Exam Bundle

This observation would validate a different case: The service desk attempts to pre-provision a Windows device with unsupported TPM attestation and receives a provisioning error. It would check 'An eligible test device completes the technician phase and the ineligible device is identified.' after 'Verify TPM and Autopilot pre-provisioning eligibility before retrying or selecting another mode.'. It does not establish success for the stated scenario; the needed evidence is 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.'.

This observation would validate a different case: An Enrollment Status Page shows 'setup complete' before a required security application is installed on Windows devices. It would check 'The device does not complete gated setup until the designated security app succeeds.' after 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.'.

This observation would validate a different case: An admin needs to deploy Cloud PCs to a different network without changing production provisioning policies for every existing user. It would check 'The pilot Cloud PCs use the new approved network while existing users remain on their prior policy.' after 'Create a tested dedicated Windows 365 provisioning policy for the new group and network.'. It does not establish success for the stated scenario; the needed evidence is 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.'.

This action is appropriate for a different case: A company permits personal apps on its corporate Android phones but wants firm separation of employee and enterprise data. There, the targeted fix is 'Deploy Android Enterprise corporate-owned devices with work profile (COPE) enrollment.' because cOPE separates personal space while retaining corporate device ownership and policy. The current scenario instead requires 'Use the supported enrollment token and dedicated-device configuration rather than a user-driven sign-in flow.' and verification that the device initializes in kiosk policy without requiring an employee's account credentials.

This action is appropriate for a different case: An organization requires supervised corporate iPads with no removable company management profile. There, the targeted fix is 'Integrate Apple Business Manager with Intune and apply automated device enrollment and supervision.' because automated corporate enrollment establishes device ownership and supervision capabilities. The current scenario instead requires 'Use the supported enrollment token and dedicated-device configuration rather than a user-driven sign-in flow.' and verification that the device initializes in kiosk policy without requiring an employee's account credentials.

This action is appropriate for a different case: A bring-your-own Android user accidentally enrolls the whole phone instead of a separate work profile. There, the targeted fix is 'Retire the inappropriate enrollment and re-enroll using approved personally owned work-profile setup.' because full management can exceed the organization's permitted control over employee devices. The current scenario instead requires 'Use the supported enrollment token and dedicated-device configuration rather than a user-driven sign-in flow.' and verification that the device initializes in kiosk policy without requiring an employee's account credentials.

This action is appropriate for a different case: An organization wants a simplified user-driven Windows 11 setup with a small set of key apps and scripts but no custom device imaging. There, the targeted fix is 'Choose Windows Autopilot device preparation with an appropriately assigned user-driven policy.' because device preparation has a simplified enrollment flow and limited OOBE application/script scope. The current scenario instead requires 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.' and verification that a pilot fleet reports the intended Windows 11 version and user applications remain functional.

This action is appropriate for a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. There, the targeted fix is 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.' because capacity and entitlement errors cannot be repaired by changing Windows Defender policy. The current scenario instead requires 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.' and verification that a pilot fleet reports the intended Windows 11 version and user applications remain functional.

This action is appropriate for a different case: A laptop must arrive ready for an employee after technicians install time-consuming core apps in the warehouse before shipment. There, the targeted fix is 'Choose Windows Autopilot pre-provisioning with a technician phase and an appropriate user phase.' because pre-provisioning separates technician-side device readiness from later user personalization. The current scenario instead requires 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.' and verification that a pilot fleet reports the intended Windows 11 version and user applications remain functional.

This action is appropriate for a different case: An employee with a personal Android phone needs protected Teams access without granting IT full device wipe privileges. There, the targeted fix is 'Use Android work-profile or app-protection management appropriate for personally owned devices.' because a personal device requires a narrower management boundary than fully managed corporate enrollment. The current scenario instead requires 'Set supported enrollment ownership and platform restrictions aligned with corporate enrollment policy.' and verification that corporate devices enroll and the test personal Windows endpoint is denied full device enrollment.

This action is appropriate for a different case: A user enrolls a second Windows machine and receives an Intune maximum device count failure. There, the targeted fix is 'Check enrollment device limits and approved user quota rather than deleting unrelated devices.' because a device-count restriction is different from an app deployment error. The current scenario instead requires 'Set supported enrollment ownership and platform restrictions aligned with corporate enrollment policy.' and verification that corporate devices enroll and the test personal Windows endpoint is denied full device enrollment.

This action is appropriate for a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. There, the targeted fix is 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.' because pre-registration and actual MDM enrollment are separate lifecycle stages. The current scenario instead requires 'Set supported enrollment ownership and platform restrictions aligned with corporate enrollment policy.' and verification that corporate devices enroll and the test personal Windows endpoint is denied full device enrollment.

This action is appropriate for a different case: A technician attempts to Entra join company devices using an account that is not permitted to join additional devices. There, the targeted fix is 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' because authentication alone does not override tenant device join restrictions. The current scenario instead requires 'Use the supported Entra registration or platform-supported join approach rather than assuming Windows join semantics.' and verification that the Mac obtains the expected registered identity and conditional access evaluates its applicable state.

This action is appropriate for a different case: An Entra-registered personal phone is replaced, but the old device remains in the account's list long after retirement. There, the targeted fix is 'Use a verified stale registration cleanup process respecting user and enrollment ownership.' because orphaned identities distort device inventory and risk decisions. The current scenario instead requires 'Use the supported Entra registration or platform-supported join approach rather than assuming Windows join semantics.' and verification that the Mac obtains the expected registered identity and conditional access evaluates its applicable state.

This action is appropriate for a different case: A device loses its Entra primary refresh token after a password reset and cloud application single sign-on stops functioning. There, the targeted fix is 'Inspect Entra sign-in/device diagnostics and refresh device authentication through supported steps.' because token and device identity failures should be isolated before reimaging. The current scenario instead requires 'Use the supported Entra registration or platform-supported join approach rather than assuming Windows join semantics.' and verification that the Mac obtains the expected registered identity and conditional access evaluates its applicable state.

This action is appropriate for a different case: A Tunnel for MAM deployment sends unrelated personal device traffic into the corporate network instead of only the approved managed app. There, the targeted fix is 'Constrain tunnel configuration and application policy to permitted work-app traffic.' because per-app network controls should not silently become device-wide interception. The current scenario instead requires 'Validate the recommendation on a staged group before broad policy assignment.' and verification that the pilot exhibits improved metrics before rollout to later cohorts is approved.

This action is appropriate for a different case: A managed catalog app requires a vendor-specific detection update after an upstream app build changes its install path. There, the targeted fix is 'Update the Enterprise App Catalog app assignment or detection configuration using supported lifecycle procedures.' because catalog availability doesn't remove the need to verify installed state. The current scenario instead requires 'Validate the recommendation on a staged group before broad policy assignment.' and verification that the pilot exhibits improved metrics before rollout to later cohorts is approved.

This action is appropriate for a different case: An enterprise uses Mobile Application Management on unenrolled phones and needs protected access to private web apps. There, the targeted fix is 'Evaluate Microsoft Tunnel for MAM with the required gateway, app policy and tenant prerequisites.' because app-only devices can need secure application-specific connectivity without full MDM. The current scenario instead requires 'Validate the recommendation on a staged group before broad policy assignment.' and verification that the pilot exhibits improved metrics before rollout to later cohorts is approved.

This observation would validate a different case: A help desk sees an Entra join error on Windows after the user's account is disabled but assumes the network firewall is the problem. It would check 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.' after 'Verify identity/account eligibility and sign-in diagnostics before changing firewall rules.'. It does not establish success for the stated scenario; the needed evidence is 'One active device identity remains after the stale entry is retired and no active access breaks.'.

This observation would validate a different case: A developer queries device identities through Microsoft Graph and mistakes the Entra device ID for the Intune managedDevice ID. It would check 'The query resolves to the intended physical device without accidentally acting on another inventory record.' after 'Map the appropriate identity identifiers and relationships before issuing device-specific API actions.'. It does not establish success for the stated scenario; the needed evidence is 'One active device identity remains after the stale entry is retired and no active access breaks.'.

This observation would validate a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. It would check 'The device registers for work access without appearing as a fully corporate-managed endpoint.' after 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.'. It does not establish success for the stated scenario; the needed evidence is 'One active device identity remains after the stale entry is retired and no active access breaks.'.

This observation would validate a different case: Windows clients are marked pending restart after the monthly cumulative patch, and compliance reports show older build versions. It would check 'After managed restart the pilot reports the new build and update-compliant state.' after 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.'. It does not establish success for the stated scenario; the needed evidence is 'A simulated failure stops broad rollout and the pilot follows an approved recovery sequence.'.

This observation would validate a different case: Android work-profile devices must not be interrupted by a forced OS update during a defined maintenance freeze. It would check 'A pilot defers updates during the freeze and installs after the approved period.' after 'Use supported Android system-update policies or OEM configuration suited to the ownership mode.'. It does not establish success for the stated scenario; the needed evidence is 'A simulated failure stops broad rollout and the pilot follows an approved recovery sequence.'.

This observation would validate a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. It would check 'Pilot Macs report the approved OS version after the assigned update window.' after 'Deploy supported macOS software update policy through the Intune Settings Catalog.'. It does not establish success for the stated scenario; the needed evidence is 'A simulated failure stops broad rollout and the pilot follows an approved recovery sequence.'.

This action is appropriate for a different case: A Windows Backup restore is offered during new Windows device setup but organizational policy forbids unmanaged personal restore sources. There, the targeted fix is 'Configure Windows Backup and restore policy with approved organizational device settings.' because enterprise restore behavior should be controlled at enrollment and data-governance boundaries. The current scenario instead requires 'Attach a supported automatic Autopilot device preparation policy to Windows 365 provisioning.' and verification that the new Cloud PC receives selected core applications before user access.

This action is appropriate for a different case: Windows laptops remain on an unsupported Windows 10 release while hardware meets the organization’s Windows 11 requirements. There, the targeted fix is 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.' because controlled feature updates can target supported release upgrades without rebuilding devices. The current scenario instead requires 'Attach a supported automatic Autopilot device preparation policy to Windows 365 provisioning.' and verification that the new Cloud PC receives selected core applications before user access.

This action is appropriate for a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. There, the targeted fix is 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' because compatibility holds should be investigated rather than treated as arbitrary policy failures. The current scenario instead requires 'Attach a supported automatic Autopilot device preparation policy to Windows 365 provisioning.' and verification that the new Cloud PC receives selected core applications before user access.

This observation would validate a different case: A company provisions Windows 365 Enterprise Cloud PCs but the chosen provisioning policy uses a network that lacks required connectivity. It would check 'A pilot Cloud PC provisions successfully and reaches approved corporate resources.' after 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.'. It does not establish success for the stated scenario; the needed evidence is 'A freshly provisioned device receives the expected name without manually renaming it.'.

This observation would validate a different case: An organization wants to pin devices to a specific Windows 11 release while allowing security quality updates. It would check 'Pilot devices remain on the chosen feature release while receiving normal security updates.' after 'Create an Intune Windows feature update policy targeting the required supported version.'. It does not establish success for the stated scenario; the needed evidence is 'A freshly provisioned device receives the expected name without manually renaming it.'.

This observation would validate a different case: An employee's Windows 365 Cloud PC is deleted accidentally and the team has no documented recovery plan. It would check 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.' after 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.'. It does not establish success for the stated scenario; the needed evidence is 'A freshly provisioned device receives the expected name without manually renaming it.'.

This action is appropriate for a different case: An Android business app needs a private managed Google Play listing rather than a public consumer listing. There, the targeted fix is 'Publish/approve the private app through the supported managed Google Play process.' because enterprise app distribution can restrict visibility to organizational users. The current scenario instead requires 'Configure the supported Win32 app return-code and restart behavior appropriately.' and verification that the test deployment records required reboot and succeeds after restart when appropriate.

This action is appropriate for a different case: A specialized kiosk app must be deployed only to dedicated Android devices, not employee-owned Android work profiles. There, the targeted fix is 'Use a dedicated-device group and appropriate Android app assignment targeting.' because different Android ownership modes require distinct app availability and permissions. The current scenario instead requires 'Configure the supported Win32 app return-code and restart behavior appropriately.' and verification that the test deployment records required reboot and succeeds after restart when appropriate.

This action is appropriate for a different case: A user complains that an optional productivity tool installs on every corporate phone without consent. There, the targeted fix is 'Change the Intune app assignment from Required to Available where appropriate.' because required and available assignments create different deployment experiences. The current scenario instead requires 'Configure the supported Win32 app return-code and restart behavior appropriately.' and verification that the test deployment records required reboot and succeeds after restart when appropriate.