Exam Bundle

This observation would validate a different case: A new Teams app version is installed, but app protection appears inactive because a stale user account is signed in. It would check 'Switching to the targeted work account activates the intended data protection controls.' after 'Check which organizational identity and supported app instance is receiving the policy.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app removes corporate documents but the user's personal content remains.'.

This observation would validate a different case: An IT team wants to report whether mobile app protection was applied without inferring success from app installation alone. It would check 'The report identifies an applied policy for eligible users and flags an unprotected account.' after 'Use Intune app protection status reporting for the targeted managed account.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app removes corporate documents but the user's personal content remains.'.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app removes corporate documents but the user's personal content remains.'.

This observation would validate a different case: An administrator needs to deploy browser restrictions to Windows devices but wants to avoid conflict with an existing security baseline. It would check 'The test endpoint reports one effective value and no unresolved configuration conflict.' after 'Compare overlapping settings and select one authoritative assignment for each control.'. It does not establish success for the stated scenario; the needed evidence is 'The restriction appears only on warehouse devices in the test cohort.'.

This observation would validate a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. It would check 'Supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.' after 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.'. It does not establish success for the stated scenario; the needed evidence is 'The restriction appears only on warehouse devices in the test cohort.'.

This observation would validate a different case: A device configuration profile is changed but its rollout has no staged group, causing an immediate company-wide restriction. It would check 'The pilot proves the setting and later cohorts remain unchanged until promotion.' after 'Apply controlled phased assignments and monitored pilot rings for Intune settings.'. It does not establish success for the stated scenario; the needed evidence is 'The restriction appears only on warehouse devices in the test cohort.'.

This observation would validate a different case: An enterprise needs every new laptop to install Microsoft 365 Apps automatically during initial Windows deployment. It would check 'A new pilot Autopilot laptop has the intended Office apps after setup.' after 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.'. It does not establish success for the stated scenario; the needed evidence is 'The approved work app stops notifications during the configured off-hours.'.

This observation would validate a different case: An enterprise needs to remove a vulnerable app version before assigning a patched replacement, avoiding two conflicting versions. It would check 'The test endpoint has only the approved current app version.' after 'Coordinate app supersedence or uninstall and replacement assignments with detection tests.'. It does not establish success for the stated scenario; the needed evidence is 'The approved work app stops notifications during the configured off-hours.'.

This observation would validate a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. It would check 'The app installs before the employee is allowed to start regulated work.' after 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.'. It does not establish success for the stated scenario; the needed evidence is 'The approved work app stops notifications during the configured off-hours.'.

This action is appropriate for a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. There, the targeted fix is 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' because compatibility holds should be investigated rather than treated as arbitrary policy failures. The current scenario instead requires 'Check device association and Autopilot registration precedence before troubleshooting assignments.' and verification that a pilot reports the intended deployment engine after device state is corrected.

This action is appropriate for a different case: Users complain that newly provisioned Cloud PCs are created in the wrong geographic location for data residency requirements. There, the targeted fix is 'Review provisioning policy region and supported placement settings before creating new Cloud PCs.' because Cloud PC regional placement must align with location policy and service availability. The current scenario instead requires 'Check device association and Autopilot registration precedence before troubleshooting assignments.' and verification that a pilot reports the intended deployment engine after device state is corrected.

This action is appropriate for a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. There, the targeted fix is 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.' because capacity and entitlement errors cannot be repaired by changing Windows Defender policy. The current scenario instead requires 'Check device association and Autopilot registration precedence before troubleshooting assignments.' and verification that a pilot reports the intended deployment engine after device state is corrected.

This action is appropriate for a different case: A Microsoft Store application has been delisted and a policy still targets its unavailable listing. There, the targeted fix is 'Check current Store availability and switch to a supported enterprise packaging source if licensed.' because no assignment can install content the store no longer offers. The current scenario instead requires 'Renew the managed Apps and Books location token and verify license sync.' and verification that current app licenses sync into Intune and a pilot install succeeds.

This action is appropriate for a different case: A security tool must be automatically installed on every company laptop and should not be treated as user-optional. There, the targeted fix is 'Assign the application as Required to the verified corporate device group.' because mandatory controls need device-wide automatic assignment. The current scenario instead requires 'Renew the managed Apps and Books location token and verify license sync.' and verification that current app licenses sync into Intune and a pilot install succeeds.

This action is appropriate for a different case: An organization must centrally configure Outlook security settings while leaving Windows device OS update rings unchanged. There, the targeted fix is 'Manage Microsoft 365 Apps policy through Intune or Microsoft 365 Apps admin center as appropriate.' because application policy and OS update management have different targets. The current scenario instead requires 'Renew the managed Apps and Books location token and verify license sync.' and verification that current app licenses sync into Intune and a pilot install succeeds.

This observation would validate a different case: A customer wants only a specific device support group to be local Administrators on Windows endpoints, not every cloud user. It would check 'Only the assigned support accounts hold local admin access on test machines.' after 'Configure the Windows local users and groups policy in Intune with supported membership settings.'. It does not establish success for the stated scenario; the needed evidence is 'A compliant test device accesses mail while an unmanaged test device is blocked.'.

This observation would validate a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. It would check 'A help-desk test user can reset an assigned device but cannot edit security policies.' after 'Create the narrowest Intune RBAC role with only required remote-action permissions.'. It does not establish success for the stated scenario; the needed evidence is 'A compliant test device accesses mail while an unmanaged test device is blocked.'.

This observation would validate a different case: A PIN policy is applied but Windows Hello for Business enrollment fails on devices without a functional TPM. It would check 'An eligible pilot device provisions its Hello key and an ineligible device gets an actionable diagnostic.' after 'Diagnose supported hardware and Windows Hello provisioning requirements instead of weakening policy globally.'. It does not establish success for the stated scenario; the needed evidence is 'A compliant test device accesses mail while an unmanaged test device is blocked.'.

This action is appropriate for a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. There, the targeted fix is 'Use Group Policy analytics to import and assess supported settings migration paths.' because analytics identifies candidate cloud-manageable settings before recreating GPOs. The current scenario instead requires 'Use appropriate Intune assignment filters alongside group targeting.' and verification that the eligible iOS pilot gets the VPN and the unsupported version is excluded.

This action is appropriate for a different case: An iOS configuration update is queued but employees report it has not arrived despite healthy device enrollment. There, the targeted fix is 'Inspect profile assignment, latest device check-in and pending policy sync status.' because an enrolled device may be offline or awaiting policy processing. The current scenario instead requires 'Use appropriate Intune assignment filters alongside group targeting.' and verification that the eligible iOS pilot gets the VPN and the unsupported version is excluded.

This action is appropriate for a different case: A Windows configuration profile shows 'conflict' for password length because two profiles target the same device with different values. There, the targeted fix is 'Inspect per-setting status and revise overlapping profile assignments or definitions.' because conflicting targeted settings do not become resolved by changing the device name. The current scenario instead requires 'Use appropriate Intune assignment filters alongside group targeting.' and verification that the eligible iOS pilot gets the VPN and the unsupported version is excluded.

This observation would validate a different case: Android work-profile devices must not be interrupted by a forced OS update during a defined maintenance freeze. It would check 'A pilot defers updates during the freeze and installs after the approved period.' after 'Use supported Android system-update policies or OEM configuration suited to the ownership mode.'. It does not establish success for the stated scenario; the needed evidence is 'A supervised pilot receives the targeted Apple OS update on its intended schedule.'.

This observation would validate a different case: A fleet of Samsung Android corporate devices needs firmware updates but the ordinary app update policy changes only application packages. It would check 'The pilot Samsung device reports the intended firmware build after its FOTA policy.' after 'Plan supported Android OEM firmware-over-the-air (FOTA) deployment or configuration restrictions.'. It does not establish success for the stated scenario; the needed evidence is 'A supervised pilot receives the targeted Apple OS update on its intended schedule.'.

This observation would validate a different case: An administrator wants to expedite one critical Windows quality patch but leave routine rollout rings unchanged. It would check 'Affected devices report the designated quality update within the approved urgent deadline.' after 'Use an eligible expedited quality update policy with targeted monitoring.'. It does not establish success for the stated scenario; the needed evidence is 'A supervised pilot receives the targeted Apple OS update on its intended schedule.'.

This action is appropriate for a different case: A company wants standard users to elevate one approved IT utility without granting permanent local administrator access. There, the targeted fix is 'Configure Intune Endpoint Privilege Management (EPM) elevation policies for that signed and approved app.' because just-in-time elevation narrows privilege compared with standing administrator membership. The current scenario instead requires 'Constrain tunnel configuration and application policy to permitted work-app traffic.' and verification that only the approved corporate app's requests traverse the tunnel during a controlled test.

This action is appropriate for a different case: A managed catalog app requires a vendor-specific detection update after an upstream app build changes its install path. There, the targeted fix is 'Update the Enterprise App Catalog app assignment or detection configuration using supported lifecycle procedures.' because catalog availability doesn't remove the need to verify installed state. The current scenario instead requires 'Constrain tunnel configuration and application policy to permitted work-app traffic.' and verification that only the approved corporate app's requests traverse the tunnel during a controlled test.

This action is appropriate for a different case: An Intune Cloud PKI certificate is nearing expiry but the team has no monitoring or lifecycle renewal plan. There, the targeted fix is 'Configure certificate health monitoring and appropriate renewal/rotation planning.' because certificates need continuous trust and expiry management. The current scenario instead requires 'Constrain tunnel configuration and application policy to permitted work-app traffic.' and verification that only the approved corporate app's requests traverse the tunnel during a controlled test.

This observation would validate a different case: A device is marked registered but the organization requires joined identity for a Windows security baseline deployment. It would check 'The rebuilt test device reports the intended join type before the baseline is assigned.' after 'Transition the eligible Windows endpoint to the appropriate Microsoft Entra joined provisioning path.'. It does not establish success for the stated scenario; the needed evidence is 'The query resolves to the intended physical device without accidentally acting on another inventory record.'.

This observation would validate a different case: A sales organization wants newly provisioned laptops automatically assigned to an Entra device group based on their operating system. It would check 'A test Windows device joins the intended group and a test macOS device does not.' after 'Create a dynamic device membership rule using supported operating system properties.'. It does not establish success for the stated scenario; the needed evidence is 'The query resolves to the intended physical device without accidentally acting on another inventory record.'.

This observation would validate a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. It would check 'The device registers for work access without appearing as a fully corporate-managed endpoint.' after 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.'. It does not establish success for the stated scenario; the needed evidence is 'The query resolves to the intended physical device without accidentally acting on another inventory record.'.

This action is appropriate for a different case: A device receives the wrong Wi-Fi profile because its enrollment-time platform group membership has not been evaluated yet. There, the targeted fix is 'Plan enrollment-time grouping and assignment precedence for critical first-login configurations.' because enrollment assignments may need target resolution before full inventory processing. The current scenario instead requires 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.' and verification that a pilot Android device receives the certificate and connects to the secure SSID.

This action is appropriate for a different case: A Teams Rooms device should receive meeting-room configuration without a user signing into Company Portal. There, the targeted fix is 'Use supported Teams Rooms specialized-device enrollment and configuration targeting.' because room equipment often has different setup and shared-use requirements from personal PCs. The current scenario instead requires 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.' and verification that a pilot Android device receives the certificate and connects to the secure SSID.

This action is appropriate for a different case: A device configuration profile is changed but its rollout has no staged group, causing an immediate company-wide restriction. There, the targeted fix is 'Apply controlled phased assignments and monitored pilot rings for Intune settings.' because ring-based deployment reduces the scope of configuration defects. The current scenario instead requires 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.' and verification that a pilot Android device receives the certificate and connects to the secure SSID.