Exam Bundle

This action is appropriate for a different case: A Change Review Agent recommends approving a proposed Intune policy that would affect a high-risk executive device group. There, the targeted fix is 'Inspect the multi-admin approval request and agent impact findings before approving.' because approval accountability remains with authorized human administrators. The current scenario instead requires 'Review proposed settings and existing Intune assignments before creating the new configuration.' and verification that the staged policy matches the security requirement and produces no unreviewed conflicts.

This action is appropriate for a different case: A Security Copilot agent recommends disabling a conditional access grant because some users are blocked from an app. There, the targeted fix is 'Validate identity security policy intent and evidence before applying suggestions to production.' because automated guidance should not override established Zero Trust access requirements. The current scenario instead requires 'Review proposed settings and existing Intune assignments before creating the new configuration.' and verification that the staged policy matches the security requirement and produces no unreviewed conflicts.

This action is appropriate for a different case: A PowerShell cleanup script mistakenly removes device records because it matches display name instead of a stable managed device identifier. There, the targeted fix is 'Resolve and validate unique Intune managedDevice IDs before mutation calls.' because device names can collide, making them unsafe destructive keys. The current scenario instead requires 'Review proposed settings and existing Intune assignments before creating the new configuration.' and verification that the staged policy matches the security requirement and produces no unreviewed conflicts.

This action is appropriate for a different case: An Intune device record shows 'retire pending' yet security operations claims corporate data has been removed from an offline phone. There, the targeted fix is 'Distinguish queued retirement from confirmed device-side completion.' because pending remote tasks are not proof that a device was altered. The current scenario instead requires 'Scope query permissions and output handling to least-privilege operational requirements.' and verification that a limited operator sees only permitted query fields while sensitive details stay restricted.

This action is appropriate for a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. There, the targeted fix is 'Require verified Intune managed device ID, serial and ownership before destructive actions.' because friendly names can collide and should not identify wipe targets alone. The current scenario instead requires 'Scope query permissions and output handling to least-privilege operational requirements.' and verification that a limited operator sees only permitted query fields while sensitive details stay restricted.

This action is appropriate for a different case: A support agent cannot tell why a single user's two iPhones receive different configuration policies. There, the targeted fix is 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' because per-user troubleshooting correlates device and app policy targeting. The current scenario instead requires 'Scope query permissions and output handling to least-privilege operational requirements.' and verification that a limited operator sees only permitted query fields while sensitive details stay restricted.

This observation would validate a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. It would check 'The app gets its intended work URL while the personal device remains unenrolled.' after 'Configure the correct managed-app configuration policy for the targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'An enrolled device is managed and the protected app enforces document-sharing restrictions.'.

This observation would validate a different case: A company wants managed iOS and Android apps to receive a company tenant identifier without requiring users to type it every launch. It would check 'The targeted app starts with the right corporate tenant and no manual text entry.' after 'Use supported app configuration policies for managed apps or devices according to enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'An enrolled device is managed and the protected app enforces document-sharing restrictions.'.

This observation would validate a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. It would check 'Work content pastes into an approved work app but not an unprotected personal app.' after 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.'. It does not establish success for the stated scenario; the needed evidence is 'An enrolled device is managed and the protected app enforces document-sharing restrictions.'.

This action is appropriate for a different case: A company wants Windows 11 monthly security updates delivered in predictable pilot and broad rings with different restart windows. There, the targeted fix is 'Configure Intune Windows update rings with staged assignments and appropriate deadlines.' because update rings manage cadence and user experience for eligible quality updates. The current scenario instead requires 'Assign the appropriate expedited quality policy to a verified at-risk group.' and verification that the vulnerable cohort receives the fix and unaffected endpoints remain on routine schedules.

This action is appropriate for a different case: An organization plans Windows Autopatch but has not assigned devices to a supported Autopatch group and expects updates automatically. There, the targeted fix is 'Verify Autopatch prerequisites, device registration and managed update policy assignments.' because autopatch behavior depends on eligible devices and managed update cohorts. The current scenario instead requires 'Assign the appropriate expedited quality policy to a verified at-risk group.' and verification that the vulnerable cohort receives the fix and unaffected endpoints remain on routine schedules.

This action is appropriate for a different case: An admin configures Delivery Optimization peers across the public internet when policy permits only same-subnet sharing. There, the targeted fix is 'Limit delivery group/peer scope to the approved network boundary.' because peer topology must follow network and privacy requirements. The current scenario instead requires 'Assign the appropriate expedited quality policy to a verified at-risk group.' and verification that the vulnerable cohort receives the fix and unaffected endpoints remain on routine schedules.

This action is appropriate for a different case: A company wants BYOD users to save work documents only in OneDrive for Business, not personal cloud storage. There, the targeted fix is 'Configure allowed save-location and data transfer restrictions in Intune app protection.' because MAM can limit where organizational content leaves supported apps. The current scenario instead requires 'Configure the correct managed-app configuration policy for the targeted identity.' and verification that the app gets its intended work URL while the personal device remains unenrolled.

This action is appropriate for a different case: A user with a personal phone signs into a protected Outlook app, but Conditional Access requires Intune-compliant device status that BYOD phones cannot meet. There, the targeted fix is 'Require an approved app protection policy in Conditional Access where supported instead of full device compliance.' because app-protection grant controls can serve supported unmanaged devices. The current scenario instead requires 'Configure the correct managed-app configuration policy for the targeted identity.' and verification that the app gets its intended work URL while the personal device remains unenrolled.

This action is appropriate for a different case: Employees bring personal phones to work and the company must prevent corporate documents from being copied into unmanaged messaging apps. There, the targeted fix is 'Create an Intune app protection policy restricting transfer of organizational data to unmanaged apps.' because MAM data protection can apply to supported work apps without full device management. The current scenario instead requires 'Configure the correct managed-app configuration policy for the targeted identity.' and verification that the app gets its intended work URL while the personal device remains unenrolled.

This observation would validate a different case: A chain purchases Android handsets in bulk and wants zero-touch registration when users first power them on. It would check 'An eligible reseller-uploaded device automatically receives the intended Intune enrollment configuration.' after 'Integrate compatible Android zero-touch enrollment with Intune configuration assignments.'. It does not establish success for the stated scenario; the needed evidence is 'The personal device enrolls with user-appropriate controls while the corporate device is supervised.'.

This observation would validate a different case: A user enrolls a second Windows machine and receives an Intune maximum device count failure. It would check 'The approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.' after 'Check enrollment device limits and approved user quota rather than deleting unrelated devices.'. It does not establish success for the stated scenario; the needed evidence is 'The personal device enrolls with user-appropriate controls while the corporate device is supervised.'.

This observation would validate a different case: A bring-your-own Android user accidentally enrolls the whole phone instead of a separate work profile. It would check 'The new profile isolates work data and personal apps remain outside managed scope.' after 'Retire the inappropriate enrollment and re-enroll using approved personally owned work-profile setup.'. It does not establish success for the stated scenario; the needed evidence is 'The personal device enrolls with user-appropriate controls while the corporate device is supervised.'.

This action is appropriate for a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. There, the targeted fix is 'Use the supported Intune device query with valid KQL and an appropriate scope.' because Intune device query can answer targeted state questions without collecting all device images. The current scenario instead requires 'Collect available Intune enrollment and device diagnostic logs for the specific record.' and verification that the log bundle identifies the enrollment failure class for the affected device.

This action is appropriate for a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. There, the targeted fix is 'Use an authorized Wipe action on the verified device record with incident tracking.' because a full wipe is appropriate for a lost corporate endpoint when approved. The current scenario instead requires 'Collect available Intune enrollment and device diagnostic logs for the specific record.' and verification that the log bundle identifies the enrollment failure class for the affected device.

This action is appropriate for a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. There, the targeted fix is 'Require verified Intune managed device ID, serial and ownership before destructive actions.' because friendly names can collide and should not identify wipe targets alone. The current scenario instead requires 'Collect available Intune enrollment and device diagnostic logs for the specific record.' and verification that the log bundle identifies the enrollment failure class for the affected device.

This action is appropriate for a different case: An automated Intune offboarding script uses Graph permissions that also allow managing unrelated Microsoft 365 users. There, the targeted fix is 'Reduce the automation identity's effective Graph scopes and target only approved device APIs.' because least privilege should constrain both permission and resource selection. The current scenario instead requires 'Validate identity security policy intent and evidence before applying suggestions to production.' and verification that the approved fix resolves legitimate access without admitting noncompliant test endpoints.

This action is appropriate for a different case: A Policy Configuration Agent proposes settings from a natural-language security standard without identifying policy conflicts. There, the targeted fix is 'Review proposed settings and existing Intune assignments before creating the new configuration.' because generated policy recommendations should be assessed for platform support and conflict. The current scenario instead requires 'Validate identity security policy intent and evidence before applying suggestions to production.' and verification that the approved fix resolves legitimate access without admitting noncompliant test endpoints.

This action is appropriate for a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. There, the targeted fix is 'Return the supported JSON schema without extra stdout content and validate the rules file.' because machine-readable output format is part of the custom compliance contract. The current scenario instead requires 'Validate identity security policy intent and evidence before applying suggestions to production.' and verification that the approved fix resolves legitimate access without admitting noncompliant test endpoints.

This action is appropriate for a different case: A tenant has four months of Intune compliance history but executives want trend reporting without manually copying screenshots. There, the targeted fix is 'Use Intune reporting exports or supported Graph reporting endpoints and create a governed dashboard.' because historical trend analysis requires repeatable, appropriately scoped data extraction. The current scenario instead requires 'Expose freshness and evaluation-time metadata in monitoring reports.' and verification that each sample device shows its latest status and actual last evaluation time.

This action is appropriate for a different case: A remediation script shows success but endpoint performance still degrades after each reboot. There, the targeted fix is 'Correlate remediation output with independent Endpoint Analytics metrics and repeating-event reports.' because successful script exit is not equivalent to sustained user-experience improvement. The current scenario instead requires 'Expose freshness and evaluation-time metadata in monitoring reports.' and verification that each sample device shows its latest status and actual last evaluation time.

This action is appropriate for a different case: A service desk needs to identify whether Windows endpoints have slow startup caused by a new login agent rather than simple user complaints. There, the targeted fix is 'Review Endpoint Analytics startup performance reports and compare deployment cohorts.' because measured startup telemetry supports evidence-based performance troubleshooting. The current scenario instead requires 'Expose freshness and evaluation-time metadata in monitoring reports.' and verification that each sample device shows its latest status and actual last evaluation time.

This observation would validate a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. It would check 'The personal device enrolls with user-appropriate controls while the corporate device is supervised.' after 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.'. It does not establish success for the stated scenario; the needed evidence is 'The new profile isolates work data and personal apps remain outside managed scope.'.

This observation would validate a different case: Company-owned Windows laptops are Entra joined but none appear in Intune after first sign-in because automatic MDM enrollment is not enabled. It would check 'A newly joined authorized Windows laptop appears as an Intune managed device after sign-in.' after 'Configure Microsoft Intune MDM user scope and required automatic enrollment prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'The new profile isolates work data and personal apps remain outside managed scope.'.

This observation would validate a different case: Apple Business Manager tokens expired and newly purchased iPhones stop appearing in assigned Intune enrollment profiles. It would check 'A new test serial number syncs and receives the configured automated enrollment profile.' after 'Renew the Apple device enrollment program token and verify the server assignment and sync.'. It does not establish success for the stated scenario; the needed evidence is 'The new profile isolates work data and personal apps remain outside managed scope.'.

This action is appropriate for a different case: A Microsoft Tunnel gateway is online but unenrolled Android users cannot start application-specific connections. There, the targeted fix is 'Check Tunnel for MAM application configuration, gateway status and supported client integration.' because gateway reachability does not guarantee a MAM policy correctly invokes it. The current scenario instead requires 'Publish and validate the appropriate CA trust chain before onboarding clients.' and verification that a test device authenticates to Wi-Fi and the server validates the full issued chain.

This action is appropriate for a different case: A managed catalog app requires a vendor-specific detection update after an upstream app build changes its install path. There, the targeted fix is 'Update the Enterprise App Catalog app assignment or detection configuration using supported lifecycle procedures.' because catalog availability doesn't remove the need to verify installed state. The current scenario instead requires 'Publish and validate the appropriate CA trust chain before onboarding clients.' and verification that a test device authenticates to Wi-Fi and the server validates the full issued chain.

This action is appropriate for a different case: A catalog application is assigned but its vendor's older custom package remains installed and causes detection confusion. There, the targeted fix is 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.' because conflicting installations should be controlled across package lifecycles. The current scenario instead requires 'Publish and validate the appropriate CA trust chain before onboarding clients.' and verification that a test device authenticates to Wi-Fi and the server validates the full issued chain.