Explanation

Reference:
https://docs.microsoft.com/en-us/intune/device-enrollment-program-enroll-ios

Explanation:
The policy needs to be applied to Group4 so we need to configure Users and Groups.
The Access controls are set to Block access

We therefore need to exclude compliant devices.
From the scenario:
* Ensure that the users in a group named Group4 can only access Microsoft Exchange Online from devices that are enrolled in Intune.
Note: When a device enrolls in Intune, the device information is updated in Azure AD to include the device compliance status. This compliance status is used by conditional access policies to block or allow access to e-mail and other organization resources.
References:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/conditions

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows

Explanation/Reference:
References:
https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/manage-conditional-access?
view=azure-devops
Testlet 2
This is a case study. Case studies are not timed separately. You can use as much exam time as you would
like to complete each case. However, there may be additional case studies and sections on this exam. You
must manage your time to ensure that you are able to complete all questions included on this exam in the
time provided.
To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.
To start the case study
To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirements, existing environment, and problem statements. When you are
ready to answer a question, click the Question button to return to the question.
Overview
Contoso, Ltd, is a consulting company that has a main office in Montreal and two branch offices in Seattle
and New York.
Contoso has the users and computers shown in the following table.

The company has IT, human resources (HR), legal (LEG), marketing (MKG) and finance (FIN)
departments.
Contoso uses Microsoft Store for Business and recently purchased a Microsoft 365 subscription.
The company is opening a new branch office in Phoenix. Most of the users in the Phoenix office will work
from home.
Existing Environment
The network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure
Active Directory (Azure AD).
All member servers run Windows Server 2016. All laptops and desktop computers run Windows 10
Enterprise.
The computers are managed by using Microsoft System Center Configuration Manager. The mobile
devices are managed by using Microsoft Intune.
The naming convention for the computers is the department acronym, followed by a hyphen, and then four
numbers, for example, FIN-6785. All the computers are joined to the on-premises Active Directory domain.
Each department has an organization unit (OU) that contains a child OU named Computers. Each
computer account is in the Computers OU of its respective department.
Intune Configuration

Requirements
Planned Changes
Contoso plans to implement the following changes:
Provide new computers to the Phoenix office users. The new computers have Windows 10 Pro

preinstalled and were purchased already.
Start using a free Microsoft Store for Business app named App1.

Implement co-management for the computers.

Technical Requirements:
Contoso must meet the following technical requirements:
Ensure that the users in a group named Group4 can only access Microsoft Exchange Online from

devices that are enrolled in Intune.
Deploy Windows 10 Enterprise to the computers of the Phoenix office users by using Windows

Autopilot.
Monitor the computers in the LEG department by using Windows Analytics.

Create a provisioning package for new computers in the HR department.

Block iOS devices from sending diagnostic and usage telemetry data.

Use the principle of least privilege whenever possible.

Enable the users in the MKG department to use App1.

Pilot co-management for the IT department.

Explanation