MD-102 Prepare infrastructure for devices — 50 Questions

Question 1

Your organization has Windows 11 devices used by remote employees. You need to ensure that only devices compliant with your security policies can access corporate email via Microsoft Outlook for Windows. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance, and assign the policy to the cloud app 'Office 365 Exchange Online'.. Conditional Access policies in Microsoft Entra ID are the primary mechanism to enforce device compliance before granting access to cloud apps like Office 365 Exchange Online. By creating a policy that requires device compliance and targeting the 'Office 365 Exchange Online' app, only devices that meet your security policies (e.g., encryption, antivirus, patch level) can authenticate and access corporate email via Outlook for Windows.

Answer

Set up a device compliance policy in Microsoft Purview to block non-compliant devices.

Answer

Configure a device filter in Exchange Online to block devices that are not managed by Intune.

Answer

Deploy an email security policy via Intune to block access from non-compliant devices.

Question 2

You are deploying Windows 10 to 500 new devices using a task sequence in Microsoft Configuration Manager. The devices need to be joined to Microsoft Entra ID and enrolled in Intune automatically during OSD. Which method should you use?

Accepted Answer

Add a 'Provision Microsoft Entra ID' step in the task sequence, using a bulk token generated from Microsoft Entra ID.. Using a 'Provision Microsoft Entra ID' step with a bulk token in a Configuration Manager task sequence directly enables automatic Microsoft Entra ID join and Intune enrollment during OSD. The bulk token, generated from Microsoft Entra ID, allows devices to be joined without user interaction, which is essential for unattended, large-scale deployments.

Answer

Use a provisioning package (PPKG) with bulk enrollment token, applied during the task sequence.

Answer

Set a Group Policy that enables automatic MDM enrollment using a discovered AAD token.

Answer

Configure Windows Autopilot for existing devices and redeploy them.

Question 3

You need to configure device compliance for devices that are not running Windows. The devices include iOS, iPadOS, Android, and macOS. Which compliance settings are common across all platforms?

Accepted Answer

Require minimum OS version.. Requiring a minimum OS version is a compliance setting available across iOS, iPadOS, Android, and macOS in Microsoft Intune. It ensures devices meet a baseline OS level for security and feature support. This setting is platform-agnostic in the sense that each platform supports specifying a minimum OS version, making it the common compliance policy across all four.

Answer

Require device password and not allow simple passwords.

Answer

Device must not be jailbroken/rooted.

Answer

Require BitLocker encryption.

Question 4

Your organization uses Microsoft Intune to manage devices. You have a compliance policy that requires devices to have a password of at least 6 characters. Some users report that their devices are marked as non-compliant even though they have a password set. What is the most likely cause?

Accepted Answer

The compliance policy is assigned to a user group that does not include the affected users.. The most likely cause is that the compliance policy is assigned to a user group that does not include the affected users. In Microsoft Intune, compliance policies are evaluated based on user or device group assignments. If a user is not a member of the assigned user group, the policy will not apply to their enrolled devices, and those devices will not be evaluated for compliance, often resulting in a non-compliant status or no status at all.

Answer

The password length setting is set to '6' but the device requires a minimum of 8.

Answer

The compliance policy is assigned to device groups, but the devices are user-enrolled.

Answer

The device uses a PIN instead of a password, which is not evaluated.

Question 5

You need to deploy a line-of-business (LOB) app to 100 Windows 10 devices managed by Intune. The app is packaged as an .msi file. Which app type should you choose in Intune?

Accepted Answer

Line-of-business app. For deploying a line-of-business (LOB) app packaged as an .msi file to Windows 10 devices managed by Intune, the correct app type is 'Line-of-business app'. This app type is specifically designed for sideloading enterprise internal apps that are not distributed via the Microsoft Store, and it supports .msi, .appx, and .appxbundle file formats. It allows direct upload of the .msi file to Intune and assigns it to users or devices without requiring complex Win32 app preparation.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store app

Question 6

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a policy that prevents users from installing apps from outside the Microsoft Store. Which TWO settings can you use?

Accepted Answer

Use the 'AppLocker' settings in a device configuration profile to allow only Store apps.. Option C is correct because AppLocker, configurable via Intune device configuration profiles (or custom OMA-URI), lets you create rules that allow only packaged apps from the Microsoft Store while blocking executables installed from other sources, directly enforcing the restriction on outside apps. Option E is correct because SmartScreen settings in Intune (e.g., 'SmartScreen for Explorer' or 'Check apps and files' set to Block/Warn) can block untrusted or unrecognized apps that do not originate from the Microsoft Store, helping prevent installation of external software. Option A is incorrect because Windows Update for Business deferral only controls when quality and feature updates are delivered, not app installation sources. Option B is incorrect because Windows Defender Firewall rules govern network traffic, not whether an app can be installed or launched from outside the Store. Option D is incorrect because BitLocker provides full-disk encryption for data-at-rest protection and has no role in restricting app installation sources.

Answer

Set 'Windows Update for Business' to defer feature updates.

Answer

Enable 'Windows Defender Firewall' to block inbound connections from non-store apps.

Answer

Enable 'BitLocker' to encrypt the system drive.

Question 7

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown on a new Windows 11 device. The cmdlet completes successfully, but the device does not appear in Intune under Windows Autopilot devices. What is the most likely cause?

Accepted Answer

The user running the cmdlet does not have the required permissions in Intune.. The Get-WindowsAutopilotInfo cmdlet uploads the device's hardware hash to the Microsoft Intune service. If the user lacks the necessary Intune role permissions (e.g., 'Intune Administrator' or a custom role with 'Enroll and assign devices' permission), the upload succeeds locally but the device hash is rejected by the Intune service, so the device never appears in the Windows Autopilot device list.

Answer

The device does not have internet access.

Answer

The device is already registered in Autopilot, so the cmdlet does nothing.

Answer

The group tag 'Marketing' is invalid.

Question 8

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

Accepted Answer

Verify that the Company Portal app is installed and updated on the device.. In Android Enterprise personally-owned work profiles, the Company Portal app is required to initiate and complete the enrollment process. If the app is missing or outdated, the device cannot receive the management profile, even if enrollment restrictions allow Android Enterprise. Ensuring the Company Portal is installed and updated is the immediate next step after verifying that Android Enterprise is allowed.

Answer

Confirm that the Intune Service to Service Connector is configured.

Answer

Check that the enrollment token has not expired.

Answer

Ensure Device Administrator enrollment is enabled.

Question 9

You need to ensure that only corporate-owned devices can access Microsoft 365 apps. You plan to use Conditional Access in Microsoft Entra ID. What should you configure as the grant control?

Accepted Answer

Require device to be marked as compliant.. Conditional Access grant control 'Require device to be marked as compliant' ensures that only devices enrolled in Microsoft Intune and meeting your compliance policies (e.g., encryption, OS version, threat level) can access Microsoft 365 apps. This directly enforces the requirement that only corporate-owned devices are allowed, as compliance status is tied to managed devices. In contrast, other options either don't restrict to corporate-owned devices or address different security concerns.

Answer

Require Hybrid Azure AD joined device.

Answer

Require multi-factor authentication.

Answer

Require approved client app.

Question 10

During Windows Autopilot deployment, devices fail to enroll in Intune with error code 0x80180014. You confirm the device is registered in Autopilot and has internet connectivity. What is the most likely cause?

Accepted Answer

The user account lacks an Intune license.. Error code 0x80180014 during Intune enrollment specifically indicates a licensing issue. Even though the device is registered in Windows Autopilot and has internet connectivity, the user account performing the enrollment must have a valid Intune license assigned (e.g., Microsoft 365 E3, E5, or standalone Intune). Without the license, the Intune service rejects the enrollment request, returning this error.

Answer

Enrollment restrictions are blocking personal devices.

Answer

The device is not registered in Autopilot.

Answer

TPM attestation failed due to hardware incompatibility.

Question 11

Users have iOS/iPadOS devices enrolled in Intune. You need to ensure that corporate data in managed apps is encrypted at rest. What should you configure?

Accepted Answer

App protection policy for iOS/iPadOS. App protection policies (APP) in Intune provide the ability to encrypt corporate data at rest within managed apps on iOS/iPadOS devices, regardless of whether the device itself is managed or enrolled. This encryption is enforced at the application layer using AES-256, ensuring that data stored by the app is protected even if the device is compromised or unenrolled. Option C is correct because APP policies are the specific mechanism for data-level encryption in managed apps, not device-level settings.

Answer

iOS native encryption feature

Answer

Compliance policy for iOS/iPadOS

Answer

Device configuration profile with encryption settings

Question 12

Which TWO prerequisites are required for Windows Autopilot self-deploying mode?

Accepted Answer

Device is registered in Windows Autopilot. Option A is correct because self-deploying mode requires the device to first be registered in Windows Autopilot (its hardware hash uploaded and a profile assigned), since the deployment is driven entirely by the Autopilot profile without any user credentials. Option E is correct because self-deploying mode specifically requires a TPM 2.0 chip, which is used to provide the device identity and attestation needed to authenticate to Microsoft Entra ID without a user. Option B is not required because self-deploying mode is a user-less scenario, so no user account with an Intune license is needed for the enrollment itself. Option C is not a stated prerequisite because self-deploying mode does not require a specific Pro/Enterprise/Education edition in the way this option implies. Option D is not required because self-deploying mode does not mandate an Entra ID P1 or P2 license; the necessary Intune/Entra capabilities are covered by the Intune licensing for the tenant.

Answer

A user account with Intune license

Answer

Windows 11/10 Pro, Enterprise, or Education edition

Answer

Microsoft Entra ID P1 or P2 license

Question 13

Which THREE actions can be taken from the Intune admin center when a device is retired?

Accepted Answer

Retire. When a device is retired in Intune, the device record is removed from management, and the device is no longer subject to compliance policies or conditional access. The Retire action (A) is the primary action that removes the device from Intune without wiping corporate data, while the Wipe action (D) resets the device to factory defaults and removes all data. The Delete action (E) permanently removes the device object from the Intune console, which is also available from the device blade after retirement or wipe.

Answer

Remote lock

Answer

Reset passcode

Question 14

Which TWO are valid methods to enroll iOS/iPadOS devices into Microsoft Intune?

Accepted Answer

Automated Device Enrollment (ADE). Options B and C are correct. Automated Device Enrollment (ADE) is the modern, automated method for enrolling corporate-owned iOS/iPadOS devices, while Company Portal enrollment allows users to enroll their personally owned devices. Option A is incorrect because Apple Configurator 2 is a tool for manually preparing devices, not a primary enrollment method. Option D is incorrect because Windows Autopilot is for Windows devices, not iOS/iPadOS. Option E is incorrect because Android Zero Touch enrollment is for Android devices.

Answer

Apple Configurator 2

Answer

Windows Autopilot

Answer

Android Zero Touch enrollment

Question 15

Your organization plans to use Windows Autopilot for device provisioning. You need to ensure devices are automatically registered in Microsoft Entra ID when they are powered on for the first time. Which prerequisite must be met?

Accepted Answer

Users must have Microsoft Entra ID P1 or P2 licenses assigned. Microsoft Entra ID P1 or P2 licenses are required because Windows Autopilot relies on Microsoft Entra ID features such as dynamic device groups, conditional access policies, and automatic enrollment policies, which are only available with these license tiers. Without these licenses, devices cannot be automatically registered in Microsoft Entra ID during the first power-on, as the Autopilot profile assignment and device registration process depend on these premium capabilities.

Answer

Devices must be pre-registered in Intune via an OEM or partner

Answer

Devices must have a TPM 2.0 chip for self-deploying mode

Answer

An on-premises Active Directory domain must be available

Question 16

You manage devices with Microsoft Intune. Users report that after a recent policy update, they cannot access company SharePoint sites on their Android devices. The devices show as compliant in Intune. What is the most likely cause?

Accepted Answer

A Conditional Access policy requires the use of the Microsoft Edge or Microsoft Authenticator app, but users are using Chrome. When a Conditional Access policy requires the use of Microsoft Edge or the Microsoft Authenticator app for accessing SharePoint, users attempting to use Chrome on Android will be blocked. The devices show as compliant in Intune, so the issue is not device compliance but the requirement for a specific approved client app. This policy enforces app-based conditional access, which overrides browser access unless the approved app is used.

Answer

The SharePoint site is configured to allow access only from specific IP ranges

Answer

The device compliance policy has a grace period for non-compliance, and the device is still within that period

Answer

An app protection policy is blocking access to SharePoint from the browser

Question 17

You are configuring Microsoft Intune for a school that provides iPads to students. You want students to be able to use their personal Apple IDs to install apps, but you need to ensure that the devices are enrolled in Intune and managed. Which Apple enrollment method should you use?

Accepted Answer

Apple Device Enrollment (ADE) with supervision and allow personal Apple IDs. Apple Automated Device Enrollment (ADE) with supervision and allowing personal Apple IDs meets the school's requirements: devices are automatically enrolled in Intune, supervision enables full management control (e.g., blocking activation lock bypass), and allowing personal Apple IDs lets students install apps using their own accounts. This combination ensures devices are managed while preserving user flexibility.

Answer

Apple Automated Device Enrollment (ADE) with user affinity

Answer

Apple Device Enrollment (ADE) with Shared iPad mode

Answer

Apple User Enrollment

Question 18

Your organization uses Microsoft Intune for device management. You have a compliance policy that requires Windows devices to have BitLocker enabled. A user reports that their device is marked as non-compliant even though BitLocker is turned on. What is the most likely cause?

Accepted Answer

The BitLocker recovery key is not escrowed to Microsoft Entra ID. The compliance policy is configured to require BitLocker, but Intune's 'Require BitLocker' setting in compliance policies actually checks both that BitLocker is enabled and that the recovery key is escrowed to Microsoft Entra ID. Even if BitLocker is actively encrypting the drive, failure to escrow the key results in non-compliance. This is why the device is marked non-compliant despite BitLocker being turned on.

Answer

BitLocker is only enabled on data drives, not the system drive

Answer

The device is running a version of Windows that does not support BitLocker

Answer

The device does not have a TPM chip

Question 19

Your organization is implementing Windows Autopilot. Which TWO prerequisites must be met before you can use Autopilot?

Accepted Answer

Microsoft Intune licenses. Option B is correct because Windows Autopilot requires Microsoft Intune licenses to manage and deploy devices, as Intune provides the MDM (Mobile Device Management) infrastructure for Autopilot profiles and enrollment. Option D is correct because Microsoft Entra ID P1 or P2 licenses are necessary for features like automatic MDM enrollment and device join, which are essential for Autopilot's cloud-based provisioning. Option A is not required because Autopilot is designed for cloud-first management and does not need an on-premises Active Directory domain. Option C is not required because Configuration Manager is optional for co-management scenarios but not a prerequisite for Autopilot. Option E is not required because while TPM 2.0 is recommended for Windows Hello and security features, it is not a strict prerequisite for using Autopilot.

Answer

An on-premises Active Directory domain

Answer

Configuration Manager

Answer

TPM 2.0 chip on all devices

Question 20

Refer to the exhibit. You are configuring a device compliance policy in Microsoft Intune for Windows devices. Based on the JSON configuration, what will happen if a device does not have a password set?

Accepted Answer

The device will be marked non-compliant and after 24 hours access will be blocked, then retired after 72 hours. The JSON configuration defines a grace period of 24 hours for non-compliance due to missing password, after which access is blocked, and a 72-hour period after which the device is retired. The device is marked non-compliant immediately when no password is set, but the actions (block access, retire) are scheduled based on these grace periods, not executed instantly.

Answer

The device will be marked non-compliant but no action is taken until the grace period expires

Answer

The device will be retired immediately because password is not set

Answer

The device will be immediately blocked from accessing corporate resources