Exam Bundle

This observation would validate a different case: An admin configures Delivery Optimization peers across the public internet when policy permits only same-subnet sharing. It would check 'The test client downloads content from allowed local peers and not prohibited external peers.' after 'Limit delivery group/peer scope to the approved network boundary.'. It does not establish success for the stated scenario; the needed evidence is 'The Office client follows its app channel while the OS stays on its target version.'.

This observation would validate a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. It would check 'Pilot Macs report the approved OS version after the assigned update window.' after 'Deploy supported macOS software update policy through the Intune Settings Catalog.'. It does not establish success for the stated scenario; the needed evidence is 'The Office client follows its app channel while the OS stays on its target version.'.

This observation would validate a different case: A macOS fleet reports inconsistent patch status because the management reporting sync hasn't completed after update. It would check 'The pilot's reported version converges with its verified local build after sync.' after 'Check device check-in, update reporting lag and local OS version before declaring failure.'. It does not establish success for the stated scenario; the needed evidence is 'The Office client follows its app channel while the OS stays on its target version.'.

This action is appropriate for a different case: Android field phones must be entirely corporate managed rather than keeping a personal side on the handset. There, the targeted fix is 'Use Android Enterprise fully managed enrollment with the supported provisioning method.' because fully managed devices are intended for corporate-only mobile workloads. The current scenario instead requires 'Apply documented platform minimum-version enrollment restrictions and communicate upgrade requirements.' and verification that supported Android builds enroll and explicitly unsupported builds receive a governed rejection.

This action is appropriate for a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. There, the targeted fix is 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.' because personal devices should not inherit corporate supervised device restrictions. The current scenario instead requires 'Apply documented platform minimum-version enrollment restrictions and communicate upgrade requirements.' and verification that supported Android builds enroll and explicitly unsupported builds receive a governed rejection.

This action is appropriate for a different case: A macOS Mac enrolled through Company Portal fails to receive management after the user denies the required profile installation. There, the targeted fix is 'Guide the user through supported macOS enrollment approval and verify the management profile.' because user-approved enrollment needs a valid installed MDM profile on the Mac. The current scenario instead requires 'Apply documented platform minimum-version enrollment restrictions and communicate upgrade requirements.' and verification that supported Android builds enroll and explicitly unsupported builds receive a governed rejection.

This observation would validate a different case: App Control for Business enforcement blocks an essential finance application after a vendor update changed its signing certificate. It would check 'The approved application executes and the untrusted test binary remains denied.' after 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.'. It does not establish success for the stated scenario; the needed evidence is 'Unauthorized inbound file sharing is denied on public and private networks.'.

This observation would validate a different case: An admin wants to enforce App Control on all endpoints at once without understanding what legitimate binaries would be blocked. It would check 'The reviewed audit log shows impacted signed apps and the staged block policy works.' after 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'Unauthorized inbound file sharing is denied on public and private networks.'.

This observation would validate a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. It would check 'The device restarts normally with its protected drive after authorized recovery.' after 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.'. It does not establish success for the stated scenario; the needed evidence is 'Unauthorized inbound file sharing is denied on public and private networks.'.

This action is appropriate for a different case: An enrollment restriction blocks personal Android devices but a department needs narrowly controlled BYOD enrollment. There, the targeted fix is 'Adjust platform/enrollment ownership restrictions only for an approved scope and test exclusions.' because enrollment restrictions apply before app and compliance configuration. The current scenario instead requires 'Check enrollment device limits and approved user quota rather than deleting unrelated devices.' and verification that the approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.

This action is appropriate for a different case: Company-owned Windows laptops are Entra joined but none appear in Intune after first sign-in because automatic MDM enrollment is not enabled. There, the targeted fix is 'Configure Microsoft Intune MDM user scope and required automatic enrollment prerequisites.' because directory join alone does not guarantee Intune management enrollment. The current scenario instead requires 'Check enrollment device limits and approved user quota rather than deleting unrelated devices.' and verification that the approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.

This action is appropriate for a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. There, the targeted fix is 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.' because pre-registration and actual MDM enrollment are separate lifecycle stages. The current scenario instead requires 'Check enrollment device limits and approved user quota rather than deleting unrelated devices.' and verification that the approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.

This observation would validate a different case: A customer wants only a specific device support group to be local Administrators on Windows endpoints, not every cloud user. It would check 'Only the assigned support accounts hold local admin access on test machines.' after 'Configure the Windows local users and groups policy in Intune with supported membership settings.'. It does not establish success for the stated scenario; the needed evidence is 'A help-desk test user can reset an assigned device but cannot edit security policies.'.

This observation would validate a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. It would check 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.' after 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.'. It does not establish success for the stated scenario; the needed evidence is 'A help-desk test user can reset an assigned device but cannot edit security policies.'.

This observation would validate a different case: A company requires device risk severity from Defender for Endpoint to affect Conditional Access grants. It would check 'A high-risk test endpoint becomes noncompliant and fails the intended access policy.' after 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.'. It does not establish success for the stated scenario; the needed evidence is 'A help-desk test user can reset an assigned device but cannot edit security policies.'.

This observation would validate a different case: Several managed Windows PCs have Intune profiles but do not appear as onboarded devices in Microsoft Defender for Endpoint. It would check 'The pilot appears active in Defender with expected device telemetry.' after 'Deploy supported Defender for Endpoint onboarding configuration to the targeted devices.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot blocks the intended port when the connection is classified public.'.

This observation would validate a different case: A business requires separate security baseline configurations for kiosks and ordinary employee laptops. It would check 'The kiosk and laptop each receive their intended controls without cross-assignment.' after 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot blocks the intended port when the connection is classified public.'.

This observation would validate a different case: A device receives two security baseline profiles that set conflicting Windows Defender options. It would check 'The pilot shows the required secure value without outstanding setting conflicts.' after 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot blocks the intended port when the connection is classified public.'.

This observation would validate a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. It would check 'The protected app signs in with its applied policy while an unsupported client is denied.' after 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.'. It does not establish success for the stated scenario; the needed evidence is 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.'.

This observation would validate a different case: A junior admin submits a destructive device configuration change that must be approved by another authorized administrator. It would check 'A protected change remains pending until an authorized independent approver approves it.' after 'Use Intune multi-admin approval for the protected change type.'. It does not establish success for the stated scenario; the needed evidence is 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.'.

This observation would validate a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. It would check 'A help-desk test user can reset an assigned device but cannot edit security policies.' after 'Create the narrowest Intune RBAC role with only required remote-action permissions.'. It does not establish success for the stated scenario; the needed evidence is 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.'.

This action is appropriate for a different case: An organization must centrally configure Outlook security settings while leaving Windows device OS update rings unchanged. There, the targeted fix is 'Manage Microsoft 365 Apps policy through Intune or Microsoft 365 Apps admin center as appropriate.' because application policy and OS update management have different targets. The current scenario instead requires 'Publish/approve the private app through the supported managed Google Play process.' and verification that the app appears in the corporate managed catalog but not publicly for unrelated customers.

This action is appropriate for a different case: A packaged Win32 application uses a shared UNC path installer that remote laptops cannot reach off VPN. There, the targeted fix is 'Distribute packaged installation content through Intune rather than relying on an inaccessible internal share.' because cloud-managed remote deployments should not depend on unavailable local installation paths. The current scenario instead requires 'Publish/approve the private app through the supported managed Google Play process.' and verification that the app appears in the corporate managed catalog but not publicly for unrelated customers.

This action is appropriate for a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. There, the targeted fix is 'Use supported app applicability rules plus appropriate assignment filters.' because being targeted does not make an incompatible OS able to install the app. The current scenario instead requires 'Publish/approve the private app through the supported managed Google Play process.' and verification that the app appears in the corporate managed catalog but not publicly for unrelated customers.

This action is appropriate for a different case: Several managed Windows PCs have Intune profiles but do not appear as onboarded devices in Microsoft Defender for Endpoint. There, the targeted fix is 'Deploy supported Defender for Endpoint onboarding configuration to the targeted devices.' because Intune enrollment does not automatically prove EDR sensor onboarding. The current scenario instead requires 'Inspect the profile-specific rule settings and effective network category on the endpoint.' and verification that the pilot blocks the intended port when the connection is classified public.

This action is appropriate for a different case: A security team wants all managed Windows PCs to use up-to-date real-time malware protection without editing antivirus settings manually on each endpoint. There, the targeted fix is 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.' because central antivirus policies enforce consistent scanning and protection settings. The current scenario instead requires 'Inspect the profile-specific rule settings and effective network category on the endpoint.' and verification that the pilot blocks the intended port when the connection is classified public.

This action is appropriate for a different case: An organization wants standardized endpoint detection and response policies rather than installing separate scripts on every workstation. There, the targeted fix is 'Deploy Intune EDR endpoint security policies with supported Defender integration.' because central EDR configuration reduces onboarding and policy drift. The current scenario instead requires 'Inspect the profile-specific rule settings and effective network category on the endpoint.' and verification that the pilot blocks the intended port when the connection is classified public.

This observation would validate a different case: A tenant needs to find stale Intune managed devices and export their names using automation without granting a developer full global administrator rights. It would check 'The script returns only approved inventory fields and cannot delete device records.' after 'Use Microsoft Graph with scoped application or delegated permissions and paginated queries.'. It does not establish success for the stated scenario; the needed evidence is 'A simulated missing service yields the intended noncompliant result with diagnostic context.'.

This observation would validate a different case: A PowerShell cleanup script mistakenly removes device records because it matches display name instead of a stable managed device identifier. It would check 'A dry run reports exact intended IDs and no unrelated records are removed.' after 'Resolve and validate unique Intune managedDevice IDs before mutation calls.'. It does not establish success for the stated scenario; the needed evidence is 'A simulated missing service yields the intended noncompliant result with diagnostic context.'.

This observation would validate a different case: A Graph script changes compliance policy assignments in production without recording input or output. It would check 'Every actual assignment update is attributable to an approved request and measured result.' after 'Add dry-run mode, explicit change approval, logging and post-change verification.'. It does not establish success for the stated scenario; the needed evidence is 'A simulated missing service yields the intended noncompliant result with diagnostic context.'.

This action is appropriate for a different case: Windows accessibility settings must stay usable, but a security configuration profile unintentionally disables all assistive technology. There, the targeted fix is 'Adjust only the conflicting setting within a scoped policy after accessibility testing.' because accessibility requirements should not be overridden by broad unvalidated restrictions. The current scenario instead requires 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' and verification that supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.

This action is appropriate for a different case: A Mac needs FileVault configuration but the admin targets a Windows BitLocker settings catalog profile. There, the targeted fix is 'Create and assign the platform-specific macOS FileVault and recovery-key configuration.' because encryption controls differ by operating system and management channel. The current scenario instead requires 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' and verification that supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.

This action is appropriate for a different case: An administrator needs to deploy browser restrictions to Windows devices but wants to avoid conflict with an existing security baseline. There, the targeted fix is 'Compare overlapping settings and select one authoritative assignment for each control.' because multiple policy sources can generate conflicting desired states. The current scenario instead requires 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' and verification that supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.