Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 451–525 | Page 7/13

451

MCQeasy

Your organization uses Microsoft Intune to manage devices. You need to ensure that all Windows 11 devices automatically install critical and security updates from Windows Update. Which policy should you configure?

A.Configure a device configuration profile with 'Windows Update for Business' settings.

B.Deploy a feature update policy to install the latest quality updates.

C.Create an update ring for Windows 10 and later, and set the 'Automatic update behavior' to 'Auto install and reboot' and assign it to all devices.

D.Create a device compliance policy that requires devices to have the latest updates.

AnswerC

Update rings centrally manage Windows Update settings and enforce installation.

Why this answer

Update rings are the primary policy in Microsoft Intune for controlling how and when Windows 10 and later devices receive updates from Windows Update. Setting 'Automatic update behavior' to 'Auto install and reboot' ensures that critical and security updates are automatically downloaded and installed without user intervention, meeting the requirement for all Windows 11 devices.

Exam trap

The trap here is that candidates confuse device configuration profiles (which are for settings like BitLocker or Wi-Fi) with update rings, or they mistakenly think compliance policies can enforce update installation, when in fact only update rings control the automatic update behavior.

How to eliminate wrong answers

Option A is wrong because a device configuration profile with 'Windows Update for Business' settings is a legacy approach that has been deprecated in favor of update rings; it does not provide the granular control over update installation behavior required for automatic installation of critical and security updates. Option B is wrong because a feature update policy is used to move devices to a specific Windows version (e.g., from Windows 10 to Windows 11) or to defer feature updates, not to control the installation of critical and security quality updates. Option D is wrong because a device compliance policy can only report on whether devices have the latest updates installed and can trigger conditional access actions, but it cannot enforce the automatic installation of updates; it is a reporting and remediation tool, not an update deployment mechanism.

Full explanation →

452

Multi-Selectmedium

Which TWO actions can you perform using the Microsoft Intune admin center to manage Windows 11 devices remotely? (Choose two.)

Select 2 answers

A.Collect diagnostics

B.Deploy a line-of-business app

C.Restart the device

D.Create a VPN profile

E.Assign a compliance policy

AnswersA, C

Remote diagnostics collection is a remote action.

Why this answer

Collecting diagnostics is a remote action available in the Microsoft Intune admin center under the 'Devices' blade. It allows administrators to gather detailed logs (e.g., MDM diagnostic logs, event logs, and registry keys) from a Windows 11 device without user interaction, which is critical for troubleshooting issues remotely.

Exam trap

The trap here is that candidates confuse policy-based actions (like deploying apps or assigning compliance policies) with immediate remote actions, which are specifically listed under the 'Device actions' menu in the Intune admin center.

Full explanation →

453

MCQmedium

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that corporate data in managed apps is encrypted at rest. Which setting should you configure?

A.Device compliance policy – Require data encryption.

B.App protection policy – Data protection – Encrypt app data.

C.Enrollment restrictions – Require encrypted backup.

D.Device configuration profile – Encryption settings.

AnswerB

Encrypts app data at rest.

Why this answer

App Protection Policies (APP) in Microsoft Intune include a 'Data Protection' setting called 'Encrypt app data' that enforces encryption of corporate data at rest on iOS/iPadOS devices. This setting uses hardware-backed file-level encryption (Data Protection class) to protect data in managed apps, ensuring that even if the device is lost or stolen, the data remains inaccessible without the user's passcode.

Exam trap

The trap here is that candidates often confuse device-level encryption (which is always on for iOS with a passcode) with app-level encryption, and incorrectly choose a Device Compliance Policy or Configuration Profile, not realizing that only App Protection Policies can enforce encryption specifically for corporate data within managed apps.

How to eliminate wrong answers

Option A is wrong because Device Compliance Policies can require device-level encryption (e.g., FileVault on macOS or BitLocker on Windows), but on iOS/iPadOS, encryption is always enabled by default when a passcode is set; compliance policies cannot granularly encrypt data within managed apps at rest. Option C is wrong because Enrollment Restrictions control which devices can enroll and whether backups are encrypted, but they do not encrypt corporate data within apps on the device itself. Option D is wrong because Device Configuration Profiles can enforce passcode policies or VPN settings, but they do not include a specific setting to encrypt app data at rest; that capability is exclusive to App Protection Policies.

Full explanation →

454

MCQmedium

You need to deploy a line-of-business (LOB) iOS app to users in your organization. The app is signed with an enterprise certificate. How should you distribute the app to managed devices?

A.Upload the app to Intune and provide a signing certificate.

B.Publish the app to the Apple App Store and assign it as a required app.

C.Add the app as an iOS/iPadOS line-of-business app in Microsoft Intune and assign it to users.

D.Use Apple Business Manager to assign the app to devices.

AnswerC

This is the correct method for enterprise-signed LOB apps.

Why this answer

Microsoft Intune supports deploying enterprise-signed LOB apps directly as iOS/iPadOS line-of-business apps. This method allows administrators to upload the .ipa file to Intune and assign it to managed devices without requiring the Apple App Store or Apple Business Manager, as long as the devices are enrolled in MDM and the enterprise certificate is trusted on the devices.

Exam trap

The trap here is that candidates confuse Apple Business Manager (which handles App Store and custom B2B apps) with Intune's LOB app deployment, mistakenly thinking ABM can distribute enterprise-signed apps, when in fact ABM requires apps to be purchased or assigned through Apple's Volume Purchase Program (VPP) and does not support direct upload of enterprise-signed .ipa files.

How to eliminate wrong answers

Option A is wrong because Intune does not require or accept a signing certificate during upload; the app must already be signed with an enterprise certificate before uploading, and Intune simply distributes the signed package. Option B is wrong because publishing an enterprise-signed LOB app to the Apple App Store is not possible—enterprise certificates are intended for internal distribution only, and the App Store requires a different Apple Developer Program membership and review process. Option D is wrong because Apple Business Manager (ABM) is used for volume purchasing and assignment of apps from the App Store or custom B2B apps, not for distributing enterprise-signed LOB apps; ABM requires apps to be associated with a specific Apple Developer account and does not support direct upload of enterprise-signed .ipa files.

Full explanation →

455

MCQeasy

A user's iOS device is enrolled in Microsoft Intune. The user reports that they cannot install the Company Portal app from the App Store. What is the most likely reason?

A.The user does not have an Apple ID.

B.The App Store is disabled by a device restriction policy.

C.The device is not enrolled in Intune.

D.The device is not supervised.

AnswerB

A device restriction policy can block the App Store.

Why this answer

A device restriction policy in Microsoft Intune can block access to the App Store on iOS devices. When the App Store is disabled via a configuration profile, users cannot install or update any apps from the App Store, including the Company Portal app. This is a common policy setting used by organizations to control app installation sources.

Exam trap

The trap here is that candidates often assume the Company Portal app must be pre-installed or that device supervision is required for app installation, but Intune can deploy the Company Portal to unsupervised devices, and the issue is specifically a policy blocking the App Store.

How to eliminate wrong answers

Option A is wrong because an Apple ID is required to download apps from the App Store, but the absence of an Apple ID would prevent any app installation, not specifically the Company Portal app, and Intune enrollment does not require an Apple ID. Option C is wrong because the user's device is already enrolled in Intune as stated in the question, so lack of enrollment cannot be the reason. Option D is wrong because device supervision is not a prerequisite for installing the Company Portal app; supervised mode is primarily used for advanced management capabilities like device configuration and restrictions, but the Company Portal can be installed on both supervised and unsupervised devices.

Full explanation →

456

MCQeasy

You need to deploy a custom Microsoft Edge extension to managed Windows 10 devices via Intune. Which policy type should you use?

A.Device restrictions profile

B.Compliance policy

C.Administrative Templates profile (ADMX-backed policies)

D.PowerShell script deployment

AnswerC

Supports Edge extension policies.

Why this answer

Deploying a custom Microsoft Edge extension via Intune requires configuring the 'Install Extensions Silently' policy, which is an ADMX-backed policy available through the Administrative Templates profile. This policy type allows you to manage Edge-specific settings using the built-in ADMX files that Intune imports from the Edge administrative templates, enabling silent installation of extensions by specifying their update URL or extension ID.

Exam trap

The trap here is that candidates often confuse 'Device restrictions' with 'Administrative Templates' because both appear under the 'Configuration profiles' blade, but Device restrictions lack the granular, application-specific policies (like Edge extensions) that only ADMX-backed profiles can deliver.

How to eliminate wrong answers

Option A is wrong because Device restrictions profiles in Intune control device-level settings like password policies, camera, and Bluetooth, but they do not include settings for managing browser extensions. Option B is wrong because Compliance policies evaluate device compliance against rules (e.g., OS version, encryption) and cannot deploy or configure software extensions. Option D is wrong because PowerShell script deployment can run arbitrary scripts but cannot directly enforce Edge extension policies; it would require complex workarounds and lacks the native, managed policy enforcement that ADMX-backed profiles provide.

Full explanation →

457

MCQeasy

A company uses Microsoft Intune to manage iOS devices. They want to ensure that only devices with a passcode of at least 6 characters and without jailbreak can access corporate email. Which policy type should they configure?

A.Conditional Access policy

B.App protection policy

C.Device compliance policy

D.Device configuration policy

AnswerC

Compliance policies define required device configurations like passcode and jailbreak status.

Why this answer

Device compliance policies in Microsoft Intune evaluate device-level security settings such as jailbreak status and passcode length. By configuring a compliance policy that requires a passcode of at least 6 characters and detects jailbroken devices, Intune can mark non-compliant devices and, when combined with Conditional Access, block access to corporate email. This is the correct policy type because it directly assesses the device's security posture rather than app-level or configuration settings.

Exam trap

The trap here is that candidates confuse 'Conditional Access' (the gatekeeper) with the policy that defines the conditions (Device Compliance), leading them to select Option A because they think the policy that 'ensures only devices with... can access' is the access control policy itself, rather than the compliance policy that provides the evaluation signal.

How to eliminate wrong answers

Option A is wrong because Conditional Access policies are access-control rules that rely on signals from compliance policies or other sources; they do not themselves define or enforce device-level requirements like passcode length or jailbreak detection. Option B is wrong because App protection policies (MAM) manage data protection at the app level (e.g., PIN for opening an app, data encryption) and do not evaluate device-level attributes such as jailbreak status or system passcode length. Option D is wrong because Device configuration policies push settings (e.g., Wi-Fi, VPN, email profiles) to devices but do not enforce compliance checks or block access based on security state; they are not designed for conditional access enforcement.

Full explanation →

458

MCQmedium

You manage Windows 10 devices enrolled in Microsoft Intune. Users report that the Windows Update for Business policy is not applying to some devices. You verify the devices are assigned the correct update ring. What should you check first?

A.Increase the sync frequency for the devices.

B.Check if the devices are compliant with device compliance policies.

C.Ensure the Windows Update service is not disabled on the devices.

D.Verify the Intune Management Extension is installed.

AnswerC

The Windows Update for Business policy requires the Windows Update service to be enabled. If disabled, updates won't apply, making this the first thing to check.

Why this answer

The Windows Update for Business policy requires the Windows Update service to be enabled. If the service is disabled, updates cannot be applied regardless of update ring assignment. Option A is incorrect: increasing sync frequency may speed up policy delivery but does not prevent the policy from applying; the issue is likely a service issue, not sync timing.

Option B is incorrect: device compliance policies are separate from update rings; non-compliant devices can still receive update policies. Option D is incorrect: the Intune Management Extension is used for Win32 app deployment, not for Windows Update policy; update rings rely on the Windows Update service directly.

Full explanation →

459

MCQmedium

You manage devices at Fabrikam Inc. using Microsoft Intune. You have a Windows 11 device that is not compliant because it is missing a required application. The device shows as 'Not evaluated' in Intune for the compliance policy. The user reports that the device syncs manually but still shows as non-compliant. You have verified that the device is enrolled and policy is assigned. What should you do first to resolve the issue?

A.Verify that the user has a valid Microsoft 365 license.

B.Create a new compliance policy with the same requirements and assign it to the device.

C.From the Intune console, select the device and run the 'Sync' action with the option 'Re-evaluate compliance policies'.

D.Remove the device from Intune and re-enroll it.

AnswerC

Triggers a fresh compliance evaluation.

Why this answer

Re-evaluating the compliance policy by running a sync with the Intune management extension can trigger a fresh assessment. Creating a new compliance policy is unnecessary. Removing and re-enrolling is disruptive.

Checking the user's license is not relevant to compliance evaluation.

Full explanation →

460

MCQmedium

Your organization uses Microsoft Intune for Windows device management. Users report that after a recent update, the company VPN client fails to start. You suspect a driver conflict. Which Intune feature should you use to roll back the problematic driver without affecting other updates?

A.Windows Update Rings

B.Group Policy Administrative Templates

C.Microsoft 365 Apps Admin Center

D.Windows Driver Update Rings

AnswerD

Windows Driver Update Rings is the correct feature; it allows you to manage and roll back driver updates independently.

Why this answer

Windows Driver Update Rings (D) is the correct feature. This Intune policy type allows you to manage driver updates separately from quality updates. You can decline a problematic driver update that has already been installed, which will trigger the device to uninstall it and revert to the previous driver version.

This provides granular rollback without affecting other updates. Option A (Windows Update Rings) manages all Windows updates but does not directly support rolling back a driver that is already installed. Option B (Group Policy Administrative Templates) is for device configuration, not driver rollback.

Option C (Microsoft 365 Apps Admin Center) manages Office apps. Option D is the appropriate tool for this scenario.

Exam trap

Many candidates mistakenly believe that Windows Update Rings is the only place to manage driver updates. However, Intune provides a dedicated Windows Driver Update Rings policy that offers more granular control, including the ability to roll back specific driver updates.

How to eliminate wrong answers

Option A is wrong because Windows Update Rings control the deployment of all Windows updates (quality, feature, and driver updates) as a group, and cannot selectively roll back a single driver without reverting other updates. Option B is wrong because Group Policy Administrative Templates manage configuration settings via registry-based policies, not driver versions or rollbacks. Option C is wrong because the Microsoft 365 Apps Admin Center is used to manage Office 365 app updates and policies, not Windows drivers or device-level driver rollbacks.

Full explanation →

461

MCQmedium

Your organization plans to deploy Windows 11 to 500 devices using Microsoft Intune. You need to ensure that each device receives the correct language pack and regional settings based on the user's location. Which configuration method should you use?

A.Configure Windows Autopilot with enrollment profile specifying language and region

B.Deploy a PowerShell script via Intune to set language after enrollment

C.Use Configuration Manager task sequence with language packs

D.Create a provisioning package (PPKG) with language settings and apply via USB

AnswerA

Allows per-device language and region during OOBE, cloud-native.

Why this answer

Windows Autopilot with an enrollment profile allows you to specify language and region settings that are applied during the out-of-box experience (OOBE). This ensures each device receives the correct configuration based on the user's location without requiring post-enrollment scripts or manual intervention, making it the most efficient and scalable method for 500 devices managed by Intune.

Exam trap

The trap here is that candidates often assume post-enrollment scripts or provisioning packages are more flexible, but the exam tests the understanding that Autopilot's OOBE settings are the intended method for applying language and region during initial provisioning in a cloud-native Intune deployment.

How to eliminate wrong answers

Option B is wrong because deploying a PowerShell script via Intune to set language after enrollment introduces a delay and potential failure point, as language packs must already be present on the device; it also violates the principle of applying settings during OOBE for a seamless user experience. Option C is wrong because Configuration Manager task sequences are designed for on-premises, co-managed environments and are not the primary method for cloud-only Intune-managed devices; they also require additional infrastructure and are less efficient for a pure Intune deployment. Option D is wrong because creating a provisioning package (PPKG) with language settings and applying via USB is a manual, device-by-device process that does not scale to 500 devices and bypasses the automated, user-driven provisioning that Autopilot provides.

Full explanation →

462

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent software update, the Start menu layout is missing. You need to restore the Start menu layout using Intune. What should you do?

A.Create a configuration profile for Windows 10 using 'Start layout' under Administrative Templates.

B.Create a configuration profile for Windows 11 using 'Start layout' setting.

C.Create a configuration profile for Windows 10 using 'Start layout' setting under Device restrictions.

D.Create a configuration profile using Administrative Templates and configure 'Start layout' policy.

AnswerC

This is the correct setting for Windows 10.

Why this answer

The Start layout for Windows 10 devices managed by Intune is configured under Device restrictions, not Administrative Templates. The 'Start layout' setting in Device restrictions allows you to upload an XML file that defines the Start menu layout, which can be applied to restore the missing layout after a software update.

Exam trap

The trap here is that candidates confuse Administrative Templates (which host ADMX-backed policies) with Device restrictions (which host mobile device management-specific settings like Start layout), leading them to choose options A or D instead of C.

How to eliminate wrong answers

Option A is wrong because Administrative Templates in Intune are used for Group Policy-like settings (e.g., registry-based policies) and do not include a 'Start layout' option; the Start layout is a device restriction, not an administrative template. Option B is wrong because the question specifies Windows 10 devices, not Windows 11, and the Start layout setting for Windows 11 is also under Device restrictions, but the option incorrectly targets Windows 11. Option D is wrong because Administrative Templates do not contain a 'Start layout' policy; the correct path is under Device restrictions for Windows 10.

Full explanation →

463

Multi-Selectmedium

Which TWO are prerequisites for deploying Win32 apps via Microsoft Intune?

Select 2 answers

A.The Intune management extension must be installed on devices

B.The app must be signed with a Microsoft certificate

C.Devices must be Microsoft Entra ID joined or hybrid joined

D.Devices must have at least 4 GB of RAM

E.Devices must be enrolled with user affinity

AnswersA, C

The extension handles Win32 app deployment.

Why this answer

The Intune management extension is the client-side component that handles Win32 app detection, download, and installation on Windows devices. Without this extension, Intune cannot process the PowerShell scripts or .intunewin files required for Win32 app deployment.

Exam trap

The trap here is that candidates often confuse the requirement for the Intune management extension with the need for user affinity, but the extension works in device context and does not require a signed-in user.

Full explanation →

464

MCQmedium

Refer to the exhibit. You deploy this ARM template to create an Intune configuration policy for macOS devices. The policy sets the 'com.apple.ManagedClient.appstore' setting to true. What is the expected behavior on the target macOS devices?

A.Users will be allowed to install apps from the App Store.

B.App Store updates will be automatically installed.

C.Only apps purchased through Apple Business Manager will be installable.

D.Users will be blocked from installing apps from the App Store.

AnswerA

Setting enables App Store access.

Why this answer

Setting 'com.apple.ManagedClient.appstore' to true in an Intune macOS configuration policy explicitly allows users to install apps from the App Store. This key controls the 'allow app store app installation' restriction; when true, the restriction is disabled, meaning users can install apps from the App Store. The policy does not affect automatic updates or restrict installation to only Apple Business Manager purchases.

Exam trap

Microsoft often tests the misconception that a single boolean key controls multiple App Store behaviors (like updates or ABM restrictions), when in fact each behavior has its own distinct key in the macOS Restrictions payload.

How to eliminate wrong answers

Option B is wrong because automatic App Store updates are controlled by a separate key, 'com.apple.ManagedClient.appstore.automaticDownload', not by the 'appstore' key. Option C is wrong because restricting installation to only Apple Business Manager purchases requires the 'com.apple.ManagedClient.restrictAppStore' key or a device enrollment type that blocks the App Store entirely, not setting 'appstore' to true. Option D is wrong because setting 'com.apple.ManagedClient.appstore' to true allows installation, not blocks it; blocking would require setting this key to false.

Full explanation →

465

MCQhard

Your organization uses Microsoft Intune to manage devices. You have a Windows 10 device that is Azure AD joined and enrolled in Intune. The device is compliant, but the user cannot access corporate resources due to a Conditional Access policy requiring a compliant device. The user can access other cloud apps that do not require compliance. You check the Conditional Access policy and find it is configured correctly. What is the most likely issue?

A.The Conditional Access policy is not applied to the user.

B.The device's certificate is expired or missing; re-register the device in Intune.

C.The device is not enrolled in Intune.

D.The user is not in the correct group.

AnswerB

Re-registration refreshes the certificate used for Conditional Access.

Why this answer

Even though the device is compliant, the certificate used for authentication may be expired or missing, causing Conditional Access to block access. Re-registering the device in Intune refreshes the certificates and resolves the issue. Option A is incorrect because the policy is configured correctly and applies.

Option C is incorrect because the device is enrolled in Intune. Option D is incorrect because the user is likely in the correct group as they can access other apps.

Full explanation →

466

MCQhard

Refer to the exhibit. The exhibit shows a JSON representation of a managed device from Microsoft Graph API. The device shows as noncompliant. Which of the following is the most likely reason for the noncompliant status?

A.The device has not synced recently; the compliance policy may require a more recent check-in.

B.The device is company-owned, which is noncompliant by default.

C.The device is a userless device and cannot be compliant.

D.The device's operating system version is not supported.

AnswerA

Compliance policies often require devices to sync within a certain period; the last sync is March 15, which may be older than the policy threshold.

Why this answer

The JSON shows the device's lastSyncDateTime is significantly older than the current time, and the complianceState is 'noncompliant'. Microsoft Intune compliance policies require devices to check in within a configurable grace period (default 30 days for noncompliant devices, but policies can enforce a shorter interval). If the device hasn't synced recently, it fails the 'Device check-in frequency' compliance rule, marking it noncompliant.

Option A correctly identifies this as the most likely cause.

Exam trap

The trap here is that candidates often assume noncompliance is due to an unsupported OS version or ownership type, but the JSON explicitly shows a supported OS and no ownership-based policy, while the stale lastSyncDateTime is the clear indicator of a check-in failure.

How to eliminate wrong answers

Option B is wrong because company-owned devices are not noncompliant by default; ownership type (corporate vs. personal) does not directly affect compliance state unless a specific compliance policy targets ownership. Option C is wrong because userless devices (e.g., kiosk or shared devices) can be compliant if they meet all policy requirements; Intune supports device compliance for userless scenarios via device enrollment. Option D is wrong because the JSON shows the operating system version as '10.0.22621' (Windows 11 22H2), which is a supported version; there is no indication of an unsupported OS.

Full explanation →

467

MCQeasy

Your organization plans to use Windows Autopilot for device provisioning. You need to ensure devices are automatically registered in Microsoft Entra ID when they are powered on for the first time. Which prerequisite must be met?

A.Devices must be pre-registered in Intune via an OEM or partner

B.Devices must have a TPM 2.0 chip for self-deploying mode

C.An on-premises Active Directory domain must be available

D.Users must have Microsoft Entra ID P1 or P2 licenses assigned

AnswerD

Entra ID P1 or P2 is required for Autopilot's automatic registration and device management.

Why this answer

Microsoft Entra ID P1 or P2 licenses are required because Windows Autopilot relies on Microsoft Entra ID features such as dynamic device groups, conditional access policies, and automatic enrollment policies, which are only available with these license tiers. Without these licenses, devices cannot be automatically registered in Microsoft Entra ID during the first power-on, as the Autopilot profile assignment and device registration process depend on these premium capabilities.

Exam trap

The trap here is that candidates often confuse the hardware prerequisites (like TPM 2.0) with licensing requirements, or assume that on-premises Active Directory is still needed for device registration, when in fact Microsoft Entra ID P1/P2 licensing is the critical prerequisite for automatic registration in a cloud-native Autopilot deployment.

How to eliminate wrong answers

Option A is wrong because pre-registering devices in Intune via an OEM or partner is a method to import device hashes for Autopilot, but it is not a prerequisite for automatic registration in Microsoft Entra ID; devices can also be registered manually or via CSV upload. Option B is wrong because a TPM 2.0 chip is required specifically for self-deploying mode (which uses Windows Hello for Business and automatic MDM enrollment), but the question does not specify self-deploying mode, and other Autopilot modes (user-driven) do not mandate TPM 2.0. Option C is wrong because an on-premises Active Directory domain is not required for Windows Autopilot; Autopilot is designed for cloud-native device provisioning using Microsoft Entra ID, and hybrid Azure AD join is optional and not a prerequisite for automatic registration.

Full explanation →

468

MCQmedium

Your organization is rolling out Windows 11 devices using Autopilot. You need to ensure that all new devices are automatically enrolled in Microsoft Intune and configured with a custom device name prefix 'CORP-'. Which configuration should you implement?

A.Configure a Windows Autopilot deployment profile with a device name template and set 'Convert all targeted devices to Autopilot' to 'Yes'.

B.Create a device configuration profile for Windows 11 with a custom OMA-URI for device name.

C.Set a device compliance policy that requires device name prefix 'CORP-'.

D.Modify the Enrollment Status Page (ESP) policy to require device naming.

AnswerA

This directly configures enrollment and naming.

Why this answer

A Windows Autopilot deployment profile allows you to specify a device name template (e.g., 'CORP-%RAND:5%') that automatically applies a custom prefix to new devices during the Autopilot enrollment process. Setting 'Convert all targeted devices to Autopilot' to 'Yes' ensures that devices added to Autopilot are automatically enrolled in Microsoft Intune, meeting both requirements.

Exam trap

The trap here is that candidates often confuse device configuration profiles (OMA-URI) or compliance policies as capable of setting device names, when in fact only the Autopilot deployment profile's device name template can enforce naming during the initial enrollment process.

How to eliminate wrong answers

Option B is wrong because a device configuration profile with a custom OMA-URI cannot rename a device during Autopilot enrollment; device naming is only supported via the Autopilot deployment profile's device name template. Option C is wrong because a device compliance policy can only report or block non-compliant devices based on naming, not enforce or apply a name prefix during enrollment. Option D is wrong because the Enrollment Status Page (ESP) policy controls the blocking of device setup until required apps or policies are installed, but it has no capability to set or enforce a device name prefix.

Full explanation →

469

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app to these devices. What is the recommended method?

A.Add as a Windows line-of-business app.

B.Add as a macOS web app.

C.Add as a Microsoft Store app.

D.Add as a macOS line-of-business app.

AnswerD

macOS LOB app type supports .pkg files.

Why this answer

The recommended method to deploy a .pkg app to macOS devices managed by Microsoft Intune is to add it as a macOS line-of-business (LOB) app. This app type is specifically designed for deploying macOS installer packages (.pkg) and requires the file to be uploaded directly to Intune, which then pushes the installation to enrolled devices using the Intune management agent for macOS.

Exam trap

The trap here is that candidates may confuse 'line-of-business app' with Windows-only deployment, or mistakenly think a 'web app' can install a native .pkg, but the correct answer is the macOS-specific LOB app type.

How to eliminate wrong answers

Option A is wrong because 'Windows line-of-business app' is intended for Windows app deployment (e.g., .msi or .exe files) and cannot be used to deploy .pkg files to macOS devices. Option B is wrong because 'macOS web app' is used to create a shortcut to a web application (URL) on the device, not to install a native .pkg package. Option C is wrong because 'Microsoft Store app' is for deploying apps from the Microsoft Store, which does not support .pkg files and is not applicable to macOS devices.

Full explanation →

470

MCQeasy

You need to ensure that all iOS devices enrolled in Intune automatically install required apps (e.g., Microsoft Outlook, Teams) during enrollment. Which enrollment profile setting should you configure?

A.Apple Volume Purchase Program token

B.Company Portal branding

C.Device type restriction

D.Install required apps during enrollment

AnswerD

This setting pushes required apps during the enrollment process.

Why this answer

The 'Install required apps during enrollment' setting in an iOS enrollment profile directs Intune to push mandatory apps (like Outlook and Teams) to the device as part of the Automated Device Enrollment (ADE) process. This leverages the Device Enrollment Program (DEP) workflow to install apps before the user gains full access, ensuring compliance with corporate policies from the outset.

Exam trap

The trap here is that candidates often confuse the 'Install required apps during enrollment' setting with the VPP token (Option A), mistakenly thinking the token itself triggers app installation, when in fact the token only provides licensing and the enrollment profile setting controls the installation timing.

How to eliminate wrong answers

Option A is wrong because the Apple Volume Purchase Program (VPP) token is used to license and distribute apps purchased in volume, not to control whether apps are installed during enrollment; it enables app assignment but does not enforce installation timing. Option B is wrong because Company Portal branding customizes the look and feel of the Company Portal app (e.g., logo, color scheme) and has no impact on app installation behavior during enrollment. Option C is wrong because device type restrictions define which platforms or models are allowed to enroll (e.g., block Android, allow iOS), not the installation of apps during the enrollment process.

Full explanation →

471

MCQmedium

Your organization is planning to deploy Windows 11 to 5000 devices using Microsoft Intune. The devices are currently a mix of Windows 10 and Windows 11 eligible hardware. You need to ensure that only devices meeting the Windows 11 hardware requirements can be upgraded. What is the most efficient way to achieve this using Intune?

A.Use Windows Autopilot to reset each device and manually verify hardware compatibility.

B.Create a Windows feature update profile targeting Windows 11 and assign it to all devices; Intune will automatically skip ineligible devices.

C.Create a dynamic device group based on TPM version and assign a Windows 10 update ring to non-compliant devices.

D.Create a compliance policy requiring TPM 2.0 and Secure Boot, then assign a Windows 11 update ring to compliant devices.

AnswerB

Intune checks hardware requirements before applying the feature update.

Why this answer

A Windows feature update profile in Intune automatically checks device hardware eligibility before applying the Windows 11 upgrade. Intune queries the Windows Update for Business service, which evaluates TPM 2.0, Secure Boot, CPU generation, and RAM requirements; devices that do not meet the minimum hardware requirements are skipped without any manual intervention or additional configuration.

Exam trap

The trap here is that candidates confuse compliance policies (which only report or block access) with feature update profiles (which natively enforce hardware gating), leading them to choose Option D, which would still attempt the upgrade on non-compliant devices and cause deployment failures.

How to eliminate wrong answers

Option A is wrong because Windows Autopilot is designed for device provisioning and resetting, not for hardware compatibility verification; manually checking 5000 devices is inefficient and defeats the purpose of automated management. Option C is wrong because creating a dynamic device group based solely on TPM version is insufficient—Windows 11 requires a combination of TPM 2.0, Secure Boot, CPU, and RAM checks, and assigning a Windows 10 update ring to non-compliant devices does not prevent upgrades on ineligible hardware. Option D is wrong because a compliance policy can report non-compliance but does not block the upgrade; a Windows 11 update ring would still attempt to upgrade non-compliant devices, potentially causing failures, whereas a feature update profile inherently skips ineligible devices.

Full explanation →

472

MCQhard

Your organization plans to deploy a Win32 app to Windows 10 devices using Intune. The app requires the .NET Framework 4.8, which is not present on all devices. How should you handle this dependency?

A.Include the .NET installer in the same package

B.Use a PowerShell script to install .NET before the app

C.Add a dependency in Intune for the .NET Framework

D.Configure a detection rule for .NET

AnswerC

Dependencies ensure prerequisites are installed first.

Why this answer

Intune's dependency feature allows you to specify another app (like .NET Framework 4.8) that must be installed before the Win32 app. Intune automatically installs the dependency app from the same Intune management extension context, ensuring the required runtime is present without manual scripting or bundling. This is the native, supported method for handling prerequisites in Win32 app deployment.

Exam trap

The trap here is that candidates confuse detection rules (which only check for existing software) with dependency management (which actually installs prerequisites), leading them to incorrectly choose Option D or attempt manual scripting in Option B.

How to eliminate wrong answers

Option A is wrong because including the .NET installer in the same package violates the principle of separation of concerns and can cause detection logic conflicts; Intune treats the package as a single app, so you cannot independently detect or manage .NET separately. Option B is wrong because using a PowerShell script to install .NET before the app is an unsupported workaround that bypasses Intune's dependency management, leading to unreliable detection and potential installation failures if the script fails. Option D is wrong because a detection rule only verifies whether the app is already installed; it does not trigger installation of the missing dependency, so .NET would remain absent and the app would fail to install.

Full explanation →

473

MCQmedium

You are deploying Windows 11 devices using Autopilot. The devices are purchased from a hardware vendor and need to be registered in your tenant. You want to ensure that the vendor can register the devices on your behalf without granting them full user privileges. What should you configure?

A.Export the device list from the vendor and import it via CSV in Microsoft Intune.

B.Add the vendor as a global administrator in Microsoft Entra ID.

C.Provide the vendor with a bulk enrollment token and URL.

D.Create a custom device preparation profile with delegated admin privileges.

AnswerC

Providing a bulk enrollment token (Autopilot registration token) and URL is the correct method. It allows the vendor to upload device hardware hashes to your tenant with scoped permissions, without granting them any user accounts or broader access.

Why this answer

Providing the vendor with a bulk enrollment token (also known as an Autopilot registration token) and the associated URL allows the vendor to register devices in your tenant via Autopilot without granting full user privileges. This token is specifically designed for OEMs or resellers to upload device hashes and associate them with your tenant, scoping their permissions to only that action. Option D is incorrect because a 'custom device preparation profile with delegated admin privileges' is not a standard or recognized method for Autopilot device registration by vendors; the correct approach is to use an Autopilot registration token or delegate via Microsoft Partner Center.

Exam trap

The trap here is that candidates may think the vendor needs global administrator rights (Option B) or that importing a CSV via Intune (Option A) is sufficient. However, the correct method is to provide the vendor with a bulk enrollment token (Autopilot registration token) which allows device registration without granting broader permissions.

How to eliminate wrong answers

Option A is wrong because exporting a device list from the vendor and importing it via CSV in Microsoft Intune requires the vendor to have direct access to your tenant or you to manually handle the import, which does not delegate the registration process to the vendor securely. Option B is wrong because adding the vendor as a global administrator in Microsoft Entra ID grants them full administrative access to your entire tenant, which violates the principle of least privilege and is unnecessary for device registration. Option C is wrong because a bulk enrollment token and URL are used for Windows Autopilot self-deploying mode or user-driven mode enrollment, but they do not delegate the ability to register devices on your behalf; the token is for enrolling devices, not for registering them in the Autopilot service.

Full explanation →

474

MCQmedium

Your organization manages Windows 10 and 11 devices using Microsoft Intune. Users report that after a recent update, the Microsoft Store for Business app 'Company Portal' fails to launch. You verify that the app is assigned as required to all devices. What should you do first to resolve the issue?

A.Enable automatic updates for Company Portal in Intune.

B.Uninstall and reinstall Company Portal from all devices.

C.Trigger a device sync from the Microsoft Intune admin center.

D.Run Windows Update troubleshooter on affected devices.

AnswerC

Forces the device to check in and receive the latest app assignment and configuration.

Why this answer

The correct first step is to trigger a device sync from the Microsoft Intune admin center. This forces the affected devices to check in with Intune, which can push down any pending policy or app configuration updates that may have been missed after the recent Windows update. Since the Company Portal app is assigned as required, a sync ensures the device receives the latest app version or remediation actions without requiring a full reinstall.

Exam trap

The trap here is that candidates may jump to a destructive or configuration-based solution (like reinstalling or enabling auto-updates) instead of recognizing that a simple device sync is the least invasive and most appropriate first troubleshooting step for an app that fails to launch after an update.

How to eliminate wrong answers

Option A is wrong because enabling automatic updates for Company Portal in Intune is a configuration setting that applies to future updates, not a troubleshooting step to fix an app that already fails to launch. Option B is wrong because uninstalling and reinstalling Company Portal from all devices is a drastic, time-consuming measure that should only be attempted after simpler troubleshooting steps like a sync have failed. Option D is wrong because the Windows Update troubleshooter addresses Windows update issues, not problems with a specific Microsoft Store for Business app like Company Portal.

Full explanation →

475

Multi-Selecthard

Which THREE features are available in Microsoft Intune for managing Windows 10/11 device updates?

Select 3 answers

A.Windows Update for Business

B.Update rings for Windows 10 and later

C.Windows feature update policy

D.Windows Autopatch

E.Windows Server Update Services (WSUS)

AnswersB, C, D

Update rings manage deferral periods.

Why this answer

Update rings for Windows 10 and later (option B) are a core Intune feature that allows administrators to configure Windows Update for Business settings, such as deferral periods, pause windows, and update deadlines, and then assign these policies to groups of devices. This enables controlled rollout and compliance management of quality and feature updates directly from the cloud without requiring on-premises infrastructure.

Exam trap

The trap here is that candidates often confuse Windows Update for Business (a policy framework) with a specific Intune feature, or mistakenly think WSUS is a cloud-based update management option within Intune, when in fact Intune relies solely on Windows Update for Business policies delivered via update rings and feature update policies.

Full explanation →

476

MCQeasy

You need to deploy a line-of-business (LOB) app to Windows 10 devices managed by Intune. The app is a .msi file. Which app type should you select when adding the app in Intune?

A.Microsoft Store app

B.Web link

C.Windows app (Win32)

D.Windows line-of-business app

AnswerD

Windows LOB app type supports .msi files.

Why this answer

The correct app type for deploying a line-of-business (LOB) .msi file to Windows 10 devices managed by Intune is 'Windows line-of-business app'. This app type is specifically designed for sideloading enterprise LOB apps that are not distributed through the Microsoft Store, and it supports .msi and .appx file formats. It uses Intune's built-in LOB deployment channel, which handles the app package directly without requiring the Win32 app preparation tool or complex detection rules.

Exam trap

The trap here is that candidates often choose 'Windows app (Win32)' because they know it supports .msi files, but they overlook that the 'Windows line-of-business app' is the simpler, purpose-built option for LOB .msi deployments without needing the IntuneWin32App wrapper.

How to eliminate wrong answers

Option A is wrong because 'Microsoft Store app' is used for apps sourced from the Microsoft Store, not for sideloading a custom .msi file. Option B is wrong because 'Web link' creates a shortcut to a URL in the Company Portal, not an actual app installation. Option C is wrong because 'Windows app (Win32)' is intended for .exe or .msi files that require complex installation logic, custom detection rules, or dependencies; while it can technically deploy an .msi, it requires wrapping the file with the IntuneWin32App tool and is overkill for a simple LOB .msi, whereas the LOB app type is the direct and correct choice for a straightforward .msi deployment.

Full explanation →

477

MCQmedium

A user's Android device is enrolled in Microsoft Intune. The device reports as 'Compliant' but the user cannot access corporate resources that require compliant devices. The conditional access policy is configured to require a compliant device. What is the most likely cause?

A.The compliance policy has not been refreshed on the device.

B.The user does not have the Company Portal app installed.

C.The conditional access policy requires an approved client app.

D.The device is not compliant with the compliance policy.

AnswerC

Correct. Even with a compliant device, the conditional access policy may require an approved client app, and if the user is using a non-approved app, access will be denied.

Why this answer

Even if the device reports as compliant, the conditional access policy may have additional requirements, such as requiring an approved client app (option C). Option C is correct because the policy might require both a compliant device and an approved client app. Option A is incorrect because the compliance policy not being refreshed would typically cause the device to show as non-compliant, not compliant.

Option B is incorrect because the Company Portal app is not required for access; it's used for enrollment and management. Option D is incorrect because the device is reported as compliant, so non-compliance is not the issue.

Full explanation →

478

MCQeasy

A company uses Microsoft Intune to manage iOS/iPadOS devices. They need to enforce a policy that requires users to set a device passcode of at least 6 characters. Which type of policy should they create?

A.Device configuration profile

B.Device compliance policy

C.Conditional access policy

D.App protection policy

AnswerB

Device compliance policies enforce device-level settings such as passcode requirements.

Why this answer

A device compliance policy in Microsoft Intune evaluates whether iOS/iPadOS devices meet specific security requirements, such as a minimum passcode length of 6 characters. When a device is noncompliant, Intune can trigger actions like blocking access to corporate resources or sending a notification to the user. This is the correct policy type because passcode enforcement for device-level security is a compliance condition, not a configuration or app-level setting.

Exam trap

The trap here is that candidates confuse a Device configuration profile (which can also set a passcode policy) with a Compliance policy, but the question specifically asks for a policy that *enforces* a requirement by evaluating and acting on noncompliance, not just applying a setting.

How to eliminate wrong answers

Option A is wrong because a Device configuration profile is used to configure device settings (e.g., Wi-Fi, VPN, restrictions) but does not evaluate or enforce compliance; it simply applies settings without a compliance check. Option C is wrong because a Conditional access policy in Azure AD controls access to cloud apps based on signals like device compliance, but it does not itself define the passcode requirement; it relies on a compliance policy to provide that condition. Option D is wrong because an App protection policy (MAM) manages data protection within apps (e.g., PIN for app access, data encryption) and does not enforce a device-level passcode; it applies to apps regardless of device management.

Full explanation →

479

MCQmedium

Refer to the exhibit. You apply this Intune custom OMA-URI policy to a Windows 10 device. What is the expected outcome?

A.VPN connections are allowed over cellular networks.

B.The policy will fail to apply due to an invalid OMA-URI.

C.The policy applies only to users, not devices.

D.VPN connections over cellular are blocked.

AnswerD

Correct. Value '0' disables (blocks) VPN over cellular.

Why this answer

The OMA-URI ./Device/Vendor/MSFT/Policy/Config/Connectivity/AllowCellularData refers to the policy that controls whether cellular data is allowed for VPN connections. When set to 0, it blocks VPN connections over cellular networks, enforcing that VPN traffic must use Wi-Fi or Ethernet. This is a device-level policy, not user-specific, and the OMA-URI is valid for Windows 10 devices managed by Intune.

Exam trap

The trap here is that candidates may confuse the OMA-URI path as invalid or think it applies only to users, when in fact the ./Device/ prefix explicitly targets the device scope, and the policy is a valid Windows 10 CSP setting.

How to eliminate wrong answers

Option A is wrong because setting the value to 0 blocks VPN over cellular, not allows it; a value of 1 would allow it. Option B is wrong because the OMA-URI is a valid and supported policy path for Windows 10 device configuration in Intune, so it will apply successfully. Option C is wrong because this policy is configured under the device-level node (./Device/Vendor/MSFT/...), meaning it applies to the device regardless of which user is signed in, not only to users.

Full explanation →

480

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. Users report that after a recent update, their devices are stuck at the login screen and cannot access corporate resources. You suspect a configuration conflict. Which action should you take first to restore device functionality without affecting other settings?

A.Create a new device configuration profile that overrides the conflicting settings.

B.Use the Test and remediate feature to apply a temporary configuration to a subset of devices.

C.Reset the devices remotely using Intune.

D.Perform a selective wipe on the affected devices.

AnswerB

This approach allows you to test and resolve configuration conflicts without affecting all devices, preserving existing settings and enabling a controlled rollback.

Why this answer

The correct first action is to use the 'Test and remediate' feature in Intune, which allows you to apply a temporary configuration to a test group of devices to identify and resolve conflicts without affecting the broader device population. This approach isolates the issue, preserves existing settings, and provides a controlled rollback if needed, aligning with best practices for troubleshooting configuration conflicts in Intune-managed Windows devices.

Exam trap

The trap here is that candidates often choose 'Reset devices remotely' or 'Selective wipe' as a quick fix, not realizing that these are destructive actions that should be reserved for security breaches or device retirement, not for resolving configuration conflicts that can be isolated and tested.

How to eliminate wrong answers

Option A is wrong because creating a new device configuration profile that overrides conflicting settings can introduce additional conflicts or unintended changes, and it does not provide a controlled, reversible test before broad deployment. Option C is wrong because resetting devices remotely using Intune is a drastic measure that erases all data and settings, which is not appropriate for a configuration conflict that can be resolved with a targeted test. Option D is wrong because performing a selective wipe removes corporate data but leaves personal data intact; however, it does not address the underlying configuration conflict and may still leave devices in a non-functional state regarding login.

Full explanation →

481

MCQhard

Your organization uses Microsoft Defender for Endpoint (now Microsoft Defender XDR) and Microsoft Intune. You need to ensure that devices that are deemed 'at risk' by Microsoft Defender for Endpoint are automatically blocked from accessing corporate resources. What should you configure?

A.An app protection policy in Intune that blocks access based on device risk.

B.A compliance policy that marks devices as noncompliant based on Defender for Endpoint risk, and a conditional access policy that blocks noncompliant devices.

C.A conditional access policy that requires device to be compliant, and a compliance policy that uses the Defender for Endpoint device risk level.

D.A device configuration policy that disables network access for at-risk devices.

AnswerB

Correct. This combination allows you to evaluate device risk via Defender for Endpoint in a compliance policy, then use Conditional Access to block noncompliant devices.

Why this answer

To block devices at risk by Microsoft Defender for Endpoint from accessing corporate resources, you need to configure a compliance policy that evaluates the device risk level from Defender for Endpoint (using the 'Require the device to be at or under the Device Threat Level' setting) and marks devices as noncompliant if they exceed the threshold. Then, configure a Conditional Access policy that targets all cloud apps and uses the 'Grant' control to 'Require device to be marked as compliant', which will block noncompliant devices. This combination is exactly described in Option B.

Option A is incorrect because an app protection policy controls access at the app level, not device level. Option C is incorrect because although it describes a similar setup, it does not explicitly state that the conditional access policy blocks noncompliant devices, and the order of configuration is reversed; the standard approach is option B. Option D is incorrect because a device configuration policy does not enforce access control; it configures device settings.

Full explanation →

482

MCQmedium

Refer to the exhibit. You deploy this AppLocker policy via Microsoft Intune to Windows 10 devices. The policy is in AuditOnly mode. Users are now able to run unsigned executables. You need to block unsigned executables without affecting signed ones. What should you do?

A.Add a deny rule for all Microsoft signed executables.

B.Keep the policy in AuditOnly and rely on Windows Defender to block unsigned apps.

C.Delete the existing rule and create a new rule that explicitly allows only specific signed apps.

D.Change the EnforcementMode to 'Enabled' and add a deny rule for unsigned executables.

AnswerD

Enabling enforcement with only allow rules for signed blocks unsigned.

Why this answer

AppLocker's AuditOnly mode logs events but does not enforce rules. To block unsigned executables, you must change the EnforcementMode to 'Enabled' so that rules are enforced. Adding a deny rule for unsigned executables specifically blocks them while allowing signed executables to run, provided no conflicting allow rules exist.

This approach ensures that only unsigned executables are blocked, leaving signed ones unaffected.

Exam trap

Microsoft often tests the misconception that AuditOnly mode can block applications if combined with other security features like Windows Defender, but in reality, AuditOnly only logs events and never enforces blocks, so you must change the enforcement mode to 'Enabled' for any AppLocker rule to take effect.

How to eliminate wrong answers

Option A is wrong because adding a deny rule for all Microsoft signed executables would block the very signed executables you want to allow, contradicting the requirement. Option B is wrong because relying on Windows Defender to block unsigned apps is not a substitute for AppLocker enforcement; Windows Defender focuses on malware detection, not application control policies, and AuditOnly mode does not enforce any blocks. Option C is wrong because deleting the existing rule and creating a new rule that explicitly allows only specific signed apps would block all other executables, including legitimate signed ones not in the allow list, which is overly restrictive and not required.

Full explanation →

483

Multi-Selectmedium

Which TWO actions can you take to improve the performance of Microsoft Intune management for Windows devices that are geographically distributed and have limited bandwidth?

Select 2 answers

A.Deploy a Configuration Manager site server at each location to act as a peer cache.

B.Increase the frequency of device sync intervals to ensure policies are applied quickly.

C.Enable Delivery Optimization to use peer-to-peer sharing within the same network.

D.Configure Windows Update for Business to use 'Download only' mode to reduce update size.

E.Disable Windows Defender real-time scanning on devices.

AnswersC, D

Peer-to-peer reduces internet bandwidth usage by sharing downloads locally.

Why this answer

Options C and D are correct. Enabling Delivery Optimization (C) allows Windows devices to download updates from other devices on the same network using peer-to-peer, reducing internet bandwidth usage. Configuring Windows Update for Business to use 'Download only' mode (D) ensures that updates are downloaded only once from Microsoft and then shared via Delivery Optimization, further reducing bandwidth consumption.

Option A is incorrect because deploying a Configuration Manager site server at each location adds infrastructure complexity and does not directly improve performance for Intune-managed devices; Peer Cache is not a native Intune feature. Option B is incorrect because increasing sync intervals increases network traffic, worsening bandwidth issues. Option E is incorrect because disabling real-time scanning compromises security without any significant bandwidth benefit.

Full explanation →

484

Multi-Selecteasy

You are planning to deploy Microsoft Defender for Endpoint on Windows 10 devices managed by Intune. Which TWO prerequisites must be met before deploying?

Select 2 answers

A.Devices must be joined to Azure AD.

B.A Microsoft Defender for Endpoint license must be assigned.

C.Devices must be enrolled in Microsoft Intune.

D.Devices must have a third-party antivirus uninstalled.

E.An Azure AD Premium license must be assigned.

AnswersB, C

License is required to use the service.

Why this answer

A Microsoft Defender for Endpoint license is required because it provides the entitlement to use the Defender for Endpoint service, including its advanced threat protection, endpoint detection and response (EDR), and vulnerability management capabilities. Without this license, the service cannot be provisioned or used, even if the devices are properly enrolled and configured.

Exam trap

The trap here is that candidates often confuse the prerequisites for Defender for Endpoint with those for other Microsoft 365 security services, mistakenly thinking Azure AD join or Azure AD Premium licenses are required, when in fact only an Intune enrollment and a Defender for Endpoint license are needed.

Full explanation →

485

MCQmedium

You are troubleshooting a user's Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is managed by Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The certificate is issued by your internal CA. The device shows 'No internet access' though it connects. What is the most likely issue?

A.The SSID in the profile is incorrect

B.The root CA certificate is not deployed to the device

C.The user does not have an Intune license

D.The Wi-Fi profile is not assigned to the device

AnswerB

Without the root CA, the SCEP certificate cannot be validated.

Why this answer

The device connects to the Wi-Fi network but shows 'No internet access,' indicating the SSID and connectivity are functional. With SCEP certificate authentication, the client must trust the issuing CA's root certificate to validate the server-side certificate during the EAP-TLS handshake. If the root CA certificate is not deployed to the device via Intune, the certificate chain cannot be verified, causing the connection to fail at the authentication layer even though the Wi-Fi association succeeds.

Exam trap

The trap here is that candidates see the device connects and assume the profile is correct, overlooking that certificate-based authentication requires both the client certificate and the root CA trust anchor to be present on the device.

How to eliminate wrong answers

Option A is wrong because an incorrect SSID would prevent the device from even seeing or connecting to the network, not just showing 'No internet access' after connecting. Option C is wrong because an Intune license is required for management enrollment, but the device is already managed and has a Wi-Fi profile assigned; the issue is certificate trust, not licensing. Option D is wrong because the profile is assigned (the device connects to the Wi-Fi), so the profile is present; the problem lies in the certificate validation step, not profile assignment.

Full explanation →

486

MCQhard

Refer to the exhibit. You are deploying Microsoft 365 Apps via Intune Win32 app packaging. The detection rule checks for the registry key existence. After installation, Intune reports the app as not detected. What is the most likely reason?

A.The detection type 'exists' is not supported for registry detection

B.The registry key path is incorrect for a 64-bit system

C.The app did not create the registry key during installation

D.The detection runs in 32-bit context and does not see the 64-bit registry key

AnswerD

32-bit detection redirected to WOW6432Node, but check32BitOn64System is false.

Why this answer

Intune Win32 app detection rules run in a 32-bit context by default on 64-bit systems. This means the detection script or rule checks the 32-bit registry view (Wow6432Node) rather than the 64-bit registry view. If the app created the registry key in the 64-bit path (e.g., HKLM\Software\Microsoft\Office), the 32-bit detection will not see it, causing a false 'not detected' state.

Exam trap

The trap here is that candidates assume registry detection is straightforward and overlook the 32-bit vs. 64-bit registry redirection, leading them to incorrectly blame the key path or the detection type instead of the context mismatch.

How to eliminate wrong answers

Option A is wrong because the 'exists' detection type is fully supported for registry detection in Intune Win32 apps; it is a common and valid rule. Option B is wrong because the registry key path may be correct for a 64-bit system, but the issue is not the path itself—it is the registry redirection that hides the key from the 32-bit detection context. Option C is wrong because the app likely did create the registry key during installation, but the detection fails due to the registry view mismatch, not because the key is missing.

Full explanation →

487

MCQmedium

Refer to the exhibit. You run a PowerShell cmdlet to get managed devices and see the output above. The device is noncompliant. What is the most likely reason?

A.The device is not enrolled.

B.The device name is too long.

C.The OS version is not supported.

D.The device has not synced recently.

AnswerD

Last sync is more than 24 hours ago, which can cause noncompliance.

Why this answer

The device is noncompliant because it has not synced recently. In Microsoft Intune, devices must regularly check in to report their compliance status; if a device fails to sync within the configured grace period (typically 30 days by default), it is marked as noncompliant. The PowerShell output shows the device is enrolled and managed, but the last sync time is missing or outdated, triggering the noncompliant state.

Exam trap

The trap here is that candidates assume noncompliance is always due to a configuration or OS issue, but Microsoft Intune also enforces compliance based on device activity—specifically the last sync time—which is a common oversight in exam scenarios.

How to eliminate wrong answers

Option A is wrong because the device is already enrolled and managed, as indicated by the 'Managed' status in the output. Option B is wrong because device name length does not affect compliance; Intune supports names up to 256 characters and has no compliance rule for name length. Option C is wrong because the OS version is listed as '10.0.19044.1706' (Windows 10 21H2), which is a supported version for Intune management and compliance policies.

Full explanation →

488

Multi-Selecteasy

Which TWO compliance settings can be configured in Microsoft Intune for Android devices?

Select 2 answers

A.Device is not jailbroken

B.Require a specific screen lock type

C.Minimum OS version

D.Require antivirus to be installed

E.Require encryption on the device

AnswersC, E

Common compliance setting.

Why this answer

The 'Minimum OS version' compliance setting in Microsoft Intune allows administrators to define a minimum Android operating system version that devices must meet to be considered compliant. This is a standard compliance policy rule that helps ensure devices run a supported and secure OS level, reducing exposure to known vulnerabilities.

Exam trap

The trap here is that candidates often confuse device configuration profiles (which enforce settings like screen lock type or antivirus) with compliance policies (which evaluate device state against rules), leading them to select options that are configuration settings rather than compliance settings.

Full explanation →

489

MCQmedium

A company uses Microsoft Intune to manage Windows 10 devices. Users report that after a recent update, the Start menu layout is not enforced. The administrator verified the policy is assigned to the correct device groups. What should the administrator check next?

A.Check the enrollment restrictions for Windows

B.Reassign the policy to the same group

C.Review the policy status in the Troubleshooting + support blade

D.Modify the Windows Update ring policy

AnswerC

This blade shows policy conflicts and errors for each device.

Why this answer

To verify that the policy is not in a conflict state by using the Troubleshooting + support blade. Option A is incorrect because the policy is already assigned. Option B is incorrect because the enrollment restrictions are not related to Start layout.

Option D is incorrect because the update ring policy does not affect Start layout enforcement.

Full explanation →

490

Multi-Selecthard

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a policy that prevents users from installing apps from outside the Microsoft Store. Which TWO settings can you use?

Select 2 answers

A.Set 'Windows Update for Business' to defer feature updates.

B.Enable 'Windows Defender Firewall' to block inbound connections from non-store apps.

C.Use the 'AppLocker' settings in a device configuration profile to allow only Store apps.

D.Enable 'BitLocker' to encrypt the system drive.

E.Configure 'SmartScreen' settings to block untrusted apps.

AnswersC, E

AppLocker can enforce store-only app installation.

Why this answer

AppLocker is a Windows feature that can be configured via Intune device configuration profiles to enforce application control policies. By creating an AppLocker rule for the 'Packaged apps' rule collection and setting the default action to 'Deny' for all users, you can explicitly allow only apps from the Microsoft Store, effectively blocking installation of non-Store apps.

Exam trap

The trap here is that candidates confuse SmartScreen's reputation-based blocking (which warns but can be bypassed) with AppLocker's explicit allow/deny enforcement, or they mistakenly think firewall or encryption policies can control application installation.

Full explanation →

491

MCQeasy

You are the Intune administrator for a small business with 50 Windows 10 devices that are currently managed by a legacy on-premises MDM. The company wants to move to Microsoft Intune for cloud management. All devices are already joined to Microsoft Entra ID. You need to migrate the devices to Intune management without resetting them. You have the following options: A) Use Windows Autopilot to reset the devices and re-enroll. B) Use Group Policy to configure MDM enrollment. C) Use the 'Switch to Intune' option in the device's 'Access work or school' settings. D) Use a provisioning package (PPKG) to enroll devices. Which option should you choose?

A.Use Windows Autopilot to reset the devices and re-enroll

B.Use Group Policy to configure MDM enrollment

C.Use the 'Switch to Intune' option in the device's 'Access work or school' settings

D.Use a provisioning package (PPKG) to enroll devices

AnswerC

Use a provisioning package (PPKG) to enroll devices. PPKG enrollment typically requires a reset or is used for new devices; it does not support switching from an existing MDM without reset.

Why this answer

Use the 'Switch to Intune' option in the device's 'Access work or school' settings. This feature is specifically designed for migrating devices from a legacy on-premises MDM to Intune without requiring a device reset. It is available on Windows 10 devices that are already joined to Microsoft Entra ID and enrolled in another MDM.

Option A is incorrect because Windows Autopilot resets the device, which is not desired. Option B (Group Policy) can force enrollment to Intune but does not handle the migration from an existing MDM; it would likely cause a conflict or require manual steps. Option D (provisioning package) is typically used for initial bulk enrollment and may also require a reset or clean installation.

Therefore, Option C is the only non-destructive migration method.

Exam trap

The trap here is that candidates often confuse the 'Switch to Intune' option with a simple enrollment method, assuming any enrollment method (like PPKG or Group Policy) can perform a non-destructive migration, when in fact only the built-in switch option is designed to handle the transition from an existing MDM without a reset.

How to eliminate wrong answers

Option A is wrong because Windows Autopilot resets the device to an out-of-box state, which would wipe all data and settings, contradicting the requirement to migrate without resetting. Option B is wrong because Group Policy can configure MDM enrollment via the MDM enrollment authority policy, but it does not provide a direct 'switch' mechanism; it would require additional configuration and may not cleanly transition from an existing MDM without manual intervention or a reset. Option D is wrong because a provisioning package (PPKG) is used for initial enrollment or re-enrollment, but applying it to an already managed device would likely cause conflicts or require a reset, and it does not support a non-destructive migration from a legacy MDM.

Full explanation →

492

MCQhard

Your organization uses Microsoft Defender for Cloud Apps (part of Microsoft Defender XDR). You need to detect when users access cloud apps from unauthorized locations. Which log source should you integrate to get location information?

A.Microsoft Entra ID sign-in logs

B.Microsoft Intune device enrollment logs

C.Microsoft Purview audit logs

D.Microsoft Sentinel

AnswerA

Entra ID sign-in logs provide IP addresses and geo-location for access events.

Why this answer

Microsoft Defender for Cloud Apps can integrate with Microsoft Entra ID (Azure AD) to receive sign-in logs, which include IP address and location. Option B is wrong because Microsoft Intune device enrollment logs do not contain app access location. Option C is wrong because Microsoft Purview audit logs are for compliance, not real-time access.

Option D is wrong because Microsoft Sentinel is a SIEM, not a source of location data.

Full explanation →

493

MCQeasy

You are preparing to deploy Windows 11 to 500 devices using Microsoft Intune. The devices are currently running Windows 10 22H2. You need to ensure that the in-place upgrade from Windows 10 to Windows 11 completes successfully. Which policy type should you configure in Intune to deliver the upgrade?

A.Deploy a configuration profile with the Windows 11 installation script.

B.Create a Windows update ring profile targeting Windows 11.

C.Create a Windows feature update profile targeting Windows 11.

D.Configure a device compliance policy requiring Windows 11.

AnswerC

Windows feature update profiles are designed to deploy feature updates like Windows 11 in Intune.

Why this answer

A Windows feature update profile in Intune is specifically designed to deliver feature updates like upgrading from Windows 10 to Windows 11. It uses the Windows Update for Business (WUfB) service to orchestrate the in-place upgrade, ensuring the device meets prerequisites and the upgrade completes successfully. This is the correct policy type for managing OS version upgrades at scale.

Exam trap

The trap here is confusing a Windows update ring profile (which controls update behavior but not the target version) with a Windows feature update profile (which explicitly specifies the target OS version for an upgrade), leading candidates to incorrectly choose Option B.

How to eliminate wrong answers

Option A is wrong because Intune does not support deploying a configuration profile with an installation script for OS upgrades; configuration profiles manage settings, not OS installation or upgrade scripts. Option B is wrong because a Windows update ring profile controls the update deferral, delivery optimization, and restart behavior for quality and feature updates, but it does not specify the target OS version for an upgrade; it only manages how updates are applied, not which feature update is installed. Option D is wrong because a device compliance policy enforces security and configuration requirements (e.g., requiring Windows 11) but does not initiate or deliver the upgrade; it only reports non-compliance if the device is not running the required OS.

Full explanation →

494

MCQeasy

A company uses Microsoft Intune to manage devices. They need to ensure that a critical line-of-business app is updated automatically on all devices. Which assignment type should they use?

A.Required

B.End-user notification

C.Uninstall

D.Available for enrolled devices

AnswerA

Forces app installation and updates.

Why this answer

The Required assignment type in Microsoft Intune automatically installs and updates apps on managed devices without user interaction, making it the correct choice for ensuring a critical line-of-business app is updated automatically. This assignment enforces the app deployment policy by pushing the update to devices during their next check-in with the Intune service, typically within 8 hours.

Exam trap

The trap here is that candidates confuse 'Available for enrolled devices' with automatic updates, but it only provides optional installation from the Company Portal, not forced updates, which is a common misconception in MD-102 exams.

How to eliminate wrong answers

Option B is wrong because End-user notification is not an assignment type; it is a setting within an app assignment that controls whether users receive notifications about app updates, but it does not enforce automatic updates. Option C is wrong because Uninstall is an assignment type used to remove an app from devices, not to update it. Option D is wrong because Available for enrolled devices allows users to install the app from the Company Portal on demand, but it does not automatically update the app; users must manually trigger the update.

Full explanation →

495

MCQhard

A company uses Microsoft Intune to manage iOS devices. Users report that they cannot install the required Microsoft Defender for Endpoint app from the Company Portal. The app shows as 'Not available' in the Company Portal. Which of the following is the most likely reason?

A.The app requires a valid Apple VPP token that has expired.

B.The device is marked as non-compliant with Intune compliance policies.

C.The Company Portal app version is outdated.

D.The device has 'Unknown Sources' enabled.

AnswerB

Non-compliant devices may be blocked from installing required apps.

Why this answer

When a device is marked as non-compliant with Intune compliance policies, the Company Portal will display required apps as 'Not available' because Intune blocks the installation of required apps on non-compliant devices to enforce security baselines. This behavior is controlled by the 'Mark devices with no compliance policy as' setting and the 'Action for noncompliance' configuration, which can block app deployment until the device is remediated.

Exam trap

The trap here is that candidates often confuse app availability issues with licensing problems (VPP token) or device configuration settings, but the 'Not available' status specifically indicates a compliance block rather than a license or platform mismatch.

How to eliminate wrong answers

Option A is wrong because an expired Apple VPP token would prevent app license assignment and show an error like 'License not available' or 'Cannot assign license', not simply mark the app as 'Not available' in Company Portal; the app would still appear but fail to install. Option C is wrong because an outdated Company Portal app version might cause sync or UI issues, but it would not cause a specific app to show as 'Not available'—the app would still be listed if assigned. Option D is wrong because 'Unknown Sources' is an Android-specific setting for sideloading apps; iOS devices do not have this setting, and it is irrelevant to Intune-managed iOS app deployment.

Full explanation →

496

MCQeasy

You are a Microsoft 365 administrator for a school district. You have 2,000 Windows 10 devices used by students. All devices are enrolled in Microsoft Intune. You need to deploy a set of educational apps from the Microsoft Store for Education (now part of Microsoft Store for Business). The apps should be automatically installed on all student devices, and students should not be able to remove them. You have already added the apps to your Microsoft Store for Business inventory and acquired offline licenses. You have also configured Intune to sync the Microsoft Store for Business. Which action should you take in Intune to deploy the apps with the least administrative effort?

A.Create a 'Microsoft Store for Business' app in Intune, select the offline-licensed apps, and assign as 'Required' to a device group containing all student devices.

B.Use the 'Microsoft Store app (Windows)' type and assign as 'Required' to the device group.

C.Create a 'Microsoft Store for Business' app in Intune, select the online-licensed apps, and assign as 'Available' to a user group.

D.Download the app packages and deploy as Win32 apps with silent switches.

AnswerA

Offline licenses allow silent install without user interaction.

Why this answer

Using the 'Microsoft Store for Business' app type with offline licenses allows automatic sync and silent installation. Option B is for user-targeted. Option C is for online licenses.

Option D is for Win32 apps.

Full explanation →

497

MCQeasy

A company wants to deploy Microsoft 365 Apps to 200 devices using Intune. They need to ensure that the deployment is available only to devices that meet a specific minimum OS version. Which feature should they use?

A.Assign the app and configure 'Require device compliance' with a filter for minimum OS version.

B.Assign the app with 'Uninstall' intent.

C.Assign the app as 'Available for enrolled devices' without filters.

D.Assign the app as 'Required' to all devices.

AnswerA

Device compliance filters can enforce OS version requirements.

Why this answer

Intune allows you to create a filter based on device properties such as OS version, and apply that filter to app assignments. This ensures the deployment is only available to devices meeting the minimum OS version. Option B is incorrect because 'Uninstall' intent would remove the app, not deploy it with OS filtering.

Option C is incorrect because 'Available for enrolled devices' without filters does not enforce any OS version requirement. Option D is incorrect because assigning as 'Required' to all devices does not filter by OS version.

Full explanation →

498

Multi-Selecthard

You are deploying a Win32 app via Intune that requires .NET Framework 4.8 as a dependency. Which THREE steps must you perform to ensure the dependency is installed before the app?

Select 3 answers

A.Configure a detection rule for .NET Framework in the main app.

B.In the main app's properties, add a dependency and select the .NET Framework app.

C.Set the dependency to 'Auto-install' so it installs before the main app.

D.Add .NET Framework 4.8 as a separate app in Intune.

E.Create a supersedence relationship where the .NET Framework app supersedes the main app.

AnswersB, C, D

Dependencies are defined in the app properties.

Why this answer

Intune dependencies allow you to specify another app that must be installed before the main app. By adding .NET Framework 4.8 as a separate app in Intune and then configuring a dependency in the main app's properties that references that app, you ensure the dependency is installed first. This is the only supported method for enforcing installation order via dependencies in Intune.

Exam trap

The trap here is that candidates confuse dependencies with supersedence, thinking supersedence can enforce installation order, but supersedence is designed for app replacement, not prerequisite installation.

Full explanation →

499

MCQhard

You manage devices with Microsoft Intune. You need to implement a conditional launch policy for Microsoft Defender for Endpoint that requires the device to have a minimum version of the sensor (10.8049.22439.1043) and a healthy signal. Which JSON policy should you deploy?

A.{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": "healthy"}}}

B.{"deviceHealth": {"defenderSensorVersion": {"version": "10.8049.22439.1043"}, "defenderSensorHealth": {"state": "enabled"}}}

C.{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}

D.{"deviceHealth": {"clientVersion": {"minimumVersion": "10.8049.22439.1043"}, "clientHealth": {"minimumVersion": 1}}}

E.{"deviceHealth": {"defenderSensorVersion": {"minimumVersion": "10.8049.22439.1043"}, "defenderSensorHealth": {"minimumVersion": 1}}}

AnswerE

Correct because it is identical to option C and follows the required schema.

Why this answer

Option E correctly implements the conditional launch policy. The schema requires 'defenderSensorVersion' with 'minimumVersion' set to the version string, and 'defenderSensorHealth' with 'minimumVersion' set to the numeric value 1 to indicate a healthy state. Option A uses the string 'healthy' instead of numeric 1.

Option B uses 'version' and 'state' which are incorrect property names. Option D uses 'clientVersion' and 'clientHealth' which are incorrect. Option C is textually identical to E but is not the designated correct answer.

Therefore, only option E is correct.

Exam trap

The trap here is that candidates confuse the `defenderSensorHealth` property with a string-based health indicator (like `"healthy"` or `"enabled"`) instead of recognizing it requires a numeric value (`1`) to represent a healthy state, as defined in the Intune policy schema.

How to eliminate wrong answers

Option A is wrong because `defenderSensorHealth` uses `minimumVersion` with the string `"healthy"`, but the schema requires a numeric value (`1`) to represent health, not a string. Option B is wrong because `defenderSensorVersion` uses `"version"` instead of `"minimumVersion"`, and `defenderSensorHealth` uses `"state": "enabled"` which is not a valid property; the correct property is `minimumVersion` with a numeric value. Option C is wrong because `defenderSensorHealth` uses `"minimumVersion": 1` which is correct, but the option is listed as incorrect in the question; however, Option C is actually syntactically identical to Option E, but the question marks Option E as correct, likely due to a formatting nuance in the original source.

Option D is wrong because it uses `clientVersion` and `clientHealth` instead of `defenderSensorVersion` and `defenderSensorHealth`, which are the correct object names for Defender for Endpoint sensor health checks.

Full explanation →

500

MCQeasy

You are a Microsoft Intune administrator for Tailwind Traders. The company has enrolled Windows 11 devices. You need to configure BitLocker encryption on all devices using Intune. You have created an endpoint security policy for BitLocker and assigned it to the correct group. After 24 hours, some devices still show as not encrypted. You verify that the devices are compliant with the policy's prerequisites. What should you do to force the policy to apply?

A.Use Group Policy Editor to configure BitLocker locally on each device.

B.Check if the devices have TPM version 2.0.

C.Re-create the BitLocker policy with a different name.

D.Remotely sync the devices from the Intune console to refresh policy.

AnswerD

Sync forces policy retrieval and application.

Why this answer

Triggering a sync on the devices will force the policy to be applied. Re-creating the policy is unnecessary. Using a local GPO is not managed centrally.

Checking the hardware is not relevant.

Full explanation →

501

MCQeasy

Refer to the exhibit. The JSON snippet shows a Windows Update for Business policy assigned to a device group. Users report that quality updates are installed 7 days after release. Which setting controls this behavior?

A.featureUpdateDeferralPeriodInDays

B.businessReadyUpdatesOnly

C.qualityUpdateDeferralPeriodInDays

D.automaticUpdateMode

AnswerC

This setting defers quality updates by the specified number of days.

Why this answer

The setting `qualityUpdateDeferralPeriodInDays` controls how long quality updates (security fixes) are deferred after release. A value of 7 means updates are installed 7 days post-release, matching the user report. This is a Windows Update for Business policy configured via CSP (Policy CSP - Update).

Exam trap

The trap here is that candidates confuse `featureUpdateDeferralPeriodInDays` with quality update deferral, assuming all deferral settings work the same way, but they are separate policies for different update types.

How to eliminate wrong answers

Option A is wrong because `featureUpdateDeferralPeriodInDays` controls deferral of feature updates (major OS version upgrades), not quality updates. Option B is wrong because `businessReadyUpdatesOnly` determines whether to receive only business-ready (servicing channel) updates or preview updates, not the deferral period. Option D is wrong because `automaticUpdateMode` controls the update installation behavior (e.g., auto-install at scheduled time, notify download), not the deferral delay.

Full explanation →

502

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved Microsoft Store apps can be installed on company devices. The solution must not require users to be local administrators. What should you configure?

A.Enable Conditional Access to block non-approved apps.

B.Deploy a local AppLocker policy using Intune.

C.Configure Windows Defender Application Control (WDAC) policy.

D.Assign an Intune App Protection Policy (APP) for Windows.

AnswerB

AppLocker can be configured via Intune to restrict app installations to approved Store apps.

Why this answer

AppLocker, when deployed via Intune as a local policy, allows you to create rules that restrict application execution to only approved Microsoft Store apps. This policy is enforced at the kernel level and does not require users to have local administrator privileges, as the rules are applied system-wide and cannot be overridden by standard users.

Exam trap

The trap here is that candidates often confuse AppLocker with Windows Defender Application Control (WDAC), thinking WDAC is the only way to control app installation, but AppLocker is the correct choice for this specific requirement of allowing only Microsoft Store apps without requiring local admin rights and with simpler management via Intune.

How to eliminate wrong answers

Option A is wrong because Conditional Access controls access to cloud resources (e.g., blocking sign-ins from non-compliant devices) but does not control which apps can be installed or run locally on the device. Option C is wrong because Windows Defender Application Control (WDAC) is a more restrictive, code-integrity-based policy that typically requires a reboot and is designed for high-security environments; it is not the simplest solution for allowing only Microsoft Store apps without local admin rights, and it can be complex to manage via Intune. Option D is wrong because Intune App Protection Policies (APP) apply to mobile application management (MAM) scenarios on iOS and Android, not to Windows 10 desktop app installation or execution control.

Full explanation →

503

MCQmedium

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

A.The device is not compliant with the compliance policy.

B.The app is not assigned to the user's device group.

C.The app is not approved in the Android Enterprise managed Google Play.

D.The Company Portal app is not installed on the device.

AnswerB

The app must be assigned to the user or group.

Why this answer

The app is assigned as 'Available for enrolled devices' in Intune, which means it must be assigned to a device group that includes the user's device. Since the device is enrolled and compliant, the most likely issue is that the app is not assigned to the correct device group, preventing it from appearing in the Company Portal for installation.

Exam trap

The trap here is that candidates often confuse 'Available for enrolled devices' with user-based assignments, assuming user group membership is sufficient, when in fact device group membership is required for this assignment type.

How to eliminate wrong answers

Option A is wrong because the device is explicitly stated as compliant, so non-compliance cannot be the issue. Option C is wrong because the app is already assigned as 'Available for enrolled devices' in Intune, which implies it has been approved in the managed Google Play; if it were not approved, the assignment would fail entirely. Option D is wrong because the user is reporting the issue from the Company Portal, confirming the app is installed and accessible.

Full explanation →

504

MCQmedium

An administrator is deploying Windows 11 using Configuration Manager. The task sequence fails on some devices during the 'Apply Operating System' step with a notice that the image file is not valid. All other devices succeed. What is the most likely cause?

A.The boot image is not compatible with the device firmware.

B.The distribution point is out of disk space.

C.The task sequence variable OSDPackagePath is missing.

D.The OS image download was corrupted on the client.

AnswerD

Corrupted download causes invalid image error on specific clients.

Why this answer

A corrupted OS image download on the client will cause the 'Apply Operating System' step to fail with an 'image file is not valid' error. Since the issue occurs only on some devices, a per-client download corruption (e.g., due to network interruption or disk I/O errors during BITS transfer) is the most likely cause, while the image itself remains valid on the distribution point.

Exam trap

The trap here is that candidates often assume a distribution point or boot image problem because those are common causes of task sequence failures, but the 'some devices succeed' clue points to a client-specific corruption rather than a global infrastructure issue.

How to eliminate wrong answers

Option A is wrong because a boot image incompatible with device firmware would cause a failure earlier in the task sequence, typically during the boot phase or when loading Windows PE, not during the 'Apply Operating System' step. Option B is wrong because if the distribution point were out of disk space, the failure would affect all clients attempting to download the OS image, not just some devices. Option C is wrong because the OSDPackagePath variable is automatically set by Configuration Manager during task sequence processing; if it were missing, the task sequence would fail consistently on all devices, not selectively.

Full explanation →

505

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. They deploy a Win32 app using detection rules. The app installs but the detection rule incorrectly reports failure, causing repeated installation attempts. What is the best way to resolve this?

A.Uninstall and redeploy the app

B.Update the detection rule to accurately reflect installed state

C.Reinstall the app manually

D.Modify the installation command to suppress output

AnswerB

Corrects the false failure.

Why this answer

The detection rule is the mechanism Intune uses to determine whether a Win32 app is already installed. If the rule incorrectly reports failure despite successful installation, Intune will repeatedly attempt to reinstall the app. Updating the detection rule to accurately reflect the installed state (e.g., checking for the correct file, registry key, or version) stops the unnecessary reinstall loop without requiring manual intervention or reconfiguration of the deployment.

Exam trap

The trap here is that candidates often assume the issue is with the installation command or the app itself, rather than recognizing that Intune's detection logic is the sole trigger for reinstallation attempts.

How to eliminate wrong answers

Option A is wrong because uninstalling and redeploying the app does not fix the root cause—the flawed detection rule—so the same incorrect detection will trigger reinstallation again after redeployment. Option C is wrong because manually reinstalling the app does not correct the detection rule; Intune will still detect the app as not installed based on the faulty rule and continue its reinstall attempts. Option D is wrong because modifying the installation command to suppress output does not change how Intune evaluates the detection rule; suppression only hides logs and does not address the mismatch between actual installation state and detection logic.

Full explanation →

506

MCQeasy

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

A.Require device to be marked as compliant

B.Require multi-factor authentication

C.Require hybrid Azure AD joined device

D.Require approved client app

AnswerA

Directly enforces compliance for access.

Why this answer

The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus active, OS version current) can access Exchange Online. This leverages Microsoft Intune device compliance policies and the Microsoft Entra ID device registration state to block non-compliant devices from accessing corporate email.

Exam trap

The trap here is that candidates often confuse device compliance with device join type (hybrid Azure AD join) or app-level controls, mistakenly thinking that requiring a specific join type or approved app alone ensures the device is healthy and secure.

How to eliminate wrong answers

Option B is wrong because requiring multi-factor authentication (MFA) addresses identity verification, not device compliance; a compromised but MFA-enabled device could still access email. Option C is wrong because requiring a hybrid Azure AD joined device enforces a specific join type (typically for on-premises AD integration), but a device can be hybrid joined yet still be non-compliant (e.g., missing security updates). Option D is wrong because requiring an approved client app (e.g., Outlook mobile) controls the application used, not the device's compliance state; a non-compliant device could still use an approved app.

Full explanation →

507

MCQmedium

Refer to the exhibit. You have the following compliance policy assigned to a Windows 10 device running version 10.0.22000.0. The device has a password of 8 characters and is encrypted. What is the compliance status of the device?

A.Noncompliant due to password length

B.Noncompliant due to encryption

C.Compliant

D.Noncompliant due to OS version

AnswerC

All conditions are met.

Why this answer

The device is running Windows 10 version 10.0.22000.0, which is between the minimum (10.0.19041.0) and maximum (10.0.22621.0) allowed. The password length is 8 characters, which meets the minimum requirement of 6. The device is encrypted.

Therefore, all compliance policy conditions are satisfied, making the device Compliant. Option C is correct. Options A, B, and D are incorrect because password length meets the requirement, encryption is enabled, and OS version is within the allowed range.

Full explanation →

508

MCQmedium

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

A.The device is marked as non-compliant.

B.The device does not have a valid device certificate.

C.The device has not checked in with the Intune service recently.

D.The device enrollment profile has expired.

AnswerC

Devices must check in to receive policy updates.

Why this answer

When a device shows as 'Not evaluated' or 'Pending' in the Intune console, it indicates that the Intune service has not received a recent check-in from the device. Even if the device is enrolled and connected to the internet, it must periodically communicate with the Intune service to retrieve policies; the default check-in interval is approximately 8 hours, and if the device misses this window, policies remain unevaluated.

Exam trap

The trap here is that candidates often assume policy delivery failures are due to compliance or certificate issues, but the MD-102 exam specifically tests the understanding that a device must actively check in with the Intune service to receive policies, and a 'Pending' status directly indicates a missed check-in.

How to eliminate wrong answers

Option A is wrong because a non-compliant device still receives policies from Intune; compliance status affects conditional access, not policy delivery. Option B is wrong because while a valid device certificate is required for enrollment, the issue described is about policy retrieval after enrollment, and a missing or expired certificate would typically cause enrollment failure or a different error state, not a 'Not evaluated' status. Option D is wrong because enrollment profiles are used during the enrollment process itself; once a device is enrolled, the profile is no longer relevant for ongoing policy delivery, and an expired profile would prevent enrollment, not cause a 'Pending' state for already-enrolled devices.

Full explanation →

509

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting. You check the BitLocker policy and it is assigned correctly. What is the most likely reason?

A.The device is running Windows 10 Home edition.

B.The device does not have a TPM chip.

C.The BitLocker policy is not assigned to the users.

D.The device is non-compliant and encryption is blocked.

AnswerB

TPM is required for BitLocker.

Why this answer

BitLocker requires a TPM (Trusted Platform Module) version 1.2 or later to provide hardware-based key storage and integrity verification. If a device lacks a TPM chip, the BitLocker policy will not apply, and encryption will fail silently or remain off, even if the policy is correctly assigned. This is the most common cause of encryption not starting on Windows 10 devices managed by Intune.

Exam trap

The trap here is that candidates often assume the issue is policy assignment or user targeting, but Microsoft Intune's BitLocker policy has a hard dependency on TPM hardware, making the absence of a TPM the most likely root cause when encryption fails on correctly targeted devices.

How to eliminate wrong answers

Option A is wrong because Windows 10 Home edition does not support BitLocker at all, but the question states some devices are not encrypting, implying others are—so the issue is not edition-wide. Option C is wrong because the question explicitly states the BitLocker policy is assigned correctly, so user assignment is not the problem. Option D is wrong because non-compliance does not block BitLocker encryption; Intune can enforce encryption regardless of compliance status, and non-compliance typically triggers remediation or reporting, not a block on encryption.

Full explanation →

510

MCQeasy

Your organization wants to deploy Windows Update for Business policies using Microsoft Intune to Windows 10 devices. Which policy type should you use?

A.App protection policy

B.Device configuration profile for Windows Update for Business

C.Device compliance policy

D.Endpoint security policy for antivirus

AnswerB

This profile type configures update rings and deferrals.

Why this answer

Windows Update for Business (WUfB) policies are configured using a device configuration profile in Microsoft Intune, specifically under the 'Windows Update for Business' template. This profile type allows you to manage update settings such as deferral periods, pause updates, and feature update targeting directly from Intune without requiring on-premises WSUS or additional infrastructure.

Exam trap

The trap here is that candidates often confuse Device compliance policies (which can report update status) with the actual policy type that configures update behavior, leading them to select Option C instead of the correct Device configuration profile for Windows Update for Business.

How to eliminate wrong answers

Option A is wrong because App protection policies (APP) are designed to protect corporate data in mobile apps (e.g., Outlook, OneDrive) on iOS/iPadOS and Android devices, not to manage Windows Update settings. Option C is wrong because Device compliance policies evaluate device health (e.g., BitLocker status, antivirus state, OS version) and trigger conditional access, but they do not configure update deployment behavior or deferral policies. Option D is wrong because Endpoint security policies for antivirus manage Microsoft Defender Antivirus configurations (e.g., real-time protection, cloud-delivered protection), not Windows Update for Business settings.

Full explanation →

511

Multi-Selecteasy

Your organization is implementing Windows Autopilot. Which TWO prerequisites must be met before you can use Autopilot?

Select 2 answers

A.An on-premises Active Directory domain

B.Microsoft Intune licenses

C.Configuration Manager

D.Microsoft Entra ID P1 or P2 licenses

E.TPM 2.0 chip on all devices

AnswersB, D

Intune licenses are required for device management.

Why this answer

And Option D are correct because Autopilot requires Microsoft Entra ID P1/P2 and Intune licenses. Option A is wrong because on-prem AD is not required. Option C is wrong because Configuration Manager is not required.

Option E is wrong because a TPM is only required for self-deploying mode.

Full explanation →

512

MCQeasy

You have created the above custom policy but it fails to apply on Windows 10 devices. What is the most likely reason?

A.The value must be an integer, not a string.

B.The OMA-URI targets the user, not the device.

C.Custom configuration policies are not supported on Windows 10.

D.The OMA-URI path is incorrect for an ADMX-backed policy.

AnswerD

ADMX policies require a specific URI format that includes the category path.

Why this answer

The OMA-URI path for an ADMX-backed policy must follow the exact format: `./Device/Vendor/MSFT/Policy/Config/ADMX_<Category>/<PolicyName>`. If the path is incorrect—for example, missing the `ADMX_` prefix or using a wrong category name—the policy will fail to apply on Windows 10 devices. Custom configuration policies do support ADMX-backed policies, but the URI must precisely match the ADMX administrative template structure.

Exam trap

The trap here is that candidates assume any OMA-URI error is due to targeting (user vs. device) or data type issues, but the MD-102 exam specifically tests the precise URI syntax for ADMX-backed policies, which is a common misconfiguration point.

How to eliminate wrong answers

Option A is wrong because the error is not about data type mismatch; ADMX-backed policies can accept string values (e.g., registry strings) depending on the policy definition, and the question does not specify a value type conflict. Option B is wrong because the OMA-URI for device configuration policies uses the `./Device/` prefix, not `./User/`, and targeting the user would be a different scope; the issue here is the path structure, not the target. Option C is wrong because custom configuration policies are fully supported on Windows 10 via MDM; they are a core feature for deploying settings not available in the built-in configuration profiles.

Full explanation →

513

MCQhard

Your organization has an existing Microsoft Intune environment. You need to configure a Windows 11 device to automatically enroll in Intune when a user signs in with their Microsoft Entra ID credentials. The device is joined to Microsoft Entra ID. What should you do?

A.Set the MDM user scope in Microsoft Entra ID to 'All' or 'Some'.

B.Configure the MDM discovery URL in Microsoft Entra ID.

C.Create an enrollment restriction that allows Windows devices.

D.Assign a device compliance policy to the user.

AnswerA

This enables automatic enrollment for Microsoft Entra ID joined devices.

Why this answer

Microsoft Entra ID joined devices automatically enroll in Intune when the MDM user scope is set to 'All' or 'Some'. Option B is incorrect because the MDM discovery URL is configured automatically for Microsoft Entra ID joined devices and does not need manual configuration. Option C is incorrect because enrollment restrictions control which devices can enroll but do not trigger automatic enrollment.

Option D is incorrect because device compliance policies are applied after enrollment, not before.

Full explanation →

514

MCQhard

Your organization uses Microsoft Intune for device management. You have a compliance policy that requires Windows devices to have BitLocker enabled. A user reports that their device is marked as non-compliant even though BitLocker is turned on. What is the most likely cause?

A.The BitLocker recovery key is not escrowed to Microsoft Entra ID

B.BitLocker is only enabled on data drives, not the system drive

C.The device is running a version of Windows that does not support BitLocker

D.The device does not have a TPM chip

AnswerA

The compliance policy checks for recovery key backup; missing escrow causes non-compliance.

Why this answer

The compliance policy is configured to require BitLocker, but Intune's 'Require BitLocker' setting in compliance policies actually checks both that BitLocker is enabled and that the recovery key is escrowed to Microsoft Entra ID. Even if BitLocker is actively encrypting the drive, failure to escrow the key results in non-compliance. This is why the device is marked non-compliant despite BitLocker being turned on.

Exam trap

The trap here is that candidates assume 'BitLocker enabled' only means the drive is encrypted, but Microsoft Intune's compliance policy specifically requires the recovery key to be escrowed to Microsoft Entra ID as part of the compliance check.

How to eliminate wrong answers

Option B is wrong because the compliance policy typically checks for BitLocker on the system drive (operating system drive), and BitLocker on data drives alone does not satisfy the requirement for system drive encryption. Option C is wrong because if the device is managed by Intune and supports BitLocker (which is available on Windows Pro, Enterprise, and Education editions), the version is likely compatible; the issue is not about version support but about key escrow. Option D is wrong because a TPM chip is required for BitLocker to function, and if BitLocker is reported as 'turned on,' the device must have a TPM; the non-compliance stems from missing key escrow, not TPM absence.

Full explanation →

515

MCQmedium

Your company uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work apps are sandboxed from personal apps. Which enrollment type should you use?

A.Fully managed

B.Work profile

C.Device administrator

D.Corporate-owned personally enabled (COPE)

AnswerB

Creates a separate work profile that sandboxes work apps on personally owned devices.

Why this answer

The Work profile enrollment type is correct because it creates a separate, managed container on Android Enterprise devices that isolates work apps and data from personal apps and data. This sandboxing is enforced by the Android Enterprise framework, ensuring that work apps cannot access personal data and vice versa, which meets the requirement for separation without requiring full device management.

Exam trap

The trap here is that candidates often confuse COPE with Work profile, assuming COPE is required for sandboxing on corporate-owned devices, but the question focuses on the enrollment type that ensures sandboxing regardless of ownership, making Work profile the correct choice.

How to eliminate wrong answers

Option A is wrong because Fully managed enrollment gives the organization complete control over the entire device, which does not provide sandboxing between work and personal apps—it manages the whole device as a corporate asset. Option C is wrong because Device administrator is a legacy Android management mode that does not support work profile sandboxing; it applies policies to the entire device and lacks the containerization capabilities of Android Enterprise. Option D is wrong because Corporate-owned personally enabled (COPE) uses a work profile for separation but is designed for corporate-owned devices that also allow personal use, whereas the question does not specify device ownership and Work profile is the standard enrollment type for sandboxing on personally owned devices.

Full explanation →

516

MCQmedium

Your organization uses Microsoft Defender for Endpoint (part of Microsoft Defender XDR) on all Windows devices. You need to ensure that devices that are not actively reporting to Defender for Endpoint are flagged as non-compliant in Intune. What should you configure?

A.Create a Conditional Access policy requiring device compliance and blocking access if not compliant.

B.Enable 'Require BitLocker' compliance setting.

C.Deploy a PowerShell script via Intune that checks the Defender service status and reports to Intune custom compliance.

D.Add a compliance policy setting: 'Require the device to be at or under the machine risk score' with a low score.

AnswerD

This setting uses Defender for Endpoint risk score to evaluate compliance. If the device is not reporting, the score is not available, causing non-compliance.

Why this answer

Microsoft Defender for Endpoint integrates with Intune compliance policies via the 'Require the device to be at or under the machine risk score' setting. When a device stops reporting to Defender, its risk score escalates above the 'Low' threshold, causing Intune to mark it as non-compliant. This directly meets the requirement to flag non-reporting devices without additional scripting or conditional access complexity.

Exam trap

The trap here is that candidates often confuse Conditional Access (which enforces compliance) with the compliance policy setting that actually defines what 'non-compliant' means, leading them to pick Option A instead of the correct risk-score setting.

How to eliminate wrong answers

Option A is wrong because a Conditional Access policy enforces access control based on compliance status but does not itself define or detect non-reporting devices; it relies on an existing compliance policy to flag them. Option B is wrong because 'Require BitLocker' only checks encryption status, not whether the device is actively reporting to Defender for Endpoint. Option C is wrong because while a custom PowerShell script can check Defender service status, it requires custom compliance discovery and is not the native, supported method for integrating Defender risk data into Intune compliance.

Full explanation →

517

MCQhard

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

A.Windows compliance policy

B.Windows 10 and later update ring

C.Windows feature update policy

D.Windows driver update policy

AnswerB

Allows configuring deferral periods.

Why this answer

The Windows 10 and later update ring policy in Intune is specifically designed to configure Windows Update for Business settings, including deferral periods for feature and quality updates. By setting the 'Feature update deferral period (days)' to 60 and 'Quality update deferral period (days)' to 14, you directly control how long updates are postponed after they are released by Microsoft. This policy applies to devices managed via Intune and leverages the Windows Update for Business service to enforce these deferrals.

Exam trap

The trap here is that candidates often confuse the 'Windows feature update policy' (which targets a specific feature update version) with the 'update ring' policy (which controls deferral periods), leading them to select option C instead of B.

How to eliminate wrong answers

Option A is wrong because Windows compliance policy is used to evaluate device compliance against security requirements (e.g., OS version, antivirus status) and does not include settings to defer update installations. Option C is wrong because Windows feature update policy is a separate policy type that targets specific feature update versions (e.g., Windows 11 22H2) and does not control deferral periods for quality updates or general feature update deferral durations. Option D is wrong because Windows driver update policy is dedicated to managing driver updates (e.g., approval, deferral) and does not handle feature or quality update deferral settings.

Full explanation →

518

MCQeasy

A company plans to deploy Windows 11 to 500 new devices using Windows Autopilot. The devices are purchased from a hardware vendor that supports OEM registration. Which prerequisite must be met to ensure Autopilot can automatically enroll these devices?

A.The devices must be registered in Microsoft Intune via the hardware vendor or manually.

B.The organization must have a hybrid Azure AD join configuration in place.

C.BitLocker must be enabled on the devices before they are shipped.

D.A local administrator account must be created on each device prior to deployment.

AnswerA

Autopilot requires device registration in Intune for automatic enrollment.

Why this answer

Autopilot requires the device to be registered in Microsoft Intune (or Entra ID) before it can be automatically enrolled. Option B is incorrect because a hybrid Azure AD join is not a prerequisite for Autopilot enrollment; it is an optional configuration. Option C is incorrect because BitLocker does not need to be enabled before shipment; it can be configured later via policy.

Option D is incorrect because a local administrator account is not required; Autopilot can create accounts during deployment.

Full explanation →

519

MCQmedium

You need to deploy a custom Windows 11 feature update to a pilot group of 50 devices before rolling out to the entire organization. The devices are managed by Intune and are in a 'Pilot' Azure AD group. What is the best approach?

A.Configure a Windows Update for Business deferral policy for all devices

B.Create a custom configuration profile with update settings

C.Create a feature update profile for Windows 11 and assign to the pilot group

D.Use Group Policy to configure Windows Update settings for the pilot group

AnswerC

Feature update profiles allow targeted deployment of feature updates.

Why this answer

Intune's feature update profiles are specifically designed to deploy Windows 11 feature updates to targeted Azure AD groups, such as the 'Pilot' group. This approach allows you to control the exact feature update version (e.g., Windows 11 23H2) and assign it only to the pilot devices, enabling a controlled rollout before expanding to the entire organization.

Exam trap

The trap here is that candidates often confuse feature update profiles with quality update policies or configuration profiles, mistakenly thinking any update-related setting can be applied via a configuration profile or deferral policy.

How to eliminate wrong answers

Option A is wrong because a Windows Update for Business deferral policy only delays the installation of updates; it does not deploy a specific feature update version to a targeted group. Option B is wrong because custom configuration profiles are used for device settings (e.g., security policies, app configurations), not for deploying feature updates; feature updates require a dedicated feature update profile. Option D is wrong because Group Policy is not applicable in a cloud-only Intune-managed environment; devices must be Azure AD joined and managed via Intune, and Group Policy requires on-premises Active Directory and Domain Services.

Full explanation →

520

MCQeasy

Northwind Traders is a retail company with 500 employees. They use Microsoft Intune to manage iOS devices. The company has a custom iOS app for inventory management that they need to deploy to all store managers. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the store managers' devices. After 48 hours, several managers report that the app is not installed on their devices. The administrator checks the Intune console and sees that the app status for those devices is 'Pending install'. What should the administrator do first to resolve the issue?

A.Deploy a certificate profile that installs the enterprise root certificate to the affected devices.

B.Create an app protection policy and assign it to the devices.

C.Instruct the users to install the app manually from the Company Portal app.

D.Re-upload the .ipa file to Intune with a different version number.

AnswerA

The devices need to trust the enterprise certificate.

Why this answer

The 'Pending install' status for an enterprise-signed iOS app typically indicates that the device does not trust the enterprise certificate used to sign the app. Deploying a certificate profile that installs the enterprise root certificate on the affected devices establishes trust, allowing the app to install successfully. Without this trust, iOS blocks the installation of any enterprise-signed app, even when assigned as 'Required' via Intune.

Exam trap

The trap here is that candidates may assume the issue is with the app package or assignment, rather than recognizing that iOS's enterprise app trust model requires the root certificate to be explicitly deployed to devices before installation can occur.

How to eliminate wrong answers

Option B is wrong because app protection policies (MAM) control data access and behavior within apps, not the installation of enterprise-signed apps; they do not resolve certificate trust issues. Option C is wrong because instructing users to install manually from Company Portal will still fail if the enterprise root certificate is not trusted on the device, as iOS will block the installation. Option D is wrong because re-uploading the .ipa file with a different version number does not address the underlying certificate trust issue; the app will remain in 'Pending install' until the device trusts the signing certificate.

Full explanation →

521

MCQhard

You need to ensure that Windows 10 devices automatically receive Microsoft 365 Apps updates from the Internet when not connected to the corporate network. Which update channel should you configure?

A.Monthly Enterprise Channel

B.Office Insider

C.Current Channel

D.Semi-Annual Channel

AnswerC

Current Channel delivers updates as they become available and works over the Internet.

Why this answer

The Current Channel is the correct choice because it provides the most frequent updates for Microsoft 365 Apps, and it is the only channel that supports automatic updates from the Internet (via the Office Content Delivery Network) when devices are not connected to the corporate network. This channel is designed for devices that need the latest features and security updates without relying on on-premises update infrastructure.

Exam trap

The trap here is that candidates often confuse the Monthly Enterprise Channel with the Current Channel, assuming that 'Monthly' implies automatic Internet updates, but the Monthly Enterprise Channel is actually designed for managed deployment and does not support automatic Internet-based updates for off-network devices.

How to eliminate wrong answers

Option A is wrong because the Monthly Enterprise Channel is intended for organizations that want a predictable, once-a-month update cycle and typically rely on on-premises distribution points (e.g., Configuration Manager) or cloud-based management tools, not automatic Internet-based updates for off-network devices. Option B is wrong because Office Insider is a pre-release channel for testing upcoming features and is not intended for production devices requiring stable, automatic updates from the Internet. Option D is wrong because the Semi-Annual Channel provides updates only twice a year and is designed for environments with strict change management and on-premises update control, not for devices that need to automatically receive updates from the Internet when off the corporate network.

Full explanation →

522

MCQmedium

Your organization uses Microsoft Intune to deploy apps to Windows 11 devices. You need to ensure that a Win32 app installs only when the device has at least 4 GB of RAM. What should you configure?

A.A dependency rule that includes a RAM check

B.A return code for insufficient RAM

C.A requirement rule that specifies minimum RAM

D.A detection rule for RAM

AnswerC

Requirement rules define hardware and software prerequisites.

Why this answer

To enforce a hardware prerequisite like minimum RAM for a Win32 app in Microsoft Intune, you configure a requirement rule. Requirement rules define the device conditions (e.g., operating system architecture, disk space, or RAM) that must be met before the app can install. Option C is correct because it directly specifies a minimum RAM value as a requirement rule, ensuring the app installs only on devices with at least 4 GB of RAM.

Exam trap

The trap here is confusing requirement rules (which enforce hardware/software prerequisites) with detection rules (which verify existing installation) or dependency rules (which manage app installation order), leading candidates to incorrectly select a detection or dependency rule for a hardware prerequisite.

How to eliminate wrong answers

Option A is wrong because dependency rules control the order of app installation (e.g., requiring another app to be installed first), not hardware checks like RAM. Option B is wrong because return codes define how Intune interprets the exit code from the app installer (e.g., success, reboot, or failure), but they cannot enforce a prerequisite condition before installation begins. Option D is wrong because detection rules are used to determine whether an app is already installed (e.g., checking for a file or registry key), not to evaluate hardware requirements before installation.

Full explanation →

523

MCQeasy

Your organization wants to use Windows Autopilot to deploy new Windows 11 devices. What is required to register a device with Windows Autopilot?

A.The device's product key

B.The device's hardware hash (4K HH)

C.The user's Microsoft account

D.The device's BIOS password

AnswerB

The hardware hash uniquely identifies the device and is required for Autopilot registration.

Why this answer

Windows Autopilot requires the device's hardware hash (4K HH) to uniquely identify the device during the registration process. This hash is generated from the device's hardware components and is uploaded to the Microsoft Intune or Partner portal to associate the device with an Autopilot profile. Without the hardware hash, Autopilot cannot recognize the device as registered and will not apply the deployment profile.

Exam trap

The trap here is that candidates often confuse the hardware hash with the product key, assuming that a license or activation key is needed for Autopilot registration, but Autopilot relies solely on hardware-based identification.

How to eliminate wrong answers

Option A is wrong because the product key is used for Windows activation, not for Autopilot registration; Autopilot uses the hardware hash to identify the device. Option C is wrong because the user's Microsoft account is not required for device registration; Autopilot registration is device-centric and occurs before user sign-in. Option D is wrong because the BIOS password is a security feature for local access control and has no role in Autopilot's device identification or enrollment process.

Full explanation →

524

MCQmedium

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

A.Non-compliant, because the OS version is not within the allowed range.

B.Compliant, because the policy includes a grace period for firewall.

C.Compliant, because the OS version is within the allowed range.

D.Non-compliant, because the firewall is disabled.

AnswerD

Active firewall is required; disabling it makes the device non-compliant.

Why this answer

The device is non-compliant because the compliance policy explicitly requires the firewall to be enabled. Even though the OS version (10.0.19044) falls within the allowed range of 10.0.17763 to 10.0.19045, the firewall requirement is a separate condition that must be met. In Microsoft Intune, if any required setting is not satisfied and no grace period is configured for that setting, the device is marked non-compliant immediately.

Exam trap

The trap here is that candidates assume OS version compliance alone determines the overall status, ignoring that all policy conditions must be satisfied, and that a disabled firewall is a separate, immediate non-compliance factor.

How to eliminate wrong answers

Option A is wrong because the OS version 10.0.19044 is within the allowed range of 10.0.17763 to 10.0.19045, so the device is not non-compliant due to OS version. Option B is wrong because the policy does not show a grace period for the firewall; grace periods are configured per setting in Intune compliance policies, and the exhibit does not indicate any grace period for the firewall rule. Option C is wrong because while the OS version is within range, compliance requires all conditions to be met; the disabled firewall overrides OS version compliance, making the device non-compliant.

Full explanation →

525

MCQhard

Your company uses Microsoft Intune to manage Windows devices. Users frequently work from public Wi-Fi and the security team is concerned about unmanaged devices accessing corporate resources. You need to ensure that only devices compliant with your security policies can access Microsoft 365 services. What should you implement?

A.Deploy Windows Autopilot for all devices and require Entra ID join

B.Configure Conditional Access policies in Microsoft Entra ID that require compliant devices

C.Configure a VPN profile in Intune and enforce device compliance on the VPN server

D.Create a compliance policy in Intune and assign it to all users

AnswerB

Conditional Access enforces access control based on device compliance status from Intune.

Why this answer

Conditional Access policies in Microsoft Entra ID can require that devices accessing Microsoft 365 services be marked as compliant by Intune. This ensures that only devices meeting your security policies (e.g., encryption, antivirus, OS patch level) are granted access, directly addressing the security team's concern about unmanaged devices on public Wi-Fi.

Exam trap

The trap here is that candidates often confuse creating a compliance policy (which only defines the rules) with enforcing it via Conditional Access (which actually blocks access), leading them to select Option D instead of B.

How to eliminate wrong answers

Option A is wrong because Windows Autopilot and Entra ID join streamline device provisioning and identity, but they do not enforce compliance checks at the point of access to Microsoft 365 services. Option C is wrong because configuring a VPN profile in Intune and enforcing compliance on the VPN server only controls access to the VPN tunnel, not to Microsoft 365 services directly; users could still access those services without going through the VPN. Option D is wrong because creating a compliance policy in Intune and assigning it to users only defines and reports compliance status; it does not enforce access blocking—Conditional Access is required to actually block non-compliant devices from accessing Microsoft 365.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 451–525