Manage and maintain devices

Your organization has purchased the Intune Suite. The service desk manager reports that a growing number of devices are experiencing unexplained startup slowdowns and application crashes, but the team lacks a proactive way to spot these problems before users file tickets. She wants a solution that surfaces device performance issues, provides a Startup Performance score, and can detect anomalies affecting groups of devices. Which Intune Suite capability should you use?

Your organization uses Windows Autopilot user-driven mode with Microsoft Entra join. The security team requires that every provisioned device be named with the prefix 'CORP-' followed by a portion of the hardware serial number so that machines can be identified in inventory reports. You are configuring the Autopilot deployment profile. Which setting should you use to enforce this naming automatically during provisioning?

Your organization ships high-end engineering laptops that require several large Win32 apps to be installed before hand-off. The helpdesk wants devices imaged and app-loaded at the IT bench so users receive a machine that finishes setup in only a few minutes. You must use Windows Autopilot to install the device-targeted apps and policies during a technician-driven phase, then let users complete only the user-specific portion later. Which Autopilot mode should you configure?

Contoso is deploying 40 Windows 11 devices that will run as unattended digital signage kiosks in a warehouse. The devices have no keyboard or mouse attached, and no user should ever sign in during provisioning. IT wants each device to enroll into Intune, join Microsoft Entra ID, and apply configuration automatically as soon as it is powered on and connected to the network. Which Windows Autopilot mode should you configure in the deployment profile?

A security analyst asks you to identify all corporate Windows devices whose BIOS/firmware version is older than a specific build so they can be prioritized for updates. You want to retrieve this data on demand for a single device to validate the reporting logic before scaling out. From the Intune admin center, which remote action lets you run a live KQL-based query against an individual managed device to return its firmware details immediately?

Your organization has purchased the Intune Suite. Developers frequently need to run a specific internal installer that requires administrative rights, but you must keep all users as standard (non-admin) accounts on their Windows devices for security. You want to allow elevation of only that one approved installer, require business justification at the moment of elevation, and capture an audit record each time it happens. Which Intune Suite capability and configuration should you implement?

Your organization uses Windows Autopilot user-driven mode for new laptops. Management requires that users cannot access the desktop until three line-of-business applications and the device compliance policy have finished applying. If provisioning fails, the helpdesk needs users to be able to see the error and contact support rather than being locked out. Which Enrollment Status Page (ESP) configuration meets these requirements?

Your organization uses Windows Autopilot device preparation policies for user-driven deployment. You want certain devices to automatically receive a specific set of configuration profiles the moment they enroll, without relying on dynamic group membership that can take time to populate. During policy creation you need devices to be placed into a static Entra security group at enrollment so targeting is immediate. Which capability should you configure to achieve this?

Your organization manages corporate-owned Android Enterprise fully managed devices with Intune. A device is being reassigned from a departing warehouse worker to a new hire in the same role. Company policy requires that all corporate apps, data, and the previous user's profile be completely removed, and the device must return to a factory-fresh state ready for re-enrollment. Which remote action should you perform?

Contoso deploys a Wi-Fi configuration profile to the 'All Corporate Windows Devices' group. However, a specific line of Surface Go tablets used only in warehouses must NOT receive this profile because they use a different network. You do not want to create a separate group or restructure existing assignments. What is the most efficient way to prevent the Surface Go devices from receiving the profile?

A security incident is underway, and the SOC team reports that a batch of 40 Windows 11 devices in the 'Finance-Workstations' Microsoft Entra ID group may be running outdated Microsoft Defender Antivirus security intelligence. You need to force these specific devices to pull the newest Defender signatures immediately, using the fewest administrative steps in the Microsoft Intune admin center. What should you do?

A laptop belonging to a finance employee was recently reported as briefly left unattended in a public area. The device is Entra joined and managed by Intune, and BitLocker is enabled with the recovery key escrowed to Entra ID. Your security team wants to invalidate the existing recovery key so the old escrowed value can no longer be used to unlock the drive, without wiping or re-imaging the device. From the Microsoft Intune admin center, which remote action should you perform on the device?

Your organization has licensed the Intune Suite and wants to issue certificates to managed Windows and iOS devices without deploying or maintaining any on-premises certificate authority infrastructure or NDES connectors. You plan to use Microsoft Cloud PKI. After creating a root CA and an issuing CA in the Intune admin center, what must you configure so that enrolled devices actually receive certificates from the issuing CA?

A user reports intermittent application crashes on a corporate Windows 11 laptop that is enrolled in Intune. The helpdesk needs to review Event Viewer logs, registry values, and the results of specific command-line queries from the device without interrupting the user or requiring them to manually export anything. From the Microsoft Intune admin center, which remote action should the technician use?

Your organization currently uses an Autopilot user-driven deployment profile for Entra-joined Windows 11 devices. Leadership wants a simpler provisioning experience that does not require you to pre-register device hardware hashes, supports assignment to a security group of enrolling users, and lets you define which apps and scripts must succeed before the user reaches the desktop. Which provisioning approach should you implement?

A helpdesk technician is troubleshooting a single corporate-owned Windows 11 laptop that users report is slow. The technician needs to interactively query the device's currently running processes and installed applications in real time from the Intune admin center, without waiting for the next scheduled inventory sync. Which Intune capability should the technician use?

Your organization has purchased the Intune Suite. The application team wants to deploy a curated set of common third-party applications (such as 7-Zip and Notepad++) to Windows devices without having to manually download installers, repackage them, or maintain update logic. They want Microsoft to handle the packaging and provide ongoing updates for these apps. Which Intune Suite capability should you use to meet this requirement with the least administrative effort?

Your company deploys corporate-owned, supervised iPads through Apple Business Manager. The security team requires that only the internal LOB app named 'FieldReports' routes its traffic through the company VPN, while all other app traffic uses the normal internet connection. You have already deployed a VPN configuration profile with the required server settings. What must you configure to meet this requirement?

Your organization manages 200 macOS devices with Intune. The IT team deploys a third-party VPN client that requires a specific set of managed configuration keys defined by the vendor in a property list (.plist) file. You need to push these vendor-defined settings to the enrolled Macs using the most appropriate Intune configuration profile type. Which profile type should you create?

A user reports that a newly assigned Win32 application has not appeared on their corporate Windows 11 laptop, even though the deployment was completed in Intune several hours ago. The device is powered on and connected to the internet. From the Intune admin center, you want to force the device to immediately contact Intune and process any pending policy and app assignments, without disrupting the user's current session. Which remote action should you perform?