Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 1–75

Automatic enrollment in Intune is the feature that enables Windows devices that are Microsoft Entra joined or hybrid Azure AD joined to automatically enroll in Intune without user interaction. When enabled, devices receive Intune policies and management automatically upon joining Microsoft Entra ID. This is the correct configuration to ensure seamless enrollment for Windows devices without user action. It is configured in the Intune portal under Enrollment > Windows > Automatic Enrollment.

The DNS category in the Settings catalog contains settings such as DNS server addresses for specific interfaces and DNS suffix search lists. Configuring this category lets you assign the required DNS servers to the Windows 11 devices and, when the profile is assigned, the settings are enforced so users cannot change the DNS configuration on those Finance devices.

Microsoft 365 Apps (Windows) configuration policies in Intune deploy and configure Office on Windows devices, letting you set update channels, remove previous installations, and choose specific apps. This directly satisfies the stem's requirement to deploy a Microsoft 365 Apps for enterprise configuration to Intune-managed devices, unlike settings catalog or compliance policies.

Correct. The device shows as compliant but Conditional Access still blocks, suggesting the policy may not require compliant device. Reviewing the policy's conditions is the logical first step.

Uploading a hardware hash registers an existing device with the Autopilot deployment service, enabling it to be reset and reprovisioned through the Autopilot out-of-box experience. This satisfies the stem's requirement for a supported Autopilot action in Microsoft Intune, converting already-deployed hardware into Autopilot-managed devices without manual imaging.

The compliance status validity period defines how long a device's last reported compliance state remains valid. When the device fails to check in within this period, Intune marks it noncompliant. Setting it to 30 days directly fulfills the requirement to flag devices that have not checked in for more than 30 days.

Device enrollment restrictions in Intune let you control which platforms and personal ownership types can enroll. By blocking personally owned Windows devices while allowing corporate-owned ones, you prevent personal devices from enrolling as managed endpoints. Users can still access email through a browser because browser access is governed by conditional access, not enrollment restrictions, so the requirement is met.

The VPP token must be synced so Microsoft Entra ID and Intune can retrieve the purchased licences, then the app is added from the store and assigned to users. This satisfies the minimum configuration needed to make the already-purchased app available.

Wipe performs a full factory reset, removing all data, settings, and the management enrolment itself, which satisfies the requirement to remotely erase a lost corporate-owned iOS device. Retire would only remove corporate data and leave personal content intact, so it cannot guarantee the device is cleared.

Restricting cut, copy and paste between other apps blocks clipboard transfer from managed to unmanaged apps on iOS/iPadOS, directly preventing the data-leak scenario. It is an app protection policy setting applied at the app layer.

A shared multi-user device configuration profile in Intune is specifically designed for Windows devices shared by multiple users. It configures settings like guest account, power management, and sign-in options to optimize for shared use. When combined with Microsoft Entra ID, each user can sign in and receive their own policies and applications based on user targeting.

Requiring Microsoft Entra join or Microsoft Entra registration before Intune enrolment enforces the identity prerequisite, so unregistered devices are blocked. This satisfies the security team's constraint that every device exist in Microsoft Entra ID prior to Intune management.

Update rings in Intune are used to configure Windows Update for Business settings, including feature update deferrals, quality update deferrals, and active hours. By assigning an update ring to the device group, you control when feature updates are installed. This directly meets the requirement to apply Windows Update for Business policies for feature updates. Update rings are the primary method for managing Windows updates in Intune.

Correct. The script lists the unique IDs (`DeviceId`) of all Windows devices in Microsoft Entra ID. While the option says 'joined', the script does not filter by join type; it returns all Windows devices in the directory.

Feature and quality update deferrals are separate settings within a Windows 10 update ring, each measured in days from release. Configuring 120 days for feature updates and 30 days for quality updates directly satisfies both constraints in the stem, since Intune applies these independently per ring without affecting the other update type.

Setting the install context to User makes the app run under each signed-in user's context, so HKEY_CURRENT_USER writes go to that user's own hive and persist between sessions. The app is already packaged as a Win32 app, so only the context needs to change. Installing in System context runs the app under the local system account, whose HKCU hive is not the user's profile.

Uploading the .ipa file as a line-of-business app is the required first step to make the app available in Intune. Once uploaded, you can assign it to groups and configure installation intent as required for automatic installation. This directly addresses the need to deploy a custom iOS app.

Enrollment platform restrictions let you block or allow iOS/iPadOS enrolment and specify a minimum OS version, so devices below iOS 16 are refused at enrolment. This satisfies the requirement before device management begins, unlike a compliance policy which only flags non-compliance afterwards.

Device restrictions profiles expose iOS passcode settings directly, including minimum passcode length and maximum minutes of inactivity before auto-lock. Assigning this profile to the device group enforces both the six-character and five-minute requirements, which the other profile types cannot satisfy.

Setting app transfer to none blocks Outlook from sending corporate data to unmanaged personal apps, satisfying the requirement to prevent copying outside the protected boundary. Combined with cut, copy and paste restrictions, it enforces data containment at the app layer rather than relying on device management.

This addresses different hardware capabilities while maintaining encryption.

Uploading the hardware hash registers the device with the Autopilot service, and the assigned deployment profile drives the out-of-box experience to join Microsoft Entra ID, auto-enrol in Intune, and trigger required app installation on first boot.

Policy assignment flows through Microsoft Entra ID group membership, so a device outside the targeted group never receives the configuration. Confirming correct group membership restores delivery of the security policy and clears the noncompliant state.

An Intune app protection policy applies MAM restrictions to managed Microsoft 365 apps, blocking cut, copy and paste of corporate content into personal apps on iOS without requiring device enrolment. This satisfies the requirement to prevent copying corporate data to personal apps.

The Sync action in the Intune admin center triggers an immediate check-in with the Intune service. This causes the device to download and apply any pending policies, including compliance policies. It is the correct and least disruptive method to force policy retrieval without waiting for the regular check-in interval.

Android Enterprise device restrictions policies expose a dedicated control that blocks installation from unknown sources, directly enforcing the requirement. App configuration policies only supply app settings, and compliance policies report state rather than prevent installation, so restrictions is the correct type.

Users must have Intune licenses to enroll devices.

A deployment profile set to Microsoft Entra hybrid joined tells the device to perform an on-premises domain join and then register with Entra ID. Without this profile, devices default to Entra joined or do not receive the correct OOBE behavior. It is a required configuration alongside the connector for hybrid join to succeed.

Proactive remediations run a detection script on a schedule and execute a remediation script only when detection reports non-compliance, satisfying the automatic BitLocker enablement requirement. This differs from configuration profiles, which enforce settings but cannot run conditional script logic.

A compliance policy rule of 'Maximum days since last check-in' directly marks devices noncompliant once their lastSyncDateTime exceeds the configured threshold. Since the exhibit shows lastSyncDateTime older than 30 days, those devices breached that rule, which explains the noncompliant complianceState without any other cause.

Microsoft Entra ID join with automatic MDM enrolment configures the device to join the tenant and register with Intune during OOBE or via Group Policy. This satisfies the stem's requirement for a valid Windows enrolment method using cloud identity.

A Win32 app must be assigned to a user or device group before Intune delivers it; without an assignment, no device receives the app. This is a mandatory requirement alongside the management extension and packaging.

For hybrid join, the Intune Connector for Active Directory uses a service account to create the computer object in the OU specified in the Autopilot deployment profile. If the OU path is invalid or the account lacks Create Computer Objects permission, the domain join fails even when the connector is online. Verifying the OU and permissions is the logical next step.

Wipe performs a full factory reset, removing all data and settings, which suits a lost corporate-owned device where data must not remain accessible. Retire would only remove corporate data, leaving personal content intact, so wipe is the appropriate action.

iOS line-of-business apps are a valid Intune app type, packaging signed .ipa files for deployment to enrolled iOS/iPadOS devices. This satisfies the stem's requirement for a supported app type, distinct from store apps, web links and built-in apps, and is uploaded directly through Microsoft Intune rather than the App Store.

Uploading the hardware hashes to the Autopilot devices page in the Microsoft Intune admin center registers each device, creating an Autopilot device record that can then be targeted by a deployment profile. This satisfies the requirement to associate devices with profiles.

Detection scripts execute first to assess device state, returning exit code 0 for compliant or non-zero for non-compliant, which triggers the paired remediation script. This satisfies the stem's requirement for actions available in proactive remediations, where detection is the mandatory first stage before any corrective action runs on the Windows device.

Autopilot requires each device's unique hardware hash registered as an Autopilot device before deployment, which links the device to your tenant and drives Intune enrolment. Without a valid hash, the profile cannot target the device, so automatic enrolment silently fails.

iOS LOB apps are uploaded as .ipa packages signed with an enterprise distribution certificate, letting Intune push them directly to supervised or enrolled devices without the App Store. This satisfies the stem's enterprise-signed, 100-device constraint.

The update deadline setting in a Windows update ring specifies the number of days after an update is available before it is forcibly installed and the device restarts. Setting it to 2 days meets the requirement. The grace period can allow users to postpone within that deadline.

This setting explicitly verifies that the BitLocker recovery key has been backed up to Microsoft Entra ID. When enabled in a compliance policy, the device is marked non-compliant if the key is not escrowed. This directly enforces the security team's requirement that keys be escrowed before compliance is granted, ensuring recovery keys are available for administrative recovery.

The compliance policy requires the antivirus signature age to be no more than 3 days. The device reports 5 days, which exceeds the threshold, so Intune evaluates the device as noncompliant. Conditional Access can then block access to Microsoft 365 resources. This is the expected behavior for a device that fails a compliance setting.

Deploying a Windows 11 feature update via a Configuration Manager servicing plan performs a true in-place upgrade, preserving user data and settings. Enabling Delivery Optimization satisfies the limited-bandwidth constraint by letting remote-office peers share update content, drastically reducing WAN consumption compared with each device downloading independently.

The grant control 'Require device to be marked as compliant' makes Microsoft Entra ID check Intune compliance state before issuing a token, blocking non-compliant devices from Microsoft 365. This directly enforces the stated constraint that only compliant devices gain access.

For Microsoft Entra hybrid joined devices, Microsoft Entra Connect must be configured to sync the device objects from the OU where the Autopilot-created computer accounts reside. This ensures that the device objects are synchronized to Microsoft Entra ID and can be used for conditional access and management. Without this sync, the hybrid join will not complete successfully.

Windows Autopilot leverages the existing Windows installation and hardware ID to enroll devices into Intune without reimaging. By registering hardware hashes, you can assign deployment profiles that automatically join devices to Microsoft Entra ID and enroll them in Intune. This meets the requirement of least administrative effort and avoids imaging.

The 'Require BitLocker' setting in a Windows compliance policy directly checks whether BitLocker Drive Encryption is enabled on the device. If BitLocker is not enabled, the device is marked noncompliant. This setting is specifically designed to enforce encryption at the device level, aligning with security requirements for data protection.

lastSyncDateTime records the most recent check-in between the device and the Intune service. A value five days old means no communication has occurred since then, so the device is likely offline, powered down, or otherwise unable to reach the service.

Intune's remote device actions include wipe, which performs a factory reset removing corporate and personal data. This is distinct from retire, which removes only company data and management, and from selective wipe on supported platforms.

Packaging the MSI and its transform into a Win32 app allows you to include the .mst and specify the installation command with the TRANSFORMS property. Win32 apps support custom scripts and full control over installation, ensuring the transform is applied. This approach requires more effort than a line-of-business app but meets the requirement.

A Windows 10/11 feature update policy in Microsoft Intune deploys a specific Windows 11 release to targeted devices, honouring the hardware readiness checks performed by Windows Update for Business. This directly satisfies the requirement that eligible Windows 10 devices upgrade automatically, while incompatible hardware is excluded from the rollout.

A PowerShell script used as a custom detection rule lets Intune evaluate arbitrary logic on the endpoint, satisfying the requirement for a valid Win32 app detection method. It returns an exit code and output that Intune interprets to confirm installation.

A device compliance policy for iOS defines the minimum PIN length requirement, enforcing a six-digit passcode as a condition of compliance. Device restrictions profiles control features, not passcode length, so compliance is the correct location.

PowerShell scripts in Intune run in the SYSTEM context on enrolled Windows 10 devices by default, satisfying the stem's requirement. Upload the script under Devices > Scripts, where it executes once or on a schedule without user credentials, unlike proactive remediations or platform scripts requiring different scopes.

Intune queues the wipe command until the device next establishes a connection, since it cannot push to an offline endpoint. On reconnection, the check-in retrieves the pending action and executes the wipe, satisfying the offline constraint in the stem.

A session policy in Defender for Cloud Apps applies Conditional Access App Control, proxying the SharePoint Online session so downloads to unmanaged devices can be blocked in real time. Access policies only evaluate sign-in conditions, so they cannot intercept an in-session download action.

In Intune, the Endpoint protection profile includes BitLocker settings where you can specify 'Save BitLocker recovery information to Microsoft Entra ID' and choose to store recovery keys. This directly ensures automatic escrow of recovery keys to Microsoft Entra ID, meeting the requirement without additional scripts.

Logs provide detailed error messages.

Custom compliance settings in Intune allow a PowerShell discovery script to gather any device property, including Defender signature version, and a JSON file to define the expected values. This is the supported way to evaluate a condition that is not exposed as a built-in compliance rule, and the result feeds directly into the device compliance state used by conditional access.

Requiring BitLocker is a valid Windows 10 compliance setting in Intune, enforcing full-disk encryption via the device encryption policy. It directly satisfies the stem's security requirement by verifying drive encryption status, and is configurable under Device Compliance > Windows 10/11 compliance policy alongside firewall and antivirus settings.

Intune evaluates compliance independently of configuration. Because the compliance policy mandates a password while the configuration policy sets none, devices without a password are flagged non-compliant even though BitLocker and Defender Antivirus satisfy their own requirements. The password requirement is the conflicting setting.

Line-of-business app type uploads the signed .ipa directly, bypassing the App Store, and supports enterprise-signed internal apps. It satisfies the constraint that the app is unavailable in the Apple App Store and signed with an enterprise certificate.

Device enrollment restrictions in Intune allow you to specify hardware requirements such as minimum TPM version and Secure Boot enforcement for Windows devices. When configured, devices that do not meet these criteria are prevented from enrolling, directly fulfilling the requirement to block non-compliant hardware at enrollment time.

Device configuration profiles are applied to devices and can be targeted to device groups. They are processed during enrollment and can apply settings before user sign-in, especially if they are assigned to the device. This ensures that the settings are in place regardless of which user signs in, meeting the requirement.

Error 0x87D1041C specifically means the app was installed but the detection rule did not detect it as installed. By adjusting the detection rule to accurately reflect the app's presence, you ensure Intune recognizes successful installations and stops retrying, resolving the failure.

The built-in Microsoft 365 Apps app type in Intune satisfies the requirement by packaging the Office suite directly, letting you configure update channels, remove prior installations and select specific products. It deploys natively through the Intune management extension without requiring separate packaging or third-party tooling, making it a valid deployment method.

Packaging the MSI as a Windows app (Win32) lets Intune enforce a dependency on the redistributable before installing the MSI, and the install behavior set to System runs the installer with SYSTEM privileges. The dependency ensures ordering, and SYSTEM context satisfies the requirement that installation occur at device level independent of user sign-in, which matches the scenario's startup requirement.

A Trusted certificate profile deploys the root or intermediate CA certificate to iOS/iPadOS devices so they trust the internal web app's server certificate. It satisfies the requirement to install a custom SSL certificate for internal access, unlike SCEP or PKCS profiles, which issue client certificates.

A detection script is required in a proactive remediation to determine if the device is compliant or non-compliant. In this scenario, it must check the status of the Windows Update service and exit with a non-zero code or 'non-compliant' output if the service is stopped, triggering the remediation script.

SkipWizard=YES suppresses the entire MDT deployment wizard, so the task sequence runs unattended from start to finish. This directly satisfies the stem's requirement for fully automated deployment with minimal user interaction across the 500 devices.

A device compliance policy can enforce the minimum OS version, marking devices below 10.0.19045 as noncompliant. A conditional access policy that requires compliant devices will then block access to corporate email for noncompliant devices. This combination directly achieves the goal of blocking email access for outdated devices.

The sign-in error indicates that conditional access is blocking access because the device is not considered compliant. Even if Intune shows the device as compliant, the conditional access policy might not be targeting the correct device or user group, or the device might not be registered in Microsoft Entra ID. Verifying the policy's included devices and users ensures the device meets the access requirements.

Exit code 1618 is the Windows Installer error indicating another installation is already in progress. When multiple Required apps install simultaneously, the Windows Installer mutex blocks the second installer. Staggering deployments, sequencing dependencies, or reducing concurrent Required apps on those devices resolves the conflict so each installer can acquire the mutex and complete.