Exam Bundle

This action is appropriate for a different case: A laptop must arrive ready for an employee after technicians install time-consuming core apps in the warehouse before shipment. There, the targeted fix is 'Choose Windows Autopilot pre-provisioning with a technician phase and an appropriate user phase.' because pre-provisioning separates technician-side device readiness from later user personalization. The current scenario instead requires 'Use the supported Windows 365 Cloud PC resize process with entitlement and user-data safeguards.' and verification that after resize the Cloud PC reports the intended capacity and retains approved work data.

This action is appropriate for a different case: A Windows Backup restore is offered during new Windows device setup but organizational policy forbids unmanaged personal restore sources. There, the targeted fix is 'Configure Windows Backup and restore policy with approved organizational device settings.' because enterprise restore behavior should be controlled at enrollment and data-governance boundaries. The current scenario instead requires 'Use the supported Windows 365 Cloud PC resize process with entitlement and user-data safeguards.' and verification that after resize the Cloud PC reports the intended capacity and retains approved work data.

This action is appropriate for a different case: An organization wants to pin devices to a specific Windows 11 release while allowing security quality updates. There, the targeted fix is 'Create an Intune Windows feature update policy targeting the required supported version.' because feature update version targeting is distinct from monthly quality update cadence. The current scenario instead requires 'Use the supported Windows 365 Cloud PC resize process with entitlement and user-data safeguards.' and verification that after resize the Cloud PC reports the intended capacity and retains approved work data.

This observation would validate a different case: A user requests a local antivirus exception for a downloaded installer without validating its publisher or hash. It would check 'The approved signed installer runs without a general exclusions directory.' after 'Verify software provenance and route any exclusion request through approved security policy.'. It does not establish success for the stated scenario; the needed evidence is 'A test machine shows the expected security provider mode without incompatible dual scanning.'.

This observation would validate a different case: A security baseline uses an older configuration and the team wants to adopt a new recommended baseline version without breaking specialized apps. It would check 'A test group meets the new settings without loss of required business application behavior.' after 'Compare baseline versions and pilot the updated policy with compatibility tests.'. It does not establish success for the stated scenario; the needed evidence is 'A test machine shows the expected security provider mode without incompatible dual scanning.'.

This observation would validate a different case: An admin wants to enforce App Control on all endpoints at once without understanding what legitimate binaries would be blocked. It would check 'The reviewed audit log shows impacted signed apps and the staged block policy works.' after 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'A test machine shows the expected security provider mode without incompatible dual scanning.'.

This observation would validate a different case: The Intune message center announces a change to a management service and the help desk wants to assess business impact. It would check 'An impact record identifies affected device groups and remediation owners for the announced change.' after 'Track service notifications against affected endpoint platforms, dependencies and owned runbooks.'. It does not establish success for the stated scenario; the needed evidence is 'The incident is recorded as provider-side and new enrollment succeeds after recovery.'.

This observation would validate a different case: A tenant has four months of Intune compliance history but executives want trend reporting without manually copying screenshots. It would check 'A dashboard reproduces month-over-month compliant counts from recorded source exports.' after 'Use Intune reporting exports or supported Graph reporting endpoints and create a governed dashboard.'. It does not establish success for the stated scenario; the needed evidence is 'The incident is recorded as provider-side and new enrollment succeeds after recovery.'.

This observation would validate a different case: A company must track enrollment failures by platform and technician across branches to find a repeating setup problem. It would check 'A sample export groups failures accurately by OS and enrollment profile.' after 'Create scoped enrollment failure reports with platform, profile and error details.'. It does not establish success for the stated scenario; the needed evidence is 'The incident is recorded as provider-side and new enrollment succeeds after recovery.'.

This observation would validate a different case: An Entra device registration does not show as compliant even though the user successfully authenticated to Microsoft 365. It would check 'The portal shows registration separately from management and compliance state after enrollment.' after 'Distinguish device identity registration from Intune enrollment and compliance policy evaluation.'. It does not establish success for the stated scenario; the needed evidence is 'An inventory check classifies sampled devices accurately despite arbitrary renamed devices.'.

This observation would validate a different case: A technician attempts to Entra join company devices using an account that is not permitted to join additional devices. It would check 'A designated enrollment account joins an allowed device and an unauthorized account remains blocked.' after 'Review Entra device-join permissions and per-user device limits before repeating enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'An inventory check classifies sampled devices accurately despite arbitrary renamed devices.'.

This observation would validate a different case: A contractor loses the company laptop and IT must prevent continued device-based cloud access without deleting the contractor's unrelated personal account. It would check 'The missing laptop no longer satisfies device access policy while permitted personal account workflows remain.' after 'Disable the compromised Entra device object and revoke relevant sessions according to incident policy.'. It does not establish success for the stated scenario; the needed evidence is 'An inventory check classifies sampled devices accurately despite arbitrary renamed devices.'.

This observation would validate a different case: An enterprise uses Mobile Application Management on unenrolled phones and needs protected access to private web apps. It would check 'A protected app accesses its allowed internal endpoint while other personal apps cannot use the tunnel.' after 'Evaluate Microsoft Tunnel for MAM with the required gateway, app policy and tenant prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'The contractor can assist the approved device but cannot start an unauthorized session.'.

This observation would validate a different case: An enterprise needs to deploy a commonly used third-party Windows app and does not want to maintain every vendor installer version manually. It would check 'A pilot app installs from the catalog and updates to an approved newer release.' after 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.'. It does not establish success for the stated scenario; the needed evidence is 'The contractor can assist the approved device but cannot start an unauthorized session.'.

This observation would validate a different case: A Tunnel for MAM deployment sends unrelated personal device traffic into the corporate network instead of only the approved managed app. It would check 'Only the approved corporate app's requests traverse the tunnel during a controlled test.' after 'Constrain tunnel configuration and application policy to permitted work-app traffic.'. It does not establish success for the stated scenario; the needed evidence is 'The contractor can assist the approved device but cannot start an unauthorized session.'.

This action is appropriate for a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. There, the targeted fix is 'Use Group Policy analytics to import and assess supported settings migration paths.' because analytics identifies candidate cloud-manageable settings before recreating GPOs. The current scenario instead requires 'Use a supported Android Enterprise dedicated-device restriction profile and approved kiosk configuration.' and verification that the test scanner accesses its business app but not blocked system settings.

This action is appropriate for a different case: An iOS configuration update is queued but employees report it has not arrived despite healthy device enrollment. There, the targeted fix is 'Inspect profile assignment, latest device check-in and pending policy sync status.' because an enrolled device may be offline or awaiting policy processing. The current scenario instead requires 'Use a supported Android Enterprise dedicated-device restriction profile and approved kiosk configuration.' and verification that the test scanner accesses its business app but not blocked system settings.

This action is appropriate for a different case: A Windows configuration profile shows 'conflict' for password length because two profiles target the same device with different values. There, the targeted fix is 'Inspect per-setting status and revise overlapping profile assignments or definitions.' because conflicting targeted settings do not become resolved by changing the device name. The current scenario instead requires 'Use a supported Android Enterprise dedicated-device restriction profile and approved kiosk configuration.' and verification that the test scanner accesses its business app but not blocked system settings.

This observation would validate a different case: A help desk sees an Entra join error on Windows after the user's account is disabled but assumes the network firewall is the problem. It would check 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.' after 'Verify identity/account eligibility and sign-in diagnostics before changing firewall rules.'. It does not establish success for the stated scenario; the needed evidence is 'A new laptop shows Entra joined ownership and its permitted user signs in with organization credentials.'.

This observation would validate a different case: An endpoint team targets a deployment to 'all Windows devices' but includes personal and organization-owned machines with different requirements. It would check 'Group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.' after 'Refine Entra dynamic membership criteria using trusted ownership and platform attributes.'. It does not establish success for the stated scenario; the needed evidence is 'A new laptop shows Entra joined ownership and its permitted user signs in with organization credentials.'.

This observation would validate a different case: An acquired company has devices in a different Microsoft Entra tenant and plans to enroll them directly into the new tenant without transitioning ownership. It would check 'A pilot device transitions under an approved plan with its new tenant record and user data intact.' after 'Design a supported device identity and enrollment migration including unjoin, re-registration, and data preservation steps.'. It does not establish success for the stated scenario; the needed evidence is 'A new laptop shows Entra joined ownership and its permitted user signs in with organization credentials.'.

This observation would validate a different case: An enrollment error appears during iPad provisioning immediately after the Apple enrollment token was refreshed, but the profile assignment is missing. It would check 'The iPad receives its intended company enrollment profile during a clean setup.' after 'Check the token synchronization and automated enrollment profile mapping for the actual device.'. It does not establish success for the stated scenario; the needed evidence is 'The next supported enrollment attempt succeeds without an unlicensed bypass.'.

This observation would validate a different case: A device enrolls but its compliance policy never arrives because it is placed in an unexpectedly excluded dynamic group. It would check 'A corrected pilot membership receives compliance policies without enrolling again.' after 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'The next supported enrollment attempt succeeds without an unlicensed bypass.'.

This observation would validate a different case: A Samsung fleet arrives with Knox Mobile Enrollment identifiers but devices are not assigned to the corporate MDM profile. It would check 'A registered Samsung handset automatically enters managed enrollment on first boot.' after 'Configure Samsung Knox Mobile Enrollment with the correct Intune profile and approved device assignments.'. It does not establish success for the stated scenario; the needed evidence is 'The next supported enrollment attempt succeeds without an unlicensed bypass.'.

This action is appropriate for a different case: A company wants managed iOS and Android apps to receive a company tenant identifier without requiring users to type it every launch. There, the targeted fix is 'Use supported app configuration policies for managed apps or devices according to enrollment.' because managed configuration delivers controlled parameters without hardcoded user instructions. The current scenario instead requires 'Check which organizational identity and supported app instance is receiving the policy.' and verification that switching to the targeted work account activates the intended data protection controls.

This action is appropriate for a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. There, the targeted fix is 'Create an Intune app configuration policy using supported managed app configuration settings.' because app configuration can deliver managed settings through a governed assignment. The current scenario instead requires 'Check which organizational identity and supported app instance is receiving the policy.' and verification that switching to the targeted work account activates the intended data protection controls.

This action is appropriate for a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. There, the targeted fix is 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.' because identity grants can restrict access to clients enforcing enterprise app data controls. The current scenario instead requires 'Check which organizational identity and supported app instance is receiving the policy.' and verification that switching to the targeted work account activates the intended data protection controls.

This action is appropriate for a different case: A company wants a semiannual Microsoft 365 Apps channel but devices keep updating from a different channel. There, the targeted fix is 'Set the correct Microsoft 365 Apps update channel through approved app management policy.' because Office update channel is separate from Windows feature update version. The current scenario instead requires 'Approve/sync the app in Managed Google Play and check connector status.' and verification that the selected Android app becomes assignable in Intune and installs on a pilot.

This action is appropriate for a different case: An internal line-of-business Windows app uses an MSI package and needs quiet installation across managed PCs. There, the targeted fix is 'Deploy the application using the appropriate Intune LOB/Win32 app packaging approach.' because install format and management needs determine the supported deployment method. The current scenario instead requires 'Approve/sync the app in Managed Google Play and check connector status.' and verification that the selected Android app becomes assignable in Intune and installs on a pilot.

This action is appropriate for a different case: Apple Business Manager's Apps and Books token expires and new app assignments stop synchronizing. There, the targeted fix is 'Renew the managed Apps and Books location token and verify license sync.' because volume-purchased app distribution depends on a valid token relationship. The current scenario instead requires 'Approve/sync the app in Managed Google Play and check connector status.' and verification that the selected Android app becomes assignable in Intune and installs on a pilot.

This observation would validate a different case: The service desk attempts to pre-provision a Windows device with unsupported TPM attestation and receives a provisioning error. It would check 'An eligible test device completes the technician phase and the ineligible device is identified.' after 'Verify TPM and Autopilot pre-provisioning eligibility before retrying or selecting another mode.'. It does not establish success for the stated scenario; the needed evidence is 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.'.

This observation would validate a different case: An Enrollment Status Page shows 'setup complete' before a required security application is installed on Windows devices. It would check 'The device does not complete gated setup until the designated security app succeeds.' after 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.'.

This observation would validate a different case: An admin needs to deploy Cloud PCs to a different network without changing production provisioning policies for every existing user. It would check 'The pilot Cloud PCs use the new approved network while existing users remain on their prior policy.' after 'Create a tested dedicated Windows 365 provisioning policy for the new group and network.'. It does not establish success for the stated scenario; the needed evidence is 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.'.