MD-102 Manage applications Practice Test 8 — 15 Questions

Question 1

You are troubleshooting an Intune deployment of a line-of-business (LOB) app for iOS. The app fails to install on some devices with error '0x87D13B9F'. Which THREE actions should you take to diagnose the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if the device is supervised and that the app requires supervised mode. Error 0x87D13B9F on iOS LOB app installs typically indicates the app cannot be installed due to a device-side or app-package constraint, so option B is correct: some LOB apps (especially those using certain deployment features or managed configurations) require the iOS device to be supervised, and an unsupervised device will reject the install. Option D is correct because an expired or invalid embedded provisioning profile in the IPA causes iOS to refuse installation, producing this class of Intune install failure. Option E is correct because insufficient free storage on the device prevents the app payload from being written, which also surfaces as an install failure with this error code. Option A is not appropriate because a service-wide incident would affect all devices broadly and is not the targeted cause of a per-device 0x87D13B9F failure. Option C is not appropriate because app configuration policies apply settings to an already-installed app and do not block or cause the installation itself to fail.

Answer

Check the Intune Service Health dashboard for service incidents

Answer

Ensure that an app configuration policy is assigned to the device

Question 2

Refer to the exhibit. You are reviewing an Intune app protection policy (APP) JSON for Windows. A user complains that they cannot copy data from a managed app. Which setting is causing this?

Accepted Answer

cutCopyAllowed and pasteAllowed are set to false. The `cutCopyAllowed` and `pasteAllowed` settings directly control the ability to transfer data out of managed apps. When both are set to `false`, the Intune App Protection Policy (APP) for Windows explicitly blocks cut, copy, and paste operations from the managed app, which matches the user's complaint. Other settings like encryption, organizational restrictions, or PIN requirements do not prevent clipboard operations.

Answer

encryptAppData is set to true

Answer

orgRestriction is set to true

Answer

requirePin is set to true

Question 3

Refer to the exhibit. You are deploying Microsoft 365 Apps via Intune Win32 app packaging. The detection rule checks for the registry key existence. After installation, Intune reports the app as not detected. What is the most likely reason?

Accepted Answer

The detection runs in 32-bit context and does not see the 64-bit registry key. Intune Win32 app detection rules run in a 32-bit context by default on 64-bit systems. This means the detection script or rule checks the 32-bit registry view (Wow6432Node) rather than the 64-bit registry view. If the app created the registry key in the 64-bit path (e.g., HKLM\Software\Microsoft\Office), the 32-bit detection will not see it, causing a false 'not detected' state.

Answer

The detection type 'exists' is not supported for registry detection

Answer

The registry key path is incorrect for a 64-bit system

Answer

The app did not create the registry key during installation

Question 4

You need to deploy a custom Microsoft Edge extension to managed Windows 10 devices via Intune. Which policy type should you use?

Accepted Answer

Administrative Templates profile (ADMX-backed policies). Deploying a custom Microsoft Edge extension via Intune requires configuring the 'Install Extensions Silently' policy, which is an ADMX-backed policy available through the Administrative Templates profile. This policy type allows you to manage Edge-specific settings using the built-in ADMX files that Intune imports from the Edge administrative templates, enabling silent installation of extensions by specifying their update URL or extension ID.

Answer

Device restrictions profile

Answer

Compliance policy

Answer

PowerShell script deployment

Question 5

Your organization has 500 Windows 11 devices managed by Microsoft Intune. You need to deploy a third-party Win32 application (AppDeploy.exe) that requires the user to accept an end-user license agreement (EULA) during installation. The app must be installed silently without user interaction. You have created a custom script that accepts the EULA automatically. The app is packaged as an .intunewin file. You need to configure the deployment in Intune.

The installation command must run the script that accepts the EULA and then launches the installer. The detection rule must check for the presence of a specific file (C:\Program Files\AppDeploy\app.exe). You want to ensure that if the installation fails, Intune retries automatically.

Which of the following configurations should you choose?

Accepted Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1 && AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: 3 attempts every 60 minutes. Option A correctly combines the custom PowerShell script to accept the EULA with the silent installer command using '&&' to ensure sequential execution, uses the specified file detection rule, and configures retry attempts as required. The install command runs the script first, then launches the installer silently, meeting all requirements. The detection rule checks for the exact file path specified, and the retry settings ensure automatic retries on failure.

Answer

Install command: 'AppDeploy.exe /S', Detection rule: Registry 'HKLM\Software\AppDeploy\Installed' exists, Retry: 3 attempts every 60 minutes

Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Answer

Install command: 'AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Question 6

You are the Intune administrator for a company that uses Microsoft Entra ID (Azure AD) for identity. You have a line-of-business (LOB) iOS app that is distributed via Intune using volume purchase program (VPP) tokens. The app requires a configuration policy to set the server URL. You have assigned the app as 'Required' to all users in the 'Sales' group. Some users report that the app does not show the configured server URL.

You verify that the app configuration policy is assigned to the same 'Sales' group. The app installs successfully. You check the Intune console and see that the app configuration policy has a status of 'Pending' for some devices. The devices are company-owned iPhones running iOS 16.

What is the most likely cause of the configuration not applying?

Accepted Answer

The devices are not supervised. App configuration policies for iOS devices require the device to be supervised, especially when using VPP tokens. The 'Pending' status indicates the policy has not been applied because the devices are not supervised. Option A is wrong because the app installs successfully, indicating iOS version compatibility. Option B is wrong because the policy is assigned to the same group, but supervision is still required. Option D is wrong because the app is deployed via VPP correctly; the issue is with configuration policy enforcement, not VPP deployment.

Answer

The iOS version does not support app configuration

Answer

The app configuration policy is not assigned to the correct group

Answer

The app is not deployed via VPP correctly

Question 7

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) named 'Company Portal' to all devices. The app is already added to Intune. You assign the app to a static device group that includes all current devices with the intent 'Required'. However, you notice that devices that enroll after the assignment do not receive the app automatically.

What should you do to ensure that the app installs on newly enrolled devices?

Accepted Answer

Ensure the device group is a dynamic group that includes all devices (e.g., use the built-in 'All devices' group). In Microsoft Intune, assignments to static Microsoft Entra ID groups only apply to devices that are members of the group at the time of assignment evaluation. Newly enrolled devices are not automatically added to a static group, so they miss the assignment. Using a dynamic group (such as the built-in 'All devices' group) ensures that all current and future devices are included, so the app assignment applies to newly enrolled devices as well.

Answer

Create a new assignment with 'Available' intent for the 'All devices' group

Answer

Re-add the app to Intune

Answer

Change the assignment intent to 'Available'

Question 8

Your organization uses Intune to manage Windows 10 devices. You have deployed a Win32 app named 'FinanceApp' with a detection rule that checks for the existence of a registry key. After deployment, you find that the app is not being detected on some devices, causing Intune to attempt reinstallation. You suspect the detection rule is incorrect.

You need to update the detection rule for the app without redeploying the entire app. You edit the app properties in Intune and modify the detection rule. However, after saving, the existing assignments still use the old detection rule.

What should you do to apply the updated detection rule to existing devices?

Accepted Answer

Increment the app version in the app properties. Incrementing the app version in the app properties is the correct action because Intune uses the app version to determine whether to re-evaluate and apply the updated detection rule to existing devices. When you modify the detection rule without changing the version, Intune does not automatically trigger a re-evaluation on devices that already have the app installed. By incrementing the version, Intune recognizes the app as updated and will re-process the detection logic on targeted devices, ensuring the new rule is applied without redeploying the entire app package.

Answer

Remove and re-add the assignment

Answer

Delete the app and recreate it with the new detection rule

Answer

Uninstall the app from all devices and redeploy

Question 9

Contoso Ltd. uses Microsoft Intune to manage Windows 11 devices. They need to deploy a Line-of-Business (LOB) app (ContosoApp.msi) to 500 devices in a pilot group. The app requires admin privileges and must be installed in the system context. The deployment must be silent with no user interaction, and the installation status must be reported to Intune. They have created a Win32 app wrapper and uploaded the .intunewin file. Which configuration should they choose in the Intune Win32 app properties to meet the requirements?

Accepted Answer

Install behavior: System, Device restart behavior: No specific action. Setting Install behavior to System ensures the app runs with admin privileges and installs in the system context, while Device restart behavior set to No specific action allows any necessary restarts to occur without blocking installation. This meets the requirements of silent deployment with no user interaction and status reporting to Intune. Option A is incorrect because User install behavior does not provide system-level privileges. Option C is incorrect because Suppress restarts may prevent necessary restarts, potentially causing the installation to fail or not complete properly. Option D is incorrect because User install context with the app requiring admin rights will fail to install correctly.

Answer

Install behavior: User, Device restart behavior: No specific action

Answer

Install behavior: System, Device restart behavior: Suppress restarts

Answer

Install behavior: User, Device restart behavior: Block restarts until installation completes

Question 10

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom vertical market app that is not available in the Apple App Store. The app is distributed as an .ipa file signed with an enterprise certificate. You have uploaded the .ipa file to Intune. However, when you assign the app to a user group, the installation fails on devices with the error 'Unable to download app'. The devices are enrolled as user-affinity devices with Device Enrollment Program (DEP). You have verified that the enterprise certificate is trusted on the devices. What is the most likely cause of the failure?

Accepted Answer

The devices are not in Supervised mode.. Enterprise-signed (in-house) .ipa apps installed via Intune on iOS/iPadOS require the device to be in Supervised mode; without supervision, the management profile cannot silently install the enterprise app and the device reports 'Unable to download app'. DEP enrollment alone does not guarantee supervision — the enrollment profile must explicitly enable Supervised mode.

Answer

The app package does not include an icon file.

Answer

The devices do not have a VPN configuration profile installed.

Answer

The app is not purchased through the Volume Purchase Program (VPP).

Question 11

Your company uses Microsoft Intune to manage Windows 10 and 11 devices. You have been asked to deploy a Microsoft 365 Apps for enterprise (formerly Office 365 ProPlus) configuration that includes Word, Excel, PowerPoint, and Outlook. The deployment must be assigned to a group of 200 devices that are not connected to the internet during initial setup; they will get updates from a local Distribution Point (DP) on the network. You have created a Win32 app using the Office Deployment Tool (ODT) with a configuration XML that specifies the products and updates source. Which additional step is necessary to ensure the installation succeeds without internet?

Accepted Answer

Include the SourcePath attribute in the configuration XML pointing to the local DP.. For an offline Win32 Office deployment, the ODT configuration XML must include a SourcePath attribute pointing to the local Distribution Point so the Office installer knows where to fetch the installation files instead of reaching out to Microsoft CDN. Without SourcePath, the setup.exe will attempt to download from the internet and fail on isolated devices.

Answer

Enable the 'Allow devices to discover network content' setting in Intune.

Answer

Download the Office installation files to each device before deployment.

Answer

Set the Office channel to 'Current' in the Intune app properties.

Question 12

Your organization manages Android Enterprise personally-owned work profile devices with Microsoft Intune. You need to deploy a managed Google Play app to these devices. The app is already approved in managed Google Play and added to Intune. When you assign the app as 'Required' to a user group, some users report that the app is not installed on their devices, and they do not see it in the work profile. You verify that the devices are enrolled and checked in with Intune. The app is listed as 'Pending' in the Intune console for those devices. What is the most likely cause?

Accepted Answer

The managed Google Play Store app is disabled on the devices.. For Android Enterprise personally-owned work profile devices, the managed Google Play Store app must be enabled on the device for managed Google Play apps to install. If the Play Store app is disabled (for example, by a device restriction or configuration profile), the app will remain in 'Pending' state and never install, even though it is approved and assigned as Required.

Answer

The app is not approved in managed Google Play for the organization.

Answer

The devices do not have a VPN profile configured.

Answer

The users do not have an app protection policy assigned.

Question 13

You are using Microsoft Intune to deploy a Win32 app (MyApp.exe) to Windows 10 devices. The app requires .NET Framework 4.8 as a dependency. You have created a Win32 app for .NET Framework 4.8 and set it as a dependency for MyApp. However, when you assign MyApp to a device group, the installation fails because .NET Framework is not installed first. The detection rules for MyApp are correctly configured. What should you do to ensure that the dependency is installed before MyApp?

Accepted Answer

Enable 'Auto-install dependency' in the dependency settings of MyApp.. In Intune Win32 app dependencies, you must explicitly enable the 'Auto-install dependency' option in the dependency settings of the parent app (MyApp). This ensures that the dependency (.NET Framework 4.8) is installed automatically before MyApp, even if the dependency app is assigned to the same group. Without this setting, the dependency is not automatically installed.

Answer

Assign the dependency app to the same device group with a higher priority.

Answer

Modify the detection rule for the dependency app to check a different file.

Answer

Require that all devices have .NET Framework 4.8 pre-installed before enrollment.

Question 14

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires a kernel extension. The app is signed with a Developer ID certificate. The devices are enrolled in Intune and are supervised. You have uploaded the .pkg to Intune and assigned it to a user group. The installation fails on devices with the error 'The app could not be installed because the kernel extension is not approved'. You have already configured a kernel extension profile that allows the specific team identifier. What else is likely missing?

Accepted Answer

The app is not notarized by Apple.. Starting with macOS 10.14.5, Apple requires all kernel extensions (kexts) to be notarized by Apple. Even if the kernel extension profile allows the team identifier, the app itself must be notarized to install on macOS 10.14.5+ systems. Without notarization, the installation fails with the given error. Option C is incorrect because the 'Allow user to approve kernel extensions' setting is for user approval after installation, not the root cause here. Options A and B are unrelated.

Answer

System Integrity Protection (SIP) is enabled on the devices.

Answer

FileVault is enabled on the devices.

Answer

The kernel extension profile does not include the 'Allow user to approve kernel extensions' setting.

Question 15

Your organization uses Microsoft Intune to manage Windows devices. You are deploying a Win32 app that requires a reboot to complete installation. You want to control the reboot behavior to minimize user disruption. Which TWO settings can you configure in the Intune Win32 app properties to manage reboot? (Choose two.)

Accepted Answer

Allow restart after installation (in assignment). Option A, 'Allow restart after installation (in assignment)', is correct because in the Intune Win32 app assignment properties you can configure the app to allow or suppress a device restart after installation, letting you decide whether the app can force a reboot for the assigned group. Option B, 'Device restart behavior', is correct because the Win32 app properties include a Device restart behavior setting with values such as 'Determine behavior based on return codes', 'App install may force a device restart', and 'No specific action', which controls how Intune handles reboot return codes (for example 3010 and 1641) from the app installer. Option C, 'Restart deadline', is not a Win32 app property setting; deadlines relate to required app assignments and enforcement timing, not reboot control. Option D, 'Restart grace period', is not configurable in the Win32 app properties; grace periods apply to Windows Update or other update rings, not Win32 app reboot handling. Option E, 'Restart notification text', is not a Win32 app setting; custom restart notifications are configured through other mechanisms such as Windows Update for Business or custom notifications, not the app's reboot behavior.

Answer

Restart deadline

Answer

Restart grace period

Answer

Restart notification text