MD-102 Manage applications — 50 Questions

Question 1

A company uses Microsoft Intune to manage iOS and Android devices. Users report that some line-of-business (LOB) apps fail to install with error '0x87D1041C'. The apps are signed and deployed as device-required installs. What is the most likely cause?

Accepted Answer

The app is signed with a different certificate than the one uploaded to Intune.. Error 0x87D1041C in Intune indicates a signature mismatch. When a line-of-business (LOB) app is deployed as a device-required install, the app binary must be signed with a certificate that has been uploaded to the Intune console. If the signing certificate used to sign the app differs from the one uploaded, Intune rejects the installation because it cannot verify the app's integrity and trust chain.

Answer

The user is not assigned to the app deployment.

Answer

The app is not compliant with the device's OS version.

Answer

The device does not have the required app configuration policy.

Question 2

An organization uses Microsoft Intune for Windows 10 device management. They need to deploy a custom Windows app (.exe) to kiosk devices. The app requires admin privileges to install, and the devices are shared. Which deployment method should be used?

Accepted Answer

Use a Win32 app with install context set to 'system'.. Option A is correct because Win32 apps in Microsoft Intune can be configured with the install context set to 'system', which grants the necessary admin privileges for installation and ensures the app is installed for all users on shared kiosk devices. This method uses the Intune Management Extension to run the installer with SYSTEM account privileges, bypassing user-level restrictions and supporting per-machine installations.

Answer

Assign the app as 'available' for user-install.

Answer

Deploy as a line-of-business app with device context.

Answer

Package as a Microsoft Store for Business app.

Question 3

You manage a fleet of Android Enterprise devices. You need to ensure that only approved apps from the managed Play Store can be installed. What configuration should you enable?

Accepted Answer

Configure a device restriction policy to allow only managed Google Play apps.. Option C is correct because a device restriction policy in Microsoft Intune allows you to restrict app installation to only the managed Google Play store. By configuring the 'Allow only managed Google Play apps' setting, you ensure that users cannot install apps from unapproved sources, effectively controlling the app ecosystem on Android Enterprise devices.

Answer

Set the device to 'Fully managed' and disable unknown sources.

Answer

Deploy an app configuration policy that blocks sideloading.

Answer

Use a compliance policy to block non-compliant apps.

Question 4

A company uses Microsoft Intune to manage Windows 10 devices. They deployed a Win32 app as 'required' but some devices show 'pending install'. The app is configured with a detection rule that checks for a registry key. What should you check first?

Accepted Answer

Check if the detection rule is incorrectly marking the app as installed.. Option D is correct because the most common reason for a 'pending install' status when a detection rule is configured is that the rule is incorrectly detecting the app as already installed. Intune evaluates the detection rule before attempting installation; if the rule finds the registry key (even if the app is not fully functional), Intune skips the installation and reports 'pending' or 'installed' without actually deploying the app. This is a frequent misconfiguration where the detection rule is too broad or references a key that exists from a previous installation or unrelated software.

Answer

Increase the app installation timeout.

Answer

Ensure the device has connectivity to Intune.

Answer

Reassign the app to a different security group.

Question 5

You need to deploy a Microsoft 365 Apps for enterprise suite to Windows 10 devices using Intune. Users are unlicensed. How should you proceed?

Accepted Answer

Create a Win32 app package for Microsoft 365 Apps and deploy it.. Option D is correct because when users are unlicensed, the Microsoft 365 Apps for enterprise suite cannot be deployed via the built-in Intune app type (which relies on license activation). Creating a Win32 app package allows you to bundle the Office Deployment Tool (ODT) with a configuration XML that sets the product ID to 'O365ProPlusRetail' and disables automatic licensing checks, enabling deployment to unlicensed devices.

Answer

Deploy the suite as 'available' from Company Portal.

Answer

Use the built-in Microsoft 365 Apps (Office) app type in Intune.

Answer

Assign the Office 365 E3 license to all users.

Question 6

Which TWO methods can you use to deploy a custom Windows app that is not available in the Microsoft Store to multiple devices managed by Intune?

Accepted Answer

Line-of-business app. Line-of-business (LOB) app deployment is correct because it allows you to upload and distribute custom Windows apps (e.g., .msi, .appx, or .exe) that are not in the Microsoft Store to Intune-managed devices. This method is specifically designed for internal or third-party apps that are not publicly available, using Intune's app packaging and assignment capabilities.

Answer

Microsoft Store for Business app

Answer

Web app

Answer

Built-in app

Question 7

Which THREE conditions must be met for an iOS line-of-business app to be successfully installed via Intune?

Accepted Answer

The app must be signed with an Apple Developer Enterprise Distribution certificate.. Option B is correct because iOS line-of-business (LOB) apps distributed outside the App Store must be signed with an Apple Developer Enterprise Distribution certificate to be trusted by the device. This certificate allows the app to run without being individually approved by Apple, which is required for Intune-managed enterprise deployment. Without this signing, the device will reject the installation due to code signing validation failures.

Answer

The app must be assigned to a security group.

Answer

The user must have an active Apple ID.

Question 8

A Win32 app 'AdobeReader' is configured as 'required' but users report the app is not installed. The above log excerpt is from a device that shows 'Installed' in Intune. What is the most likely cause?

Accepted Answer

The detection script incorrectly reports the app as installed.. The log excerpt indicates that Intune reports the app as 'Installed' on the device, yet users confirm it is not present. This discrepancy most likely occurs because the detection script used to verify installation is flawed—it may be checking for a registry key, file, or version string that exists even when the app is not fully installed, or it may be returning a false positive. Since Intune relies entirely on the detection method to determine installation status, an incorrect script would cause Intune to mark the app as installed without the actual binaries being present.

Answer

The app is assigned to a different device group.

Answer

The app was installed but later removed by the user.

Answer

The device is not syncing with Intune.

Question 9

You configured the above app protection policy for a Microsoft 365 app. Users report that they cannot paste text from the managed app into another app. What is the most likely reason?

Accepted Answer

The 'dataTransferPolicy' is set to 'allowNone', which prevents data from leaving the managed app.. The 'dataTransferPolicy' setting controls how data can be transferred between managed and unmanaged apps. When set to 'allowNone', it prevents any data from leaving the managed app, including paste operations from the managed app into another app. This is the most direct cause of the reported issue.

Answer

The 'pinLength' requirement is not met.

Answer

The 'requireBiometric' setting is blocking actions.

Answer

The 'allowCutCopy' setting is set to false, which blocks copy, but paste is unaffected.

Question 10

A company uses Microsoft Intune to manage Windows 10 devices. Users report that a LOB app deployed as a required install fails to install on some devices. The app is configured with a dependency on another app. What should the administrator verify first?

Accepted Answer

Check if the dependency app is assigned and installed successfully. Option D is correct because when a required LOB app fails to install, the most common cause is that its dependency app is not present or not successfully installed on the target device. Intune enforces dependency apps to be installed before the parent app, and if the dependency is missing or failed, the parent app installation will not proceed. The administrator should first verify that the dependency app is assigned to the same device groups and has a successful installation status.

Answer

Ensure the devices have internet connectivity

Answer

Verify that the app is signed with a trusted certificate

Answer

Recreate the deployment policy

Question 11

An organization is moving from on-premises SCCM to Microsoft Intune for Windows app management. They need to ensure that users can self-install company portal apps without administrator intervention. Which configuration is required?

Accepted Answer

Assign the app to users as 'Available' in the Company Portal. Option D is correct because the 'Available' assignment type in Microsoft Intune allows users to install apps on demand from the Company Portal without requiring administrator intervention. This configuration meets the requirement for self-service installation while respecting user intent, as opposed to forced installations.

Answer

Configure the app as 'Required' for all users

Answer

Add the app to the Windows Autopilot deployment profile

Answer

Grant users local administrator rights on their devices

Question 12

An administrator deploys a Win32 app via Intune with detection rule 'File exists: C:\Program Files\MyApp\app.exe'. The app is reported as installed, but users cannot launch it. The file exists but is corrupted. How should the administrator modify the detection rule to ensure the app is correctly detected and re-installed if corrupted?

Accepted Answer

Use a custom detection script that validates the file hash or signature. Option C is correct because a custom detection script can verify the file's integrity by checking its hash or digital signature, ensuring that even if the file exists, it is not corrupted. Intune's built-in detection rules only check for file existence or version, not file integrity. By using a script that validates the hash, the administrator can force a reinstall when the file is corrupted, as the detection will fail.

Answer

Remove the detection rule so Intune always re-installs the app

Answer

Add a registry detection rule for the app's uninstall key

Answer

Change detection rule to 'File version comparison' and set minimum version

Question 13

A company wants to deploy Microsoft 365 Apps for enterprise to Windows 10 devices using Intune. They need to ensure that the apps are updated automatically from the Office Content Delivery Network (CDN). Which update channel should they select in the Office app deployment configuration?

Accepted Answer

Monthly Enterprise Channel. The Monthly Enterprise Channel is the correct choice because it provides a predictable, once-per-month update cadence with security and quality updates, and it is designed for enterprise environments that require automatic updates from the Office Content Delivery Network (CDN) via Intune. This channel balances receiving new features sooner than the Semi-Annual Enterprise Channel while still offering managed deployment through configuration profiles.

Answer

Semi-Annual Enterprise Channel

Answer

Current Channel

Answer

Insider Channel

Question 14

An administrator deploys an iOS app as 'Required' to a group of devices using Intune. The app fails to install on some devices with error '0x87D13B9F'. What is the most likely cause?

Accepted Answer

The devices are not supervised. Error 0x87D13B9F in Intune indicates that the device is not supervised. For iOS/iPadOS, Intune requires devices to be in Supervised mode to install 'Required' apps silently without user interaction. Without supervision, the device cannot accept managed app installations pushed by MDM, causing the deployment to fail.

Answer

The devices have insufficient storage space

Answer

The app is not compatible with the iOS version on those devices

Answer

The app is not signed with an Apple Enterprise Developer certificate

Question 15

A company is planning to deploy a custom Win32 app to Windows 10 devices using Intune. The app requires a .NET Framework 4.8 prerequisite. Which TWO methods can the administrator use to ensure the prerequisite is installed?

Accepted Answer

Add the prerequisite as a dependency in the app deployment. Option C is correct because Intune Win32 app deployment supports dependencies, allowing an administrator to specify .NET Framework 4.8 as a required dependency. When configured, Intune automatically installs the dependency before the main app, ensuring the prerequisite is present without manual intervention or additional scripting.

Answer

Require users to manually install the prerequisite

Answer

Use Group Policy to deploy the prerequisite

Answer

Package the prerequisite into the same Win32 app

Question 16

An administrator uses Intune to deploy a line-of-business (LOB) app for Android. The app is failing to install on some devices. The administrator reviews the Intune management extension logs and sees error 'Device not compliant with app configuration policy'. Which THREE conditions could cause this error?

Accepted Answer

The device is not enrolled in Android Enterprise work profile. Option A is correct because the 'Device not compliant with app configuration policy' error occurs when an Android Enterprise work profile is required for the app's deployment but the device lacks this enrollment. Intune uses app configuration policies to enforce settings like work profile enrollment; if the device is not enrolled in a work profile, the policy cannot be applied, causing the installation to fail.

Answer

The app was previously installed and then uninstalled

Answer

The Company Portal app is not installed on the device

Question 17

An administrator is troubleshooting why a Win32 app is repeatedly installed on a device. The exhibit shows a log snippet. What is the most likely cause of the repeated installation?

Accepted Answer

The app writes the detection file to a temporary folder that is cleaned periodically. Option A is correct because if the Win32 app's detection file is written to a temporary folder (e.g., %TEMP% or C:\Windows\Temp) that is periodically cleaned by disk cleanup policies or the Storage Sense feature, Intune will no longer detect the app as installed after the file is removed. This causes the Microsoft Intune Management Extension to re-run the installation on the next sync cycle, leading to a repeated installation loop. The detection rule relies on the persistent presence of the file, so its removal triggers reinstallation.

Answer

The app requires a reboot to complete installation

Answer

The detection rule runs before the install completes

Answer

The exit code 0 is misinterpreted as failure

Question 18

An Android device running OS version 9.0 with app version 1.5.0 is targeted by the app protection policy in the exhibit. What is the expected behavior when the user tries to access work data?

Accepted Answer

Access is allowed with a warning to update the app and OS. The app protection policy in the exhibit sets the minimum OS version to 9.0 and the minimum app version to 1.5.0, with the warning level set to OS version 8.0 and app version 1.4.0. Since the device runs OS 9.0 (meeting the minimum) and app version 1.5.0 (meeting the minimum), but the OS version is below the warning level (9.0 is not below 8.0) and the app version is below the warning level (1.5.0 is not below 1.4.0), the device actually meets both minimum requirements. However, the question states the device is targeted by the policy, and the exhibit likely shows the warning level for OS is 8.0 and for app is 1.4.0, meaning the device's OS 9.0 is above the warning level, but the app version 1.5.0 is above the warning level as well. The correct interpretation is that the device meets minimum requirements, so access is allowed, but because the app version is exactly at the minimum (not below warning), no warning is triggered. Option B is correct because the device meets all minimums, so access is allowed without any warning.

Answer

Access is blocked because the OS version is below the warning level

Answer

Access is allowed without any warning because minimum requirements are met

Answer

Access is blocked because the app version is below the warning level

Question 19

A company uses Microsoft Intune to manage Windows 10 devices. Users report that some required line-of-business (LOB) apps are not being installed on their devices. The apps are assigned as 'Required' to a device group that includes the affected devices. Which two actions should the administrator take to troubleshoot the issue? (Choose two.)

Accepted Answer

Review the Intune Management Extension logs on a device for installation errors.. The Intune Management Extension (IME) is the component responsible for deploying Win32 and line-of-business (LOB) apps on Windows 10 devices. Reviewing its logs (located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs) provides detailed error messages, such as download failures, dependency issues, or script execution errors, which directly indicate why a required app failed to install.

Answer

Uninstall the app from the affected devices and reassign it as Required.

Answer

Reassign the app to the device group with a different assignment type.

Answer

Run gpresult /r on a device to confirm the app assignment policy is applied.

Question 20

An organization uses Microsoft Intune to manage iOS/iPadOS devices. They have a custom line-of-business (LOB) iOS app that must be deployed to 50 devices. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the 50 devices. After 24 hours, only 30 devices have the app installed. The remaining 20 devices show 'pending install' status. What is the most likely cause?

Accepted Answer

The devices do not have a trusted certificate profile that trusts the enterprise signing certificate.. The most likely cause is that the 20 devices lack a trusted certificate profile that trusts the enterprise signing certificate. For an enterprise-signed LOB app to install on iOS/iPadOS, the device must trust the root certificate used to sign the app. Without a trusted certificate profile deployed via Intune, the installation will remain in 'pending install' status because the device cannot validate the app's signature.

Answer

The .ipa file exceeds the maximum file size allowed for LOB apps.

Answer

The users on the 20 devices have not opened the Company Portal app to trigger the installation.

Answer

The MDM push certificate has expired, preventing app installation.