Exam Bundle

This observation would validate a different case: A Graph automation exceeds Intune service request limits and receives HTTP 429 responses. It would check 'A test workload recovers after throttling within the approved retry budget.' after 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.'. It does not establish success for the stated scenario; the needed evidence is 'The approved fix resolves legitimate access without admitting noncompliant test endpoints.'.

This observation would validate a different case: A Graph call returns a transient 503 response and the workflow marks the entire tenant inventory as empty. It would check 'A transient simulated failure is reported or recovered without returning false zero devices.' after 'Distinguish transport errors from valid empty results and retry within a bounded policy.'. It does not establish success for the stated scenario; the needed evidence is 'The approved fix resolves legitimate access without admitting noncompliant test endpoints.'.

This observation would validate a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. It would check 'The pilot returns a parseable evaluation and its compliance state matches test conditions.' after 'Return the supported JSON schema without extra stdout content and validate the rules file.'. It does not establish success for the stated scenario; the needed evidence is 'The approved fix resolves legitimate access without admitting noncompliant test endpoints.'.

This action is appropriate for a different case: A device receives the wrong Wi-Fi profile because its enrollment-time platform group membership has not been evaluated yet. There, the targeted fix is 'Plan enrollment-time grouping and assignment precedence for critical first-login configurations.' because enrollment assignments may need target resolution before full inventory processing. The current scenario instead requires 'Manage required settings through the authoritative Intune configuration policy instead of permanent local exceptions.' and verification that the approved firewall rule remains effective after subsequent Intune sync.

This action is appropriate for a different case: A device configuration profile is changed but its rollout has no staged group, causing an immediate company-wide restriction. There, the targeted fix is 'Apply controlled phased assignments and monitored pilot rings for Intune settings.' because ring-based deployment reduces the scope of configuration defects. The current scenario instead requires 'Manage required settings through the authoritative Intune configuration policy instead of permanent local exceptions.' and verification that the approved firewall rule remains effective after subsequent Intune sync.

This action is appropriate for a different case: Windows accessibility settings must stay usable, but a security configuration profile unintentionally disables all assistive technology. There, the targeted fix is 'Adjust only the conflicting setting within a scoped policy after accessibility testing.' because accessibility requirements should not be overridden by broad unvalidated restrictions. The current scenario instead requires 'Manage required settings through the authoritative Intune configuration policy instead of permanent local exceptions.' and verification that the approved firewall rule remains effective after subsequent Intune sync.

This action is appropriate for a different case: A PowerShell cleanup script mistakenly removes device records because it matches display name instead of a stable managed device identifier. There, the targeted fix is 'Resolve and validate unique Intune managedDevice IDs before mutation calls.' because device names can collide, making them unsafe destructive keys. The current scenario instead requires 'Review the Device Offboarding Agent evidence and require authorized admin approval before changes.' and verification that the admin confirms affected IDs and only approved stale devices are offboarded.

This action is appropriate for a different case: An automated Intune offboarding script uses Graph permissions that also allow managing unrelated Microsoft 365 users. There, the targeted fix is 'Reduce the automation identity's effective Graph scopes and target only approved device APIs.' because least privilege should constrain both permission and resource selection. The current scenario instead requires 'Review the Device Offboarding Agent evidence and require authorized admin approval before changes.' and verification that the admin confirms affected IDs and only approved stale devices are offboarded.

This action is appropriate for a different case: A Policy Configuration Agent proposes settings from a natural-language security standard without identifying policy conflicts. There, the targeted fix is 'Review proposed settings and existing Intune assignments before creating the new configuration.' because generated policy recommendations should be assessed for platform support and conflict. The current scenario instead requires 'Review the Device Offboarding Agent evidence and require authorized admin approval before changes.' and verification that the admin confirms affected IDs and only approved stale devices are offboarded.

This observation would validate a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. It would check 'Work content pastes into an approved work app but not an unprotected personal app.' after 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.'. It does not establish success for the stated scenario; the needed evidence is 'A test app locks out after the defined offline interval.'.

This observation would validate a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. It would check 'The app gets its intended work URL while the personal device remains unenrolled.' after 'Configure the correct managed-app configuration policy for the targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'A test app locks out after the defined offline interval.'.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'A test app locks out after the defined offline interval.'.

This action is appropriate for a different case: A laptop must arrive ready for an employee after technicians install time-consuming core apps in the warehouse before shipment. There, the targeted fix is 'Choose Windows Autopilot pre-provisioning with a technician phase and an appropriate user phase.' because pre-provisioning separates technician-side device readiness from later user personalization. The current scenario instead requires 'Use the supported Cloud PC reprovisioning lifecycle only after confirming expected data impact.' and verification that a nonproduction reprovision creates the intended fresh image with documented user-data handling.

This action is appropriate for a different case: The service desk attempts to pre-provision a Windows device with unsupported TPM attestation and receives a provisioning error. There, the targeted fix is 'Verify TPM and Autopilot pre-provisioning eligibility before retrying or selecting another mode.' because supported TPM attestation requirements vary by Autopilot deployment mode. The current scenario instead requires 'Use the supported Cloud PC reprovisioning lifecycle only after confirming expected data impact.' and verification that a nonproduction reprovision creates the intended fresh image with documented user-data handling.

This action is appropriate for a different case: A company-owned Windows kiosk should provision without any individual user signing in during out-of-box experience. There, the targeted fix is 'Use a supported Windows Autopilot self-deploying profile on eligible hardware.' because self-deploying mode is designed for userless organization-owned devices with suitable TPM attestation. The current scenario instead requires 'Use the supported Cloud PC reprovisioning lifecycle only after confirming expected data impact.' and verification that a nonproduction reprovision creates the intended fresh image with documented user-data handling.

This action is appropriate for a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. There, the targeted fix is 'Create an Intune app configuration policy using supported managed app configuration settings.' because app configuration can deliver managed settings through a governed assignment. The current scenario instead requires 'Use platform-specific app protection policies with precise assignment scopes.' and verification that Android targets receive the rule and unrelated iOS users are unaffected.

This action is appropriate for a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. There, the targeted fix is 'Configure the correct managed-app configuration policy for the targeted identity.' because app configuration for managed apps differs from device-wide iOS configuration. The current scenario instead requires 'Use platform-specific app protection policies with precise assignment scopes.' and verification that Android targets receive the rule and unrelated iOS users are unaffected.

This action is appropriate for a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. There, the targeted fix is 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.' because identity grants can restrict access to clients enforcing enterprise app data controls. The current scenario instead requires 'Use platform-specific app protection policies with precise assignment scopes.' and verification that Android targets receive the rule and unrelated iOS users are unaffected.

This observation would validate a different case: An Intune report contains sensitive employee device details and should be shared with executives who need only risk totals. It would check 'Executives see accurate fleet trends without individual employee identifiers.' after 'Aggregate or redact user-level data and apply report access restrictions.'. It does not establish success for the stated scenario; the needed evidence is 'The detection identifies a failed test condition and remediation restores expected state.'.

This observation would validate a different case: A fleet health score decreases but leadership cannot tell whether app reliability or startup performance was responsible. It would check 'The report identifies which metric and cohort account for the observed decline.' after 'Decompose Endpoint Analytics scores by dimension and inspect corresponding device groups.'. It does not establish success for the stated scenario; the needed evidence is 'The detection identifies a failed test condition and remediation restores expected state.'.

This observation would validate a different case: An admin dashboard shows compliance percentages but hides the tenant's oldest policy evaluation timestamp. It would check 'Each sample device shows its latest status and actual last evaluation time.' after 'Expose freshness and evaluation-time metadata in monitoring reports.'. It does not establish success for the stated scenario; the needed evidence is 'The detection identifies a failed test condition and remediation restores expected state.'.

This action is appropriate for a different case: A macOS fleet reports inconsistent patch status because the management reporting sync hasn't completed after update. There, the targeted fix is 'Check device check-in, update reporting lag and local OS version before declaring failure.' because update installation and service reporting can differ in timing. The current scenario instead requires 'Check hotpatch eligibility, supported OS/architecture and necessary baseline state before enabling policy.' and verification that an eligible pilot receives hotpatch while an ineligible PC takes the normal cumulative update path.

This action is appropriate for a different case: The security team notices Windows 365 Cloud PCs receive updates far later than physical laptops. There, the targeted fix is 'Check Cloud PC update policy assignment and Windows Autopatch/Intune targeting.' because Cloud PCs are managed endpoints whose update policy must be explicitly effective. The current scenario instead requires 'Check hotpatch eligibility, supported OS/architecture and necessary baseline state before enabling policy.' and verification that an eligible pilot receives hotpatch while an ineligible PC takes the normal cumulative update path.

This action is appropriate for a different case: An administrator wants to expedite one critical Windows quality patch but leave routine rollout rings unchanged. There, the targeted fix is 'Use an eligible expedited quality update policy with targeted monitoring.' because emergency quality updates can be accelerated without replacing general ring strategy. The current scenario instead requires 'Check hotpatch eligibility, supported OS/architecture and necessary baseline state before enabling policy.' and verification that an eligible pilot receives hotpatch while an ineligible PC takes the normal cumulative update path.

This action is appropriate for a different case: Two Intune device configuration policies assign incompatible firewall settings, and the admin mistakenly blames device noncompliance. There, the targeted fix is 'Inspect Intune policy conflict and setting-level status before rewriting the compliance rules.' because configuration conflicts are distinct from compliance assessment failures. The current scenario instead requires 'Use report-only testing and documented emergency-access exclusions before policy enforcement.' and verification that test logs show intended blocks while approved emergency access remains available.

This action is appropriate for a different case: A compliance check requires BitLocker but a freshly enrolled Windows device has not finished encryption. There, the targeted fix is 'Configure appropriate grace period and evaluate encryption deployment state before enforcing device access.' because a compliance deadline should account for permitted remediation timing. The current scenario instead requires 'Use report-only testing and documented emergency-access exclusions before policy enforcement.' and verification that test logs show intended blocks while approved emergency access remains available.

This action is appropriate for a different case: An Intune compliance policy for Android expects a Windows-only setting and shows unknown evaluations. There, the targeted fix is 'Assign platform-specific compliance settings only to supported operating systems.' because compliance criteria are not interchangeable across device platforms. The current scenario instead requires 'Use report-only testing and documented emergency-access exclusions before policy enforcement.' and verification that test logs show intended blocks while approved emergency access remains available.

This observation would validate a different case: An application installer returns a vendor-specific exit code meaning reboot required, and Intune incorrectly marks the deployment as failed. It would check 'The test deployment records required reboot and succeeds after restart when appropriate.' after 'Configure the supported Win32 app return-code and restart behavior appropriately.'. It does not establish success for the stated scenario; the needed evidence is 'Outlook shows the required security option and OS updates follow their existing ring.'.

This observation would validate a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. It would check 'The test user receives their licensed settings after the machine install.' after 'Separate machine installation from appropriate user-specific license or configuration deployment.'. It does not establish success for the stated scenario; the needed evidence is 'Outlook shows the required security option and OS updates follow their existing ring.'.

This observation would validate a different case: A user opens Company Portal but does not see the approved optional line-of-business app because it was assigned to a device group as Required only. It would check 'An eligible pilot user can locate and install the optional app.' after 'Create a correct Available assignment to the eligible user population.'. It does not establish success for the stated scenario; the needed evidence is 'Outlook shows the required security option and OS updates follow their existing ring.'.

This observation would validate a different case: An Intune report contains sensitive employee device details and should be shared with executives who need only risk totals. It would check 'Executives see accurate fleet trends without individual employee identifiers.' after 'Aggregate or redact user-level data and apply report access restrictions.'. It does not establish success for the stated scenario; the needed evidence is 'Two consecutive pilot runs converge on the desired state without losing files.'.

This observation would validate a different case: Application startup performance degrades after a new security agent version and teams argue using anecdotal complaints. It would check 'The score change is measured on comparable hardware and reversed after a pilot fix.' after 'Compare Endpoint Analytics app startup telemetry before and after the agent release.'. It does not establish success for the stated scenario; the needed evidence is 'Two consecutive pilot runs converge on the desired state without losing files.'.

This observation would validate a different case: A report claims 100% compliance because it excludes devices that have not checked in for 30 days. It would check 'The report explicitly identifies stale devices and does not count them as confirmed compliant.' after 'Include stale-device and missing-data treatment in compliance reporting definitions.'. It does not establish success for the stated scenario; the needed evidence is 'Two consecutive pilot runs converge on the desired state without losing files.'.