0:00–0:20
Review
0:20–0:35
VM tidy
0:35–1:40
Assessment
1:40–2:00
Debrief
0:00 – 0:20Review · 20 min
Week 6 consolidation — the complete endpoint governance stack
Connect five days of endpoint work into one governance picture before the assessment opens.
- Draw the full Week 6 stack on the board: On-prem AD → Entra ID Connect → Hybrid join → Intune enrolment → Device group → Compliance policy → Configuration profile → CA device compliance gate → M365 access. Ask students to trace what happened to WIN-CLIENT-01 across the five days — it started as just an AD machine and ended as a fully managed, compliant, KFM-configured, app-deployed, CA-gated endpoint.
- Ask: "The LL — Windows Baseline Compliance policy requires Defender to be enabled. The LL — Windows Security Baseline configuration profile also configures Defender settings. These are two different things — what is each one doing?" — prime the compliance vs configuration distinction one final time before the written section
- Ask: "A device is non-compliant. The CA policy blocks M365 access. The user calls the helpdesk. What is the exact sequence of steps to restore access — in what order must things happen?" — this is Section B of the assessment in conversational form
- Ask: "LINUX-01 is enrolled. It is compliant. CA001 requires compliant device. Can a Lakeview Logistics user sign into Teams from LINUX-01?" — yes, the CA framework is platform-agnostic. The compliance state is what matters, not the OS.
- 5 minutes open Q&A — no new concepts, clarifications only
Instructor note — pre-seed the assessment scenario: Before class, on WIN-CLIENT-02: (1) disable Windows Defender Real-time protection, (2) turn off Windows Firewall, (3) if possible, check that BitLocker is not active (it may never have been on a VM — note this). These create a multi-setting non-compliance state that students must find and fix individually. Do not tell students which settings are broken — finding them via the Intune Device compliance tab is Section A of the assessment.
0:20 – 0:35VM tidy · 15 min
Final self-audit before the assessment window opens
- WIN-CLIENT-01: enrolled, compliant, KFM active, LL — Known Folder Move profile shows Succeeded
- WIN-CLIENT-02: enrolled, LL — Windows Baseline Compliance assigned — compliance state will be deliberately broken by instructor pre-seed
- LINUX-01: enrolled, intune service running (sudo systemctl status intune), LL — Linux Baseline Compliance assigned
- CA001: both MFA and Require compliant device conditions active — not Report-only
- SG — All Windows Devices, SG — All Linux Devices, SG — Production Devices groups all exist
- Lab Journal entries complete for Days 1–4
Assessment boundary: At 0:35 no further tenant or VM changes are permitted unless directed by the assessment sheet. The instructor's pre-seeded non-compliance state on WIN-CLIENT-02 is now live.
0:35 – 1:40Assessment · 65 min
Week 6 assessment — the Lakeview Logistics non-compliant device incident
WIN-CLIENT-02 has been reported non-compliant in Intune. The user assigned to it cannot access M365. Students investigate, remediate, verify, and explain.
| Section | What is assessed | Marks |
|---|
| Section A — Investigation | Navigate to WIN-CLIENT-02's compliance detail in Intune, identify all non-compliant settings, record their current state, and explain how each one violates the LL — Windows Baseline Compliance policy. | 25 pts |
| Section B — Remediation | Fix all non-compliant settings on WIN-CLIENT-02, force a sync, verify the compliance state returns to Compliant in Intune, and verify M365 access is restored for the assigned user. | 25 pts |
| Section C — CA chain explanation | Written: explain the complete chain from the moment a setting became non-compliant to the moment M365 access was blocked, and from remediation to access restoration — including every component (Intune, Entra ID cached state, CA policy evaluation, token issuance). | 25 pts |
| Section D — Governance recommendation | Given the incident, design and implement one Intune control that would either prevent the non-compliance from occurring, detect it faster, or automatically remediate it. Implement the change in the tenant and document it. | 25 pts |
Instructor note: Section A requires Intune → Devices → WIN-CLIENT-02 → Device compliance tab. The specific failing settings depend on what was pre-seeded — students must find them without being told. Section C is the most intellectually demanding section — distinguishing the Intune compliance evaluation, the Entra ID cached state, and the CA sign-in evaluation is where strong students separate from weaker ones. Section D has three defensible answers: a shorter check-in interval, a non-compliance notification to the manager, or a remediation script. Marks are for quality of reasoning and implementation, not for choosing a specific option.
1:40 – 2:00Debrief · 20 min
Assessment debrief & Week 7 preview
- Walk through Section A — show the Device compliance tab path. Which settings were flagged? Which students found all of them vs only some?
- Walk through Section C — draw the timeline on the board: setting breaks → Intune detects at next check-in → Entra ID cached compliance updated → next CA evaluation blocks access. Make the asynchronous nature explicit: there is a window between non-compliance occurring and access being blocked.
- Ask: "What is the single most impactful change you could make to shrink that window between non-compliance and access block?" — shorter device check-in frequency (configurable in Intune), combined with a CA sign-in frequency policy (continuous access evaluation)
- Ask: "Looking at the complete six-week M365 stack — identity, email, SharePoint, Teams, endpoints — what is the weakest remaining governance gap at Lakeview Logistics?" — open synthesis, prime Weeks 7–8
- Week 7 preview: Security and threat protection — Microsoft Defender for M365 (email, Teams, SharePoint threat scanning), Defender for Endpoint (device-level threat detection that integrates with Intune compliance), Secure Score, DLP policies, and sensitivity labels. The devices managed in Week 6 become Defender for Endpoint targets in Week 7.
Assessment rubric — marking guidance
| Criterion | Full marks | Partial | No marks |
|---|
| Section A | All pre-seeded non-compliant settings found via correct path, each setting's policy violation explained accurately | Some settings found, others missed, or correct path not documented | Non-compliant settings not found |
| Section B | All settings remediated, sync forced, Compliant state confirmed in Intune, M365 access verified with evidence | Settings fixed but verification incomplete or M365 access not tested | Settings not remediated |
| Section C | Full chain documented accurately: Intune evaluation, cached state, CA evaluation, token, block, remediation path — timing and asynchrony addressed | Chain partially correct — missing the asynchronous evaluation or the token/cached state mechanism | Chain not described or fundamentally incorrect |
| Section D | Root cause identified, appropriate control chosen and implemented in tenant, clear reasoning for why it addresses the gap | Gap identified, control chosen but not implemented or reasoning weak | Gap not identified |
Learning outcomes — by end of Week 6, students can…
Build hybrid identityInstall Entra ID Connect and hybrid-join Windows machines from scratch
Enforce device complianceCreate and assign compliance policies and observe non-compliant states
Deploy configuration profilesUse Settings Catalog, Update rings, and Security Baselines to configure enrolled devices
Package and deploy appsUse IntuneWinAppUtil and deploy Win32 and Store apps to Windows devices
Manage Linux endpointsEnrol Ubuntu 22.04 via the Intune agent and apply Linux compliance policies
Explain the CA chainTrace the full path from device non-compliance to M365 access block and back