INTUNE ADMIN LAB - PRIVATE CASE WORKSHEET
Version: 1.1, 7 November 2026

Use a separate copy for each case. Do not enter passwords, recovery keys, tokens,
customer email contents or full personal identifiers in the public course.
Keep sensitive operational evidence inside your approved support system.

Case / ticket:
Learning mode: evidence review / own lab execution
Operator role and scope:
Device identifier (private):
Relevant user/device context (private):
Policy or app identifier (private):
Windows edition / version / architecture:
Observation timestamp and time zone:
Last device check-in:
Last policy/app report timestamp:

1. SYMPTOM
Expected behaviour:
Observed behaviour:
Exact error or state:

2. EVIDENCE
Assignment inclusions, exclusions, filter mode and membership:
Filter Match / No match and resulting eligibility:
Filter Evaluation time / Last modified:
Effective context and platform applicability:
Portal evidence and timestamp:
Endpoint evidence and timestamp:
LAPS only - failed operation / required permission / effective scope:
LAPS only - event RecordId / error code / same-cycle events:
What the evidence does NOT prove:

3. HYPOTHESIS
Most likely cause:
Alternative explanation:
Next check that would distinguish them:
Relevant Microsoft reference and date reviewed:

4. CHANGE PLAN (only for an approved own-lab change)
Smallest change / exact pilot scope:
Original value and rollback steps:
Expected impact and control device or app:
Owner / approval / maintenance window if required:

5. RETEST
New observation after the change:
Positive control:
Negative control:
Browser exercise only - marker version / rule / simulated exit / STDOUT / STDERR:
Portal reporting delay accounted for:
Pass / fail / inconclusive, and why:
Cleanup and restored state:

6. HANDOVER
One-paragraph explanation another administrator can verify:
Outstanding work:

Completion of a reading exercise is not proof of execution in a tenant.