Windows 11 devices enrolled in Microsoft Intune run an in-house agent that records its build number in a registry value. No built-in Intune compliance setting reads that value, and the security team requires that a device carrying a build below the approved minimum is reported as non-compliant and that the person using it is shown an explanation in the Company Portal. Select TWO items you must author and add to Intune to extend compliance in that way.
- AA PowerShell discovery script, uploaded to the compliance scripts area of Intune, that reads the registry value on the device and writes the result it finds to its output. Correct
- BAn Endpoint Analytics remediation script pair, made up of a detection script and a remediation script, assigned to the same group of Windows devices that runs the in-house agent.
- CA JSON file of detection rules, attached to the custom compliance setting of a Windows compliance policy, that states the comparison to make and the message to show the user. Correct
- DA Win32 app detection rule that reads the same registry value, added to the Intune app that installs the in-house agent on each of the Windows devices in scope.
- EA device configuration profile that writes the approved minimum build number into the registry of each Windows device before the compliance policy is next evaluated.
Why A is correct: A custom compliance setting has no way to read an arbitrary registry value on its own, so the discovery script is the component that runs on the device and reports the value back for evaluation.
Why B is wrong: Remediations do run a detection script on the device and are a reasonable place to look, but their results are reported as remediation output and do not contribute to the compliance state a compliance policy publishes.
Why C is correct: The JSON file is what turns a value the script reported into a compliant or non-compliant verdict, and it carries the remediation strings that the Company Portal presents to the user.
Why D is wrong: A Win32 detection rule can certainly read a registry value, but it decides whether Intune considers that app installed, so it reports an app installation state rather than a device compliance state.
Why E is wrong: This is the common confusion between configuring a device and evaluating it, and writing the approved value onto the device would destroy the evidence the compliance check is supposed to read.