Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 751–825 | Page 11/13

751

MCQhard

You manage a hybrid Azure AD joined Windows 10 device with Intune. The device is showing as 'Pending' enrollment. You have verified that the user has an Intune license and the device is synced with Azure AD Connect. What is the most likely issue?

A.The user is not the primary user of the device.

B.The Group Policy for automatic Intune enrollment is not applied to the device.

C.The device is not co-managed with Configuration Manager.

D.Azure AD Connect has not synced the device object.

AnswerB

Hybrid Azure AD joined devices need a GPO with the MDM discovery URL.

Why this answer

When a hybrid Azure AD joined device shows 'Pending' enrollment in Intune, the most common cause is that the Group Policy setting 'Automatically enroll devices to Microsoft Intune' has not been applied to the device. This policy triggers the automatic MDM enrollment via the device's scheduled task during user sign-in. Without this policy, the device remains in a pending state even if the user has a license and the device object is synced.

Exam trap

The trap here is that candidates often assume a synced device object and a licensed user are sufficient for enrollment, overlooking the critical Group Policy trigger that initiates the automatic MDM enrollment workflow.

How to eliminate wrong answers

Option A is wrong because the 'Pending' enrollment status is not related to the primary user assignment; Intune enrollment for hybrid Azure AD joined devices is device-based and does not require a designated primary user. Option C is wrong because co-management with Configuration Manager is not a prerequisite for Intune enrollment; it is an optional configuration that can be added after enrollment. Option D is wrong because the device object has already been synced with Azure AD Connect (as stated in the question), and the 'Pending' status indicates the enrollment process has started but is waiting for the MDM discovery step, not for the device object to appear in Azure AD.

Full explanation →

752

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom PKG file that requires administrative privileges to install. The deployment must be silent without user interaction. What should you do?

A.Use a shell script to run the PKG installer with sudo privileges via a launch daemon.

B.Add the PKG to Apple Business Manager and distribute via VPP.

C.Deploy the PKG as a line-of-business app in Intune and assign it as required.

D.Place the PKG in a network share and instruct users to install via Company Portal.

AnswerC

Intune supports PKG deployment silently on macOS.

Why this answer

Intune supports deploying PKG files as line-of-business (LOB) apps on macOS. When you upload the PKG and assign it as 'Required', Intune silently installs it using the macOS Installer framework with administrative privileges, without requiring user interaction. The Intune management agent on the device handles the installation in the system context, ensuring a silent deployment.

Exam trap

The trap here is that candidates often confuse the 'line-of-business app' deployment method with other distribution mechanisms like VPP or manual scripts, failing to recognize that Intune's LOB app assignment is the only built-in method that supports silent, privileged installation of custom PKG files on macOS.

How to eliminate wrong answers

Option A is wrong because using a shell script with sudo via a launch daemon is a manual, unsupported workaround that bypasses Intune's management capabilities and does not integrate with reporting or compliance. Option B is wrong because Apple Business Manager (ABM) and Volume Purchase Program (VPP) are used for distributing apps from the App Store, not custom PKG files; VPP does not support sideloading arbitrary PKGs. Option D is wrong because placing the PKG on a network share and instructing users to install via Company Portal requires user interaction and does not achieve silent deployment; Company Portal for macOS does not natively support silent installation of PKG files from a share.

Full explanation →

753

MCQhard

Your organization is migrating from on-premises SCCM to Microsoft Intune. You have a Win32 app that requires a custom script to run after installation. The app must be available to users in a remote office with limited internet connectivity. What should you use to deploy the app?

A.Configure a cloud management gateway (CMG) to distribute the app.

B.Store the app in Azure Files and mount it on devices.

C.Use a PowerShell script deployed via Intune to download the app from a local file share.

D.Deploy the Win32 app via Intune with Delivery Optimization and peer caching enabled.

AnswerD

This reduces internet bandwidth usage for remote offices.

Why this answer

Delivery Optimization combined with peer caching allows devices in a remote office with limited internet connectivity to download the Win32 app from other peers on the same local network, reducing WAN bandwidth usage. Intune natively supports Win32 app deployment with this feature, and the custom script can be included as a post-installation detection or requirement script. This approach aligns with the migration from SCCM to Intune while addressing connectivity constraints.

Exam trap

The trap here is that candidates often confuse Cloud Management Gateway (CMG) as an Intune feature, when it is actually an SCCM component, leading them to pick Option A despite the question explicitly stating a migration from SCCM to Intune.

How to eliminate wrong answers

Option A is wrong because a Cloud Management Gateway (CMG) is an SCCM feature for managing internet-based clients, not a method for distributing Win32 apps via Intune; it does not solve the limited connectivity issue in a remote office for Intune-managed devices. Option B is wrong because Azure Files is a cloud file share service that requires devices to have internet connectivity to mount the share, which contradicts the 'limited internet connectivity' constraint; it also does not integrate with Intune's app deployment pipeline. Option C is wrong because using a PowerShell script deployed via Intune to download from a local file share bypasses Intune's built-in app delivery and reporting mechanisms, and the script would need to handle authentication and network paths manually, making it unreliable and unsupported for Win32 app deployment.

Full explanation →

754

MCQeasy

You need to make a web app available to users in your organization through Microsoft Intune Company Portal. Which app type should you create in Intune?

A.iOS store app

B.Web app

C.Windows app (Win32)

D.Android store app

AnswerB

Web apps are used to publish web links in Company Portal.

Why this answer

To make a web app available through Microsoft Intune Company Portal, you must create a 'Web app' type. This app type allows you to add a link to a web application that users can access via the Company Portal, without needing to install a native client. Intune's Web app type supports both HTTP and HTTPS URLs and can be configured with a display name, URL, and icon for the Company Portal listing.

Exam trap

The trap here is that candidates may confuse 'Web app' with other app types like 'Windows app (Win32)' or 'iOS store app', thinking they need to wrap a web app in a native installer, when Intune's Web app type is specifically designed for this purpose.

How to eliminate wrong answers

Option A is wrong because an iOS store app is designed for iOS devices and requires a native app package from the Apple App Store, not a web app. Option C is wrong because a Windows app (Win32) is used for deploying traditional desktop applications via .msi or .exe files, not for making a web app available. Option D is wrong because an Android store app is for native Android applications distributed through the Google Play Store, not for web-based apps.

Full explanation →

755

MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to enforce that all devices use a 6-digit passcode and that the device automatically wipes after 10 failed attempts. Which profile type should you configure?

A.Device compliance policy

B.Device restrictions profile (iOS)

C.Device configuration profile (custom)

D.App protection policy

AnswerB

Device restrictions include passcode policies and wipe after failed attempts.

Why this answer

A Device restrictions profile (iOS) in Microsoft Intune includes the 'Password' category where you can set minimum passcode length (e.g., 6 digits) and the number of failed attempts before the device wipes. This profile type directly manages device-level security settings on iOS/iPadOS, making it the correct choice for enforcing passcode complexity and auto-wipe behavior.

Exam trap

The trap here is that candidates often confuse Device compliance policy (which only reports compliance) with Device restrictions profile (which actually enforces the settings), leading them to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because Device compliance policy evaluates whether a device meets security requirements (e.g., passcode length) but does not enforce or configure the passcode settings; it only marks devices as compliant or non-compliant. Option C is wrong because a custom configuration profile (using Apple Configurator or custom XML) is used for settings not available in the built-in UI, but passcode length and wipe after failed attempts are standard settings in the Device restrictions profile, so a custom profile is unnecessary and overly complex. Option D is wrong because App protection policy applies to app-level data protection (e.g., PIN for opening a managed app, data encryption) and cannot enforce device-level passcode length or device wipe after failed attempts.

Full explanation →

756

MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. Users report that after a recent update, the corporate Wi-Fi profile no longer connects automatically. You verify the profile is still assigned and the device shows 'Not compliant' in Intune. What should you check first?

A.Review the device's compliance policy status and resolve any non-compliance.

B.Re-enroll the device in Intune.

C.Create a new Wi-Fi profile and assign it.

D.Verify the device's certificate for the Wi-Fi profile is still valid.

AnswerA

Non-compliance can block policies; resolving it will allow the Wi-Fi profile to apply.

Why this answer

The device shows 'Not compliant' in Intune, which directly prevents the Wi-Fi profile from applying or connecting automatically. Intune enforces compliance before allowing configuration profiles to take effect; resolving the non-compliance will restore automatic connectivity. This is the most direct and likely cause given the scenario.

Exam trap

The trap here is that candidates often jump to certificate or profile issues, overlooking that Intune's compliance enforcement can block profile application even when the profile is correctly assigned and certificates are valid.

How to eliminate wrong answers

Option B is wrong because re-enrolling the device is a drastic step that does not address the root cause of non-compliance; the profile is already assigned, and re-enrollment would not fix compliance issues. Option C is wrong because creating a new Wi-Fi profile would be redundant and ineffective if the existing profile is still assigned but blocked by non-compliance; the issue is not the profile itself. Option D is wrong because while certificate validity could cause connectivity issues, the device's 'Not compliant' status is the immediate blocker, and certificate issues would typically manifest as authentication failures, not a failure to connect automatically.

Full explanation →

757

MCQhard

A Windows 11 device running build 10.0.22621.500 reports as noncompliant with the policy shown. The device meets all password requirements, has BitLocker enabled, and uses Microsoft Defender for Endpoint with a 'high' security level. What is the most likely cause of noncompliance?

A.Screen timeout exceeds the policy setting

B.Device threat protection level is not set to high

C.Storage encryption is not enabled

D.OS version is above the maximum allowed

AnswerA

Policy requires lock after 5 minutes; device may have longer timeout.

Why this answer

The device is noncompliant because the screen timeout setting exceeds the policy's maximum allowed value. In Microsoft Intune, compliance policies for Windows 11 enforce specific screen timeout limits (e.g., 5 minutes for idle timeout), and even if other requirements like password, BitLocker, and Defender for Endpoint are met, a mismatch in screen timeout triggers noncompliance. The build number 10.0.22621.500 indicates Windows 11 22H2, which is within supported versions, so OS version is not the issue.

Exam trap

The trap here is that candidates assume noncompliance must be due to a security feature like encryption or threat protection, but the question explicitly states those are met, so the correct answer is the less obvious screen timeout setting, which is a common misconfiguration in Intune compliance policies.

How to eliminate wrong answers

Option B is wrong because the device uses Microsoft Defender for Endpoint with a 'high' security level, which meets the threat protection requirement; the policy likely requires a minimum level of 'high' or 'medium', and 'high' satisfies it. Option C is wrong because BitLocker is enabled, which satisfies storage encryption requirements for compliance; the policy does not require additional encryption beyond what BitLocker provides. Option D is wrong because the OS version 10.0.22621.500 corresponds to Windows 11 22H2, which is below the maximum allowed version (typically the latest supported build), and the policy does not set a maximum OS version that would exclude this build.

Full explanation →

758

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to ensure that devices are enrolled automatically without user interaction and that the enrollment status page (ESP) is configured to block device use until required apps are installed. What should you configure?

A.Configure a Group Policy to auto-enroll devices into Intune

B.Configure a device enrollment manager (DEM) account

C.Configure Windows Autopilot self-deploying mode and an Enrollment Status Page profile

D.Configure co-management with Microsoft Configuration Manager

AnswerC

Correct. Windows Autopilot self-deploying mode enables zero-touch enrollment without user interaction. The Enrollment Status Page (ESP) can be configured to block device use until required apps are installed, meeting both requirements.

Why this answer

Windows Autopilot with self-deploying mode allows zero-touch enrollment, and the Enrollment Status Page (ESP) can be configured to block device use until required apps are installed. Option A is wrong because Group Policy does not provide automatic enrollment into Intune. Option B is wrong because a device enrollment manager (DEM) account is used for bulk enrollment but does not provide automatic zero-touch enrollment.

Option D is wrong because co-management with Microsoft Configuration Manager does not provide zero-touch enrollment without additional configuration.

Full explanation →

759

MCQhard

An administrator is troubleshooting why a Win32 app is repeatedly installed on a device. The exhibit shows a log snippet. What is the most likely cause of the repeated installation?

A.The app writes the detection file to a temporary folder that is cleaned periodically

B.The app requires a reboot to complete installation

C.The detection rule runs before the install completes

D.The exit code 0 is misinterpreted as failure

AnswerA

If the file is in a temp folder, it may be deleted, causing detection to fail on subsequent scans.

Why this answer

If the Win32 app's detection file is written to a temporary folder (e.g., %TEMP% or C:\Windows\Temp) that is periodically cleaned by disk cleanup policies or the Storage Sense feature, Intune will no longer detect the app as installed after the file is removed. This causes the Microsoft Intune Management Extension to re-run the installation on the next sync cycle, leading to a repeated installation loop. The detection rule relies on the persistent presence of the file, so its removal triggers reinstallation.

Exam trap

The trap here is that candidates assume a detection rule failure is due to timing (Option C) or exit code issues (Option D), but the real-world cause is often a transient detection artifact that gets cleaned, not a logic error in the installation process.

How to eliminate wrong answers

Option B is wrong because a required reboot does not cause repeated installation; Intune marks the app as installed after the exit code 0 is received, and a pending reboot only delays further actions, not reinstallation. Option C is wrong because the detection rule runs after the installation script completes and returns an exit code, not before; the log snippet would show a detection failure only after the install attempt finishes. Option D is wrong because exit code 0 is universally interpreted as success by Intune's Win32 app management; a misinterpretation would require a custom detection rule or a non-standard exit code mapping, which is not indicated.

Full explanation →

760

Multi-Selecteasy

You need to configure Microsoft Defender for Endpoint on macOS devices. Which THREE components must be installed?

Select 3 answers

A.Microsoft Defender for Endpoint daemon

B.Microsoft Intune management extension

C.Configuration Manager client

D.Microsoft Defender for Endpoint kernel extension (or system extension)

E.Microsoft Defender for Endpoint user interface agent

AnswersA, D, E

Core service for protection.

Why this answer

The Microsoft Defender for Endpoint daemon (mdatp) is the core service that runs in the background on macOS, handling threat detection, real-time protection, and communication with the cloud backend. Without this daemon, the product cannot perform its primary security functions, making it a mandatory component for any installation.

Exam trap

The trap here is that candidates often confuse the macOS Defender components with Windows Defender components, mistakenly including Intune or ConfigMgr agents that are irrelevant to macOS deployments.

Full explanation →

761

Multi-Selectmedium

You are troubleshooting an Intune-managed Windows 10 device that is not receiving a required application. Which THREE steps should you take to diagnose the issue? (Choose three.)

Select 3 answers

A.Ensure the device has network connectivity

B.Review the app requirement rules (e.g., OS version)

C.Check the app assignment status in the Intune console

D.Verify the device is compliant with compliance policies

E.Perform a factory reset on the device

AnswersA, B, C

The device must be able to reach Intune to download the app.

Why this answer

Network connectivity is a prerequisite for Intune-managed devices to communicate with the Microsoft Intune service. Without connectivity, the device cannot check in, download app policies, or retrieve application payloads. You should verify the device can reach endpoints like *.manage.microsoft.com and that the Windows Push Notification Services (WNS) channel is open.

Exam trap

The trap here is confusing compliance policies with app delivery prerequisites; candidates often assume a non-compliant device cannot receive any apps, but Intune separates compliance from app assignment unless conditional access is explicitly configured.

Full explanation →

762

MCQeasy

You need to deploy a line-of-business app to 100 Windows 10 devices that are managed by Microsoft Intune. The app installer is a .msi file. Which app type should you select when adding the app in Microsoft Intune?

A.Microsoft Store app (Windows)

B.Windows app (Line-of-business)

C.Web link

D.Windows app (Win32)

AnswerD

Win32 app supports .msi, .exe, and PowerShell scripts for deployment.

Why this answer

D is correct because Win32 app management in Intune supports deploying traditional desktop applications, including .msi files, to Windows 10 devices. Win32 apps can be assigned to devices managed by Intune and allow for complex installation commands, detection rules, and dependencies, making them suitable for line-of-business apps that require full control over the installation process.

Exam trap

The trap here is that candidates often confuse 'Line-of-business' (which only supports .appx/.msix) with Win32 apps, assuming any custom app qualifies as line-of-business, but Intune requires the Win32 app type for .msi files.

How to eliminate wrong answers

Option A is wrong because Microsoft Store app (Windows) is used for apps sourced from the Microsoft Store, not for sideloading a custom .msi file. Option B is wrong because Windows app (Line-of-business) is designed for .appx or .msix packages, not for .msi installers. Option C is wrong because Web link simply creates a shortcut to a URL and does not deploy an actual application installer.

Full explanation →

763

MCQmedium

Your organization uses Microsoft Intune to manage 1,500 Windows 10 and 500 macOS devices. You need to deploy Microsoft Edge (Stable channel) to all Windows devices. The deployment must ensure that Edge is set as the default browser, and that the 'SmartScreen' feature is enabled. You also want to ensure that users cannot change the default browser setting. You have created a configuration profile with the required settings. The Edge app is available in the Microsoft Store for Business. Which deployment method should you use to meet all requirements with the least administrative effort?

A.Use a PowerShell script to install Edge and apply settings via registry.

B.Deploy Edge as a Win32 app using the offline installer, and apply the configuration profile separately.

C.Use the 'Microsoft Edge for Windows 10 and later' built-in app type in Intune, assign it as 'Required' to a device group, and apply the configuration profile.

D.Deploy Edge as a Microsoft Store for Business app and use OMA-URI to set default browser.

AnswerC

Built-in app type simplifies deployment and policy application.

Why this answer

The built-in 'Microsoft Edge for Windows 10 and later' app type in Intune provides a streamlined deployment for Edge. It allows specifying the channel (Stable), and configuration profiles can enforce the default browser and enable SmartScreen. This requires the least administrative effort as it's fully integrated.

Option A (PowerShell script) requires custom scripting and registry manipulation, which is more effort and less manageable. Option B (Win32 app) works but requires downloading the offline installer and applying the configuration profile separately, whereas the built-in type is simpler. Option D (Store for Business app) requires OMA-URI for settings, but the built-in app type already supports configuration profiles, making it unnecessary.

Exam trap

Candidates might think a Win32 app is required for setting policies, but Intune's built-in Edge app type can deploy the browser and apply configuration profiles simultaneously.

Full explanation →

764

MCQhard

Contoso Ltd. uses Microsoft Intune to manage Windows 11 devices. They need to deploy a Line-of-Business (LOB) app (ContosoApp.msi) to 500 devices in a pilot group. The app requires admin privileges and must be installed in the system context. The deployment must be silent with no user interaction, and the installation status must be reported to Intune. They have created a Win32 app wrapper and uploaded the .intunewin file. Which configuration should they choose in the Intune Win32 app properties to meet the requirements?

A.Install behavior: User, Device restart behavior: No specific action

B.Install behavior: System, Device restart behavior: No specific action

C.Install behavior: System, Device restart behavior: Suppress restarts

D.Install behavior: User, Device restart behavior: Block restarts until installation completes

AnswerB

System context provides admin privileges, and No specific action avoids restart prompts.

Why this answer

Setting Install behavior to System ensures the app runs with admin privileges and installs in the system context, while Device restart behavior set to No specific action allows any necessary restarts to occur without blocking installation. This meets the requirements of silent deployment with no user interaction and status reporting to Intune. Option A is incorrect because User install behavior does not provide system-level privileges.

Option C is incorrect because Suppress restarts may prevent necessary restarts, potentially causing the installation to fail or not complete properly. Option D is incorrect because User install context with the app requiring admin rights will fail to install correctly.

Full explanation →

765

MCQmedium

You manage a fleet of 2,000 iOS devices for a healthcare organization. The devices are used by clinicians and must be enrolled in Intune. Due to security requirements, you must ensure that devices are supervised and that the Company Portal app is installed automatically. You have Apple Business Manager (ABM) set up with Intune. You need to configure the enrollment process so that when a new device is unboxed and turned on, it automatically enrolls and receives the required configuration. Which enrollment method should you use?

A.Device enrollment (without user affinity)

B.Company Portal enrollment

C.Automated Device Enrollment (ADE) with user affinity

D.User enrollment (BYOD)

AnswerC

This provides supervision and automatic app installation.

Why this answer

Automated Device Enrollment (ADE) with user affinity is the correct method because it leverages Apple Business Manager (ABM) to supervise devices automatically during the initial setup, enforces the required supervision state, and installs the Company Portal app via a mandatory VPP app assignment. User affinity ensures that each device is associated with a specific clinician, enabling user-based policies and conditional access. This meets the healthcare organization's security requirements for supervised devices and automatic app deployment.

Exam trap

The trap here is that candidates often choose Device enrollment without user affinity (Option A) thinking it is sufficient for supervised devices, but they overlook the requirement for user-specific policies and conditional access that only user affinity can provide.

How to eliminate wrong answers

Option A is wrong because Device enrollment (without user affinity) does not associate devices with a specific user, which is required for clinician-specific policies and conditional access in a healthcare environment. Option B is wrong because Company Portal enrollment requires the user to manually install the Company Portal app and initiate enrollment, which does not guarantee automatic supervision or zero-touch deployment. Option D is wrong because User enrollment (BYOD) is designed for personally owned devices and does not support supervision or automated configuration via ABM, failing the security requirement for supervised devices.

Full explanation →

766

MCQhard

You need to configure Windows 10 devices to automatically encrypt their drives using BitLocker when they enroll in Microsoft Intune. You have created a BitLocker policy in Endpoint Security. However, after enrollment, some devices are not encrypted. You verify that the devices have a TPM 2.0 and meet hardware requirements. What is the most likely reason for the failure?

A.The devices do not have Secure Boot enabled.

B.The TPM is not enabled in the BIOS.

C.The BitLocker policy does not require a recovery password to be saved to Azure AD.

D.The devices are not compliant with the BitLocker compliance policy.

AnswerC

Without recovery key escrow, BitLocker may not encrypt.

Why this answer

BitLocker requires a recovery key to be escrowed to Azure AD before encryption can proceed when managed via Intune. If the policy does not mandate saving the recovery password to Azure AD, the encryption process will fail silently on devices that meet all hardware prerequisites, including TPM 2.0. This is a common configuration oversight in Endpoint Security BitLocker policies.

Exam trap

The trap here is that candidates assume hardware readiness (TPM, Secure Boot) is sufficient for automatic encryption, but Intune requires explicit recovery key escrow to Azure AD as a gating condition.

How to eliminate wrong answers

Option A is wrong because Secure Boot is not a prerequisite for BitLocker; it is recommended for system integrity but BitLocker can function without it. Option B is wrong because the TPM is already confirmed as present and meeting hardware requirements (TPM 2.0), so it must be enabled in the BIOS for the devices to be recognized. Option D is wrong because compliance policies evaluate device settings after encryption; non-compliance with a BitLocker compliance policy would be a result of encryption failure, not the root cause.

Full explanation →

767

MCQeasy

You need to deploy a Win32 app to Windows devices using Intune. The app requires admin privileges to install. How should you configure the deployment?

A.Set the install context to system.

B.Set the install context to user.

C.Assign the app as required for all users.

D.Use a line-of-business app type instead.

AnswerA

System context runs with admin rights.

Why this answer

Setting the install context to 'system' runs the Win32 app installer with the SYSTEM account, which has the highest privileges on a Windows device. This ensures the installer can perform actions requiring admin rights, such as writing to Program Files or modifying system registry keys, without user interaction or credential prompts. In Intune, the system context is the only way to silently deploy apps that demand elevated permissions.

Exam trap

The trap here is that candidates often confuse 'install context' with 'assignment scope' (required vs. available), mistakenly thinking that marking an app as 'required for all users' automatically grants admin privileges, when in fact the install context must be explicitly set to 'system' for elevated installations.

How to eliminate wrong answers

Option B is wrong because setting the install context to 'user' runs the installer under the logged-on user's account, which lacks admin privileges unless the user is a local administrator, and it cannot perform system-level changes silently. Option C is wrong because assigning the app as required for all users does not change the install context; it only controls targeting, and if the install context is set to user, the app will still fail to install for non-admin users. Option D is wrong because using a line-of-business (LOB) app type does not inherently provide admin privileges; LOB apps are typically for single-file installers (e.g., .msi or .intunewin) and still require the correct install context to be set to system for elevated installations.

Full explanation →

768

MCQhard

Refer to the exhibit. You are reviewing an Intune configuration profile JSON for Windows 10. The profile includes BitLocker settings. Which setting will prevent users from enabling BitLocker if another encryption method is already in use?

A.bitLockerEncryptionMethod set to aes256

B.passwordRequired set to true

C.bitLockerDisableWarningForOtherDiskEncryption set to false

D.bitLockerDisableWarningForOtherDiskEncryption set to true

AnswerC

When false, the warning is shown and BitLocker will not enable if other encryption exists.

Why this answer

Setting bitLockerDisableWarningForOtherDiskEncryption to false means that BitLocker will display a warning and block enabling BitLocker if another disk encryption method (such as third-party encryption) is detected on the drive. This setting enforces the requirement to prevent users from enabling BitLocker when another encryption solution is already active, ensuring compliance and avoiding conflicts.

Exam trap

The trap here is that candidates often confuse bitLockerDisableWarningForOtherDiskEncryption with a simple warning toggle, not realizing that setting it to false actively blocks BitLocker enablement when other encryption is detected, while setting it to true allows BitLocker to proceed without warning.

How to eliminate wrong answers

Option A is wrong because bitLockerEncryptionMethod set to aes256 only specifies the encryption algorithm to use (AES-256) when BitLocker is enabled; it does not control whether BitLocker can be enabled if another encryption method is already present. Option B is wrong because passwordRequired set to true mandates that a recovery password be configured for BitLocker, but it does not affect the detection or blocking of other disk encryption methods. Option D is wrong because setting bitLockerDisableWarningForOtherDiskEncryption to true would suppress the warning and allow BitLocker to be enabled even if another encryption method is in use, which is the opposite of the desired behavior.

Full explanation →

769

MCQeasy

Your organization uses Microsoft Intune to manage Android devices. You need to ensure that corporate data on these devices is protected in case the device is lost or stolen. You configure a compliance policy that requires device encryption and a device lock screen. However, you also want to be able to selectively wipe corporate data without wiping personal data. What should you do?

A.Enable remote lock on the device.

B.Configure a device compliance policy to wipe the device if non-compliant.

C.Use a device configuration profile to enable selective wipe.

D.Assign an app protection policy to the user for the corporate apps.

AnswerD

MAM policies enable selective wipe.

Why this answer

App protection policies (APP) in Microsoft Intune provide the ability to selectively wipe corporate data from managed apps without affecting personal data on Android devices. This is achieved through the selective wipe action, which removes only the organization's data from apps that have the policy applied, leaving personal data intact. Compliance policies, as described in the scenario, enforce device-level settings like encryption and lock screen but do not offer granular data separation for selective wipe.

Exam trap

The trap here is that candidates often confuse device compliance policies (which enforce device-level security and can trigger full wipe) with app protection policies (which enable selective wipe of corporate data), leading them to choose option B or C instead of D.

How to eliminate wrong answers

Option A is wrong because remote lock only locks the device remotely, preventing unauthorized access but does not wipe any data, corporate or personal. Option B is wrong because configuring a device compliance policy to wipe the device if non-compliant performs a full device wipe, removing all data including personal data, which contradicts the requirement to selectively wipe only corporate data. Option C is wrong because device configuration profiles in Intune manage device settings (e.g., Wi-Fi, VPN, restrictions) and do not include a selective wipe capability; selective wipe is a feature of app protection policies, not configuration profiles.

Full explanation →

770

MCQmedium

Your organization plans to deploy Windows Autopilot for new devices. You need to ensure that the hardware hashes are uploaded to Microsoft Intune before the devices are shipped to users. What is the recommended approach?

A.Add the device to Microsoft Entra ID before shipping.

B.Obtain the hardware hash from the device manufacturer or reseller.

C.Use Microsoft Configuration Manager to collect the hardware hash.

D.Run a PowerShell script on each device to capture the hardware hash.

AnswerB

OEMs and resellers can upload hashes to Intune via the OEM API.

Why this answer

The hardware hash can be obtained from the device manufacturer or reseller (OEM) before the device is shipped. This is the recommended approach for new devices as it allows the hardware hash to be uploaded to Intune without needing to power on the device. Option A is wrong because adding the device to Microsoft Entra ID does not upload the hardware hash.

Option C is wrong because Configuration Manager can collect hashes but requires the device to be on the network and is typically used for existing devices. Option D is wrong because running a PowerShell script on each device requires the device to be powered on and manually executed, which is less efficient for new devices.

Full explanation →

771

Multi-Selecteasy

Which TWO are prerequisites for co-management with Microsoft Intune and Configuration Manager? (Select TWO.)

Select 2 answers

A.Devices enrolled in Microsoft Intune

B.Configuration Manager current branch

C.On-premises Active Directory

D.Public Key Infrastructure (PKI)

E.Hybrid Microsoft Entra ID joined devices

AnswersA, B

Correct. Devices must be enrolled in Intune to receive policies and apps from Intune, enabling co-management.

Why this answer

Devices must be enrolled in Microsoft Intune to be co-managed; Intune enrollment is the mechanism that enables cloud-based management. Option B is correct because co-management requires Configuration Manager current branch (version 1606 or later) as a minimum. Option E is not strictly required: co-management supports both hybrid and pure Azure AD joined devices, though hybrid is common.

Options C and D are not prerequisites; on-premises AD and PKI are optional.

Exam trap

The trap is that candidates may think hybrid Azure AD join is mandatory for co-management, but both hybrid and pure Azure AD join are supported. They may also overlook that Configuration Manager current branch is a prerequisite, not just an optional upgrade.

Full explanation →

772

MCQeasy

You are deploying a line-of-business (LOB) app to iOS devices using Microsoft Intune. The app is signed with an enterprise certificate. Users report that the app installs but crashes immediately on launch. What is the most likely cause?

A.The Intune company portal app is not installed.

B.The app is not signed.

C.The app requires a VPN connection.

D.The enterprise developer certificate is not trusted on the device.

AnswerD

iOS requires manual trust of enterprise cert before launching.

Why this answer

The most likely cause is that the enterprise developer certificate is not trusted on the device. iOS requires that enterprise-signed apps have their root certificate manually trusted via a profile (e.g., MDM or manual installation) before the app can run. Without this trust, iOS blocks the app from executing, causing an immediate crash on launch.

Exam trap

The trap here is that candidates may confuse 'signed' with 'trusted' — the app is signed, but iOS requires explicit trust of the enterprise certificate, which is a separate step often overlooked in MDM deployments.

How to eliminate wrong answers

Option A is wrong because the Company Portal app is not required for LOB app installation via MDM; Intune can push apps directly using Apple Push Notification service (APNs) and managed Open In. Option B is wrong because the app is explicitly stated to be signed with an enterprise certificate, so it is signed; the issue is trust, not signature absence. Option C is wrong because a VPN connection is not a prerequisite for launching an LOB app; VPN requirements are app-specific and would not cause an immediate crash on launch.

Full explanation →

773

MCQhard

Your organization uses Microsoft Intune to manage Android Enterprise devices (work profile). You need to ensure that corporate data on these devices is encrypted. Additionally, you want to enforce a policy that prevents users from disabling the work profile. You have created a device compliance policy that requires encryption, but some devices are marked as non-compliant even though they have encryption enabled. You suspect that the devices are using file-based encryption instead of full-disk encryption. What should you do to ensure that the devices meet the encryption requirement?

A.Enable the work profile on the devices via a device configuration profile.

B.Change the device encryption method to full-disk encryption using a device configuration profile.

C.Verify that the compliance policy is set correctly for Android Enterprise; if needed, re-evaluate the policy assignment.

D.Create a device configuration profile that enforces encryption on the work profile.

AnswerC

The compliance policy should correctly assess file-based encryption as compliant; re-evaluation may resolve false non-compliance.

Why this answer

The issue is likely a misconfiguration of the compliance policy assignment or evaluation. Android Enterprise work profile devices use file-based encryption by default, which Intune considers compliant. If devices are marked non-compliant despite encryption being enabled, you should verify that the compliance policy is correctly assigned to the target groups and re-evaluate the policy.

Option A is incorrect because the work profile is already enabled on the device. Option B is incorrect because Intune cannot change the encryption method on Android devices; encryption type is device-specific. Option D is incorrect because device configuration profiles cannot enforce encryption on the work profile; encryption is managed by the device OS.

Full explanation →

774

Multi-Selecteasy

Which TWO of the following are types of app protection policies (APP) in Microsoft Intune?

Select 2 answers

A.macOS

B.iOS/iPadOS

C.Windows 10/11

D.Web apps

E.Android

AnswersB, E

APP is supported for iOS/iPadOS.

Why this answer

In Microsoft Intune, app protection policies (APP) are designed to manage and protect app data on devices that may or may not be enrolled in MDM. The two supported mobile platforms for APP are iOS/iPadOS and Android, as these platforms allow granular control over app-level data through Intune SDK-integrated apps or managed browsers.

Exam trap

The trap here is that candidates often confuse device compliance policies (which support macOS and Windows) with app protection policies, leading them to select macOS or Windows as valid APP types.

Full explanation →

775

MCQhard

You are planning a Windows 11 deployment using Microsoft Intune. The organization has a requirement that all devices must have BitLocker enabled with a TPM protector. You configure a BitLocker policy in Intune. However, some devices report that BitLocker is not enabled. What is the most likely reason?

A.The devices have TPM version 1.2 instead of 2.0.

B.The devices are not joined to Microsoft Entra ID.

C.The BitLocker policy is configured only for Windows 11 Enterprise devices.

D.The devices are running Windows 10 instead of Windows 11.

AnswerA

Windows 11 requires TPM 2.0 for BitLocker.

Why this answer

The most likely reason is that the devices have TPM version 1.2 instead of 2.0. BitLocker requires a TPM 2.0 chip to support the TPM protector when using the default Intune policy settings; TPM 1.2 is not supported for this configuration in Windows 11, as Microsoft requires TPM 2.0 for BitLocker system drive encryption with a TPM protector.

Exam trap

The trap here is that candidates may assume the issue is OS version (Windows 10 vs 11) or Entra ID join status, but the core requirement is TPM 2.0, which is a hardware prerequisite for Windows 11 and BitLocker TPM protector enforcement in Intune.

How to eliminate wrong answers

Option B is wrong because devices do not need to be joined to Microsoft Entra ID for BitLocker to be enabled via Intune; they can be hybrid joined or managed via co-management, and the policy can still apply. Option C is wrong because the BitLocker policy in Intune is not limited to Windows 11 Enterprise; it can be configured for Windows 11 Pro, Education, and Enterprise editions. Option D is wrong because Windows 10 devices also support BitLocker with TPM 2.0, and the policy would still apply if the TPM version is 2.0; the issue is specifically TPM version, not the OS version.

Full explanation →

776

MCQeasy

A company uses Microsoft Intune to manage iOS devices. They need to ensure that only devices with a passcode of at least 6 characters can access corporate email. Which type of policy should they create?

A.App protection policy

B.Enrollment restriction

C.Device configuration policy

D.Device compliance policy

AnswerD

Device compliance policies can require a passcode length for conditional access.

Why this answer

Device compliance policies enforce security requirements like passcode length at the device level. Option A (App protection policy) is incorrect because it targets app-level data protection, not device settings. Option B (Enrollment restriction) is incorrect because it controls which devices can enroll but does not enforce passcode requirements.

Option C (Device configuration policy) is incorrect because it configures device settings but does not enforce compliance with policies.

Full explanation →

777

MCQeasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a Microsoft 365 Apps for Enterprise to work profiles. Which app type should you select in Intune?

A.Web app

B.Android Enterprise system app

C.Line-of-business app

D.Managed Google Play app

AnswerD

Microsoft 365 Apps is available as a Managed Google Play app.

Why this answer

For deploying Microsoft 365 Apps for Enterprise to Android Enterprise work profiles, the correct app type is Managed Google Play app. Intune integrates with Managed Google Play to distribute approved apps to work profiles, ensuring compliance with Android Enterprise policies. Web apps, system apps, and line-of-business apps cannot deliver the full Microsoft 365 suite with managed configuration and app protection policies in a work profile context.

Exam trap

The trap here is that candidates may confuse 'Line-of-business app' with any business app, but Microsoft 365 Apps for Enterprise is a commercially available app that must be distributed via Managed Google Play, not uploaded as a custom package.

How to eliminate wrong answers

Option A is wrong because a Web app only provides a shortcut to a URL and cannot install native Microsoft 365 apps with offline capabilities or managed app configuration. Option B is wrong because Android Enterprise system apps are pre-installed system components, not third-party apps like Microsoft 365, and cannot be deployed via Intune for work profiles. Option C is wrong because a Line-of-business app is used for custom internal apps uploaded directly to Intune, not for commercially available apps like Microsoft 365 that must be sourced from Managed Google Play.

Full explanation →

778

Matchingmedium

Match each Co-management workload to its management authority when co-managed.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Intune

Intune (if Windows Update for Business selected)

Intune

Configuration Manager or Intune

Why these pairings

In co-management, workloads can be assigned to either Configuration Manager or Intune. Common defaults: Windows Update and Endpoint Protection to Intune; Device Configuration and Resource Access to Configuration Manager.

Full explanation →

779

MCQeasy

You are troubleshooting an issue where a user reports that their Windows device is not receiving compliance policies from Intune. The device shows as 'Not compliant' in the Intune console. What is the most likely cause?

A.The user does not have an Intune license assigned.

B.The device is not enrolled in Intune.

C.The compliance policy is stale and needs to be re-assigned.

D.The device has no network connectivity.

AnswerA

Correct. Without an Intune license, compliance policies cannot be applied to the device, even if it is enrolled. The device appears as 'Not compliant' because the policies are not being evaluated.

Why this answer

The device showing as 'Not compliant' in the Intune console indicates it is enrolled in Intune. The most likely cause for compliance policies not being applied is that the user does not have a valid Intune license assigned. Without a license, the device can be enrolled but compliance policies will not be evaluated or enforced.

Option B is incorrect because the device is enrolled (as evidenced by its appearance in the console). Option C is incorrect because a stale policy would still apply if the device is enrolled and licensed. Option D is incorrect because network connectivity would affect policy retrieval but the device would still be enrolled and licensed.

Full explanation →

780

MCQmedium

Refer to the exhibit. You create a compliance policy for Windows 10 devices. A device is reported as non-compliant. Upon investigation, you find that the device has a password of 6 characters. Which setting is causing the non-compliance?

A.requireCodeIntegrity

B.passwordMinimumLength

C.requireDeviceEncryption

D.requireSecureBoot

AnswerB

The policy requires minimum 8 characters, but the device has only 6.

Why this answer

The compliance policy requires a minimum password length, and the device's 6-character password does not meet that requirement, making it non-compliant. The passwordMinimumLength setting directly controls the minimum number of characters a password must have, so a password shorter than the configured value triggers non-compliance.

Exam trap

The trap here is that candidates often confuse passwordMinimumLength with password complexity or other security settings like requireCodeIntegrity or requireSecureBoot, assuming any security-related non-compliance must be due to a broader security feature rather than the specific password length.

How to eliminate wrong answers

Option A is wrong because requireCodeIntegrity enforces that code integrity features (like Windows Defender Application Control) are enabled, which is unrelated to password length. Option C is wrong because requireDeviceEncryption mandates BitLocker or device encryption, not password length. Option D is wrong because requireSecureBoot checks that Secure Boot is enabled in UEFI, which is a hardware security feature, not a password policy.

Full explanation →

781

MCQhard

You manage a Microsoft 365 tenant with 10,000 users. You are planning a Conditional Access policy to require MFA for all users. However, you need to ensure that users who have not yet registered for MFA are not blocked. What should you do to handle unregistered users?

A.Configure the Conditional Access policy in 'Report-only' mode to identify unregistered users.

B.Enable the Azure AD Identity Protection MFA registration policy to require users to register for MFA within 14 days.

C.Exclude all users who have not registered for MFA from the Conditional Access policy.

D.Create a separate Conditional Access policy that requires MFA only for users who have not registered for MFA.

AnswerB

This policy ensures users register before they are required to use MFA, preventing lockout.

Why this answer

The Azure AD Identity Protection MFA registration policy automatically enforces MFA registration for all users within a specified grace period (default 14 days), ensuring that users who have not yet registered are prompted to register before being blocked by a Conditional Access policy. This policy works in conjunction with Conditional Access by pre-registering users, so when the CA policy requiring MFA is enabled, all users already have MFA credentials available, preventing lockout.

Exam trap

The trap here is that candidates often confuse 'Report-only mode' (which only logs, not registers) with a solution for handling unregistered users, or they incorrectly assume that excluding unregistered users or creating a separate policy for them would solve the problem without causing lockout.

How to eliminate wrong answers

Option A is wrong because Report-only mode only logs what would happen if the policy were enforced, but does not actually register users for MFA; unregistered users would still be blocked when the policy is turned on. Option C is wrong because excluding unregistered users from the CA policy would leave them without MFA protection, defeating the purpose of the policy and creating a security gap. Option D is wrong because a separate CA policy requiring MFA for unregistered users would still block them since they have no MFA method registered to satisfy the requirement, causing a lockout.

Full explanation →

782

MCQmedium

You are reviewing an Intune endpoint protection profile for Windows 10. The exhibit shows a JSON snippet of the configuration. A user reports that a device detected malware with moderate severity, but the action taken was 'quarantine'. However, the desired action is 'clean'. Which setting should you modify?

A.defenderScheduleScanDay and defenderScheduleScanTime

B.A global setting to override all actions

C.defenderScanType

D.defenderDetectedMalwareActions for moderateSeverity

AnswerD

Change the value from 'quarantine' to 'clean'.

Why this answer

The `defenderDetectedMalwareActions` setting in Intune endpoint protection profiles allows you to specify the remediation action for each threat severity level, including moderate. Since the user wants 'clean' instead of 'quarantine' for moderate severity threats, you must modify the `moderateSeverity` value within this setting. This is the only setting that controls per-severity remediation actions for Microsoft Defender Antivirus.

Exam trap

The trap here is that candidates confuse scan scheduling or scan type settings with remediation actions, or assume a single global action exists, when Microsoft Intune requires per-severity configuration via `defenderDetectedMalwareActions`.

How to eliminate wrong answers

Option A is wrong because `defenderScheduleScanDay` and `defenderScheduleScanTime` control when scheduled scans run, not the action taken on detected malware. Option B is wrong because there is no global override setting in Intune endpoint protection profiles that applies a single action to all threat severities; remediation actions are configured per severity level. Option C is wrong because `defenderScanType` defines the type of scan (e.g., quick, full) to perform, not the remediation action after detection.

Full explanation →

783

Multi-Selecthard

Your organization uses Microsoft Intune and you need to configure Windows Autopilot for hybrid Microsoft Entra ID join. Which THREE components are required?

Select 3 answers

A.A domain join profile (configured in Intune).

B.A device compliance policy.

C.An Autopilot deployment profile.

D.An MDM push certificate.

E.An enrollment status page profile.

AnswersA, C, E

Specifies on-premises AD domain for hybrid join.

Why this answer

A domain join profile is required for hybrid Microsoft Entra ID join because it provides the on-premises Active Directory domain information that the device needs during Autopilot provisioning. Without this profile, the device cannot complete the domain join step, which is essential for establishing the hybrid identity state.

Exam trap

The trap here is that candidates often confuse the requirement for a device compliance policy with the need for a domain join profile, not realizing that compliance policies are applied after enrollment and are not prerequisites for the Autopilot hybrid join process.

Full explanation →

784

MCQhard

You have enabled Microsoft Defender for Endpoint on macOS devices. Some macOS devices show a status of 'Sensor disconnected' in the Microsoft Defender XDR portal. The devices are online and can communicate with the internet. Which troubleshooting step should you take first?

A.Check the Windows Security app for any alerts.

B.Run a full scan using Microsoft Defender for Endpoint on the affected devices.

C.Re-enroll the devices in Microsoft Intune.

D.Uninstall and reinstall the Microsoft Defender for Endpoint agent.

AnswerB

Malware can cause sensor disconnection; scanning may resolve it.

Why this answer

Running a full scan is the first recommended troubleshooting step when macOS devices show a 'Sensor disconnected' status in Microsoft Defender XDR. This status often indicates that the sensor process (e.g., mdatp) is not running or has crashed, and a full scan can trigger the sensor to restart and re-establish communication with the cloud backend. It is a non-disruptive, quick check that validates the agent's core functionality before escalating to more invasive steps.

Exam trap

The trap here is that candidates may assume a connectivity issue requires re-enrollment or reinstallation, but Microsoft's official troubleshooting guidance prioritizes a full scan first because it restarts the sensor process without disrupting the device's security posture.

How to eliminate wrong answers

Option A is wrong because the Windows Security app is a Windows-only component and does not exist on macOS; checking it would be irrelevant. Option C is wrong because re-enrolling in Microsoft Intune addresses management enrollment issues, not sensor connectivity; the devices are already enrolled and online. Option D is wrong because uninstalling and reinstalling the agent is a last-resort step that should only be taken after verifying that a full scan and other less disruptive troubleshooting steps have failed.

Full explanation →

785

Multi-Selectmedium

Which TWO actions should you take to ensure that only healthy Windows 10/11 devices can access Microsoft 365 services? (Choose two.)

Select 2 answers

A.Create a device compliance policy that includes health attestation checks

B.Configure Intune enrollment

C.Use Windows Autopilot to pre-provision devices

D.Deploy an app protection policy to M365 apps

E.Create a Conditional Access policy that requires compliant device

AnswersA, E

Compliance policy defines health criteria.

Why this answer

A device compliance policy with health attestation checks uses Windows Health Attestation Service (WHAS) to verify that devices have secure boot, BitLocker enabled, and no kernel-level tampering. This ensures only devices meeting hardware-level security baselines can be marked as compliant, which is a prerequisite for Conditional Access policies that gate access to Microsoft 365 services.

Exam trap

The trap here is that candidates confuse device enrollment (Option B) or provisioning (Option C) with ongoing health verification, but neither ensures the device remains healthy at the time of access; only the combination of a compliance policy with attestation checks and a Conditional Access policy that requires compliant device enforces this at authentication time.

Full explanation →

786

Multi-Selecthard

Which TWO of the following are valid reasons to use a Windows PowerShell script deployment instead of a Win32 app in Intune?

Select 2 answers

A.Configuring Windows Update for Business policies

B.Applying a temporary security configuration change quickly

C.Modifying registry settings on a schedule

D.Installing an MSI with silent switches

E.Deploying a complex application with multiple files

AnswersB, C

Scripts are ideal for quick changes.

Why this answer

Scripts in Intune are best suited for quick, temporary changes that do not require a full application lifecycle, such as applying a temporary security configuration change (option B) or modifying registry settings on a schedule (option C). Win32 apps are better for deploying complex applications (option E) or installing MSIs (option D), and configuring Windows Update policies (option A) is done via configuration profiles.

Full explanation →

787

Multi-Selecthard

A company uses Microsoft Intune to manage Windows 10 devices. They are deploying a Win32 app using the Intune Management Extension. The app requires a reboot and must ensure that the installation completes successfully before the device is allowed to restart. Which TWO deployment settings should be configured?

Select 2 answers

A.Enable 'Delivery optimization' for the app

B.Set 'Device restart behavior' to 'Require device restart'

C.Set 'Device restart behavior' to 'No specific action'

D.Configure 'Supersedence' to replace the app

E.Configure 'Return codes' for 'Soft reboot' as 'No action'

AnswersC, E

Prevents Intune from forcing a reboot, allowing installation to complete.

Why this answer

Setting 'Device restart behavior' to 'No specific action' allows Intune to complete the Win32 app installation without forcing an immediate reboot, which is necessary when the app itself handles the reboot or when you want to control the restart timing. This setting prevents the Intune Management Extension from triggering a restart before the installation is fully complete, ensuring the app's post-installation processes (e.g., file copies, registry writes) finish successfully.

Exam trap

The trap here is that candidates often confuse 'Device restart behavior' with a simple toggle for requiring a reboot, missing that 'No specific action' is the correct choice when the app itself manages the reboot, and they overlook the need to also configure 'Return codes' for 'Soft reboot' as 'No action' to prevent the IME from misinterpreting a soft reboot code as an installation failure.

Full explanation →

788

MCQhard

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You want to automatically remediate devices that are found to be missing critical security updates during a vulnerability assessment. What should you configure?

A.Assign a Windows Update for Business policy to all devices.

B.Create a compliance policy that marks devices as non-compliant if missing updates.

C.Configure automated investigation and remediation in Microsoft Defender for Endpoint.

D.Configure an endpoint security policy for Windows Defender Antivirus.

AnswerC

Automated remediation can trigger Intune to apply updates.

Why this answer

Microsoft Defender for Endpoint's automated investigation and remediation capabilities can be configured to automatically respond to vulnerabilities detected during assessments, including missing critical security updates. This leverages the built-in threat and vulnerability management (TVM) module to trigger remediation actions without manual intervention, aligning with the requirement for automatic remediation.

Exam trap

The trap here is that candidates often confuse compliance policies (which only detect and block non-compliant devices) with automated remediation (which actively fixes the issue), leading them to choose Option B instead of recognizing that MDE's automated investigation and remediation is the correct mechanism for automatic update installation.

How to eliminate wrong answers

Option A is wrong because a Windows Update for Business policy manages update deployment and deferral settings but does not automatically remediate devices based on vulnerability assessment results; it lacks the detection and response integration needed for automated remediation. Option B is wrong because a compliance policy marks devices as non-compliant and can trigger conditional access blocks, but it does not automatically install missing updates; remediation requires additional configuration like a remediation script or integration with update rings. Option D is wrong because an endpoint security policy for Windows Defender Antivirus focuses on antivirus configuration and threat protection, not on managing or remediating missing operating system security updates.

Full explanation →

789

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices that haven't checked in for 30 days are automatically retired. Which configuration should you implement?

A.Set up an automatic enrollment policy that retires devices after 30 days of inactivity.

B.Use the Intune device cleanup rules to automatically remove devices that haven't checked in for 30 days.

C.Configure a device compliance policy with a 'Mark device noncompliant' action after 30 days of no check-in and add an action for noncompliance to retire the device.

D.Create a device configuration profile with a 'Device Health' setting to require check-in within 30 days.

AnswerC

This directly enforces retirement after 30 days of inactivity.

Why this answer

Intune's compliance policies can be configured to mark devices as noncompliant after a specified period of no check-in (e.g., 30 days), and then trigger an action for noncompliance—such as retiring the device. This ensures that devices that have not communicated with Intune within the defined timeframe are automatically removed from management, meeting the requirement.

Exam trap

The trap here is that candidates often confuse Intune device cleanup rules (which simply remove stale device records from the console) with compliance policy actions (which can actually retire the device and revoke company data), leading them to select Option B incorrectly.

How to eliminate wrong answers

Option A is wrong because automatic enrollment policies are used to enroll devices into Intune, not to retire them after inactivity; there is no 'retire after inactivity' setting in enrollment policies. Option B is wrong because Intune device cleanup rules remove devices from the Intune console after a specified number of days of no check-in, but they do not trigger a retire action—they simply delete the device record, which does not send a retire command to the device or revoke company data. Option D is wrong because device configuration profiles manage settings like security policies and compliance, but they do not include a 'Device Health' setting to require check-in within a certain number of days, nor do they have the ability to trigger a retire action based on check-in frequency.

Full explanation →

790

MCQmedium

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company portal app that allows users to enroll their devices. Which app type should you use?

A.Built-in app

B.iOS and macOS store app

C.Web link

D.macOS LOB app

AnswerB

Company Portal for macOS is available in the Mac App Store.

Why this answer

The Company Portal app for macOS is available in the Apple App Store and is distributed via Intune as an iOS and macOS store app. This app type allows Intune to manage the app installation and assignment from the store, enabling users to enroll their macOS devices into management. Built-in apps are for pre-installed system apps, web links are for shortcuts, and LOB apps are for custom in-house apps, none of which provide the required enrollment functionality.

Exam trap

The trap here is that candidates confuse the 'iOS and macOS store app' type with the 'Built-in app' type, thinking Company Portal is a built-in system app, when in fact it must be downloaded from the App Store and managed as a store app.

How to eliminate wrong answers

Option A is wrong because built-in apps in Intune refer to pre-installed system apps like Safari or Calendar, not the Company Portal, which must be downloaded from the App Store. Option C is wrong because a web link only creates a shortcut to a URL in the Company Portal website, not a native app installation, and macOS device enrollment requires the native Company Portal app. Option D is wrong because a macOS LOB app is used for custom in-house applications uploaded directly to Intune, not for store-sourced apps like Company Portal.

Full explanation →

791

MCQhard

A company uses Microsoft Intune to manage Windows 10 devices. They have a compliance policy that requires BitLocker to be enabled. Some devices are marked as non-compliant even though BitLocker appears to be on. The administrator runs 'manage-bde -status' on a non-compliant device and sees that the protection status is 'Protection Off'. What is the most likely cause?

A.The BitLocker key protectors are missing or have been removed.

B.The TPM is not initialized.

C.The device has a recovery password protector but no TPM protector.

D.The device uses a different encryption method (e.g., XTS-AES 256 vs AES 128).

AnswerA

Without key protectors, BitLocker protection is suspended.

Why this answer

The compliance policy requires BitLocker to be enabled, but 'manage-bde -status' shows 'Protection Off'. This indicates that while the drive is encrypted, BitLocker is not actively protecting the data because the key protectors (such as the TPM protector) are missing or have been removed. Intune checks the protection status, not just encryption state, so when protectors are absent, the device is marked non-compliant.

Exam trap

The trap here is that candidates confuse 'encrypted' with 'protected'—BitLocker can encrypt a drive without active protection if key protectors are missing, and Intune compliance policies specifically require protection to be on, not just encryption to be present.

How to eliminate wrong answers

Option B is wrong because if the TPM were not initialized, BitLocker would typically fail to enable or would show a different status (e.g., 'TPM is not ready'), not 'Protection Off' on an already encrypted drive. Option C is wrong because having a recovery password protector without a TPM protector is a valid configuration (e.g., on devices without TPM) and would still show 'Protection On' if the protector is present and active. Option D is wrong because the encryption method (e.g., XTS-AES 256 vs AES 128) does not affect the protection status; it only determines the algorithm used for encryption, and Intune compliance policies do not check for encryption method mismatch.

Full explanation →

792

MCQmedium

A user reports that their Windows 11 device cannot access corporate resources after a recent update. The device is enrolled in Intune. You check the device compliance status and find it is marked as non-compliant. Which two actions should you take?

A.Perform a 'Retire' action on the device

B.Request the user to run the 'Sync' action from the Company Portal

C.Use the 'Reset' action to re-enroll the device

D.Run a compliance check from the Intune console

AnswerB, D

Sync applies pending policies and updates compliance status.

Why this answer

The correct actions are B and D. When a device is marked non-compliant after an update, the user can trigger a manual sync from the Company Portal (option B) to force a compliance check and policy refresh. Additionally, an administrator can run an on-demand compliance check from the Intune console (option D) to immediately re-evaluate the device's status.

Option A (Retire) would remove the device from management, and option C (Reset) would wipe the device, both of which are overly drastic for this scenario.

Full explanation →

793

MCQeasy

Refer to the exhibit. A detection script for a Win32 app in Intune uses a WMI query. The script is expected to detect if BitLocker is not enabled. What will the script return if BitLocker is enabled on the device?

A.It returns the protection status as 1.

B.It returns the drive letter of the protected volume.

C.It returns no results, indicating that BitLocker is enabled.

D.It returns an error because the query is invalid.

AnswerC

No volumes match the condition when BitLocker is on.

Why this answer

The WMI query in the detection script uses the `SELECT * FROM Win32_EncryptableVolume WHERE DriveLetter = 'C:' AND ProtectionStatus = 0` condition. When BitLocker is enabled, `ProtectionStatus` is 1, so no volumes match the query. The script returns no results, which Intune interprets as the application not being detected (i.e., BitLocker is enabled, so the detection condition is not met).

Exam trap

The trap here is that candidates mistakenly think the script returns a value (like 1 or the drive letter) when BitLocker is enabled, rather than understanding that the query's WHERE clause filters for unprotected volumes, so a successful detection (non-empty result) only occurs when BitLocker is off.

How to eliminate wrong answers

Option A is wrong because `ProtectionStatus = 1` indicates BitLocker is enabled, but the script specifically queries for `ProtectionStatus = 0`; returning a status of 1 would require a different query or output logic. Option B is wrong because the query does not return the drive letter; it returns the entire WMI object only when the condition is met, and if BitLocker is enabled, no objects are returned. Option D is wrong because the WMI query is syntactically valid and will execute without error; it simply returns an empty result set when no volumes match the `ProtectionStatus = 0` condition.

Full explanation →

794

Multi-Selecthard

You have a Microsoft Intune environment with devices running Windows 10 and 11. You need to configure a policy that enforces BitLocker drive encryption with a TPM protector and stores recovery key in Microsoft Entra ID. Which three settings must you configure in the endpoint protection profile? (Choose three.)

Select 3 answers

A.Store recovery key in Microsoft Entra ID

B.Require encryption of OS drive

C.Choose encryption method (XTS-AES 128-bit)

D.Enable BitLocker

E.Configure TPM as a protector

AnswersA, D, E

Recovery key storage must be set to Microsoft Entra ID.

Why this answer

The 'Store recovery key in Microsoft Entra ID' setting ensures that the BitLocker recovery key is automatically backed up to the user's Microsoft Entra ID object. This is essential for recovery scenarios and is a key requirement for managing BitLocker via Intune, as it allows administrators to retrieve the key from the Entra admin center.

Exam trap

The trap here is that candidates often confuse the 'Require encryption of OS drive' as a separate mandatory setting, when in fact it is automatically enforced by the 'Enable BitLocker' setting, making it redundant to select both.

Full explanation →

795

MCQmedium

Refer to the exhibit. You create a new update ring policy for Windows 10 devices. You assign the policy to a test group. After a week, you notice that no devices have installed any quality updates. Devices are online and enrolled. What is the most likely reason?

A.Devices are assigned a different update ring policy that defers quality updates.

B.The feature update deferral period is too long.

C.The quality update pause start date is set to a future date.

D.The policy requires a restart to take effect.

AnswerA

Conflicting policies can cause no updates to apply.

Why this answer

The most likely reason is that devices are assigned a different update ring policy that defers quality updates. In Microsoft Intune, if multiple update ring policies are assigned to a device, the policy with the most restrictive settings (i.e., the highest deferral or pause) takes precedence. Even though the new policy sets QualityUpdateDeferralInDays to 0, an existing policy with a positive deferral would delay installation.

Option B is incorrect because feature update deferral does not affect quality updates. Option C is incorrect because the pause start date is not set; a null value means no pause. Option D is incorrect because the policy takes effect without requiring a restart; updates install based on deferral settings.

Full explanation →

796

MCQhard

You manage a fleet of iOS devices enrolled in Microsoft Intune. You need to ensure that only approved corporate devices can access Exchange Online. You configure a Conditional Access policy that requires devices to be compliant with Intune compliance policies. However, some users report that they are still able to access email from personal iOS devices that are not enrolled. What should you check first?

A.The policy does not include iOS as a device platform.

B.The policy is not applied to Exchange Online as a cloud app.

C.The Grant control is set to 'Require one of the selected controls' instead of 'Require all'.

D.The policy is not scoped to all users.

AnswerB

The policy must include Exchange Online in the cloud apps list.

Why this answer

The Conditional Access policy must explicitly include Exchange Online as a cloud app to govern access to it. If the policy is not applied to Exchange Online, it will not enforce compliance requirements for that service, allowing unenrolled devices to connect. Intune's Conditional Access policies are app-specific; omitting the target cloud app renders the policy ineffective for that workload.

Exam trap

The trap here is that candidates often focus on device platform or user scoping, overlooking that Conditional Access policies must explicitly list the target cloud application (e.g., Exchange Online) to enforce controls for that service.

How to eliminate wrong answers

Option A is wrong because the issue is that personal iOS devices are accessing email, which implies the policy is not blocking them; if iOS were missing as a device platform, the policy would not apply to any iOS device at all, but the problem is specific to Exchange Online access, not platform targeting. Option C is wrong because the Grant control setting 'Require one of the selected controls' versus 'Require all' affects how multiple conditions are combined (e.g., MFA and compliance), but it does not cause the policy to be bypassed entirely; the core issue is that the policy is not applied to the correct cloud app. Option D is wrong because scoping to all users is not the primary issue; even if the policy is scoped to all users, it will not enforce compliance for Exchange Online if that app is not selected in the policy.

Full explanation →

797

MCQmedium

A company plans to deploy Windows 11 to 500 new devices using Microsoft Deployment Toolkit (MDT). The devices have various hardware configurations. The deployment must include language packs and regional settings. Which deployment method should the administrator use to minimize manual intervention?

A.Create a custom task sequence in MDT that includes language packs and regional settings.

B.Use Windows Configuration Designer to create a provisioning package with language settings.

C.Create a task sequence in Configuration Manager without MDT integration.

D.Use Windows Autopilot with a custom profile to deploy language packs.

AnswerA

Task sequences automate deployment including language and region.

Why this answer

MDT allows the administrator to create a custom task sequence that integrates language packs and regional settings directly into the deployment process. This approach automates the entire deployment with minimal manual intervention, as the task sequence handles all configuration steps without requiring post-deployment adjustments.

Exam trap

The trap here is that candidates often confuse provisioning packages (Option B) or Autopilot (Option D) as suitable for offline image customization, when in fact they only apply settings at runtime and cannot inject language packs into the OS image during deployment.

How to eliminate wrong answers

Option B is wrong because Windows Configuration Designer provisioning packages are designed for runtime configuration and cannot inject language packs into the offline Windows image during deployment; they apply settings after the OS is installed, requiring additional manual steps. Option C is wrong because Configuration Manager without MDT integration lacks the flexible task sequence engine needed to seamlessly inject language packs and regional settings during the deployment process, making it less efficient for this scenario. Option D is wrong because Windows Autopilot is a cloud-based deployment method that does not support injecting language packs into the OS image; it relies on existing images and applies settings post-deployment, which does not minimize manual intervention for language pack integration.

Full explanation →

798

Multi-Selectmedium

Which TWO of the following are prerequisites for deploying a Win32 app via Microsoft Intune?

Select 2 answers

A.The app must be packaged using the Microsoft Win32 Content Prep Tool.

B.The device must be running Windows 10 version 1803 or later.

C.The device must have the Intune Management Extension installed.

D.The device must be Azure AD joined.

E.The device must have the Company Portal app installed.

AnswersA, C

Tool creates .intunewin file.

Why this answer

The Microsoft Win32 Content Prep Tool is required to package Win32 apps into the .intunewin format that Intune can process. This tool pre-processes the installation files and detection logic, ensuring the app can be uploaded and deployed through the Intune console.

Exam trap

The trap here is that candidates often confuse the Windows 10 version requirement for Win32 apps (1607) with the higher version required for other Intune features like co-management or Windows Autopilot, leading them to incorrectly select version 1803.

Full explanation →

799

Multi-Selecteasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. Which TWO configurations are required?

Select 2 answers

A.The user must have a Google account

B.The device must be personally owned

C.The device must be enrolled using Android Enterprise work profile

D.The app must be approved in the managed Google Play store

E.The app must be configured as a kiosk app

AnswersC, D

Required for managed Google Play apps.

Why this answer

Android Enterprise work profile enrollment is the specific enrollment mode that creates a separate, managed profile on the device, isolating work apps and data from personal apps. This is the only Android Enterprise enrollment type that supports managed Google Play app deployment to work profile devices, as it binds the device to the managed Google Play store without requiring a personal Google account on the device.

Exam trap

The trap here is that candidates often confuse the requirement for a Google account (personal) with the managed Google Play account, or assume that work profile requires personal ownership, when in fact the enrollment type (work profile) is the sole prerequisite for deploying managed Google Play apps to work profile devices.

Full explanation →

800

Multi-Selecthard

Which THREE are valid methods to deploy an app as available for users in Microsoft Intune?

Select 3 answers

A.Assign the app to a device group with the 'Available' setting

B.Add the app to the Company Portal as a featured app without assignment

C.Assign the app to a user group with the 'Required' setting

D.Assign the app to a user group with the 'Available' setting

E.Assign the app to a user group with the 'Available for enrolled devices' setting

AnswersC, D, E

Required installs are still available in Company Portal.

Why this answer

Assigning an app with the 'Required' setting to a user group forces the app to be installed on the user's devices, making it available for deployment. In Microsoft Intune, the 'Required' assignment is a valid method to deploy an app as available for users, as it triggers automatic installation based on user identity. This ensures the app is pushed to all devices associated with the user group, aligning with the scenario of making an app available.

Exam trap

The trap here is that candidates often confuse device group assignments with user group assignments, mistakenly thinking 'Available' can be applied to device groups, but Intune restricts 'Available' to user groups only, and 'Required' is valid for both user and device groups.

Full explanation →

801

Multi-Selectmedium

Your organization is planning to use Microsoft Intune to manage Windows 11 devices. Which TWO are prerequisites for enrolling a Windows device in Intune?

Select 2 answers

A.Local administrator account on the device.

B.Microsoft Copilot for Microsoft 365 license.

C.Azure AD Premium P2 license.

D.Network connectivity to https://manage.microsoft.com and other Intune endpoints.

E.A Microsoft account (work or school) with an Intune license.

AnswersD, E

Connectivity is required for enrollment and management.

Why this answer

Network connectivity to https://manage.microsoft.com and other Intune endpoints is essential for device enrollment. Without this connectivity, the device cannot communicate with the Intune service to complete registration, policy retrieval, or management tasks. This requirement applies to all enrollment methods, including automatic enrollment via Azure AD join and manual enrollment via the Company Portal.

Exam trap

The trap here is that candidates often confuse the licensing requirements for Intune enrollment with Azure AD Premium P2, but Intune enrollment only requires an Intune license (or a bundled license like Microsoft 365 E3), not Azure AD P2.

Full explanation →

802

MCQmedium

You use Microsoft Intune to manage macOS devices. You need to deploy a shell script that runs on all macOS devices. What is the correct method?

A.Add a shell script under Devices > Scripts

B.Use Company Portal to distribute the script

C.Add a PowerShell script under Devices > Scripts

D.Create a custom configuration profile with Bash script

AnswerA

Intune supports shell scripts for macOS.

Why this answer

In Microsoft Intune, shell scripts for macOS are managed under Devices > Scripts, where you can add a script with a specific shell (e.g., bash, sh, zsh) and configure its execution frequency, run context, and notifications. This is the correct method because Intune natively supports deploying and running shell scripts on macOS devices via the Intune management agent, without requiring additional infrastructure.

Exam trap

The trap here is that candidates confuse the ability to run PowerShell scripts on Windows with macOS, or mistakenly think a configuration profile can execute arbitrary code, when in fact Intune strictly separates script deployment (Devices > Scripts) from configuration profiles (Devices > Configuration profiles).

How to eliminate wrong answers

Option B is wrong because Company Portal is a client application for end-user self-service tasks like installing available apps or enrolling devices, not a mechanism for deploying and executing scripts on macOS devices. Option C is wrong because PowerShell scripts are not natively supported on macOS in Intune; Intune's script deployment for macOS only supports shell scripts (e.g., bash, sh, zsh), not PowerShell. Option D is wrong because custom configuration profiles are used to apply settings (e.g., preferences, restrictions) via property lists, not to execute scripts; scripts require the dedicated 'Scripts' blade under Devices.

Full explanation →

803

MCQhard

A multinational organization uses Microsoft Entra ID joined devices with Intune. The security team wants to block enrollment of devices from non-corporate networks unless they have a compliant certificate. Which enrollment restriction should you configure?

A.Device platform restrictions

B.Conditional Access policy requiring hybrid Azure AD join

C.Compliance policy for device health

D.Enrollment device restrictions with certificate requirement

AnswerD

This allows only devices presenting a valid certificate to enroll.

Why this answer

Enrollment device restrictions in Intune allow you to block enrollment from non-corporate networks unless a compliant certificate is present. This is configured under 'Enrollment device restrictions' where you can set a 'Block' action for devices not on trusted networks and require a certificate for compliance, ensuring only authenticated devices can enroll from untrusted locations.

Exam trap

The trap here is confusing post-enrollment controls (compliance policies, Conditional Access) with pre-enrollment controls (enrollment restrictions), leading candidates to select options that manage devices after they are already enrolled rather than blocking enrollment itself.

How to eliminate wrong answers

Option A is wrong because device platform restrictions control which operating systems (e.g., Windows, iOS, Android) can enroll, not network-based certificate requirements. Option B is wrong because a Conditional Access policy requiring hybrid Azure AD join applies to access to cloud apps after enrollment, not to the enrollment process itself, and it does not enforce certificate-based network restrictions. Option C is wrong because compliance policies evaluate device health (e.g., encryption, jailbreak status) after enrollment, not during the enrollment flow, and cannot block enrollment from specific networks.

Full explanation →

804

MCQhard

Your organization has 5,000 Windows 10 devices managed by Microsoft Intune. You are implementing a new security policy that requires all devices to have BitLocker enabled with TPM validation. You create a device configuration profile for BitLocker and assign it to all devices. After two days, you notice that only 3,200 devices are compliant with the BitLocker policy. The remaining devices show 'Not applicable' for the setting. You verify that all devices are Windows 10 Pro or Enterprise and have TPM 2.0. What is the most likely cause of the 'Not applicable' status?

A.Some devices have TPM 1.2 instead of TPM 2.0

B.The system partition is not configured correctly

C.Secure Boot is disabled on some devices

D.The devices are not enrolled in Intune

AnswerB

BitLocker requires a properly configured system partition; otherwise, the policy shows 'Not applicable'.

Why this answer

BitLocker requires a system partition (active partition) that is of sufficient size (typically at least 100 MB) and properly configured. If the system partition is missing or misconfigured, the BitLocker setting will appear as 'Not applicable' even if the device meets other requirements like TPM 2.0. Option A is incorrect because all devices have TPM 2.0 as stated.

Option C is incorrect because Secure Boot is not a prerequisite for BitLocker. Option D is incorrect because the devices are already enrolled in Intune.

Full explanation →

805

MCQhard

You are the endpoint administrator for Contoso, a company with 5,000 Windows 11 devices managed by Microsoft Intune. The company uses Microsoft Defender for Endpoint (MDE) for endpoint detection and response. You need to implement a solution that ensures all devices have the latest Windows security updates installed within 7 days of release. Additionally, you must ensure that if a device misses two consecutive update cycles, it is automatically blocked from accessing corporate resources until it is updated. You have the following requirements: 1. Use Intune update rings to control update deployment. 2. Use MDE vulnerability management to identify missing updates. 3. Device compliance policies should check for missing updates and mark devices noncompliant. 4. Conditional Access should block noncompliant devices. Which combination of actions should you take?

A.Configure an update ring with a 7-day deferral. Create an app protection policy that requires minimum OS version. Assign the app protection policy to all users.

B.Configure an update ring with no deferral (deferral 0). Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.

C.Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Configure Conditional Access to require compliant devices.

D.Configure an update ring with a 7-day deferral. Create a device compliance policy that checks for missing updates. Assign the compliance policy to all devices. Do not configure Conditional Access.

AnswerC

Correct: updates are deferred 7 days; compliance checks missing updates; Conditional Access blocks noncompliant devices. The policy will mark devices noncompliant if they miss updates, and after two cycles (14 days) they will be blocked.

Why this answer

Configure an update ring with a 7-day deferral to ensure updates are installed within 7 days. Create a device compliance policy that checks for missing updates to mark devices as noncompliant. Configure Conditional Access to require compliant devices, blocking those that are noncompliant.

Option A is incorrect because it uses an app protection policy instead of a device compliance policy. Option B is incorrect because it sets no deferral (deferral 0), which would apply updates immediately, not within 7 days as required. Option D is incorrect because it does not configure Conditional Access, so noncompliant devices would not be blocked.

Full explanation →

806

MCQhard

You run the PowerShell command to check the assignment of a Microsoft Store app in Intune. The output shows 'intent: required' and 'target: allDevicesAssignmentTarget'. Which statement is true about this app?

A.The app is assigned to a specific device group named 'All Devices'.

B.The app will install automatically on all enrolled devices.

C.The app is only assigned to devices that have the Intune Management Extension.

D.The app is available for users to install from Company Portal.

AnswerB

Required assignment to all devices triggers automatic installation.

Why this answer

The output shows 'intent: required' and 'target: allDevicesAssignmentTarget'. In Intune, 'intent: required' means the app is mandatory and will install automatically without user intervention. 'target: allDevicesAssignmentTarget' indicates the assignment applies to all enrolled devices, not a specific group. Therefore, the app will install automatically on every enrolled device, making option B correct.

Exam trap

The trap here is that candidates confuse 'allDevicesAssignmentTarget' with a manually created 'All Devices' group, or misinterpret 'intent: required' as making the app available in Company Portal, when in fact it enforces automatic installation.

How to eliminate wrong answers

Option A is wrong because 'allDevicesAssignmentTarget' is a built-in system group representing all enrolled devices, not a user-created device group named 'All Devices'. Option C is wrong because the Intune Management Extension is only required for Win32 apps or PowerShell scripts, not for Microsoft Store apps, which use the Windows Store client or the Intune management agent. Option D is wrong because 'intent: required' forces installation, whereas 'intent: available' would make the app visible in Company Portal for user-initiated installation.

Full explanation →

807

Multi-Selectmedium

Which THREE actions can you perform from the Microsoft Intune admin center to remediate a non-compliant Windows device?

Select 3 answers

A.Retire the device

B.Remote lock

C.Wipe the device

D.Assign a compliance policy

E.Sync the device

AnswersA, C, E

Retire removes managed data and enrollment.

Why this answer

The Retire action removes the device from Intune management and revokes corporate data access, which is a valid remediation for non-compliant Windows devices when the device cannot be brought back into compliance. This action is performed from the Microsoft Intune admin center under the device's compliance status.

Exam trap

The trap here is that candidates may confuse 'Assign a compliance policy' with a remediation action, but it is a configuration step that does not directly fix a non-compliant device; only enforcement actions like retire, wipe, or sync can remediate non-compliance.

Full explanation →

808

MCQhard

A user reports that their Windows 11 device cannot connect to the corporate Wi-Fi network. In Intune, the device shows a status of 'Pending' for the Wi-Fi configuration profile. The profile is assigned to a group that includes the user. What is the most likely cause of the issue?

A.The device does not have the required root certificate installed.

B.The Wi-Fi profile is not assigned to the user's group.

C.The Wi-Fi profile requires user affinity and the device is shared.

D.The device has not checked in to Intune within the last 8 hours.

AnswerD

Devices check in periodically; a pending status means the policy hasn't been applied yet.

Why this answer

The 'Pending' status in Intune for a Wi-Fi configuration profile indicates that the policy has been assigned but not yet applied to the device. This typically occurs when the device has not performed a recent check-in with the Intune service. By default, devices check in every 8 hours, so if the device has not checked in within that window, the profile remains in a 'Pending' state until the next successful sync.

Exam trap

The trap here is that candidates often assume 'Pending' means a configuration error (like missing certificates or incorrect assignment) rather than recognizing it as a synchronization delay, which is a common Intune behavior tested on the MD-102 exam.

How to eliminate wrong answers

Option A is wrong because a missing root certificate would typically cause a connection failure after the profile is applied, not a 'Pending' status in Intune; the profile would still be delivered and show as 'Succeeded' or 'Error' depending on the certificate validation. Option B is wrong because the question explicitly states the profile is assigned to a group that includes the user, so assignment is not the issue. Option C is wrong because user affinity affects how profiles are targeted (user vs. device), but a 'Pending' status is not caused by user affinity settings; it is a sync timing issue.

Full explanation →

809

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires a kernel extension. The app is signed with a Developer ID certificate. The devices are enrolled in Intune and are supervised. You have uploaded the .pkg to Intune and assigned it to a user group. The installation fails on devices with the error 'The app could not be installed because the kernel extension is not approved'. You have already configured a kernel extension profile that allows the specific team identifier. What else is likely missing?

A.System Integrity Protection (SIP) is enabled on the devices.

B.FileVault is enabled on the devices.

C.The kernel extension profile does not include the 'Allow user to approve kernel extensions' setting.

D.The app is not notarized by Apple.

AnswerD

The app is not notarized by Apple. Notarization is required for kernel extensions on macOS 10.14.5+ to ensure they are free from known malicious content. This is the missing prerequisite.

Why this answer

Starting with macOS 10.14.5, Apple requires all kernel extensions (kexts) to be notarized by Apple. Even if the kernel extension profile allows the team identifier, the app itself must be notarized to install on macOS 10.14.5+ systems. Without notarization, the installation fails with the given error.

Option C is incorrect because the 'Allow user to approve kernel extensions' setting is for user approval after installation, not the root cause here. Options A and B are unrelated.

Full explanation →

810

MCQmedium

You are deploying a managed Google Play app to Android Enterprise fully managed devices. The app is not appearing in the work profile. What is the most likely reason?

A.The app is not approved in Managed Google Play

B.The work profile is not enabled

C.The device is not enrolled in Intune

D.The device is not associated with a Google account

AnswerA

Apps must be approved before deployment.

Why this answer

The most likely reason the app is not appearing is that it has not been approved in Managed Google Play. For Android Enterprise fully managed devices, apps must be approved in the Managed Google Play console before they can be deployed via Intune. Option B is incorrect because the work profile is not relevant for fully managed devices; they are corporate-owned and do not use work profiles.

Option C is incorrect because the device must be enrolled in Intune, but if it is enrolled and the app is missing, lack of enrollment is not the most likely reason. Option D is incorrect because fully managed devices are associated with a managed Google account via the enrollment token, not a personal Google account.

Full explanation →

811

Multi-Selecthard

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a PowerShell script that runs in the user context on a schedule. Which TWO methods can you use? (Choose two.)

Select 2 answers

A.Device compliance policy with a custom script

B.Proactive remediation in Microsoft Intune

C.Configuration profile with a scheduled task

D.Line-of-business app deployment package

E.PowerShell script deployment from the Intune console

AnswersB, C

Proactive remediations can run PowerShell scripts on a schedule in user context.

Why this answer

Proactive remediations in Microsoft Intune allow you to run PowerShell scripts in the user context on a schedule, making option B correct. They are designed for detection and remediation of common support issues, supporting both user and system context execution with configurable schedules.

Exam trap

The trap here is that candidates confuse the one-time execution of Intune PowerShell scripts (option E) with the scheduled execution capability of proactive remediations, or mistakenly think a configuration profile with a scheduled task (option C) is not valid because it requires manual creation of the scheduled task XML, but it is actually a supported method for running scripts on a schedule in the user context.

Full explanation →

812

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to configure a policy that prevents users from disabling the camera on their corporate iOS devices. You create a device restrictions profile and set the 'Enable camera' setting to 'No'. You assign the profile to a group containing all iOS devices. After 24 hours, users report that the camera is still functional. What should you check first?

A.Verify that the devices are members of the assigned group.

B.Ensure the setting 'Enable camera' is set to 'Not configured' instead of 'No'.

C.Review the device compliance status.

D.Check if the profile is applied to users instead of devices.

AnswerA

Group membership is the most common cause of policy not applying.

Why this answer

The profile must be assigned to the correct group; if the devices are not in the group, the policy won't apply. Option B is wrong because the setting is correct. Option C is wrong because iOS restrictions are applied at the device level, not user.

Option D is wrong because device compliance is not relevant here.

Full explanation →

813

MCQmedium

A company uses Intune to manage Android Enterprise devices. The administrator deployed a compliance policy that requires encryption and a minimum OS version. Some devices are not showing as compliant even though they meet the requirements. The administrator suspects a time delay. What is the default compliance check interval for Android Enterprise devices in Intune?

A.Every 1 hour

B.Every 8 hours

C.Every 30 minutes

D.Every 24 hours

AnswerB

Default compliance check interval for Android Enterprise is every 8 hours.

Why this answer

The default compliance check interval for Android Enterprise devices in Intune is every 8 hours. This interval determines how often devices re-evaluate their compliance status against assigned policies, and it is not configurable for Android Enterprise devices. The administrator's suspicion of a time delay is valid because even if a device meets the requirements, it will not report as compliant until the next scheduled check occurs.

Exam trap

The trap here is that candidates often confuse the default compliance check interval for Android Enterprise with the shorter intervals used by other platforms (like iOS/iPadOS at 1 hour) or with the legacy Android device administrator interval (24 hours), leading them to select an incorrect option.

How to eliminate wrong answers

Option A is wrong because 1 hour is not the default interval; it is the minimum check-in frequency for some other platforms like iOS/iPadOS, but not for Android Enterprise. Option C is wrong because 30 minutes is the default check-in frequency for Windows 10/11 devices using the Microsoft Intune agent, not for Android Enterprise. Option D is wrong because 24 hours is the default compliance check interval for Android device administrator (legacy) management, not for Android Enterprise (work profile or fully managed) devices.

Full explanation →

814

Multi-Selecteasy

Which TWO of the following are benefits of using Microsoft Intune to manage applications on mobile devices?

Select 2 answers

A.Ability to deploy apps to devices without requiring sideloading.

B.Enforcement of device compliance before app installation.

C.Support for user-based licensing only.

D.Selective wipe of corporate data from apps when a user leaves.

E.Automatic backup of app data to the cloud.

AnswersA, D

Apps are installed via MDM channel.

Why this answer

Microsoft Intune uses the Company Portal app or the Intune app wrapper to deploy line-of-business (LOB) apps directly to devices without requiring users to manually sideload them. This simplifies app distribution by leveraging the MDM channel, which pushes the app package (e.g., .ipa for iOS, .apk for Android) to the device, ensuring it is installed silently or with minimal user interaction. Sideloading typically involves manual installation via USB or enterprise provisioning profiles, which Intune eliminates through its managed deployment capabilities.

Exam trap

The trap here is that candidates often confuse 'deploying apps without sideloading' with 'enforcing compliance before installation,' but Intune deploys apps to all enrolled devices and uses conditional access to gate access, not installation, making Option B a common distractor.

Full explanation →

815

MCQeasy

A Windows 10 device is assigned this update ring policy. A new quality update is released today. When will the device install the update?

A.In 7 days

B.In 30 days

C.Today

D.Never, because automatic update mode requires reboot with warning.

AnswerC

Deferral is 0 days, so it installs as soon as available.

Why this answer

The update ring policy is configured with 'Automatic update behavior' set to 'Auto install and restart without end-user control' and 'Servicing channel' set to 'Current branch (CB)'. When a new quality update is released, devices in this configuration will download and install the update immediately, typically within 24 hours of release, without any deferral period. The policy does not specify any deferral for quality updates, so the installation occurs today.

Exam trap

The trap here is that candidates confuse the 'Automatic update behavior' setting (which controls restart behavior) with the deferral period (which controls when the update is offered), leading them to incorrectly assume that a 'reboot with warning' mode delays the installation itself.

How to eliminate wrong answers

Option A is wrong because a 7-day deferral would only apply if the update ring policy had a 'Quality update deferral period (days)' set to 7, which is not indicated in the scenario. Option B is wrong because a 30-day deferral is typically used for feature updates, not quality updates, and the policy does not specify such a deferral for quality updates. Option D is wrong because 'Automatic update mode' with 'Auto install and restart without end-user control' does not prevent installation; it allows the update to install and then reboots with a warning, but the update itself is installed immediately upon availability.

Full explanation →

816

MCQmedium

A company deploys Windows 10 Enterprise devices managed by Microsoft Intune. Users report that after a recent Windows update, the Start menu layout is reset to default on some devices. The company uses a custom Start menu layout XML policy. How should the administrator ensure the custom layout is reapplied automatically after feature updates?

A.Use a Feature Update policy in Intune to set the 'Start layout XML' setting.

B.Deploy a provisioning package with the custom layout to all devices via Intune.

C.Configure the 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar to point to the XML file.

D.Reapply the Start layout policy manually after each feature update.

AnswerC

The Start layout policy is reapplied during policy refresh, which occurs after feature updates.

Why this answer

The 'Start layout' policy under User Configuration > Administrative Templates > Start Menu and Taskbar in a Group Policy Object (GPO) or Intune Administrative Template profile is designed to persistently enforce a custom Start layout XML. When a Windows feature update resets the Start menu to default, this policy automatically reapplies the custom layout at next user logon or policy refresh, ensuring consistency without manual intervention.

Exam trap

The trap here is that candidates confuse Feature Update policies (which manage version upgrades) with configuration policies (which enforce settings like Start layout), leading them to incorrectly select Option A.

How to eliminate wrong answers

Option A is wrong because a Feature Update policy in Intune controls which Windows version is installed, not the Start layout configuration; it does not contain a 'Start layout XML' setting. Option B is wrong because a provisioning package applies settings only during initial device setup or reset, not dynamically after a feature update; it is not designed for ongoing policy enforcement. Option D is wrong because manual reapplication is not an automated solution and contradicts the requirement for automatic reapplication after feature updates.

Full explanation →

817

MCQhard

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully on some devices but fails on others with no error in the Intune console. The app logs show 'Access Denied' during installation. What should you check first?

A.The device is not Microsoft Entra ID joined

B.The device has insufficient disk space

C.The app is not signed

D.The installation context (user vs system) in the app deployment

AnswerD

The app may require system privileges but is set to user context.

Why this answer

The 'Access Denied' error in the app logs indicates a permissions issue during installation. In Intune, Win32 apps can be deployed in either 'user' or 'system' installation context. If the app requires administrative privileges (e.g., writing to Program Files or the registry under HKLM) but is configured to run in the user context, it will fail with an access denied error on devices where the user lacks sufficient rights.

Therefore, verifying the installation context is the first troubleshooting step.

Exam trap

The trap here is that candidates often assume 'Access Denied' is always a signing or permission issue at the device level, but the MD-102 exam specifically tests the distinction between user and system installation contexts in Intune Win32 app deployments.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID (formerly Azure AD) join status does not directly cause 'Access Denied' errors during app installation; it affects authentication and policy application, not local file system permissions. Option B is wrong because insufficient disk space typically produces a 'disk full' or 'out of space' error, not an 'Access Denied' error. Option C is wrong because an unsigned app would generate a different error, such as 'The publisher could not be verified' or a SmartScreen warning, not an 'Access Denied' error.

Full explanation →

818

MCQhard

A user reports that their Windows 11 device is not receiving a required security baseline policy from Microsoft Intune. The device appears as compliant in the Microsoft Intune admin center. Other devices in the same group receive the policy. You verify that the policy is assigned to the correct group and that the user is a member. What is the most likely cause?

A.The device has not checked in with Intune recently or has a policy conflict

B.The user is not a member of the Azure AD group that the policy is assigned to

C.The policy is not assigned to any group

D.The device is marked as non-compliant and has been blocked

AnswerA

If the device hasn't checked in or has a conflict, it may not apply the policy.

Why this answer

The most likely cause is that the device has not checked in with Intune recently or has a policy conflict. Even though the device appears compliant in the admin center, compliance status is based on the last check-in data; if the device hasn't synced recently, it won't receive new or updated policies. Policy conflicts, such as overlapping settings from multiple baselines or configuration profiles, can also prevent a specific security baseline from applying, even when the device is otherwise compliant.

Exam trap

The trap here is that candidates assume compliance status directly correlates with policy delivery, but Intune separates compliance evaluation from policy assignment—a device can be compliant yet still fail to receive policies due to sync issues or conflicts.

How to eliminate wrong answers

Option B is wrong because the question explicitly states that the user is a member of the correct Azure AD group, so group membership is not the issue. Option C is wrong because the policy is verified to be assigned to the correct group, so the policy is indeed assigned. Option D is wrong because the device is reported as compliant in the Intune admin center, and a non-compliant device would be blocked from receiving policies only if a conditional access policy enforces that block; compliance status alone does not prevent policy delivery.

Full explanation →

819

MCQmedium

You are configuring a Windows 10 device compliance policy in Microsoft Intune. The policy requires that devices have BitLocker enabled and a minimum OS build version. However, some devices are showing as 'Not compliant' even though they meet the requirements. What is the most likely cause?

A.The OS build version is not reported correctly.

B.The devices have not checked in with Intune recently.

C.BitLocker is not enabled on the system drive.

D.The devices need to be rebooted for the policy to apply.

AnswerB

Outdated check-in can cause incorrect non-compliance status.

Why this answer

The most likely cause is that the devices have not checked in with Intune recently. Intune compliance policies are evaluated only when devices check in via the Intune Management Extension or the MDM agent. If a device hasn't synced within the configured check-in frequency (default every 8 hours), its compliance status becomes stale and may show as 'Not compliant' even if it meets the requirements locally.

This is a common scenario where the policy is correctly configured, but the device's last sync timestamp is too old.

Exam trap

The trap here is that candidates often assume a local configuration mismatch (like BitLocker or OS build) is the cause, but the real issue is the device's failure to communicate its compliance state to Intune, which is a common scenario in hybrid or offline environments.

How to eliminate wrong answers

Option A is wrong because the OS build version is reported correctly by the device's MDM client via the DeviceInventory CSP; if the device meets the build requirement, the reported value will match the policy. Option C is wrong because the question states the devices meet the requirements, meaning BitLocker is enabled on the system drive; the issue is not a local configuration failure. Option D is wrong because rebooting does not trigger a compliance evaluation or policy application; Intune policies are applied during MDM sync, not on boot, and compliance status is updated only after a successful check-in.

Full explanation →

820

Multi-Selecthard

Which THREE of the following are valid methods to enroll Android devices into Microsoft Intune?

Select 3 answers

A.Android Device Administrator

B.Android Legacy

C.Android Enterprise work profile

D.Android Open Source Project (AOSP)

E.Android Enterprise fully managed

AnswersC, D, E

Work profile is for BYOD scenarios, separating work and personal data.

Why this answer

Android Enterprise work profile is a supported enrollment method in Microsoft Intune that allows users to keep their personal apps and data separate from corporate data on the same device. Intune manages the work profile using the Android Enterprise platform, which provides containerization and policy enforcement without requiring full device control.

Exam trap

The trap here is that candidates confuse 'Android Device Administrator' (a deprecated method) with 'Android Enterprise work profile' (a modern method), or mistakenly think 'Android Legacy' is a valid enrollment option when it is not a recognized Intune enrollment type.

Full explanation →

821

Multi-Selectmedium

Which TWO are valid methods to deploy Windows 10/11 using Microsoft Intune?

Select 2 answers

A.Windows Autopilot

B.Provisioning packages (PPKG)

C.PXE boot from a distribution point

D.Network boot via WDS

E.Bootable USB media with Windows Setup

AnswersA, B

Cloud-native deployment method.

Why this answer

Windows Autopilot is a valid Intune deployment method because it uses cloud-based configuration to transform a new or existing device into a business-ready state without manual imaging. It leverages hardware hashes uploaded to Intune, which then applies policies, apps, and settings during the out-of-box experience (OOBE). This eliminates the need for traditional imaging infrastructure.

Exam trap

The trap here is that candidates confuse on-premises deployment tools (WDS, PXE, USB media) with cloud-native Intune methods, forgetting that Intune is a cloud-only MDM service that does not support direct imaging or network boot protocols.

Full explanation →

822

Multi-Selecteasy

A company uses Microsoft Intune to manage devices. They want to use a script to collect inventory data from Windows devices. Which TWO methods can be used?

Select 2 answers

A.Device configuration profile

B.Proactive remediations

C.Custom compliance policy

D.PowerShell script deployment

E.App protection policy

AnswersB, C

Detection scripts in proactive remediations can collect inventory data.

Why this answer

Proactive remediations (B) are correct because they allow you to run PowerShell scripts on a schedule to detect and remediate issues, and the detection script can output custom inventory data that is collected and reported in Intune. Custom compliance policies (C) are correct because they can execute a PowerShell script to evaluate compliance settings, and the script's output (e.g., registry values, file versions) can be used to gather inventory data as part of the compliance check.

Exam trap

The trap here is that candidates confuse 'running a script' (PowerShell script deployment) with 'collecting inventory data from a script' (Proactive remediations or custom compliance policies), not realizing that only the latter two methods natively capture and report script output back to Intune as inventory.

Full explanation →

823

MCQeasy

You need to ensure that all corporate-owned Windows devices automatically receive security updates as soon as they are released by Microsoft. Which update ring policy setting should you configure in Microsoft Intune?

A.Set the 'Microsoft product updates' setting to 'Allow'.

B.Set 'Defer quality updates' to 0 days.

C.Select the 'Windows Insider' channel for quality updates.

D.Select the 'Semi-Annual Channel' for feature updates.

AnswerB

0-day deferral means updates are installed immediately.

Why this answer

Setting 'Defer quality updates' to 0 days in a Microsoft Intune update ring policy ensures that quality (security) updates are applied immediately upon release by Microsoft, with no deferral period. This configuration forces Windows devices to download and install security updates as soon as they are available from Windows Update, meeting the requirement for automatic and immediate security patching.

Exam trap

The trap here is that candidates often confuse 'Defer quality updates' with 'Microsoft product updates' or 'Semi-Annual Channel', mistakenly thinking those settings control the speed of security update delivery, when in fact they address unrelated update categories or release channels.

How to eliminate wrong answers

Option A is wrong because 'Microsoft product updates' controls whether updates for other Microsoft products (like Office) are included during Windows updates, not the timing of security update delivery. Option C is wrong because selecting the 'Windows Insider' channel is for pre-release testing builds, not for receiving released security updates immediately; it would expose devices to unstable preview code. Option D is wrong because the 'Semi-Annual Channel' for feature updates controls the deferral of feature updates (new OS versions), not the timing of quality (security) updates, and does not address immediate security patching.

Full explanation →

824

MCQeasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that when a device is lost, an IT admin can remotely wipe only the work profile, leaving the personal data intact. Which remote action should you use?

A.Wipe

B.Remove work profile

C.Retire

D.Delete

AnswerB

This action removes only the work profile, preserving personal apps and data.

Why this answer

The 'Remove work profile' action is the correct remote action for Android Enterprise personally-owned work profile devices because it specifically targets and removes only the managed work profile, including all corporate apps and data, while leaving the user's personal profile and data intact. This action is designed for BYOD scenarios where the organization needs to protect corporate data without affecting the employee's personal information.

Exam trap

The trap here is that candidates often confuse 'Retire' with 'Remove work profile' because both remove corporate data, but on Android Enterprise personally-owned work profile devices, 'Remove work profile' is the explicit and correct action name, while 'Retire' is a legacy or generic term that may not be listed as a separate action in the Intune console for this device type.

How to eliminate wrong answers

Option A is wrong because 'Wipe' performs a full factory reset of the entire device, erasing both personal and corporate data, which is not appropriate when only the work profile needs to be removed. Option C is wrong because 'Retire' is a generic action that removes management and all company data from the device, but on Android Enterprise personally-owned work profile devices, it effectively performs the same as 'Remove work profile'; however, the specific and correct action name for this scenario is 'Remove work profile', not 'Retire'. Option D is wrong because 'Delete' is not a valid remote action in Microsoft Intune for Android Enterprise devices; it typically refers to deleting the device object from the console without initiating a wipe or profile removal.

Full explanation →

825

MCQmedium

You have configured the above app protection policy for iOS. What is the effect on managed apps?

A.Users can use Face ID to unlock apps

B.Users cannot take screenshots within managed apps

C.Users can back up app data to iCloud

D.Users can print from managed apps

AnswerB

Screen capture is blocked.

Why this answer

The app protection policy for iOS includes a setting to prevent screenshots and screen captures in managed apps. When this policy is configured, the OS restricts the ability to capture the screen within those apps, making option B correct. This is enforced by the iOS MDM framework, which disables the screenshot functionality at the app level.

Exam trap

The trap here is that candidates often confuse the screenshot prevention setting with other common app protection policies like PIN/biometric requirements or data transfer restrictions, leading them to select options A, C, or D incorrectly.

How to eliminate wrong answers

Option A is wrong because Face ID unlock is controlled by a separate policy setting ('Require PIN for access' or 'Use biometrics'), not by the screenshot prevention setting. Option C is wrong because backing up app data to iCloud is blocked by the 'Prevent backup' policy setting, which is independent of screenshot controls. Option D is wrong because printing from managed apps is governed by the 'Restrict cut, copy, and paste' or 'Allow printing' policy settings, not by the screenshot prevention configuration.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 751–825