Exam Bundle

This action is appropriate for a different case: A company wants one kiosk policy for Teams Rooms and Android scanners and finds platform targeting failures. There, the targeted fix is 'Create separate specialty-device configuration profiles aligned to each platform.' because specialized endpoint capabilities cannot be assumed interchangeable. The current scenario instead requires 'Configure the required trust and identity certificate payloads through supported management profiles.' and verification that a Mac connects without an untrusted certificate warning under approved policy.

This action is appropriate for a different case: A Teams Rooms device should receive meeting-room configuration without a user signing into Company Portal. There, the targeted fix is 'Use supported Teams Rooms specialized-device enrollment and configuration targeting.' because room equipment often has different setup and shared-use requirements from personal PCs. The current scenario instead requires 'Configure the required trust and identity certificate payloads through supported management profiles.' and verification that a Mac connects without an untrusted certificate warning under approved policy.

This action is appropriate for a different case: Two Android departments share a device group, but only warehouse devices should receive a barcode-scanning restriction. There, the targeted fix is 'Split assignments using trusted device attributes and supported filters or group membership.' because broad assignments can apply vendor-specific controls to the wrong devices. The current scenario instead requires 'Configure the required trust and identity certificate payloads through supported management profiles.' and verification that a Mac connects without an untrusted certificate warning under approved policy.

This observation would validate a different case: A line-of-business app uses a dependency installer that requires a reboot before the main install can work. It would check 'The pilot installation sequences the restart safely and later installs the main app.' after 'Configure appropriate Intune dependency and restart handling for both packages.'. It does not establish success for the stated scenario; the needed evidence is 'The supervised test iPad retains the required app after sync and the policy reports success.'.

This observation would validate a different case: An Intune Win32 app reports 'installed' even though its executable is absent because the detection rule checks the wrong file path. It would check 'A missing application fails detection and a correctly installed test app reports installed.' after 'Correct the Win32 app detection rules to verify a reliable product file, registry key or MSI ID.'. It does not establish success for the stated scenario; the needed evidence is 'The supervised test iPad retains the required app after sync and the policy reports success.'.

This observation would validate a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. It would check 'The test user receives their licensed settings after the machine install.' after 'Separate machine installation from appropriate user-specific license or configuration deployment.'. It does not establish success for the stated scenario; the needed evidence is 'The supervised test iPad retains the required app after sync and the policy reports success.'.

This observation would validate a different case: A KQL device query is returning no rows because the administrator copied a Log Analytics table name not available in Intune device query. It would check 'A corrected query returns the expected records from a controlled device sample.' after 'Use the device query supported schema and validate KQL syntax against its data model.'. It does not establish success for the stated scenario; the needed evidence is 'The log bundle identifies the enrollment failure class for the affected device.'.

This observation would validate a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. It would check 'The intended cohort restarts and unaffected device records show no remote action.' after 'Use supported Intune bulk remote action with carefully verified group/device selection.'. It does not establish success for the stated scenario; the needed evidence is 'The log bundle identifies the enrollment failure class for the affected device.'.

This observation would validate a different case: A support agent cannot tell why a single user's two iPhones receive different configuration policies. It would check 'The resulting report shows the effective assignment and exclusion causing the difference.' after 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.'. It does not establish success for the stated scenario; the needed evidence is 'The log bundle identifies the enrollment failure class for the affected device.'.

This action is appropriate for a different case: An Intune device record shows 'retire pending' yet security operations claims corporate data has been removed from an offline phone. There, the targeted fix is 'Distinguish queued retirement from confirmed device-side completion.' because pending remote tasks are not proof that a device was altered. The current scenario instead requires 'Select Retire or selective corporate data removal where supported, not full device wipe.' and verification that corporate accounts and managed data disappear while personal photos remain.

This action is appropriate for a different case: A KQL device query is returning no rows because the administrator copied a Log Analytics table name not available in Intune device query. There, the targeted fix is 'Use the device query supported schema and validate KQL syntax against its data model.' because KQL environments have different tables and available properties. The current scenario instead requires 'Select Retire or selective corporate data removal where supported, not full device wipe.' and verification that corporate accounts and managed data disappear while personal photos remain.

This action is appropriate for a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. There, the targeted fix is 'Use the supported Intune device query with valid KQL and an appropriate scope.' because Intune device query can answer targeted state questions without collecting all device images. The current scenario instead requires 'Select Retire or selective corporate data removal where supported, not full device wipe.' and verification that corporate accounts and managed data disappear while personal photos remain.

This observation would validate a different case: A business requires separate security baseline configurations for kiosks and ordinary employee laptops. It would check 'The kiosk and laptop each receive their intended controls without cross-assignment.' after 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.'. It does not establish success for the stated scenario; the needed evidence is 'The alert has triage evidence and documented containment or false-positive disposition.'.

This observation would validate a different case: An attacker uses Office macros to launch credential theft from a managed Windows laptop. It would check 'A controlled macro-based process launch is blocked without harming approved documents.' after 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.'. It does not establish success for the stated scenario; the needed evidence is 'The alert has triage evidence and documented containment or false-positive disposition.'.

This observation would validate a different case: Windows Firewall is disabled locally by a privileged user each time the computer boots despite managed policy. It would check 'The managed firewall returns to the approved state and the override attempt is documented.' after 'Investigate effective endpoint security policy and tamper-protection or configuration drift.'. It does not establish success for the stated scenario; the needed evidence is 'The alert has triage evidence and documented containment or false-positive disposition.'.

This observation would validate a different case: An administrator assigns a corporate VPN profile to every iOS device but wants it only on devices with a supported OS version. It would check 'The eligible iOS pilot gets the VPN and the unsupported version is excluded.' after 'Use appropriate Intune assignment filters alongside group targeting.'. It does not establish success for the stated scenario; the needed evidence is 'A newly provisioned room device gets its assigned policies and is centrally visible.'.

This observation would validate a different case: An organization needs a new ADMX-backed policy in Intune that is not yet included in its ordinary settings catalog. It would check 'The policy applies to supported Windows pilot devices and reports an effective value.' after 'Import the supported ADMX definition and publish the associated configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'A newly provisioned room device gets its assigned policies and is centrally visible.'.

This observation would validate a different case: A company wants one kiosk policy for Teams Rooms and Android scanners and finds platform targeting failures. It would check 'Each test device receives only its supported policy payload.' after 'Create separate specialty-device configuration profiles aligned to each platform.'. It does not establish success for the stated scenario; the needed evidence is 'A newly provisioned room device gets its assigned policies and is centrally visible.'.

This action is appropriate for a different case: Windows enrollment fails after Autopilot because the assigned user lacks the required Intune license. There, the targeted fix is 'Assign and verify the correct eligible Intune entitlement for the affected user.' because device enrollment requires service licensing and is not fixed by policy republishing. The current scenario instead requires 'Verify Android Enterprise connector binding and Google managed Play integration health.' and verification that a test managed application synchronizes into Intune and becomes assignable.

This action is appropriate for a different case: An employee with a personal Android phone needs protected Teams access without granting IT full device wipe privileges. There, the targeted fix is 'Use Android work-profile or app-protection management appropriate for personally owned devices.' because a personal device requires a narrower management boundary than fully managed corporate enrollment. The current scenario instead requires 'Verify Android Enterprise connector binding and Google managed Play integration health.' and verification that a test managed application synchronizes into Intune and becomes assignable.

This action is appropriate for a different case: A macOS Mac enrolled through Company Portal fails to receive management after the user denies the required profile installation. There, the targeted fix is 'Guide the user through supported macOS enrollment approval and verify the management profile.' because user-approved enrollment needs a valid installed MDM profile on the Mac. The current scenario instead requires 'Verify Android Enterprise connector binding and Google managed Play integration health.' and verification that a test managed application synchronizes into Intune and becomes assignable.

This action is appropriate for a different case: A company wants a semiannual Microsoft 365 Apps channel but devices keep updating from a different channel. There, the targeted fix is 'Set the correct Microsoft 365 Apps update channel through approved app management policy.' because Office update channel is separate from Windows feature update version. The current scenario instead requires 'Correct the Win32 app detection rules to verify a reliable product file, registry key or MSI ID.' and verification that a missing application fails detection and a correctly installed test app reports installed.

This action is appropriate for a different case: An app catalog entry becomes available to the wrong security group and contractors download a licensed finance tool. There, the targeted fix is 'Correct required/available assignment and group exclusions to enforce app entitlement.' because app visibility and installation rights depend on correct user/device targeting. The current scenario instead requires 'Correct the Win32 app detection rules to verify a reliable product file, registry key or MSI ID.' and verification that a missing application fails detection and a correctly installed test app reports installed.

This action is appropriate for a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. There, the targeted fix is 'Use supported app applicability rules plus appropriate assignment filters.' because being targeted does not make an incompatible OS able to install the app. The current scenario instead requires 'Correct the Win32 app detection rules to verify a reliable product file, registry key or MSI ID.' and verification that a missing application fails detection and a correctly installed test app reports installed.

This observation would validate a different case: A tenant has four months of Intune compliance history but executives want trend reporting without manually copying screenshots. It would check 'A dashboard reproduces month-over-month compliant counts from recorded source exports.' after 'Use Intune reporting exports or supported Graph reporting endpoints and create a governed dashboard.'. It does not establish success for the stated scenario; the needed evidence is 'A stopped service triggers remediation while a healthy service reports compliant.'.

This observation would validate a different case: An operations team wants automated notifications when a previously compliant device becomes noncompliant, not weekly manual spreadsheet checks. It would check 'A controlled noncompliance transition produces one actionable notification with device context.' after 'Configure supported Intune alerts and notifications or approved report-driven monitoring for compliance drift.'. It does not establish success for the stated scenario; the needed evidence is 'A stopped service triggers remediation while a healthy service reports compliant.'.

This observation would validate a different case: A fleet health score decreases but leadership cannot tell whether app reliability or startup performance was responsible. It would check 'The report identifies which metric and cohort account for the observed decline.' after 'Decompose Endpoint Analytics scores by dimension and inspect corresponding device groups.'. It does not establish success for the stated scenario; the needed evidence is 'A stopped service triggers remediation while a healthy service reports compliant.'.

This observation would validate a different case: A company provisions Windows 365 Enterprise Cloud PCs but the chosen provisioning policy uses a network that lacks required connectivity. It would check 'A pilot Cloud PC provisions successfully and reaches approved corporate resources.' after 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.'. It does not establish success for the stated scenario; the needed evidence is 'Logs identify the failed enrollment stage and a targeted correction succeeds.'.

This observation would validate a different case: An Enrollment Status Page shows 'setup complete' before a required security application is installed on Windows devices. It would check 'The device does not complete gated setup until the designated security app succeeds.' after 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'Logs identify the failed enrollment stage and a targeted correction succeeds.'.

This observation would validate a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. It would check 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.' after 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.'. It does not establish success for the stated scenario; the needed evidence is 'Logs identify the failed enrollment stage and a targeted correction succeeds.'.

This action is appropriate for a different case: A company uses one Microsoft 365 Apps policy for every user but call-center users require a smaller set of Office applications. There, the targeted fix is 'Create role-scoped Microsoft 365 Apps deployment packages or configurations.' because different roles can require different allowed application sets. The current scenario instead requires 'Inspect application deployment and Intune Management Extension logs separately from device compliance.' and verification that the corrected path yields a successful detection while compliance state is unchanged.

This action is appropriate for a different case: A Windows Win32 app detection rule checks only a registry key that remains after uninstall, causing false positives. There, the targeted fix is 'Use a reliable detection strategy reflecting actual installed application state.' because stale registry artifacts can mislead installation reporting. The current scenario instead requires 'Inspect application deployment and Intune Management Extension logs separately from device compliance.' and verification that the corrected path yields a successful detection while compliance state is unchanged.

This action is appropriate for a different case: A user complains that an optional productivity tool installs on every corporate phone without consent. There, the targeted fix is 'Change the Intune app assignment from Required to Available where appropriate.' because required and available assignments create different deployment experiences. The current scenario instead requires 'Inspect application deployment and Intune Management Extension logs separately from device compliance.' and verification that the corrected path yields a successful detection while compliance state is unchanged.