Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 676–750 | Page 10/13

676

MCQmedium

Refer to the exhibit. An Intune administrator configured a Win32 app with the settings shown. What is the expected behavior when the app installation exits with return code 3010?

A.The device restarts immediately

B.The installation is marked as failed

C.The device may restart after installation outside of active hours

D.The app is not installed

AnswerC

Soft reboot triggers a deferred restart.

Why this answer

Return code 3010 is a standard Windows Installer code indicating a reboot is required. In Intune, a Win32 app that exits with 3010 is treated as a successful installation, but the device may be restarted outside of active hours to apply changes. This behavior aligns with the 'Device restart behavior' setting configured in the app's properties, which defers the restart to a maintenance window.

Exam trap

The trap here is that candidates often confuse return code 3010 with a failure code, assuming any non-zero exit code means the installation failed, but Intune specifically treats 3010 as a success with a pending reboot, not an error.

How to eliminate wrong answers

Option A is wrong because Intune does not force an immediate restart after a 3010 return code; instead, it schedules the restart during non-active hours to minimize user disruption. Option B is wrong because 3010 is not a failure code; Intune interprets it as a successful installation that requires a reboot, so the installation is marked as successful, not failed. Option D is wrong because the app is installed successfully; the 3010 code only indicates that a reboot is pending to complete the configuration, not that the installation itself failed.

Full explanation →

677

Multi-Selecthard

Which THREE features are available in Microsoft Intune's Windows Autopilot for existing devices?

Select 3 answers

A.Collect hardware hash from the existing device.

B.Deploy a provisioning package using a USB drive.

C.Reset the device and re-enroll it using Autopilot.

D.Automatically convert the device to an Autopilot device without user interaction.

E.Apply Autopilot profiles to macOS devices.

AnswersA, B, C

Hardware hash is collected to register the device.

Why this answer

The 'Collect hardware hash' step is a core requirement for Windows Autopilot for existing devices. The hardware hash uniquely identifies the device and must be uploaded to the Microsoft Intune Autopilot service to register it for Autopilot deployment. This hash is collected using a PowerShell script (Get-WindowsAutopilotInfo.ps1) or via the Configuration Manager console.

Exam trap

The trap here is that candidates may confuse the 'automatic conversion' in Option D with the 'Automatic Deployment Mode' profile, but automatic conversion without user interaction is not supported for existing devices—only for new devices ordered from OEMs with hardware hash pre-registered.

Full explanation →

678

Multi-Selectmedium

Your organization uses Microsoft Intune to manage Windows devices. You are deploying a Win32 app that requires a reboot to complete installation. You want to control the reboot behavior to minimize user disruption. Which TWO settings can you configure in the Intune Win32 app properties to manage reboot? (Choose two.)

Select 2 answers

A.Allow restart after installation (in assignment)

B.Device restart behavior

C.Restart deadline

D.Restart grace period

E.Restart notification text

AnswersA, B

This can be set to Yes or No in the assignment settings.

Why this answer

The correct answers are A and B. Option A ('Allow restart after installation') is a setting in the app assignment that, when enabled, permits the device to restart after the app installs. Option B ('Device restart behavior') controls whether restarts are suppressed or blocked during the app installation.

Option C ('Restart deadline') is not a configurable setting for Win32 apps in Intune; it is used for Windows Update rings. Option D ('Restart grace period') is not available for Win32 apps; it is used for update compliance policies. Option E ('Restart notification text') is not a setting for Win32 apps; it is used for device restart notifications in update policies.

Full explanation →

679

Multi-Selectmedium

Your company is deploying iOS devices using Apple Business Manager and Intune. You need to ensure that devices are automatically configured with Wi-Fi settings, email profiles, and a list of required apps during the initial setup. Which THREE configurations should you create in Intune?

Select 3 answers

A.A device configuration profile for Wi-Fi settings.

B.A Windows configuration designer provisioning package.

C.A device compliance policy for iOS.

D.A device configuration profile for email settings.

E.An iOS app configuration policy for required apps.

AnswersA, D, E

Wi-Fi profile configures wireless settings.

Why this answer

Options A, D, and E are correct. Device configuration profiles (A) can deploy Wi-Fi settings to iOS devices. Device configuration profiles (D) can also deploy email settings.

An iOS app configuration policy (E) can be used to require specific apps during enrollment. Option B is incorrect because Windows Configuration Designer provisioning packages are for Windows devices, not iOS. Option C is incorrect because a device compliance policy is for compliance checking, not initial configuration.

Full explanation →

680

Multi-Selecthard

Which THREE conditions can be used to create a dynamic device group in Microsoft Entra ID for Intune management? (Choose three.)

Select 3 answers

A.Enrollment profile name (e.g., 'Autopilot Profile')

B.Last sign-in time of the user

C.Installed application version

D.Device model (e.g., 'Surface Pro 7')

E.Operating system version (e.g., 'Windows 11 22H2')

AnswersA, D, E

Enrollment profile name is a valid device attribute.

Why this answer

Microsoft Entra ID dynamic device groups can use the 'enrollmentProfileName' property as a rule attribute. This allows you to target devices based on the specific Autopilot profile assigned during enrollment, enabling precise management of devices that underwent a particular provisioning process.

Exam trap

The trap here is that candidates confuse dynamic device group rules (which only support device attributes) with dynamic user group rules or compliance policies, leading them to select user-based or application-based conditions like 'Last sign-in time' or 'Installed application version'.

Full explanation →

681

Multi-Selectmedium

A company uses Microsoft Intune to manage Windows 10 devices. They want to ensure that devices have BitLocker enabled and are compliant before accessing corporate resources. Which TWO actions should the administrator take? (Choose two.)

Select 2 answers

A.Assign the device compliance policy to all users.

B.Create a device compliance policy that requires BitLocker.

C.Enable Windows Hello for Business.

D.Create a device configuration profile to enable BitLocker.

E.Create a Conditional Access policy that grants access only to compliant devices.

AnswersB, E

Compliance policy checks BitLocker status.

Why this answer

A device compliance policy in Microsoft Intune can include the setting to require BitLocker on Windows 10 devices. This policy evaluates the device's BitLocker status and marks it as noncompliant if BitLocker is not enabled, which is a prerequisite for Conditional Access to block access to corporate resources.

Exam trap

The trap here is that candidates often confuse a device configuration profile (which enables BitLocker) with a compliance policy (which evaluates and enforces BitLocker status), leading them to select Option D instead of understanding that both a compliance policy and a Conditional Access policy are required for the stated goal.

Full explanation →

682

MCQhard

You are planning to deploy a custom line-of-business (LOB) app to 200 Windows 11 devices using Intune. The app requires a specific registry key to be present before installation. What should you do?

A.Add the app as a dependency for another app that creates the registry key.

B.Use an app configuration policy to set the registry key before the app installs.

C.Add a requirement rule to the app deployment that runs a PowerShell script to check for the registry key.

D.Create a custom compliance policy to enforce the registry key.

AnswerC

Requirement rules can use PowerShell scripts to check prerequisites.

Why this answer

Intune's requirement rules allow you to run a PowerShell script that checks for the existence of a specific registry key before the app installs. If the script returns a non-zero exit code, Intune will not proceed with the installation, ensuring the prerequisite is met. This is the only option that directly enforces a precondition for the app installation without requiring additional apps or policies.

Exam trap

The trap here is that candidates often confuse requirement rules (which block installation if unmet) with detection rules (which determine if an app is already installed), or they mistakenly think app configuration policies can modify the Windows registry, when in fact they are limited to mobile device management (MDM) settings for specific platforms.

How to eliminate wrong answers

Option A is wrong because adding the app as a dependency for another app that creates the registry key would require the LOB app to be installed first, which is the opposite of what is needed—the registry key must be present before the LOB app installs. Option B is wrong because app configuration policies are used to configure app settings (e.g., for managed iOS/iPadOS or Android apps) and cannot create or modify registry keys on Windows devices. Option D is wrong because custom compliance policies evaluate device compliance after enrollment and can mark a device as non-compliant, but they do not prevent or block the installation of a specific app; they only trigger remediation or conditional access actions.

Full explanation →

683

MCQmedium

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to a device. The app appears in the managed Google Play store but the deployment status shows 'Failed'. What is the most likely cause?

A.The device is enrolled in a personally-owned work profile.

B.The device is not allowed to access the managed Google Play store.

C.The app is not approved in the managed Google Play store.

D.The device does not have Google Play Services installed.

AnswerD

Correct. Google Play Services is required for managed Google Play functionality. Without it, the deployment process cannot proceed, resulting in a 'Failed' status.

Why this answer

The most likely cause of a 'Failed' deployment status for a managed Google Play app is that the device does not have Google Play Services installed. Google Play Services is a prerequisite for accessing and installing apps from the managed Google Play store. Without it, the device cannot complete the deployment, even if the app is approved and the device is enrolled correctly.

Option A is incorrect because personally-owned work profiles do support app deployment; the failure is not inherently due to the profile type.

Exam trap

The trap here is that candidates often assume a 'Failed' deployment status is due to approval or access issues, but Microsoft Intune specifically reports this error when the app is incompatible with the work profile container on personally-owned devices.

How to eliminate wrong answers

Option B is wrong because if the device were not allowed to access the managed Google Play store, the app would not appear in the store at all, and the deployment status would show 'Not applicable' or 'Pending' rather than 'Failed'. Option C is wrong because the app appears in the managed Google Play store, which means it has already been approved by an administrator; an unapproved app would not be visible in the store. Option D is wrong because Google Play Services is a prerequisite for enrolling in Android Enterprise and for accessing the managed Google Play store; if it were missing, the device would not be able to enroll or show the app in the store.

Full explanation →

684

MCQhard

You manage devices with Microsoft Intune. A user reports that their Windows 11 device is not receiving updates from Windows Update for Business. The device shows as compliant in Intune. You verify that update rings are assigned to the device. What should you check next?

A.Check if the device has a compliance policy that blocks updates.

B.Ensure that the device is not configured for dual scan.

C.Check the device's delivery optimization settings.

D.Verify that the update ring is assigned to the correct Azure AD group.

AnswerC

Delivery optimization can prevent updates if misconfigured.

Why this answer

Delivery optimization settings control how Windows Update for Business downloads updates, and misconfigured settings (e.g., peer caching or bandwidth throttling) can prevent updates from being received even when update rings are properly assigned. Since the device is compliant and update rings are assigned, the next logical step is to verify that delivery optimization is not blocking or delaying the download. This aligns with Intune's troubleshooting workflow for Windows Update for Business issues.

Exam trap

The trap here is that candidates assume compliance or group assignment is the root cause, but Microsoft Intune's update delivery relies on delivery optimization as a prerequisite, and the exam tests the understanding that update rings only define the deferral policy, not the download mechanism.

How to eliminate wrong answers

Option A is wrong because compliance policies in Intune do not block updates; they enforce device configuration requirements (e.g., encryption, OS version) and mark devices non-compliant if unmet, but they do not prevent Windows Update from receiving updates. Option B is wrong because dual scan (configuring both Windows Update for Business and WSUS) is a potential issue, but it is not the next check after verifying update ring assignment and compliance; dual scan typically causes update conflicts, not a complete failure to receive updates. Option D is wrong because the question already states that update rings are assigned to the device, so verifying the Azure AD group assignment is redundant and not the next logical step.

Full explanation →

685

MCQhard

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy a custom security baseline that includes blocking PowerShell scripts from running unless they are signed by a trusted publisher. Which configuration should be applied?

A.Set the PowerShell Execution Policy to 'AllSigned' via Administrative Templates.

B.Create a Windows Defender Application Control (WDAC) policy that blocks unsigned scripts.

C.Enable BitLocker with Secure Boot to validate script integrity.

D.Configure AppLocker rules to deny execution of PowerShell scripts.

AnswerA

This policy requires all scripts to be signed by a trusted publisher before running.

Why this answer

Setting the PowerShell Execution Policy to 'AllSigned' via Administrative Templates in Intune ensures that PowerShell scripts can only run if they are signed by a trusted publisher. This policy is enforced through Group Policy or Intune's Settings Catalog, directly controlling the PowerShell execution policy at the machine level, which meets the requirement for a custom security baseline.

Exam trap

The trap here is that candidates often confuse AppLocker or WDAC with PowerShell Execution Policy, thinking they achieve the same granular control over script signing, but only the PowerShell Execution Policy directly enforces the 'AllSigned' requirement for PowerShell scripts.

How to eliminate wrong answers

Option B is wrong because Windows Defender Application Control (WDAC) controls which executables, scripts, and drivers can run based on code integrity policies, but it does not specifically enforce a signature requirement for PowerShell scripts in the same granular way as the PowerShell Execution Policy; WDAC can block unsigned scripts but is broader and not the targeted configuration for PowerShell execution policy. Option C is wrong because BitLocker with Secure Boot validates the integrity of the boot process and system files, not script execution policies; it does not control whether PowerShell scripts must be signed. Option D is wrong because AppLocker rules can deny execution of PowerShell scripts, but they do not enforce a signature requirement from a trusted publisher; AppLocker can block or allow based on path, publisher, or hash, but the specific requirement for scripts to be signed by a trusted publisher is best achieved via the PowerShell Execution Policy set to 'AllSigned'.

Full explanation →

686

Multi-Selectmedium

Which TWO of the following are supported app types for deploying to iOS devices via Microsoft Intune?

Select 2 answers

A.Web link

B.iOS line-of-business app

C.iOS store app

D.Android app

E.Win32 app

AnswersB, C

iOS LOB apps are supported.

Why this answer

iOS store apps and iOS line-of-business apps are supported. Web links are for any device but not an app type. Win32 and Android are not for iOS.

Full explanation →

687

MCQeasy

A company wants to prevent corporate data from being copied from managed apps to personal apps on iOS devices. Which Intune policy should the administrator configure?

A.Device configuration profile

B.Device compliance policy

C.App protection policy

D.Enrollment restrictions

AnswerC

App protection policies control data transfer between managed and unmanaged apps.

Why this answer

App Protection Policies (APP) in Microsoft Intune are specifically designed to manage and protect corporate data within applications, regardless of the device enrollment state. On iOS, you can configure data transfer settings such as 'Allow app to transfer data to other apps' to restrict copying corporate data from managed apps to personal apps, using the iOS native inter-app control mechanisms like the Open-In management feature.

Exam trap

The trap here is that candidates often confuse App Protection Policies (which control data at the app layer) with Device Compliance Policies (which control device access), leading them to select the wrong option when the question focuses on data leakage prevention between apps.

How to eliminate wrong answers

Option A is wrong because Device Configuration Profiles are used to configure device settings (e.g., Wi-Fi, VPN, email) and enforce device-level restrictions, not to control data flow between apps at the application layer. Option B is wrong because Device Compliance Policies evaluate device health and security posture (e.g., jailbreak detection, minimum OS version) but do not govern inter-app data transfer policies. Option D is wrong because Enrollment Restrictions control which devices or users can enroll in Intune (e.g., platform allow/block, device type limits) and have no impact on data sharing behavior between apps after enrollment.

Full explanation →

688

Multi-Selecteasy

You are configuring Windows Update for Business policies in Microsoft Intune. You want to ensure that devices receive quality updates (security fixes) as soon as they are released, but defer feature updates for up to 60 days. Which TWO settings should you configure?

Select 2 answers

A.Set 'Defer quality updates (days)' to 0.

B.Set 'Feature update channel' to 'Semi-Annual Channel'.

C.Set 'Update notification level' to 'Turn off notifications'.

D.Set 'Defer quality updates (days)' to 60.

E.Set 'Defer feature updates (days)' to 60.

AnswersA, E

0 days means immediate installation of quality updates.

Why this answer

To receive quality updates immediately, set 'Defer quality updates (days)' to 0 (option A). To defer feature updates for 60 days, set 'Defer feature updates (days)' to 60 (option E). Option B is incorrect because 'Feature update channel' is a channel selection, not a deferral setting.

Option C is about notification level, unrelated to update timing. Option D would defer quality updates, which is the opposite of the requirement.

Full explanation →

689

Multi-Selecthard

Which TWO settings must be configured to enable Windows Hello for Business in an Intune policy?

Select 2 answers

A.Enable Windows Hello for Business provisioning.

B.Use Windows Hello for Business.

C.Configure biometrics (facial recognition or fingerprint).

D.Certificate enrollment policy.

E.Minimum PIN length.

AnswersB, E

Correct. This is the primary setting that enables WHfB in an Intune device configuration profile. Without it enabled, no other WHfB settings take effect.

Why this answer

To enable Windows Hello for Business in an Intune policy, you must configure two settings: 'Use Windows Hello for Business' acts as the master toggle to enable WHfB, and 'Minimum PIN length' establishes a mandatory PIN security baseline. Biometrics (facial recognition or fingerprint) is optional and not required to enable Windows Hello for Business.

Exam trap

The trap is that candidates often think biometrics is required, but in Intune, enabling WHfB only requires the master toggle and a minimum PIN length. Biometrics configuration is optional. Additionally, 'Enable Windows Hello for Business provisioning' is not a valid setting; the correct setting is 'Use Windows Hello for Business'.

Full explanation →

690

MCQhard

Refer to the exhibit. The JSON snippet shows the Azure AD Identity Protection MFA registration policy configuration for the Contoso tenant. A new user, Jane, joins the company and is assigned a license. Jane attempts to access the Azure portal and is prompted to register for MFA. She registers successfully. However, the next day, she is again prompted to register for MFA. What is the most likely cause?

A.The MFA registration policy is disabled.

B.The user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory.

C.The policy is not including all users.

D.The policy excludes the user Jane.

AnswerB

If the user is synced from on-premises, changes in on-premises can reset the MFA registration state.

Why this answer

The most likely cause is that the user's MFA registration is being reset due to a synchronization issue with on-premises Active Directory. When Azure AD Connect synchronizes a user object from on-premises AD, it can overwrite the cloud MFA registration state if the on-premises attribute (such as 'StrongAuthenticationMethods' or 'StrongAuthenticationTime') is not set or is reset. This causes the user to be treated as unregistered, prompting MFA registration again despite a previous successful registration.

Exam trap

The trap here is that candidates often assume the issue is with the policy configuration (enabled, scope, or exclusions) rather than recognizing that a synchronization reset of the MFA registration state is the root cause in a hybrid environment.

How to eliminate wrong answers

Option A is wrong because if the MFA registration policy were disabled, Jane would not have been prompted to register at all, let alone repeatedly. Option C is wrong because the policy not including all users would mean Jane is not targeted by the policy, so she would not be prompted to register for MFA. Option D is wrong because if the policy explicitly excluded Jane, she would not be prompted to register for MFA in the first place.

Full explanation →

691

MCQeasy

A user reports that Microsoft 365 Apps for enterprise is not installing on their Windows 10 device. The app is assigned as 'Available' to the user group. What must the user do to trigger the installation?

A.Wait for the next device sync

B.Open the Company Portal app and install from there

C.Restart the device

D.Log off and log back in

AnswerB

Users install available apps through Company Portal.

Why this answer

Available app installs require user interaction via the Company Portal. Option A is wrong because the app is not required. Option C is wrong because the user can initiate install anytime.

Option D is wrong because no restart is needed before install.

Full explanation →

692

Multi-Selecthard

You are troubleshooting an issue where Windows 10 devices are not receiving policies from Microsoft Intune. The devices are enrolled and show as 'active' in the console. Which THREE steps should you take to diagnose the problem?

Select 3 answers

A.Verify the last sync time in Intune console.

B.Re-register the device in Azure AD.

C.Check the device's local firewall rules for Intune ports.

D.Re-enroll the device by removing and re-adding it in Intune.

E.Collect MDM diagnostic logs from the device.

AnswersA, D, E

If last sync is old, the device may not be communicating.

Why this answer

Options A, D, and E are correct. Verifying the last sync time (A) helps determine if the device has checked in recently and whether policies should have been applied. Re-enrolling the device (D) can resolve enrollment or communication issues by forcing a fresh registration and policy download.

Collecting MDM diagnostic logs (E) provides detailed error information from the device side. Option B is unnecessary because the device is already enrolled and active; re-registering in Azure AD would not address policy delivery issues. Option C is not a standard troubleshooting step for Intune policy problems, as Intune uses HTTPS (port 443) which is typically allowed by default firewalls.

Full explanation →

693

Multi-Selecthard

You are planning the deployment of Microsoft 365 Apps for enterprise to Windows 10 devices. You need to minimize network bandwidth during installation. Which THREE actions should you take?

Select 3 answers

A.Use the Office Deployment Tool with a local source

B.Configure BranchCache

C.Enable peer caching for Office 365 Content

D.Download the full installation files from the internet

E.Use express updates for Office

AnswersA, C, E

Installs from local share instead of internet.

Why this answer

The Office Deployment Tool (ODT) can be configured with a local source path (SourcePath attribute in configuration.xml) to store installation files on a network share or local cache. This eliminates repeated downloads from the internet for each client, significantly reducing WAN bandwidth usage during deployment.

Exam trap

The trap here is that candidates often confuse BranchCache (a general Windows caching feature) with peer caching for Office 365 Content, which is a specific Office feature designed for installation and update distribution, leading them to incorrectly select BranchCache as a bandwidth-saving measure.

Full explanation →

694

MCQmedium

Refer to the exhibit. The JSON shows a managed device's properties retrieved from Microsoft Graph. The device's complianceState is 'noncompliant'. Which step should you take next to investigate why the device is noncompliant?

A.Verify the last sync time to ensure the device is communicating.

B.Query the device's compliance policy status via Graph API or Intune console.

C.Check if the device is properly enrolled by verifying azureADRegistered.

D.Check if the device is jailbroken or rooted.

AnswerB

The compliance policy details will reveal the failing policy.

Why this answer

The compliance policy details will show which specific policy is failed. Option A is incorrect because the device is already enrolled. Option C is incorrect because last sync time is recent.

Option D is incorrect because jailbreak is not applicable to Windows.

Full explanation →

695

MCQeasy

You are investigating a malware incident on a Windows 10 device managed by Microsoft Intune and protected by Microsoft Defender for Endpoint. Which log should you analyze to determine the initial infection vector?

A.Microsoft Sysinternals Process Monitor logs.

B.Microsoft Intune compliance reports.

C.Windows Event Viewer logs on the device.

D.Microsoft Defender XDR incident investigation timeline.

AnswerD

The timeline shows the initial infection vector and related events.

Why this answer

The Microsoft Defender XDR incident investigation timeline aggregates alerts, events, and forensic data from all Defender for Endpoint sensors across devices, providing a unified view of the attack chain. This timeline specifically surfaces the initial infection vector (e.g., malicious file, phishing link, or exploit) by correlating process creation, network connections, and file events at the moment of compromise, which is exactly what you need for malware incident analysis.

Exam trap

The trap here is that candidates often choose Windows Event Viewer (Option C) because they associate it with security auditing, but they fail to realize that the Defender XDR incident timeline is the centralized, cloud-native tool designed specifically for cross-device attack chain analysis in a managed environment.

How to eliminate wrong answers

Option A is wrong because Sysinternals Process Monitor logs are a local, real-time monitoring tool that captures file system, registry, and process/thread activity, but they are not centrally collected or retained by Intune or Defender for Endpoint for historical incident investigation; they require manual setup and are not part of the managed security solution. Option B is wrong because Intune compliance reports focus on device configuration compliance (e.g., OS version, encryption status, required apps) and do not contain security event logs or forensic data needed to trace an infection vector. Option C is wrong because Windows Event Viewer logs on the device (e.g., Security, System, or Microsoft-Windows-Windows Defender/Operational) are local and can be useful, but they lack the cross-device correlation, cloud-based retention, and automated attack chain reconstruction that the Defender XDR incident timeline provides; relying solely on Event Viewer would miss telemetry from other endpoints and cloud signals.

Full explanation →

696

MCQhard

An organization has deployed Microsoft Entra Connect Sync to synchronize on-premises Active Directory to Microsoft Entra ID. Users report that some cloud-only user accounts cannot be assigned licenses. The admin checks the provisioning logs and finds that the cloud accounts have a source of authority of 'Microsoft Entra ID'. What is the most likely cause?

A.The accounts have the 'cloudOnly' attribute set to true, which blocks license assignment.

B.The accounts have no proxyAddresses, so licensing fails.

C.The accounts are missing the 'UsageLocation' attribute, which is required for license assignment.

D.The users are not synchronized because the sync schedule is set to manual.

AnswerC

UsageLocation must be set before assigning licenses.

Why this answer

The most likely cause is that the cloud-only user accounts are missing the 'UsageLocation' attribute. In Microsoft Entra ID, a UsageLocation must be set before licenses can be assigned to any user, including cloud-only accounts. Without this attribute, license assignment fails regardless of the user's source of authority.

Exam trap

The trap here is that candidates may assume license assignment failures are due to synchronization issues or missing proxyAddresses, but the real requirement is the UsageLocation attribute, which is often overlooked in cloud-only user provisioning.

How to eliminate wrong answers

Option A is wrong because there is no 'cloudOnly' attribute in Microsoft Entra ID; the source of authority is determined by the 'dirSyncEnabled' property, and cloud-only accounts have it set to false, which does not block license assignment. Option B is wrong because proxyAddresses are not required for license assignment; they are used for email routing and recipient resolution, not licensing. Option D is wrong because the question states the accounts are cloud-only, not synchronized from on-premises, so the sync schedule is irrelevant to these users.

Full explanation →

697

MCQmedium

A hospital uses Intune to manage Windows 10 devices used by doctors. The devices should automatically install critical updates from Windows Update for Business. Which type of policy should the administrator create?

A.Device compliance policy

B.App protection policy

C.Update rings for Windows 10

D.Device configuration profile (Update settings)

AnswerC

Update rings configure Windows Update for Business settings, including automatic installation.

Why this answer

Update rings for Windows 10 are the correct policy type in Intune to manage when and how Windows 10 devices receive updates from Windows Update for Business. This policy allows you to configure deferral periods, pause updates, and set the update behavior (e.g., automatic installation of critical updates) without requiring on-premises WSUS or manual approval.

Exam trap

The trap here is that candidates confuse 'Device configuration profile (Update settings)' with the correct answer, because both can manage update behavior, but Update rings are the modern, recommended method in Intune for Windows 10 update management, while the legacy Update settings profile is deprecated and lacks features like pause and deferral granularity.

How to eliminate wrong answers

Option A is wrong because device compliance policies evaluate whether devices meet security requirements (e.g., encryption, antivirus) and trigger conditional access, but they do not control the installation of Windows updates. Option B is wrong because app protection policies manage how data is accessed and shared within mobile applications (e.g., Outlook, OneDrive) and do not affect operating system updates. Option D is wrong because while Device configuration profiles include update settings (e.g., 'Update settings' category), these are legacy settings that are less flexible and are superseded by Update rings for Windows 10, which provide granular control over Windows Update for Business policies.

Full explanation →

698

MCQmedium

An administrator deploys an iOS app as 'Required' to a group of devices using Intune. The app fails to install on some devices with error '0x87D13B9F'. What is the most likely cause?

A.The devices have insufficient storage space

B.The app is not compatible with the iOS version on those devices

C.The app is not signed with an Apple Enterprise Developer certificate

D.The devices are not supervised

AnswerD

Required app deployment on iOS requires the device to be in supervised mode.

Why this answer

Error 0x87D13B9F in Intune indicates that the device is not supervised. For iOS/iPadOS, Intune requires devices to be in Supervised mode to install 'Required' apps silently without user interaction. Without supervision, the device cannot accept managed app installations pushed by MDM, causing the deployment to fail.

Exam trap

The trap here is that candidates often confuse generic installation failures (like storage or compatibility) with the specific supervised-mode requirement, because the error code is not immediately intuitive and many assume 'Required' apps can install on any device.

How to eliminate wrong answers

Option A is wrong because insufficient storage space typically generates a different error (e.g., 0x87D13B9E or a generic installation failure), not 0x87D13B9F. Option B is wrong because iOS version incompatibility usually results in error 0x87D13B9C or a 'not supported' message, not this specific code. Option C is wrong because the app signing certificate (Enterprise vs.

App Store) is unrelated to this error; Intune can deploy both types, and signing issues produce errors like 0x87D13B9A or 'invalid profile'.

Full explanation →

699

Multi-Selecthard

Which TWO of the following are required to configure Windows Hello for Business using Microsoft Intune?

Select 2 answers

A.Company Portal app installed

B.A Trusted Platform Module (TPM) chip on the device

C.Azure AD Premium P1 licenses

D.Certificate-based authentication

E.A key trust model configured in Intune

AnswersB, E

TPM is required for hardware key protection.

Why this answer

A Trusted Platform Module (TPM) chip is required to provide hardware-based key protection for Windows Hello for Business. Additionally, a key trust model must be configured in Intune to manage the public keys. The Company Portal app is not required; it is used for enrollment but not specifically for Windows Hello configuration.

Azure AD Premium P1 licenses are not required for Windows Hello for Business; they are needed for other features like Conditional Access. Certificate-based authentication is optional and not a requirement.

Full explanation →

700

Drag & Dropmedium

Order the steps to configure Windows Defender Antivirus exclusions via Group Policy.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order to configure Windows Defender Antivirus exclusions via Group Policy is to first open the Group Policy Management Console (GPMC), edit the desired Group Policy Object (GPO), navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Exclusions, configure the specific exclusions (e.g., file, folder, or process exclusions), and then force a Group Policy update using gpupdate /force to apply the changes immediately. This sequence ensures that the policy settings are properly accessed and applied, preventing common errors like applying an empty configuration or navigating to a non-edited GPO.

Full explanation →

701

Multi-Selectmedium

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices. Which TWO conditions must be met?

Select 2 answers

A.The iOS devices must have the distribution profile installed.

B.The app must be packaged as an .appx file.

C.The app must be signed with an Apple Enterprise Developer certificate.

D.The app must be assigned to devices only, not users.

E.The app must be distributed via the Apple App Store.

AnswersA, C

The distribution profile trusts the enterprise developer.

Why this answer

IOS devices require a distribution profile (provisioning profile) to trust and install line-of-business (LOB) apps that are not distributed through the Apple App Store. The distribution profile contains the app ID, device IDs (if not using user enrollment), and the enterprise certificate, enabling the device to validate and run the app. Without this profile, the app will fail to install or launch due to code signing validation failures enforced by iOS.

Exam trap

The trap here is that candidates often confuse the packaging format (.appx vs .ipa) or assume LOB apps must be assigned only to devices, when Intune supports both user and device assignments for iOS LOB apps.

Full explanation →

702

MCQeasy

You have the above JSON policy assigned to a Windows 10 device. A user reports that they are unable to set a password that meets the policy. Which additional setting is required for the password to be accepted?

A.Increase passwordMinimumLength to 10.

B.Set passwordExpirationDays to 0 to never expire.

C.Ensure the password includes characters from at least 3 character sets.

D.Set passwordRequiredType to 'alphanumeric' (it is already set).

AnswerC

The policy requires 3 character sets.

Why this answer

PasswordMinimumCharacterSetCount of 3 requires the user to include characters from 3 different sets (e.g., uppercase, lowercase, digits). The other options are not directly related to the issue. Option A is incorrect because alphanumeric includes letters and numbers.

Option B is incorrect because 8 is already set. Option D is incorrect because expiration is not about acceptance.

Full explanation →

703

MCQmedium

Refer to the exhibit. A user attempts to sign in to Microsoft Graph PowerShell and receives the error shown. What is the most likely cause?

A.The user is not registered for MFA.

B.The user does not have an appropriate Microsoft Entra ID license assigned.

C.The device is not registered in Microsoft Entra ID.

D.The sign-in was blocked by a Conditional Access policy.

AnswerB

Error code 50058 indicates missing license.

Why this answer

The error shown indicates that the user lacks the required license for Microsoft Entra ID (formerly Azure AD) features needed to sign in to Microsoft Graph PowerShell. Microsoft Graph PowerShell requires an appropriate Microsoft Entra ID license (such as Premium P1 or P2) to access directory-level APIs and authentication methods. Without this license, the service cannot validate the user's identity for Graph API calls, resulting in the sign-in failure.

Exam trap

Microsoft often tests the misconception that MFA registration or device compliance is the root cause of Graph PowerShell sign-in failures, when in fact the underlying license requirement for Microsoft Entra ID is the specific gate that Microsoft enforces for directory API access.

How to eliminate wrong answers

Option A is wrong because the error message does not mention multi-factor authentication (MFA) registration; MFA registration errors typically prompt for additional verification or show a specific MFA-related error code. Option C is wrong because device registration in Microsoft Entra ID is not a prerequisite for signing in to Microsoft Graph PowerShell; the user can authenticate from any device as long as they have the correct credentials and license. Option D is wrong because Conditional Access policy blocks usually display a distinct error message referencing the policy name or a 'blocked by Conditional Access' notice, not a generic license-related error.

Full explanation →

704

MCQhard

During Windows Autopilot deployment, devices fail to enroll in Intune with error code 0x80180014. You confirm the device is registered in Autopilot and has internet connectivity. What is the most likely cause?

A.Enrollment restrictions are blocking personal devices.

B.The device is not registered in Autopilot.

C.The user account lacks an Intune license.

D.TPM attestation failed due to hardware incompatibility.

AnswerC

Common cause of this error.

Why this answer

Error code 0x80180014 during Intune enrollment specifically indicates a licensing issue. Even though the device is registered in Windows Autopilot and has internet connectivity, the user account performing the enrollment must have a valid Intune license assigned (e.g., Microsoft 365 E3, E5, or standalone Intune). Without the license, the Intune service rejects the enrollment request, returning this error.

Exam trap

The trap here is that candidates often confuse enrollment restrictions or TPM issues with licensing errors, but Microsoft specifically uses error code 0x80180014 to isolate license assignment as the root cause.

How to eliminate wrong answers

Option A is wrong because enrollment restrictions for personal devices apply to the device's ownership type (corporate vs. personal), not to licensing; the error 0x80180014 is not related to ownership restrictions. Option B is wrong because the question explicitly states the device is registered in Autopilot, so this cannot be the cause. Option D is wrong because TPM attestation failure would produce a different error code (e.g., 0x80070520 or 0x80090016) and is unrelated to the 0x80180014 licensing error.

Full explanation →

705

MCQmedium

A company uses Microsoft Intune to manage Windows 11 devices. Users report that the Company Portal app is not showing required applications. You verify that the devices show as 'Compliant' in Microsoft Intune. Which configuration should you check first?

A.Check the Microsoft Entra ID (Azure AD) configuration for the device.

B.Check the Windows Update for Business ring assignments.

C.Check the device compliance policy settings.

D.Check the application assignments in Intune.

AnswerD

If the user or device is not assigned to the application, it will not appear in Company Portal.

Why this answer

The most common reason required applications are not visible in Company Portal is that the applications have not been assigned to the user or device group. Even if a device is compliant, Intune will only display applications that are assigned with an 'Available' intent to the user or device. Checking application assignments first directly addresses the symptom without assuming other configurations are misconfigured.

Exam trap

The trap here is that candidates often assume compliance policy issues cause application visibility problems, but Intune separates compliance evaluation from application assignment; a compliant device can still miss apps if the assignments are misconfigured.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID (Azure AD) configuration primarily controls authentication, device registration, and conditional access, not the visibility of assigned applications in Company Portal. Option B is wrong because Windows Update for Business ring assignments control update deferral and delivery optimization, not application deployment or visibility. Option C is wrong because the device is already marked as 'Compliant', so compliance policy settings are not the cause; compliance policies affect conditional access and device health, not the display of assigned applications.

Full explanation →

706

MCQmedium

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

A.Compliant, because the OS version is within the allowed range.

B.Non-compliant, because the firewall is disabled.

C.Compliant, because the policy includes a grace period for firewall.

D.Non-compliant, because the OS version is not within the allowed range.

AnswerB

Active firewall is required; disabling it makes the device non-compliant.

Why this answer

The compliance policy requires the firewall to be enabled. Since the device has a disabled firewall, it fails that specific requirement, making it non-compliant regardless of meeting other conditions like OS version. In Microsoft Intune, compliance policies evaluate each setting independently; a single non-compliant setting results in an overall non-compliant status.

Exam trap

The trap here is that candidates assume meeting the OS version requirement alone makes the device compliant, ignoring that compliance policies enforce all configured settings independently, and a disabled firewall is a distinct failure condition.

How to eliminate wrong answers

Option A is wrong because meeting the OS version requirement does not override a failed firewall requirement; compliance is evaluated per setting, and any single non-compliant setting makes the device non-compliant. Option C is wrong because the exhibit shows no grace period configured for the firewall setting; grace periods are optional and must be explicitly set per setting in the policy. Option D is wrong because the OS version (10.0.19044) is within the allowed range specified in the policy, so this is not a cause of non-compliance.

Full explanation →

707

MCQhard

Your organization manages Android Enterprise personally-owned work profile devices with Microsoft Intune. You need to deploy a managed Google Play app to these devices. The app is already approved in managed Google Play and added to Intune. When you assign the app as 'Required' to a user group, some users report that the app is not installed on their devices, and they do not see it in the work profile. You verify that the devices are enrolled and checked in with Intune. The app is listed as 'Pending' in the Intune console for those devices. What is the most likely cause?

A.The app is not approved in managed Google Play for the organization.

B.The devices do not have a VPN profile configured.

C.The users do not have an app protection policy assigned.

D.The managed Google Play Store app is disabled on the devices.

AnswerD

If disabled, apps cannot be installed in the work profile.

Why this answer

In a work profile, the managed Google Play Store app must be present and active; if it is disabled, apps cannot be installed. Option A is wrong because the app is already approved. Option B is wrong because VPN is not required.

Option C is wrong because there is no app protection policy requirement for installation.

Full explanation →

708

Multi-Selecthard

You are configuring Windows Information Protection (WIP) in Microsoft Intune. You want to protect corporate data from being accidentally shared to personal locations while still allowing the user to work productively. Which THREE settings should you configure?

Select 3 answers

A.Configure a device configuration profile to enable WIP.

B.Set the 'Share over' data transfer policy to 'Block'.

C.Define network boundaries (corporate IP ranges, DNS suffixes).

D.Configure the data recovery agent certificate.

E.Add protected apps that are allowed to access corporate data.

AnswersC, D, E

Network boundaries help identify corporate data.

Why this answer

Options C, D, and E are correct. To protect corporate data with Windows Information Protection (WIP) in Intune, you must define network boundaries (C) to identify corporate network locations, configure a data recovery agent certificate (D) to allow encrypted data recovery, and add protected apps (E) that are allowed to access corporate data. Option A is incorrect because WIP is enabled through a Windows Information Protection policy, not a device configuration profile.

Option B is incorrect because setting 'Share over' to 'Block' would prevent all sharing, which is not productive; WIP uses data transfer policies to allow controlled sharing.

Full explanation →

709

MCQeasy

Refer to the exhibit. You are configuring a Windows Autopilot profile. The profile specifies enrollmentType as 'azureAdJoined'. Which scenario does this profile support?

A.Self-deploying mode where no user interaction is required.

B.User-driven deployment with Microsoft Entra ID join.

C.Hybrid Microsoft Entra ID join with on-premises domain controller.

D.On-premises Active Directory domain join only.

AnswerB

User-driven Entra ID join is the standard scenario.

Why this answer

The enrollmentType 'azureAdJoined' in a Windows Autopilot profile specifically configures a user-driven deployment that joins the device to Microsoft Entra ID (formerly Azure AD). In this mode, the end user provides their Microsoft Entra ID credentials during the out-of-box experience (OOBE), and the device is registered as a Microsoft Entra ID joined device, enabling single sign-on and compliance policies without requiring on-premises infrastructure.

Exam trap

The trap here is that candidates often confuse 'azureAdJoined' with self-deploying mode (option A) because both result in Microsoft Entra ID join, but the key differentiator is that self-deploying mode requires additional profile settings (like a device enrollment manager account) and is intended for kiosk or shared devices, not user-driven scenarios.

How to eliminate wrong answers

Option A is wrong because self-deploying mode uses enrollmentType 'azureADJoined' but with a different profile setting (selfDeployingMode = true) and requires no user interaction; the question specifies only enrollmentType as 'azureAdJoined', which does not imply self-deploying mode. Option C is wrong because hybrid Microsoft Entra ID join requires an on-premises domain controller and uses enrollmentType 'azureADHybridJoined' or a profile configured for hybrid join, not 'azureAdJoined'. Option D is wrong because on-premises Active Directory domain join is not supported by Windows Autopilot; Autopilot only supports Microsoft Entra ID join or hybrid Microsoft Entra ID join, and 'azureAdJoined' explicitly targets cloud-only join.

Full explanation →

710

MCQmedium

Your organization uses Microsoft Intune to manage iOS devices. You need to prevent users from removing the Intune Company Portal app from their devices. Which setting should you configure?

A.Block app removal in device restrictions

B.Block screen capture

C.Require PIN for app store purchases

D.Block jailbroken devices

AnswerA

Blocking app removal prevents users from uninstalling the Company Portal.

Why this answer

The 'Block app removal' setting in iOS device restrictions prevents users from uninstalling the Company Portal app, ensuring it remains on the device for management. Option B is incorrect because blocking screen capture does not affect app removal. Option C is incorrect because requiring a PIN for app store purchases is unrelated to app removal.

Option D is incorrect because blocking jailbroken devices addresses security risks, not app removal.

Full explanation →

711

MCQhard

You have deployed the compliance policy shown in the exhibit. A Windows 10 device reports as non-compliant. The device has Windows 10 version 21H2 (build 19044.1288), password is set with 8 characters and includes numbers only, firewall is active, Defender is enabled, and BitLocker is on. Which setting is causing non-compliance?

A.passwordMinimumLength

B.passwordRequiredType

C.osMinimumVersion

D.activeFirewallRequired

AnswerB

The password is numbers only, not alphanumeric.

Why this answer

The compliance policy requires an alphanumeric password (letters and numbers), but the device uses a password with numbers only. Option A is incorrect because a password length of 8 meets the minimum length requirement. Option C is incorrect because the device's OS build (19044.1288) falls within the allowed range (19042.0 to 19045.999).

Option D is incorrect because the firewall is active.

Full explanation →

712

MCQmedium

Refer to the exhibit. A Microsoft Graph PowerShell cmdlet retrieves devices. What is the purpose of this query?

A.To find Windows devices that are compliant

B.To find Windows devices with an operating system version earlier than 2025

C.To find Windows devices enrolled before January 1, 2025

D.To find Windows devices that have not synced since before January 1, 2025

AnswerD

The query uses Get-MgDevice with a filter on approximateLastSignInDateTime being less than 2025-01-01T00:00:00Z, retrieving devices that have not synced since that date.

Why this answer

The query uses Get-MgDevice with a filter on approximateLastSignInDateTime being less than 2025-01-01T00:00:00Z. This filter retrieves devices whose last approximate sign-in occurred before January 1, 2025, indicating they have not synced since that date. The -and operator with deviceId -ne $null ensures only actual devices (not null device IDs) are returned.

Option D correctly identifies this as finding devices that have not synced since before January 1, 2025.

Exam trap

The trap here is that candidates confuse `approximateLastSignInDateTime` with `enrolledDateTime`, leading them to incorrectly select Option C, which refers to enrollment date instead of last sync date.

How to eliminate wrong answers

Option A is wrong because the query does not include any filter on `complianceState` or `isCompliant`; it only filters on `approximateLastSignInDateTime` and `deviceId`. Option B is wrong because the query does not reference `operatingSystemVersion` or any version-related property; it filters on a date, not an OS version. Option C is wrong because the filter uses `approximateLastSignInDateTime`, which tracks the last sign-in or sync time, not the enrollment date (`enrolledDateTime`); the query would need to filter on `enrolledDateTime` to find devices enrolled before a specific date.

Full explanation →

713

MCQhard

Your organization uses Microsoft Defender for Endpoint to manage device security. You need to ensure that all Windows devices are reporting security events to Microsoft Defender XDR. You have verified that the Microsoft Defender for Endpoint service is running on the devices. However, some devices show as 'inactive' in the Microsoft Defender XDR console. What is the most likely cause?

A.The device is not compliant with Intune compliance policies.

B.The device is not enrolled in Microsoft Intune.

C.The device does not have Microsoft Defender Antivirus enabled.

D.The Microsoft Defender for Endpoint sensor is not connected to the cloud service.

AnswerD

Inactive status typically indicates a communication issue between the sensor and the cloud.

Why this answer

The 'inactive' status in Microsoft Defender XDR indicates that the Defender for Endpoint sensor on the device has lost connectivity to the cloud service. Even if the service is running locally, the sensor must maintain an active HTTPS connection (using TLS 1.2 or higher) to the Defender for Endpoint backend to send telemetry and receive policy updates. Without this cloud connectivity, the device cannot report security events, resulting in the 'inactive' state.

Exam trap

The trap here is that candidates assume a running service equals full functionality, but the exam tests the distinction between the local service state and the cloud connectivity required for the sensor to report as 'active' in the console.

How to eliminate wrong answers

Option A is wrong because Intune compliance policies govern device configuration and access control, not the reporting status of Defender for Endpoint; a non-compliant device can still be active in Defender XDR. Option B is wrong because enrollment in Microsoft Intune is not a prerequisite for Defender for Endpoint; devices can be onboarded via Group Policy, local script, or other methods without Intune. Option C is wrong because Microsoft Defender Antivirus is a separate component; the Defender for Endpoint sensor can function and report events even if the antivirus is disabled or replaced by a third-party solution.

Full explanation →

714

MCQhard

You are troubleshooting an app deployment issue. A Win32 app fails to install on some Windows 10 devices. The Intune management extension logs show error code 0x80070643. What is the most likely cause?

A.The app package is corrupted

B.The device does not meet the minimum OS version requirement

C.A pending reboot from a previous installation is blocking the install

D.The user does not have admin privileges

AnswerC

0x80070643 often means 'Installation failure, reboot required'.

Why this answer

Error code 0x80070643 translates to 'ERROR_INSTALL_FAILURE' and is commonly associated with a pending reboot that blocks the installation of a Win32 app via Intune. The Intune Management Extension checks for pending reboot status before executing app installations; if a reboot is required, the installation fails with this error to prevent system instability.

Exam trap

The trap here is that candidates often confuse 0x80070643 with a generic installation failure and assume it indicates a corrupted package or permission issue, but the specific error code is tied to reboot-pending conditions in Windows Installer and Intune deployments.

How to eliminate wrong answers

Option A is wrong because a corrupted app package typically results in error codes like 0x8007000D or 0x80091007, not 0x80070643, and would fail during extraction or verification. Option B is wrong because an OS version requirement failure would produce a different error, such as 0x80073CFD (ERROR_INSTALL_OPTIONAL_FEATURE_REQUIRES_REBOOT) or a specific compliance error, not 0x80070643. Option D is wrong because the Intune Management Extension runs in the SYSTEM context, so admin privileges are not required for the user; a lack of admin rights would cause a different error like 0x80070005 (E_ACCESSDENIED).

Full explanation →

715

Multi-Selecteasy

You are configuring a Microsoft Intune app configuration policy for a managed iOS app. Which THREE types of settings can you include in the policy?

Select 3 answers

A.Permissions such as location or camera

B.Configuration settings (key-value pairs)

C.Compliance rules for the app

D.Network requirements like VPN

E.Connection string for a backend service

AnswersA, B, E

Permissions can be configured in app config.

Why this answer

Intune app configuration policies for managed iOS apps can include permissions settings (e.g., location, camera, contacts) to control whether the app can access device features. These are defined using the iOS managed app configuration schema, which allows you to specify permission behaviors such as 'Allow,' 'Deny,' or 'Prompt' for each protected resource.

Exam trap

The trap here is that candidates confuse app configuration policies (which deliver settings like key-value pairs and permissions) with app protection policies (which enforce compliance rules and data loss prevention), leading them to incorrectly select compliance rules as a valid setting type.

Full explanation →

716

MCQmedium

A user reports that their Windows 10 device is not receiving configuration policies from Intune. The device shows as 'Enrolled' but the last check-in was 5 days ago. What is the most likely cause?

A.The device is connected through a VPN that blocks Intune traffic.

B.The device has not checked in for more than 7 days, causing Intune to mark it as inactive.

C.The device has been unenrolled from Intune.

D.The Intune Connector for Active Directory is not configured.

AnswerA

Correct. A VPN that blocks Intune traffic can prevent the device from communicating with the Intune service, causing the device to appear enrolled but not receive policies. The last check-in being 5 days ago suggests a persistent connectivity issue.

Why this answer

The most likely cause is that the device is connected through a VPN that blocks Intune traffic. Intune requires direct internet access to communicate with its service. If the VPN restricts or filters this traffic, the device may remain enrolled but unable to check in or receive policies.

Option B is incorrect because the device last checked in 5 days ago, which is within the 7-day window, so it would not be marked inactive. Option C is incorrect because the device shows as 'Enrolled'. Option D is incorrect because the Intune Connector for Active Directory is used for hybrid Azure AD join scenarios, not for direct policy delivery to enrolled devices.

Exam trap

Do not assume that a check-in time of 5 days automatically means the device is within the acceptable range; the issue here is connectivity, not inactivity.

Full explanation →

717

MCQhard

Refer to the exhibit. You are configuring a Windows Update Ring policy in Microsoft Intune. You want the pilot devices to install feature updates 30 days after Microsoft releases them, but you also need to ensure that users cannot postpone updates indefinitely. However, users are reporting that updates are installing outside of active hours. What is the most likely cause?

A.The 'updateNotificationLevel' is set to 2, which suppresses user notifications about updates.

B.The 'automaticUpdateBehavior' value of 4 is incorrect; it should be set to 3 to install during active hours.

C.The device's time zone is not aligned with the active hours configured in the policy.

D.The feature update deferral of 30 days is too short; it should be 60 days to align with the pilot timeline.

AnswerC

Time zone mismatch can cause updates to install outside the intended window.

Why this answer

Windows Update for Business uses the device's local time zone to determine active hours. If the device's time zone does not match the active hours configured in the Intune policy, updates can install outside the intended window, even if the policy settings are otherwise correct.

Exam trap

The trap here is that candidates often focus on deferral periods or update behavior settings, overlooking that active hours are time-zone-dependent and must match the device's local time zone to function correctly.

How to eliminate wrong answers

Option A is wrong because 'updateNotificationLevel' set to 2 controls the level of notifications shown to users (e.g., turning off restart warnings), but it does not affect when updates install relative to active hours. Option B is wrong because 'automaticUpdateBehavior' value of 4 (auto install and restart at scheduled time) is correct for enforcing updates during active hours; value 3 (auto install and notify for restart) would allow users to postpone, which contradicts the requirement to prevent indefinite postponement. Option D is wrong because the feature update deferral of 30 days is a grace period before installation, not related to active hours compliance; extending it to 60 days would not fix the time zone mismatch.

Full explanation →

718

MCQmedium

A company uses Microsoft Intune to manage macOS devices. They need to deploy a custom plist configuration file to set security settings. Which policy type should they use?

A.Device configuration profile (custom)

B.App protection policy

C.Device compliance policy

D.Device cleanup rule

AnswerA

Custom configuration profiles allow uploading plist files for macOS.

Why this answer

A custom device configuration profile in Microsoft Intune allows administrators to deploy plist files to macOS devices, enabling the configuration of settings not covered by built-in templates. This is the correct policy type for deploying a custom plist file because it directly supports uploading and assigning property list files to enforce specific security configurations.

Exam trap

The trap here is that candidates may confuse 'custom configuration profiles' with 'compliance policies' because both involve security settings, but compliance policies only evaluate and report, not deploy configuration files.

How to eliminate wrong answers

Option B is wrong because App protection policies are designed to manage how apps access and handle corporate data on mobile devices, not to deploy system-level configuration files like plists. Option C is wrong because Device compliance policies evaluate whether devices meet security requirements (e.g., encryption, OS version) and trigger conditional access, but they do not deploy configuration files. Option D is wrong because Device cleanup rules automatically remove inactive devices from Intune after a specified period; they have no role in deploying configuration settings.

Full explanation →

719

Multi-Selectmedium

Which TWO of the following can be used to deploy Microsoft 365 Apps to Windows devices managed by Microsoft Intune? (Select TWO.)

Select 2 answers

A.Configuration Manager

B.Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type

C.Group Policy

D.Win32 app wrapper

E.Microsoft 365 Apps admin center

AnswersB, E

Built-in app type specifically for Office deployment.

Why this answer

Both B and E are correct. The Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type (B) provides the native deployment mechanism within Intune. The Microsoft 365 Apps admin center (E) is used to configure the deployment settings (e.g., update channel, languages, architecture), which are then applied when the Intune app type is assigned to devices.

Together, they enable the deployment of Microsoft 365 Apps to Windows devices managed by Intune.

Exam trap

A common mistake is to think that only the Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type is sufficient for deployment, overlooking that the Microsoft 365 Apps admin center is also used to configure and initiate the deployment settings. Conversely, some may assume the admin center alone can deploy without the Intune app type, but the deployment requires both. Additionally, candidates often incorrectly select Configuration Manager or Group Policy, which are not native Intune deployment methods for Microsoft 365 Apps.

Full explanation →

720

MCQmedium

A company uses Microsoft Intune to manage iOS/iPadOS devices. The compliance policy requires a minimum OS version of 15.0. A user reports that their iPad running iOS 14.8 cannot access company email and shows as non-compliant. However, the device is up to date with the latest available OS for that hardware. What should you do to allow the device to access email while maintaining security?

A.Configure a compliance grace period of 30 days on the policy.

B.Change the minimum OS version to 14.8 in the policy.

C.Delete the compliance policy that requires iOS 15.0.

D.Request the user to update the iPad to iOS 15.0.

AnswerA

A grace period allows temporary access while the user updates.

Why this answer

A compliance grace period allows the device to remain non-compliant for a specified duration (e.g., 30 days) without immediately blocking access to company resources. This gives the user time to update the OS if possible, but since the iPad hardware cannot go beyond iOS 14.8, the grace period still permits email access while the device is marked non-compliant, maintaining security by not permanently exempting the device.

Exam trap

The trap here is that candidates often choose to lower the OS version requirement (Option B) or delete the policy (Option C) as a quick fix, failing to recognize that a grace period is the designed Intune feature to handle temporary or hardware-limited non-compliance without compromising the overall security baseline.

How to eliminate wrong answers

Option B is wrong because lowering the minimum OS version to 14.8 would permanently weaken the security baseline for all devices, not just the one that cannot update. Option C is wrong because deleting the compliance policy entirely removes the OS version requirement for all devices, which is an overreaction and compromises security. Option D is wrong because requesting the user to update to iOS 15.0 is impossible on hardware that does not support that version, so it is not a viable solution.

Full explanation →

721

MCQmedium

A user has a Windows 10 device that is managed by Intune. The device is compliant but the user reports that they cannot access corporate email on their device. The email profile is deployed via Intune. Other users can access email successfully. What should you check first?

A.Check if the email profile is assigned to the user.

B.Re-create the email profile for all users.

C.Verify device compliance status.

D.Check if the user's certificate is valid and assigned.

AnswerD

Certificate issues are a common cause.

Why this answer

When an email profile is deployed via Intune and the device is compliant, the most likely cause of a single user's failure to access corporate email is an issue with certificate-based authentication. Intune often uses SCEP or PKCS certificates to authenticate email access, and if the user's certificate is missing, expired, or not properly assigned, the email profile will fail to connect even though the device is compliant and the profile is assigned.

Exam trap

The trap here is that candidates assume a compliant device guarantees email access, overlooking that certificate-based authentication is a separate layer that must be validated independently, and that a single user's failure often points to a user-specific certificate issue rather than a global policy or profile problem.

How to eliminate wrong answers

Option A is wrong because the email profile is deployed via Intune and other users can access email, so the profile is likely assigned correctly; checking assignment again would not resolve a certificate issue. Option B is wrong because re-creating the email profile for all users is an unnecessary and disruptive action that does not address the root cause of a single user's certificate problem. Option C is wrong because the question explicitly states the device is compliant, so verifying compliance status again would not identify the certificate-related failure.

Full explanation →

722

Matchingmedium

Match each MDM (Mobile Device Management) enrollment method to its typical scenario.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

User-owned devices enrolled with user affinity

Company-owned devices assigned to a specific user

Shared or kiosk devices not tied to a user

Zero-touch deployment for new Windows devices

Enroll multiple devices using a shared account

Why these pairings

Correct matches: Apple Business Manager automates enrollment of corporate iOS devices; Android Enterprise Work Profile supports BYOD Android with work/personal separation. Common confusions include mistaking Windows Autopilot for Android enrollment and confusing user-driven enrollment with automated methods.

Full explanation →

723

MCQeasy

You have devices enrolled in Microsoft Intune. You need to configure a policy that requires a PIN of at least 6 characters for accessing Microsoft Entra ID resources. Which policy type should you configure?

A.Device compliance policy

B.Conditional Access policy

C.App protection policy

D.Device configuration policy

AnswerB

Conditional Access policies can require a PIN or other authentication methods for accessing Microsoft Entra ID resources.

Why this answer

Conditional Access policies (Option B) can require a PIN for accessing Microsoft Entra ID resources. Option A is incorrect because device compliance policies evaluate device health but do not enforce PIN requirements for resource access. Option C is incorrect because app protection policies manage app-level data protection, not PIN requirements for Entra ID access.

Option D is incorrect because device configuration policies manage device settings like email profiles, not access policies.

Full explanation →

724

MCQeasy

You have a hybrid Azure AD joined Windows 10 device that is managed by Microsoft Intune. The device is not receiving policies. You verify that the device is enrolled and shows in Intune. You also verify that the user has an appropriate license. What should you check next?

A.Verify the MDM discovery URL and enrollment configuration in Microsoft Entra ID.

B.Re-enroll the device in Intune.

C.Ensure the device has internet connectivity.

D.Assign a compliance policy to the device.

AnswerA

Incorrect MDM configuration can prevent policy delivery.

Why this answer

The device is hybrid Azure AD joined and enrolled in Intune, but policies are not applying. Since enrollment and licensing are confirmed, the next likely cause is a misconfiguration in the MDM discovery URL or enrollment scope in Microsoft Entra ID (formerly Azure AD). This URL tells devices where to find the Intune MDM service; if it is incorrect or not configured, the device cannot retrieve policies even though it appears enrolled.

Exam trap

The trap here is that candidates assume a successfully enrolled device will always receive policies, but Microsoft Entra ID's MDM configuration acts as a gatekeeper that must be correctly set for policy delivery to function.

How to eliminate wrong answers

Option B is wrong because re-enrolling the device would not fix a configuration issue with the MDM discovery URL or enrollment scope; it would only repeat the same enrollment process that already succeeded. Option C is wrong because internet connectivity is already implied by the device being enrolled and showing in Intune; without connectivity, enrollment itself would fail. Option D is wrong because assigning a compliance policy assumes the device can receive policies, but the core issue is that the device is not receiving any policies at all, so a compliance policy would not be delivered either.

Full explanation →

725

MCQhard

You are troubleshooting an Intune enrollment issue on a Windows 10 device. The device is Microsoft Entra joined, but the enrollment status shows 'Pending'. What is the most likely cause?

A.The device is not compliant with a conditional access policy.

B.The device does not have BitLocker enabled.

C.The Enrollment Status Page (ESP) profile is not assigned to the device.

D.The MDM authority is not set to Intune.

AnswerC

ESP profiles can cause the enrollment to hang in 'Pending' if not configured or if there is a timeout.

Why this answer

The Enrollment Status Page (ESP) tracks the installation of profiles, policies, and apps during enrollment. If the ESP profile is not assigned to the device, the enrollment process may hang in a 'Pending' state waiting for the ESP configuration. Option A is incorrect because conditional access policies are evaluated after enrollment, not during.

Option B is incorrect because BitLocker is a disk encryption feature unrelated to enrollment status. Option D is incorrect because the MDM authority is set at the tenant level; if it were not set to Intune, enrollment would fail entirely, not just show 'Pending'.

Full explanation →

726

MCQmedium

Refer to the exhibit. An administrator runs this PowerShell command using the Microsoft Graph PowerShell SDK. The output returns no devices. However, the administrator knows that there are non-compliant Windows devices in Intune. What is the most likely reason?

A.The filter string is case-sensitive and should be 'windows' in lowercase.

B.The cmdlet requires the -All parameter to return all devices.

C.The -Filter parameter is not supported for this cmdlet.

D.The admin does not have the required permissions to read device compliance.

AnswerB

Without -All, the cmdlet may only return a subset.

Why this answer

The Get-MgDeviceManagementManagedDevice cmdlet from the Microsoft Graph PowerShell SDK, by default, returns only the first 100 devices. When a filter is applied and no devices are returned despite known non-compliant devices existing, the most common cause is that the result set is truncated. Adding the -All parameter forces the cmdlet to page through all results and return the complete set of devices, including those that match the filter.

Exam trap

The trap here is that candidates assume a filter returning no results means the filter syntax is wrong or permissions are missing, when in fact the default page size truncation silently hides matching devices that exist on subsequent pages.

How to eliminate wrong answers

Option A is wrong because the filter string for the 'operatingSystem' property in Microsoft Graph is case-insensitive; 'Windows' and 'windows' would match the same devices. Option C is wrong because the -Filter parameter is fully supported for Get-MgDeviceManagementManagedDevice and is used to query device properties like operatingSystem. Option D is wrong because if the administrator lacked permissions, the cmdlet would return an access denied error, not an empty result set with no error.

Full explanation →

727

MCQhard

A company uses Microsoft Intune to manage iOS devices. The administrator configures a device compliance policy that requires a minimum OS version of 15.0. Users report that devices running iOS 14.8 are marked non-compliant even after updating to iOS 15.0. What is the most likely cause?

A.The device has not checked in with Intune after the update

B.The compliance policy requires a grace period

C.The update was not applied successfully

D.The compliance policy is not assigned to the correct user group

AnswerA

Compliance evaluation occurs at check-in; if the device hasn't checked in, status remains.

Why this answer

The most likely cause is that the device has not checked in with Intune after the update. Intune relies on periodic check-ins to evaluate compliance; if the device updated to iOS 15.0 but hasn't completed a check-in, Intune still sees the last reported OS version (14.8) and marks it non-compliant. A forced sync or waiting for the next scheduled check-in resolves this.

Exam trap

The trap here is that candidates assume the compliance policy is evaluated in real-time or that a successful OS update automatically triggers a compliance re-evaluation, when in fact Intune relies on scheduled or manual check-ins to refresh device state.

How to eliminate wrong answers

Option B is wrong because a grace period gives users time to remediate non-compliance (e.g., update the OS) but does not affect the reporting of the current OS version after an update; the issue is about stale data, not a delay in enforcement. Option C is wrong because users report the update was applied, and the problem is that Intune hasn't received the new version, not that the update failed—failed updates would typically leave the device on 14.8 with no change. Option D is wrong because the compliance policy is assigned and affecting the correct devices (they are marked non-compliant), so assignment to the wrong group would mean no compliance evaluation at all, not a stale version mismatch.

Full explanation →

728

MCQhard

Refer to the exhibit. The JSON snippet shows a device compliance policy for Windows 10. You assign this policy to a device group. Some devices report as noncompliant even though they have BitLocker enabled and meet password requirements. What is the most likely cause?

A.The deviceThreatProtectionEnabled setting should be false.

B.The password minimum length is too short.

C.The storageRequireEncryption setting conflicts with BitLocker.

D.The devices are not enrolled in Microsoft Defender for Endpoint.

AnswerD

Device threat protection requires Defender for Endpoint to report a threat level.

Why this answer

The deviceThreatProtectionEnabled setting requires devices to be enrolled in Microsoft Defender for Endpoint to report threat levels. Without this enrollment, the compliance policy cannot evaluate the threat status, causing devices to be marked as noncompliant even if BitLocker and password policies are satisfied.

Exam trap

The trap here is that candidates often assume BitLocker and storageRequireEncryption are redundant or conflicting, but the real issue is the dependency on Microsoft Defender for Endpoint enrollment for threat-based compliance policies.

How to eliminate wrong answers

Option A is wrong because setting deviceThreatProtectionEnabled to false would disable the threat protection requirement, which would not resolve the noncompliance caused by missing Defender for Endpoint enrollment; the setting itself is valid when the service is configured. Option B is wrong because the password minimum length being too short would cause noncompliance only if the actual device password is shorter than the policy requirement, but the question states devices meet password requirements, so this is not the issue. Option C is wrong because storageRequireEncryption and BitLocker do not conflict; storageRequireEncryption enforces device encryption, which BitLocker provides, so both settings work together to ensure compliance.

Full explanation →

729

Multi-Selectmedium

Your organization plans to use Microsoft Intune to manage macOS devices. Which TWO prerequisites are required for macOS enrollment?

Select 2 answers

A.An Apple Push Notification service (APNs) certificate.

B.A user enrollment certificate from a public CA.

C.A Volume Purchase Program (VPP) token.

D.Microsoft Entra ID join or registration.

E.A Microsoft Configuration Manager connector.

AnswersA, D

APNs certificate is required for all Apple device management in Intune.

Why this answer

An Apple Push Notification service (APNs) certificate is required for macOS enrollment because it establishes a persistent, secure connection between Microsoft Intune and Apple's servers. This certificate enables Intune to send management commands, policies, and app installations to macOS devices. Without a valid APNs certificate, Intune cannot communicate with enrolled devices, making enrollment impossible.

Exam trap

The trap here is that candidates often confuse optional post-enrollment features (like VPP tokens or Configuration Manager connectors) with mandatory enrollment prerequisites, or mistakenly think a public CA certificate is needed when Intune handles certificate provisioning internally.

Full explanation →

730

Multi-Selecteasy

An organization uses Microsoft Defender for Endpoint to detect threats on Windows devices. The security team wants Intune to automatically increase the device's risk score when a threat is detected. Which TWO components are required?

Select 2 answers

A.Device compliance policy with 'Require device threat level' set to 'Low'

B.Microsoft Defender for Endpoint connector in Intune

C.Device configuration profile

D.App protection policy

E.Conditional Access policy

AnswersA, B

Compliance policy uses Defender for Endpoint risk score.

Why this answer

A device compliance policy with 'Require device threat level' set to 'Low' forces Intune to evaluate the threat level reported by Microsoft Defender for Endpoint. When a threat is detected that exceeds the 'Low' threshold, the device is marked as noncompliant, which effectively increases the device's risk score in Intune and can trigger subsequent actions like Conditional Access blocks.

Exam trap

The trap here is that candidates often confuse a device configuration profile with a compliance policy, thinking that a configuration profile can enforce threat-based risk scoring, but only the compliance policy evaluates the threat level from the Defender connector.

Full explanation →

731

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting even though the policy is assigned. What should you check first?

A.Confirm that the device has a compatible TPM chip and that it is enabled.

B.Verify that Secure Boot is disabled in BIOS.

C.Ensure devices are marked as compliant in Intune.

D.Check if the BitLocker policy is using the Settings catalog.

AnswerA

BitLocker requires a TPM (1.2 or 2.0) that is enabled and initialized.

Why this answer

BitLocker requires a compatible TPM (Trusted Platform Module) chip, version 1.2 or 2.0, that is enabled and activated in the BIOS/UEFI. If the TPM is missing, disabled, or not initialized, the BitLocker policy will apply but encryption will fail silently or remain pending. This is the most common root cause for devices not encrypting despite policy assignment.

Exam trap

The trap here is that candidates often assume the issue is policy-related (e.g., compliance or configuration source) and overlook the fundamental hardware prerequisite of a functional TPM, which is the first thing to verify in any BitLocker troubleshooting workflow.

How to eliminate wrong answers

Option B is wrong because Secure Boot should be enabled, not disabled, for BitLocker to function properly; disabling Secure Boot can actually prevent encryption or cause recovery mode. Option C is wrong because device compliance status in Intune does not control BitLocker encryption enforcement; the policy applies regardless of compliance, though compliance can be used for conditional access. Option D is wrong because the Settings catalog is simply a method to configure policy settings; whether the policy uses it or not has no bearing on encryption failure — the issue is a hardware prerequisite, not the policy configuration source.

Full explanation →

732

Matchingmedium

Match each Windows 10/11 edition to its applicable Microsoft 365 feature.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Supports MDM and basic compliance policies

Full feature set including Windows Defender Application Guard

Similar to Enterprise but for academic institutions

Pro features with education-specific settings

Not supported for MDM enrollment

Why these pairings

Windows 10 Pro supports Azure AD Join and Intune MDM; Windows 10 Enterprise provides full Defender for Endpoint; Windows 11 Home lacks these enterprise features. Common confusions include thinking Pro supports all security features or that Home supports Autopilot.

Full explanation →

733

MCQeasy

You need to deploy a line-of-business (LOB) app to 100 Windows 10 devices managed by Intune. The app is packaged as an .msi file. Which app type should you choose in Intune?

A.Windows app (Win32)

B.Line-of-business app

C.Web link

D.Microsoft Store app

AnswerB

Intune supports .msi as a line-of-business app.

Why this answer

For deploying a line-of-business (LOB) app packaged as an .msi file to Windows 10 devices managed by Intune, the correct app type is 'Line-of-business app'. This app type is specifically designed for sideloading enterprise internal apps that are not distributed via the Microsoft Store, and it supports .msi, .appx, and .appxbundle file formats. It allows direct upload of the .msi file to Intune and assigns it to users or devices without requiring complex Win32 app preparation.

Exam trap

The trap here is that candidates often confuse 'Line-of-business app' with 'Windows app (Win32)' because both support .msi files, but the Win32 app type requires additional packaging steps and is intended for complex installations, while LOB app is the simpler, direct upload option for enterprise internal apps.

How to eliminate wrong answers

Option A is wrong because 'Windows app (Win32)' is intended for .exe or .msi files that require complex installation logic, such as detection rules, dependencies, and custom return codes; it is overkill for a simple .msi LOB app and requires additional preparation like converting to .intunewin format. Option C is wrong because 'Web link' is used to deploy a shortcut to a web application, not to install a local .msi file on the device. Option D is wrong because 'Microsoft Store app' is used to deploy apps from the Microsoft Store catalog, not to upload and sideload a custom .msi file.

Full explanation →

734

MCQmedium

You are deploying a new line-of-business (LOB) app to Windows 10 devices managed by Microsoft Intune. The app requires a specific registry key to be set before installation. What is the best approach to ensure the registry key is applied before the app installs?

A.Create a compliance policy that requires the registry key and mark the app as required.

B.Use a device configuration policy to set the registry key, then assign the app as available.

C.Include a PowerShell script in the app's installation command that sets the registry key before the main installer runs.

D.Define a requirement rule in the Win32 app that checks for the registry key; if missing, use a proactive remediation script to create it.

AnswerD

Requirement rules block installation until conditions are met, and proactive remediation can enforce the prerequisite.

Why this answer

Win32 app deployment in Intune supports requirement rules that can check for prerequisites like registry keys. When the requirement is not met, you can pair the app with a proactive remediation script that creates the missing registry key before the app installation runs, ensuring the dependency is satisfied without manual intervention.

Exam trap

The trap here is that candidates often confuse compliance policies or device configuration policies with runtime prerequisites, not realizing that Intune's requirement rules and proactive remediations are the designed mechanism for enforcing pre-installation conditions for Win32 apps.

How to eliminate wrong answers

Option A is wrong because compliance policies evaluate device compliance after enrollment and do not trigger actions before app installation; they cannot enforce a registry key to be set as a prerequisite for a specific app. Option B is wrong because device configuration policies apply settings on a schedule or at enrollment, not in a guaranteed sequence before a specific app installs, and assigning the app as available does not enforce the dependency. Option C is wrong because while a PowerShell script in the installation command can set the registry key, this approach is not the best practice for Win32 apps in Intune; it mixes dependency logic with the installer, making troubleshooting and dependency management harder, and Intune's requirement rules with proactive remediation provide a cleaner, more reliable method.

Full explanation →

735

MCQeasy

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that users cannot remove the Company Portal app from their devices. Which configuration should you apply?

A.Assign the Company Portal app as 'Available for enrolled devices' with 'Removable' set to Yes.

B.Assign the Company Portal app as 'Uninstall' for all devices.

C.Assign the Company Portal app as 'Required' with 'Removable' set to No.

D.Create a device restriction policy that blocks removal of the Company Portal app.

AnswerC

This prevents users from removing the app.

Why this answer

When you assign the Company Portal app as 'Required' for iOS/iPadOS devices in Microsoft Intune, you can set the 'Removable' option to 'No'. This configuration prevents users from uninstalling the Company Portal app, ensuring it remains on the device for management and compliance purposes.

Exam trap

The trap here is that candidates often confuse device restriction policies with app assignment settings, assuming that a general policy can block app removal, when in fact the control is specific to the app's assignment properties in Intune.

How to eliminate wrong answers

Option A is wrong because setting the app as 'Available for enrolled devices' with 'Removable' set to Yes allows users to install the app from the Company Portal but also permits them to remove it, which does not meet the requirement to prevent removal. Option B is wrong because assigning the app as 'Uninstall' would remove the Company Portal app from devices, which is the opposite of ensuring it cannot be removed. Option D is wrong because iOS/iPadOS device restriction policies in Intune do not include a setting to block removal of the Company Portal app; the ability to prevent removal is controlled through the app assignment settings, not through device restrictions.

Full explanation →

736

MCQmedium

Your organization uses Microsoft Intune for device management. A user reports that their Android device is not receiving a required app that is assigned as 'Required' for all users. The device shows as 'Compliant' in Intune. What is the most likely cause?

A.The device is marked non-compliant.

B.The user has not installed the Company Portal app.

C.The device is not enrolled in Intune.

D.The app is not supported on the device's Android version.

AnswerD

App incompatibility is a common reason for required apps not installing.

Why this answer

The device is compliant and enrolled, and the user has the Company Portal app (required for Android enrollment). The most likely reason the required app is not installing is that the app is not supported on the device's Android version. Intune will skip installation if the minimum OS version requirement defined in the app assignment is not met, even if the device is otherwise compliant.

Exam trap

The trap here is that candidates assume a compliant device will always receive required apps, overlooking that app-level OS version requirements are evaluated separately from device compliance policies.

How to eliminate wrong answers

Option A is wrong because the device is explicitly stated as 'Compliant' in Intune, so non-compliance cannot be the cause. Option B is wrong because the Company Portal app is required for Android enrollment; if it were missing, the device would not be enrolled or compliant. Option C is wrong because the device shows as 'Compliant' in Intune, which requires successful enrollment; an unenrolled device would not have a compliance status.

Full explanation →

737

Multi-Selecteasy

Which TWO types of policies can be assigned to user groups in Microsoft Intune?

Select 2 answers

A.Device compliance policy

B.Enrollment restriction

C.App protection policy

D.Device configuration policy

E.Windows update ring

AnswersA, C

Compliance policies can be assigned to user groups to evaluate devices of those users.

Why this answer

Device compliance policy (A) can be assigned to user groups to define rules that devices must meet, such as requiring a minimum OS version or BitLocker encryption, and to trigger conditional access. App protection policy (C) can be assigned to user groups to manage how apps access and handle corporate data, even on unenrolled devices, by applying settings like PIN or data transfer restrictions.

Exam trap

The trap here is that candidates often assume all Intune policies can be assigned to user groups, but Microsoft explicitly restricts enrollment restrictions, device configuration policies, and update rings to device groups only.

Full explanation →

738

MCQeasy

You need to deploy a web link as an app to Android Enterprise work profile devices. Users should see the link in the Company Portal app. What type of app should you add in Microsoft Intune?

A.iOS/iPadOS web clip

B.Android store app

C.Managed Google Play web link

D.Windows app package (MSI)

AnswerC

Web links are added as web links in Managed Google Play.

Why this answer

Managed Google Play web links are the correct app type for deploying a web link as an app to Android Enterprise work profile devices. When added in Intune, this web link appears in the Company Portal app under the 'Apps' tab, allowing users to open the link directly. Other app types like iOS web clips or Android store apps do not support this specific deployment method for Android Enterprise work profiles.

Exam trap

The trap here is that candidates often confuse 'web link' deployment with 'web clip' (iOS) or assume any app type can deliver a URL, but only Managed Google Play web links are purpose-built for Android Enterprise work profiles in Intune.

How to eliminate wrong answers

Option A is wrong because iOS/iPadOS web clips are designed for Apple devices and cannot be deployed to Android Enterprise work profile devices. Option B is wrong because Android store apps are actual APK-based applications from the Google Play Store, not web links; they require a package to install, not a URL. Option D is wrong because Windows app packages (MSI) are for Windows devices and have no relevance to Android Enterprise work profile deployments.

Full explanation →

739

MCQeasy

You need to configure Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. What is the recommended method to onboard devices?

A.Install the Defender for Endpoint client manually on each device.

B.Use a device configuration profile in Intune to deploy the onboarding package.

C.Use the Microsoft 365 Defender portal to generate a script that users run.

D.Use Group Policy to configure the onboarding registry keys.

AnswerB

Correct: Device configuration profiles in Intune can deploy the onboarding package to enrolled devices.

Why this answer

Intune's device configuration profiles allow you to deploy the Defender for Endpoint onboarding package (a .zip containing the onboarding script and required files) directly to Windows 10 devices. This method is recommended as it integrates seamlessly with Intune's management framework, supports bulk deployment via policies, and ensures devices are properly configured without manual intervention or user interaction.

Exam trap

The trap here is that candidates often assume Group Policy (Option D) is the standard for all Windows management, but for Intune-managed devices, the recommended and supported method is the device configuration profile, not Group Policy, which requires on-premises infrastructure and does not integrate with cloud-based enrollment.

How to eliminate wrong answers

Option A is wrong because manually installing the Defender for Endpoint client on each device is not scalable for enterprise environments and contradicts the recommended automated approach via Intune. Option C is wrong because the Microsoft 365 Defender portal generates a script for local execution, but relying on users to run it introduces security risks, compliance gaps, and lacks centralized enforcement. Option D is wrong because Group Policy is not the recommended method for Intune-managed devices; while it can configure registry keys, it requires on-premises Active Directory and does not leverage Intune's cloud-native device management capabilities.

Full explanation →

740

MCQeasy

Refer to the exhibit. You are deploying a line-of-business iOS app. Which statement is correct about this app?

A.The app requires iOS 15.0 or later.

B.The app can only be installed on iPads.

C.The app will expire on December 31, 2025.

D.The app has no expiration date.

AnswerC

expirationDateTime is set to 2025-12-31T23:59:59Z.

Why this answer

The exhibit shows the app's expiration date is set to December 31, 2025, under the 'Expiration date' field. In Microsoft Intune, when you configure a line-of-business (LOB) iOS app, you can specify an expiration date; after that date, the app will be blocked from installation or launch. Therefore, option C is correct because the app will expire on that date.

Exam trap

In the Microsoft MD-102 exam, candidates often need to read the expiration date field carefully in the Intune portal for LOB apps, distinguishing it from other properties like minimum OS version or device family. A common trap is assuming that no expiration date is set when one is clearly displayed.

How to eliminate wrong answers

Option A is wrong because the 'Minimum OS version' field in the exhibit is not shown, and the question does not provide any evidence that the app requires iOS 15.0 or later; the expiration date is unrelated to OS version requirements. Option B is wrong because the exhibit does not specify device family restrictions (e.g., iPad-only); LOB iOS apps can be deployed to iPhones and iPads unless explicitly configured otherwise in Intune. Option D is wrong because the exhibit clearly displays an expiration date of December 31, 2025, meaning the app has a defined expiration, not no expiration.

Full explanation →

741

MCQeasy

A user's mobile device is lost. You need to remotely wipe the device using Microsoft Intune. What is the correct sequence of actions?

A.Ask the user to reset the device from the Company Portal app.

B.Create a device compliance policy with the Action for noncompliance set to 'Remote wipe'.

C.In the Microsoft Intune admin center, select the device and choose Retire/Wipe.

D.Remove the device from Microsoft Entra ID and it will automatically wipe.

AnswerC

This is the correct action to wipe a device.

Why this answer

The Retire/Wipe action in the Microsoft Intune admin center is the direct, administrator-initiated method to remotely wipe a lost device. This action sends a wipe command to the device via the Intune service, which the device's management agent (Company Portal or MDM agent) processes to perform a factory reset, removing all corporate and personal data.

Exam trap

The trap here is that candidates confuse the automatic wipe triggered by a compliance policy (Option B) with the manual, immediate wipe needed for a lost device, or they assume removing the device from Entra ID (Option D) will wipe it, which it does not.

How to eliminate wrong answers

Option A is wrong because the Company Portal app allows a user to initiate a remote wipe themselves, but the scenario states the device is lost, so the user cannot access the app; the administrator must perform the wipe. Option B is wrong because a device compliance policy with 'Action for noncompliance' set to 'Remote wipe' only triggers a wipe when the device becomes noncompliant (e.g., after a policy violation), not as an immediate, on-demand wipe for a lost device. Option D is wrong because removing a device from Microsoft Entra ID (formerly Azure AD) only revokes its access to cloud resources and does not send a wipe command; the device remains intact with all data.

Full explanation →

742

MCQhard

You are troubleshooting a Windows 10 device that fails to enroll in Intune manually via 'Access work or school'. The user receives the error 'We couldn't auto-discover a management endpoint matching the username entered'. What is the most likely cause?

A.The user does not have an Intune license assigned

B.The DNS CNAME record for enrollment is missing or incorrect

C.The MDM authority is not set to Intune

D.The device firewall is blocking traffic to manage.microsoft.com

AnswerB

Auto-discovery requires correct DNS record.

Why this answer

The error 'We couldn't auto-discover a management endpoint matching the username entered' indicates that the device cannot resolve the user's domain to an Intune MDM server via DNS. This is a classic symptom of a missing or incorrect DNS CNAME record (e.g., 'EnterpriseEnrollment.contoso.com' pointing to 'manage.microsoft.com'), which is required for automatic MDM discovery during manual enrollment. Without this record, the device cannot locate the Intune enrollment endpoint.

Exam trap

The trap here is that candidates often confuse a DNS discovery failure with a connectivity or licensing issue, but the specific wording 'auto-discover a management endpoint' is a direct clue that DNS CNAME resolution is the root cause, not firewall or license problems.

How to eliminate wrong answers

Option A is wrong because an Intune license is required for enrollment, but the error message specifically points to auto-discovery failure, not a licensing issue; a missing license would typically result in a 'not authorized' or 'license not found' error. Option C is wrong because the MDM authority being set to Intune is a prerequisite for enrollment, but the error here is about DNS resolution, not authority configuration; if the authority were misconfigured, the error would occur later in the process (e.g., after endpoint discovery). Option D is wrong because a firewall blocking traffic to manage.microsoft.com would cause a connection timeout or 'cannot reach server' error, not a discovery failure; the error occurs before any HTTPS traffic is attempted, during the DNS lookup phase.

Full explanation →

743

Multi-Selecteasy

Which THREE are valid device management actions in Microsoft Intune? (Choose three.)

Select 3 answers

A.Wipe

B.Delete

C.Retire

D.Sync

E.Reboot

AnswersA, C, D

Wipe restores the device to factory settings.

Why this answer

Wipe is a valid Intune device action that restores a device to factory default settings, removing all data and corporate resources. It is typically used for devices that are lost, stolen, or being repurposed, and it can be applied to both corporate-owned and personally-owned devices enrolled in Intune.

Exam trap

Microsoft often tests the distinction between 'Wipe' and 'Retire' actions, and candidates may confuse 'Delete' with 'Retire' or assume 'Reboot' is a built-in action when it is not directly available in the Intune console.

Full explanation →

744

MCQmedium

You are reviewing an iOS LOB app configuration in Intune. The app is assigned to a user group that includes both iPhone and iPad users. Users with iPhones report that the app does not appear in Company Portal. What is the most likely reason?

A.The bundle ID is incorrect for the app.

B.The build number is missing.

C.The app version is not specified.

D.The app is configured to deploy only to iPads.

AnswerD

The JSON shows 'iPhoneAndIPod: false', so iPhones are excluded.

Why this answer

Intune allows administrators to configure iOS LOB apps with device-type restrictions, including a setting that limits deployment to iPads only. If this setting is enabled, the app will not appear in Company Portal for iPhone users, even though they are in the assigned user group. The app's assignment is based on user group membership, but device-level filtering prevents it from being visible on unsupported device types.

Exam trap

The trap here is that candidates often assume the issue is a configuration error like an incorrect bundle ID or missing version, but they overlook the device-type restriction setting, which is a common but subtle cause of app visibility differences between iPhone and iPad users.

How to eliminate wrong answers

Option A is wrong because an incorrect bundle ID would cause the app to fail to install or launch, but it would not prevent the app from appearing in Company Portal; the app would still be listed as available. Option B is wrong because the build number is an internal versioning detail used for app updates and troubleshooting, and its absence does not affect the app's visibility in Company Portal. Option C is wrong because the app version is not required for an iOS LOB app to appear in Company Portal; it is only needed for version-specific targeting or update rules, not for basic availability.

Full explanation →

745

MCQeasy

Your organization uses Microsoft Entra ID joined devices with Windows 10. You need to ensure that only compliant devices can access corporate email in Microsoft Outlook for Windows. Which integration should you enable?

A.Create a Conditional Access policy in Microsoft Entra ID requiring compliant devices for Exchange Online.

B.Enable App Protection Policies for Outlook for Windows.

C.Require all devices to be enrolled in Intune before accessing email.

D.Configure a compliance policy in Intune to mark devices as non-compliant if not updated.

AnswerA

Conditional Access integrates with Intune compliance to block non-compliant devices.

Why this answer

Creating a Conditional Access policy in Microsoft Entra ID that requires compliant devices for Exchange Online is the correct integration because it directly enforces device compliance as a condition for accessing corporate email. This policy evaluates the device's compliance status reported by Intune before granting access to Exchange Online, ensuring only compliant devices can use Outlook for Windows.

Exam trap

The trap here is that candidates confuse App Protection Policies (which protect data at the app level) with device compliance enforcement, or assume that Intune compliance policies alone block access without a Conditional Access policy to enforce them.

How to eliminate wrong answers

Option B is wrong because App Protection Policies (APP) for Outlook for Windows manage data protection at the app level (e.g., preventing copy/paste) but do not enforce device compliance; they are designed for unmanaged or BYOD scenarios. Option C is wrong because requiring all devices to be enrolled in Intune before accessing email is a prerequisite, not an integration that enforces compliance; it does not block non-compliant enrolled devices. Option D is wrong because configuring a compliance policy in Intune to mark devices as non-compliant if not updated is a compliance rule, but it does not integrate with access control; it requires a Conditional Access policy to enforce the block.

Full explanation →

746

Multi-Selecteasy

Which TWO are valid methods to enroll Windows devices into Microsoft Intune?

Select 2 answers

A.VPN connection

B.Cloud Management Gateway

C.Azure AD join

D.Bulk enrollment using provisioning package

E.Windows Autopilot

AnswersD, E

Bulk enrollment token method.

Why this answer

Windows provisioning packages (PPKG) created with Windows Configuration Designer allow bulk enrollment of Windows devices into Intune without user interaction. This method is ideal for large-scale deployments where devices are not yet Azure AD joined or Autopilot-registered, as the PPKG contains the enrollment credentials and settings to automatically join the device to Azure AD and enroll it in Intune during the out-of-box experience (OOBE).

Exam trap

The trap here is confusing prerequisites or supporting technologies (like VPN, CMG, or Azure AD join) with actual enrollment methods, leading candidates to select options that are necessary for enrollment but do not themselves perform the enrollment action.

Full explanation →

747

MCQmedium

You need to deploy Microsoft 365 Apps for enterprise to 500 Windows 10 devices using Microsoft Intune. Devices are in multiple time zones. You want to minimize network impact during business hours. Which deployment approach should you use?

A.Use Intune 'Microsoft 365 Apps for Windows 10 and later' built-in app type with delivery optimization.

B.Deploy the offline installer using Intune Win32 app packaging.

C.Configure dynamic installation from Microsoft 365 Apps admin center with gradual rollout and set maintenance window.

D.Assign the app to a device group and set deadline for immediate installation.

AnswerC

Allows scheduling and uses CDN.

Why this answer

The Microsoft 365 Apps admin center allows you to configure a gradual rollout with a maintenance window, which lets you schedule deployments during off-peak hours across multiple time zones, minimizing network impact during business hours. This approach uses the 'Cloud Update' channel to control update distribution and can be integrated with Intune for policy enforcement, ensuring that devices in different time zones receive the installation at their respective low-activity periods.

Exam trap

The trap here is that candidates often assume Intune's built-in app type with delivery optimization (Option A) is sufficient for time-zone-aware scheduling, but delivery optimization only handles peer-to-peer caching and does not provide the maintenance window or gradual rollout control needed to minimize business-hour impact across multiple time zones.

How to eliminate wrong answers

Option A is wrong because the built-in 'Microsoft 365 Apps for Windows 10 and later' app type in Intune uses delivery optimization to reduce bandwidth, but it does not provide a maintenance window or time-zone-aware scheduling; it triggers installation immediately upon assignment, which could impact business hours in some time zones. Option B is wrong because deploying the offline installer as a Win32 app requires manual packaging and does not support gradual rollout or maintenance windows; it installs immediately when the policy reaches the device, causing network impact during business hours. Option D is wrong because assigning the app to a device group with a deadline for immediate installation forces all devices to install as soon as possible, ignoring time zone differences and potentially saturating the network during peak hours.

Full explanation →

748

MCQmedium

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a custom Windows 10 update ring that delays feature updates by 60 days and quality updates by 14 days. You create the update ring and assign it to a device group. After a week, you notice that devices are not receiving the quality updates as expected. What should you verify first?

A.Ensure the deferral period for quality updates is set to 14 days.

B.Check that the update ring is assigned to the correct group.

C.Verify that Windows Update for Business is enabled on the devices.

D.Review the device compliance status.

AnswerC

If disabled, devices won't receive updates from Intune.

Why this answer

Windows Update for Business must be enabled on Windows 10 devices for Intune update rings to apply. If it is disabled, devices ignore the update ring policy. Verifying this setting is the first troubleshooting step.

Option A is incorrect because the deferral period is set correctly according to the requirement. Option B is incorrect because the update ring is already assigned; if the assignment were wrong, no updates would apply at all, but the issue is specific to quality updates. Option D is incorrect because device compliance status does not directly affect update ring application.

Full explanation →

749

MCQeasy

A company is planning to implement Microsoft Intune for mobile device management. They want to ensure that only compliant devices can access Exchange Online. Which technology should they use?

A.Mobile Application Management (MAM) policies

B.Intune compliance policies without Conditional Access

C.Azure AD join with automatic enrollment

D.Conditional Access policies with device compliance

AnswerD

Conditional Access can block non-compliant devices.

Why this answer

Conditional Access policies with device compliance (Option D) is the correct technology because it integrates Intune compliance policies with Azure AD Conditional Access to enforce access controls on Exchange Online. When a device is marked non-compliant by Intune, Conditional Access blocks or restricts access to Exchange Online, ensuring only compliant devices can connect. This is the standard Microsoft approach for combining device management with identity-driven access control.

Exam trap

The trap here is that candidates often confuse Intune compliance policies alone with Conditional Access, thinking that marking a device non-compliant automatically blocks access, when in fact a Conditional Access policy is required to enforce the block.

How to eliminate wrong answers

Option A is wrong because Mobile Application Management (MAM) policies control app-level data protection and do not evaluate device compliance; they apply to apps regardless of device enrollment status. Option B is wrong because Intune compliance policies alone cannot block access to Exchange Online; they require a Conditional Access policy to enforce the compliance state. Option C is wrong because Azure AD join with automatic enrollment handles device registration and enrollment into Intune but does not enforce access restrictions based on compliance; it is a prerequisite, not the enforcement mechanism.

Full explanation →

750

MCQmedium

Your company has 200 iOS devices that are enrolled in Microsoft Intune via Apple Business Manager. The devices are used by field sales representatives who need access to the corporate CRM app and email. You need to ensure that if a device is lost or stolen, the corporate data can be removed without affecting personal data. The devices are configured with user affinity. What should you do?

A.Perform a full wipe on the device from Intune.

B.Retire the device from Intune.

C.Perform a selective wipe (corporate data removal) from Intune.

D.Create a device compliance policy to mark the device as noncompliant.

AnswerC

Selective wipe removes only managed corporate data.

Why this answer

Performing a selective wipe (corporate data removal) from Intune removes only corporate data while leaving personal data intact on devices with user affinity. Option A is incorrect because a full wipe removes all data, including personal data. Option B is incorrect because retiring the device removes it from management but does not remove corporate data.

Option D is incorrect because a compliance policy marks the device as noncompliant but does not remove data.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 676–750