“The policy never arrived.” That was the ticket. When I opened the device report, the policy was right there. The setting said Not applicable, and the laptop was running Windows Pro. Another sync would not change its edition.
I built this lab around that moment: before changing a setting, what would you need to see to explain the result to the next administrator?
Open the interactive Intune Admin Lab →
Choose the ticket on your desk
- The policy never arrived. Or did it? Read the device report, check Windows edition support and decide when to investigate assignments and filters.
- Installed is not the same as detected. Investigate 0x87D1041C. Use a browser exercise to see why an installed newer version can fail an exact-version check, then try the same rule with the test marker removed.
- LAPS succeeded. Where is the password? Separate policy delivery, the account, the Entra backup and the operator’s permissions. Decide what the evidence lets you say without revealing a password.
How to use it
Allow about 25–40 minutes for one case, or 80–110 minutes for all three. Each case includes screenshots, a decision, a retest plan and a short handover. You can work from the supplied evidence without a tenant, and save your place in the same browser.
Download the lab kit (ZIP) for the instructions and a blank investigation worksheet. Keep any operational notes in your own support system.
What was tested
The seven screenshots come from an Intune tenant. The Windows edition and LAPS backup observations are real. The Win32 incident is a teaching scenario: its detection rules run in your browser, and the exercise does not deploy an application. The LAPS case does not claim a fresh sign-in or a forced rotation. Each case links to the Microsoft documentation behind its conclusions.
