MD-102 Manage and maintain devices — 40 Questions

Question 1

Your organization manages Windows 10 and 11 devices using Microsoft Intune. Users report that after a recent update, the Microsoft Store for Business app 'Company Portal' fails to launch. You verify that the app is assigned as required to all devices. What should you do first to resolve the issue?

Accepted Answer

Trigger a device sync from the Microsoft Intune admin center.. The correct first step is to trigger a device sync from the Microsoft Intune admin center. This forces the affected devices to check in with Intune, which can push down any pending policy or app configuration updates that may have been missed after the recent Windows update. Since the Company Portal app is assigned as required, a sync ensures the device receives the latest app version or remediation actions without requiring a full reinstall.

Answer

Enable automatic updates for Company Portal in Intune.

Answer

Uninstall and reinstall Company Portal from all devices.

Answer

Run Windows Update troubleshooter on affected devices.

Question 2

You are designing a Windows 365 Cloud PC provisioning policy. The requirement is that when a user is assigned a Cloud PC, it must automatically have Microsoft Defender for Endpoint configured with real-time protection enabled and a custom firewall rule allowing only specific IPs. Which approach should you use?

Accepted Answer

Create an Intune device configuration profile using the Settings Catalog and assign it to the Azure AD group containing Cloud PC users.. Option A is correct because Intune device configuration profiles using the Settings Catalog allow granular control over Microsoft Defender for Endpoint settings (e.g., real-time protection) and custom firewall rules. These profiles can be assigned to an Azure AD group containing Cloud PC users, ensuring the settings are applied automatically after provisioning via the Windows 365 service, which integrates with Intune for post-provisioning management.

Answer

Include the settings in the Windows 365 provisioning policy.

Answer

Create a PowerShell script that runs during provisioning and apply it via Azure Automation.

Answer

Use a Group Policy Object (GPO) applied via on-premises AD.

Question 3

A user's iOS device is enrolled in Microsoft Intune and is compliant. However, the user cannot access corporate email in the Outlook mobile app. The app displays an error that the device is not compliant. What is the most likely cause?

Accepted Answer

A compliance policy was updated requiring a newer OS version or additional security settings.. Option C is correct because Intune compliance policies are evaluated in real time when a user attempts to access corporate resources. If an administrator updates a policy to require a newer iOS version or additional security settings (e.g., passcode complexity, encryption), the device may become non-compliant even if it was previously compliant. The Outlook app checks device compliance via the Intune SDK and will block access if the device no longer meets the policy requirements, displaying the 'device not compliant' error.

Answer

The user's Intune license has expired.

Answer

The Outlook app is not installed on the device.

Answer

The device is not enrolled in Intune.

Question 4

Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a custom Line-of-Business (LOB) app that is signed with a certificate not trusted by the devices. The app must be available to users in the Company Portal. What should you do?

Accepted Answer

Upload the app as a LOB app in Intune and assign it to the target group.. Option C is correct because Intune natively supports deploying signed Line-of-Business (LOB) apps directly to managed Windows devices, even if the signing certificate is not trusted by the devices. Intune handles the app delivery through the Company Portal, and the app will install as long as the device is enrolled and the app is assigned to the target group. The certificate trust issue is irrelevant for LOB app deployment via Intune because Intune does not validate the certificate chain for LOB apps; it only requires the app to be signed.

Answer

Upload the app to Microsoft Store for Business and assign it as offline.

Answer

Enable side-loading of apps on the target devices using Group Policy.

Answer

Convert the app to a .appx package and sign it with a trusted certificate.

Question 5

You need to ensure that Windows 10 devices in your organization receive the latest quality updates within 7 days of release. You configure a Windows Update for Business policy in Intune with a deferral period of 7 days. After two weeks, some devices have not installed the updates. What is the most likely reason?

Accepted Answer

Devices have not synced with Intune to receive the updated policy.. Option D is correct because Windows Update for Business policies in Intune are not applied in real time; devices must check in with the Intune service to receive the updated policy. The default sync interval for Intune-managed Windows 10 devices is approximately 8 hours, and if a device has not synced since the policy was configured, it will not yet have the new deferral settings. This explains why some devices have not installed the updates even after two weeks, as they may have missed the sync window or have a longer check-in cycle.

Answer

The devices are configured to receive updates from WSUS instead of Windows Update.

Answer

The deferral period is too short; Microsoft recommends 14 days.

Answer

The policy is configured to apply only to devices in a specific Azure AD group.

Question 6

You are troubleshooting a Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is enrolled in Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The user can connect to other Wi-Fi networks. What is the most likely cause?

Accepted Answer

The root CA certificate required to validate the RADIUS server certificate is not installed on the device.. The device can connect to other Wi-Fi networks but not the corporate one, indicating the issue is specific to the corporate network's authentication requirements. Since the profile uses SCEP certificate authentication, the device must trust the root CA that issued the RADIUS server certificate to validate the server during the EAP-TLS handshake. If the root CA certificate is missing, the client will reject the RADIUS server certificate, causing the connection to fail. This is the most likely cause because the profile assignment and driver are not specific to this single network failure.

Answer

The user's password has expired.

Answer

The Wi-Fi profile is not assigned to the user's device.

Answer

The device's Wi-Fi adapter driver is outdated.

Question 7

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a configuration profile that enforces FileVault encryption. The profile must allow recovery key escrow to Intune. After deploying the profile, you notice that some devices are not encrypted. What should you check first?

Accepted Answer

Check if the user has logged in and acknowledged the FileVault prompt.. Option A is correct because FileVault encryption on macOS requires user interaction to complete. When Intune deploys a FileVault profile with recovery key escrow, the user must log in and explicitly acknowledge the FileVault prompt to enable encryption. If the user has not done so, the device remains unencrypted regardless of the profile assignment.

Answer

Ensure that a compliance policy is also assigned requiring encryption.

Answer

Ensure the devices are supervised.

Answer

Verify that the profile is assigned to the correct device group.

Question 8

You need to implement a solution that automatically wipes a company-owned Windows 10 device when it has not connected to Intune for 30 days. Which Intune feature should you configure?

Accepted Answer

Compliance policy with a device health rule for 'Maximum days since last check-in' and a non-compliance action to retire the device.. Option B is correct because a compliance policy can mark a device as non-compliant if it hasn't checked in for a specified period, and then a conditional access policy can block access. However, automatic wipe is not automatic; you can configure a non-compliance action to retire or wipe. Option A is wrong because configuration profiles don't enforce check-in. Option C is wrong because device cleanup is for stale records, not automatic wipe. Option D is wrong because scripts don't run on disconnected devices.

Answer

A PowerShell script that runs on the device to self-destruct after 30 days.

Answer

Device cleanup rules to automatically delete devices after 30 days.

Answer

Device configuration profile with a setting to require periodic check-in.

Question 9

A user reports that after resetting their Windows 10 device, they cannot re-enroll it in Intune. The device appears as 'Pending' in the admin center. What is the most likely reason?

Accepted Answer

The device has a stale record in Intune that needs to be deleted.. When a Windows 10 device is reset, its existing Intune enrollment record becomes stale. The device attempts to re-enroll but the old record causes a conflict, leaving the device in a 'Pending' state in the admin center. Deleting the stale device record from Intune allows the enrollment to complete successfully.

Answer

The user is trying to enroll with a different Azure AD account.

Answer

The MDM authority is not set to Intune.

Answer

The user does not have an Intune license assigned.

Question 10

Which TWO actions can you take to improve the performance of Microsoft Intune management for Windows devices that are geographically distributed and have limited bandwidth?

Accepted Answer

Enable Delivery Optimization to use peer-to-peer sharing within the same network.. Options A and D are correct. Option A reduces data transfer by using delta updates. Option D reduces network load by using delivery optimization. Option B is wrong because more frequent sync increases network usage. Option C is wrong because it does not affect bandwidth. Option E is wrong because Peer Cache uses local peers, not internet.

Answer

Deploy a Configuration Manager site server at each location to act as a peer cache.

Answer

Increase the frequency of device sync intervals to ensure policies are applied quickly.

Answer

Disable Windows Defender real-time scanning on devices.

Question 11

Which THREE conditions must be met for a Windows 10 device to be able to use Windows Autopilot self-deploying mode?

Accepted Answer

The device must be Azure AD joined.. Azure AD join is required for self-deploying mode because this mode provisions a device for shared or kiosk scenarios without user interaction. The device must be joined to Azure AD to establish a device identity and allow policy application before any user signs in, which is a core requirement for the zero-touch provisioning flow.

Answer

The device must be Hybrid Azure AD joined.

Answer

A user must be assigned to the device in Autopilot.

Question 12

Which TWO methods can you use to deploy Microsoft 365 Apps to Windows 10 devices managed by Intune?

Accepted Answer

Use the Microsoft 365 Apps (Windows) app type in Intune.. Option A is correct because the 'Microsoft 365 Apps (Windows)' app type in Intune is a built-in deployment method specifically designed to install Office 365 ProPlus (now Microsoft 365 Apps) on managed Windows 10 devices. It allows you to select the installation channel, language, and update settings directly from the Intune console without needing external tools.

Answer

Use the Office Deployment Tool wrapped as a Win32 app.

Answer

Use Group Policy to assign Office installation.

Answer

Deploy the Microsoft Store version of Office.

Question 13

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running OS version 10.0.22621.100. The device has a password set, firewall active, and Defender enabled. However, the device is marked as non-compliant. What is the most likely reason?

Accepted Answer

The OS version exceeds the maximum allowed version specified in the policy.. The device OS version 10.0.22621.100 exceeds the maximum OS version specified in the policy (10.0.22621.0). In Microsoft Intune compliance policies, the 'Maximum OS version' setting marks a device as non-compliant if the device's OS build number is greater than the specified value, even if all other conditions are met. This is a common configuration to prevent devices from running untested or incompatible OS builds.

Answer

The password length is exactly 8 characters, but the policy requires more than 8.

Answer

Microsoft Defender is not at the required version 4.18.2207.7.

Answer

The device does not have a password set.

Question 14

Refer to the exhibit. You run this PowerShell command to retrieve Windows devices. The output shows several devices with lastSyncDateTime older than 30 days and complianceState as 'noncompliant'. What is the most likely cause for these devices to be noncompliant?

Accepted Answer

The compliance policy includes a rule for 'Maximum days since last check-in' and these devices exceeded that limit.. Option A is correct because compliance policy requires devices to check in periodically; if they haven't synced in 30 days, they may be marked noncompliant due to a 'last check-in' rule. Option B is wrong because device name does not affect compliance. Option C is wrong because the command filters for Windows. Option D is wrong because there is no evidence of enrollment failure.

Answer

The devices failed to enroll properly.

Answer

The devices are running a non-Windows operating system.

Answer

The devices have names that do not match the naming convention.

Question 15

Refer to the exhibit. You apply this device configuration profile to a group of Windows 10 devices. Users report that they receive update notifications outside of active hours. Which setting should you modify to suppress notifications during active hours?

Accepted Answer

Set updateNotificationLevel to 'turnOffAllNotifications'.. The setting updateNotificationLevel controls whether Windows Update displays notifications to users. Setting it to 'turnOffAllNotifications' suppresses all update notifications, including those that appear outside of active hours. This is the correct configuration to prevent users from seeing update notifications during active hours.

Answer

Modify activeHoursStart and activeHoursEnd to cover the full day.

Answer

Set cloudBlockLevel to 'normal'.

Answer

Set detectionFrequency to a higher value.

Question 16

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, some devices are no longer receiving compliance policies. You verify that the devices are enrolled and show as active in Intune. What should you check first?

Accepted Answer

Verify that the compliance policy is assigned to the correct Windows version.. Option B is correct because the compliance policy may not have been updated to target the new Windows version after the update. Option A is wrong because connectivity issues would affect all policies, not just compliance. Option C is wrong because if the device is enrolled and active, the enrollment record is intact. Option D is wrong because compliance policies are not tied to user group membership in this scenario.

Answer

Check if the devices can connect to the Intune service.

Answer

Ensure the users are members of the correct Azure AD group.

Answer

Re-enroll the devices in Intune.

Question 17

A company uses Microsoft Intune to manage iOS devices. They need to ensure that corporate data on these devices is protected if a device is lost or stolen. The solution must allow users to continue using personal apps and data after a selective wipe. What should they configure?

Accepted Answer

Initiate a selective wipe from the Intune console.. Option A is correct because a selective wipe from the Intune console removes only corporate data (e.g., managed apps, email profiles, VPN configurations) while preserving personal apps and data on the iOS device. This meets the requirement of protecting corporate data on a lost or stolen device without affecting the user's personal content. Intune uses the iOS Management Profile and the built-in selective wipe capability that targets only the MDM-managed corporate partition.

Answer

Configure a full wipe action in a compliance policy.

Answer

Use Remote Lock from the Intune console.

Answer

Create a device compliance policy that marks the device as noncompliant.

Question 18

You are managing Windows 10 devices with Intune. You need to deploy a PowerShell script that runs under the system context during device enrollment. Which approach should you use?

Accepted Answer

Upload the script as a PowerShell script in Intune and assign it to the device group.. Option D is correct because Intune's 'PowerShell scripts' feature allows you to upload and assign scripts that run under the system context during device enrollment, specifically targeting devices in a group. This is the only native Intune method that executes scripts in the system context at enrollment time without additional configuration.

Answer

Deploy the script as a proactive remediation.

Answer

Use a device compliance policy to trigger the script.

Answer

Create a custom configuration profile to run the script.

Question 19

Your organization uses Microsoft Defender for Endpoint (Microsoft Defender XDR). You need to ensure that all Windows 10 devices report their security health to Microsoft Defender for Endpoint. Some devices are showing as inactive. What is the most likely cause?

Accepted Answer

The Microsoft Defender for Endpoint sensor is not installed or configured correctly.. The Microsoft Defender for Endpoint sensor is the core component that collects and reports security telemetry from Windows 10 devices to the Defender for Endpoint cloud service. If the sensor is not installed, is missing, or is misconfigured (e.g., due to a corrupted installation or incorrect onboarding script), the device will appear as inactive in the Microsoft 365 Defender portal, even if the device is otherwise healthy and connected.

Answer

The devices are not enrolled in Microsoft Intune.

Answer

The devices are not compliant with conditional access policies.

Answer

The devices have lost connectivity to the internet.

Question 20

A company uses Microsoft Intune to manage Windows 10 devices with a hybrid Azure AD join configuration. Users report that they are unable to access corporate resources on their devices. You verify that the devices are enrolled and that compliance policies are applied. What should you check next?

Accepted Answer

Verify that the devices can communicate with an on-premises domain controller.. In a hybrid Azure AD join configuration, devices must be able to communicate with an on-premises domain controller to authenticate and obtain Kerberos tickets for accessing corporate resources. Even if Intune enrollment and compliance policies are applied, a loss of connectivity to the domain controller (e.g., due to network changes or DNS issues) will prevent resource access. This is the most likely cause given that enrollment and compliance are verified as working.

Answer

Check the certificate profile assigned to the devices.

Answer

Ensure the devices have a VPN connection to the corporate network.

Answer

Review the conditional access policies for the users.