Intune Devices & Exams

[CHiLL]

We are looking into the option of migrating from our legacy on-site domain joined/co-managed Windows devices to purely Intune cloud joined. So far, results have been promising, though I can't figure out what the best way to manage using these devices for exams, be it an online exam or for access arrangements.

 

In our current domain environment, we use normal domain joined Windows laptops and specific user accounts that have a lot of GPO restrictions applied, with the main ones being that the desktop and start menu are redirected to a specific location that only contains apps that can be used and removes all unnecessary apps to help avoid cheating. Usually we have all the icons on the desktop, with all but the one(s) the students need hidden and students cannot show hidden files. We also utilise Impero app restrictions and AppLocker to prevent apps from launching. However, using Intune I don't know if I can have the same redirected desktop/start menu to only show icons that are required.

 

1) Is it possible to have Intune only users redirect their desktop and start menu or at least specify exactly what is shown?

2) How do I manage something like required exam resources, such as a PDF or Python questions for a Computer Science exam? (This is currently done via a mapped drive that only exam accounts have access to and is read-only)

3) I know Intune can be slow at making changes, so if one exam ends at 10:30 and another that needs a different app starts at 11:00, is that enough time for the changes to be made and then applied when the next exam account requires it at 11:00?

 

Our main requirements are:

 

- Use ExamWritePad, which is running and configured from a local network share - an icon on the desktop would be required for this

- Use Word (including spell check) - this is rare but does happen from time to time

- Use Pearson Online Platform - Depreciated but may come back -

- Use PowerPoint - had our first request for this for an access arrangement student for next week

- Use ClaroRead - I don't think anyone uses this anymore, though we are licensed and it's an accessibility thing

- Use IDLE for Python for Computer Science exams

- File Explorer to access Documents and mapped drives

 

I also don't know how Internet access restrictions would work for a device that requires online authentication.

 

There are other considerations that I haven't fully thought through yet, such as hiding the time because students aren't meant to see that apparently.

 

For the time-being, we are continuing to use on-site domain joined devices as done previously, though this is something I need to look at in the future.

[TechMonkey]

It's on my list to research this as well, so sorry no definitive answers for you.

 

Currently rough idea in my head is:

- set them up as kiosks so a reboot will clear them, with work being saved elsewhere. Alternative is get some card readers so we can hand out exam passes that will sign the correct exam user in. (all theoretical at the moment)

- Internet would be locked down to the necessary M365 urls and specific resources needed.

- Apps assigned to the exam user and all other apps blocked.

 

Setup and return to normal is a concern of mine, knowing how I have had to hand craft reg keys at short notice before to get an exam prepared that I wasn't informed of or was informed incorrectly of. The exam users with cards should solve this, in conjunction with Smoothwall to block only what is needed.

 

I've not heard the hide the time requirement before so I will have to find out what that is about.

[midweek]

Exam requirements is the one thing stopping us moving to Intune from onsite AD. If we had a fleet of dedicated exam devices then maybe, but as an indie school we have a high proportion of digital requirements for exams so this would be too expensive.

[Joeloman]

A little other input...

Many countries in Europe use https://www.safeexambrowser.org/news_en.html

Works on many platforms.

[thimon]

Can you use PDQ to help with this? We’re also looking at moving to InTune and can see we’ll need to either move away from app locker to block access to the various Office apps or use InTune’s WDAC feature. We use firewall rules to cut Edge off from the internet, which InTune also allows. Everything else we control / deploy via PDQ which makes it a doddle, we can make a standard laptop exam ready in less than 5 minutes.

[lornebooker]

Would be interested if you got anywhere with this! Currently stuck with this issue at the moment.

[Dipl0]

Sorry for necroing the thread, what was the outcome of this? Did you manage this successfully? We are in the process of cloud migration and exam laptops are my only remaining domain devices.

 

I have a few ideas. We already have a restricted SSID with a internet blocking policy, I suspect this might need to be loosened slightly to allow intune management. I understand there's some oma-uri codes to restrict who logs into the devices (Restrict which users can logon into a Windows 10 device with Microsoft Intune | Peter Klapwijk - In The Cloud 24-7) which I hope is still relevant. Then probably applocker to restrict apps other than Read/Write and EWP.

 

We have an ever changing fleet due to the nature of our students, EWP on some, Read and Write and EWP on others and then outside of exams they get used for entrance exams where they use an online examination which we'd deal with by having a separate Wi-Fi enabled SSIDs for exams, this means I probably can't force a wifi network annoyingly unless I consider different groups for their different uses but then I'm at the mercy of the Intune Minute if(and when) I don't get told until the last minute.

 

 

[psydii]

We allocate a set of devices to become exam devices for the period, with plenty of time for them to pivot over and transition from the generic set of profiles to the ones tuned for exam device use.  We also use exam accounts locked to specific devices, and take them off the network for period.   They save their work in the local documents. The exams team manage the initial logon (to cache the credentials) and the  saving and purging of files before/after each exam.

[CHiLL]

Unfortunately, I didn't get anywhere with this and I'm not currently at that school (seconded elsewhere). I believe they still do exams with on-premise domain-joined laptops.

[jamesrhart]

We moved to exam.net at the start of the year, worked really well (uses safe exam browser in the background), students turn up with their school issued device and just use the allocated code based on individual needs, we place a few spare chargers and devices in the exam hall just in case.

[Dipl0]

On 20/07/2026 at 09:49, jamesrhart said:

We moved to exam.net at the start of the year, worked really well (uses safe exam browser in the background), students turn up with their school issued device and just use the allocated code based on individual needs, we place a few spare chargers and devices in the exam hall just in case.

 

As in for External Summer Exams? If so is your exams officer not concerned about the JCQ requirement to not use their own devices?

 

"• candidates are not allowed to use their own computers or other electronic devices, e.g. mobile phones."

[drutt]

18 minutes ago, Dipl0 said:

 

As in for External Summer Exams? If so is your exams officer not concerned about the JCQ requirement to not use their own devices?

 

"• candidates are not allowed to use their own computers or other electronic devices, e.g. mobile phones."

 

But its a school issued device, ergo, not theirs.

[jamesrhart]

Correct, school issued and school owned device, so not the pupils.

[Dipl0]

7 minutes ago, jamesrhart said:

Correct, school issued and school owned device, so not the pupils.

Is JCQ happy with that distinction? In my eyes I'd feel concerned about the ability to place an unfair advantage onto the computer ahead of the exam even with secure exam browser locking it down. I believe that's the opinion of my exams officer and smt also. 

[jamesrhart]

I’m not sure what you mean by an unfair advantage, they are using their normal way of working on a device that they are familiar with (in terms of the hardware), the locked down browser removes all other aspects when the exam starts.  We used to deploy fixed PCs and the students found these difficult to work with as the keyboard travel, screen size etc isn’t what they are used to, then we ended up deploying the same devices the students had in a permanently locked down mode, now we use the same device the student has (a school device) in a locked down mode.  This boils down to how much you trust the software, we do, it’s been proven across Europe, how much do you trust they don’t bring something else into the hall?

Edited August 5 by jamesrhart

[Dipl0]

JCQs requirements talk about a device being used for the exam to ensure it has no previously stored data. I'm just confused how you get around this when presumably the pupils own device still has all of their school work on? I understand exam.net locks down into secure exam browser and I understand moving out of the app is blocked but if there were a way to get out of that, a student could just open up their revision work and have complete access to previous work and syllabus? I can understand using a standalone device for exams which they login to exam.net to access the exam, I understand that because it's more closed and the previous work isn't available, I just don't understand how that is feasible using their 1-1 device that JCQ deem that as acceptable.

 

Just to clarify this is genuine curiosity as I've never worked with an exams officer who would consider allowing students to bring in their own device (1-1 included) due to these JCQ requirements I'm discussing.

 

 

Quote

 

14.25 A word processor:

• must have been cleared of any previously stored data, as must any portable storage medium used. An unauthorised memory stick must not be used by a candidate. When needed, the centre must provide a memory stick, which is cleared of any previously stored data, to the candidate; (Instructions for Conducting Examinations (ICE) – Joint Council for Qualifications)

 

Edited August 5 by Dipl0

[jamesrhart]

No, I understand and no offence taken - exam.net are listed as JCQ compliant.  But to take your particular point it says:

 

“A word processor: must have been cleared of any previously stored data…..”. The word processor starts with a clean page and so has been cleared of all previous data and we don’t use portable media.  
 

In terms of getting out of the app, students are still invigilated and our invigilators have had specific training for exam.net - again we trust the product the same as we trusted GPO and applocker beforehand - only now exam.net also monitor for anomalies - they are open that they had one issue several years ago, their monitoring picked it up and before the exam has even ended they had called the school and closed the hole within days.

Edited August 5 by jamesrhart

[psydii]

When I did this 22 years ago, we had separate accounts for the examinations, that had logon time restrictions and we reduced cached logons to 1. At the end of the exam the student would reboot and log back onto their daily account.

 

Today i’d probably do something similar, and leverage kiosk mode in conjunction with the lockdown tools built into the exam app.  We use Entra/AD pass though Auth so we can still leverage login restriction based on time and use conditional access to lock the accounts to a specific device, with perhaps a script to clear their Onedrive cloud-side.