11.1 Compliance Policies and Configuration Profiles

You're the systems administrator for an international sports equipment retail company that uses Azure Active Directory (AD) and Microsoft Intune to manage their mobile devices. All company-owned Windows 11 mobile devices are registered in Azure AD and enrolled in Microsoft Intune.

You decide that you want to create an Intune conditional access policy that:

Applies the policy to the Office 365, Microsoft Teams, and SharePoint cloud apps.

Assigns the policy to Windows platforms.

Requires the Windows 11 devices to be marked as Compliant.

Give the policy a name.

Assign users and user groups.

Select cloud apps or user actions.

Select conditions (such as the device platform).

Grant or block access based on controls.

Enable the policy.

A user contacts you to let you know their Intune-enrolled device has been remotely locked. What would have caused this?

The user's device is non-compliant and was remotely locked.

You're the systems administrator for an international sports equipment retail company. The company requires that the Windows 11 laptops for employees be replaced with new Windows 11 laptops every 3 years.

In addition, the company requires the following:

When the employees log into their new laptops, all the existing user and application settings need to be in place.

There must be a separation of corporate and employee data.

Data must be automatically encrypted with Azure Rights Management.

Which of the following features would BEST meet the company's requirements?

Enterprise State Roaming

You're the systems administrator for an international trading company that uses Azure Active Directory (AD) and Microsoft Intune to manage their mobile devices. All company-owned mobile devices are registered in Azure AD and enrolled in Microsoft Intune.

Many company-owned laptops are currently running Windows 10 and are enrolled in Microsoft Intune. You want to identify which of these laptops can be upgraded to Windows 11.

SOLUTION: You create a device compliance policy and assign the policy to the laptops. After 24 hours, you view the device compliance report in Intune.

NO

As the systems administrator for a company that uses Azure AD and Microsoft Intune to manage their corporate-owned mobile devices, you want to be able to access your Intune data to view reports and charts related to:

Devices

Enrollments

App protection policies

Compliance policies

Device configuration policies

Which tool does Microsoft Intune provide to view these types of reports?

Microsoft Power BI Online reports

You're the systems administrator for an international sports equipment retail company that uses Azure Active Directory (AD) and Microsoft Intune to their manage mobile devices. All company-owned mobile devices are registered in Azure AD, enrolled in Microsoft Intune, and have BitLocker installed and running.

You've created a conditional access policy that:

Includes an assigned Test user group.

Applies the policy to the Microsoft 365, Microsoft Teams, and SharePoint cloud apps.

Assigns the policy to Windows platforms.

SOLUTION: You check the conditional access policy settings and discover that the Enable policy setting is set to Off. You change the setting to On.

YES

You're a systems administrator for an international trading company that uses Azure Active Directory (AD) and Microsoft Intune to manage their mobile devices. All company-owned mobile devices are registered in Azure AD and enrolled in Microsoft Intune.

You've created your first device compliance policy that:

Marks a device enrolled in Intune as Not Compliant if BitLocker isn't installed and running on a managed Windows 11 device.

Sends an email notification to you to indicate that the device is non-compliant.

Is assigned to a Test device group.

You haven't enrolled the devices in Intune.

You're the systems administrator for a fashion design company that uses Azure Active Directory (AD) and Microsoft Intune to manage their mobile devices. All company-owned mobile devices are registered in Azure AD and enrolled in Microsoft Intune.

You've created the following Azure AD device groups:

Win11dev: All company-owned Windows 11 mobile devices

iPadProdev: All company-owned iPad Pro tablets

Androiddev: All company-owned Android mobile devices

You've created a Microsoft App Store device configuration profile that restricts several options for employee management of apps in the Microsoft Store. These setting apply on the employees' managed Windows 11 mobile devices.

YES

You're the systems administrator for an international trading company that uses Azure Active Directory (AD) and Microsoft Intune to manage their mobile devices. All company-owned mobile devices are registered in Azure AD and enrolled in Microsoft Intune.

You've created the following dynamic user groups to manage access to company resources:

Managers: jobTitle = "Manager"

Consultants: jobTitle = "Customer Consultant"

OfficeAdmin: jobTitle = "Office Administrator"

SalesReps: jobTitle ="Sales Representative"

NO

You're the systems administrator for an international trading company that uses Azure Active Directory (AD) and Microsoft Intune to manage their mobile devices. All company-owned mobile devices are registered in Azure AD and enrolled in Microsoft Intune.

You've created the following dynamic user groups to manage access to company resources:

Managers: jobTitle = "Manager"

Consultants: jobTitle = "Customer Consultant"

OfficeAdmin: jobTitle = "Office Administrator"

SalesReps: jobTitle = "Sales Representative"

YES