INTUNE ADMIN LAB · CASE 04
Private operator worksheet. Use UTC throughout. Crop identifiers and mailbox contents from publication screenshots.

INTUNE BASELINE
Dedicated device and owner:
Intune device state, reported OS version and last check-in UTC:
Lab policy name, minimum OS version, per-setting result and report time UTC:
Device group members and action for noncompliance:
Microsoft Entra device ID from the Intune record (private):
Optional local comparison with the four-part build from ver and time UTC:
Pilot user: enabled Intune / Exchange Online / Entra ID P1 or P2 entitlements:

WHAT IF SIMULATION (completed path in the article)
Target user (private), individual resource / app ID, device platform and client app:
Device ID (private) and OS version supplied to What If:
Additional sign-in conditions supplied, if any:
Expected pilot policy and sole grant control:
Record each run time, the policy name returned, its grant and mode, and your interpretation.
A. isCompliant = True  | time / policy / grant / mode / interpretation:
B. isCompliant = False | time / policy / grant / mode / interpretation:
C. isCompliant = True  | time / policy / grant / mode / interpretation:
If the expected policy was absent, record the first unmet condition shown:
Mailbox access during the What If exercise: untested.

OPTIONAL LIVE SIGN-IN TEST
Before starting, confirm the Edge work profile, mailbox and access to interactive sign-in logs.
Dedicated device, other users affected and enforced policies in scope:
Original OS minimum, valid higher test minimum and person responsible for restoration:
For each phase: BASELINE / FAILURE / RECOVERY
- Threshold value, installed build and UTC change time:
- Per-setting result, reported time, overall compliance and check-in time:
- Private sign-in event ID, UTC time, resource and matching device ID:
- Report-only result on the named policy and relevant enabled policy results:
- Observed mailbox access during that sign-in:
- Two redacted figure filenames:
- Supported conclusion or reason the phase is inconclusive:

Close the live test
- Recovery evidence newer than restoration time:
- Lab assignments and policies retired after recovery:
- Final check-in and device state:
- Outstanding work and owner: