MD-102 Manage applications — 20 Questions

Question 1

Which TWO methods can you use to deploy a custom Windows app that is not available in the Microsoft Store to multiple devices managed by Intune?

Accepted Answer

Line-of-business app. Line-of-business (LOB) app deployment is correct because it allows you to upload and distribute custom Windows apps in .msi, .appx, or .intunewin format that are not in the Microsoft Store to Intune-managed devices. However, .exe files are not supported as LOB apps; they require Win32 app management. Win32 app management (option B) is also correct because it supports deploying .exe and .msi apps using the .intunewin wrapper, specifically designed for complex Win32 apps that are not in the Store.

Answer

Microsoft Store for Business app

Answer

Web app

Answer

Built-in app

Question 2

You are asked to recommend a solution for deploying a web application as an icon on users' Windows 10 devices managed by Intune. Which app type should you use?

Accepted Answer

Web link. A web link app in Intune creates a shortcut on the Windows 10 desktop or Start menu that opens a specified URL in the default browser. This is the correct choice because the requirement is to deploy an icon that launches a web application, not to install a binary or package. Web link apps are lightweight, require no installation, and are managed via Intune's 'Web link' app type under Windows apps.

Answer

Windows app (Win32)

Answer

Microsoft Store app

Answer

Built-in app

Question 3

A user reports that a required app is not installed on their Windows 11 device managed by Intune. The app appears in the Microsoft Intune admin center with a status of 'Pending - Install Pending'. You verify that the device is online and has network connectivity. What is the most likely cause?

Accepted Answer

The Intune Management Extension has not synced with the service yet.. The 'Pending - Install Pending' status indicates that Intune has successfully delivered the app assignment policy to the device, but the Intune Management Extension (IME) has not yet executed the installation. Since the device is online and has network connectivity, the most likely cause is that the IME has not synced with the Intune service to receive the actual installation instructions. The IME syncs periodically (every 24 hours by default, or on reboot/logon), and until it completes a sync, the app remains in this pending state. Options B, C, and D are incorrect: if the user were not targeted (B), the app would not appear with 'Pending' status; if the app were assigned as 'Available' (C), the status would show 'Available' rather than 'Pending - Install Pending'; and conditional access (D) does not affect app installation status.

Answer

The user is not targeted with the app assignment.

Answer

The app is assigned as 'Available' instead of 'Required'.

Answer

The device is not compliant with conditional access policies.

Question 4

A company uses Microsoft Intune to manage Windows devices. They want to ensure that only approved Microsoft Store apps can be installed on corporate devices. Which configuration policy should they use?

Accepted Answer

Windows app control policy. Windows app control policy in Microsoft Intune is specifically for Windows Defender Application Control (WDAC), which uses a base policy to allow only trusted apps. To restrict installation to only approved Microsoft Store apps, you can configure a WDAC policy with a base policy that only allows apps from the Microsoft Store. This policy blocks all other executables. Option B (sideloading policy) allows installation of non-Store apps, not restrict. Option C (Microsoft Store for Business app policy) is for managing deployment of Store apps, not controlling which apps can run. Option D (app inventory policy) is for reporting, not restricting.

Answer

Windows app sideloading policy

Answer

Microsoft Store for Business app policy

Answer

Windows app inventory policy

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. Which app deployment method should you use?

Accepted Answer

Windows app (sideloading). In Microsoft Intune, the 'Windows app (sideloading)' deployment method is specifically designed for deploying line-of-business (LOB) apps to Windows 10 devices. This method allows you to upload the app package and include the signing certificate. Intune will install the certificate on the device before installing the app, thereby ensuring the app can be installed even if the certificate was not previously trusted.

Answer

Microsoft Store for Business (MSFB) app

Answer

Web app

Answer

Line-of-business (LOB) app

Question 6

You are troubleshooting a Microsoft Intune app deployment for a Win32 app that is assigned as 'Available' to a user group. The user reports that the app does not appear in Company Portal. The user is a member of the assigned group. The device is enrolled and compliant. What should you check first?

Accepted Answer

Verify the user is in the correct Azure AD group.. The correct first step is to verify that the user is actually a member of the Azure AD group that the app is assigned to. Although the user reports membership, group membership may not have synced to Intune yet, or there might be a group membership caching issue. Company Portal relies on Intune's group membership evaluation to display available apps. Option D is incorrect because adding a Win32 app as a featured app only highlights it in Company Portal but is not required for visibility; available apps appear by default if the user is in the assigned group.

Answer

Review the app detection rules.

Answer

Confirm the app is assigned as 'Required' instead of 'Available'.

Answer

Check if the app is added to Company Portal as a featured app.

Question 7

Your organization uses Intune to manage macOS devices. You need to deploy a .pkg app. What must be done before uploading the app to Intune?

Accepted Answer

Use the Intune App Wrapping Tool for macOS. Pkg apps must be wrapped using the Intune App Wrapping Tool for macOS before uploading to Intune. Option A is incorrect because .pkg apps cannot be uploaded directly; they must be wrapped first. Option B is incorrect because the .intunemac format is the output of the Intune App Wrapping Tool, not a conversion of the package itself. Option D is incorrect because signing is not required before uploading; the Intune App Wrapping Tool handles signing if necessary.

Answer

Nothing, upload the .pkg directly

Answer

Convert the package to .intunemac format

Answer

Sign the package with an Apple Developer certificate

Question 8

You are a Microsoft 365 Endpoint Administrator for Contoso Ltd. The company has 2,000 Windows 11 devices enrolled in Microsoft Intune. You need to deploy a custom line-of-business (LOB) application (AppX package) to 500 devices used by the sales team. The app must be available in the Company Portal for users to install on demand, but it should also be automatically installed on devices that have not installed it within 7 days. Additionally, you want to ensure that the app is removed if a device is unenrolled from Intune. The sales team members are in a dynamic device group called 'Sales Devices' based on device category. You have the AppX package (.appxbundle) signed with a trusted certificate. You need to choose the correct deployment approach from the four options below.

Accepted Answer

Add as a Line-of-business app, assign to 'Sales Devices' group as 'Required', and also assign to the same group as 'Available' for Company Portal.. It uses a required assignment to the 'Sales Devices' device group, which ensures the LOB app is automatically installed on all devices in the group. Adding an additional 'Available' assignment makes the app visible in the Company Portal for on-demand installation. The required assignment also ensures the app is removed when a device is unenrolled from Intune. Option A is incorrect because the app is an AppX LOB app, not a Microsoft Store for Business app. Option C is incorrect because an 'Available' assignment with a deadline does not enforce automatic installation or removal on unenroll. Option D is incorrect because the app is an AppX package, not a Win32 app, and assigning to a user group instead of a device group would not target the correct devices.

Answer

Add as a Microsoft Store for Business (offline) app, assign to 'Sales Devices' group as 'Available', and configure deadline after 7 days.

Answer

Add as a Line-of-business app, assign to 'Sales Devices' group as 'Available', and configure 'Available for enrolled devices' with deadline after 7 days.

Answer

Add as a Windows app (Win32), assign to a user group containing sales users as 'Required', and set deadline to 7 days.

Question 9

Your company uses Microsoft Intune to manage Windows 10 and 11 devices. You have been asked to deploy a Microsoft 365 Apps for enterprise (formerly Office 365 ProPlus) configuration that includes Word, Excel, PowerPoint, and Outlook. The deployment must be assigned to a group of 200 devices that are not connected to the internet during initial setup; they will get updates from a local Distribution Point (DP) on the network. You have created a Win32 app using the Office Deployment Tool (ODT) with a configuration XML that specifies the products and updates source. Which additional step is necessary to ensure the installation succeeds without internet?

Accepted Answer

Include the SourcePath attribute in the configuration XML pointing to the local DP.. The Office Deployment Tool (ODT) configuration XML must include the SourcePath attribute pointing to the local Distribution Point (DP) so that devices without internet can access the installation files. Option A is incorrect because 'Allow devices to discover network content' is not a setting in Intune; devices need an explicit path. Option B is incorrect because the files are already hosted on the DP; downloading to each device defeats the purpose of using a DP. Option C is incorrect because the Office channel is set in the configuration XML, not in Intune app properties.

Answer

Enable the 'Allow devices to discover network content' setting in Intune.

Answer

Download the Office installation files to each device before deployment.

Answer

Set the Office channel to 'Current' in the Intune app properties.

Question 10

A company uses Microsoft Intune to manage iOS and Android devices. Users report that some line-of-business (LOB) apps fail to install with error '0x87D1041C'. The apps are signed and deployed as device-required installs. What is the most likely cause?

Accepted Answer

The app is signed with a different certificate than the one uploaded to Intune.. Error 0x87D1041C in Intune indicates a signature mismatch. When a line-of-business (LOB) app is deployed as a device-required install, the app binary must be signed with a certificate that has been uploaded to the Intune console. If the signing certificate used to sign the app differs from the one uploaded, Intune rejects the installation because it cannot verify the app's integrity and trust chain.

Answer

The user is not assigned to the app deployment.

Answer

The app is not compliant with the device's OS version.

Answer

The device does not have the required app configuration policy.

Question 11

An organization uses Microsoft Intune for Windows 10 device management. They need to deploy a custom Windows app (.exe) to kiosk devices. The app requires admin privileges to install, and the devices are shared. Which deployment method should be used?

Accepted Answer

Use a Win32 app with install context set to 'system'.. Win32 apps in Microsoft Intune can be configured with the install context set to 'system', which grants the necessary admin privileges for installation and ensures the app is installed for all users on shared kiosk devices. This method uses the Intune Management Extension to run the installer with SYSTEM account privileges, bypassing user-level restrictions and supporting per-machine installations.

Answer

Assign the app as 'available' for user-install.

Answer

Deploy as a line-of-business app with device context.

Answer

Package as a Microsoft Store for Business app.

Question 12

You manage a fleet of Android Enterprise devices. You need to ensure that only approved apps from the managed Play Store can be installed. What configuration should you enable?

Accepted Answer

Configure a device restriction policy to allow only managed Google Play apps.. A device restriction policy in Microsoft Intune allows you to restrict app installation to only the managed Google Play store. By configuring the 'Allow only managed Google Play apps' setting, you ensure that users cannot install apps from unapproved sources, effectively controlling the app ecosystem on Android Enterprise devices.

Answer

Set the device to 'Fully managed' and disable unknown sources.

Answer

Deploy an app configuration policy that blocks sideloading.

Answer

Use a compliance policy to block non-compliant apps.

Question 13

A company uses Microsoft Intune to manage Windows 10 devices. They deployed a Win32 app as 'required' but some devices show 'pending install'. The app is configured with a detection rule that checks for a registry key. What should you check first?

Accepted Answer

Check if the detection rule is incorrectly marking the app as installed.. The most common reason for a 'pending install' status when a detection rule is configured is that the rule is incorrectly detecting the app as already installed. Intune evaluates the detection rule before attempting installation; if the rule finds the registry key (even if the app is not fully functional), Intune skips the installation and reports 'pending' or 'installed' without actually deploying the app. This is a frequent misconfiguration where the detection rule is too broad or references a key that exists from a previous installation or unrelated software.

Answer

Increase the app installation timeout.

Answer

Ensure the device has connectivity to Intune.

Answer

Reassign the app to a different security group.

Question 14

You need to deploy a Microsoft 365 Apps for enterprise suite to Windows 10 devices using Intune. Users are unlicensed. How should you proceed?

Accepted Answer

Create a Win32 app package for Microsoft 365 Apps and deploy it.. When users are unlicensed, the Microsoft 365 Apps for enterprise suite cannot be deployed via the built-in Intune app type (which relies on license activation). Creating a Win32 app package allows you to bundle the Office Deployment Tool (ODT) with a configuration XML that sets the product ID to 'O365ProPlusRetail' and disables automatic licensing checks, enabling deployment to unlicensed devices.

Answer

Deploy the suite as 'available' from Company Portal.

Answer

Use the built-in Microsoft 365 Apps (Office) app type in Intune.

Answer

Assign the Office 365 E3 license to all users.

Question 15

Which THREE conditions must be met for an iOS line-of-business app to be successfully installed via Intune?

Accepted Answer

The app must be assigned to a security group.. For an iOS line-of-business (LOB) app to be successfully installed via Intune, three conditions must be met. First, the app must be assigned to a security group (A) because Intune targets app deployments to groups; without assignment the app will not be installed. Second, the app must be signed with an Apple Developer Enterprise Distribution certificate (B) to be trusted by devices without individual Apple approval. Third, the app must be uploaded as a .ipa file (D), which is the required package format for iOS LOB apps. Option C is incorrect because registering the device UDID with Apple Business Manager is not a requirement for LOB app installation; it is used for device enrollment and supervision. Option E is incorrect because an active Apple ID is not needed for enterprise-distributed LOB apps.

Answer

The device UDID must be registered with Apple Business Manager.

Answer

The user must have an active Apple ID.

Question 16

A Win32 app 'AdobeReader' is configured as 'required' but users report the app is not installed. The above log excerpt is from a device that shows 'Installed' in Intune. What is the most likely cause?

Accepted Answer

The detection script incorrectly reports the app as installed.. The log excerpt indicates that Intune reports the app as 'Installed' on the device, yet users confirm it is not present. This discrepancy most likely occurs because the detection script used to verify installation is flawed—it may be checking for a registry key, file, or version string that exists even when the app is not fully installed, or it may be returning a false positive. Since Intune relies entirely on the detection method to determine installation status, an incorrect script would cause Intune to mark the app as installed without the actual binaries being present.

Answer

The app is assigned to a different device group.

Answer

The app was installed but later removed by the user.

Answer

The device is not syncing with Intune.

Question 17

You configured the above app protection policy for a Microsoft 365 app. Users report that they cannot paste text from the managed app into another app. What is the most likely reason?

Accepted Answer

The 'dataTransferPolicy' is set to 'allowNone', which prevents data from leaving the managed app.. The 'dataTransferPolicy' setting controls how data can be transferred between managed and unmanaged apps. When set to 'allowNone', it prevents any data from leaving the managed app, including paste operations from the managed app into another app. This is the most direct cause of the reported issue.

Answer

The 'pinLength' requirement is not met.

Answer

The 'requireBiometric' setting is blocking actions.

Answer

The 'allowCutCopy' setting is set to false, which blocks copy, but paste is unaffected.

Question 18

A company uses Microsoft Intune to manage Windows 10 devices. Users report that a LOB app deployed as a required install fails to install on some devices. The app is configured with a dependency on another app. What should the administrator verify first?

Accepted Answer

Check if the dependency app is assigned and installed successfully. When a required LOB app fails to install, the most common cause is that its dependency app is not present or not successfully installed on the target device. Intune enforces dependency apps to be installed before the parent app, and if the dependency is missing or failed, the parent app installation will not proceed. The administrator should first verify that the dependency app is assigned to the same device groups and has a successful installation status.

Answer

Ensure the devices have internet connectivity

Answer

Verify that the app is signed with a trusted certificate

Answer

Recreate the deployment policy

Question 19

An organization is moving from on-premises SCCM to Microsoft Intune for Windows app management. They need to ensure that users can self-install company portal apps without administrator intervention. Which configuration is required?

Accepted Answer

Assign the app to users as 'Available' in the Company Portal. The 'Available' assignment type in Microsoft Intune allows users to install apps on demand from the Company Portal without requiring administrator intervention. This configuration meets the requirement for self-service installation while respecting user intent, as opposed to forced installations.

Answer

Configure the app as 'Required' for all users

Answer

Add the app to the Windows Autopilot deployment profile

Answer

Grant users local administrator rights on their devices

Question 20

An administrator deploys a Win32 app via Intune with detection rule 'File exists: C:\Program Files\MyApp\app.exe'. The app is reported as installed, but users cannot launch it. The file exists but is corrupted. How should the administrator modify the detection rule to ensure the app is correctly detected and re-installed if corrupted?

Accepted Answer

Use a custom detection script that validates the file hash or signature. A custom detection script can verify the file's integrity by checking its hash or digital signature, ensuring that even if the file exists, it is not corrupted. Intune's built-in detection rules only check for file existence or version, not file integrity. By using a script that validates the hash, the administrator can force a reinstall when the file is corrupted, as the detection will fail.

Answer

Remove the detection rule so Intune always re-installs the app

Answer

Add a registry detection rule for the app's uninstall key

Answer

Change detection rule to 'File version comparison' and set minimum version