Exam Bundle

This observation would validate a different case: Endpoint Analytics reports poor application reliability but the team monitors only Windows boot speed. It would check 'A targeted report identifies the affected app crash trend separately from boot duration.' after 'Use application reliability metrics alongside startup performance in Endpoint Analytics.'. It does not establish success for the stated scenario; the needed evidence is 'The script runs only on targeted devices during the intended test schedule.'.

This observation would validate a different case: A policy status dashboard shows a rise in 'error' and 'conflict' states after a Windows configuration rollout. It would check 'The report identifies the conflicting setting and its assignments on affected devices.' after 'Use device configuration reporting and setting-level diagnostics to isolate policy conflicts.'. It does not establish success for the stated scenario; the needed evidence is 'The script runs only on targeted devices during the intended test schedule.'.

This observation would validate a different case: An admin dashboard shows compliance percentages but hides the tenant's oldest policy evaluation timestamp. It would check 'Each sample device shows its latest status and actual last evaluation time.' after 'Expose freshness and evaluation-time metadata in monitoring reports.'. It does not establish success for the stated scenario; the needed evidence is 'The script runs only on targeted devices during the intended test schedule.'.

This observation would validate a different case: A contractor has two organizational accounts on the same phone and one department must be unable to access the other's protected app data. It would check 'Tests show each account can access only its authorized data in the protected app.' after 'Plan per-identity app protection and access boundaries with separate Conditional Access scopes.'. It does not establish success for the stated scenario; the needed evidence is 'Work content pastes into an approved work app but not an unprotected personal app.'.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'Work content pastes into an approved work app but not an unprotected personal app.'.

This observation would validate a different case: Corporate iPhones are fully enrolled, but a help desk believes app protection policies are unnecessary when app data must remain protected during share operations. It would check 'An enrolled device is managed and the protected app enforces document-sharing restrictions.' after 'Apply appropriate app protection policies in addition to device management where required.'. It does not establish success for the stated scenario; the needed evidence is 'Work content pastes into an approved work app but not an unprotected personal app.'.

This observation would validate a different case: A user opens Company Portal but does not see the approved optional line-of-business app because it was assigned to a device group as Required only. It would check 'An eligible pilot user can locate and install the optional app.' after 'Create a correct Available assignment to the eligible user population.'. It does not establish success for the stated scenario; the needed evidence is 'The enterprise app is removed and unrelated personal apps remain.'.

This observation would validate a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. It would check 'The app installs before the employee is allowed to start regulated work.' after 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.'. It does not establish success for the stated scenario; the needed evidence is 'The enterprise app is removed and unrelated personal apps remain.'.

This observation would validate a different case: A company uses one Microsoft 365 Apps policy for every user but call-center users require a smaller set of Office applications. It would check 'Call-center pilots receive the approved subset and analysts receive their full suite.' after 'Create role-scoped Microsoft 365 Apps deployment packages or configurations.'. It does not establish success for the stated scenario; the needed evidence is 'The enterprise app is removed and unrelated personal apps remain.'.

This action is appropriate for a different case: A security admin sees a Security Copilot agent suggest that 500 endpoints are stale and immediately prepares a bulk offboarding job. There, the targeted fix is 'Review the Device Offboarding Agent evidence and require authorized admin approval before changes.' because agent recommendations are supervised aids, not automatic deletion permission. The current scenario instead requires 'Scope custom compliance discovery to supported device platforms and policy prerequisites.' and verification that supported Windows pilots evaluate the script and unsupported platforms remain excluded.

This action is appropriate for a different case: An automated Intune offboarding script uses Graph permissions that also allow managing unrelated Microsoft 365 users. There, the targeted fix is 'Reduce the automation identity's effective Graph scopes and target only approved device APIs.' because least privilege should constrain both permission and resource selection. The current scenario instead requires 'Scope custom compliance discovery to supported device platforms and policy prerequisites.' and verification that supported Windows pilots evaluate the script and unsupported platforms remain excluded.

This action is appropriate for a different case: A support team uses Security Copilot to summarize device performance but mistakes an anomaly prediction for a completed repair. There, the targeted fix is 'Treat AI device performance analysis as a recommendation requiring verified action and measurable outcome.' because prediction and actual endpoint remediation are separate workflow stages. The current scenario instead requires 'Scope custom compliance discovery to supported device platforms and policy prerequisites.' and verification that supported Windows pilots evaluate the script and unsupported platforms remain excluded.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Use Intune app protection status reporting for the targeted managed account.' and verification that the report identifies an applied policy for eligible users and flags an unprotected account.

This action is appropriate for a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. There, the targeted fix is 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.' because identity grants can restrict access to clients enforcing enterprise app data controls. The current scenario instead requires 'Use Intune app protection status reporting for the targeted managed account.' and verification that the report identifies an applied policy for eligible users and flags an unprotected account.

This action is appropriate for a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. There, the targeted fix is 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.' because selective restrictions can preserve personal usability while preventing leakage. The current scenario instead requires 'Use Intune app protection status reporting for the targeted managed account.' and verification that the report identifies an applied policy for eligible users and flags an unprotected account.

This action is appropriate for a different case: A corporate Mac is registered under an employee's account, but its manager expects Entra join behavior identical to a Windows PC. There, the targeted fix is 'Use the supported Entra registration or platform-supported join approach rather than assuming Windows join semantics.' because device identity capabilities differ across operating systems and deployment models. The current scenario instead requires 'Use a verified stale registration cleanup process respecting user and enrollment ownership.' and verification that the retired phone registration disappears without affecting the replacement device's sign-in.

This action is appropriate for a different case: A technician attempts to Entra join company devices using an account that is not permitted to join additional devices. There, the targeted fix is 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' because authentication alone does not override tenant device join restrictions. The current scenario instead requires 'Use a verified stale registration cleanup process respecting user and enrollment ownership.' and verification that the retired phone registration disappears without affecting the replacement device's sign-in.

This action is appropriate for a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. There, the targeted fix is 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.' because shared-use devices should not inherit an arbitrary employee's personal management scope. The current scenario instead requires 'Use a verified stale registration cleanup process respecting user and enrollment ownership.' and verification that the retired phone registration disappears without affecting the replacement device's sign-in.

This observation would validate a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. It would check 'A help-desk test user can reset an assigned device but cannot edit security policies.' after 'Create the narrowest Intune RBAC role with only required remote-action permissions.'. It does not establish success for the stated scenario; the needed evidence is 'A high-risk test endpoint becomes noncompliant and fails the intended access policy.'.

This observation would validate a different case: A customer wants only a specific device support group to be local Administrators on Windows endpoints, not every cloud user. It would check 'Only the assigned support accounts hold local admin access on test machines.' after 'Configure the Windows local users and groups policy in Intune with supported membership settings.'. It does not establish success for the stated scenario; the needed evidence is 'A high-risk test endpoint becomes noncompliant and fails the intended access policy.'.

This observation would validate a different case: A company uses corporate Windows endpoints but wants passwordless sign-in based on the user's biometric gesture, not network location. It would check 'User sign-in meets the intended authentication requirement without a shared password.' after 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'A high-risk test endpoint becomes noncompliant and fails the intended access policy.'.

This observation would validate a different case: A Windows ADMX policy was imported with a duplicate namespace and now the administrative template cannot be saved. It would check 'The corrected template imports and a pilot setting can be created without schema errors.' after 'Correct the imported ADMX metadata and related dependencies using supported Intune import rules.'. It does not establish success for the stated scenario; the needed evidence is 'The test scanner accesses its business app but not blocked system settings.'.

This observation would validate a different case: Windows devices require a browser security setting available in the Intune settings catalog, but the admin creates an unrelated compliance rule. It would check 'The expected browser setting appears effective on targeted Windows pilot devices.' after 'Create a Windows device configuration profile using the supported settings catalog control.'. It does not establish success for the stated scenario; the needed evidence is 'The test scanner accesses its business app but not blocked system settings.'.

This observation would validate a different case: A Windows configuration profile shows 'conflict' for password length because two profiles target the same device with different values. It would check 'The pilot reports one intended applied password policy and no setting conflict.' after 'Inspect per-setting status and revise overlapping profile assignments or definitions.'. It does not establish success for the stated scenario; the needed evidence is 'The test scanner accesses its business app but not blocked system settings.'.

This action is appropriate for a different case: An acquired company has devices in a different Microsoft Entra tenant and plans to enroll them directly into the new tenant without transitioning ownership. There, the targeted fix is 'Design a supported device identity and enrollment migration including unjoin, re-registration, and data preservation steps.' because an enrolled device is tied to its source tenant and cannot be reassigned by display-name change. The current scenario instead requires 'Base privileged targeting on controlled device properties and separate authorization, not an untrusted name.' and verification that a renamed unapproved device does not acquire the privileged group's resources.

This action is appropriate for a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. There, the targeted fix is 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.' because device registration supports work access while preserving BYOD ownership boundaries. The current scenario instead requires 'Base privileged targeting on controlled device properties and separate authorization, not an untrusted name.' and verification that a renamed unapproved device does not acquire the privileged group's resources.

This action is appropriate for a different case: A device loses its Entra primary refresh token after a password reset and cloud application single sign-on stops functioning. There, the targeted fix is 'Inspect Entra sign-in/device diagnostics and refresh device authentication through supported steps.' because token and device identity failures should be isolated before reimaging. The current scenario instead requires 'Base privileged targeting on controlled device properties and separate authorization, not an untrusted name.' and verification that a renamed unapproved device does not acquire the privileged group's resources.

This action is appropriate for a different case: A fleet of laptops is shared among shifts and a user-based Entra group causes the same device to receive inconsistent assignments. There, the targeted fix is 'Use the appropriate device-based targeting strategy for settings that must persist across users.' because user-based membership follows sign-in identity rather than the stable shared endpoint. The current scenario instead requires 'Map the appropriate identity identifiers and relationships before issuing device-specific API actions.' and verification that the query resolves to the intended physical device without accidentally acting on another inventory record.

This action is appropriate for a different case: A technician attempts to Entra join company devices using an account that is not permitted to join additional devices. There, the targeted fix is 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' because authentication alone does not override tenant device join restrictions. The current scenario instead requires 'Map the appropriate identity identifiers and relationships before issuing device-specific API actions.' and verification that the query resolves to the intended physical device without accidentally acting on another inventory record.

This action is appropriate for a different case: A branch requires traditional on-premises domain authentication for line-of-business software while also using cloud-based identity policies. There, the targeted fix is 'Plan Microsoft Entra hybrid join with synchronized identity and valid domain connectivity.' because hybrid join retains an AD DS dependency while enabling Entra device identity. The current scenario instead requires 'Map the appropriate identity identifiers and relationships before issuing device-specific API actions.' and verification that the query resolves to the intended physical device without accidentally acting on another inventory record.

This observation would validate a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. It would check 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.' after 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app signs in with its applied policy while an unsupported client is denied.'.

This observation would validate a different case: An Intune compliance policy for Android expects a Windows-only setting and shows unknown evaluations. It would check 'Android pilot devices evaluate their supported controls without irrelevant Windows errors.' after 'Assign platform-specific compliance settings only to supported operating systems.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app signs in with its applied policy while an unsupported client is denied.'.

This observation would validate a different case: A Windows LAPS password appears in directory but ordinary users can retrieve it due to overly broad role membership. It would check 'The ordinary user cannot retrieve the secret while an authorized operator can with logging.' after 'Restrict LAPS password retrieval permissions with approved RBAC and audit usage.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app signs in with its applied policy while an unsupported client is denied.'.