PRACTICE / MODULE 010 / MICROSOFT

Enrolled.
Not compliant.

Alex's Northstar Services laptop is Entra joined and Intune enrolled, but SharePoint blocks access. Learn the rules, investigate the evidence and restore device compliance without weakening the policy.

← Review Intune fundamentals Previous · M365 onboarding →

03 / INTERACTIVE INTUNE INVESTIGATION

Diagnose FIN-LT014 and FIN-LT022.

Use the fictional administrative panels to diagnose stale health attestation and a second device's missing compliance-policy assignment. Collect evidence before closing each ticket. Unsafe workarounds are recognized as failures.

JOELEarns / NORTHSTAR SERVICESMicrosoft Intune Device management

TRAINING TENANT ONLYINCIDENT NS-2112

DEVICE / ASSIGNED USERFIN-LT014Alex Morgan / Finance

MODELED HEALTH4 / 7Current verification prerequisites

TICKETS CLOSED0 / 2Persistent in this browser

SIMULATED FEEDBACKInvestigate the reported BitLocker health result before making changes.

MICROSOFT ENTRA / DEVICE IDENTITY

FIN-LT014 · identity

Device identity and device management are separate. Verify that you are looking at the intended corporate endpoint before interpreting compliance.

FIN-LT014Windows 11 Enterprise · Northstar ServicesMicrosoft Entra joined · Assigned to Alex Morgan

JOINED

Entra joined device identity exists

A device record establishes identity, not an Intune compliance result. In real support, review join status and device identifiers rather than blindly rejoining.

Read-only Windows evidence

dsregcmd /status reports device join state and related diagnostics. Compare the correct device object and expected ownership.

SIMULATED CHANGE LOG1 events

TICKET
NS-2112 opened: FIN-LT014 Entra joined + Intune enrolled; SharePoint requires a compliant device.

TICKET NOTESNo real tenant data

Copy the current training result; no data is sent to Microsoft or a third-party service.

JOELEarns / NORTHSTAR SERVICES / SIMULATED INTUNE TICKET
Ticket: NS-2112
Device: FIN-LT014
Assigned user: Alex Morgan (NS-2112) / Finance (NS-2118)
Entra joined: true
Intune enrolled: true
Compliance policy assigned: true
BitLocker locally enabled: true
Secure Boot enabled: true
Supported Windows build: true
Boot health current: false
Intune check-in reflected: false
Client device signal present: true
Compliant-device Conditional Access required: true
MFA requirement enabled: true
Unassigned device setting: noncompliant
Checks:
- PASS: Entra identity — Entra device object and expected join confirmed.
- PASS: Intune enrollment — Intune enrollment is active in this model.
- PASS: Effective compliance assignment — Northstar Windows Secure Baseline is assigned to this device.
- FAIL: Local health & attestation — BitLocker is enabled locally but the simulated boot-time health attestation is stale.
- FAIL: Compliance state reported to Entra — No current compliance evaluation/check-in is reflected in the simulated cloud state.
- FAIL: Finance SharePoint grant — SharePoint is blocked: the applied Conditional Access grant requires a compliant device.
- PASS: Baseline & policy safeguards — Required Conditional Access and MFA remain in force; devices lacking an assigned policy are treated as noncompliant.
Evidence note: Training simulation; no live device was enrolled, encrypted, restarted, or modified.

KEEP THE LAYERS DISTINCT

Enrolled isn't compliant. Compliant isn't authorized.

Device identity, MDM enrollment, health evidence, reporting and Conditional Access each require their own verification.

Review Intune fundamentals →Related Conditional Access →Northstar onboarding →