Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 226–300 | Page 4/13

226

MCQeasy

You need to deploy Windows 10 Enterprise to 100 new computers using Microsoft Intune. The computers are not yet joined to Microsoft Entra ID. What is the recommended method?

A.Join each device to Entra ID manually and then enroll in Intune.

B.Create a provisioning package using Windows Configuration Designer and deploy via USB.

C.Register the devices in Windows Autopilot and deploy an Autopilot profile.

D.Use a Configuration Manager task sequence to deploy the OS.

AnswerC

Autopilot automates the deployment and enrollment process.

Why this answer

Windows Autopilot is the recommended method for deploying Windows 10 Enterprise to new devices that are not yet joined to Microsoft Entra ID because it automates the entire provisioning process—from joining Entra ID to enrolling in Intune—without requiring any manual intervention or imaging. By registering the devices in Autopilot and deploying an Autopilot profile, the out-of-box experience (OOBE) is customized to join Entra ID and enroll in Intune automatically, ensuring a zero-touch deployment that aligns with modern management best practices.

Exam trap

The trap here is that candidates often confuse provisioning packages (Option B) as the recommended method for cloud-only deployments, but Autopilot is specifically designed for zero-touch, cloud-native provisioning and is the correct answer for new devices not yet joined to Entra ID.

How to eliminate wrong answers

Option A is wrong because manually joining each device to Entra ID and then enrolling in Intune is not recommended for 100 new computers; it is labor-intensive, error-prone, and defeats the purpose of automated, scalable deployment. Option B is wrong because provisioning packages created with Windows Configuration Designer are typically used for bulk provisioning in on-premises or hybrid scenarios, but they do not leverage cloud-native Autopilot capabilities and require physical USB deployment, which is less efficient for remote or large-scale rollouts. Option D is wrong because using a Configuration Manager task sequence to deploy the OS is a traditional imaging approach that relies on on-premises infrastructure and does not integrate natively with cloud-based Entra ID join and Intune enrollment, making it unsuitable for a modern, cloud-first deployment strategy.

Full explanation →

227

Multi-Selectmedium

Which TWO of the following are benefits of using Windows Autopilot for device provisioning?

Select 2 answers

A.Eliminates the requirement for a Microsoft Entra ID subscription.

B.Allows end users to set up their own devices with minimal IT involvement.

C.Enables device provisioning over a VPN connection.

D.Reduces the need for custom imaging and manual setup.

E.Supports deployment without any internet connectivity.

AnswersB, D

Autopilot provides a self-service deployment experience.

Why this answer

Windows Autopilot leverages the device's hardware identity (hash) to automatically enroll it in Microsoft Entra ID and join it to a domain or tenant, allowing end users to complete the setup process themselves with minimal IT intervention. This reduces helpdesk calls and streamlines the out-of-box experience (OOBE) by presenting only necessary screens.

Exam trap

The trap here is that candidates often assume Autopilot can work over a VPN or without internet because it is a cloud-based service, but it requires direct internet access during OOBE before any VPN client is installed.

Full explanation →

228

MCQmedium

You are the Intune administrator for Fabrikam, Inc., which has 5,000 Windows 10 devices. The company wants to move from on-premises Group Policy management to Intune. You have already deployed the Intune Management Extension to all devices. However, some devices are not receiving policies. You discover that these devices are not enrolled in Intune. You need to enroll all devices as quickly as possible with minimal user interaction. The devices are already joined to on-premises Active Directory. You have Microsoft Entra ID Connect configured. What should you do?

A.Configure the MDM user scope in Microsoft Entra ID to All, and ensure devices are hybrid joined.

B.Distribute a script to each user to run manually.

C.Deploy Windows Autopilot to reset and re-enroll each device.

D.Use the Intune Enrollment Status Page to force enrollment.

AnswerA

This enables automatic enrollment for hybrid joined devices.

Why this answer

Configuring the MDM user scope to 'All' in Microsoft Entra ID triggers automatic MDM enrollment for hybrid Azure AD-joined devices when combined with Microsoft Entra ID Connect. Since the devices are already joined to on-premises AD and Entra ID Connect is configured, setting the MDM scope to 'All' enables automatic, silent enrollment via the scheduled task created by the Group Policy for automatic enrollment, requiring no user interaction beyond sign-in.

Exam trap

The trap here is that candidates often confuse the Enrollment Status Page (ESP) as an enrollment trigger, when in fact it is a post-enrollment configuration tool, or they mistakenly believe Autopilot is required for hybrid devices, ignoring the simpler automatic enrollment path via MDM scope and hybrid join.

How to eliminate wrong answers

Option B is wrong because distributing a script for manual execution requires user interaction and administrative overhead, which contradicts the goal of minimal user interaction and rapid enrollment. Option C is wrong because Windows Autopilot resets the device and requires re-joining to Azure AD, which is disruptive, time-consuming, and not suitable for already domain-joined devices that only need Intune enrollment. Option D is wrong because the Enrollment Status Page (ESP) is a configuration within Intune that controls device setup progress during enrollment, not a mechanism to trigger or force enrollment on unenrolled devices.

Full explanation →

229

MCQmedium

A user reports that their Windows 11 device is not receiving configuration policies from Microsoft Intune. The device shows as 'active' in the Intune admin center. Which troubleshooting step should you take first?

A.Unenroll and re-enroll the device.

B.Restart the Microsoft Intune Management Extension service on the device.

C.Verify that the device is compliant with BitLocker encryption requirements.

D.Check the device's compliance policy assignment.

AnswerB

This service handles delivery of configuration policies, scripts, and apps; restarting it forces a sync.

Why this answer

The Microsoft Intune Management Extension (IME) is the agent responsible for processing and applying configuration policies on Windows devices. If the device is 'active' in Intune but not receiving policies, the IME service may be stuck or not running. Restarting this service forces the agent to re-sync with Intune, which is the quickest and least disruptive first step.

Exam trap

The trap here is that candidates often confuse device 'active' status with successful policy delivery, leading them to jump to compliance checks or re-enrollment instead of first troubleshooting the local agent that actually applies the policies.

How to eliminate wrong answers

Option A is wrong because unenrolling and re-enrolling is a drastic step that should only be taken after verifying that the IME service or sync process is not the issue; it also requires re-provisioning the device and can cause unnecessary downtime. Option C is wrong because BitLocker compliance is a specific policy setting, not a prerequisite for receiving any configuration policies; the device can be non-compliant with BitLocker yet still receive other policies. Option D is wrong because checking compliance policy assignment addresses whether the device meets compliance rules, not whether the policy delivery mechanism (IME) is functioning; a device can be compliant but still fail to receive policies if the agent is not running.

Full explanation →

230

MCQmedium

A company uses Microsoft Intune to manage iOS and Android devices. Users report that some line-of-business (LOB) apps fail to install with error '0x87D1041C'. The apps are signed and deployed as device-required installs. What is the most likely cause?

A.The user is not assigned to the app deployment.

B.The app is not compliant with the device's OS version.

C.The device does not have the required app configuration policy.

D.The app is signed with a different certificate than the one uploaded to Intune.

AnswerD

This error specifically indicates a certificate mismatch.

Why this answer

Error 0x87D1041C in Intune indicates a signature mismatch. When a line-of-business (LOB) app is deployed as a device-required install, the app binary must be signed with a certificate that has been uploaded to the Intune console. If the signing certificate used to sign the app differs from the one uploaded, Intune rejects the installation because it cannot verify the app's integrity and trust chain.

Exam trap

The trap here is that candidates often confuse error 0x87D1041C with a user assignment or OS version issue, but the specific error code directly points to a certificate mismatch, not a policy or compliance failure.

How to eliminate wrong answers

Option A is wrong because the deployment is configured as a device-required install, which targets the device directly and does not require user assignment; the error would be different (e.g., 0x87D13B9F) if the user lacked assignment. Option B is wrong because OS version compliance issues typically produce error 0x87D1041C only if the app's minimum OS requirement is not met, but the question states the apps are signed and deployed, and the specific error code 0x87D1041C maps to a certificate/signing problem, not an OS version mismatch. Option C is wrong because app configuration policies are optional for LOB apps and are not required for installation; missing configuration policies would not block installation with this error code.

Full explanation →

231

MCQmedium

You have a Windows 11 device enrolled in Intune that is not receiving configuration profiles. The device shows 'Pending' status for all profiles. You confirm the device is connected to the internet and can reach Microsoft's servers. What is the most likely cause?

A.The device is not in the correct security group for the profile assignment.

B.The device has a certificate issue preventing it from receiving profiles.

C.The device is not syncing with Intune.

D.The Intune service is experiencing an outage.

AnswerC

If the device is not syncing, it will show 'Pending'.

Why this answer

If the device is not syncing, it will show 'Pending'. Option A is wrong because group membership is for assignment, not sync. Option B is wrong because certificate issues affect authentication, not profile delivery.

Option D is wrong because the Intune service health is for global issues, not a single device.

Full explanation →

232

MCQmedium

Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. You plan to use Windows Autopilot for new devices. Which prerequisite must be met for Autopilot to work with Entra ID?

A.Devices must be registered in Autopilot using hardware hash

B.Devices must be domain-joined to on-premises AD

C.An Azure AD Premium P2 license must be assigned

D.Configuration Manager must be deployed for OS imaging

AnswerA

Prerequisite for Autopilot deployment.

Why this answer

Windows Autopilot requires that each device be registered in the Autopilot service using its unique hardware hash (also known as a hardware ID). This hash is collected from the device's firmware and uploaded to the Autopilot deployment service, which then associates the device with the target tenant. Without this registration, Autopilot cannot identify the device during the out-of-box experience (OOBE) and cannot automatically enroll it into Microsoft Entra ID.

Exam trap

The trap here is that candidates often assume Autopilot requires an on-premises domain join (option B) because they confuse Autopilot with traditional imaging or hybrid Azure AD join scenarios, but Autopilot's core value is cloud-native, domain-join-free provisioning.

How to eliminate wrong answers

Option B is wrong because Autopilot devices do not need to be domain-joined to on-premises Active Directory; Autopilot is designed to directly join devices to Microsoft Entra ID (formerly Azure AD) during OOBE, bypassing any on-premises dependency. Option C is wrong because while Azure AD Premium P2 licenses provide additional features like Identity Protection and Privileged Identity Management, Autopilot itself only requires Azure AD Premium P1 (or Microsoft 365 E3/E5) for the Autopilot deployment profile and automatic enrollment; P2 is not a prerequisite. Option D is wrong because Configuration Manager is not required for Autopilot; Autopilot uses cloud-based provisioning via Microsoft Intune and does not rely on any on-premises imaging or OS deployment tool like Configuration Manager.

Full explanation →

233

MCQeasy

An organization uses Microsoft Intune to manage Windows devices. They want to ensure that only devices with a TPM 2.0 chip can access corporate email. Which policy should be configured?

A.Device enrollment restriction to require TPM 2.0

B.Device configuration profile to enable TPM 2.0

C.Device compliance policy with a condition for TPM 2.0, combined with a conditional access policy

D.App protection policy to require TPM 2.0

AnswerC

The compliance policy checks for TPM 2.0, and conditional access blocks devices that are non-compliant.

Why this answer

A device compliance policy can evaluate whether a device has TPM 2.0 (via the TPM specification version check), and when combined with a Conditional Access policy, it can block access to corporate email for non-compliant devices. This is the standard Microsoft approach for enforcing hardware-based security requirements for cloud app access.

Exam trap

The trap here is that candidates often confuse device compliance policies with enrollment restrictions, thinking that blocking enrollment is sufficient, but Conditional Access is required to enforce access control after enrollment.

How to eliminate wrong answers

Option A is wrong because device enrollment restrictions control which devices can enroll in Intune, but they do not enforce ongoing access control for corporate email after enrollment; they only block enrollment itself. Option B is wrong because a device configuration profile cannot enable TPM 2.0—TPM is a hardware component that is either present or not, and configuration profiles manage settings, not hardware capabilities. Option D is wrong because app protection policies (MAM) manage data protection within apps without requiring device-level compliance checks like TPM presence; they are designed for unmanaged or BYOD scenarios where device compliance is not evaluated.

Full explanation →

234

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10/11 devices. You need to configure a Windows Autopilot deployment for new devices that are shipped directly to users. The devices must be automatically enrolled in Intune and configured with your organization's standard settings. What is the minimum requirement for the device to be recognized by Windows Autopilot?

A.The device must have a Microsoft Entra ID Premium P2 license assigned.

B.The device must have its hardware hash uploaded to Microsoft Intune.

C.The device must be Azure AD registered before shipping.

D.The device must be joined to on-premises Active Directory first.

AnswerB

The hardware hash uniquely identifies the device for Autopilot.

Why this answer

The minimum requirement for a device to be recognized by Windows Autopilot is that its hardware hash must be uploaded to Microsoft Intune. This hash uniquely identifies the device and allows Autopilot to associate it with the correct deployment profile during the out-of-box experience. Option A is incorrect because while some Autopilot features may require Microsoft Entra ID Premium P2, it is not a minimum requirement for device recognition.

Option C is incorrect because the device does not need to be Azure AD registered before shipping; registration occurs during the Autopilot process. Option D is incorrect because joining on-premises Active Directory is not required; Autopilot devices are typically Azure AD joined.

Full explanation →

235

MCQmedium

You are designing a Windows Autopilot deployment for a new fleet of devices. The devices will be shipped directly to users from the vendor. You need to ensure that the devices automatically enroll in Microsoft Intune and receive a standard set of applications during the out-of-box experience (OOBE). Which Autopilot deployment profile should you assign?

A.User-Driven mode (Azure AD joined) with user-assigned apps.

B.Pre-provisioning (White Glove) mode with device-assigned apps.

C.Self-Deploying mode (Azure AD registered) with device-assigned apps.

D.Self-Deploying mode (Azure AD joined) with user-assigned apps.

AnswerA

User-Driven mode allows users to sign in and receive user-assigned apps during OOBE.

Why this answer

User-Driven mode with Azure AD joined and user-assigned apps is correct because the devices are shipped directly to users, who will perform the OOBE themselves. This mode requires a user to sign in with Azure AD credentials, which triggers automatic enrollment in Microsoft Intune and applies the assigned user-targeted apps during the enrollment process.

Exam trap

The trap here is confusing Self-Deploying mode with user-assigned apps, but Self-Deploying mode is designed for devices without a user context and only supports device-assigned apps, making it unsuitable for user-driven app delivery.

How to eliminate wrong answers

Option B is wrong because Pre-provisioning (White Glove) mode requires an IT technician to perform the initial setup before shipping, which contradicts the scenario where devices ship directly to users. Option C is wrong because Self-Deploying mode with Azure AD registered does not support full Intune enrollment with user-assigned apps; it is designed for kiosk or shared devices and uses device-assigned apps only. Option D is wrong because Self-Deploying mode with Azure AD joined cannot use user-assigned apps; it is intended for devices without a user context, so apps must be device-assigned.

Full explanation →

236

Drag & Dropmedium

Arrange the steps to troubleshoot a BitLocker recovery key prompt on a Windows 10 device.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order for troubleshooting a BitLocker recovery key prompt is to first identify the cause (e.g., TPM change, PIN reset), then retrieve the recovery key from its stored location (e.g., Azure AD, Microsoft account), enter it to unlock the drive, and finally address the root cause to prevent recurrence. This sequence ensures a logical progression from diagnosis to resolution without unnecessary steps.

Full explanation →

237

Multi-Selecthard

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a set of Line-of-Business (LOB) apps using the Microsoft Intune Management Extension. Which THREE conditions must be met?

Select 3 answers

A.The app must be deployed in user context

B.The Microsoft Intune Management Extension must be installed on the device

C.The device must have connectivity to Microsoft Intune

D.The devices must be co-managed with Microsoft Configuration Manager

E.The device must be Azure AD joined or hybrid Azure AD joined

AnswersB, C, E

The extension is required for Win32 app deployment.

Why this answer

The correct options are B, C, and E. B: The Intune Management Extension must be installed on the device to deploy LOB apps. C: The device must have connectivity to Microsoft Intune for the management extension to communicate.

E: The device must be Azure AD joined or hybrid Azure AD joined to support Intune management. Option A is incorrect because the app is deployed in system context, not user context. Option D is incorrect because co-management with Configuration Manager is not required for deploying LOB apps via Intune Management Extension.

Full explanation →

238

Multi-Selecteasy

Which TWO are benefits of using Windows Autopilot for device provisioning? (Select two.)

Select 2 answers

A.Works offline without internet connectivity.

B.Enables deployment of custom operating system images.

C.Allows IT to provision devices remotely without physical access.

D.Reduces the need for manual imaging and configuration.

E.Eliminates the need for any user interaction during setup.

AnswersC, D

Users can self-deploy from anywhere.

Why this answer

Windows Autopilot leverages cloud-based services to provision new devices, eliminating the need for IT staff to be physically present. Option C is correct because Autopilot allows IT to deploy a device by simply providing the user with the hardware; the device automatically joins Azure AD, enrolls in Intune, and applies policies over the internet. This remote provisioning capability is a core benefit, as it enables zero-touch deployment for remote workers or distributed offices.

Exam trap

The trap here is that candidates often assume Autopilot eliminates all user interaction (Option E) because of the term 'zero-touch,' but in user-driven mode the user must still sign in, while self-deploying mode (for kiosks or shared devices) can be truly zero-touch—the question does not specify the mode, so Option E is too absolute and incorrect.

Full explanation →

239

MCQeasy

You need to deploy a Microsoft 365 Apps for enterprise configuration (e.g., exclude specific apps) to Windows 10 devices via Intune. Which tool should you use to generate the configuration XML?

A.Office Customization Tool (OCT)

B.Group Policy Management Console

C.Microsoft 365 admin center

D.Microsoft Intune admin center

AnswerA

OCT creates the configuration XML for Click-to-Run installations.

Why this answer

The Office Customization Tool (OCT) is the correct tool because it generates the configuration XML file (configuration.xml) that Intune uses to control Microsoft 365 Apps for enterprise deployments, including excluding specific apps like Access or Publisher. Intune's built-in Office deployment integration relies on this XML to define installation settings, and the OCT is the official Microsoft tool designed for this purpose.

Exam trap

The trap here is that candidates confuse the Intune admin center (where you assign the policy) with the tool that creates the configuration file, leading them to pick Option D instead of recognizing that the OCT is the separate, prerequisite tool for XML generation.

How to eliminate wrong answers

Option B is wrong because Group Policy Management Console is used to manage Group Policy Objects (GPOs) for domain-joined devices, not to generate the XML configuration file required by Intune for Office deployment. Option C is wrong because the Microsoft 365 admin center manages licensing, user accounts, and service settings, but it does not generate the deployment XML for Office app exclusions. Option D is wrong because the Microsoft Intune admin center is where you upload and assign the configuration XML, but it does not generate the XML itself; the OCT is the tool that creates the file.

Full explanation →

240

MCQeasy

You need to ensure that all corporate-owned Windows 11 devices automatically install critical security updates as soon as they are released by Microsoft. Which Intune feature should you configure?

A.Expedited quality updates in a Windows 10 update ring.

B.A WSUS policy pushed via Group Policy.

C.Windows 10 update rings with a deferral period of 0 days.

D.Windows Autopatch.

AnswerA

Expedited quality updates force immediate installation.

Why this answer

Expedited quality updates in a Windows 10 update ring allow you to push critical security updates immediately, bypassing any deferral periods or gradual rollout settings. This feature uses the Windows Update for Business service to force the installation of a specific update as soon as it is released by Microsoft, ensuring compliance with security requirements for corporate-owned devices.

Exam trap

The trap here is that candidates confuse a zero-day deferral period with immediate installation, not realizing that update rings still use gradual rollout percentages and device check-in schedules, whereas expedited updates force an immediate, non-deferred installation.

How to eliminate wrong answers

Option B is wrong because WSUS (Windows Server Update Services) is an on-premises solution that requires Group Policy configuration and does not leverage Intune's cloud-based update management; it also introduces latency due to synchronization schedules and approval workflows. Option C is wrong because setting a deferral period of 0 days in a Windows 10 update ring still respects the gradual rollout (e.g., percentage-based rings) and does not guarantee immediate installation; updates are offered based on Microsoft's release cadence and device check-in cycles. Option D is wrong because Windows Autopatch is a service for automating update deployment across multiple update rings and policies, but it does not provide a mechanism to force immediate installation of a specific critical security update; it focuses on maintaining a baseline update cadence, not expedited deployment.

Full explanation →

241

MCQeasy

You need to ensure that only devices that have a specific set of approved iOS apps can access company resources. Which Intune feature should you use?

A.Selective wipe

B.App protection policy

C.Device compliance policy with required apps

D.App configuration policy

AnswerC

Device compliance policy with required apps can verify mandatory apps are present, but it does not block installation of non-approved apps. It is insufficient for the requirement.

Why this answer

Device compliance policy with required apps allows you to specify a list of iOS apps that must be installed for a device to be compliant. By combining this with conditional access, you can block non-compliant devices from accessing corporate resources, ensuring that only devices with the approved apps gain access.

Exam trap

Many candidates confuse this with device restriction profiles that can block the installation of unapproved apps, but compliance policies only check for the presence of apps.

How to eliminate wrong answers

Option A is wrong because selective wipe removes only corporate data from a device, not control which apps can be installed. Option B is wrong because app protection policy (MAM) manages data protection within apps (e.g., copy/paste restrictions) but does not enforce which apps can be installed on the device. Option D is wrong because app configuration policy supplies settings to apps (e.g., server URLs) but does not restrict app installation.

Full explanation →

242

Multi-Selecteasy

Your organization requires that all managed Windows devices have Microsoft Defender Antivirus enabled and running. Which TWO methods can you use to verify this compliance?

Select 2 answers

A.Create an Intune compliance policy for Windows Defender.

B.Check Microsoft Entra ID device settings.

C.Use Microsoft Defender XDR device health reports.

D.Review the Local Group Policy Editor on each device.

E.Run a Configuration Manager hardware inventory.

AnswersA, C

Correct. Compliance policies can check Defender state.

Why this answer

Intune compliance policies include a 'Microsoft Defender for Endpoint' category that allows you to require Defender Antivirus to be enabled and running. When a device reports its Defender status via the Intune Management Extension, the compliance policy evaluates the real-time protection state and marks the device as noncompliant if Defender is off or disabled. Option C is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides device health reports that aggregate antivirus status across all enrolled devices, including whether Defender is active and up to date.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID device settings (which manage device identity and registration) with device compliance monitoring, leading them to incorrectly select Option B as a verification method.

Full explanation →

243

MCQhard

You run the above PowerShell script to change the Windows Autopilot group tag for devices currently tagged as 'Sales' to 'Marketing'. You have assigned different deployment profiles to the 'Sales' and 'Marketing' group tags. After running the script, you check the Autopilot devices in Intune and see that the group tag for the devices has changed. However, the devices still apply the 'Sales' deployment profile during OOBE. What is the most likely reason?

A.The deployment profile is assigned to the device by device ID, not group tag.

B.The deployment profile assignment is based on the group tag at the time of enrollment; existing devices retain the original profile.

C.The script needs to include a step to remove the device from Autopilot and re-import it.

D.The script did not sync the device details to Intune after changing the group tag.

AnswerB

Autopilot profiles are assigned at enrollment, and changing the tag does not reassign profiles for already-enrolled devices.

Why this answer

The group tag is evaluated at the time of enrollment to determine which deployment profile to assign. Changing the group tag on an already-enrolled device does not retroactively change the profile assignment; the device retains the profile that was applied during its original OOBE. This is by design in Windows Autopilot, as the profile is bound to the device record at enrollment.

Exam trap

The trap here is that candidates assume updating the group tag in Intune will immediately change the deployment profile for already-enrolled devices, but Microsoft's Autopilot design evaluates the tag only at enrollment time, not retroactively.

How to eliminate wrong answers

Option A is wrong because deployment profiles are assigned based on group tags or device serial numbers, not device IDs, and the scenario confirms the tag changed but the profile didn't, ruling out a device ID assignment. Option C is wrong because removing and re-importing the device is unnecessary; the group tag change is sufficient for new enrollments, but existing devices are not affected. Option D is wrong because the script likely synced the change (the tag updated in Intune), but syncing does not retroactively reassign the deployment profile to an already-enrolled device.

Full explanation →

244

MCQeasy

You are reviewing a custom device configuration profile in Intune. The exhibit shows an OMA-URI setting. What is the purpose of this setting?

A.Enables the camera on the lock screen

B.Disables the camera on the device entirely

C.Disables the microphone on the lock screen

D.Disables the camera on the lock screen

AnswerD

The OMA-URI prevents the camera from being used on the lock screen.

Why this answer

The OMA-URI setting ./Vendor/MSFT/Policy/Config/DeviceLock/PreventLockScreenCamera is used to disable the camera on the Windows lock screen. This policy prevents users from accessing the camera while the device is locked, enhancing security by mitigating privacy risks such as unauthorized camera use. It does not affect camera functionality once the user logs in.

Exam trap

The trap here is that candidates often confuse 'disable camera on lock screen' with 'disable camera entirely' (Option B), but the OMA-URI explicitly targets the lock screen only, not the full device camera functionality.

How to eliminate wrong answers

Option A is wrong because the setting specifically disables the camera on the lock screen, not enables it; enabling would require a different policy value or OMA-URI path. Option B is wrong because this policy only restricts camera access on the lock screen, not the entire device; to disable the camera entirely, you would use a different policy such as AllowCamera under Device/Experience. Option C is wrong because this OMA-URI targets the camera, not the microphone; disabling the microphone on the lock screen would involve a separate policy like PreventLockScreenMicrophone.

Full explanation →

245

MCQmedium

A company uses Intune to manage macOS devices. They need to deploy a custom configuration profile that enforces FileVault encryption. What is the recommended approach?

A.Create an endpoint security disk encryption policy in Intune and assign it to the devices

B.Use Apple Configurator to create the profile and import it into Intune

C.Ask users to manually enable FileVault

D.Use JAMF Pro to manage FileVault

AnswerA

Intune supports FileVault configuration via endpoint security policies.

Why this answer

The recommended approach is to create an endpoint security disk encryption policy in Intune (option A). Intune provides built-in FileVault settings under endpoint security disk encryption for macOS. Option B (Apple Configurator) is a local configuration tool, not an MDM solution, and cannot be used for remote management.

Option C (manually enabling FileVault) is not scalable for enterprise deployment. Option D (JAMF Pro) is a third-party MDM, not Microsoft Intune.

Full explanation →

246

MCQeasy

You assign a required app to a device group. After the next sync, some devices report a 'Failed' status. What should you check first?

A.The device's last sync time

B.If a newer version is already installed

C.Whether the user is licensed

D.The device management log

AnswerD

Logs contain error details.

Why this answer

The device management log (also known as the Intune management extension log or the MDM agent log on the device) provides detailed, real-time error codes and failure reasons for app installation attempts. When a required app shows 'Failed' status after sync, this log is the first place to check because it captures the exact cause—such as a download failure, dependency issue, or script execution error—that the Intune console cannot surface in summary views.

Exam trap

The trap here is that candidates assume 'Failed' status always points to a licensing or sync timing issue, when in fact the device management log is the definitive source for granular failure details that the Intune console summary cannot provide.

How to eliminate wrong answers

Option A is wrong because the last sync time only tells you when the device last communicated with Intune, not why a specific app installation failed; a recent sync does not guarantee successful app processing. Option B is wrong because checking for a newer version already installed is a troubleshooting step for 'Not Applicable' or 'Already Installed' statuses, not for 'Failed' status—the failure indicates the installation process itself encountered an error. Option C is wrong because licensing is validated at enrollment and sync time; if the user were unlicensed, the app would typically show as 'Not Applicable' or the device would not receive the policy at all, not a 'Failed' installation status.

Full explanation →

247

MCQmedium

You have assigned the above compliance policy to all Windows 10 devices. A user's device shows as noncompliant with a reason of 'TPM not found'. What should you do to resolve the issue?

A.Disable the TPM requirement in the policy.

B.Assign the policy to a different group that excludes those devices.

C.Create a new compliance policy without the TPM requirement and assign it to devices without TPM.

D.Change the password complexity requirement to 'none'.

AnswerC

This allows different requirements for different hardware.

Why this answer

The device lacks TPM hardware, so the compliance policy requirement for TPM cannot be met. The appropriate solution is to create a separate compliance policy without the TPM requirement and assign it to devices that do not have TPM, ensuring those devices can still be compliant without compromising security requirements for TPM-capable devices.

Exam trap

The trap here is that candidates may think disabling the TPM requirement in the existing policy is the simplest fix, but this overlooks the need to maintain security for TPM-capable devices and the best practice of using targeted policies for different hardware capabilities.

How to eliminate wrong answers

Option A is wrong because disabling the TPM requirement in the existing policy would remove the security control for all devices, including those that do have TPM, weakening the overall security posture. Option B is wrong because assigning the policy to a different group that excludes non-TPM devices does not resolve the noncompliance for the existing devices; it only avoids the issue by not applying the policy to them, leaving them without any compliance policy. Option D is wrong because changing the password complexity requirement to 'none' is unrelated to the TPM not found issue; it addresses a different compliance setting and does not fix the missing TPM hardware.

Full explanation →

248

MCQhard

Your organization is deploying Windows Autopilot self-deploying mode for kiosk devices. The devices will be used in a public area and must not require user interaction during the initial setup. What is the prerequisite for this deployment?

A.A user must be assigned to the device in Microsoft Entra ID.

B.The device must have a TPM 2.0 chip.

C.An enrollment profile must be assigned to the user.

D.The device must be added to Microsoft Entra ID manually.

AnswerB

TPM 2.0 is required for hardware attestation in self-deploying mode.

Why this answer

Windows Autopilot self-deploying mode relies on the device's TPM 2.0 chip to cryptographically attest its identity to Microsoft Entra ID without any user interaction. The TPM 2.0 provides hardware-bound keys that enable the device to authenticate itself and automatically enroll, which is essential for kiosk devices in public areas where no user credentials can be supplied during initial setup.

Exam trap

The trap here is that candidates often confuse self-deploying mode with user-driven mode, mistakenly thinking a user assignment or manual Entra ID addition is required, when in fact TPM 2.0 is the critical hardware prerequisite for unattended, zero-touch enrollment.

How to eliminate wrong answers

Option A is wrong because assigning a user to the device in Microsoft Entra ID is not required for self-deploying mode; in fact, self-deploying mode is specifically designed for scenarios where no user interaction is needed, and the device operates without a user context. Option C is wrong because an enrollment profile must be assigned to the device, not to the user; self-deploying mode uses a device-targeted profile that is applied during the out-of-box experience without any user sign-in. Option D is wrong because the device must be added to Microsoft Entra ID automatically via Autopilot registration (using hardware hash upload), not manually; manual addition would defeat the purpose of zero-touch deployment.

Full explanation →

249

Multi-Selectmedium

Which THREE conditions can be used in a Conditional Access policy to require a compliant device?

Select 3 answers

A.Device state

B.Client apps

C.Locations

D.Device platform

E.Sign-in risk

AnswersB, C, D

Can require compliance for browser, mobile apps, desktop clients.

Why this answer

Options B, C, and D are correct. Option B: Client apps condition allows targeting specific applications or user actions. Option C: Locations condition allows requiring compliance based on IP ranges or countries.

Option D: Device platform condition allows targeting specific operating systems. Option A is incorrect because the Device state condition includes options like 'Device hybrid Azure AD joined' and 'Device marked as compliant', but it filters based on current state rather than requiring compliance. To require a compliant device, you use the grant control, not the Device state condition.

Option E is incorrect because sign-in risk is a condition but is not used to require a compliant device; it's used for risk-based policies.

Full explanation →

250

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that some required applications are not being installed on their devices. You confirm the applications are assigned as 'Required' to a device group, and the devices are online. What is the most likely cause?

A.BitLocker encryption is pending

B.The user is not logged in to the device

C.The enrollment status page is blocking installation

D.The Intune Management Extension is missing

AnswerD

The Intune Management Extension is required for processing Win32 app installations; if missing, apps will not install.

Why this answer

The Intune Management Extension is required to process Win32 app installations. If the extension is missing or not running, required apps will not install even though the device is online and assignment is configured. Option A is wrong because BitLocker encryption status does not affect app installation.

Option B is wrong because device-targeted assignments do not require the user to be logged in. Option C is wrong because the enrollment status page does not block required app installations after enrollment is complete.

Full explanation →

251

MCQhard

You are planning a Windows 11 deployment for 1000 devices using Configuration Manager co-management with Intune. You need to ensure that devices automatically enroll to Intune after the Configuration Manager client is installed. Which workload must you configure in Configuration Manager?

A.Endpoint Protection

B.Windows Update policies

C.Resource access

D.Client apps

AnswerD

Correct. Client apps workload includes the policy to automatically enroll devices to Intune when the Configuration Manager client is installed.

Why this answer

The 'Client apps' workload in Configuration Manager co-management is responsible for synchronizing client applications and enabling automatic enrollment of devices to Intune after the Configuration Manager client is installed. Option A (Endpoint Protection) is incorrect because it manages endpoint protection policies, not enrollment. Option B (Windows Update policies) is incorrect because it governs Windows Update for Business policies, not Intune enrollment.

Option C (Resource access) is incorrect because it configures resource access policies like certificates and VPN, not automatic enrollment.

Full explanation →

252

MCQeasy

You need to enroll a Windows 11 device into Microsoft Intune using a work or school account. The device is already joined to Microsoft Entra ID. What is the simplest enrollment method?

A.Windows Autopilot

B.Group Policy to configure enrollment

C.Manual enrollment using the Company Portal

D.Automatic enrollment via Microsoft Entra join

AnswerD

Microsoft Entra joined devices can be automatically enrolled in Intune.

Why this answer

Microsoft Entra joined devices automatically enroll in Intune when configured, making it the simplest method. Option A (Windows Autopilot) is wrong because it requires additional setup and is not the simplest. Option B (Group Policy) is wrong because Group Policy is typically used for on-premises devices and not automatic.

Option C (Manual enrollment via Company Portal) is wrong because it requires user interaction and is not automatic.

Full explanation →

253

MCQhard

You review the compliance policy JSON for Windows 10 devices. A device running Windows 10 version 22H2 (build 22621.0) with a numeric-only password of 10 characters, BitLocker enabled, firewall enabled, and Microsoft Defender running reports as non-compliant. What is the most likely reason?

A.The password type is not alphanumeric.

B.The OS version is outside the allowed range.

C.Storage encryption is not enabled.

D.Microsoft Defender is not enabled.

AnswerA

The policy requires alphanumeric, but the password is numeric-only.

Why this answer

The compliance policy JSON for Windows 10 devices specifies a password type requirement of 'alphanumeric'. The device in question uses a numeric-only password (10 characters), which does not meet the alphanumeric requirement, causing it to be reported as non-compliant. All other conditions—BitLocker enabled, firewall enabled, and Microsoft Defender running—are satisfied, so the password type is the sole issue.

Exam trap

The trap here is that candidates often assume a long numeric password (10 characters) meets complexity requirements, but the policy explicitly requires alphanumeric characters, and the exam tests attention to the specific JSON setting rather than general password strength.

How to eliminate wrong answers

Option B is wrong because the OS version (Windows 10 version 22H2, build 22621.0) is within the allowed range; the compliance policy typically specifies a minimum OS version, and 22H2 is a supported build. Option C is wrong because storage encryption is enabled via BitLocker, which satisfies the encryption requirement. Option D is wrong because Microsoft Defender is explicitly stated as running, so it is enabled and compliant.

Full explanation →

254

MCQhard

You are the endpoint administrator for Contoso Ltd., a global company with 5,000 Windows 11 devices managed by Microsoft Intune. The company has a strict security policy requiring that all devices must have BitLocker Drive Encryption enabled on the operating system drive. Additionally, devices must be compliant with the policy to access corporate resources via Conditional Access. Recently, an audit revealed that 200 devices are non-compliant because BitLocker is not enabled. You investigate and find that these devices are all personal devices enrolled as 'Windows bring your own device' (BYOD). The BitLocker policy is configured as a device configuration profile targeting 'All Devices'. The compliance policy requires 'Storage encryption' to be enabled. You need to resolve the non-compliance for these BYOD devices. What should you do?

A.Assign the BitLocker configuration profile to device groups that include BYOD devices.

B.Upgrade the Windows edition on BYOD devices to Windows Pro or Enterprise.

C.Create a separate compliance policy for BYOD devices that does not require storage encryption.

D.Configure the compliance policy to mark devices as compliant if BitLocker is not enabled but other settings are met.

AnswerB

BitLocker is only available on Pro/Enterprise editions; upgrading enables encryption.

Why this answer

BitLocker Drive Encryption is only available on Windows Pro, Enterprise, or Education editions. BYOD devices often run Windows Home, which does not support BitLocker. Upgrading to Windows Pro or Enterprise enables BitLocker, resolving the non-compliance.

Option A is incorrect because the profile is already assigned to 'All Devices', but it cannot enable BitLocker on unsupported editions. Option C is incorrect as it would bypass the security requirement. Option D is incorrect because compliance policies cannot override device capabilities; they can only require encryption on devices that support it.

Full explanation →

255

MCQeasy

You need to ensure that only authorized users can enroll devices in Microsoft Intune. Which setting should you configure?

A.Enrollment restrictions

B.Device categories

C.Device compliance policies

D.Conditional access policies

AnswerA

Enrollment restrictions can block personal devices or require authorization.

Why this answer

Device enrollment restrictions in Intune allow you to block personal devices or require user approval. Option A is correct because enrollment restrictions can limit who can enroll. Option B is incorrect because device compliance policies apply after enrollment.

Option C is incorrect because conditional access policies control access to resources, not enrollment. Option D is incorrect because device categories are for grouping, not blocking enrollment.

Full explanation →

256

MCQhard

You are configuring Conditional Access for device compliance. You have an Intune compliance policy that requires a minimum OS version. You create a Conditional Access policy that grants access only when devices are marked as compliant. However, some users can still access corporate email from non-compliant devices. What is the most likely reason?

A.The Conditional Access policy is set to 'Block' instead of 'Grant'.

B.The Conditional Access policy applies only to users in a specific group.

C.The compliance policy is not assigned to the users' devices.

D.The Conditional Access policy does not include the email application as a target.

AnswerD

Conditional Access must target specific cloud apps.

Why this answer

A Conditional Access policy must include at least one cloud app as a target. If the corporate email application (e.g., Exchange Online) is not included in the policy, the policy will not apply to access attempts for that app, allowing non-compliant devices to connect. Option A is incorrect because a 'Block' policy would block access, not allow it.

Option B is incorrect because the policy's user scope does not affect whether the app is targeted. Option C is incorrect because while compliance policy assignment is important, the most direct reason is the missing app target.

Full explanation →

257

MCQhard

You have a Windows 11 device that is co-managed with Configuration Manager and Microsoft Intune. After migrating the Windows Update workload to Intune, users report that they can still manually check for updates in Windows Settings and install optional driver and firmware updates that are not signed by Microsoft. You need to prevent users from installing these optional updates. Which setting should you configure in Intune?

A.Set 'Configure Automatic Updates' to '2 - Notify for download and notify for install'.

B.Set 'Defer quality updates' to '30 days'.

C.Set 'Allow non-Microsoft signed updates' to 'Block'.

D.Set 'Specify intranet Microsoft update service location' to point to WSUS.

AnswerC

Set 'Allow non-Microsoft signed updates' to 'Block' prevents installation of non-Microsoft signed optional updates, which are the typical optional updates users can install.

Why this answer

Setting 'Allow non-Microsoft signed updates' to 'Block' directly prevents users from installing the optional driver and firmware updates that are not signed by Microsoft, which are precisely the updates described in the scenario. Option A changes notification behavior, Option B defers quality updates, and Option D redirects to WSUS, none of which block optional updates.

Exam trap

Some may think that blocking non-Microsoft signed updates also blocks all optional updates, but since the scenario specifically targets non-Microsoft signed updates, this setting is appropriate and addresses the requirement.

How to eliminate wrong answers

Option A is wrong because 'Configure Automatic Updates' set to '2 - Notify for download and notify for install' controls the notification behavior for updates but does not prevent users from manually checking for or installing optional updates; it only changes the download and install timing. Option B is wrong because 'Defer quality updates' to '30 days' delays the installation of quality updates but does not block optional updates; it is a deferral policy, not a block. Option D is wrong because 'Specify intranet Microsoft update service location' to point to WSUS is used to redirect update scanning to an internal WSUS server, which is not relevant when the Windows Update workload is managed by Intune and does not prevent optional updates from being installed.

Full explanation →

258

MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that when a device is lost or stolen, the IT admin can remotely lock the device and display a custom message on the lock screen. What should you configure?

A.Enable lost mode on the device via Apple Business Manager.

B.Configure a device compliance policy to wipe the device on non-compliance.

C.Initiate a remote assistance session to lock the device.

D.Use the remote lock action in Intune and provide a custom message.

AnswerD

Remote lock allows locking and displaying a message.

Why this answer

The remote lock action in Microsoft Intune allows IT admins to lock a lost or stolen iOS/iPadOS device and display a custom message on the lock screen. This action uses the Apple MDM protocol to send a lock command with an optional message, ensuring the device is secured and a contact number or instructions are visible. Option D directly fulfills the requirement without relying on third-party services or compliance policies.

Exam trap

The trap here is that candidates confuse Apple Business Manager's enrollment capabilities with Intune's remote management actions, or they assume a compliance policy can be used for immediate lock scenarios, when in fact only the remote lock action supports a custom lock screen message.

How to eliminate wrong answers

Option A is wrong because Apple Business Manager is used for device enrollment and app distribution, not for remote lock actions; lost mode is a feature of Apple's Find My app, not Intune. Option B is wrong because a device compliance policy can trigger a wipe on non-compliance, but it does not provide a custom lock screen message and is not designed for immediate remote lock scenarios. Option C is wrong because remote assistance sessions require user interaction and cannot lock a device or display a custom message without user consent.

Full explanation →

259

MCQmedium

Refer to the exhibit. You run the PowerShell cmdlet shown and get the output. You need to investigate why Laptop-02 is non-compliant. Which additional cmdlet should you run to get the non-compliance reasons?

A.Get-MgDeviceManagementManagedDeviceCompliancePolicyState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

B.Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary -DeviceCompliancePolicyId <id>

C.Get-MgDeviceManagementManagedDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

D.Get-MgDeviceManagementDeviceConfigurationState -ManagedDeviceId 87654321-4321-4321-4321-123456789abc

AnswerA

Correct. This cmdlet retrieves the compliance policy state and reasons for a specific device, allowing you to see why Laptop-02 is non-compliant.

Why this answer

Get-MgDeviceManagementManagedDeviceCompliancePolicyState retrieves the compliance policy state for a specific managed device, including the non-compliance reasons. This cmdlet returns compliance policy state details per device, which allows you to investigate why Laptop-02 is non-compliant. Option B is incorrect because Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary provides a summary of settings across devices, not per-device reasons.

Option C is incorrect because Get-MgDeviceManagementManagedDeviceConfigurationState retrieves device configuration state, not compliance policy state. Option D is incorrect because Get-MgDeviceManagementDeviceConfigurationState retrieves device configuration state, not compliance reasons.

Full explanation →

260

MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy an internal web app as a web clip on users' devices. The app requires users to authenticate with their organization credentials. Which configuration is required to ensure a seamless single sign-on experience?

A.Add the web clip with 'Managed App Configuration' including SSO key

B.Enable 'Use managed browser' in the app assignment

C.Deploy a VPN configuration that forces traffic through the corporate network

D.Configure the web clip with 'Full screen' option enabled

AnswerA

Managed App Configuration allows setting SSO for web clips.

Why this answer

Deploying the web clip with 'Managed App Configuration' including an SSO key allows Intune to inject authentication tokens into the web clip, enabling seamless single sign-on (SSO) without requiring the user to re-enter credentials. This leverages the Microsoft Enterprise SSO plug-in or a custom SSO configuration to automatically authenticate against the internal web app using the user's organization credentials.

Exam trap

The trap here is that candidates confuse network-level controls (like VPN or managed browser) with identity-layer SSO, assuming that forcing traffic through the corporate network or using a managed browser alone will automatically authenticate the user, when in fact SSO requires explicit app configuration to pass authentication tokens.

How to eliminate wrong answers

Option B is wrong because enabling 'Use managed browser' only forces the web clip to open in a managed browser (e.g., Microsoft Edge) but does not by itself provide SSO; it requires additional configuration like the SSO plug-in or app configuration policies to pass authentication tokens. Option C is wrong because deploying a VPN configuration that forces traffic through the corporate network addresses network-level access but does not handle authentication; SSO requires identity-layer token exchange, not just network routing. Option D is wrong because configuring the web clip with 'Full screen' option enabled only changes the display mode (hides Safari UI) and has no impact on authentication or SSO behavior.

Full explanation →

261

MCQhard

A company uses Microsoft Intune to manage Windows 10 devices with a hybrid Azure AD join configuration. Users report that they are unable to access corporate resources on their devices. You verify that the devices are enrolled and that compliance policies are applied. What should you check next?

A.Check the certificate profile assigned to the devices.

B.Verify that the devices can communicate with an on-premises domain controller.

C.Ensure the devices have a VPN connection to the corporate network.

D.Review the conditional access policies for the users.

AnswerB

Hybrid Azure AD join devices need to connect to a domain controller to complete registration.

Why this answer

In a hybrid Azure AD join configuration, devices must be able to communicate with an on-premises domain controller to authenticate and obtain Kerberos tickets for accessing corporate resources. Even if Intune enrollment and compliance policies are applied, a loss of connectivity to the domain controller (e.g., due to network changes or DNS issues) will prevent resource access. This is the most likely cause given that enrollment and compliance are verified as working.

Exam trap

The trap here is that candidates often jump to conditional access or certificate issues because they sound security-related, but the core requirement for hybrid Azure AD joined devices is on-premises domain controller connectivity for authentication.

How to eliminate wrong answers

Option A is wrong because certificate profiles are used for authentication or encryption, but the issue here is about general resource access; if certificates were the problem, you would typically see specific authentication failures rather than a complete inability to access resources. Option C is wrong because a VPN connection is not a prerequisite for hybrid Azure AD joined devices to access corporate resources; they can use DirectAccess or a cloud proxy, and the question does not indicate remote access requirements. Option D is wrong because conditional access policies control access based on conditions like compliance, but since compliance policies are already applied and verified, reviewing conditional access is a later step after confirming network connectivity to the domain controller.

Full explanation →

262

MCQmedium

Contoso uses Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps from the Microsoft Store can be installed on corporate devices. What should you configure?

A.App Protection Policies (APP)

B.Device Compliance policies

C.iOS/iPadOS App Configuration policies

D.Managed App Policies (MAM)

AnswerC

iOS/iPadOS App Configuration policies can include settings to restrict app installation to only approved apps from the Microsoft Store.

Why this answer

To ensure only approved apps from the Microsoft Store can be installed on corporate iOS/iPadOS devices, configure a Device restrictions policy (Device configuration profile) with settings such as blocking the App Store or allowing only managed apps. App Configuration policies cannot restrict app installation; they only supply app-specific settings.

Exam trap

Do not confuse App Configuration policies with Device restrictions. App Configuration policies configure settings within apps; Device restrictions control device-level behaviors such as app installation.

How to eliminate wrong answers

Option A is wrong because App Protection Policies (APP) control data leakage and access within apps (e.g., copy/paste restrictions), not the installation of apps from specific sources. Option B is wrong because Device Compliance policies evaluate device health (e.g., jailbreak detection, OS version) but do not restrict which apps can be installed. Option C is wrong because iOS/iPadOS App Configuration policies deliver settings to apps (e.g., managed bookmarks, server URLs) but do not block installation of unapproved apps.

Full explanation →

263

MCQmedium

You have a hybrid Microsoft Entra ID joined Windows 10 device that is co-managed with Configuration Manager and Intune. You want Intune to manage Windows Update for Business settings. Which slider setting should you configure in Configuration Manager?

A.Move the slider for 'Windows Update policies' to 'Intune'

B.Move the slider for 'Endpoint protection' to 'Intune'

C.Move the slider for 'Resource access' to 'Intune'

D.Move the slider for 'Device configuration' to 'Intune'

AnswerA

This delegates update management to Intune.

Why this answer

In a co-management scenario, workload sliders in Configuration Manager determine which authority manages specific workloads. To have Intune manage Windows Update for Business settings, you must move the slider for 'Windows Update policies' to Intune. This shifts the policy authority from Configuration Manager to Intune, allowing Intune's Update Rings and feature update policies to control Windows Update behavior on the device.

Exam trap

The trap here is that candidates often confuse 'Windows Update policies' with 'Device configuration' or 'Endpoint protection', assuming that update settings fall under a broader configuration or security category, but Microsoft specifically separates update management into its own workload slider.

How to eliminate wrong answers

Option B is wrong because 'Endpoint protection' controls antivirus, firewall, and Defender policies, not Windows Update settings. Option C is wrong because 'Resource access' manages VPN, Wi-Fi, email, and certificate profiles, which are unrelated to update policies. Option D is wrong because 'Device configuration' handles device restriction and configuration profiles, not Windows Update for Business policies.

Full explanation →

264

Multi-Selecteasy

Which TWO methods can you use to enroll a Windows 10 device in Microsoft Intune?

Select 2 answers

A.Navigate to the Intune enrollment URL in a browser.

B.Use the Company Portal website to enroll.

C.Sign in to Settings > Accounts > Access work or school and connect.

D.Join the device to Azure AD during OOBE.

E.Enroll from the Microsoft 365 admin center.

AnswersC, D

This is the manual enrollment method.

Why this answer

Enrolling a Windows 10 device via Settings > Accounts > Access work or school and clicking 'Connect' initiates a device enrollment that registers the device with Azure AD and automatically enrolls it in Intune (if auto-enrollment is configured via GPO or MDM discovery). This method uses the MDM enrollment protocol over the Enrollment REST service, requiring only a work or school account.

Exam trap

The trap here is that candidates confuse the Company Portal website (a web interface for app installation) with the Company Portal app (a native client that can initiate enrollment), leading them to incorrectly select Option B as a valid enrollment method.

Full explanation →

265

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that devices automatically receive the latest feature updates from the Windows 11 servicing channel. You configure a Windows 10 feature update policy targeting the devices. However, after 24 hours, devices still show Windows 10 version 22H2. What is the most likely cause?

A.Windows Update for Business is disabled in group policy.

B.The policy is a Windows 10 feature update policy, but devices need a Windows 11 feature update policy to upgrade to Windows 11.

C.The policy is not assigned to a device group containing the devices.

D.Devices have not been restarted after policy assignment.

AnswerB

Windows 10 feature update policies only apply to Windows 10 devices for feature updates within Windows 10. To upgrade to Windows 11, a Windows 11 feature update policy must be used.

Why this answer

A Windows 10 feature update policy is designed to move devices between Windows 10 feature versions (e.g., 22H2 to 23H2). To upgrade devices from Windows 10 to Windows 11, you must use a Windows 11 feature update policy, which specifically targets the Windows 11 servicing channel. Since the policy targets Windows 10 feature updates, it will not trigger the OS upgrade to Windows 11, leaving devices on Windows 10 22H2.

Exam trap

The trap here is that candidates assume a 'feature update policy' generically applies to any OS upgrade, but Microsoft Intune strictly separates Windows 10 and Windows 11 feature update policies, and using the wrong one will not trigger the OS version upgrade.

How to eliminate wrong answers

Option A is wrong because disabling Windows Update for Business via group policy would block all Windows Updates, not just feature updates, and the question states the policy is configured in Intune, which overrides local GP if properly set. Option C is wrong because the policy is described as targeting the devices, and if it were not assigned to a device group, the devices would not receive the policy at all, but the issue is that the policy type is incorrect for the desired upgrade. Option D is wrong because restarting devices does not change the policy type; a Windows 10 feature update policy will never upgrade to Windows 11 regardless of reboots.

Full explanation →

266

MCQhard

You are the endpoint administrator for Contoso, a company with 10,000 Windows 11 devices managed by Microsoft Intune. The devices are a mix of corporate-owned and bring-your-own-device (BYOD). You need to implement a solution that allows users to access corporate resources only if their devices meet specific security requirements: disk encryption (BitLocker), antivirus (Microsoft Defender), and a minimum OS build. Additionally, you must ensure that users cannot access corporate email from devices that are jailbroken or rooted. The solution should automatically block non-compliant devices from accessing resources and provide a notification to the user explaining the issue. You have already configured compliance policies in Intune. What should you do next to enforce the block?

A.Configure a device enrollment restriction to block non-compliant devices from Azure AD join.

B.Create a device configuration policy that blocks access to corporate resources.

C.Create an app protection policy in Intune to block access to apps.

D.Create a Conditional Access policy in Microsoft Entra ID that requires compliant device for access.

AnswerD

Conditional Access evaluates device compliance and blocks access if not compliant, with user notification.

Why this answer

Conditional Access policies in Microsoft Entra ID can evaluate device compliance status from Intune to grant or block access to corporate resources like Exchange Online. When a device is marked non-compliant (e.g., missing BitLocker, outdated OS, jailbroken/rooted), the Conditional Access policy blocks access and can display a notification. Option A is incorrect because device enrollment restrictions only control whether a device can enroll in Intune or join Azure AD; they do not enforce access after enrollment.

Option B is incorrect because device configuration policies apply settings but do not enforce access control. Option C is incorrect because app protection policies protect data within apps but rely on device compliance for access decisions.

Full explanation →

267

Multi-Selecthard

Which THREE components are required for a successful Windows Autopilot self-deploying mode deployment?

Select 3 answers

A.A local administrator account created on the device.

B.Windows Autopilot device registration using the hardware hash.

C.A Microsoft 365 E3 license assigned to the user.

D.Microsoft Entra ID Premium P1 or P2 license.

E.A Windows Autopilot deployment profile assigned to the device.

AnswersB, D, E

The device must be registered in Autopilot to be recognized.

Why this answer

B is correct because Windows Autopilot self-deploying mode requires the device to be registered with Microsoft using its hardware hash. This registration links the device to an Azure AD tenant and enables the deployment profile to be downloaded automatically during the out-of-box experience, without user interaction.

Exam trap

The trap here is that candidates often assume a user license or local admin account is required, but self-deploying mode is specifically designed for userless scenarios and relies solely on device registration and a Microsoft Entra ID Premium license.

Full explanation →

268

MCQmedium

A company uses Microsoft Intune to manage Windows 10 devices. They deployed a Win32 app as 'required' but some devices show 'pending install'. The app is configured with a detection rule that checks for a registry key. What should you check first?

A.Increase the app installation timeout.

B.Ensure the device has connectivity to Intune.

C.Reassign the app to a different security group.

D.Check if the detection rule is incorrectly marking the app as installed.

AnswerD

A pre-existing registry key can cause Intune to skip installation, resulting in 'pending install'.

Why this answer

The most common reason for a 'pending install' status when a detection rule is configured is that the rule is incorrectly detecting the app as already installed. Intune evaluates the detection rule before attempting installation; if the rule finds the registry key (even if the app is not fully functional), Intune skips the installation and reports 'pending' or 'installed' without actually deploying the app. This is a frequent misconfiguration where the detection rule is too broad or references a key that exists from a previous installation or unrelated software.

Exam trap

The trap here is that candidates often assume 'pending install' means a connectivity or timeout issue, but the real cause is a misconfigured detection rule that falsely reports the app as already installed, preventing the installation from executing.

How to eliminate wrong answers

Option A is wrong because increasing the installation timeout would not resolve a detection rule that incorrectly marks the app as installed; timeout issues typically affect downloads or installations that are genuinely in progress, not a false positive detection. Option B is wrong because if the device lacked connectivity to Intune, the status would likely be 'not applicable' or 'error' rather than 'pending install', and Intune would report a communication failure. Option C is wrong because reassigning the app to a different security group would not fix a detection rule logic error; the issue is with how the app is detected on the device, not with group membership or targeting.

Full explanation →

269

MCQmedium

A user's Android device is not receiving email from the corporate Microsoft 365 tenant. The device is enrolled in Intune and shows as compliant. The email profile is assigned to the user. What should you check first?

A.Verify that the device meets the compliance policy for Android.

B.Confirm that the user has an Exchange Online license.

C.Check the device's last check-in time with Intune.

D.Ensure the device is enrolled in Intune.

AnswerC

The profile may not have been applied yet.

Why this answer

The device is already compliant and enrolled, and the email profile is assigned, so the most likely issue is that the device has not recently checked in with Intune to receive the latest policy or profile. Checking the last check-in time is the first troubleshooting step because Intune relies on periodic device check-ins to push configuration profiles, including email profiles. If the device hasn't checked in recently, it won't have the email profile applied, even if it's compliant and enrolled.

Exam trap

The trap here is that candidates assume compliance or enrollment guarantees policy delivery, but Intune requires a successful device check-in to actually apply profiles, making the last check-in time the critical first check.

How to eliminate wrong answers

Option A is wrong because the device already shows as compliant, so verifying compliance again would be redundant and not address why the email profile hasn't been applied. Option B is wrong because the user's ability to receive email from the corporate tenant is not dependent on an Exchange Online license; the email profile configuration and Intune policy delivery are the immediate technical blockers. Option D is wrong because the device is already enrolled in Intune (as stated in the scenario), so re-checking enrollment is unnecessary and does not explain why the email profile hasn't been delivered.

Full explanation →

270

MCQhard

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a Win32 app that has a complex installation requiring multiple command-line parameters. The app must be available to users in the Company Portal. What is the best way to handle the installation parameters?

A.Deploy a PowerShell script via Intune that runs the installer with parameters.

B.Configure detection rules to run a script that passes parameters.

C.Use the Intune Win32 app packaging to specify the installation command with parameters.

D.Use an administrative template to set parameters before installing.

AnswerC

The .intunewin file includes the command line.

Why this answer

Intune's Win32 app packaging allows you to specify the full installation command, including complex parameters, directly in the 'Install command' field. This method ensures the installer runs with the exact parameters needed, and the app is then published to the Company Portal for user self-service. PowerShell scripts or detection rules do not handle the installation parameters themselves, and administrative templates are for configuring settings, not installation commands.

Exam trap

The trap here is that candidates may think a PowerShell script is needed for complex parameters, but Intune's Win32 app packaging directly supports any command-line string, making the script unnecessary and less efficient.

How to eliminate wrong answers

Option A is wrong because deploying a PowerShell script via Intune that runs the installer with parameters is an indirect workaround; Intune's Win32 app packaging natively supports specifying the installation command with parameters, making a separate script unnecessary and less reliable for detection and reporting. Option B is wrong because detection rules are used to verify if an app is already installed, not to pass installation parameters; they run after the installation command, not during it. Option D is wrong because administrative templates (ADMX-backed policies) are used to configure registry-based settings or policies, not to specify installation command-line parameters for a Win32 app.

Full explanation →

271

MCQmedium

Refer to the exhibit. You have configured a Windows Update for Business policy in Intune. Based on the JSON, what is the effect on devices?

A.Devices will not receive any updates from June 1 to July 15

B.Devices will receive all updates normally until July 15

C.Quality updates are paused from June 1 to June 30, and feature updates are paused from July 1 to July 15

D.The policy is invalid because pause dates cannot overlap

AnswerC

The pause start and expiry dates define the pause periods.

Why this answer

The JSON policy specifies 'qualityUpdatesPauseStartDate': '2023-06-01' and 'qualityUpdatesPauseEndDate': '2023-06-30', meaning quality updates are paused during that period. Similarly, 'featureUpdatesPauseStartDate': '2023-07-01' and 'featureUpdatesPauseEndDate': '2023-07-15' pause feature updates from July 1 to July 15. Option A is incorrect because devices will still receive feature updates before July 1.

Option B is incorrect because quality updates are paused starting June 1. Option D is incorrect because pause dates for different update types can overlap; only pause dates for the same type cannot overlap.

Exam trap

Candidates often misinterpret the pause date fields, thinking that a single pause applies to all updates, or that overlapping dates are invalid. The correct understanding is that quality and feature updates have separate pause configurations.

Full explanation →

272

Multi-Selectmedium

A company uses Microsoft Intune to manage Android Enterprise devices. They have a requirement to deploy a set of apps that are critical for business operations. Which TWO app deployment policies should the administrator configure to ensure the apps are always available and up-to-date?

Select 2 answers

A.Enable 'Auto-update' for the apps in the managed Play Store.

B.Assign the apps as 'Required' to the device group.

C.Configure the app to allow users to update manually.

D.Assign the apps as 'Available for enrolled devices' to the device group.

E.Set the app assignment type to 'Uninstall' for the device group.

AnswersA, B

Auto-update ensures apps stay current.

Why this answer

Enabling 'Auto-update' for apps in the managed Play Store ensures that critical business apps are automatically updated to the latest version without user intervention, maintaining security and functionality. Option B is correct because assigning apps as 'Required' to a device group forces installation on all targeted devices, guaranteeing that the apps are always present for business operations.

Exam trap

The trap here is that candidates often confuse 'Available for enrolled devices' with 'Required', not realizing that only 'Required' forces installation, while 'Available' relies on user action, which fails the 'always available' requirement.

Full explanation →

273

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app that is signed by a developer certificate that is not yet trusted on the devices. What must you do to allow the installation?

A.Deploy the app as a line-of-business app with the 'Allow user to bypass' option enabled.

B.Use a device configuration policy to trust the developer certificate before deploying the app.

C.Instruct users to manually approve the installation in System Preferences.

D.Convert the .pkg to a .dmg and deploy via Microsoft Store for Business.

AnswerB

Trusting the certificate allows the .pkg to run.

Why this answer

MacOS requires that the developer certificate of a .pkg app be trusted at the system level before installation can proceed. By deploying a device configuration policy in Intune that adds the developer certificate to the trusted root store, you establish the necessary trust chain, allowing the .pkg to install without user intervention. This approach aligns with macOS Gatekeeper and security policies, which block unsigned or untrusted packages by default.

Exam trap

The trap here is that candidates assume the 'Allow user to bypass' option (Option A) will let the installation proceed despite the untrusted certificate, but it only controls the user-facing error message and does not override macOS security enforcement.

How to eliminate wrong answers

Option A is wrong because the 'Allow user to bypass' option in Intune for line-of-business apps only suppresses the installation failure prompt; it does not resolve the underlying certificate trust issue, and the app will still fail to install if the certificate is untrusted. Option C is wrong because instructing users to manually approve the installation in System Preferences is not a scalable or reliable management approach, and Intune cannot enforce or automate this manual step across devices. Option D is wrong because converting a .pkg to a .dmg does not address the certificate trust requirement, and Microsoft Store for Business does not support direct deployment of .dmg files to macOS devices; it is intended for Windows and mobile apps.

Full explanation →

274

MCQeasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that corporate data on a device is wiped if the device is reported stolen. Which action should you configure?

A.Full wipe from the Intune console.

B.Selective wipe from the Intune console.

C.Delete the device from Microsoft Entra ID.

D.Retire the device from Intune.

AnswerB

Selective wipe removes corporate data only.

Why this answer

A selective wipe on an Android Enterprise device removes only corporate data (managed apps, work profile, and policies) while preserving the user's personal data. This is the appropriate action when a device is reported stolen, as it ensures corporate data is protected without affecting the user's personal information, which aligns with the organization's data protection requirements.

Exam trap

The trap here is that candidates often confuse 'full wipe' with 'selective wipe' in Android Enterprise, mistakenly thinking a full wipe is required for stolen devices, but Microsoft Intune's selective wipe is the correct and recommended action for corporate data removal while preserving personal data.

How to eliminate wrong answers

Option A is wrong because a full wipe resets the entire device to factory defaults, erasing both corporate and personal data, which is overly aggressive and may not be necessary or desired for a stolen device scenario. Option C is wrong because deleting the device from Microsoft Entra ID only removes the device object from identity management, but it does not trigger any data wipe on the device itself, leaving corporate data accessible. Option D is wrong because retiring a device from Intune removes management and wipes corporate data, but the term 'retire' is synonymous with selective wipe in Intune; however, the question specifically asks for the action to configure, and 'selective wipe' is the precise term used in the Intune console for this operation, while 'retire' is the broader action that includes selective wipe.

Full explanation →

275

Drag & Dropmedium

Order the steps to configure a Windows 10 device for Microsoft 365 Apps deployment via Intune.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Begin in Intune admin center, add a new app, choose Microsoft 365 Apps, configure suite, and assign.

Full explanation →

276

Multi-Selecthard

You are designing a device management strategy for a remote workforce using Windows 10 laptops that are Azure AD joined. You need to ensure that devices can be remotely wiped if lost or stolen, and that BitLocker recovery keys are escrowed to Azure AD. Which THREE configurations should you implement?

Select 3 answers

A.Join devices to on-premises Active Directory.

B.Configure a BitLocker policy in Intune that enables key escrow to Azure AD.

C.Configure a Group Policy to escrow BitLocker keys to Active Directory.

D.Enroll devices in Microsoft Intune.

E.Ensure devices are Azure AD joined.

AnswersB, D, E

Key escrow stores recovery keys in Azure AD.

Why this answer

Intune's BitLocker policy includes a setting to automatically store recovery keys in Azure AD, which is essential for key escrow. This integration ensures that if a device is lost or stolen, administrators can retrieve the recovery key from Azure AD to access encrypted data or perform a remote wipe. Without this policy, BitLocker keys would not be escrowed to Azure AD even if the device is enrolled in Intune.

Exam trap

The trap here is that candidates might think Group Policy (Option C) is sufficient for Azure AD-joined devices, but Group Policy only works with on-premises AD and cannot escrow keys to Azure AD, while Intune's BitLocker policy is the correct cloud-native approach.

Full explanation →

277

MCQmedium

A company manages 500 Windows 10 devices using Microsoft Intune. They plan to upgrade to Windows 11. The IT team wants to ensure that only devices meeting the Windows 11 hardware requirements are allowed to upgrade. They need to block the upgrade on devices that do not meet the requirements, and provide a clear error message to users. What should the IT team configure?

A.Configure a Windows 11 readiness policy in Intune and assign it to all devices.

B.Configure a feature update policy for Windows 10 and Windows 11 in Intune.

C.Create a compliance policy with Windows 11 requirements and assign it to all devices.

D.Use a device configuration profile to set the 'TargetReleaseVersion' policy for Windows 11.

AnswerA

Windows 11 readiness policy blocks upgrade on non-compliant devices and shows a custom message.

Why this answer

A Windows 11 readiness policy in Intune is specifically designed to evaluate device hardware compatibility against Windows 11 requirements and block the upgrade on non-compliant devices while displaying a custom error message to users. This policy uses the Windows Health Monitoring and the TPM 2.0 attestation checks to enforce the hardware requirements before the upgrade can proceed.

Exam trap

The trap here is that candidates often confuse a compliance policy (which only reports non-compliance) with a readiness policy (which actively blocks the upgrade and provides a user-facing error), leading them to select Option C instead of A.

How to eliminate wrong answers

Option B is wrong because a feature update policy for Windows 10 and Windows 11 only controls the deployment of the feature update itself (e.g., which version to install) but does not include hardware readiness checks or the ability to block the upgrade with a custom error message based on hardware requirements. Option C is wrong because a compliance policy with Windows 11 requirements can mark devices as non-compliant but does not block the upgrade process; compliance policies are used for conditional access and device health, not for controlling the upgrade workflow. Option D is wrong because the 'TargetReleaseVersion' policy is a device configuration profile setting that specifies which Windows version to target (e.g., Windows 11) but does not perform hardware readiness checks or provide a user-facing error message when requirements are not met.

Full explanation →

278

MCQhard

You are troubleshooting a Windows 11 device that fails to install a required application from the Company Portal. The app is assigned as required to the device. The device shows as compliant and has a healthy connection. What is the most likely cause?

A.The device is low on storage

B.The app is assigned to users, not devices

C.The app is available but not required

D.The device has offline files enabled

AnswerB

If the app is assigned to users instead of devices, the device may not receive the required installation.

Why this answer

When an application is assigned as required but fails to install on a compliant, connected device, the most likely cause is a mismatch in assignment targeting. In Microsoft Intune, required app assignments can be scoped to either users or devices. If the app is assigned to users but the device is not associated with a licensed user (or the user is not targeted), the device will not receive the installation policy.

The Company Portal checks user-based assignments, and without a targeted user, the required installation does not trigger.

Exam trap

The trap here is that candidates assume a compliant device with a healthy connection will always receive required apps, overlooking the critical difference between user-assigned and device-assigned app policies in Intune.

How to eliminate wrong answers

Option A is wrong because low storage would typically generate a specific error message or status in Intune (e.g., 'not enough disk space') and is not the most likely cause given the device is compliant and healthy. Option C is wrong because the question states the app is assigned as required, not available; if it were available, the user would need to manually install it, which contradicts the 'required' assignment. Option D is wrong because offline files (Client-Side Caching) do not prevent Intune from installing required applications; they affect file synchronization, not policy application.

Full explanation →

279

Multi-Selecteasy

You are configuring Microsoft Intune for a new organization. You need to ensure that users can only enroll corporate-owned devices and are blocked from enrolling personal devices. Which TWO settings should you configure?

Select 2 answers

A.Create a conditional access policy that blocks devices not marked as corporate.

B.Configure enrollment restrictions to set 'Allow personally owned devices' to 'No'.

C.Create a conditional access policy that requires compliant devices.

D.Create a device compliance policy that marks personal devices as non-compliant.

E.Configure enrollment device platform restrictions to block personally owned devices.

AnswersB, E

This directly blocks personal device enrollment.

Why this answer

Setting 'Allow personally owned devices' to 'No' in enrollment restrictions explicitly blocks users from enrolling personal devices while still allowing corporate-owned device enrollment. This setting is enforced at the time of enrollment, preventing personal devices from being added to Intune management entirely.

Exam trap

The trap here is that candidates confuse post-enrollment controls (conditional access, compliance policies) with pre-enrollment controls (enrollment restrictions), leading them to select options that only block access after enrollment rather than preventing enrollment itself.

Full explanation →

280

MCQmedium

A user's device is enrolled in Microsoft Intune and compliant, but they cannot access corporate email via the Outlook mobile app. The app opens and shows 'Cannot connect to server'. Other users with the same device model can access email. What is the most likely cause?

A.The app protection policy is misconfigured.

B.The device model is blocked by a Conditional Access policy.

C.The device is not compliant with the compliance policy.

D.The user is blocked by a Conditional Access policy due to sign-in risk.

AnswerD

Conditional Access can block based on user risk, which would prevent access.

Why this answer

The user's device is compliant and enrolled, yet the Outlook app cannot connect to the server. A Conditional Access policy that blocks access based on sign-in risk (e.g., medium or high risk detected by Azure AD Identity Protection) can target the user directly, even if the device itself is compliant. This explains why other users with the same device model are unaffected—the block is user-specific, not device-specific.

Exam trap

The trap here is that candidates assume a device compliance issue is the root cause because the error is connectivity-related, but the question explicitly states the device is compliant, forcing you to consider user-specific Conditional Access controls like sign-in risk.

How to eliminate wrong answers

Option A is wrong because a misconfigured app protection policy (MAM policy) would typically block data access or show a policy-related error, not a generic 'Cannot connect to server' message, and it would affect all users with that policy applied, not just one user. Option B is wrong because if the device model were blocked by a Conditional Access policy, all users with that model would be affected, not just a single user. Option C is wrong because the question explicitly states the device is compliant, so non-compliance cannot be the cause.

Full explanation →

281

MCQmedium

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom shell script that runs once on each device. What should you configure?

A.A shell script with the 'Run script once per device' option.

B.A device compliance policy with a custom shell script.

C.A custom configuration profile with a script payload.

D.A managed app that includes the script.

AnswerA

Shell scripts in Intune can be set to run once per device.

Why this answer

Microsoft Intune provides a native 'Shell script' policy type for macOS that includes a 'Run script once per device' setting. This ensures the script executes exactly one time on each target device, meeting the requirement without additional configuration or workarounds.

Exam trap

The trap here is that candidates confuse configuration profiles (which set settings) with script execution, or assume compliance policies can run scripts, when Intune separates these functions into distinct policy types for macOS management.

How to eliminate wrong answers

Option B is wrong because device compliance policies evaluate device health and configuration state, not execute scripts; they cannot run custom shell scripts. Option C is wrong because custom configuration profiles use property list (plist) payloads to set settings, not to execute scripts; they lack a script execution engine. Option D is wrong because managed apps are deployed to install or configure applications, not to run arbitrary shell scripts; scripts are not part of the app deployment workflow.

Full explanation →

282

MCQeasy

You are an Intune administrator for a company that has recently deployed Windows 11 devices. Management wants to ensure that all devices are running the latest feature update (Windows 11 23H2) within 60 days of release. You need to configure a Windows Update for Business policy in Intune to achieve this goal. Which settings should you configure?

A.Set the feature update deferral period to 60 days and assign the policy to all devices.

B.Set the feature update deferral period to 60 days and pause updates for 30 days.

C.Set the feature update deadline to 60 days and assign the policy to a device group.

D.Set the feature update deferral period to 0 days and assign to all users.

AnswerA

Deferral of 60 days means the update will be offered within 60 days after release.

Why this answer

Setting the feature update deferral period to 60 days in a Windows Update for Business policy ensures that devices will wait up to 60 days after Microsoft releases a feature update (e.g., Windows 11 23H2) before installing it. This meets the requirement of having all devices running the latest feature update within 60 days of release, as the deferral period defines the maximum delay from the release date. Assigning the policy to all devices ensures blanket coverage across the Windows 11 fleet.

Exam trap

The trap here is that candidates confuse the 'deferral period' (which delays the initial offering of the update) with the 'deadline' (which forces installation after the update is already available), leading them to incorrectly select a deadline-based option when the goal is to control how soon after release the update becomes available to devices.

How to eliminate wrong answers

Option B is wrong because pausing updates for 30 days would block updates entirely for that period, preventing devices from receiving the feature update within the 60-day window; the deferral period and pause are mutually exclusive controls. Option C is wrong because setting a feature update deadline to 60 days does not control the initial availability of the update—it only enforces a forced installation deadline after the update is already offered, which could result in devices not receiving the update until well after 60 days from release. Option D is wrong because setting the deferral period to 0 days would cause devices to install the feature update immediately upon release, which does not align with the goal of ensuring installation within 60 days (it would be too aggressive and could cause disruption), and assigning to all users instead of devices is less effective for device-level update management.

Full explanation →

283

Multi-Selectmedium

Which TWO actions are required to prepare Windows devices for subscription activation? (Select TWO.)

Select 2 answers

A.Ensure the device has a Windows 10/11 Pro or Education license

B.Enter a MAK key

C.Configure a KMS host key

D.Join the device to Microsoft Entra ID or hybrid Microsoft Entra ID

E.Install the Azure AD Connect tool

AnswersA, D

Subscription Activation works only on Pro and Education editions.

Why this answer

Subscription activation requires a qualifying base license of Windows 10/11 Pro or Education. These editions support the subscription activation feature, which upgrades the device to Windows 10/11 Enterprise without requiring a separate product key. Without this base license, the device cannot be upgraded via subscription activation.

Exam trap

The trap here is that candidates often confuse subscription activation with traditional volume activation methods (KMS or MAK) and select options B or C, or mistakenly think Azure AD Connect is required for device join, when in fact only Microsoft Entra ID or hybrid join is needed.

Full explanation →

284

Multi-Selecthard

You are planning the deployment of Windows 11 using Intune. Which TWO components are required to perform an in-place upgrade from Windows 10?

Select 2 answers

A.A Group Policy to enable Windows Update for Business.

B.A valid Windows 11 product key.

C.The Intune Management Extension installed on the device.

D.A Windows 11 feature update profile in Intune.

E.Hardware that meets Windows 11 system requirements.

AnswersD, E

A Windows 11 feature update profile in Intune is required. This profile specifies the target version and deploys the feature update to eligible devices.

Why this answer

To perform an in-place upgrade from Windows 10 to Windows 11 using Intune, you need two core components: a Windows 11 feature update profile in Intune to trigger the upgrade, and hardware that meets Windows 11 system requirements for compatibility. Although the question asks for three components, only two of the listed options are correct. A valid product key is not needed because the digital license carries forward.

The Intune Management Extension is not used for feature updates, and Group Policy for Windows Update for Business is not required when using Intune's built-in update management. The third component is not applicable in this context.

Exam trap

The question states 'which THREE components are required', but only two correct options (D and E) are provided. The trap is that candidates may feel compelled to select three answers, leading them to pick an incorrect option such as A, B, or C. In reality, the question likely expects only two required components; the 'three' may be a typo or misdirection.

Full explanation →

285

MCQmedium

Your organization, Fabrikam, uses Microsoft Intune to manage iOS/iPadOS and Android devices. You need to implement a solution that ensures company email can only be accessed from the Outlook mobile app, and that data from the Outlook app cannot be copied to personal apps. You also need to ensure that when a user leaves the company, the corporate data in Outlook is removed without affecting personal data. You plan to use app protection policies (MAM). The devices are not enrolled in Intune (unmanaged). You configure the app protection policies for Outlook on iOS and Android. However, users report that they can still copy email content to personal apps. What should you check?

A.Ensure that the devices are enrolled in Intune.

B.Check that the device compliance policy is assigned.

C.Verify that the 'Cut, copy, and paste' setting in the app protection policy is set to 'No' or 'Policy managed apps'.

D.Confirm that the Outlook app is a managed app in Intune.

AnswerC

Correct. This setting controls cut, copy, and paste behavior. Setting it to 'No' or 'Policy managed apps' prevents copying data to unmanaged apps.

Why this answer

The 'Cut, copy, and paste' setting in the app protection policy controls data transfer between apps. To prevent copying email content to personal apps, this setting must be set to 'No' or 'Policy managed apps'. Option A is incorrect because device enrollment is not required for MAM policies on unmanaged devices.

Option B is incorrect because device compliance policies are not applicable without enrollment. Option D is incorrect because Outlook is already a managed app; the issue is the policy setting.

Full explanation →

286

MCQhard

You have an Intune-managed Windows 10 device that is not receiving app updates. The app was deployed as a Win32 app with a detection rule. You verify that the device is online and the Intune Management Extension is running. What should you check first?

A.The detection rule is set to 'File exists'.

B.The app is assigned as 'Required' in the assignment.

C.The Intune Management Extension is up to date.

D.The app assignment schedule is configured to update.

AnswerD

The update schedule must be set for the app to receive updates.

Why this answer

The app update frequency is controlled by the app assignment schedule. Option D is correct because Win32 apps in Intune update based on the assignment schedule; if it is not configured to update, the app will not receive updates. Option A is incorrect because detection rules are used for installation detection, not update scheduling.

Option B is incorrect because even if the app is assigned as 'Required', updates only occur if the schedule allows. Option C is incorrect because the Intune Management Extension being up to date does not control update frequency.

Full explanation →

287

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a line-of-business (LOB) app that requires a reboot after installation. Which deployment configuration should you use to ensure the app installs and the device reboots outside of business hours?

A.Available assignment without deadline

B.Available assignment with a deadline and a grace period for reboot

C.Uninstall assignment for all devices

D.Required assignment with a reboot behavior of 'Immediate'

AnswerD

Required assignment ensures automatic installation. Although the reboot behavior is 'Immediate', you can configure device restart policies (like Active Hours) to delay the reboot until outside business hours, meeting the requirement.

Why this answer

A Required assignment ensures the app is forcibly installed on devices. Although the reboot behavior is set to 'Immediate', you can use device configuration policies (such as Active Hours or Windows Update restart policies) to defer the reboot until outside business hours. Option A does not guarantee installation because it is only available.

Option B is invalid because Available assignments do not support deadlines or grace periods. Option C is for uninstalling, not deploying.

Exam trap

Candidates often think that an Available assignment with a deadline can enforce installation, but Available assignments only make apps available in Company Portal; they do not support deadlines or grace periods. To ensure installation and schedule reboot, a Required assignment is necessary. While 'Immediate' reboot seems counterintuitive for scheduling, you can combine it with device restart policies to achieve the desired outcome.

How to eliminate wrong answers

Option A is wrong because an Available assignment without deadline makes the app optional for users to install from Company Portal, and does not enforce installation or reboot timing, so the app may never be installed or rebooted outside business hours. Option C is wrong because an Uninstall assignment removes the app from devices, which is the opposite of deploying it. Option D is wrong because a Required assignment with a reboot behavior of 'Immediate' forces the device to reboot as soon as the app installs, regardless of business hours, causing potential disruption.

Full explanation →

288

MCQmedium

Refer to the exhibit. You run a PowerShell command to check the assignment status of device configuration profiles. The 'BitLocker Policy' shows 'Pending'. What does 'Pending' indicate?

A.The policy is waiting for user approval

B.The policy assignment failed due to a conflict

C.The policy has been successfully applied

D.The policy has been assigned to the device but not yet applied

AnswerD

Pending indicates the policy is queued for application.

Why this answer

In Microsoft Intune, when a device configuration profile shows a status of 'Pending', it means the policy has been successfully assigned to the device in the cloud but has not yet been applied or reported back as compliant. This is a normal transitional state that occurs while the device checks in with the Intune service, downloads the policy, and applies it during the next sync cycle. The 'Pending' status does not indicate failure, conflict, or user approval requirements.

Exam trap

The trap here is that candidates often confuse 'Pending' with a failure or conflict, when in fact it is a normal intermediate state that resolves automatically after the device syncs with Intune.

How to eliminate wrong answers

Option A is wrong because 'Pending' does not require user approval; user approval is only relevant for specific scenarios like enrollment or app installation prompts, not for device configuration profiles. Option B is wrong because a policy conflict would typically result in a 'Conflict' or 'Error' status, not 'Pending'. Option C is wrong because 'Pending' explicitly means the policy has not yet been applied; a successfully applied policy would show a status of 'Succeeded' or 'Compliant'.

Full explanation →

289

MCQhard

A company uses Microsoft Defender for Endpoint to manage endpoint security. They observe that some devices are not reporting vulnerability data to Microsoft Defender XDR. Which component is most likely misconfigured?

A.Microsoft Sentinel workspace

B.Microsoft Defender for Endpoint sensor on the devices

C.Intune MDM authority

D.Microsoft Purview compliance portal

AnswerB

The sensor collects vulnerability data; missing sensor stops reporting.

Why this answer

(Microsoft Defender for Endpoint sensor) is correct. The sensor is the agent installed on devices that collects and reports vulnerability information to Microsoft Defender XDR. If the sensor is misconfigured, missing, or not running, devices will not report vulnerability data.

Option A (Microsoft Sentinel workspace) is a SIEM that ingests security data but is not the source of vulnerability data. Option C (Intune MDM authority) manages device compliance and configuration but does not directly collect vulnerability data. Option D (Microsoft Purview compliance portal) handles data governance and compliance, not vulnerability reporting.

Full explanation →

290

Multi-Selecteasy

You are deploying Microsoft 365 Apps for enterprise using Microsoft Intune. Which TWO methods can you use to assign the application to users?

Select 2 answers

A.Assign to individual users directly.

B.Assign to a distribution group.

C.Assign to a dynamic group using device attributes.

D.Assign to a device group.

E.Assign to a Microsoft Entra ID user group.

AnswersD, E

Device groups allow targeting based on device membership.

Why this answer

Microsoft Intune supports assigning Microsoft 365 Apps for enterprise directly to device groups, which ensures the application is installed on the specified devices regardless of which user signs in. This method is useful for shared or kiosk devices where user-based assignment would not apply. Option E is correct because assigning to a Microsoft Entra ID user group is the standard method for user-based deployment, allowing the apps to be provisioned based on user identity.

Exam trap

The trap here is that candidates often confuse distribution groups with security groups, assuming any group type can be used for Intune assignments, but only security groups (including Microsoft Entra ID groups) are supported for application targeting.

Full explanation →

291

Multi-Selecteasy

Which TWO are valid methods to enroll iOS/iPadOS devices into Microsoft Intune?

Select 2 answers

A.Apple Configurator 2

B.Automated Device Enrollment (ADE)

C.Company Portal enrollment

D.Windows Autopilot

E.Android Zero Touch enrollment

AnswersB, C

Apple's DEP-based enrollment.

Why this answer

Options B and C are correct. Automated Device Enrollment (ADE) is the modern, automated method for enrolling corporate-owned iOS/iPadOS devices, while Company Portal enrollment allows users to enroll their personally owned devices. Option A is incorrect because Apple Configurator 2 is a tool for manually preparing devices, not a primary enrollment method.

Option D is incorrect because Windows Autopilot is for Windows devices, not iOS/iPadOS. Option E is incorrect because Android Zero Touch enrollment is for Android devices.

Full explanation →

292

MCQmedium

You have a Windows 10 device that is managed by Intune and enrolled in Microsoft Defender for Endpoint. The device is reporting a high number of false positive detections from Microsoft Defender Antivirus. You need to configure an exclusion for a specific folder path to reduce false positives. Where should you configure the exclusion?

A.In a device compliance policy

B.In Group Policy

C.In the endpoint protection profile for Microsoft Defender Antivirus in Intune

D.In Microsoft Defender Security Center

AnswerC

Exclusions are set within the antivirus settings of the endpoint protection profile.

Why this answer

In an Intune-managed environment, antivirus exclusions for Microsoft Defender Antivirus are configured within the endpoint protection profile, specifically under the Microsoft Defender Antivirus settings. This profile is assigned to devices via Intune policies, allowing centralized management of exclusions without requiring on-premises Group Policy or direct interaction with the Microsoft Defender Security Center portal.

Exam trap

The trap here is that candidates often confuse the Microsoft Defender Security Center (a cloud-based security analytics portal) with the Intune endpoint protection profile, mistakenly thinking exclusions are configured in the security center rather than in the device management policy.

How to eliminate wrong answers

Option A is wrong because device compliance policies are used to enforce security requirements (e.g., encryption, OS version) and do not contain settings for antivirus exclusions. Option B is wrong because Group Policy is a traditional on-premises management tool; while it can configure Defender exclusions, it is not applicable when the device is solely managed by Intune and not domain-joined or using Group Policy. Option D is wrong because Microsoft Defender Security Center (now part of Microsoft 365 Defender) is a security operations portal for threat investigation and response, not a configuration interface for local antivirus exclusions on individual devices.

Full explanation →

293

Multi-Selecteasy

You are configuring Microsoft Intune for Windows 10 devices. Which two settings can you enforce using a device restrictions profile? (Select TWO.)

Select 2 answers

A.Disable the camera

B.Set default web browser

C.Set battery saver threshold

D.Configure Windows Update for Business settings

E.Require a password for device unlock

AnswersA, E

Device restrictions include hardware disabling.

Why this answer

A is correct because the device restrictions profile in Microsoft Intune includes a 'Camera' setting under the 'General' category, which allows you to disable the camera on Windows 10 devices by setting it to 'Block'. This enforces a policy that prevents camera access across all apps and the OS, leveraging the CSP (Policy CSP) `Camera/AllowCamera`.

Exam trap

The trap here is that candidates often confuse device restrictions profiles with other policy types, such as Administrative Templates or Windows Update for Business profiles, leading them to select settings like default browser or Windows Update configuration that belong to different policy categories.

Full explanation →

294

Multi-Selecteasy

Your organization plans to use Windows Autopilot to provision new devices. Which TWO methods can you use to obtain the hardware hash for a new device?

Select 2 answers

A.Request the hardware hash from the device manufacturer (OEM)

B.Extract the hardware hash from the device BIOS

C.Run a PowerShell script on a device that is already running Windows 10 or later

D.Use Microsoft Intune to generate the hardware hash from the device serial number

E.Use Windows Configuration Designer to create a provisioning package that captures the hardware hash

AnswersA, C

OEMs can provide the hardware hash.

Why this answer

OEMs can provide the hardware hash for devices they manufacture, which can be uploaded to Microsoft Intune or the Autopilot deployment service. This method is commonly used for new devices ordered directly from the manufacturer, as the hash is generated during the manufacturing process and included in the device's packaging or accessible via the OEM's portal.

Exam trap

The trap here is that candidates often assume the hardware hash can be extracted from BIOS or generated by Intune from a serial number, but the hash requires a running Windows OS to compute and must be collected via PowerShell or provided by the OEM.

Full explanation →

295

MCQhard

You are troubleshooting an Intune-managed iOS device that cannot install a VPP (Volume Purchase Program) app. The device shows a 'License Not Found' error. The app is assigned as 'Available' without device enrollment. What is the most likely cause?

A.The app is configured to remove when the device leaves management.

B.The Apple VPP token has expired.

C.The device is not compliant with conditional access policies.

D.The device is enrolled without user affinity (device enrollment).

AnswerD

VPP apps need user affinity to assign licenses.

Why this answer

The 'License Not Found' error occurs because VPP app licenses are tied to a user principal name (UPN). When a device is enrolled without user affinity (device enrollment), there is no associated user to which the VPP license can be assigned. Since the app is assigned as 'Available' (requiring user-based licensing), the device cannot retrieve a license, resulting in the error.

Exam trap

The trap here is that candidates confuse device enrollment without user affinity with device-based VPP licensing, not realizing that 'Available' assignments always require a user context to redeem a license.

How to eliminate wrong answers

Option A is wrong because the 'remove when device leaves management' setting controls app removal upon unenrollment, not license retrieval during installation. Option B is wrong because an expired VPP token would prevent synchronization of app licenses entirely, not cause a per-device 'License Not Found' error; the token expiration would typically show a different error in the console. Option C is wrong because conditional access policies control access to resources like email or SharePoint, not the installation of VPP apps; non-compliance would block access, not cause a license error during app installation.

Full explanation →

296

Multi-Selecthard

Which THREE are required for a successful Microsoft Intune enrollment of a Windows device?

Select 3 answers

A.A device compliance policy assigned to the device

B.MDM enrollment enabled in Microsoft Entra ID

C.Azure AD Premium P1 license

D.A valid Microsoft Intune license assigned to the user

E.Internet connectivity to Microsoft Intune service

AnswersB, D, E

Must be enabled to allow enrollment.

Why this answer

Microsoft Intune requires MDM enrollment to be enabled in Microsoft Entra ID (formerly Azure AD) to allow devices to register and communicate with the Intune service. Without this setting, the device cannot complete the enrollment process, as Entra ID acts as the identity provider and enrollment authority for Intune-managed devices.

Exam trap

The trap here is that candidates often confuse post-enrollment requirements (like compliance policies or Azure AD Premium P1) with prerequisites for enrollment, leading them to select options that are only needed after the device is already enrolled.

Full explanation →

297

MCQeasy

You need to deploy Microsoft 365 Apps to Windows devices using Microsoft Intune. The deployment must be available to users in the company portal. Which app type should you select?

A.Windows 10/11 (Microsoft 365 Apps)

B.Microsoft 365 (Web link)

C.Microsoft Store app (new)

D.Windows app (Win32)

AnswerA

This app type is specifically for Office deployment.

Why this answer

The 'Windows 10/11 (Microsoft 365 Apps)' app type in Intune is specifically designed to deploy Microsoft 365 Apps (formerly Office 365 ProPlus) with built-in support for the Office Deployment Tool (ODT) and XML configuration. This app type automatically handles the installation, updates, and licensing via the Microsoft 365 Apps for enterprise channel, and it appears in the Company Portal for user-initiated installation. Other app types lack the native integration for Microsoft 365 Apps deployment or do not support user-visible installation in the Company Portal.

Exam trap

The trap here is that candidates often choose 'Windows app (Win32)' because they think any desktop app must be deployed as a Win32 app, overlooking the dedicated Microsoft 365 Apps app type that provides built-in ODT integration and automatic update management.

How to eliminate wrong answers

Option B (Microsoft 365 (Web link)) is wrong because it only creates a shortcut to a web URL in the Company Portal, not an actual app installation, so it cannot deploy Microsoft 365 Apps locally. Option C (Microsoft Store app (new)) is wrong because it is used for deploying apps from the Microsoft Store, not for deploying Microsoft 365 Apps via the Office Deployment Tool. Option D (Windows app (Win32)) is wrong because while it can deploy any Win32 app, it requires manual packaging of the Office installation files and does not provide the built-in ODT integration, update management, or automatic licensing that the dedicated Microsoft 365 Apps app type offers.

Full explanation →

298

Drag & Dropmedium

Arrange the steps to perform a Windows 10 feature update using Windows Update for Business in Intune.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for performing a Windows 10 feature update using Windows Update for Business in Intune starts with creating a deployment ring, then configuring the feature update version and rollout settings, followed by assigning the ring to the target devices or groups, and finally monitoring the update deployment to track success and issues. This order ensures that the ring is properly configured before being applied, and that monitoring captures the actual deployment activity.

Full explanation →

299

MCQhard

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data is protected when users access Microsoft 365 apps. Which policy should you configure?

A.Use a Mobile App Configuration policy to enforce app settings.

B.Deploy an Intune App Protection Policy (APP) for Microsoft 365 apps.

C.Create a Device Compliance policy for iOS devices.

D.Configure a Conditional Access policy to require compliant devices.

AnswerB

APP protects corporate data in apps, such as preventing copy-paste or requiring PIN.

Why this answer

Intune App Protection Policies (APP) protect corporate data at the app level for Microsoft 365 apps, without requiring device enrollment or management. Option A is incorrect because Mobile App Configuration policies enforce app settings but do not protect data. Option C is incorrect because Device Compliance policies ensure devices meet compliance criteria but do not protect data within apps.

Option D is incorrect because Conditional Access policies control access based on conditions but do not directly protect data within apps.

Full explanation →

300

MCQmedium

You manage Windows 10 devices with Intune. You need to collect diagnostic logs from a remote device that is experiencing application crashes. Which Intune feature should you use?

A.Collect diagnostics

B.Company Portal app

C.Autopilot Reset

D.Windows Update for Business

AnswerA

This remote action collects logs without user intervention.

Why this answer

The 'Collect diagnostics' feature in Intune allows you to remotely gather diagnostic logs from Windows 10 devices without user interaction. This is the correct tool for troubleshooting application crashes because it collects system logs, event logs, and crash dumps directly from the device via the Intune management channel, enabling analysis of the failure.

Exam trap

The trap here is that candidates may confuse 'Collect diagnostics' with the Company Portal's ability to view device status or sync policies, but the Company Portal cannot initiate log collection; only the Intune admin console's 'Collect diagnostics' action can remotely gather crash logs.

How to eliminate wrong answers

Option B is wrong because the Company Portal app is a self-service portal for users to install applications, access corporate resources, and enroll devices, not a tool for collecting diagnostic logs. Option C is wrong because Autopilot Reset is used to reset a device to a business-ready state, removing user data and apps, which would destroy the crash logs needed for diagnosis. Option D is wrong because Windows Update for Business manages update policies and deployment rings, not diagnostic log collection; it focuses on keeping devices patched, not troubleshooting application crashes.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 226–300