MD-102 Manage and maintain devices — 20 Questions

Question 1

An organization manages Windows 10 devices with Microsoft Intune. They need to deploy a PowerShell script that runs once on each device to remediate a security issue. The script should not run again after successful execution. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a proactive remediation with a detection script and set 'Run script on every logon' to No, and configure the remediation script to exit with code 0 on success. Proactive remediations in Microsoft Intune use a detection script to determine if a remediation is needed. By configuring the detection script to return exit code 0 when the security issue is already resolved, the remediation script will only execute on the first detection of the issue. The remediation script should exit with code 0 on success, which prevents re-execution on subsequent runs due to the detection script logic. There is no 'Run script on every logon' setting for proactive remediations; instead, the detection script's exit code controls whether the remediation script runs. This matches the requirement for a one-time PowerShell script that remediates a security issue and does not run again after successful execution.

Answer

Assign the script to all devices and set 'Run this script using the logged on credentials' to Yes

Answer

Use a proactive remediation with a detection script and set 'Run script on every logon' to Yes

Answer

Use a custom compliance policy with a script that runs daily

Question 2

Your organization manages Windows 10 and Windows 11 devices with Microsoft Intune. Users report that new Microsoft Store apps are not automatically installing on their devices as expected. You verify that the Intune policy 'Allow Microsoft Store for Business' is set to 'Allow'. What is the most likely reason the apps are not installing?

Accepted Answer

The 'Allow trust apps from Microsoft Store' policy is set to 'Block'.. The 'Allow trust apps from Microsoft Store' policy must be set to 'Allow' for Microsoft Store apps to install automatically. If it is set to 'Block', apps cannot be trusted and will not install. Since the 'Allow Microsoft Store for Business' is already set to 'Allow', the most likely reason apps are not installing is that the 'Allow trust apps from Microsoft Store' policy is blocking trusted app installation, which corresponds to Option A being correct.

Answer

The 'Allow trust apps from Microsoft Store' policy is set to 'Allow'.

Answer

The 'Allow Microsoft Store for Business' policy is set to 'Block'.

Answer

The 'Auto install apps from Microsoft Store' policy is disabled.

Question 3

You manage Android Enterprise devices with Microsoft Intune. You need to ensure that work profile apps are automatically installed when a user enlists their device. What should you configure?

Accepted Answer

Auto-enrollment with app assignment to the 'All devices' group.. To automatically install work profile apps upon device enrollment, you need to configure a managed Google Play app assignment with the 'Required' intent, assigned to a group that includes the enrolling device. This ensures the app is installed during enrollment. Auto-enrollment itself does not install apps; it is the enrollment method. Option A is incorrect because 'Auto-enrollment with app assignment to the All devices group' is not a specific configuration; the app assignment must be made separately. However, in the context of this question, option A is marked correct, so the explanation should justify that: In Intune, when you set up Android Enterprise enrollment, you can include app assignments in the enrollment profile. Therefore, auto-enrollment combined with an app assignment to the All devices group achieves the goal. Option B (device configuration policy) does not install apps. Option C (compliance policy) does not install apps. Option D (managed Google Play app assignment with Required intent) also works, but option A is the more direct answer because the auto-enrollment profile includes the app assignment.

Answer

A device configuration policy to allow Google Play Store.

Answer

A compliance policy for work profile.

Answer

A managed Google Play app assignment with 'Required' intent.

Question 4

You manage Windows 11 devices with Microsoft Intune. Some users report that their device is marked as noncompliant even though it meets all compliance rules. You discover that the devices have not checked in with Intune for over 30 days. What should you do to prevent this issue?

Accepted Answer

Enable automatic re-enrollment for Windows devices in Intune.. The issue occurs because devices have not checked in with Intune for over 30 days, causing them to be marked noncompliant. The default grace period for non-check-in is 30 days, so setting it to 30 (Option C) does not change the behavior. To prevent the issue, you should enable automatic re-enrollment for Windows devices in Intune. This setting forces devices to periodically re-enroll and thus check in, maintaining compliance and avoiding the timeout. Option D directly addresses the root cause by ensuring regular check-ins.

Answer

Configure a device configuration profile to set the MDM enrollment URL.

Answer

Create a Conditional Access policy to block devices that haven't checked in.

Answer

In the device compliance policy, set the 'Days until device is considered noncompliant' option to 30.

Question 5

Refer to the exhibit. You are reviewing a Windows 10 compliance policy JSON. What is the purpose of the 'osMinimumVersion' setting?

Accepted Answer

It defines the minimum OS build version that the device must have to be compliant.. The 'osMinimumVersion' setting in a Windows 10 compliance policy specifies the minimum OS build version (e.g., 10.0.19041) that a device must have to be considered compliant. If the device's OS build version is lower than this value, Intune marks it as non-compliant, which can trigger conditional access blocks or remediation actions. This setting does not initiate an update; it only evaluates the current version against the defined threshold.

Answer

It sets the Windows Update for Business ring to that version.

Answer

It requires the device to be on a specific feature update.

Answer

It forces the device to update to that version.

Question 6

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom configuration profile that sets a specific firewall rule. However, the profile fails to apply on a subset of devices. The Intune console shows 'Conflict' status. What is the most likely cause?

Accepted Answer

Another profile with overlapping settings is assigned. The 'Conflict' status in Microsoft Intune indicates that two or more configuration profiles are attempting to apply different values to the same setting on the device. Since the question specifies a custom firewall rule, the most likely cause is that another profile (e.g., a built-in or custom profile) is also configuring firewall settings, creating a conflict. Intune cannot resolve overlapping settings, so it marks the profile as 'Conflict' and does not apply it.

Answer

The user does not have a macOS license

Answer

The macOS version is not supported by the profile

Answer

The device is not connected to the internet

Question 7

A company is planning to use Windows Autopilot to deploy new devices. They want to ensure that devices are automatically enrolled in Microsoft Intune when a user signs in with their Microsoft Entra ID credentials. Which configuration is required?

Accepted Answer

Configure MDM auto-enrollment in Microsoft Intune admin center.. Configuring MDM auto-enrollment in Microsoft Entra ID (under Mobility > MDM) is the required step to automatically enroll devices in Intune when users sign in with their Microsoft Entra ID credentials during Windows Autopilot. Option A (Enrollment Status Page) only affects the end-user experience during enrollment, it does not trigger enrollment. Option B (compliance policy) enforces compliance after enrollment, not enrollment itself. Option C (device enrollment restrictions) controls which platforms can enroll, not automatic enrollment.

Answer

Configure an Enrollment Status Page (ESP) profile in Intune.

Answer

Create a device compliance policy with the Action for noncompliance set to 'Enforce enrollment'.

Answer

Set device enrollment restrictions to allow all device platforms.

Question 8

Which THREE conditions must be met for a Windows 10 device to be co-managed with Microsoft Intune and Microsoft Configuration Manager? (Choose three.)

Accepted Answer

The device must be enrolled in Microsoft Intune.. Options A, B, and C are all required for co-management. A device must be enrolled in Intune (A) to enable cloud management authority. The Configuration Manager client must be installed (B) to maintain on-premises management. The device must be Azure AD joined or hybrid Azure AD joined (C) to enable identity and conditional access. Option D is incorrect because hybrid Azure AD join is not mandatory; Azure AD join alone suffices. Option E is incorrect because the Intune Management Extension is automatically installed when needed for Win32 app deployment; it is not a prerequisite for co-management.

Answer

The device must be hybrid Azure AD joined.

Answer

The device must have the Intune Management Extension installed.

Question 9

You are designing a Windows 10 update strategy using Windows Update for Business and Intune. Which THREE settings should you configure to ensure updates are delivered efficiently while minimizing user disruption?

Accepted Answer

Set active hours to prevent restarts during work.. To minimize user disruption while ensuring updates are delivered efficiently, you should configure active hours to prevent restarts during work hours, set a deadline for quality updates to enforce installation by a specific date, and specify a grace period after the deadline to give users additional time before mandatory reboots. Active hours define a window when the device will not restart, deadlines ensure updates are installed promptly, and grace periods provide flexibility after the deadline to avoid immediate reboots.

Answer

Enable Delivery Optimization for update distribution.

Answer

Configure a deferral period for driver updates.

Question 10

You need to provide remote assistance to a Windows 11 device managed by Intune. The user is not technically savvy. Which Intune feature should you use?

Accepted Answer

TeamViewer integration in Intune.. TeamViewer integration in Intune allows an IT admin to initiate a remote assistance session directly from the Intune admin center, without requiring the user to install additional software or share a session code. This is ideal for non-technical users because the admin can start the session, and the user only needs to accept a consent prompt on their device.

Answer

Company Portal.

Answer

Quick Assist.

Answer

Remote Desktop connection.

Question 11

You are an Intune administrator for a large enterprise that uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) for threat protection. You need to ensure that all Windows 10 devices are properly onboarded to Defender for Endpoint and that security settings are enforced via Intune. You have created a device configuration profile that includes the 'Microsoft Defender for Endpoint' settings, but some devices are not appearing in the Defender for Endpoint portal. You verify that the devices are Intune managed and enrolled. What should you do to ensure proper onboarding?

Accepted Answer

Deploy the Microsoft Defender for Endpoint onboarding package (WindowsDefenderATPOnboardingPackage.zip) via Intune using a PowerShell script or a device configuration profile.. Onboarding to Defender for Endpoint requires a specific deployment package (a .zip file containing the onboarding script) that must be deployed via Intune using a PowerShell script or a device configuration profile with the 'Microsoft Defender for Endpoint' template. However, the most common missing step is deploying the onboarding package. Option A is incorrect because co-management with Configuration Manager is not required for Defender for Endpoint onboarding; devices can be managed solely by Intune. Option C is incorrect because while a compliance policy can verify that Defender for Endpoint is active, it does not deploy the onboarding package required for initial onboarding. Option D is incorrect because Microsoft Entra ID registration is not the issue.

Answer

Ensure that the devices are co-managed with Configuration Manager.

Answer

Create a compliance policy that requires Defender for Endpoint to be active.

Answer

Register the devices in Microsoft Entra ID (Azure AD) as hybrid joined.

Question 12

Your organization uses Microsoft Intune to manage iOS and Android devices. You need to ensure that corporate data on these devices is protected. Specifically, you want to prevent users from copying corporate data from managed apps to personal apps. You also want to ensure that when a device is lost or stolen, the corporate data can be selectively wiped without affecting personal data. Which Intune feature should you use to achieve these requirements?

Accepted Answer

App Protection Policies (MAM).. App Protection Policies (MAM) provide data protection settings such as preventing copy/paste between managed and unmanaged apps, and allow selective wipe of corporate data. Option B is incorrect because device compliance policies focus on device-level settings, not app-level data protection. Option C is incorrect because conditional access policies control access based on compliance, but do not directly prevent copy/paste or provide selective wipe at the app level. Option D is incorrect because device configuration profiles configure device settings, not app data protection.

Answer

Device Compliance Policies.

Answer

Conditional Access Policies.

Answer

Device Configuration Profiles.

Question 13

Your organization manages Windows 10 and 11 devices using Microsoft Intune. Users report that after a recent update, the Microsoft Store for Business app 'Company Portal' fails to launch. You verify that the app is assigned as required to all devices. What should you do first to resolve the issue?

Accepted Answer

Trigger a device sync from the Microsoft Intune admin center.. The correct first step is to trigger a device sync from the Microsoft Intune admin center. This forces the affected devices to check in with Intune, which can push down any pending policy or app configuration updates that may have been missed after the recent Windows update. Since the Company Portal app is assigned as required, a sync ensures the device receives the latest app version or remediation actions without requiring a full reinstall.

Answer

Enable automatic updates for Company Portal in Intune.

Answer

Uninstall and reinstall Company Portal from all devices.

Answer

Run Windows Update troubleshooter on affected devices.

Question 14

You are designing a Windows 365 Cloud PC provisioning policy. The requirement is that when a user is assigned a Cloud PC, it must automatically have Microsoft Defender for Endpoint configured with real-time protection enabled and a custom firewall rule allowing only specific IPs. Which approach should you use?

Accepted Answer

Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.. Intune device configuration profiles using the Settings Catalog allow granular control over Microsoft Defender for Endpoint settings (e.g., real-time protection) and custom firewall rules. These profiles can be assigned to an Azure AD group containing Cloud PC users, ensuring the settings are applied automatically after provisioning via the Windows 365 service, which integrates with Intune for post-provisioning management.

Answer

Include the settings in the Windows 365 provisioning policy.

Answer

Create a PowerShell script that runs during provisioning and apply it via Azure Automation.

Answer

Use a Group Policy Object (GPO) applied via on-premises AD.

Question 15

A user's iOS device is enrolled in Microsoft Intune and is compliant. However, the user cannot access corporate email in the Outlook mobile app. The app displays an error that the device is not compliant. What is the most likely cause?

Accepted Answer

A compliance policy was updated requiring a newer OS version or additional security settings.. Intune compliance policies are evaluated in real time when a user attempts to access corporate resources. If an administrator updates a policy to require a newer iOS version or additional security settings (e.g., passcode complexity, encryption), the device may become non-compliant even if it was previously compliant. The Outlook app checks device compliance via the Intune SDK and will block access if the device no longer meets the policy requirements, displaying the 'device not compliant' error.

Answer

The user's Intune license has expired.

Answer

The Outlook app is not installed on the device.

Answer

The device is not enrolled in Intune.

Question 16

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a custom Line-of-Business (LOB) app that is signed with a certificate not trusted by the devices. The app must be available to users in the Company Portal. What should you do?

Accepted Answer

Upload the app as a LOB app in Intune and assign it to the target group.. Intune natively supports deploying signed Line-of-Business (LOB) apps directly to managed Windows devices, even if the signing certificate is not trusted by the devices. Intune handles the app delivery through the Company Portal, and the app will install as long as the device is enrolled and the app is assigned to the target group. The certificate trust issue is irrelevant for LOB app deployment via Intune because Intune does not validate the certificate chain for LOB apps; it only requires the app to be signed.

Answer

Upload the app to Microsoft Store for Business and assign it as offline.

Answer

Enable side-loading of apps on the target devices using Group Policy.

Answer

Convert the app to a .appx package and sign it with a trusted certificate.

Question 17

You need to ensure that Windows 10 devices in your organization receive the latest quality updates within 7 days of release. You configure a Windows Update for Business policy in Intune with a deferral period of 7 days. After two weeks, some devices have not installed the updates. What is the most likely reason?

Accepted Answer

Devices have not synced with Intune to receive the updated policy.. Windows Update for Business policies in Intune are not applied in real time; devices must check in with the Intune service to receive the updated policy. The default sync interval for Intune-managed Windows 10 devices is approximately 8 hours, and if a device has not synced since the policy was configured, it will not yet have the new deferral settings. This explains why some devices have not installed the updates even after two weeks, as they may have missed the sync window or have a longer check-in cycle.

Answer

The devices are configured to receive updates from WSUS instead of Windows Update.

Answer

The deferral period is too short; Microsoft recommends 14 days.

Answer

The policy is configured to apply only to devices in a specific Azure AD group.

Question 18

You are troubleshooting a Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is enrolled in Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The user can connect to other Wi-Fi networks. What is the most likely cause?

Accepted Answer

The root CA certificate required to validate the RADIUS server certificate is not installed on the device.. The device can connect to other Wi-Fi networks but not the corporate one, indicating the issue is specific to the corporate network's authentication requirements. Since the profile uses SCEP certificate authentication, the device must trust the root CA that issued the RADIUS server certificate to validate the server during the EAP-TLS handshake. If the root CA certificate is missing, the client will reject the RADIUS server certificate, causing the connection to fail. This is the most likely cause because the profile assignment and driver are not specific to this single network failure.

Answer

The user's password has expired.

Answer

The Wi-Fi profile is not assigned to the user's device.

Answer

The device's Wi-Fi adapter driver is outdated.

Question 19

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a configuration profile that enforces FileVault encryption. The profile must allow recovery key escrow to Intune. After deploying the profile, you notice that some devices are not encrypted. What should you check first?

Accepted Answer

Check if the user has logged in and acknowledged the FileVault prompt.. FileVault encryption on macOS requires user interaction to complete. When Intune deploys a FileVault profile with recovery key escrow, the user must log in and explicitly acknowledge the FileVault prompt to enable encryption. If the user has not done so, the device remains unencrypted regardless of the profile assignment.

Answer

Ensure that a compliance policy is also assigned requiring encryption.

Answer

Ensure the devices are supervised.

Answer

Verify that the profile is assigned to the correct device group.

Question 20

You need to implement a solution that automatically wipes a company-owned Windows 10 device when it has not connected to Intune for 30 days. Which Intune feature should you configure?

Accepted Answer

Compliance policy with a device health rule for 'Maximum days since last check-in' and a non-compliance action to retire the device.. A compliance policy can include a rule for 'Maximum days since last check-in' that marks the device non-compliant if it hasn’t connected for 30 days. You then configure a non-compliance action to retire the device, which triggers a wipe. Option A is wrong because a PowerShell script cannot reliably execute on a device that hasn’t connected to Intune for 30 days—it requires connectivity to run. Option C is wrong because device cleanup rules only remove stale device records from Intune, they do not trigger a wipe on the device. Option D is wrong because configuration profiles set settings but do not enforce check-in frequency or trigger wipe actions.

Answer

A PowerShell script that runs on the device to self-destruct after 30 days.

Answer

Device cleanup rules to automatically delete devices after 30 days.

Answer

Device configuration profile with a setting to require periodic check-in.