You’re helping a company that’s just completed a migration from on-premises Active Directory to Microsoft Entra ID. Several department heads are reporting that their teams can no longer access a legacy, on-premises line-of-business application that uses Kerberos authentication. The application server cannot be moved to the cloud. What should you configure to restore secure access to this application for the Entra ID-joined users?

Consider this situation: Your organization uses Microsoft Intune for application management. You need to deploy a critical, company-developed .msi application to all Windows devices in the Finance department. However, the application must only install for users who are actively signed in, and it should be available in the Company Portal for optional reinstallation. Which app assignment type should you use?

A user calls the help desk because their Windows 11 device, enrolled in Microsoft Intune, is performing very slowly. You suspect a recently deployed configuration profile might be causing the issue. You need to quickly revert the device’s configuration to the last known good state that is officially defined by Intune policy, without performing a full wipe. What should you do?

You are designing an update strategy for 500 Windows 11 devices across multiple time zones. The leadership team has approved a 14-day deferral period for Feature Updates to allow for internal testing. However, they insist that all security updates must be installed on devices within 48 hours of Microsoft’s release, regardless of the user’s work schedule or connectivity. Which update ring configuration in Intune best meets these requirements?

Your company is implementing co-management with Configuration Manager and Microsoft Intune. You have shifted the “Device Configuration” workload slider to Intune Pilot for a specific device collection. For a device in that pilot collection, where will a Windows 10/11 compliance policy be evaluated and enforced?

You need to ensure that all corporate-owned Windows devices automatically encrypt their primary drive. You create a BitLocker configuration profile in Microsoft Intune. Which of the following is a key advantage of using Intune to manage BitLocker, compared to relying solely on Group Policy in an on-premises domain?

During an Autopilot deployment for a new hire, the user gets an error message stating “Something went wrong. Your organization could not enroll your device.” You verify the device hash is properly uploaded and assigned to the user. What is the most likely cause if the user’s account has the correct Intune license?

To meet new security requirements, you must create a policy that prevents data transfer between Microsoft Edge and Microsoft Word on company Windows devices. Specifically, you need to block users from copying text from a web page in Edge and pasting it into a Word document. Which Intune endpoint security policy category should you configure?

You manage a mixed environment of BYOD and corporate-owned iOS/iPadOS devices in Intune. For the corporate devices, you need to push a required VPN configuration profile to ensure they always connect to corporate resources through a secure tunnel. However, you must guarantee that this mandatory VPN profile never gets delivered to or installed on any personally owned BYOD device. How can you achieve this?

You’re helping a company that’s just completed a migration from on-premises Active Directory to Microsoft Entra ID. Several department heads are reporting that their teams can no longer access a legacy, on-premises line-of-business application that uses Kerberos authentication. The application server cannot be moved to the cloud. What should you configure to restore secure access to this application for the Entra ID-joined users?0