Exam Bundle

This observation would validate a different case: A Windows configuration profile shows 'conflict' for password length because two profiles target the same device with different values. It would check 'The pilot reports one intended applied password policy and no setting conflict.' after 'Inspect per-setting status and revise overlapping profile assignments or definitions.'. It does not establish success for the stated scenario; the needed evidence is 'A Mac connects without an untrusted certificate warning under approved policy.'.

This observation would validate a different case: A company wants one kiosk policy for Teams Rooms and Android scanners and finds platform targeting failures. It would check 'Each test device receives only its supported policy payload.' after 'Create separate specialty-device configuration profiles aligned to each platform.'. It does not establish success for the stated scenario; the needed evidence is 'A Mac connects without an untrusted certificate warning under approved policy.'.

This observation would validate a different case: A Mac needs FileVault configuration but the admin targets a Windows BitLocker settings catalog profile. It would check 'The Mac reports encryption status and the approved escrowed recovery information.' after 'Create and assign the platform-specific macOS FileVault and recovery-key configuration.'. It does not establish success for the stated scenario; the needed evidence is 'A Mac connects without an untrusted certificate warning under approved policy.'.

This action is appropriate for a different case: A packaged Win32 application uses a shared UNC path installer that remote laptops cannot reach off VPN. There, the targeted fix is 'Distribute packaged installation content through Intune rather than relying on an inaccessible internal share.' because cloud-managed remote deployments should not depend on unavailable local installation paths. The current scenario instead requires 'Collect Intune Management Extension logs and app installer exit codes before modifying detection.' and verification that logs identify the exact failing component and a corrected package succeeds on eligible devices.

This action is appropriate for a different case: A Teams Rooms device must run its supported collaboration client but the admin deploys a normal desktop Office suite installer to it. There, the targeted fix is 'Use the supported Teams Rooms app servicing and specialized device management path.' because specialty room devices can have different application deployment models. The current scenario instead requires 'Collect Intune Management Extension logs and app installer exit codes before modifying detection.' and verification that logs identify the exact failing component and a corrected package succeeds on eligible devices.

This action is appropriate for a different case: A company wants a semiannual Microsoft 365 Apps channel but devices keep updating from a different channel. There, the targeted fix is 'Set the correct Microsoft 365 Apps update channel through approved app management policy.' because Office update channel is separate from Windows feature update version. The current scenario instead requires 'Collect Intune Management Extension logs and app installer exit codes before modifying detection.' and verification that logs identify the exact failing component and a corrected package succeeds on eligible devices.

This action is appropriate for a different case: A long-offline laptop rejoins and receives many updates at once, creating avoidable branch congestion. There, the targeted fix is 'Use supported update deadlines, Delivery Optimization and staged release policies for returning devices.' because catch-up servicing should respect bandwidth and security targets. The current scenario instead requires 'Review Windows update deployment and per-device installation reports, including pending restart state.' and verification that the pilot's report matches installed build and documents its restart status.

This action is appropriate for a different case: A macOS fleet reports inconsistent patch status because the management reporting sync hasn't completed after update. There, the targeted fix is 'Check device check-in, update reporting lag and local OS version before declaring failure.' because update installation and service reporting can differ in timing. The current scenario instead requires 'Review Windows update deployment and per-device installation reports, including pending restart state.' and verification that the pilot's report matches installed build and documents its restart status.

This action is appropriate for a different case: An iPhone fleet needs supervised operating-system updates with deferred installation schedules and the administrator uses a Windows update ring. There, the targeted fix is 'Configure supported iOS/iPadOS update settings using Intune Settings Catalog or Apple update management controls.' because Apple software update mechanisms differ from Windows Update for Business. The current scenario instead requires 'Review Windows update deployment and per-device installation reports, including pending restart state.' and verification that the pilot's report matches installed build and documents its restart status.

This observation would validate a different case: A device is marked registered but the organization requires joined identity for a Windows security baseline deployment. It would check 'The rebuilt test device reports the intended join type before the baseline is assigned.' after 'Transition the eligible Windows endpoint to the appropriate Microsoft Entra joined provisioning path.'. It does not establish success for the stated scenario; the needed evidence is 'The next enrolled test laptop records corporate ownership and receives only the intended policies.'.

This observation would validate a different case: A contractor loses the company laptop and IT must prevent continued device-based cloud access without deleting the contractor's unrelated personal account. It would check 'The missing laptop no longer satisfies device access policy while permitted personal account workflows remain.' after 'Disable the compromised Entra device object and revoke relevant sessions according to incident policy.'. It does not establish success for the stated scenario; the needed evidence is 'The next enrolled test laptop records corporate ownership and receives only the intended policies.'.

This observation would validate a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. It would check 'The device registers for work access without appearing as a fully corporate-managed endpoint.' after 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.'. It does not establish success for the stated scenario; the needed evidence is 'The next enrolled test laptop records corporate ownership and receives only the intended policies.'.

This observation would validate a different case: A help desk needs a newly assigned Windows compliance policy to take effect without waiting for normal device check-in. It would check 'The device checks in and reports its updated compliance state.' after 'Issue a supported Intune Sync remote action and verify policy evaluation.'. It does not establish success for the stated scenario; the needed evidence is 'The old key no longer unlocks after successful rotation and the new escrowed key is accessible to authorized staff.'.

This observation would validate a different case: An Intune device record shows 'retire pending' yet security operations claims corporate data has been removed from an offline phone. It would check 'A test report tracks pending and completed states separately with last contact time.' after 'Distinguish queued retirement from confirmed device-side completion.'. It does not establish success for the stated scenario; the needed evidence is 'The old key no longer unlocks after successful rotation and the new escrowed key is accessible to authorized staff.'.

This observation would validate a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. It would check 'The intended cohort restarts and unaffected device records show no remote action.' after 'Use supported Intune bulk remote action with carefully verified group/device selection.'. It does not establish success for the stated scenario; the needed evidence is 'The old key no longer unlocks after successful rotation and the new escrowed key is accessible to authorized staff.'.

This observation would validate a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. It would check 'A targeted Windows device installs the accounting app silently and Intune reports success.' after 'Package it as a supported Intune Win32 app and configure the required install command.'. It does not establish success for the stated scenario; the needed evidence is 'The room console receives the approved client version without unsupported Office installation.'.

This observation would validate a different case: A Microsoft Store application has been delisted and a policy still targets its unavailable listing. It would check 'The replacement app package installs on pilot endpoints and no stale Store reference remains.' after 'Check current Store availability and switch to a supported enterprise packaging source if licensed.'. It does not establish success for the stated scenario; the needed evidence is 'The room console receives the approved client version without unsupported Office installation.'.

This observation would validate a different case: A network team needs to deploy Microsoft 365 Apps during Autopilot without downloading every language package during setup. It would check 'The pilot receives only the selected applications and languages.' after 'Use a tailored Office Deployment Tool configuration or Intune suite profile for required components.'. It does not establish success for the stated scenario; the needed evidence is 'The room console receives the approved client version without unsupported Office installation.'.

This action is appropriate for a different case: An administrator wants to restrict a sensitive app to devices that are company-managed and mistakenly assumes Entra join guarantees security compliance. There, the targeted fix is 'Combine appropriate managed device identity with evaluated Intune compliance and Conditional Access requirements.' because identity ownership and actual security posture are separate trust signals. The current scenario instead requires 'Plan Microsoft Entra hybrid join with synchronized identity and valid domain connectivity.' and verification that the Windows device reports both domain join and hybrid Entra registration after synchronization.

This action is appropriate for a different case: An acquired company has devices in a different Microsoft Entra tenant and plans to enroll them directly into the new tenant without transitioning ownership. There, the targeted fix is 'Design a supported device identity and enrollment migration including unjoin, re-registration, and data preservation steps.' because an enrolled device is tied to its source tenant and cannot be reassigned by display-name change. The current scenario instead requires 'Plan Microsoft Entra hybrid join with synchronized identity and valid domain connectivity.' and verification that the Windows device reports both domain join and hybrid Entra registration after synchronization.

This action is appropriate for a different case: A help desk sees an Entra join error on Windows after the user's account is disabled but assumes the network firewall is the problem. There, the targeted fix is 'Verify identity/account eligibility and sign-in diagnostics before changing firewall rules.' because join requires a permitted working identity as well as network connectivity. The current scenario instead requires 'Plan Microsoft Entra hybrid join with synchronized identity and valid domain connectivity.' and verification that the Windows device reports both domain join and hybrid Entra registration after synchronization.

This action is appropriate for a different case: A Change Review Agent recommends approving a proposed Intune policy that would affect a high-risk executive device group. There, the targeted fix is 'Inspect the multi-admin approval request and agent impact findings before approving.' because approval accountability remains with authorized human administrators. The current scenario instead requires 'Resolve and validate unique Intune managedDevice IDs before mutation calls.' and verification that a dry run reports exact intended IDs and no unrelated records are removed.

This action is appropriate for a different case: A Policy Configuration Agent proposes settings from a natural-language security standard without identifying policy conflicts. There, the targeted fix is 'Review proposed settings and existing Intune assignments before creating the new configuration.' because generated policy recommendations should be assessed for platform support and conflict. The current scenario instead requires 'Resolve and validate unique Intune managedDevice IDs before mutation calls.' and verification that a dry run reports exact intended IDs and no unrelated records are removed.

This action is appropriate for a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. There, the targeted fix is 'Return the supported JSON schema without extra stdout content and validate the rules file.' because machine-readable output format is part of the custom compliance contract. The current scenario instead requires 'Resolve and validate unique Intune managedDevice IDs before mutation calls.' and verification that a dry run reports exact intended IDs and no unrelated records are removed.

This observation would validate a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. It would check 'The portal separately shows the imported serial and its later enrolled management record.' after 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.'. It does not establish success for the stated scenario; the needed evidence is 'Supported Android builds enroll and explicitly unsupported builds receive a governed rejection.'.

This observation would validate a different case: Company-owned Android tablets must run only a warehouse scanning application with no employee user account. It would check 'A freshly reset tablet enrolls into kiosk mode and exposes only approved applications.' after 'Configure Android Enterprise dedicated-device enrollment and a supported kiosk profile.'. It does not establish success for the stated scenario; the needed evidence is 'Supported Android builds enroll and explicitly unsupported builds receive a governed rejection.'.

This observation would validate a different case: A pilot group should enroll Windows devices automatically while the rest of the tenant remains on an older management platform. It would check 'Pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.' after 'Limit automatic MDM enrollment scope to the approved pilot users.'. It does not establish success for the stated scenario; the needed evidence is 'Supported Android builds enroll and explicitly unsupported builds receive a governed rejection.'.

This action is appropriate for a different case: A company uses Remote Help for employee laptops but wants sessions visible in audit logs without recording private chat content unnecessarily. There, the targeted fix is 'Configure governed Remote Help logging and retention consistent with privacy policies.' because remote assistance accountability should not create indiscriminate data collection. The current scenario instead requires 'Inspect EPM elevation conditions and limit administrative process scope to approved applications.' and verification that the approved utility works and unrelated command execution does not gain admin rights.

This action is appropriate for a different case: A managed catalog app requires a vendor-specific detection update after an upstream app build changes its install path. There, the targeted fix is 'Update the Enterprise App Catalog app assignment or detection configuration using supported lifecycle procedures.' because catalog availability doesn't remove the need to verify installed state. The current scenario instead requires 'Inspect EPM elevation conditions and limit administrative process scope to approved applications.' and verification that the approved utility works and unrelated command execution does not gain admin rights.

This action is appropriate for a different case: A help desk needs remote interactive assistance for users but employees should be able to grant consent to support sessions. There, the targeted fix is 'Configure Microsoft Intune Remote Help with approved roles, tenant configuration and consent behavior.' because remote assistance should be governed and attributable to authorized support staff. The current scenario instead requires 'Inspect EPM elevation conditions and limit administrative process scope to approved applications.' and verification that the approved utility works and unrelated command execution does not gain admin rights.

This observation would validate a different case: An app catalog entry becomes available to the wrong security group and contractors download a licensed finance tool. It would check 'The finance test user can install the tool and contractor accounts cannot see it.' after 'Correct required/available assignment and group exclusions to enforce app entitlement.'. It does not establish success for the stated scenario; the needed evidence is 'A missing application fails detection and a correctly installed test app reports installed.'.

This observation would validate a different case: A mobile app installed on an iPad is removed by users despite being required for device compliance tasks. It would check 'The supervised test iPad retains the required app after sync and the policy reports success.' after 'Use appropriate required app assignment and supervised device restrictions where supported.'. It does not establish success for the stated scenario; the needed evidence is 'A missing application fails detection and a correctly installed test app reports installed.'.

This observation would validate a different case: An Intune app deployment succeeds in the device report, but the user cannot launch it because a required license assignment is missing. It would check 'A licensed pilot user launches the app and an unlicensed test gets a controlled denial.' after 'Verify application licensing and assigned user entitlement after confirming installation.'. It does not establish success for the stated scenario; the needed evidence is 'A missing application fails detection and a correctly installed test app reports installed.'.