You are troubleshooting a Microsoft 365 Apps for enterprise deployment on Windows 10 devices managed by Intune. Users report that the apps are not installing, but the deployment status in Intune shows 'Success' for some devices and 'Failed' for others. On a failing device, you discover that the Office Deployment Tool (ODT) logs indicate '0x80070005 - Access denied'. What is the most likely cause?
Running as user leads to access denied when writing to Program Files.
Why this answer
The error code 0x80070005 (Access denied) in Office Deployment Tool (ODT) logs indicates a permissions issue. When Intune deploys Microsoft 365 Apps, it runs the ODT in the system context via the Intune Management Extension. If the ODT is inadvertently executed in the user context (e.g., due to a misconfigured detection script or deployment script that doesn't elevate), it lacks the necessary privileges to write to the Program Files directory or modify system registry keys, causing the access denied error.
Exam trap
The trap here is that candidates often associate 'Access denied' with file permissions or antivirus blocking, but in the context of Intune-managed ODT deployments, the root cause is almost always the execution context (user vs. system), not a missing file permission or security software.
How to eliminate wrong answers
Option A is wrong because insufficient disk space would produce a different error, such as 0x80070070 (ERROR_DISK_FULL) or a specific 'not enough space' message in the ODT logs, not an access denied error. Option B is wrong because an invalid Channel attribute in configuration.xml would cause a parsing error or a 'channel not found' error, not an access denied error; the ODT would fail before attempting to write files. Option C is wrong because lack of internet connectivity would result in a download failure error (e.g., 0x80072EFD or a timeout), not an access denied error; the ODT would report a network-related failure.