Real tenant investigation
Policies that don’t apply
Separate assignment, delivery, applicability and reporting before you change a policy.
25–35 minutes · 0 / 3 learning checkpointsOpen case 01 →Three incidents. One better troubleshooting habit.
From ticket
to resolution.
A practical Intune lab for administrators who want to explain what happened, prove the cause and know when it is safe to close the ticket.
0 / 9 learning checkpoints
Resume →Reading progress is saved only in this browser. It does not certify tenant tests.
Choose the ticket on your desk
Start with the symptom.
Real portal + browser exercise
Application detection errors
Investigate 0x87D1041C and prove what a detection rule actually accepts.
30–40 minutes · 0 / 3 learning checkpointsOpen case 02 →Current + dated tenant evidence
LAPS evidence and access
Separate policy delivery, account management, backup and operator permissions.
25–35 minutes · 0 / 3 learning checkpointsOpen case 03 →Built for a working administrator
Investigate before you change.
Each case gives you a ticket, readable evidence, a decision point, a hidden hint and a practical handover. Try the question before revealing the resolution.
Use the step index on your phone, open any screenshot at its original resolution, and save a step to resume later in the same browser.
Two ways to use the pilot
- Evidence mode: complete all three cases with the provided screenshots. No tenant access needed.
- Your lab: use a single authorised pilot device and the worksheet to collect equivalent evidence. Tenant changes are separate from this reading exercise.
Allow roughly 80–110 minutes for the three cases. Device propagation and any separately planned operational tests add time.
What is real, and what is an exercise?
| Case | Evidence in this edition | Boundary |
|---|---|---|
| Policies | Fresh tenant report, exact Not applicable setting, Windows Pro edition. | Supported diagnosis; no policy remediation was deployed. |
| Application detection | Fresh Win32 configuration screenshot and a tested browser exercise. | The fictional incident was not reproduced as an Intune failure. |
| LAPS | Dated October deployment evidence plus fresh November device/backup metadata. | No fresh local sign-in, forced rotation or access-denial test. |
Screenshots are native captures with account headers excluded. Dates identify historical evidence. Configuration values were not changed to create a result.
Take the investigation with you
Your lab kit.
A private worksheet and instructions for the browser detection exercise. No tenant credentials, automatic assignments or production deployment scripts.
Download the lab kit · ZIP ↓- Case worksheet · TXT
Facts, hypothesis, approved change, retest and rollback. - Instructions and boundaries · TXT
- Interactive detection exercise →
Runs in this page’s memory. No installation or PowerShell required.
Keep a useful record.
Save each step explicitly with Save this step. Checkpoints track what you have understood; log your own test outcomes separately in the worksheet. Progress does not sync between devices, browsers, private windows or a future published URL.
No sign-in is required. Your checkpoints and saved step stay in this browser. To keep a separate record or move between devices, download the worksheet or export your progress.