Exam Bundle

This action is appropriate for a different case: Endpoint Analytics reports poor application reliability but the team monitors only Windows boot speed. There, the targeted fix is 'Use application reliability metrics alongside startup performance in Endpoint Analytics.' because boot metrics alone do not explain crashes and application failures. The current scenario instead requires 'Include stale-device and missing-data treatment in compliance reporting definitions.' and verification that the report explicitly identifies stale devices and does not count them as confirmed compliant.

This action is appropriate for a different case: An Intune report contains sensitive employee device details and should be shared with executives who need only risk totals. There, the targeted fix is 'Aggregate or redact user-level data and apply report access restrictions.' because role-appropriate reporting should minimize disclosure of personal device information. The current scenario instead requires 'Include stale-device and missing-data treatment in compliance reporting definitions.' and verification that the report explicitly identifies stale devices and does not count them as confirmed compliant.

This action is appropriate for a different case: After a corporate app deployment, devices show inconsistent app install results but the dashboard aggregates only successful check-ins. There, the targeted fix is 'Export Intune app installation state per device and failure category.' because enrollment check-in does not prove application deployment completed. The current scenario instead requires 'Include stale-device and missing-data treatment in compliance reporting definitions.' and verification that the report explicitly identifies stale devices and does not count them as confirmed compliant.

This action is appropriate for a different case: A company provisions Windows 365 Enterprise Cloud PCs but the chosen provisioning policy uses a network that lacks required connectivity. There, the targeted fix is 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.' because Cloud PC creation requires a viable network and identity architecture. The current scenario instead requires 'Validate the Autopilot hardware registration tenant and assigned deployment profile.' and verification that the hardware shows the intended tenant identity and assigned profile at setup.

This action is appropriate for a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. There, the targeted fix is 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.' because capacity and entitlement errors cannot be repaired by changing Windows Defender policy. The current scenario instead requires 'Validate the Autopilot hardware registration tenant and assigned deployment profile.' and verification that the hardware shows the intended tenant identity and assigned profile at setup.

This action is appropriate for a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. There, the targeted fix is 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.' because device preparation deliberately limits setup app/script complexity for reliability. The current scenario instead requires 'Validate the Autopilot hardware registration tenant and assigned deployment profile.' and verification that the hardware shows the intended tenant identity and assigned profile at setup.

This action is appropriate for a different case: A service desk needs to identify whether Windows endpoints have slow startup caused by a new login agent rather than simple user complaints. There, the targeted fix is 'Review Endpoint Analytics startup performance reports and compare deployment cohorts.' because measured startup telemetry supports evidence-based performance troubleshooting. The current scenario instead requires 'Use device configuration reporting and setting-level diagnostics to isolate policy conflicts.' and verification that the report identifies the conflicting setting and its assignments on affected devices.

This action is appropriate for a different case: An operations team wants automated notifications when a previously compliant device becomes noncompliant, not weekly manual spreadsheet checks. There, the targeted fix is 'Configure supported Intune alerts and notifications or approved report-driven monitoring for compliance drift.' because timely alerting reduces time to investigate deterioration in endpoint posture. The current scenario instead requires 'Use device configuration reporting and setting-level diagnostics to isolate policy conflicts.' and verification that the report identifies the conflicting setting and its assignments on affected devices.

This action is appropriate for a different case: A scheduled remediation needs to run on a small pilot set during evening hours, not across all corporate laptops. There, the targeted fix is 'Configure supported scheduling and scoped assignments for the remediation package.' because maintenance automation should honor rollout and working-hour constraints. The current scenario instead requires 'Use device configuration reporting and setting-level diagnostics to isolate policy conflicts.' and verification that the report identifies the conflicting setting and its assignments on affected devices.

This observation would validate a different case: A mobile device enrollment is failing and the help desk needs actionable logs before wiping the phone. It would check 'The log bundle identifies the enrollment failure class for the affected device.' after 'Collect available Intune enrollment and device diagnostic logs for the specific record.'. It does not establish success for the stated scenario; the needed evidence is 'Signature version advances after the correct network source becomes accessible.'.

This observation would validate a different case: A KQL device query is returning no rows because the administrator copied a Log Analytics table name not available in Intune device query. It would check 'A corrected query returns the expected records from a controlled device sample.' after 'Use the device query supported schema and validate KQL syntax against its data model.'. It does not establish success for the stated scenario; the needed evidence is 'Signature version advances after the correct network source becomes accessible.'.

This observation would validate a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. It would check 'The query returns only eligible devices with the vulnerable app version.' after 'Use the supported Intune device query with valid KQL and an appropriate scope.'. It does not establish success for the stated scenario; the needed evidence is 'Signature version advances after the correct network source becomes accessible.'.

This action is appropriate for a different case: An administrator wants to extend device compliance using PowerShell but the custom script is assigned to unsupported macOS targets. There, the targeted fix is 'Scope custom compliance discovery to supported device platforms and policy prerequisites.' because a valid script on Windows need not be a valid macOS compliance mechanism. The current scenario instead requires 'Treat AI device performance analysis as a recommendation requiring verified action and measurable outcome.' and verification that after an approved fix, endpoint metrics improve and the recorded work item shows the change.

This action is appropriate for a different case: A security operations script stores an Intune app secret in a shared plain text PowerShell file. There, the targeted fix is 'Use supported secure credential or certificate-based authentication and restricted identity permissions.' because automation credentials require separate lifecycle protection from script source. The current scenario instead requires 'Treat AI device performance analysis as a recommendation requiring verified action and measurable outcome.' and verification that after an approved fix, endpoint metrics improve and the recorded work item shows the change.

This action is appropriate for a different case: A developer records full device user names and confidential diagnostic strings in an automation job log shared across help desk staff. There, the targeted fix is 'Minimize Graph output and restrict diagnostic log retention and access.' because automated telemetry can leak information unrelated to troubleshooting needs. The current scenario instead requires 'Treat AI device performance analysis as a recommendation requiring verified action and measurable outcome.' and verification that after an approved fix, endpoint metrics improve and the recorded work item shows the change.

This observation would validate a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. It would check 'The device registers for work access without appearing as a fully corporate-managed endpoint.' after 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.'. It does not establish success for the stated scenario; the needed evidence is 'A test shared device is enrolled under the approved ownership workflow without a permanent user affinity.'.

This observation would validate a different case: A Windows endpoint is missing from an Entra dynamic group because its directory attributes have not synchronized. It would check 'The updated attributes place the endpoint in the group without a standing manual workaround.' after 'Confirm directory synchronization and membership processing before manually adding a permanent exception.'. It does not establish success for the stated scenario; the needed evidence is 'A test shared device is enrolled under the approved ownership workflow without a permanent user affinity.'.

This observation would validate a different case: An endpoint team targets a deployment to 'all Windows devices' but includes personal and organization-owned machines with different requirements. It would check 'Group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.' after 'Refine Entra dynamic membership criteria using trusted ownership and platform attributes.'. It does not establish success for the stated scenario; the needed evidence is 'A test shared device is enrolled under the approved ownership workflow without a permanent user affinity.'.

This observation would validate a different case: An admin's PowerShell script queries Microsoft Graph but fails after the first 100 devices in a large tenant. It would check 'The script counts all expected inventory devices across multiple pages.' after 'Implement Graph pagination using the returned next-link sequence.'. It does not establish success for the stated scenario; the needed evidence is 'Supported Windows pilots evaluate the script and unsupported platforms remain excluded.'.

This observation would validate a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. It would check 'The pilot returns a parseable evaluation and its compliance state matches test conditions.' after 'Return the supported JSON schema without extra stdout content and validate the rules file.'. It does not establish success for the stated scenario; the needed evidence is 'Supported Windows pilots evaluate the script and unsupported platforms remain excluded.'.

This observation would validate a different case: A Graph call returns a transient 503 response and the workflow marks the entire tenant inventory as empty. It would check 'A transient simulated failure is reported or recovered without returning false zero devices.' after 'Distinguish transport errors from valid empty results and retry within a bounded policy.'. It does not establish success for the stated scenario; the needed evidence is 'Supported Windows pilots evaluate the script and unsupported platforms remain excluded.'.

This observation would validate a different case: A company requires device risk severity from Defender for Endpoint to affect Conditional Access grants. It would check 'A high-risk test endpoint becomes noncompliant and fails the intended access policy.' after 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.'. It does not establish success for the stated scenario; the needed evidence is 'User sign-in meets the intended authentication requirement without a shared password.'.

This observation would validate a different case: A sensitive Intune change is submitted and its approver is the same user who requested the change. It would check 'The requester cannot self-approve and a second authorized approver is recorded.' after 'Configure separation of duty in multi-admin approval and audit the approval chain.'. It does not establish success for the stated scenario; the needed evidence is 'User sign-in meets the intended authentication requirement without a shared password.'.

This observation would validate a different case: A company adds a new Intune compliance policy but Conditional Access continues permitting devices without any policy. It would check 'A device with no applicable compliance evaluation is denied when the policy requires it.' after 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.'. It does not establish success for the stated scenario; the needed evidence is 'User sign-in meets the intended authentication requirement without a shared password.'.

This action is appropriate for a different case: A company ships new Windows laptops directly to remote employees without maintaining custom OS images or having technicians stage every unit. There, the targeted fix is 'Configure Windows Autopilot user-driven deployment with a suitable assigned profile and enrollment prerequisites.' because user-driven provisioning transforms an OEM-installed Windows installation during the initial user experience. The current scenario instead requires 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.' and verification that an off-network pilot completes the chosen supported join workflow without domain dependency failure.

This action is appropriate for a different case: A service desk wants to reset a problematic Autopilot-managed Windows laptop while preserving its approved management state. There, the targeted fix is 'Choose a supported Windows Autopilot reset or reprovisioning action suited to the deployment model.' because reset workflows differ from full destructive wipe and can retain certain enrollment state. The current scenario instead requires 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.' and verification that an off-network pilot completes the chosen supported join workflow without domain dependency failure.

This action is appropriate for a different case: An Autopilot enrollment failure exposes only a generic timeout and the administrator keeps wiping the laptop without collecting diagnostics. There, the targeted fix is 'Collect Autopilot deployment logs and Intune enrollment diagnostics before making another change.' because repeated resets without failure evidence can conceal enrollment and application problems. The current scenario instead requires 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.' and verification that an off-network pilot completes the chosen supported join workflow without domain dependency failure.

This action is appropriate for a different case: A corporate iPhone user removes Company Portal and expects the supervised automated enrollment state to disappear. There, the targeted fix is 'Explain and manage corporate supervision through Apple automated enrollment rather than app removal.' because supervision and MDM identity reside beyond the Company Portal user application. The current scenario instead requires 'Integrate compatible Android zero-touch enrollment with Intune configuration assignments.' and verification that an eligible reseller-uploaded device automatically receives the intended Intune enrollment configuration.

This action is appropriate for a different case: An enrollment error appears during iPad provisioning immediately after the Apple enrollment token was refreshed, but the profile assignment is missing. There, the targeted fix is 'Check the token synchronization and automated enrollment profile mapping for the actual device.' because token health and device-to-profile assignment must both be correct. The current scenario instead requires 'Integrate compatible Android zero-touch enrollment with Intune configuration assignments.' and verification that an eligible reseller-uploaded device automatically receives the intended Intune enrollment configuration.

This action is appropriate for a different case: An employee with a personal Android phone needs protected Teams access without granting IT full device wipe privileges. There, the targeted fix is 'Use Android work-profile or app-protection management appropriate for personally owned devices.' because a personal device requires a narrower management boundary than fully managed corporate enrollment. The current scenario instead requires 'Integrate compatible Android zero-touch enrollment with Intune configuration assignments.' and verification that an eligible reseller-uploaded device automatically receives the intended Intune enrollment configuration.

This observation would validate a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. It would check 'The device restarts normally with its protected drive after authorized recovery.' after 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.'. It does not establish success for the stated scenario; the needed evidence is 'The infected pilot loses unauthorized network access while forensic evidence is preserved.'.

This observation would validate a different case: An ASR rule blocks a business-approved legacy app, and the service desk suggests turning off all ASR protections. It would check 'The approved app runs while unrelated ASR detections remain enforced.' after 'Create a tightly scoped policy exception or compatible application update after security review.'. It does not establish success for the stated scenario; the needed evidence is 'The infected pilot loses unauthorized network access while forensic evidence is preserved.'.

This observation would validate a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. It would check 'A newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.' after 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.'. It does not establish success for the stated scenario; the needed evidence is 'The infected pilot loses unauthorized network access while forensic evidence is preserved.'.