Exam Bundle

This observation would validate a different case: A company adds a new Intune compliance policy but Conditional Access continues permitting devices without any policy. It would check 'A device with no applicable compliance evaluation is denied when the policy requires it.' after 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.'. It does not establish success for the stated scenario; the needed evidence is 'A tagged device receives its correctly assigned application despite regional admin visibility limits.'.

This observation would validate a different case: Two Intune device configuration policies assign incompatible firewall settings, and the admin mistakenly blames device noncompliance. It would check 'The conflicting assignments are resolved and the device reports consistent effective settings.' after 'Inspect Intune policy conflict and setting-level status before rewriting the compliance rules.'. It does not establish success for the stated scenario; the needed evidence is 'A tagged device receives its correctly assigned application despite regional admin visibility limits.'.

This observation would validate a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. It would check 'A help-desk test user can reset an assigned device but cannot edit security policies.' after 'Create the narrowest Intune RBAC role with only required remote-action permissions.'. It does not establish success for the stated scenario; the needed evidence is 'A tagged device receives its correctly assigned application despite regional admin visibility limits.'.

This action is appropriate for a different case: An Intune Cloud PKI certificate is nearing expiry but the team has no monitoring or lifecycle renewal plan. There, the targeted fix is 'Configure certificate health monitoring and appropriate renewal/rotation planning.' because certificates need continuous trust and expiry management. The current scenario instead requires 'Configure governed Remote Help logging and retention consistent with privacy policies.' and verification that a sample support session has the required audit metadata and protected access to its records.

This action is appropriate for a different case: A managed catalog app requires a vendor-specific detection update after an upstream app build changes its install path. There, the targeted fix is 'Update the Enterprise App Catalog app assignment or detection configuration using supported lifecycle procedures.' because catalog availability doesn't remove the need to verify installed state. The current scenario instead requires 'Configure governed Remote Help logging and retention consistent with privacy policies.' and verification that a sample support session has the required audit metadata and protected access to its records.

This action is appropriate for a different case: A Microsoft Tunnel gateway is online but unenrolled Android users cannot start application-specific connections. There, the targeted fix is 'Check Tunnel for MAM application configuration, gateway status and supported client integration.' because gateway reachability does not guarantee a MAM policy correctly invokes it. The current scenario instead requires 'Configure governed Remote Help logging and retention consistent with privacy policies.' and verification that a sample support session has the required audit metadata and protected access to its records.

This observation would validate a different case: An ASR rule blocks a business-approved legacy app, and the service desk suggests turning off all ASR protections. It would check 'The approved app runs while unrelated ASR detections remain enforced.' after 'Create a tightly scoped policy exception or compatible application update after security review.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies impacted applications and the pilot block phase denies only unwanted behavior.'.

This observation would validate a different case: Defender for Endpoint device risk rises above an approved threshold, but Conditional Access still allows the endpoint unrestricted corporate access. It would check 'High-risk pilot devices are blocked while low-risk compliant devices retain access.' after 'Integrate Defender risk with Intune compliance and enforce a compliant-device grant condition.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies impacted applications and the pilot block phase denies only unwanted behavior.'.

This observation would validate a different case: A security team wants all managed Windows PCs to use up-to-date real-time malware protection without editing antivirus settings manually on each endpoint. It would check 'A pilot endpoint reports active protection and the intended antivirus policy state.' after 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies impacted applications and the pilot block phase denies only unwanted behavior.'.

This action is appropriate for a different case: A branch requires traditional on-premises domain authentication for line-of-business software while also using cloud-based identity policies. There, the targeted fix is 'Plan Microsoft Entra hybrid join with synchronized identity and valid domain connectivity.' because hybrid join retains an AD DS dependency while enabling Entra device identity. The current scenario instead requires 'Combine appropriate managed device identity with evaluated Intune compliance and Conditional Access requirements.' and verification that a joined noncompliant laptop is blocked, while a joined compliant one passes the test policy.

This action is appropriate for a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. There, the targeted fix is 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.' because device registration supports work access while preserving BYOD ownership boundaries. The current scenario instead requires 'Combine appropriate managed device identity with evaluated Intune compliance and Conditional Access requirements.' and verification that a joined noncompliant laptop is blocked, while a joined compliant one passes the test policy.

This action is appropriate for a different case: A device is marked registered but the organization requires joined identity for a Windows security baseline deployment. There, the targeted fix is 'Transition the eligible Windows endpoint to the appropriate Microsoft Entra joined provisioning path.' because workplace registration is not equivalent to a fully joined device identity. The current scenario instead requires 'Combine appropriate managed device identity with evaluated Intune compliance and Conditional Access requirements.' and verification that a joined noncompliant laptop is blocked, while a joined compliant one passes the test policy.

This action is appropriate for a different case: A company must track enrollment failures by platform and technician across branches to find a repeating setup problem. There, the targeted fix is 'Create scoped enrollment failure reports with platform, profile and error details.' because enrollment analytics help distinguish systemic failures from isolated user mistakes. The current scenario instead requires 'Configure supported scheduling and scoped assignments for the remediation package.' and verification that the script runs only on targeted devices during the intended test schedule.

This action is appropriate for a different case: A tenant has four months of Intune compliance history but executives want trend reporting without manually copying screenshots. There, the targeted fix is 'Use Intune reporting exports or supported Graph reporting endpoints and create a governed dashboard.' because historical trend analysis requires repeatable, appropriately scoped data extraction. The current scenario instead requires 'Configure supported scheduling and scoped assignments for the remediation package.' and verification that the script runs only on targeted devices during the intended test schedule.

This action is appropriate for a different case: A policy status dashboard shows a rise in 'error' and 'conflict' states after a Windows configuration rollout. There, the targeted fix is 'Use device configuration reporting and setting-level diagnostics to isolate policy conflicts.' because an aggregate failed count cannot identify the colliding assignment. The current scenario instead requires 'Configure supported scheduling and scoped assignments for the remediation package.' and verification that the script runs only on targeted devices during the intended test schedule.

This observation would validate a different case: A new laptop receives a random computer name but IT requires a predictable approved asset prefix during deployment. It would check 'A freshly provisioned device receives the expected name without manually renaming it.' after 'Configure supported Windows Autopilot device-name template behavior on the applicable deployment profile.'. It does not establish success for the stated scenario; the needed evidence is 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.'.

This observation would validate a different case: The organization requires users to be standard users after Autopilot rather than local administrators during setup. It would check 'The signed-in employee cannot elevate without an authorized privilege mechanism.' after 'Configure supported account type settings for the applicable Autopilot deployment mode.'. It does not establish success for the stated scenario; the needed evidence is 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.'.

This observation would validate a different case: A service desk wants to reset a problematic Autopilot-managed Windows laptop while preserving its approved management state. It would check 'After pilot reset the device returns to the expected managed ready state.' after 'Choose a supported Windows Autopilot reset or reprovisioning action suited to the deployment model.'. It does not establish success for the stated scenario; the needed evidence is 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.'.

This action is appropriate for a different case: A company requires device risk severity from Defender for Endpoint to affect Conditional Access grants. There, the targeted fix is 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.' because device risk can contribute to compliance decisions before app access. The current scenario instead requires 'Assign platform-specific compliance settings only to supported operating systems.' and verification that Android pilot devices evaluate their supported controls without irrelevant Windows errors.

This action is appropriate for a different case: A company adds a new Intune compliance policy but Conditional Access continues permitting devices without any policy. There, the targeted fix is 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.' because an unassessed device should not be silently considered compliant. The current scenario instead requires 'Assign platform-specific compliance settings only to supported operating systems.' and verification that Android pilot devices evaluate their supported controls without irrelevant Windows errors.

This action is appropriate for a different case: A customer wants only a specific device support group to be local Administrators on Windows endpoints, not every cloud user. There, the targeted fix is 'Configure the Windows local users and groups policy in Intune with supported membership settings.' because local administrative membership needs explicit managed authorization. The current scenario instead requires 'Assign platform-specific compliance settings only to supported operating systems.' and verification that Android pilot devices evaluate their supported controls without irrelevant Windows errors.

This observation would validate a different case: A developer queries device identities through Microsoft Graph and mistakes the Entra device ID for the Intune managedDevice ID. It would check 'The query resolves to the intended physical device without accidentally acting on another inventory record.' after 'Map the appropriate identity identifiers and relationships before issuing device-specific API actions.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot device transitions under an approved plan with its new tenant record and user data intact.'.

This observation would validate a different case: A technician attempts to Entra join company devices using an account that is not permitted to join additional devices. It would check 'A designated enrollment account joins an allowed device and an unauthorized account remains blocked.' after 'Review Entra device-join permissions and per-user device limits before repeating enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot device transitions under an approved plan with its new tenant record and user data intact.'.

This observation would validate a different case: A manufacturer issues company-owned Windows laptops and wants device-based single sign-on without maintaining on-premises domain join. It would check 'A new laptop shows Entra joined ownership and its permitted user signs in with organization credentials.' after 'Choose Microsoft Entra join for cloud-native corporate devices and assign managed enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot device transitions under an approved plan with its new tenant record and user data intact.'.

This action is appropriate for a different case: An EDR policy should isolate a compromised endpoint but the help desk confuses quarantine with full device wipe. There, the targeted fix is 'Use appropriate Defender incident-response containment and coordinate with Intune management actions.' because threat containment and destructive enrollment cleanup have different purposes. The current scenario instead requires 'Rotate the BitLocker recovery key and confirm replacement escrow under authorized access.' and verification that the exposed recovery string cannot be used after successful rotation.

This action is appropriate for a different case: A company combines Intune antivirus settings and security baseline policies with incompatible scan schedules. There, the targeted fix is 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' because duplicate management intent can create inconsistent endpoint protection. The current scenario instead requires 'Rotate the BitLocker recovery key and confirm replacement escrow under authorized access.' and verification that the exposed recovery string cannot be used after successful rotation.

This action is appropriate for a different case: A device receives two security baseline profiles that set conflicting Windows Defender options. There, the targeted fix is 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' because security baselines are configurable templates that can conflict with other policies. The current scenario instead requires 'Rotate the BitLocker recovery key and confirm replacement escrow under authorized access.' and verification that the exposed recovery string cannot be used after successful rotation.

This observation would validate a different case: An enrollment restriction blocks personal Android devices but a department needs narrowly controlled BYOD enrollment. It would check 'The approved pilot BYOD phone enrolls while disallowed device types still fail.' after 'Adjust platform/enrollment ownership restrictions only for an approved scope and test exclusions.'. It does not establish success for the stated scenario; the needed evidence is 'The approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.'.

This observation would validate a different case: A corporate iPhone user removes Company Portal and expects the supervised automated enrollment state to disappear. It would check 'After app removal the test device remains supervised and applicable MDM policy stays intact.' after 'Explain and manage corporate supervision through Apple automated enrollment rather than app removal.'. It does not establish success for the stated scenario; the needed evidence is 'The approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.'.

This observation would validate a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. It would check 'The personal device enrolls with user-appropriate controls while the corporate device is supervised.' after 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.'. It does not establish success for the stated scenario; the needed evidence is 'The approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.'.

This observation would validate a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. It would check 'A help-desk test user can reset an assigned device but cannot edit security policies.' after 'Create the narrowest Intune RBAC role with only required remote-action permissions.'. It does not establish success for the stated scenario; the needed evidence is 'Only the assigned support accounts hold local admin access on test machines.'.

This observation would validate a different case: An executive wants email access blocked from unmanaged devices even when their passwords and MFA succeed. It would check 'A compliant test device accesses mail while an unmanaged test device is blocked.' after 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.'. It does not establish success for the stated scenario; the needed evidence is 'Only the assigned support accounts hold local admin access on test machines.'.

This observation would validate a different case: A company requires device risk severity from Defender for Endpoint to affect Conditional Access grants. It would check 'A high-risk test endpoint becomes noncompliant and fails the intended access policy.' after 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.'. It does not establish success for the stated scenario; the needed evidence is 'Only the assigned support accounts hold local admin access on test machines.'.