Exam Bundle

This observation would validate a different case: A tenant's Intune service communications warn of a regional enrollment issue but support continues reinstalling Company Portal on every phone. It would check 'The incident is recorded as provider-side and new enrollment succeeds after recovery.' after 'Check Intune tenant status, service health and message center notifications first.'. It does not establish success for the stated scenario; the needed evidence is 'An impact record identifies affected device groups and remediation owners for the announced change.'.

This observation would validate a different case: A company must track enrollment failures by platform and technician across branches to find a repeating setup problem. It would check 'A sample export groups failures accurately by OS and enrollment profile.' after 'Create scoped enrollment failure reports with platform, profile and error details.'. It does not establish success for the stated scenario; the needed evidence is 'An impact record identifies affected device groups and remediation owners for the announced change.'.

This observation would validate a different case: Application startup performance degrades after a new security agent version and teams argue using anecdotal complaints. It would check 'The score change is measured on comparable hardware and reversed after a pilot fix.' after 'Compare Endpoint Analytics app startup telemetry before and after the agent release.'. It does not establish success for the stated scenario; the needed evidence is 'An impact record identifies affected device groups and remediation owners for the announced change.'.

This observation would validate a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. It would check 'The work browser opens the approved home page while personal browsing remains untouched.' after 'Use managed app configuration for the supported work browser and targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'A controlled copy-to-personal-account test is blocked while work-to-work flows succeed.'.

This observation would validate a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. It would check 'Work content pastes into an approved work app but not an unprotected personal app.' after 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.'. It does not establish success for the stated scenario; the needed evidence is 'A controlled copy-to-personal-account test is blocked while work-to-work flows succeed.'.

This observation would validate a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. It would check 'The protected app removes corporate documents but the user's personal content remains.' after 'Trigger selective corporate app data wipe for the managed identity where supported.'. It does not establish success for the stated scenario; the needed evidence is 'A controlled copy-to-personal-account test is blocked while work-to-work flows succeed.'.

This action is appropriate for a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. There, the targeted fix is 'Check supervision and platform prerequisites before configuring Apple update enforcement.' because some Apple update commands require corporate supervision. The current scenario instead requires 'Configure Intune Windows update rings with staged assignments and appropriate deadlines.' and verification that pilot devices patch first and broader devices follow after a monitored validation window.

This action is appropriate for a different case: A Windows update fails only on one device model after a firmware revision and the team considers blocking all tenant updates. There, the targeted fix is 'Use per-model diagnostics and staged targeting to isolate the compatibility defect.' because localized firmware issues should not halt unrelated secure devices. The current scenario instead requires 'Configure Intune Windows update rings with staged assignments and appropriate deadlines.' and verification that pilot devices patch first and broader devices follow after a monitored validation window.

This action is appropriate for a different case: A business wants to deploy an emergency Windows fix only to a device class that runs the affected application. There, the targeted fix is 'Assign the appropriate expedited quality policy to a verified at-risk group.' because security urgency does not justify unnecessary disruption of unrelated devices. The current scenario instead requires 'Configure Intune Windows update rings with staged assignments and appropriate deadlines.' and verification that pilot devices patch first and broader devices follow after a monitored validation window.

This action is appropriate for a different case: A help desk needs remote interactive assistance for users but employees should be able to grant consent to support sessions. There, the targeted fix is 'Configure Microsoft Intune Remote Help with approved roles, tenant configuration and consent behavior.' because remote assistance should be governed and attributable to authorized support staff. The current scenario instead requires 'Review EPM elevation requests and create narrow approved rules rather than blanket authorization.' and verification that the pilot's approved software elevates while unknown programs still require review.

This action is appropriate for a different case: A security team needs to audit which EPM-elevated executables employees actually run across a pilot fleet. There, the targeted fix is 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.' because privileged execution should be monitored to detect policy misuse. The current scenario instead requires 'Review EPM elevation requests and create narrow approved rules rather than blanket authorization.' and verification that the pilot's approved software elevates while unknown programs still require review.

This action is appropriate for a different case: A catalog application is assigned but its vendor's older custom package remains installed and causes detection confusion. There, the targeted fix is 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.' because conflicting installations should be controlled across package lifecycles. The current scenario instead requires 'Review EPM elevation requests and create narrow approved rules rather than blanket authorization.' and verification that the pilot's approved software elevates while unknown programs still require review.

This observation would validate a different case: A report claims 100% compliance because it excludes devices that have not checked in for 30 days. It would check 'The report explicitly identifies stale devices and does not count them as confirmed compliant.' after 'Include stale-device and missing-data treatment in compliance reporting definitions.'. It does not establish success for the stated scenario; the needed evidence is 'The post-upgrade cohort can be assessed against the saved pre-upgrade distribution.'.

This observation would validate a different case: After a corporate app deployment, devices show inconsistent app install results but the dashboard aggregates only successful check-ins. It would check 'The report lists each failed app installation and its relevant code.' after 'Export Intune app installation state per device and failure category.'. It does not establish success for the stated scenario; the needed evidence is 'The post-upgrade cohort can be assessed against the saved pre-upgrade distribution.'.

This observation would validate a different case: An organization sees repeated unexpected restarts on one hardware model after a new driver rollout. It would check 'The post-remediation model reports fewer unexpected restarts under comparable usage.' after 'Correlate restart frequency with device model and driver deployment history.'. It does not establish success for the stated scenario; the needed evidence is 'The post-upgrade cohort can be assessed against the saved pre-upgrade distribution.'.

This observation would validate a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. It would check 'The protected supported app connects and an unprotected native app cannot access mail.' after 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.'. It does not establish success for the stated scenario; the needed evidence is 'Outlook prompts for the configured app PIN on the BYOD pilot.'.

This observation would validate a different case: A company wants managed iOS and Android apps to receive a company tenant identifier without requiring users to type it every launch. It would check 'The targeted app starts with the right corporate tenant and no manual text entry.' after 'Use supported app configuration policies for managed apps or devices according to enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'Outlook prompts for the configured app PIN on the BYOD pilot.'.

This observation would validate a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. It would check 'The protected app removes corporate documents but the user's personal content remains.' after 'Trigger selective corporate app data wipe for the managed identity where supported.'. It does not establish success for the stated scenario; the needed evidence is 'Outlook prompts for the configured app PIN on the BYOD pilot.'.

This action is appropriate for a different case: A Microsoft Store application has been delisted and a policy still targets its unavailable listing. There, the targeted fix is 'Check current Store availability and switch to a supported enterprise packaging source if licensed.' because no assignment can install content the store no longer offers. The current scenario instead requires 'Correct required/available assignment and group exclusions to enforce app entitlement.' and verification that the finance test user can install the tool and contractor accounts cannot see it.

This action is appropriate for a different case: An enterprise needs every new laptop to install Microsoft 365 Apps automatically during initial Windows deployment. There, the targeted fix is 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' because Office app deployment can be managed alongside Windows enrollment provisioning. The current scenario instead requires 'Correct required/available assignment and group exclusions to enforce app entitlement.' and verification that the finance test user can install the tool and contractor accounts cannot see it.

This action is appropriate for a different case: An Intune Win32 app reports 'installed' even though its executable is absent because the detection rule checks the wrong file path. There, the targeted fix is 'Correct the Win32 app detection rules to verify a reliable product file, registry key or MSI ID.' because accurate detection separates actual installed state from command execution status. The current scenario instead requires 'Correct required/available assignment and group exclusions to enforce app entitlement.' and verification that the finance test user can install the tool and contractor accounts cannot see it.

This observation would validate a different case: A company uses Remote Help for employee laptops but wants sessions visible in audit logs without recording private chat content unnecessarily. It would check 'A sample support session has the required audit metadata and protected access to its records.' after 'Configure governed Remote Help logging and retention consistent with privacy policies.'. It does not establish success for the stated scenario; the needed evidence is 'The test protected application establishes an authorized tunnel and its status reports healthy.'.

This observation would validate a different case: A company wants standard users to elevate one approved IT utility without granting permanent local administrator access. It would check 'The utility elevates with EPM while unrelated applications remain non-elevated.' after 'Configure Intune Endpoint Privilege Management (EPM) elevation policies for that signed and approved app.'. It does not establish success for the stated scenario; the needed evidence is 'The test protected application establishes an authorized tunnel and its status reports healthy.'.

This observation would validate a different case: A managed catalog app requires a vendor-specific detection update after an upstream app build changes its install path. It would check 'The new pilot release is reported installed and a missing app is detected as absent.' after 'Update the Enterprise App Catalog app assignment or detection configuration using supported lifecycle procedures.'. It does not establish success for the stated scenario; the needed evidence is 'The test protected application establishes an authorized tunnel and its status reports healthy.'.

This action is appropriate for a different case: A remote kiosk is frozen after an application update and operations needs a controlled reboot, not a factory reset. There, the targeted fix is 'Use the Restart remote device action with authorization and user-impact assessment.' because restart and wipe have drastically different data effects. The current scenario instead requires 'Verify recovery-key escrow health and supported rotation prerequisites before action.' and verification that the pilot rotates successfully and the new recovery key is confirmed escrowed.

This action is appropriate for a different case: A security team wants to refresh Microsoft Defender Antivirus signatures on a set of endpoints without reinstalling the agent. There, the targeted fix is 'Run the supported Defender Antivirus security intelligence update action in Intune.' because security intelligence refresh is distinct from OS upgrades and MDE onboarding. The current scenario instead requires 'Verify recovery-key escrow health and supported rotation prerequisites before action.' and verification that the pilot rotates successfully and the new recovery key is confirmed escrowed.

This action is appropriate for a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. There, the targeted fix is 'Use an authorized Wipe action on the verified device record with incident tracking.' because a full wipe is appropriate for a lost corporate endpoint when approved. The current scenario instead requires 'Verify recovery-key escrow health and supported rotation prerequisites before action.' and verification that the pilot rotates successfully and the new recovery key is confirmed escrowed.

This observation would validate a different case: A Windows local group policy replaces an emergency break-glass member by accident during rollout. It would check 'The pilot device contains both mandated emergency access and the intended managed members.' after 'Choose group-membership update semantics that preserve required approved break-glass access.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot device provisions its Hello key and an ineligible device gets an actionable diagnostic.'.

This observation would validate a different case: An executive wants email access blocked from unmanaged devices even when their passwords and MFA succeed. It would check 'A compliant test device accesses mail while an unmanaged test device is blocked.' after 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot device provisions its Hello key and an ineligible device gets an actionable diagnostic.'.

This observation would validate a different case: A compliance check requires BitLocker but a freshly enrolled Windows device has not finished encryption. It would check 'The pilot becomes compliant after encryption, and an unencrypted device past grace is blocked.' after 'Configure appropriate grace period and evaluate encryption deployment state before enforcing device access.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot device provisions its Hello key and an ineligible device gets an actionable diagnostic.'.

This observation would validate a different case: A Graph automation exceeds Intune service request limits and receives HTTP 429 responses. It would check 'A test workload recovers after throttling within the approved retry budget.' after 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.'. It does not establish success for the stated scenario; the needed evidence is 'The approved fix resolves legitimate access without admitting noncompliant test endpoints.'.

This observation would validate a different case: A Graph call returns a transient 503 response and the workflow marks the entire tenant inventory as empty. It would check 'A transient simulated failure is reported or recovered without returning false zero devices.' after 'Distinguish transport errors from valid empty results and retry within a bounded policy.'. It does not establish success for the stated scenario; the needed evidence is 'The approved fix resolves legitimate access without admitting noncompliant test endpoints.'.

This observation would validate a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. It would check 'The pilot returns a parseable evaluation and its compliance state matches test conditions.' after 'Return the supported JSON schema without extra stdout content and validate the rules file.'. It does not establish success for the stated scenario; the needed evidence is 'The approved fix resolves legitimate access without admitting noncompliant test endpoints.'.