised Entra device object and revoke relevant sessions according to incident policy.' because revoking device trust is distinct from indiscriminately deleting an identity. The current scenario instead requires 'Distinguish device identity registration from Intune enrollment and compliance policy evaluation.' and verification that the portal shows registration separately from management and compliance state after enrollment.

This action is appropriate for a different case: A corporate application fails because a security admin created an outbound firewall rule that blocks its authorized API endpoint. There, the targeted fix is 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.' because least privilege balances necessary application connectivity with traffic restrictions. The current scenario instead requires 'Configure Intune and Defender for Endpoint integration with supported data-sharing and licensing.' and verification that a Defender incident links to the expected Intune device and risk/compliance data.

This action is appropriate for a different case: A business requires separate security baseline configurations for kiosks and ordinary employee laptops. There, the targeted fix is 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.' because endpoint risk and application compatibility differ by device role. The current scenario instead requires 'Configure Intune and Defender for Endpoint integration with supported data-sharing and licensing.' and verification that a Defender incident links to the expected Intune device and risk/compliance data.

This action is appropriate for a different case: A company combines Intune antivirus settings and security baseline policies with incompatible scan schedules. There, the targeted fix is 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' because duplicate management intent can create inconsistent endpoint protection. The current scenario instead requires 'Configure Intune and Defender for Endpoint integration with supported data-sharing and licensing.' and verification that a Defender incident links to the expected Intune device and risk/compliance data.

This observation would validate a different case: Two subsidiaries use one Intune tenant and regional operators must not see each other's device records. It would check 'Each regional technician sees only authorized device records in the admin center.' after 'Configure Intune scope tags and appropriate role scope group assignments.'. It does not establish success for the stated scenario; the needed evidence is 'The old credential fails after rotation and authorized escrow shows a new protected value.'.

This observation would validate a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. It would check 'The protected app signs in with its applied policy while an unsupported client is denied.' after 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.'. It does not establish success for the stated scenario; the needed evidence is 'The old credential fails after rotation and authorized escrow shows a new protected value.'.

This observation would validate a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. It would check 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.' after 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.'. It does not establish success for the stated scenario; the needed evidence is 'The old credential fails after rotation and authorized escrow shows a new protected value.'.

This observation would validate a different case: A company wants managed iOS and Android apps to receive a company tenant identifier without requiring users to type it every launch. It would check 'The targeted app starts with the right corporate tenant and no manual text entry.' after 'Use supported app configuration policies for managed apps or devices according to enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'A device backup excludes protected work app content while personal backup continues.'.

This observation would validate a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. It would check 'The corporate app receives its server address and the BYOD version does not.' after 'Use managed-device app configuration targeting appropriate device groups.'. It does not establish success for the stated scenario; the needed evidence is 'A device backup excludes protected work app content while personal backup continues.'.

This observation would validate a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. It would check 'The work browser opens the approved home page while personal browsing remains untouched.' after 'Use managed app configuration for the supported work browser and targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'A device backup excludes protected work app content while personal backup continues.'.

This observation would validate a different case: A PowerShell cleanup script mistakenly removes device records because it matches display name instead of a stable managed device identifier. It would check 'A dry run reports exact intended IDs and no unrelated records are removed.' after 'Resolve and validate unique Intune managedDevice IDs before mutation calls.'. It does not establish success for the stated scenario; the needed evidence is 'A transient simulated failure is reported or recovered without returning false zero devices.'.

This observation would validate a different case: An administrator wants to extend device compliance using PowerShell but the custom script is assigned to unsupported macOS targets. It would check 'Supported Windows pilots evaluate the script and unsupported platforms remain excluded.' after 'Scope custom compliance discovery to supported device platforms and policy prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'A transient simulated failure is reported or recovered without returning false zero devices.'.

This observation would validate a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. It would check 'The pilot returns a parseable evaluation and its compliance state matches test conditions.' after 'Return the supported JSON schema without extra stdout content and validate the rules file.'. It does not establish success for the stated scenario; the needed evidence is 'A transient simulated failure is reported or recovered without returning false zero devices.'.

This observation would validate a different case: A KQL device query is returning no rows because the administrator copied a Log Analytics table name not available in Intune device query. It would check 'A corrected query returns the expected records from a controlled device sample.' after 'Use the device query supported schema and validate KQL syntax against its data model.'. It does not establish success for the stated scenario; the needed evidence is 'The directory records a new LAPS password and prior credentials fail.'.

This observation would validate a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. It would check 'The intended cohort restarts and unaffected device records show no remote action.' after 'Use supported Intune bulk remote action with carefully verified group/device selection.'. It does not establish success for the stated scenario; the needed evidence is 'The directory records a new LAPS password and prior credentials fail.'.

This observation would validate a different case: A mobile device enrollment is failing and the help desk needs actionable logs before wiping the phone. It would check 'The log bundle identifies the enrollment failure class for the affected device.' after 'Collect available Intune enrollment and device diagnostic logs for the specific record.'. It does not establish success for the stated scenario; the needed evidence is 'The directory records a new LAPS password and prior credentials fail.'.

This action is appropriate for a different case: An endpoint team targets a deployment to 'all Windows devices' but includes personal and organization-owned machines with different requirements. There, the targeted fix is 'Refine Entra dynamic membership criteria using trusted ownership and platform attributes.' because broad operating-system matches do not establish corporate ownership. The current scenario instead requires 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.' and verification that a test shared device is enrolled under the approved ownership workflow without a permanent user affinity.

This action is appropriate for a different case: An Entra-registered personal phone is replaced, but the old device remains in the account's list long after retirement. There, the targeted fix is 'Use a verified stale registration cleanup process respecting user and enrollment ownership.' because orphaned identities distort device inventory and risk decisions. The current scenario instead requires 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.' and verification that a test shared device is enrolled under the approved ownership workflow without a permanent user affinity.

This action is appropriate for a different case: A Windows device appears twice in Entra after it was rebuilt and renamed, confusing asset ownership and conditional access reports. There, the targeted fix is 'Correlate device IDs and lifecycle state before removing a verified stale registration.' because display-name similarity is insufficient to distinguish an active device from an orphan. The current scenario instead requires 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.' and verification that a test shared device is enrolled under the approved ownership workflow without a permanent user affinity.

This observation would validate a different case: A Windows quality update policy explicitly disables hotpatch while a tenant default enables it and the admin expects default precedence. It would check 'A pilot's update diagnostics show the targeted hotpatch setting is effective.' after 'Honor the effective device-assigned quality update policy when it overrides tenant hotpatch default.'. It does not establish success for the stated scenario; the needed evidence is 'Affected devices report the designated quality update within the approved urgent deadline.'.

This observation would validate a different case: An iPhone fleet needs supervised operating-system updates with deferred installation schedules and the administrator uses a Windows update ring. It would check 'A supervised pilot receives the targeted Apple OS update on its intended schedule.' after 'Configure supported iOS/iPadOS update settings using Intune Settings Catalog or Apple update management controls.'. It does not establish success for the stated scenario; the needed evidence is 'Affected devices report the designated quality update within the approved urgent deadline.'.

This observation would validate a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. It would check 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.' after 'Check supervision and platform prerequisites before configuring Apple update enforcement.'. It does not establish success for the stated scenario; the needed evidence is 'Affected devices report the designated quality update within the approved urgent deadline.'.

This observation would validate a different case: A developer queries device identities through Microsoft Graph and mistakes the Entra device ID for the Intune managedDevice ID. It would check 'The query resolves to the intended physical device without accidentally acting on another inventory record.' after 'Map the appropriate identity identifiers and relationships before issuing device-specific API actions.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected group evaluates test device properties to the expected membership outcome.'.

This observation would validate a different case: A help desk sees an Entra join error on Windows after the user's account is disabled but assumes the network firewall is the problem. It would check 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.' after 'Verify identity/account eligibility and sign-in diagnostics before changing firewall rules.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected group evaluates test device properties to the expected membership outcome.'.

This observation would validate a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. It would check 'A test shared device is enrolled under the approved ownership workflow without a permanent user affinity.' after 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected group evaluates test device properties to the expected membership outcome.'.

This observation would validate a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. It would check 'The dry run rejects stale selections and records the updated approved device set.' after 'Add preflight freshness checks and compare identifiers before applying bulk changes.'. It does not establish success for the stated scenario; the needed evidence is 'The reviewer sees the target change and records an explicit decision, not automatic deployment.'.

This observation would validate a different case: A Policy Configuration Agent proposes settings from a natural-language security standard without identifying policy conflicts. It would check 'The staged policy matches the security requirement and produces no unreviewed conflicts.' after 'Review proposed settings and existing Intune assignments before creating the new configuration.'. It does not establish success for the stated scenario; the needed evidence is 'The reviewer sees the target change and records an explicit decision, not automatic deployment.'.

This observation would validate a different case: A tenant needs to find stale Intune managed devices and export their names using automation without granting a developer full global administrator rights. It would check 'The script returns only approved inventory fields and cannot delete device records.' after 'Use Microsoft Graph with scoped application or delegated permissions and paginated queries.'. It does not establish success for the stated scenario; the needed evidence is 'The reviewer sees the target change and records an explicit decision, not automatic deployment.'.

This observation would validate a different case: A finance workstation must prevent unsolicited inbound file sharing even when a user changes Wi-Fi networks. It would check 'Unauthorized inbound file sharing is denied on public and private networks.' after 'Deploy a Windows Defender Firewall policy for the applicable network profiles.'. It does not establish success for the stated scenario; the needed evidence is 'The device restarts normally with its protected drive after authorized recovery.'.

This observation would validate a different case: Several managed Windows PCs have Intune profiles but do not appear as onboarded devices in Microsoft Defender for Endpoint. It would check 'The pilot appears active in Defender with expected device telemetry.' after 'Deploy supported Defender for Endpoint onboarding configuration to the targeted devices.'. It does not establish success for the stated scenario; the needed evidence is 'The device restarts normally with its protected drive after authorized recovery.'.

This observation would validate a different case: A company's endpoints are enrolled in Intune but Defender XDR shows duplicate security device entries after rebuilding laptops. It would check 'Only the active security record is used for triage after stale-record verification.' after 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.'. It does not establish success for the stated scenario; the needed evidence is 'The device restarts normally with its protected drive after authorized recovery.'.