Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 451–525

Windows Autopilot self-deploying mode enrols devices with no user credentials, satisfying the zero-touch requirement, since it authenticates via the device's TPM-attested identity rather than an interactive sign-in. Pairing it with an Enrollment Status Page profile blocks device use until assigned required apps install, meeting the stem's gating constraint.

Intune's Win32 detection rules re-evaluate the detection file on each check-in. Because the file sits in a temporary folder that is periodically cleaned, the rule never finds it, so the app is reinstalled repeatedly. A stable, non-volatile detection path would satisfy the detection constraint.

Intune uses detection rules to determine if an app is installed. When an app is assigned as required, Intune periodically evaluates the detection rule. If the app is not detected, Intune reinstalls it. By ensuring a proper detection rule is configured, you enable Intune to detect the app's absence and automatically reinstall it, thus enforcing the required state. This is the correct method to ensure the app is reinstalled if removed.

The Microsoft Defender for Endpoint daemon provides the background scanning and protection service that macOS requires, satisfying the stem's demand for a mandatory component. Without this persistent service, real-time threat detection cannot run on the device, so it must be installed alongside the network extension and the application itself.

Without network connectivity the device cannot reach Intune or the content delivery service to download the app. Verifying connectivity confirms the device can actually receive policy and app payloads, ruling out a fundamental delivery blocker first.

To configure custom administrative template settings that are not built into Intune, you must first import the ADMX and ADML files. Intune allows you to upload custom ADMX files, which then make the corresponding settings available in the administrative templates profile. This is a prerequisite before you can create a profile that uses those settings.

Setting the install context to system runs the app's installer under the local SYSTEM account, which already holds full administrative rights on the device. This satisfies the stem's requirement that the Win32 app needs admin privileges to install, avoiding any user-context elevation prompt during Intune deployment.

When false, the warning is shown and BitLocker will not enable if other encryption exists.

App protection policies apply at the application layer, enforcing encryption and access controls on corporate data within managed apps. This enables selective wipe of corporate data from those apps while leaving personal data on the device untouched, which device-level compliance policies cannot achieve.

Capturing the hardware hash at the manufacturer or reseller lets it be uploaded to Microsoft Intune before shipping, so devices enrol automatically on first boot. Manual hash collection after delivery would delay provisioning and break the pre-shipment requirement.

Co-management requires the device to be enrolled in Microsoft Intune so the Intune service can receive policy and workload data alongside Configuration Manager. Without this enrolment, the Configuration Manager client alone cannot hand over workloads, so enrolment satisfies the stated prerequisite.

In an Intune compliance policy for Android Enterprise, the 'Rooted devices' setting can be set to 'Block'. When a device is detected as rooted, it is marked non-compliant. You can then use Conditional Access to block access to corporate email and other resources. This directly enforces the requirement.

An untrusted enterprise signing certificate causes iOS to block code execution at launch, so the app installs but terminates immediately. Trusting the certificate under Settings > General > VPN & Device Management resolves this. This satisfies the stem's constraint: the app is enterprise-signed, and iOS enforces certificate trust before allowing the binary to run.

Intune provides a built-in report called 'Devices without recent check-in' that lists devices that have not communicated with the service within a specified number of days. This report directly answers the requirement to find devices inactive for more than 30 days.

A device compliance policy defines passcode requirements, including minimum length, and marks devices non-compliant when unmet. Conditional Access then blocks corporate email access for non-compliant iOS devices, directly satisfying the six-character passcode constraint. Configuration profiles merely enforce settings without gating access, so they cannot restrict email by compliance state.

In Intune, you can assign a device configuration profile to a specific device group. By creating a group that contains only the co-managed devices, you ensure the profile applies only to them. This is the simplest and most direct method. It does not require any additional filtering or complex configuration, and it works regardless of the workload settings, as long as the devices are in the group.

Microsoft 365 Apps for Enterprise is published through Managed Google Play, so Intune deploys it to Android Enterprise work profiles as a Managed Google Play app type. This is the only supported app type for that scenario.

Shortcuts visible to every user must reside in the common Start menu path, typically under ProgramData\Microsoft\Windows\Start Menu\Programs. Installing in system context allows the installer to write to that machine-wide location. Ensuring the package itself creates the shortcut there, rather than only in the installing user's profile, guarantees all users on the device see it, which matches the requirement.

The compliance policy's passwordMinimumLength setting enforces a minimum character count, and the device's six-character password falls below the configured threshold, triggering non-compliance. This directly matches the stem's reported condition, where the password length is the sole identified deviation from policy requirements.

Modifying defenderDetectedMalwareActions for moderateSeverity directly controls the remediation action applied when Windows Defender Antivirus detects moderate-severity malware. The stem's constraint is that quarantine was applied instead of clean, so aligning this severity-specific action with the desired clean behaviour resolves the mismatch without affecting low, high, or severe thresholds.

Health attestation in a Microsoft Entra ID compliance policy reports TPM-measured boot state, verifying Secure Boot, BitLocker and code integrity before granting access. This satisfies the stem's requirement that only healthy devices reach Microsoft 365 services, since non-compliant devices are blocked by Conditional Access.

An internet connection during the out-of-box experience lets the device contact the Autopilot deployment service, download its assigned profile, and enrol into Microsoft Entra ID. Without connectivity at OOBE, profile retrieval fails and the device cannot complete the cloud-driven provisioning sequence.

The error message means Intune ran the installer, saw a success exit code, but then evaluated the detection rule and found no match, so it treats the install as failed. A detection rule that checks the wrong path, registry hive, or version on those devices explains why the same package succeeds elsewhere.

The iOS and macOS store app type deploys the Company Portal from the Apple App Store, which users need to enrol macOS devices into Intune. It satisfies the enrolment requirement because Company Portal is the agent that initiates macOS enrolment.

BitLocker reports Protection Off when valid key protectors, such as TPM, PIN, or recovery password, are absent or removed, even if the volume was previously encrypted. Intune's compliance policy therefore evaluates BitLocker as not enabled, marking the device non-compliant.

The SharedPC CSP exposes InactiveThreshold, which deletes local profiles not used within the specified number of days. This is the supported Intune mechanism for reclaiming disk space on shared or shift-based devices. It is applied through a settings catalog entry or custom OMA-URI, and it targets the exact behaviour required without affecting active users' profiles.

Self-deploying mode is designed for devices that require no user interaction. During OOBE, the device automatically joins Microsoft Entra ID and enrolls in Intune using the device's hardware hash and an assigned Autopilot profile. This mode is ideal for kiosks, digital signage, or shared devices where no user credentials are available or desired.

Microsoft Entra hybrid join requires the device to authenticate against an on-premises domain controller during the offline domain join process. A line of sight is essential. Configuring the profile for hybrid join is the correct first step because it enables the device to be joined to AD DS and registered in Microsoft Entra ID simultaneously. Without this setting, the device would only be Microsoft Entra joined, not hybrid joined.

Required for managed Google Play apps.

The assignment status for a configuration profile shows which devices received the profile and any errors during deployment. This is the quickest way to see if the email profile was successfully applied or if there were conflicts or failures that could explain the email issue.

Intune's Devices > Scripts node deploys shell scripts natively to macOS, executing them via the Intune management agent. This satisfies the requirement to run a script across all managed macOS devices without repackaging as an app.

A required intent with an allDevicesAssignmentTarget forces automatic installation on every enrolled device, with no user interaction or opt-out. This satisfies the stem's constraint: the assignment targets all devices rather than users or groups, so Intune pushes the Microsoft Store app silently to each enrolled device.

App Protection Policies apply MAM controls at the app layer, blocking copy-paste and data transfer from managed apps to personal apps, and support selective wipe that removes only corporate data, leaving personal content intact on the enrolled device.

'Access Denied' typically means the installer ran under the wrong account context. A Win32 app set to user context executes with standard user rights, so system-level writes fail. Verifying whether the app is configured for system context resolves the failure.

Windows Autopilot deploys Windows 10/11 by binding a device's hardware hash to a profile, so it enrols into Intune and receives configuration during the out-of-box experience, requiring no imaging infrastructure. This satisfies the question's requirement for a valid Intune-based deployment method.

The Attack surface reduction policy under Endpoint security in Intune is specifically designed to configure and enforce ASR rules. It provides a streamlined interface to set rules to Block, Audit, or Warn. When set to Block, the rules are enforced by Defender Antivirus and cannot be disabled by users, meeting the requirement.

Correct. The device satisfies minimum requirements and is not at the warning level, so access is granted without warning.

Intune includes a built-in report called 'Devices with stale check-in' that lists devices that have not checked in for a specified number of days. This report can be filtered to show devices not checked in for more than 30 days, directly answering the requirement.

Correct. The query summarizes unique devices by name.

A required app with a dependency will not install until the dependency app is successfully assigned to the same device and installed. Verifying the dependency's assignment and installation state first isolates whether the failure originates from the prerequisite rather than the LOB app itself.

Conditional access policies in Microsoft Entra ID evaluate device compliance state and can block access to cloud apps when a device is noncompliant. By requiring compliant devices, noncompliant devices are denied access to Microsoft 365 services. The timing depends on token lifetime and compliance re-evaluation, but this is the correct mechanism to enforce compliance-based access.

Automatic MDM enrollment for Windows devices is configured in Microsoft Entra ID under Mobility (MDM and MAM). By setting the MDM user scope to All or a specific group, synchronized users can automatically enroll their Windows 10 devices into Intune when they join or register the device in Microsoft Entra ID, which is the required first step.

The OMA-URI value 0 maps to the Security telemetry level, the minimum setting that sends only security-related data. This level is restricted to Enterprise editions, so Windows Pro devices would not apply it, matching the stated Enterprise-only constraint.

Windows Update for Business reports in Intune provide detailed error codes and failure reasons for quality and feature updates, including per-device data. This directly meets the requirement to see the error code without accessing the device, as the report aggregates telemetry from the device and surfaces the exact failure code.

Error 0x800f0831 indicates a missing servicing-stack or prerequisite update, not a network fault. Two weeks offline left the component store without the required cumulative prerequisites, so servicing cannot stage the Intune update. Reconnecting alone does not repair it; DISM /RestoreHealth or installing the prerequisite servicing stack update is needed.

Policy can trigger log upload to Intune.

Win32 apps in Intune allow you to specify the exact install command, including silent switches such as /quiet or /silent. By packaging the .exe with the Microsoft Win32 Content Prep Tool and providing the correct silent command, Intune can install the app without user interaction. This is the standard method for deploying custom .exe installers.

When you initiate a wipe action for an offline device, Intune queues the command. The device will receive and execute the wipe the next time it connects to the Intune service. This is standard behavior for remote actions on enrolled devices. The wipe will remove corporate data and, depending on the wipe type, may reset the device to factory settings. The command remains pending until the device checks in.

The Firewall setting in a Windows compliance policy checks whether the Windows Firewall is enabled on the device. Configuring this setting to 'Require' ensures devices with the firewall disabled are marked non-compliant, directly fulfilling the requirement.

A Conditional Access policy that requires compliant devices and uses the grant control 'Require device to be marked as compliant' will block access from devices that are not compliant. When a device becomes noncompliant, Intune marks it as such, and Conditional Access evaluates the device state. Access is typically blocked within minutes, meeting the 15-minute requirement. This is the correct approach to enforce compliance for access to corporate resources.

Group Policy delivers the automatic MDM enrolment task that hybrid Azure AD joined Windows devices require, triggering Intune enrolment via the device's domain membership. Configuring it here satisfies the hybrid join scenario, unlike manual or provisioning-package methods.

An app protection policy enforces data-transfer restrictions at the app layer, blocking copy, paste and share actions between managed work apps and unmanaged personal apps within the Android Enterprise work profile. This directly satisfies the stem's requirement to prevent corporate data leaking from work apps to personal apps.

Enrollment restrictions can block devices by platform, manufacturer, etc.

Error 0x80070005 is Access Denied, which for Microsoft 365 Apps deployment via the Intune management extension typically reflects insufficient rights to write to protected locations. Because the app requires elevation and the user lacks local administrator privileges, the installation cannot complete.

This is correct because a device configuration profile using the Windows Hello for Business template in Intune allows you to centrally configure PIN requirements. Assigning the profile to all Windows 11 devices ensures that the settings are applied automatically to each device, meeting the requirement for no user interaction and enforcing the minimum PIN length.

Intune provides a built-in app type for Microsoft 365 Apps. Selecting this type launches a wizard where you can configure update channel, version, and other settings. This is the correct method to deploy Microsoft 365 Apps using the dedicated wizard.

Attack surface reduction rules block risky behaviours such as Office macros spawning child processes, script downloads and credential theft, satisfying the requirement for device protection features. They are enforced through Microsoft Defender for Endpoint policy and configuration profiles, hardening endpoints against common malware vectors without relying on signature detection alone.

Windows Autopilot deployment profiles are used to configure the out-of-box experience (OOBE) for new devices. When a device is registered with Autopilot, the profile can automatically enroll the device in Intune, apply policies, and skip certain OOBE screens. This meets the requirement of minimal user interaction and automatic enrollment for non-domain-joined devices.

Packaging the app and script as a Win32 app allows you to define a custom installation command that can execute the installer followed by the PowerShell script. Intune runs the command as SYSTEM, and you can ensure the script runs only after successful installation by chaining commands with conditional execution. This meets the requirement without user interaction.

Correct. Wipe resets the device to factory settings.

A device configuration profile with the Kiosk settings configured for single-app mode assigns the store app as the sole full-screen experience on the Windows 10 device, satisfying the single-app kiosk constraint directly through Intune's built-in kiosk configuration.

Continuous access evaluation (CAE) enables near-real-time enforcement of Conditional Access policies by allowing Microsoft Entra ID to revoke access tokens when a device's compliance state changes, rather than waiting for token expiry. Combined with a compliant device requirement, CAE ensures that a noncompliant device is blocked within minutes, meeting the 5-minute requirement without user reauthentication.

An update ring's deadline setting forces installation within a defined window after release; setting it to 7 days directly satisfies the stem's requirement that devices install critical updates within 7 days, without relying on user-initiated checks.

Approval in managed Google Play is mandatory before an Android Enterprise fully managed device can install any app, even when it appears in the Company Portal. Unapproved apps remain unavailable to Intune, so the install silently fails. Checking approval status directly addresses the managed Play Store constraint in the stem.

For Android Enterprise personally-owned work profile devices, device restrictions profiles include settings to block installation of apps from unknown sources. This directly prevents sideloading and meets the requirement. Device restrictions are used to control features like camera, Bluetooth, and app installation sources on managed devices.

MSI apps deploy through the Intune management extension on Windows, so its logs record the actual installation failure reason. Devices showing 'Failed' have the agent present, making these logs the correct diagnostic source for the error code.

Correct. Feature update version targeting is a Windows Update for Business policy in Intune that allows you to specify a feature update version for devices to stay on.

Assigning the device configuration profile to a device group containing all devices delivers the Defender Antivirus real-time protection and Controlled Folder Access settings to every existing and future member. This satisfies the stem's efficiency constraint, since new devices joining the group inherit the settings automatically.

A compliance policy defines the rules a device must meet, such as encryption, PIN and OS version, and reports each device's state to Intune. Conditional Access then uses that state, so the policy is the prerequisite that produces the compliance signal.

Copying the built-in Windows security baseline preserves Microsoft's curated hardening settings, then lets you adjust only the BitLocker values required. The copy is assigned to your Windows 11 device groups through Microsoft Entra ID, satisfying the need for a custom baseline without rebuilding every setting manually.

App protection policies with session controls let Android 11.0 devices reach email without meeting the OS-version compliance bar, because Conditional Access evaluates Intune app protection as a separate grant control rather than device compliance. Corporate data stays contained through encryption, selective wipe and copy/paste restrictions, satisfying the requirement to protect data on non-compliant personal devices.

The endpoint protection configuration includes a firewall rule named 'Allow RDP' whose action is set to Block rather than Allow. This blocks inbound TCP 3389 traffic, preventing RDP connections even though the rule's name suggests otherwise.

The Windows quality updates report shows the status of monthly security and quality updates across managed devices. It includes data on which devices have installed or are pending specific quality updates, and you can filter by update name and time. This report directly provides the information needed to identify devices missing recent security updates.