Microsoft 365 Endpoint Administrator MD-102 MD-102 Questions 526–600 | Page 8/13

526

Multi-Selecthard

Your organization uses Microsoft Intune to manage devices. You need to ensure that only approved applications can run on Windows 10 devices. Which THREE components can you use to implement application control? (Choose three.)

Select 3 answers

A.Windows Information Protection (WIP).

B.Windows Defender Application Control (WDAC).

C.Intune application control policies.

D.AppLocker.

E.BitLocker drive encryption.

AnswersB, C, D

WDAC is a code integrity policy to control what apps can run.

Why this answer

Windows Defender Application Control (WDAC) is a code integrity feature that restricts which executables, scripts, and installers can run on Windows 10 devices. It uses a trust-based model where only binaries signed by approved publishers or with specific hash values are allowed, making it a core component for application control in an Intune-managed environment.

Exam trap

The trap here is that candidates often confuse Windows Information Protection (WIP) with application control because both involve 'policies' in Intune, but WIP is strictly for data loss prevention, not for blocking or allowing application execution.

Full explanation →

527

MCQhard

A Win32 app 'AdobeReader' is configured as 'required' but users report the app is not installed. The above log excerpt is from a device that shows 'Installed' in Intune. What is the most likely cause?

A.The detection script incorrectly reports the app as installed.

B.The app is assigned to a different device group.

C.The app was installed but later removed by the user.

D.The device is not syncing with Intune.

AnswerA

The script returns exit code 0 and stdout 'Installed', so Intune skips enforcement. The actual app may be missing.

Why this answer

The log excerpt indicates that Intune reports the app as 'Installed' on the device, yet users confirm it is not present. This discrepancy most likely occurs because the detection script used to verify installation is flawed—it may be checking for a registry key, file, or version string that exists even when the app is not fully installed, or it may be returning a false positive. Since Intune relies entirely on the detection method to determine installation status, an incorrect script would cause Intune to mark the app as installed without the actual binaries being present.

Exam trap

The trap here is that candidates assume 'Installed' in Intune means the app is physically present on the device, but Intune only reflects what the detection method reports, not the actual file system state.

How to eliminate wrong answers

Option B is wrong because if the app were assigned to a different device group, the device would not receive the required assignment at all, and Intune would not show the app as 'Installed'—it would show 'Not applicable' or 'Pending'. Option C is wrong because if the user removed the app, Intune's next sync would detect the absence via the detection script and reinstall the app (since it's required), or at minimum change the status to 'Failed' or 'Not installed'. Option D is wrong because if the device were not syncing, Intune would show a stale or 'Last check-in' status older than 24 hours, and the app status would likely be 'Pending' or 'Unknown', not 'Installed'.

Full explanation →

528

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a configuration profile that enforces FileVault encryption. The profile must allow recovery key escrow to Intune. After deploying the profile, you notice that some devices are not encrypted. What should you check first?

A.Check if the user has logged in and acknowledged the FileVault prompt.

B.Ensure that a compliance policy is also assigned requiring encryption.

C.Ensure the devices are supervised.

D.Verify that the profile is assigned to the correct device group.

AnswerA

FileVault requires user interaction to start encryption.

Why this answer

FileVault encryption on macOS requires user interaction to complete. When Intune deploys a FileVault profile with recovery key escrow, the user must log in and explicitly acknowledge the FileVault prompt to enable encryption. If the user has not done so, the device remains unencrypted regardless of the profile assignment.

Exam trap

The trap here is that candidates often assume a configuration profile alone enforces encryption immediately, overlooking the mandatory user interaction step required by macOS for FileVault activation.

How to eliminate wrong answers

Option B is wrong because compliance policies do not trigger encryption; they only report non-compliance after encryption is expected. Option C is wrong because macOS devices do not require supervision for FileVault encryption or key escrow; supervision is an iOS/iPadOS concept. Option D is wrong because if the profile were assigned to the wrong group, the profile would not appear on the device at all, but the issue here is that the profile is deployed yet encryption is not active, indicating a user interaction gap.

Full explanation →

529

Multi-Selectmedium

Which TWO troubleshooting steps should you take when a Windows 11 device fails to enroll in Intune with error code 0x80180014?

Select 2 answers

A.Ensure that the device is in the correct enrollment profile group.

B.Recreate the device compliance policy.

C.Check if the device is already enrolled in another MDM provider.

D.Verify that the user has an appropriate Intune license assigned.

E.Check if the device has TPM 2.0 enabled.

AnswersC, D

Device might be already enrolled elsewhere.

Why this answer

Error code 0x80180014 typically indicates that the device is already enrolled with another MDM provider, such as Microsoft Configuration Manager (with co-management) or a third-party MDM like VMware Workspace ONE. Intune enforces a single-MDM enrollment policy per device; if a prior MDM enrollment is detected, the new enrollment attempt fails. Checking for existing MDM enrollment is therefore the correct first step.

Exam trap

The trap here is that candidates often assume error 0x80180014 is a licensing or compliance issue, but Microsoft specifically uses this error code to signal a duplicate or conflicting MDM enrollment, not a missing license or policy misconfiguration.

Full explanation →

530

MCQmedium

You manage Windows 10 devices with Microsoft Intune. A user reports that a device has a red shield icon in the Windows Security Center, indicating tamper protection is off. You need to re-enable tamper protection on the device using Intune. Which profile type should you configure?

A.Device configuration profile (settings catalog)

B.Endpoint protection profile (Microsoft Defender Antivirus)

C.Security baseline (Windows 10/11)

D.Compliance policy

AnswerB

Tamper protection is configured within the Microsoft Defender Antivirus section of endpoint protection profiles.

Why this answer

Tamper protection is a Microsoft Defender Antivirus setting that prevents unauthorized changes to security features. In Intune, this setting is configured under the 'Endpoint protection profile' using the 'Microsoft Defender Antivirus' template, specifically via the 'Enable tamper protection to prevent Microsoft Defender being disabled' toggle. This profile type directly manages Defender settings, including tamper protection, and applies them to enrolled Windows 10 devices.

Exam trap

The trap here is that candidates confuse the 'Security baseline' (which applies many security settings but not tamper protection) with the 'Endpoint protection profile' (which specifically manages Defender features like tamper protection), leading them to select Option C incorrectly.

How to eliminate wrong answers

Option A is wrong because a Device configuration profile (settings catalog) can configure many Windows settings but does not include the specific tamper protection setting for Microsoft Defender Antivirus; tamper protection is only exposed through the Endpoint protection profile. Option C is wrong because a Security baseline (Windows 10/11) applies a predefined set of security policies, but tamper protection is not a setting within the baseline; it must be configured separately via an Endpoint protection profile. Option D is wrong because a Compliance policy evaluates device compliance against rules (e.g., requiring tamper protection to be on) but cannot enforce or enable tamper protection; it only reports non-compliance and can trigger remediation actions via other profiles.

Full explanation →

531

MCQmedium

Refer to the exhibit. You run this PowerShell command using the Microsoft Graph PowerShell SDK. What is the primary purpose of this command?

A.To list only non-compliant Windows devices.

B.To retrieve all managed devices regardless of operating system.

C.To enforce compliance on Windows devices.

D.To retrieve a list of all Windows managed devices with their compliance status.

AnswerD

Correct. The command selects complianceState for Windows devices.

Why this answer

The PowerShell command uses `Get-MgDeviceManagementManagedDevice` with a filter for `operatingSystem eq 'Windows'` and selects properties including `complianceState`. This retrieves all Windows managed devices and their compliance status, making option D correct. The command does not filter by compliance state, so it returns both compliant and non-compliant devices, and it does not enforce any compliance action.

Exam trap

The trap here is that candidates may assume the command only returns non-compliant devices because complianceState is selected, but the filter does not restrict by compliance value—it merely includes that property in the output.

How to eliminate wrong answers

Option A is wrong because the command does not filter by complianceState; it retrieves all Windows devices, not just non-compliant ones. Option B is wrong because the filter `operatingSystem eq 'Windows'` explicitly limits results to Windows devices, not all managed devices regardless of operating system. Option C is wrong because the command is a read-only GET operation that retrieves device data; it does not perform any enforcement or remediation actions on compliance.

Full explanation →

532

MCQeasy

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

A.Custom

B.Endpoint protection

C.Device restrictions

D.Device features

AnswerB

Endpoint protection profiles include security settings such as FileVault encryption for macOS.

Why this answer

'Endpoint protection' profiles include FileVault settings for macOS. Option A is incorrect because 'Custom' profiles are used for importing custom settings, not for encryption. Option C is incorrect because 'Device restrictions' contain general restrictions but not FileVault.

Option D is incorrect because 'Device features' include settings like wallpaper and lock screen, not encryption.

Full explanation →

533

MCQmedium

Refer to the exhibit. An Intune administrator created this device restrictions policy for Windows 10 devices. Which statement about the policy is true?

A.The policy will block access to the Microsoft Store and Cortana.

B.The policy will apply only to the primary user of the device.

C.The policy will prevent users from installing apps from outside the Microsoft Store.

D.The policy will block the camera on all devices.

AnswerA

Both Store and Cortana are set to Block.

Why this answer

The policy includes settings that block the Microsoft Store and Cortana. Option B is wrong because the policy does not block the camera; it allows it. Option C is wrong because the policy would apply to all users on the device.

Option D is wrong because the policy does not affect app installation from other sources.

Full explanation →

534

MCQhard

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You have deployed a device configuration profile that configures the device's email settings for the native Mail app. Recently, the organization decided to switch to Microsoft Outlook for iOS as the primary email client. You need to ensure that users can only use Outlook for accessing corporate email, and that the native Mail app is blocked from accessing corporate data. Which combination of Intune policies should you implement?

A.Create an App Protection Policy (MAM) that restricts the transfer of corporate data to other apps and a Device Configuration Profile that sets the default mail app to Outlook.

B.Create a device compliance policy that requires the device to have Outlook installed.

C.Use device enrollment restrictions to block devices that have the native Mail app installed.

D.Create a conditional access policy for Exchange Online that blocks the native Mail app and allows only Outlook.

AnswerA

MAM policy can block data transfer to native Mail, and configuration profile sets default app.

Why this answer

An App Protection Policy (MAM) can restrict corporate data access to only managed apps like Outlook, preventing the native Mail app from opening corporate data. Additionally, a Device Configuration Profile can set Outlook as the default mail app on iOS/iPadOS devices, effectively blocking the native Mail app from handling corporate email. Option B is incorrect because a device compliance policy requiring Outlook installation does not prevent the native Mail app from accessing data.

Option C is incorrect because device enrollment restrictions are for initial enrollment, not controlling app usage. Option D is incorrect because a conditional access policy can block the native Mail app from Exchange Online but does not set Outlook as the default mail app.

Full explanation →

535

Multi-Selecthard

Which THREE factors can cause a required app deployment to fail on a Windows 10 device managed by Intune? (Choose three.)

Select 3 answers

A.The device has an app update policy that blocks updates.

B.The device is not connected to the internet.

C.The user is not assigned to the app.

D.The device does not meet the app's requirement rules.

E.The app's dependency is not installed.

AnswersB, D, E

Internet connectivity is required to download the app.

Why this answer

Intune requires a device to have internet connectivity to communicate with the Microsoft Intune service and download required app deployments. Without internet access, the Intune Management Extension cannot retrieve the app assignment policy or download the application content from the cloud, causing the deployment to fail.

Exam trap

The trap here is that candidates often confuse 'app update policy' (which controls updates) with 'app deployment policy' (which controls initial installation), leading them to incorrectly select Option A as a cause of deployment failure.

Full explanation →

536

MCQeasy

Your organization is deploying Windows devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune when they are first powered on. What should you configure?

A.Join the device to Azure AD hybrid by configuring a domain join profile.

B.Create an Autopilot deployment profile with 'Assign to' set to 'All devices' and ensure the device is registered in Autopilot.

C.Configure the Enrollment Status Page (ESP) to require device enrollment.

D.Manually add the device serial number to Intune via the admin center.

AnswerB

This automatically enrolls the device in Intune during OOBE.

Why this answer

Windows Autopilot requires both a registered device (identified by hardware hash) and an assigned deployment profile to trigger automatic enrollment in Microsoft Intune during the first power-on. Setting 'Assign to' to 'All devices' ensures the profile applies to any registered Autopilot device, and the device registration step links the hardware identity to your tenant. Without this combination, the device will not automatically enroll.

Exam trap

The trap here is that candidates confuse the Enrollment Status Page (ESP) with the enrollment trigger itself, thinking ESP configuration alone enables automatic enrollment, when in fact ESP only manages the post-enrollment provisioning sequence.

How to eliminate wrong answers

Option A is wrong because joining a device to Azure AD hybrid via a domain join profile is a separate configuration for hybrid-joined devices and does not by itself trigger automatic Intune enrollment; Autopilot enrollment requires a deployment profile with enrollment settings. Option C is wrong because the Enrollment Status Page (ESP) controls the end-user experience during enrollment (e.g., blocking use until apps are installed) but does not initiate or enforce device enrollment; enrollment must already be configured via a deployment profile. Option D is wrong because manually adding a device serial number to Intune via the admin center registers the device for management but does not create an Autopilot deployment profile; without a profile assigned, the device will not automatically enroll during first power-on.

Full explanation →

537

MCQhard

An administrator is configuring Microsoft Entra ID Protection. They want to create a policy that automatically blocks sign-ins when the risk level is high. However, they notice that the policy is not triggering for some users who have high risk. What is the most likely reason?

A.The sign-in risk policy is overriding the user risk policy.

B.The users have MFA enabled, so they are exempt from risk policies.

C.The user risk policy is set to 'Report-only' mode instead of 'On'.

D.The policy is configured to apply only to a test group, and the affected users are not members.

AnswerC

Report-only mode only logs, does not block.

Why this answer

When a user risk policy is set to 'Report-only' mode, it evaluates risk and generates reports but does not enforce any actions such as blocking sign-ins. For automatic blocking to occur, the policy must be set to 'On' (enabled). The administrator likely configured the policy correctly in terms of risk level but overlooked the enforcement mode, which is a common misconfiguration in Microsoft Entra ID Protection.

Exam trap

The trap here is that candidates often assume a policy is automatically enforcing once configured with a risk level, overlooking the separate 'mode' setting that controls enforcement versus reporting-only behavior.

How to eliminate wrong answers

Option A is wrong because sign-in risk policies and user risk policies are independent; one does not override the other. They evaluate different risk types (sign-in vs. user) and can be configured separately. Option B is wrong because having MFA enabled does not exempt users from risk policies; in fact, MFA is often a remediation step, and risk policies can still block or require additional actions regardless of MFA status.

Option D is wrong because if the policy were configured to apply only to a test group and the affected users were not members, the policy would not apply at all, but the question states the policy is not triggering for some users who have high risk, implying it is applied but not enforcing—this points to a mode issue, not a scope issue.

Full explanation →

538

MCQhard

You are the Intune administrator for a company that uses Microsoft Entra ID (Azure AD) for identity. You have a line-of-business (LOB) iOS app that is distributed via Intune using volume purchase program (VPP) tokens. The app requires a configuration policy to set the server URL. You have assigned the app as 'Required' to all users in the 'Sales' group. Some users report that the app does not show the configured server URL. You verify that the app configuration policy is assigned to the same 'Sales' group. The app installs successfully. You check the Intune console and see that the app configuration policy has a status of 'Pending' for some devices. The devices are company-owned iPhones running iOS 16. What is the most likely cause of the configuration not applying?

A.The iOS version does not support app configuration

B.The app configuration policy is not assigned to the correct group

C.The devices are not supervised

D.The app is not deployed via VPP correctly

AnswerC

App configuration policies for VPP apps require supervised mode.

Why this answer

App configuration policies for iOS devices require the device to be supervised, especially when using VPP tokens. The 'Pending' status indicates the policy has not been applied because the devices are not supervised. Option A is wrong because the app installs successfully, indicating iOS version compatibility.

Option B is wrong because the policy is assigned to the same group, but supervision is still required. Option D is wrong because the app is deployed via VPP correctly; the issue is with configuration policy enforcement, not VPP deployment.

Full explanation →

539

Multi-Selectmedium

Your organization is deploying Windows 10 devices using Windows Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are required to set up Windows Hello for Business. Which TWO configurations should you apply?

Select 1 answer

A.Configure a Windows Autopilot deployment profile to require Windows Hello for Business.

B.Enable Azure AD device registration.

C.Configure a Windows Hello for Business policy in Intune device configuration.

D.Configure a Windows Hello for Business enrollment policy in Intune.

E.Deploy a custom script that enables Windows Hello.

AnswersD

The enrollment policy in Intune directly controls whether users must set up Windows Hello during OOBE.

Why this answer

Option D is correct. Configuring a Windows Hello for Business enrollment policy in Intune is sufficient to require users to set up Windows Hello during OOBE. Option C (device configuration policy) is not necessary for OOBE; it enforces settings after enrollment.

Option A is incorrect because Autopilot deployment profiles do not directly enforce Windows Hello; they only configure the OOBE experience. Option B (Azure AD device registration) is a prerequisite but not sufficient alone. Option E (custom script) is not a standard or recommended configuration for OOBE.

Full explanation →

540

MCQmedium

You are configuring Microsoft Intune for a school that provides iPads to students. You want students to be able to use their personal Apple IDs to install apps, but you need to ensure that the devices are enrolled in Intune and managed. Which Apple enrollment method should you use?

A.Apple Automated Device Enrollment (ADE) with user affinity

B.Apple Device Enrollment (ADE) with supervision and allow personal Apple IDs

C.Apple Device Enrollment (ADE) with Shared iPad mode

D.Apple User Enrollment

AnswerB

Supervised devices can allow personal Apple IDs while still being fully managed.

Why this answer

Apple Automated Device Enrollment (ADE) with supervision and allowing personal Apple IDs meets the school's requirements: devices are automatically enrolled in Intune, supervision enables full management control (e.g., blocking activation lock bypass), and allowing personal Apple IDs lets students install apps using their own accounts. This combination ensures devices are managed while preserving user flexibility.

Exam trap

The trap here is that candidates often confuse 'user affinity' with 'personal Apple IDs' or assume that any ADE enrollment requires managed Apple IDs, but ADE with supervision explicitly supports personal Apple IDs while still providing full management control.

How to eliminate wrong answers

Option A is wrong because ADE with user affinity associates the device with a specific user (e.g., using a managed Apple ID), which conflicts with the requirement to allow personal Apple IDs; user affinity typically requires a managed Apple ID for full management. Option C is wrong because Shared iPad mode is designed for multi-user scenarios (e.g., shared devices in a classroom) and does not support personal Apple IDs; it uses managed Apple IDs and caches user data locally. Option D is wrong because Apple User Enrollment is a lightweight enrollment method that does not provide full device supervision or management (e.g., it cannot enforce device-level restrictions like blocking activation lock), and it inherently uses managed Apple IDs, not personal Apple IDs.

Full explanation →

541

MCQeasy

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy Microsoft 365 Apps for enterprise to 500 devices. The devices are in a hybrid Azure AD joined configuration. The administrator wants to use Intune to deploy the apps. Which deployment method should the administrator use?

A.Use the Office Deployment Tool (ODT) to create a configuration file and deploy via Intune as a Win32 app.

B.Use Group Policy to deploy the Office 2019 suite.

C.Add a 'Microsoft 365 Apps for Windows 10 and later' app in Intune and assign it to the devices.

D.Upload the Office installation files as a line-of-business (LOB) app.

AnswerC

This is the recommended method for deploying Microsoft 365 Apps via Intune.

Why this answer

Intune provides a built-in 'Microsoft 365 Apps for Windows 10 and later' app type that is specifically designed to deploy and manage Microsoft 365 Apps for enterprise. This method uses Intune's native integration with the Office Content Delivery Network (CDN) to download and install the latest version of Office, and it supports hybrid Azure AD joined devices without requiring additional tools or configuration files.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing the Office Deployment Tool (Option A) because they think it provides more control, but they miss that Intune's native 'Microsoft 365 Apps' app type is the simplest and most appropriate method for standard deployments, especially when no custom XML configuration is required.

How to eliminate wrong answers

Option A is wrong because while the Office Deployment Tool (ODT) can be used to create a configuration file, deploying it as a Win32 app is unnecessarily complex and bypasses Intune's native Office app management capabilities, which provide automatic updates and simplified assignment. Option B is wrong because Group Policy is not an Intune deployment method; it relies on on-premises Active Directory and does not integrate with Intune for cloud-managed device deployment. Option D is wrong because uploading Office installation files as a line-of-business (LOB) app is intended for single-file or simple app packages, not for the multi-component, dynamically updated Microsoft 365 Apps suite, and it would require manual updates and lack the built-in configuration options.

Full explanation →

542

Multi-Selectmedium

A company manages devices with Microsoft Intune. They need to deploy a line-of-business (LOB) app to iOS devices. Which TWO of the following are required?

Select 2 answers

A.The app package must be in .ipa format

B.The app must have a unique bundle ID

C.The deployment must use 'Required' installation purpose

D.The app must be assigned to a user group only

E.Apple MDM push certificate must be configured

AnswersA, B

iOS LOB apps require .ipa format.

Why this answer

IOS line-of-business (LOB) apps must be packaged in the .ipa format, which is the standard iOS app package that Intune can deploy directly to devices. Intune uses the .ipa file to install the app on supervised or unsupervised iOS devices via the MDM channel, and the app must be signed with an Apple Developer Enterprise certificate or a distribution certificate.

Exam trap

The trap here is that candidates often confuse the general prerequisites for iOS management (like the Apple MDM push certificate) with the specific requirements for deploying an LOB app, leading them to select option E incorrectly.

Full explanation →

543

MCQmedium

You are planning to enroll macOS devices in Intune. Users must authenticate with their Microsoft Entra ID credentials and then be prompted to install the Company Portal app. Which enrollment method should you use?

A.User enrollment

B.Device enrollment (without user affinity)

C.Bring your own device (BYOD) enrollment

D.Automated device enrollment (with user affinity)

AnswerD

This uses Apple Business Manager and prompts for Microsoft Entra ID credentials.

Why this answer

Automated device enrollment (with user affinity) is correct because it uses Apple's Automated Device Enrollment (ADE) to supervise the device, enforce user authentication with Microsoft Entra ID, and automatically install the Company Portal app during setup. This method ensures the device is enrolled in Intune with a user context, which is required for the user to authenticate and receive the Company Portal prompt.

Exam trap

The trap here is that candidates often confuse 'Automated device enrollment' with 'Device enrollment (without user affinity)', mistakenly thinking that any automated enrollment method will prompt for user authentication and app installation, but without user affinity, the device is enrolled as a shared device with no user context.

How to eliminate wrong answers

Option A is wrong because User enrollment is designed for personally owned devices and does not support automated installation of the Company Portal app during setup; it requires manual installation and does not enforce supervision. Option B is wrong because Device enrollment (without user affinity) enrolls the device without a specific user, so users cannot authenticate with their Entra ID credentials, and the Company Portal app is not automatically installed. Option C is wrong because Bring your own device (BYOD) enrollment typically uses User enrollment or manual enrollment methods, not automated device enrollment, and does not guarantee the Company Portal app is installed automatically during the setup process.

Full explanation →

544

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 and iOS devices. You need to deploy a certificate-based authentication solution for Wi-Fi and VPN access. You have set up a Certificate Connector for Microsoft Intune and issued a root CA certificate. You have created a trusted certificate profile for the root CA and a SCEP certificate profile for client certificates. However, iOS devices are failing to enroll for client certificates. You verify that the SCEP profile is correctly configured and assigned. What is the most likely cause?

A.The Certificate Connector is not configured to support iOS devices.

B.iOS devices require user affinity for SCEP enrollment, which is not configured.

C.The SCEP profile does not reference the trusted certificate profile for the root CA, or the trusted certificate profile is not assigned to iOS devices.

D.The iOS devices are not compliant with the compliance policy.

AnswerC

iOS devices require a trusted certificate profile for the root CA to be deployed before the SCEP profile, and the SCEP profile must reference that trusted certificate. If the reference is missing or incorrect, the SCEP enrollment will fail.

Why this answer

For SCEP certificate enrollment on iOS devices, the trusted root CA certificate profile must be deployed first and the SCEP profile must reference it. If the reference is missing or the trusted profile is not assigned to the iOS devices, the SCEP enrollment will fail. Option A is incorrect because the Certificate Connector supports iOS devices.

Option B is incorrect because SCEP certificate profiles for device enrollment do not require user affinity; user affinity is only needed for user certificates. Option D is incorrect because device compliance policy is not a prerequisite for SCEP certificate enrollment; non-compliant devices can still enroll for certificates.

Full explanation →

545

MCQeasy

A company uses Microsoft Intune to manage devices. They need to report on which devices have a specific Windows update installed. Which reporting method should be used?

A.Use the Microsoft Intune admin center to view the Windows Update for Business report

B.Use Microsoft 365 Lighthouse

C.Use the Device compliance report in Intune

D.Use Microsoft Defender for Endpoint's advanced hunting

AnswerA

The Windows Update for Business report in Intune shows update status per device.

Why this answer

The Windows Update for Business report in the Microsoft Intune admin center provides a dedicated view of update compliance, including which devices have installed specific Windows updates. This report aggregates data from the Windows Update service and displays it per device, making it the correct method for identifying devices with a particular update installed.

Exam trap

The trap here is that candidates often confuse the Device compliance report (which checks OS version or build) with the Windows Update for Business report (which tracks specific KB installations), leading them to select Option C incorrectly.

How to eliminate wrong answers

Option B is wrong because Microsoft 365 Lighthouse is designed for multi-tenant management of Microsoft 365 services across customers, not for granular per-device Windows update reporting within a single tenant. Option C is wrong because the Device compliance report in Intune focuses on compliance policies (e.g., encryption, OS version) and does not track individual Windows update KB installations. Option D is wrong because Microsoft Defender for Endpoint's advanced hunting uses Kusto Query Language (KQL) to query security-related events and device information, but it is not the primary or recommended method for reporting on Windows update installation status; it requires custom queries and lacks the pre-built update-specific aggregation of the Windows Update for Business report.

Full explanation →

546

MCQmedium

You deploy a Windows 11 kiosk device using Intune. The kiosk should run a single app (Microsoft Edge). After assignment, the device starts but shows a blank screen. What is the most likely issue?

A.The kiosk profile is not correctly assigned.

B.The device is not assigned to a user.

C.The AUMID for Microsoft Edge is not specified.

D.The device is not running Windows 10/11 Enterprise.

AnswerC

Required for single-app kiosk.

Why this answer

The most likely issue is that the AUMID for Microsoft Edge is not specified in the kiosk profile. For a single-app kiosk on Windows 11, Intune requires the Application User Model ID (AUMID) to launch the app correctly. Without it, the kiosk shell cannot identify which executable to run, resulting in a blank screen instead of the Edge browser.

Exam trap

The trap here is that candidates assume a blank screen means a policy assignment failure or licensing issue, when in fact it is a configuration detail—the missing AUMID—that prevents the kiosk app from launching.

How to eliminate wrong answers

Option A is wrong because the kiosk profile assignment is verified by the device receiving the policy; a blank screen indicates the profile applied but the app failed to launch, not that assignment is missing. Option B is wrong because a kiosk device can be assigned to a device group without a user; user assignment is not required for single-app kiosk mode. Option D is wrong because Windows 11 Pro supports kiosk mode via Intune; only Windows 10/11 Enterprise or Education is required for multi-app kiosk or Assigned Access, but single-app kiosk works on Pro.

Full explanation →

547

MCQeasy

You manage a fleet of Android Enterprise devices. You need to ensure that only approved apps from the managed Play Store can be installed. What configuration should you enable?

A.Set the device to 'Fully managed' and disable unknown sources.

B.Deploy an app configuration policy that blocks sideloading.

C.Configure a device restriction policy to allow only managed Google Play apps.

D.Use a compliance policy to block non-compliant apps.

AnswerC

This policy enforces that only apps from the managed Play Store can be installed.

Why this answer

A device restriction policy in Microsoft Intune allows you to restrict app installation to only the managed Google Play store. By configuring the 'Allow only managed Google Play apps' setting, you ensure that users cannot install apps from unapproved sources, effectively controlling the app ecosystem on Android Enterprise devices.

Exam trap

The trap here is that candidates often confuse reactive compliance policies (which detect non-compliant apps after installation) with proactive device restriction policies (which prevent installation entirely), leading them to choose Option D instead of the correct proactive setting.

How to eliminate wrong answers

Option A is wrong because setting the device to 'Fully managed' and disabling unknown sources does not restrict installations to only managed Google Play apps; it only prevents sideloading from unknown sources, but users could still install apps from the public Play Store. Option B is wrong because an app configuration policy is used to configure app-specific settings (e.g., account credentials or permissions), not to block sideloading or restrict app sources; blocking sideloading is a device restriction. Option D is wrong because a compliance policy can mark devices as non-compliant if non-approved apps are detected, but it does not prevent installation of those apps in the first place; it only reacts after the fact.

Full explanation →

548

MCQeasy

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a security baseline that enforces BitLocker encryption and Windows Defender Antivirus settings. What is the recommended approach?

A.Create a custom configuration profile using Configuration Manager.

B.Deploy a PowerShell script via Intune to configure the settings.

C.Use the built-in Windows 10 security baseline in Intune.

D.Apply Group Policy Objects from on-premises Active Directory.

AnswerC

Security baselines are pre-configured policy templates.

Why this answer

The recommended approach is to use the built-in Windows 10 security baseline in Intune (Option C). Intune provides pre-configured security baselines that include settings for BitLocker encryption and Windows Defender Antivirus, which can be customized as needed. Option A is incorrect because custom configuration profiles do not provide the pre-built baseline and are more manual.

Option B is incorrect because PowerShell scripts are not a baseline and are less manageable at scale. Option D is incorrect because Group Policy from on-premises AD is not integrated with Intune and requires hybrid infrastructure.

Full explanation →

549

MCQeasy

A company uses Microsoft Intune to manage macOS devices. They need to enforce FileVault encryption on all Macs. What should they configure?

A.An endpoint security policy for disk encryption.

B.A device configuration profile with FileVault settings.

C.A device compliance policy that requires FileVault.

D.An app protection policy.

AnswerB

Device configuration profiles can enforce FileVault on macOS.

Why this answer

FileVault encryption on macOS is enforced through a device configuration profile in Microsoft Intune. Specifically, you create a settings catalog or a custom profile that includes the FileVault settings under the 'System Preferences' > 'Security & Privacy' category, which allows you to require FileVault and escrow the recovery key to Intune. This is the native Intune method for managing macOS disk encryption, as endpoint security policies for disk encryption are designed for Windows BitLocker, not macOS.

Exam trap

The trap here is that candidates confuse 'endpoint security policies' (which are Windows-only for disk encryption) with device configuration profiles (which handle macOS FileVault), leading them to select Option A instead of B.

How to eliminate wrong answers

Option A is wrong because endpoint security policies for disk encryption in Intune are specifically designed for Windows devices (BitLocker) and do not support macOS FileVault; macOS encryption must be configured via device configuration profiles. Option C is wrong because a device compliance policy can check if FileVault is enabled and mark non-compliant devices, but it cannot enforce or enable FileVault encryption itself—it only reports compliance status and can trigger conditional access blocks. Option D is wrong because app protection policies manage data protection at the application level (e.g., preventing copy/paste from managed apps) and do not control device-level encryption like FileVault.

Full explanation →

550

MCQeasy

A company uses Windows Autopilot for user-driven deployments. They want to ensure that during the out-of-box experience (OOBE), users are required to sign in with their Azure AD credentials and the device is automatically enrolled in Intune. Which Autopilot deployment profile setting should be configured?

A.Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as' to 'Azure AD joined'.

B.Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Hybrid Azure AD joined'.

C.Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to 'Azure AD joined'.

D.Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Azure AD joined'.

AnswerD

This requires user sign-in and enrolls device in Intune.

Why this answer

The scenario requires a user-driven deployment where the user signs in with Azure AD credentials during OOBE, and the device is automatically enrolled in Intune. Setting 'Deployment mode' to 'User-Driven' ensures the user authenticates during OOBE, and 'Join to Azure AD as' to 'Azure AD joined' makes the device Azure AD-joined, which triggers automatic Intune enrollment via the MDM enrollment authority configured in Azure AD.

Exam trap

The trap here is that candidates often confuse 'Self-Deploying' with 'User-Driven' because both can result in Azure AD join and Intune enrollment, but 'Self-Deploying' does not require user sign-in during OOBE, which is explicitly required in the question.

How to eliminate wrong answers

Option A is wrong because 'Self-Deploying' mode does not require user sign-in during OOBE; it uses a device token for automatic enrollment, which contradicts the requirement for user Azure AD credentials. Option B is wrong because 'Hybrid Azure AD joined' requires the device to be joined to an on-premises Active Directory and then registered with Azure AD, which is not the scenario described and does not rely solely on Azure AD credentials during OOBE. Option C is wrong because 'White Glove' (now called 'Pre-Provisioning') is a technician-driven process that pre-provisions the device before the user receives it, and the user still signs in later, but the question specifies that users sign in during OOBE, not that a technician pre-provisions.

Full explanation →

551

MCQeasy

An organization wants to enforce encryption on all Windows 10/11 devices using Intune. Which policy type should they use?

A.Device compliance policy

B.App protection policy

C.Device configuration profile (settings catalog)

D.Endpoint security disk encryption policy

AnswerD

This policy is designed to enforce BitLocker settings.

Why this answer

The Endpoint security disk encryption policy in Intune is specifically designed to enforce encryption (e.g., BitLocker) on Windows 10/11 devices. It provides a dedicated, streamlined interface for configuring encryption settings and monitoring compliance, unlike general device configuration profiles which require manual setup via the settings catalog. This policy type is the correct choice because it directly targets disk encryption as a security baseline, aligning with the organization's goal to enforce encryption across all managed devices.

Exam trap

The trap here is that candidates often confuse Device compliance policy (which only checks encryption status) with a policy that actually enforces encryption, or they assume the settings catalog is the only way to configure BitLocker, missing the purpose-built Endpoint security disk encryption policy.

How to eliminate wrong answers

Option A is wrong because Device compliance policy evaluates whether devices meet compliance rules (e.g., encryption status) but does not enforce or configure encryption settings; it only reports non-compliance. Option B is wrong because App protection policy applies to mobile apps and data at the app level (e.g., MAM), not to the operating system or disk encryption on Windows devices. Option C is wrong because Device configuration profile (settings catalog) can configure BitLocker settings, but it is a general-purpose tool that requires manual selection of individual settings, whereas Endpoint security disk encryption policy provides a purpose-built, policy-driven approach with built-in monitoring and reporting for encryption enforcement.

Full explanation →

552

MCQhard

Your company has a Microsoft Intune environment with Windows devices. You need to deploy a Microsoft 365 Apps update using the Semi-Annual Enterprise Channel. You have configured the update channel in an Intune administrative template. However, devices are not receiving the updates. What is the most likely cause?

A.The administrative template does not configure the update channel; you must use the Office Deployment Tool.

B.Devices are not configured for Windows Update for Business.

C.Devices need to be in the Semi-Annual Channel (Targeted) to receive updates.

D.The Semi-Annual Enterprise Channel is not supported for Microsoft 365 Apps.

AnswerA

Intune requires ODT for update channel configuration.

Why this answer

When you configure the update channel for Microsoft 365 Apps via an Intune administrative template (ADMX), the setting is applied as a Group Policy preference but does not actually trigger the update mechanism. Microsoft 365 Apps updates require the Office Deployment Tool (ODT) or the Office CDN to deliver the correct channel bits. The administrative template only sets the registry key for the channel; without the ODT or a corresponding update policy, devices remain on their current channel and do not receive new updates.

Exam trap

The trap here is that candidates assume configuring the update channel via an administrative template is sufficient to change the channel and trigger updates, when in fact the template only sets a registry value and does not initiate the actual update process.

How to eliminate wrong answers

Option B is wrong because Windows Update for Business (WUfB) is not required for Microsoft 365 Apps updates; these updates are delivered independently via the Office Content Delivery Network (CDN) and managed through Office-specific policies, not Windows Update. Option C is wrong because the Semi-Annual Channel (Targeted) is a separate channel that receives updates earlier, but the Semi-Annual Enterprise Channel is a valid, supported channel; the issue is not about targeting but about the deployment mechanism. Option D is wrong because the Semi-Annual Enterprise Channel is fully supported for Microsoft 365 Apps; it is one of the standard update channels designed for enterprise environments.

Full explanation →

553

Multi-Selectmedium

You are an enterprise administrator for Contoso Ltd. You need to configure Microsoft 365 tenant-wide settings for external collaboration. Which TWO actions should you take to meet the following goals: (1) allow only specific external domains to collaborate with your organization, and (2) ensure that external users are required to sign in with multi-factor authentication (MFA) before accessing shared resources?

Select 2 answers

A.Disable external sharing in the Microsoft 365 admin center for all workloads.

B.Configure the SharePoint and OneDrive domain allowlist to include only the approved external domains.

C.Configure the SharePoint and OneDrive domain blocklist to exclude all external domains except the approved ones.

D.Create a Conditional Access policy in Azure AD that requires MFA for all external users accessing your tenant.

E.Enable B2B direct connect in the cross-tenant access settings for the approved external domains.

AnswersB, D

This restricts sharing to only the domains in the allowlist, meeting goal 1.

Why this answer

Configuring the SharePoint and OneDrive domain allowlist restricts external sharing to only the approved external domains, meeting the first goal. Option D is correct because a Conditional Access policy in Azure AD can require MFA for all external users, satisfying the second goal by enforcing authentication requirements before access to shared resources.

Exam trap

The trap here is that candidates often confuse domain allowlists with blocklists, or assume that B2B direct connect settings (which manage cross-tenant access for Teams) can enforce MFA, when in fact only Conditional Access policies provide that control for external users accessing shared resources.

Full explanation →

554

Multi-Selecthard

Which TWO components are required for a successful Windows Autopilot deployment with user-driven Microsoft Entra ID join? (Select two.)

Select 2 answers

A.Enrollment Status Page (ESP) configuration.

B.Device registration in the Autopilot service using hardware hash.

C.On-premises Active Directory domain join.

D.Windows Autopilot deployment profile in Intune.

E.Microsoft Configuration Manager co-management.

AnswersB, D

Device registration is essential to associate the device with the Autopilot service and trigger the deployment profile.

Why this answer

For a user-driven Windows Autopilot deployment with Microsoft Entra ID join, the required components are device registration in the Autopilot service using hardware hash and a Windows Autopilot deployment profile in Intune. The Enrollment Status Page (ESP) is optional and not required for a successful deployment. On-premises Active Directory domain join is not needed because the device joins Microsoft Entra ID, and Configuration Manager co-management is optional.

Exam trap

The trap here is that candidates often confuse the optional Enrollment Status Page with a mandatory component, or they mistakenly believe on-premises Active Directory join is required for user-driven Autopilot, when in fact Microsoft Entra ID join is a separate, cloud-native identity option.

Full explanation →

555

MCQhard

Contoso Ltd. is a financial services company with 2,000 users. They use Microsoft Intune to manage Windows 10 devices. The company has a strict security policy that requires all devices to have a specific set of security applications installed: an antivirus (AV) app, a disk encryption app, and a VPN client. These apps are all line-of-business (LOB) Win32 apps packaged as .intunewin files. The administrator created a Win32 app for each and assigned them as 'Required' to all devices. After the deployment, the administrator notices that the apps are not installing on approximately 10% of devices. The devices are online and have connectivity. The Intune Management Extension is running. When the administrator checks the Intune Management Extension logs on a failing device, they see the following error: 'Failed to download content. Error: 0x80070002 - The system cannot find the file specified.' What is the most likely cause?

A.The content for the Win32 app was not uploaded correctly or is missing from Intune.

B.The Intune Management Extension does not have permission to install apps on those devices.

C.The user is not logged in, so the app cannot be installed.

D.The app detection rules do not match the installed version.

AnswerA

The error indicates the file cannot be found, suggesting the content is missing.

Why this answer

The error 0x80070002 ('The system cannot find the file specified') in the Intune Management Extension logs indicates that the client is attempting to download the Win32 app content from Intune, but the content blob is missing or inaccessible. This typically occurs when the .intunewin file was not uploaded correctly, the upload was interrupted, or the content was deleted from Intune after assignment. Since the extension is running and connectivity is confirmed, the issue is server-side content availability, not client-side permissions or detection logic.

Exam trap

The trap here is that candidates often confuse a download failure with a detection rule mismatch or permission issue, but the specific error code 0x80070002 points directly to missing content on the server side, not client-side configuration problems.

How to eliminate wrong answers

Option B is wrong because the Intune Management Extension runs as SYSTEM and does not require additional permissions to install apps; a permission issue would manifest as an access denied error, not a 'file not found' error. Option C is wrong because Win32 apps assigned as 'Required' install in the system context regardless of user login state; user presence is irrelevant for system-context installations. Option D is wrong because detection rules only affect whether the app is considered installed after the download and installation attempt; they do not cause a download failure with error 0x80070002, which occurs before any detection logic runs.

Full explanation →

556

MCQeasy

You need to enable users to install company apps from a private store on their iOS devices. Which Microsoft Intune feature should you use?

A.Volume Purchase Program (VPP)

B.Mobile Application Management (MAM) policies

C.Certificate profiles

D.Company Portal app

AnswerA

VPP enables distribution of licensed apps to devices.

Why this answer

The Volume Purchase Program (VPP) is the correct feature because it allows organizations to purchase app licenses in bulk from Apple and distribute them to users' iOS devices through a private store. By integrating VPP with Microsoft Intune, you can assign licensed apps to users or devices, enabling them to install company-approved apps from a private store without requiring an Apple ID or personal payment.

Exam trap

The trap here is that candidates confuse the Company Portal app (the user-facing installation interface) with the underlying licensing and distribution mechanism (VPP) that actually enables the private store functionality.

How to eliminate wrong answers

Option B is wrong because Mobile Application Management (MAM) policies control app behavior (e.g., data protection, access requirements) but do not provide a mechanism to distribute or install apps from a private store. Option C is wrong because certificate profiles are used for authentication and secure communication (e.g., Wi-Fi, VPN, email profiles), not for app distribution or store configuration. Option D is wrong because the Company Portal app is the client interface for users to access and install apps, but it is not the feature that enables the private store; the private store is enabled by VPP integration, and Company Portal simply presents the apps.

Full explanation →

557

MCQeasy

Your organization uses Microsoft Intune to manage Android enterprise devices. You need to ensure that only approved apps from the managed Google Play store can be installed on work profiles. Which configuration should you use?

A.Configure a device compliance policy that requires 'Allow installation from unknown sources' to be disabled

B.Use a conditional access policy to block unapproved apps

C.Create an app configuration policy that blocks side-loading

D.Assign a device restriction policy that sets 'Allow all apps' to false

AnswerA

Disabling unknown sources restricts installation to managed Google Play.

Why this answer

A device compliance policy that requires 'Allow installation from unknown sources' to be disabled ensures that only apps from the managed Google Play store can be installed on Android Enterprise work profiles. This setting prevents side-loading of apps from untrusted sources, which is the primary mechanism to enforce app approval in a managed environment. Intune compliance policies evaluate this setting and can trigger conditional access or mark devices as non-compliant if unknown sources are enabled.

Exam trap

The trap here is that candidates often confuse compliance policies (which enforce device-level settings like unknown sources) with app configuration policies (which manage app-specific settings) or conditional access (which controls resource access), leading them to select options that do not directly control app installation sources.

How to eliminate wrong answers

Option B is wrong because conditional access policies control access to cloud resources based on signals like device compliance or location, but they do not directly block the installation of unapproved apps on the device itself. Option C is wrong because an app configuration policy is used to deliver settings to managed apps (like restricting copy/paste or data transfer), not to block side-loading or control app installation sources. Option D is wrong because 'Allow all apps' is not a valid setting in Android Enterprise device restriction policies; the correct approach is to use the 'Allow installation from unknown sources' compliance setting to restrict app sources.

Full explanation →

558

MCQeasy

You need to ensure that Windows 10 devices automatically enroll in Intune when they join Microsoft Entra ID. Which setting should you configure?

A.Compliance policies in Intune

B.MDM user scope in Microsoft Entra ID

C.Co-management slider in Configuration Manager

D.Enrollment device platform restrictions in Intune

AnswerB

This sets the scope of users who will auto-enroll their devices.

Why this answer

The MDM user scope setting in Microsoft Entra ID (formerly Azure AD) controls which users can automatically enroll their Windows 10 devices into Intune when they join Entra ID. When set to 'All' or 'Some', the device triggers automatic MDM enrollment during the Entra ID join process using the MDM enrollment protocol (MS-MDE), eliminating the need for manual enrollment steps.

Exam trap

The trap here is that candidates often confuse the MDM user scope (which controls the automatic enrollment trigger) with enrollment restrictions or compliance policies, which only apply after the enrollment process has already started.

How to eliminate wrong answers

Option A is wrong because compliance policies in Intune evaluate device compliance after enrollment, not trigger or configure automatic enrollment. Option C is wrong because the co-management slider in Configuration Manager controls workload distribution between ConfigMgr and Intune for already-managed devices, not the initial automatic enrollment of Windows 10 into Intune during Entra ID join. Option D is wrong because enrollment device platform restrictions in Intune block or allow enrollment based on platform or version after the enrollment attempt is initiated, but do not enable or configure the automatic enrollment trigger itself.

Full explanation →

559

MCQhard

Your organization uses Microsoft Defender for Endpoint (Defender XDR) and Intune. You need to ensure that when a device is found to have a critical vulnerability, a remediation action is automatically triggered. Which integration should you configure?

A.Configure a Microsoft Sentinel playbook.

B.Configure a Microsoft Foundry AI model.

C.Configure a Microsoft Purview data loss prevention policy.

D.Configure the integration between Microsoft Defender for Endpoint and Microsoft Intune.

AnswerD

The integration between Microsoft Defender for Endpoint and Microsoft Intune allows automatic remediation actions (e.g., patch deployment, device quarantine) when critical vulnerabilities are found.

Why this answer

Microsoft Defender for Endpoint can integrate with Microsoft Intune to automatically trigger remediation actions when critical vulnerabilities are found. Option A is incorrect because Microsoft Sentinel is a SIEM and SOAR platform; while it can automate responses, it is not the direct integration for Intune remediation. Option B is incorrect because Microsoft Foundry is an AI platform, not used for device remediation.

Option C is incorrect because Microsoft Purview focuses on data governance and compliance, not device remediation.

Full explanation →

560

MCQhard

You are deploying a Win32 app that requires administrator privileges to install. The app runs on Windows 11 devices. How should you configure the app in Intune to ensure it installs with elevated privileges?

A.Set the app install behavior to 'System'.

B.Set the app to run in user context.

C.Use a PowerShell script to run the installer.

D.Configure a detection rule to check for admin rights.

AnswerA

System context runs the installer with elevated privileges.

Why this answer

Setting the install behavior to 'System' in Intune for a Win32 app ensures the installer runs with the SYSTEM account, which inherently has administrator privileges. This is required for apps that demand elevated rights during installation, as the SYSTEM account bypasses user account control (UAC) and can write to protected system locations like Program Files or the registry.

Exam trap

The trap here is that candidates often confuse 'install behavior' with 'detection rules' or 'script execution,' mistakenly thinking a PowerShell script or a detection rule can enforce elevation, when in fact only the 'System' context setting in Intune ensures the installer runs with the necessary administrator privileges.

How to eliminate wrong answers

Option B is wrong because setting the app to run in user context executes the installer with the logged-on user's permissions, which typically lack the administrator privileges needed for this app, causing installation failure. Option C is wrong because using a PowerShell script to run the installer does not inherently elevate privileges; the script runs under the same context as the Intune deployment agent unless explicitly configured with a separate elevation mechanism, which is not specified. Option D is wrong because configuring a detection rule to check for admin rights does not grant or enforce elevation during installation; detection rules only verify whether the app is already installed, not how it installs.

Full explanation →

561

MCQhard

You are designing a device management strategy for a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You need to ensure that devices are managed by Intune and can access on-premises resources. Which approach should you recommend?

A.Hybrid Azure AD join

B.Entra ID registered with on-premises domain join

C.Windows Autopilot self-deploying mode

D.Entra ID joined with VPN to on-premises

AnswerA

Hybrid Azure AD join allows devices to be joined to both on-premises AD and Entra ID, enabling Intune management and on-premises resource access.

Why this answer

Hybrid Azure AD join is the correct approach because it allows devices that are joined to on-premises Active Directory to also register with Microsoft Entra ID, enabling Intune management while maintaining access to on-premises resources via Kerberos/NTLM authentication. This configuration synchronizes the device object from AD to Entra ID using Azure AD Connect, creating a device identity that can be managed by Intune and can authenticate against both cloud and on-premises services without requiring a VPN.

Exam trap

The trap here is that candidates often confuse 'Entra ID registered' with 'Hybrid Azure AD join' because both involve Entra ID, but only Hybrid Azure AD join provides the on-premises domain join required for seamless resource access without a VPN.

How to eliminate wrong answers

Option B is wrong because Entra ID registered devices are only workplace-joined (personal or BYOD) and do not have a computer object in on-premises AD, so they cannot authenticate to on-premises resources using domain credentials or access domain-joined file shares without additional configuration. Option C is wrong because Windows Autopilot self-deploying mode is designed for kiosk or shared devices that are Entra ID joined only, not hybrid joined, and thus cannot natively access on-premises resources without a VPN or other connectivity solution. Option D is wrong because Entra ID joined devices with a VPN can access on-premises resources, but they are not domain-joined and therefore cannot use Kerberos authentication to on-premises AD; they rely on VPN connectivity and typically require additional solutions like Microsoft Entra application proxy or Always On VPN for seamless resource access, making it less integrated than Hybrid Azure AD join.

Full explanation →

562

MCQmedium

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

A.Confirm that the Intune Service to Service Connector is configured.

B.Verify that the Company Portal app is installed and updated on the device.

C.Check that the enrollment token has not expired.

D.Ensure Device Administrator enrollment is enabled.

AnswerB

The Company Portal app is required for Android Enterprise work profile enrollment.

Why this answer

In Android Enterprise personally-owned work profiles, the Company Portal app is required to initiate and complete the enrollment process. If the app is missing or outdated, the device cannot receive the management profile, even if enrollment restrictions allow Android Enterprise. Ensuring the Company Portal is installed and updated is the immediate next step after verifying that Android Enterprise is allowed.

Exam trap

The trap here is that candidates often confuse enrollment tokens (used for Android Enterprise dedicated or fully managed devices) with the enrollment method for personally-owned work profiles, leading them to incorrectly check token expiration instead of verifying the Company Portal app.

How to eliminate wrong answers

Option A is wrong because the Intune Service to Service Connector is used for Apple Device Enrollment Program (DEP) or VPP integration, not for Android Enterprise enrollment. Option C is wrong because enrollment tokens are used for Android Enterprise dedicated devices (kiosk mode) or fully managed devices, not for personally-owned work profiles, which use a different enrollment method (Google Play account-based). Option D is wrong because Device Administrator enrollment is a legacy method for Android devices and is not used for Android Enterprise personally-owned work profiles; enabling it would not resolve the issue and could conflict with modern management.

Full explanation →

563

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

A.Ensure the device is running Windows 10 Enterprise.

B.Run the Policy Manager tool on the device.

C.Verify the device is a member of the assigned device group.

D.Check the device's notification area for a policy update prompt.

AnswerC

If the device is not in the group, the policy won't apply. This is the first troubleshooting step.

Why this answer

The most common reason a kiosk mode profile fails to apply is that the device is not a member of the assigned device group. Intune evaluates policy targeting based on group membership; if the device is missing from the group, the profile will never be delivered. Verifying group membership is the first logical troubleshooting step before investigating device-level issues.

Exam trap

The trap here is that candidates often assume the issue is a licensing or edition requirement (Windows 10 Enterprise) when the real problem is almost always a misconfigured or missing group assignment in Intune.

How to eliminate wrong answers

Option A is wrong because Windows 10 Pro also supports kiosk mode via assigned access, so Enterprise is not a strict prerequisite. Option B is wrong because the Policy Manager tool (rsop.msc) is used for Group Policy, not Intune MDM policies; Intune policies are managed via the MDM sync and the device's Settings app. Option D is wrong because Intune does not display a policy update prompt in the notification area; policy sync is silent or triggered manually via Settings > Accounts > Access work or school > Info > Sync.

Full explanation →

564

Matchingmedium

Match each Microsoft 365 Apps update channel to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Monthly updates with new features first

Monthly security and quality updates

Updates twice a year (January and July)

Early access to upcoming features

Insider builds for testing

Why these pairings

Update channels control how Microsoft 365 Apps are updated, relevant for MD-102.

Full explanation →

565

MCQeasy

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft Outlook is protected even if the device is not enrolled in MDM. Which policy should you deploy?

A.Device compliance policy

B.Device configuration profile

C.Conditional Access policy

D.App protection policy (MAM)

AnswerD

MAM policies protect app data without device enrollment.

Why this answer

App protection policies (MAM) protect corporate data in apps like Outlook without requiring device enrollment in MDM. Option A (Device compliance policy) requires MDM enrollment. Option B (Device configuration profile) is for device settings, not data protection.

Option C (Conditional Access policy) controls access but does not directly protect data within apps.

Full explanation →

566

MCQeasy

You are deploying Windows 10 devices using Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are blocked from bypassing the sign-in screen by clicking 'Skip for now'. Which setting should you configure in the Enrollment Status Page (ESP) profile?

A.Block user from signing in automatically

B.Block Windows Setup page

C.Require device compliance

D.Block device setup failure

AnswerA

This setting forces users to sign in with their Microsoft account during OOBE.

Why this answer

The correct setting is 'Block user from signing in automatically' in the Enrollment Status Page (ESP) profile. This setting prevents users from bypassing the sign-in screen by clicking 'Skip for now' during OOBE. When enabled, the device forces the user to complete authentication before proceeding, ensuring proper enrollment.

Exam trap

Candidates often confuse ESP settings with Autopilot deployment profile settings. The key is to recognize that only the 'Block user from signing in automatically' setting directly prevents skipping the sign-in screen during OOBE.

How to eliminate wrong answers

Option B is wrong because 'Block Windows Setup page' is not a valid setting in the ESP profile; Windows Setup pages are controlled by the Autopilot deployment profile, not the ESP. Option C is wrong because 'Require device compliance' is a conditional access policy or compliance setting, not an ESP configuration, and it does not block the 'Skip for now' button during OOBE. Option D is wrong because 'Block device setup failure' is not a real ESP setting; the ESP can be configured to show or skip the setup failure page, but it does not prevent users from bypassing the sign-in screen.

Full explanation →

567

MCQeasy

You are managing Windows 10 devices with Intune. You need to deploy a PowerShell script that runs under the system context during device enrollment. Which approach should you use?

A.Deploy the script as a proactive remediation.

B.Use a device compliance policy to trigger the script.

C.Create a custom configuration profile to run the script.

D.Upload the script as a PowerShell script in Intune and assign it to the device group.

AnswerD

Intune PowerShell scripts can run in system context and execute during enrollment.

Why this answer

Intune's 'PowerShell scripts' feature allows you to upload and assign scripts that run under the system context during device enrollment, specifically targeting devices in a group. This is the only native Intune method that executes scripts in the system context at enrollment time without additional configuration.

Exam trap

The trap here is that candidates confuse the 'PowerShell scripts' feature with proactive remediations or custom configuration profiles, not realizing that only the dedicated PowerShell script deployment runs under the system context during enrollment.

How to eliminate wrong answers

Option A is wrong because proactive remediations run on a schedule or on detection, not during device enrollment, and they require the Intune Management Extension to be already installed. Option B is wrong because device compliance policies evaluate device settings and trigger non-compliance actions, but they cannot execute arbitrary PowerShell scripts during enrollment. Option C is wrong because custom configuration profiles use CSPs (Configuration Service Providers) to configure settings, not to run arbitrary PowerShell scripts; they lack a mechanism to execute script files.

Full explanation →

568

MCQmedium

Your organization has Windows 10 devices managed by Intune. You need to enforce BitLocker encryption on all devices. The devices must use a TPM protector and a recovery password. What should you configure?

A.Compliance policy for Windows 10

B.Endpoint security > Disk encryption policy

C.Windows Update for Business policy

D.Device configuration profile for Windows 10

AnswerB

Endpoint security > Disk encryption policy in Intune allows configuring BitLocker settings, including TPM protector and recovery password.

Why this answer

To enforce BitLocker encryption with a TPM protector and recovery password on Windows 10 devices managed by Intune, you must configure an Endpoint security > Disk encryption policy. This policy type specifically targets BitLocker settings, including TPM and recovery password requirements, and is designed to enforce encryption at the device level through the Intune MDM channel.

Exam trap

The trap here is that candidates often confuse Device configuration profiles (Option D) with Endpoint security policies, but Microsoft explicitly separates disk encryption into the Endpoint security node for focused management, and the exam tests this distinction.

How to eliminate wrong answers

Option A is wrong because Compliance policy for Windows 10 evaluates device compliance after encryption is applied but does not configure BitLocker settings like TPM or recovery password; it only reports on encryption status. Option C is wrong because Windows Update for Business policy controls update rings and feature updates, not disk encryption or BitLocker configuration. Option D is wrong because Device configuration profile for Windows 10 can include some BitLocker settings, but the recommended and correct method for enforcing BitLocker with specific protectors in Intune is the Endpoint security > Disk encryption policy, which provides a dedicated, streamlined interface for encryption policies.

Full explanation →

569

MCQhard

You are deploying a line-of-business (LOB) app to iOS devices managed by Intune. The app requires a specific configuration to access internal resources. Which approach should you use to deliver the configuration?

A.Assign a custom device configuration profile

B.Create an App Configuration Policy targeting managed devices

C.Deploy an App Protection Policy

D.Use Apple Volume Purchase Program (VPP) tokens

AnswerB

App config policies deliver settings to apps.

Why this answer

An App Configuration Policy targeting managed devices is the correct approach because it allows you to supply XML or JSON settings directly to the LOB app on iOS devices enrolled in Intune. This policy is applied when the app runs, enabling it to access internal resources without requiring a separate device profile or user interaction.

Exam trap

The trap here is that candidates often confuse App Configuration Policies (which deliver app-specific settings) with App Protection Policies (which enforce data protection), leading them to select Option C incorrectly.

How to eliminate wrong answers

Option A is wrong because a custom device configuration profile manages device-level settings (e.g., Wi-Fi, VPN, restrictions) and cannot deliver app-specific configuration settings to a line-of-business app. Option C is wrong because an App Protection Policy manages data protection and access controls (e.g., PIN, encryption, save-as restrictions) for apps that integrate with Intune SDK, but it does not deliver app-specific configuration settings. Option D is wrong because Apple Volume Purchase Program (VPP) tokens are used to manage app licensing and distribution, not to deliver app configuration settings.

Full explanation →

570

MCQhard

A user has a Windows 10 device that is enrolled in Microsoft Intune. The user reports that they cannot install a required app from the Company Portal. You check the Intune console and see that the app assignment is 'Required' but the installation status shows 'Failed'. The device is compliant. What should you check first?

A.Review the Intune management extension logs on the device.

B.Verify the device compliance policy.

C.Check the Company Portal app version.

D.Reassign the app to the user.

AnswerA

Logs will show the specific error.

Why this answer

The Intune management extension (IME) handles app installation, PowerShell scripts, and custom compliance actions on Windows devices. When a required app fails to install despite the device being compliant, the IME logs (located in `ProgramData\Microsoft\IntuneManagementExtension\Logs`) provide granular error details such as exit codes, download failures, or dependency issues. Reviewing these logs is the fastest way to diagnose the root cause without making assumptions about compliance or app version.

Exam trap

The trap here is that candidates assume a compliant device means all Intune operations will succeed, overlooking that the Intune management extension is a separate component with its own failure modes unrelated to device compliance.

How to eliminate wrong answers

Option B is wrong because the device is already confirmed compliant, so compliance policy is not the cause of the installation failure. Option C is wrong because the Company Portal app version affects the user interface and enrollment flow, not the backend installation of a required app pushed by Intune. Option D is wrong because reassigning the app does not address the underlying failure reason and may simply reproduce the same error without diagnostic insight.

Full explanation →

571

MCQhard

A company uses Configuration Manager to deploy Windows 11. During the deployment, several devices fail with error code 0x80070002. The administrator suspects the issue is related to missing boot images or content distribution. What should the administrator do first to resolve the issue?

A.Increase the client cache size on the affected devices.

B.Check the driver packages in the task sequence.

C.Verify that the boot image and OS image are distributed to all distribution points.

D.Recreate the task sequence with new OS image.

AnswerC

Missing content on DP causes file not found error.

Why this answer

Error code 0x80070002 translates to 'The system cannot find the file specified.' In a Configuration Manager task sequence deployment, this typically indicates that the boot image or OS image content is not available on the distribution point that the client is accessing. Verifying distribution ensures the required content is present and accessible, which is the most direct and common fix for this error.

Exam trap

The trap here is that candidates often focus on client-side issues like cache or drivers, but the error code 0x80070002 specifically points to missing or inaccessible content on the server side, making distribution verification the correct first step.

How to eliminate wrong answers

Option A is wrong because increasing client cache size does not resolve missing content on distribution points; cache size affects local storage of downloaded content, not content availability. Option B is wrong because driver packages are not the primary cause of a 'file not found' error during boot image or OS image retrieval; missing drivers would cause hardware-specific failures, not a generic 0x80070002. Option D is wrong because recreating the task sequence is unnecessary and time-consuming; the issue is content distribution, not the task sequence definition itself.

Full explanation →

572

MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. You have a requirement to ensure that all devices have BitLocker Drive Encryption enabled with a TPM protector and a recovery key escrowed to Azure AD. Additionally, you need to configure a policy that prevents users from changing the BitLocker settings. You create a device configuration profile using the 'Endpoint Protection' template for Windows 10 and later. After deploying the policy to a test group, you notice that BitLocker is not enabled on some devices. The devices meet the hardware requirements and are Azure AD joined. What is the most likely reason for the failure, and how should you resolve it?

A.Devices are not hybrid Azure AD joined; convert them to hybrid join for BitLocker policy to apply.

B.The policy does not specify a recovery key escrow location; configure it to escrow to Azure AD.

C.The policy is missing the 'Enable full disk encryption' setting or the encryption method is not specified; check the 'Windows Encryption' settings in the profile.

D.Devices are not co-managed with Configuration Manager; enable co-management to apply BitLocker policy.

AnswerC

The 'Encryption method' and 'Enable full disk encryption' settings must be configured in the profile for BitLocker to be enabled.

Why this answer

The 'Endpoint Protection' template for Windows 10 and later requires explicit configuration of the 'Enable full disk encryption' setting and the encryption method (e.g., XTS-AES 128-bit) under the 'Windows Encryption' section. Without these settings, the policy does not trigger BitLocker to start encryption on the device, even if other settings like TPM protector and recovery key escrow are configured. The devices are Azure AD joined and meet hardware requirements, so the missing encryption enablement is the most likely cause.

Exam trap

The trap here is that candidates assume configuring TPM protector and recovery key escrow is sufficient to enable BitLocker, but the 'Enable full disk encryption' setting is a separate mandatory toggle that must be explicitly enabled in the policy.

How to eliminate wrong answers

Option A is wrong because BitLocker policies in Intune apply to both Azure AD joined and hybrid Azure AD joined devices; hybrid join is not a prerequisite for BitLocker policy application. Option B is wrong because the question states that the policy already includes a recovery key escrow to Azure AD, so the failure is not due to a missing escrow location. Option D is wrong because co-management with Configuration Manager is not required for Intune to manage BitLocker on Windows 11 devices; Intune can apply BitLocker policies directly via the MDM channel.

Full explanation →

573

MCQmedium

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

A.The ComplianceState reflects the last sync; the device may have changed compliance since.

B.The device is compliant but not syncing because it is turned off.

C.The device is no longer enrolled but shows compliant due to a reporting delay.

D.The compliance policy was removed after the last sync.

AnswerA

Compliance state is cached until next sync.

Why this answer

The ComplianceState property in Microsoft Intune reflects the compliance status at the time of the last device check-in. If a device has not synced for 7 days, the stored ComplianceState is stale and may no longer represent the actual compliance posture. The device could have become non-compliant since its last sync due to policy changes, missing updates, or configuration drift, but Intune will not update the state until the next successful sync.

Exam trap

Microsoft Intune often tests the misconception that ComplianceState is a live, real-time indicator, when in fact it is a snapshot from the last successful sync, and candidates may incorrectly assume a compliant state means the device is currently secure.

How to eliminate wrong answers

Option B is wrong because a device that is turned off cannot sync, but the ComplianceState would still show the last known state; the issue is not that the device is compliant but not syncing, but that the state is outdated. Option C is wrong because if the device were no longer enrolled, it would not appear in the managed devices list or would show an 'unenrolled' status, not a compliant state with a 7-day sync gap. Option D is wrong because removing a compliance policy after the last sync would not retroactively change the ComplianceState; the device would remain compliant until the next sync, at which point it would be evaluated against the new policy set.

Full explanation →

574

Multi-Selecthard

Which TWO actions should you take to ensure that devices are automatically enrolled in Microsoft Intune when users sign in with a work account on Windows 10/11?

Select 2 answers

A.Set the MDM user scope to 'All' or 'Some' in Azure AD.

B.In Intune, set the enrollment restriction to allow Windows devices.

C.Enable automatic Azure AD registration for Windows devices.

D.Enable co-management with Configuration Manager.

E.Configure the MDM discovery URL in Group Policy.

AnswersA, E

This determines which users get automatic enrollment.

Why this answer

Options A and E are correct. Option A: Setting the MDM user scope to 'All' or 'Some' in Azure AD enables automatic MDM enrollment for the specified users. Option E: Configuring the MDM discovery URL via Group Policy allows Windows 10/11 devices to automatically enroll in Intune by discovering the MDM service.

Option B is incorrect because enrollment restrictions in Intune control device platforms but do not directly trigger automatic enrollment. Option C is incorrect because automatic Azure AD registration is a separate process and does not automatically enroll devices into Intune. Option D is incorrect because co-management with Configuration Manager is a hybrid management approach and is not required for automatic Intune enrollment.

Full explanation →

575

MCQmedium

A user reports that a required app is not installing on their Android Enterprise device. The device is enrolled in Intune and shows as compliant. The app is assigned to the user. What is the most likely cause?

A.The device is not compliant with conditional access policies.

B.The user does not have the Company Portal app installed.

C.The app is not available on Managed Google Play.

D.The device does not have a work profile configured.

AnswerB

Company Portal is required for app installation on Android Enterprise.

Why this answer

On Android Enterprise devices enrolled in Intune, the Company Portal app is required to install line-of-business (LOB) apps or manage app installations via the Intune console. Without the Company Portal app, the device cannot receive app assignment push notifications or initiate the installation process, even if the device is compliant and the app is assigned to the user. This is a prerequisite for app deployment on Android Enterprise work profiles.

Exam trap

The trap here is that candidates assume app installation failures are always due to compliance or app availability issues, overlooking the critical prerequisite that the Company Portal app must be present and active on the device to receive and execute app assignments.

How to eliminate wrong answers

Option A is wrong because the device is explicitly stated as compliant, and conditional access policies are evaluated at authentication time, not during app installation; a compliant device would not be blocked by conditional access for app deployment. Option C is wrong because the question does not specify the app type, and even if the app is not available on Managed Google Play, Intune can still deploy web apps or line-of-business apps via the Company Portal; the core issue is the missing Company Portal app, not the app's availability. Option D is wrong because the device is enrolled in Android Enterprise, which inherently requires a work profile to be configured; if the work profile were missing, the device would not be enrolled or compliant.

Full explanation →

576

MCQeasy

You are troubleshooting a Windows 11 device that cannot connect to the corporate Wi-Fi network. The device is enrolled in Intune and has a Wi-Fi profile assigned. The profile uses SCEP certificate authentication. The user can connect to other Wi-Fi networks. What is the most likely cause?

A.The user's password has expired.

B.The root CA certificate required to validate the RADIUS server certificate is not installed on the device.

C.The Wi-Fi profile is not assigned to the user's device.

D.The device's Wi-Fi adapter driver is outdated.

AnswerB

Without the root CA, the device cannot trust the server's certificate, causing authentication failure.

Why this answer

The device can connect to other Wi-Fi networks but not the corporate one, indicating the issue is specific to the corporate network's authentication requirements. Since the profile uses SCEP certificate authentication, the device must trust the root CA that issued the RADIUS server certificate to validate the server during the EAP-TLS handshake. If the root CA certificate is missing, the client will reject the RADIUS server certificate, causing the connection to fail.

This is the most likely cause because the profile assignment and driver are not specific to this single network failure.

Exam trap

The trap here is that candidates confuse a missing root CA certificate with a missing client certificate, but the symptom of being able to connect to other networks isolates the problem to server-side certificate validation, not client-side enrollment.

How to eliminate wrong answers

Option A is wrong because password expiration is irrelevant to SCEP certificate authentication, which uses machine or user certificates, not passwords. Option C is wrong because the device is enrolled in Intune and has a Wi-Fi profile assigned, so the profile is present; if it were not assigned, the profile would not appear at all, but the user can see and attempt to connect. Option D is wrong because an outdated Wi-Fi adapter driver would affect all Wi-Fi connections, not just the corporate network, and the user can connect to other networks successfully.

Full explanation →

577

MCQmedium

Your organization uses Microsoft Intune to manage Windows 11 devices. Users report that after a recent update, the Start menu layout resets to default every time they sign in. Which Intune policy setting is most likely causing this issue?

A.Import Microsoft Edge assets policy

B.Show 'Recommended' section policy

C.Allow pinned folders policy

D.Start layout policy under Device Restrictions

AnswerD

This policy can enforce a specific layout; if set to remove custom layout, it resets on sign-in.

Why this answer

The Start layout policy under Device Restrictions (D) is the most likely cause because it enforces a specific Start menu configuration on Windows 11 devices. When this policy is set to 'Enabled' and configured with a layout XML, it reapplies the layout at every user sign-in, overriding any user customizations. This behavior matches the reported issue of the Start menu resetting to default after a recent update.

Exam trap

The trap here is that candidates may confuse policies that affect individual Start menu elements (like pinned folders or the Recommended section) with the overarching Start layout policy that enforces a complete layout reset, leading them to select a partially correct but insufficient option.

How to eliminate wrong answers

Option A is wrong because the 'Import Microsoft Edge assets policy' is used to manage Edge browser assets like bookmarks and settings, not the Start menu layout. Option B is wrong because the 'Show Recommended section policy' controls the visibility of the 'Recommended' section in the Start menu, but it does not reset the entire Start menu layout to default. Option C is wrong because the 'Allow pinned folders policy' manages which folders appear in the Start menu's pinned area, but it does not cause a full layout reset on sign-in.

Full explanation →

578

MCQmedium

You are configuring conditional access policies in Microsoft Entra ID to require compliant devices for access to Microsoft 365 services. Some users report that they cannot access Outlook Web App (OWA) even though their device is marked as compliant in Intune. What should you verify?

A.The conditional access policy has the grant control set to 'Require device to be marked as compliant'.

B.All users have the required Microsoft 365 license.

C.The conditional access policy includes all cloud apps.

D.The device platform condition is set to iOS and Android only.

AnswerA

Without this grant, the policy might only apply other controls like MFA, not compliance.

Why this answer

The most likely cause of users being unable to access OWA despite device compliance is that the conditional access policy's grant control is not set to 'Require device to be marked as compliant'. Without this grant, the policy may apply other controls (e.g., MFA) or block access entirely, even if the device is compliant in Intune. This setting explicitly enforces that only compliant devices can access the targeted cloud apps, such as Office 365 Exchange Online.

Exam trap

The trap here is that candidates assume device compliance alone is sufficient for access, but they overlook that the conditional access policy must explicitly include the 'Require device to be marked as compliant' grant control to enforce compliance-based access.

How to eliminate wrong answers

Option B is wrong because licensing issues would prevent access to Microsoft 365 services entirely or show a license error, not specifically block OWA while the device is compliant; the scenario describes a compliance-related block, not a licensing one. Option C is wrong because including all cloud apps is not required for OWA access; the policy should target the specific app (e.g., Office 365 Exchange Online) to avoid unintended blocks on other services, and including all cloud apps could cause broader access issues unrelated to the reported symptom. Option D is wrong because restricting the device platform to iOS and Android only would block access from Windows, macOS, or other platforms, but the users are reporting issues with OWA access, and the policy should match the platforms in use; the problem is not platform-specific but rather the grant control setting.

Full explanation →

579

MCQeasy

A user reports that their iOS device is not receiving email on their work account. The device is enrolled in Intune. You verify that the Exchange ActiveSync profile is assigned correctly. What should you check next?

A.Ensure the MDM authority is set to Intune.

B.Check if an app protection policy is assigned to the user.

C.Verify that the device is enrolled in device enrollment manager mode.

D.Check the device's compliance status in Intune.

AnswerD

Noncompliant devices are blocked by Conditional Access from accessing corporate email.

Why this answer

If the device is noncompliant (e.g., due to a noncompliant app or OS version), Conditional Access policies in Intune will block email access even if the Exchange ActiveSync profile is correctly assigned. Option A is incorrect because the MDM authority is already verified by the fact the device is enrolled and the profile is assigned; changing it would not resolve the issue. Option B is incorrect because app protection policies (MAM) are separate from device-level email access via the native mail app—they manage data protection within apps, not connectivity.

Option C is incorrect because Device Enrollment Manager (DEM) mode is used for bulk enrollment scenarios, not for individual device email issues.

Full explanation →

580

MCQeasy

Your company deploys Microsoft Defender for Endpoint to Windows devices managed by Microsoft Intune. You need to ensure that all devices send diagnostic data at the 'Optional diagnostic data' level. Which configuration profile type should you use?

A.Administrative templates

B.Device restrictions

C.Endpoint protection

D.Custom

AnswerB

Correct. Device restrictions includes the 'Diagnostic data' setting under Windows 10 and later > General, allowing you to set the level to 'Optional diagnostic data'.

Why this answer

The correct configuration profile type is 'Device restrictions' (Option B). In Microsoft Intune, the Device restrictions profile for Windows 10/11 includes the 'Diagnostic data' setting under the General category, which allows you to configure the level of diagnostic data sent to Microsoft, including 'Optional diagnostic data'. Option A (Administrative templates) is used for ADMX-backed policies but is not the simplest method for this specific setting.

Option C (Endpoint protection) focuses on security settings like Microsoft Defender Antivirus and does not contain diagnostic data settings. Option D (Custom) could be used but is not the recommended or simplest approach.

Full explanation →

581

MCQhard

Refer to the exhibit. You apply this configuration profile to Windows 10 devices. A user reports that their device's diagnostic data level is set to 'Full' in Settings > Diagnostics & feedback. What is the most likely reason?

A.The user manually changed the setting after the policy applied.

B.Windows Defender is blocking the policy application.

C.A conflicting Group Policy object is overriding the Intune policy.

D.The policy is not assigned to the device or the device is not enrolled.

AnswerD

If the policy is not assigned, the device won't receive it.

Why this answer

The most common reason for a configuration profile not taking effect is that the policy is not assigned to the device or the device is not enrolled in Intune. Without proper enrollment, the device never receives the policy, so the default or user-chosen diagnostic data level remains. Even if the policy is assigned, if the device is not enrolled, Intune cannot manage it.

Exam trap

The trap here is that candidates assume a policy applied in Intune automatically reaches all devices, forgetting that the device must be enrolled and the policy must be assigned to a group containing that device.

How to eliminate wrong answers

Option A is wrong because if the user manually changed the setting after the policy applied, Intune would enforce the policy on the next sync (typically every 8 hours or on demand), reverting the setting back to the configured level. Option B is wrong because Windows Defender does not block Intune policy application; it operates independently and does not interfere with MDM policy enforcement. Option C is wrong because while a conflicting Group Policy object could override Intune policy, the question asks for the 'most likely reason,' and the scenario does not mention any on-premises AD or GP infrastructure; the simplest and most common cause is that the policy was never delivered due to lack of assignment or enrollment.

Full explanation →

582

Multi-Selecthard

You manage a hybrid Azure AD joined environment with Microsoft Intune. You need to migrate Group Policy objects (GPOs) to Intune policies for Windows 10 devices. Which THREE tools or methods should you use?

Select 3 answers

A.MDM Migration Analysis Tool (MMAT)

B.Custom OMA-URI settings in a configuration profile

C.Desktop Analytics

D.Group Policy Analytics in Microsoft Intune

E.PowerShell scripts to apply registry settings

AnswersA, B, D

MMAT assesses GPO compatibility with MDM.

Why this answer

The MDM Migration Analysis Tool (MMAT) is correct because it analyzes existing on-premises Group Policy Objects (GPOs) and generates a report mapping each GPO setting to its equivalent MDM policy in Intune, including a readiness score. This tool directly supports the migration workflow by identifying which GPOs can be converted and which require manual intervention, making it essential for planning a GPO-to-Intune migration.

Exam trap

The trap here is that candidates often confuse Desktop Analytics (a Windows upgrade readiness tool) with Group Policy Analytics (a GPO-to-Intune migration tool), leading them to incorrectly select Desktop Analytics as a valid migration method.

Full explanation →

583

Multi-Selecthard

Which THREE are supported reporting options in Microsoft Intune for device compliance?

Select 3 answers

A.Export compliance data to CSV

B.View compliance status for each device

C.Compliance trends over time

D.Real-time compliance dashboard

E.Scheduled email reports

AnswersA, B, C

Export is available in the compliance report.

Why this answer

Microsoft Intune allows administrators to export compliance data to a CSV file from the compliance dashboard. This is a supported reporting option that enables offline analysis and archival of device compliance status.

Exam trap

The trap here is that candidates often assume Intune has a real-time dashboard or scheduled email reports because other Microsoft 365 services (like Exchange or Security & Compliance) offer these features, but Intune's compliance reporting is batch-based and lacks native scheduling for email delivery.

Full explanation →

584

Multi-Selecteasy

Which TWO actions can be performed using a Windows Autopilot reset? (Choose two.)

Select 2 answers

A.Change the primary user of the device

B.Reinstall Windows 11 from scratch

C.Retain the Autopilot registration

D.Remove personal files and apps

E.Remove the device from Microsoft Intune

AnswersC, D

The device remains registered for Autopilot.

Why this answer

Options C and D are correct. Windows Autopilot reset retains the device's Autopilot registration (option C) and removes personal files and apps (option D). Option A is incorrect because Autopilot reset does not change the primary user; that requires a different process.

Option B is incorrect because Autopilot reset does not reinstall Windows from scratch; it refreshes the existing OS. Option E is incorrect because Autopilot reset does not remove the device from Microsoft Intune; that would require a manual action.

Full explanation →

585

MCQhard

You are deploying Windows 10 to 500 new devices using a task sequence in Microsoft Configuration Manager. The devices need to be joined to Microsoft Entra ID and enrolled in Intune automatically during OSD. Which method should you use?

A.Add a 'Provision Microsoft Entra ID' step in the task sequence, using a bulk token generated from Microsoft Entra ID.

B.Use a provisioning package (PPKG) with bulk enrollment token, applied during the task sequence.

C.Set a Group Policy that enables automatic MDM enrollment using a discovered AAD token.

D.Configure Windows Autopilot for existing devices and redeploy them.

AnswerA

This step allows Entra ID join and automatic Intune enrollment during OSD.

Why this answer

Using a 'Provision Microsoft Entra ID' step with a bulk token in a Configuration Manager task sequence directly enables automatic Microsoft Entra ID join and Intune enrollment during OSD. The bulk token, generated from Microsoft Entra ID, allows devices to be joined without user interaction, which is essential for unattended, large-scale deployments.

Exam trap

The trap here is that candidates often confuse the 'Provision Microsoft Entra ID' step with a provisioning package (PPKG), but the step is a native task sequence action that correctly handles bulk tokens during OSD, whereas a PPKG is applied outside the task sequence flow.

How to eliminate wrong answers

Option B is wrong because a provisioning package (PPKG) with a bulk enrollment token is typically applied during the initial Windows setup (OOBE) or via a script, not as a step within a Configuration Manager task sequence; the task sequence requires the dedicated 'Provision Microsoft Entra ID' step to handle the token. Option C is wrong because Group Policy for automatic MDM enrollment relies on a discovered AAD token from a user sign-in, which does not work in an unattended OSD scenario where no interactive user logs in to discover the token. Option D is wrong because Windows Autopilot for existing devices is designed for re-provisioning or resetting devices that are already registered in Autopilot, not for deploying 500 new devices from scratch via a Configuration Manager task sequence.

Full explanation →

586

MCQmedium

You deploy a new line-of-business app to Windows 10 devices via Intune. Users report that the app does not appear in the Company Portal. You verify that the app is assigned to the correct group. What is the most likely cause?

A.The app's installation behavior is set to 'System'.

B.The app is not supported on Windows 10.

C.Users need to add the app manually.

D.The app is assigned to the wrong group.

AnswerA

Correct. System-installed apps may not appear in Company Portal.

Why this answer

When a line-of-business (LOB) app is deployed with installation behavior set to 'System', it installs in the device context and runs as SYSTEM. The Company Portal only displays apps installed in the user context. Even though the app is assigned to the correct group, it will not appear in the Company Portal because the portal filters out system-context apps.

To make it visible, the installation behavior must be set to 'User'.

Exam trap

The trap here is that candidates assume any assigned app will appear in Company Portal, overlooking the critical distinction between system-context and user-context installation behavior in Intune.

How to eliminate wrong answers

Option B is wrong because the app is already deployed and users report it does not appear, not that it fails to install; Windows 10 supports LOB apps via Intune. Option C is wrong because Intune-managed apps are automatically available in the Company Portal when assigned; users do not need to manually add them. Option D is wrong because the question explicitly states the app is assigned to the correct group, so group misassignment is not the cause.

Full explanation →

587

MCQhard

A company uses Microsoft Intune to manage Windows 11 devices. They want to deploy a Win32 app that requires user interaction during installation. The app must be installed with administrative privileges. Which installation behavior setting should you configure?

A.Installation time (64-bit vs 32-bit)

B.System context (device)

C.Device restart behavior

D.User context (user)

AnswerB

System context (device) is correct because it ensures the installer runs with administrative privileges (as SYSTEM). Although user interaction is not possible in this context, the requirement for admin privileges is satisfied. If interaction is needed, the app must handle it via other means.

Why this answer

The correct setting is 'System context (device)' because the app must be installed with administrative privileges. In Intune, the 'System' installation behavior runs the installer as the SYSTEM account, which inherently has administrative privileges. While this context does not allow user interaction, the requirement for admin privileges takes precedence.

If user interaction were absolutely necessary, a different installation method (such as running the installer in user context with self-elevation) would be required, but the question asks for the installation behavior setting that provides administrative privileges, which is System context.

Exam trap

The trap here is that candidates often assume 'User context' is required for user interaction, but they overlook that administrative privileges are only possible with 'System context'. The requirement for admin privileges overrides the need for interaction, so the correct answer is System context.

How to eliminate wrong answers

Option A is wrong because 'Installation time (64-bit vs 32-bit)' controls whether the app is installed on 64-bit or 32-bit systems, not the security context or user interaction behavior. Option B is wrong because 'System context (device)' runs the installer as the SYSTEM account, which suppresses all user interaction and would fail for an app that requires user input during setup. Option C is wrong because 'Device restart behavior' determines whether the device restarts after installation and does not affect the user interaction or privilege level during installation.

Full explanation →

588

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only corporate-owned devices can access company resources, while allowing users to enroll personal devices for limited access. You plan to use enrollment restrictions and compliance policies. What should you configure?

A.Set enrollment device platform restrictions to block personally owned devices, and create a compliance policy to mark personal devices as noncompliant.

B.Configure enrollment restrictions to block all devices from enrolling.

C.Configure a compliance policy that requires devices to be corporate-owned.

D.Create a conditional access policy that requires devices to be marked as compliant.

AnswerA

Enrollment restrictions prevent personal devices from enrolling, and compliance policies enforce the corporate ownership requirement.

Why this answer

Enrollment device platform restrictions can block personally owned devices from enrolling, while a compliance policy can mark personal devices that do enroll as noncompliant. This combination ensures corporate-owned devices get full access, and personal devices are either blocked or flagged for limited access via conditional access policies.

Exam trap

The trap here is that candidates often confuse compliance policies with enrollment restrictions, thinking a compliance policy alone can block enrollment, when in fact compliance policies only evaluate devices after they are enrolled and cannot prevent enrollment itself.

How to eliminate wrong answers

Option B is wrong because blocking all devices from enrolling would prevent both corporate and personal devices from accessing company resources, which does not meet the requirement to allow personal devices limited access. Option C is wrong because compliance policies can evaluate device ownership (e.g., via the 'Device ownership' setting), but they cannot enforce enrollment restrictions; they only mark devices as compliant or noncompliant after enrollment, so personal devices could still enroll and then be marked noncompliant, but the requirement to block personal devices from enrolling is not achieved. Option D is wrong because a conditional access policy that requires devices to be marked as compliant does not control enrollment; it only controls access after enrollment, so personal devices could still enroll and then be blocked from access, but the requirement to block personal devices from enrolling is not met.

Full explanation →

589

MCQeasy

Refer to the exhibit. You are reviewing a JSON policy for Windows 10 compliance. Which of the following is required by this policy?

A.Secure Boot disabled

B.A TPM chip present and enabled

C.BitLocker drive encryption enabled

D.A password of at least 8 characters

AnswerB

'tpmRequired': true requires a TPM chip.

Why this answer

The JSON policy includes the setting 'requireTPM' with a value of 'true', which mandates that a Trusted Platform Module (TPM) chip must be present and enabled on the device to be compliant. TPM provides hardware-level security for cryptographic operations and is a key requirement for features like BitLocker, but the policy itself specifically enforces TPM presence, not encryption status.

Exam trap

The trap here is that candidates often confuse TPM requirement with BitLocker encryption, assuming that requiring TPM automatically implies BitLocker is enabled, but the policy only checks for the TPM chip itself, not the encryption state.

How to eliminate wrong answers

Option A is wrong because the policy does not reference Secure Boot at all; Secure Boot is a separate UEFI security feature that ensures only signed OS bootloaders run, and disabling it would actually reduce security, not meet a compliance requirement. Option C is wrong because while TPM is often used with BitLocker, the policy explicitly requires TPM (requireTPM: true) and does not include a setting for BitLocker drive encryption (e.g., requireEncryption or requireBitLocker). Option D is wrong because the policy does not include any password length requirement; password policies in Intune compliance are set via 'passwordMinimumLength' or similar properties, which are absent from this JSON.

Full explanation →

590

MCQeasy

A company uses Configuration Manager to deploy Windows 11. During the deployment, the task sequence fails at the 'Apply Operating System' step. The error log shows 'Failed to find a valid operating system image package'. You verify that the operating system image package exists and is distributed to the distribution point. What is the most likely cause?

A.The client computer does not have enough disk space

B.The task sequence is not associated with the correct boot image

C.The operating system image package is not enabled for use with task sequences

D.The distribution point is not configured to support PXE boot

AnswerC

The package must be enabled for task sequences.

Why this answer

When an operating system image package exists and is distributed to distribution points but the task sequence fails with 'Failed to find a valid operating system image package', the most common cause is that the image package is not enabled for use with task sequences. In Configuration Manager, each OS image package has a property 'Enable this operating system image for use in task sequences' that must be checked; if unchecked, the task sequence engine cannot reference the package during the Apply Operating System step, even though the package is present and distributed.

Exam trap

The trap here is that candidates often assume the error is due to distribution point issues (like PXE or content distribution) because the error message mentions 'failed to find', but the real cause is a simple property setting on the OS image package that is frequently overlooked during troubleshooting.

How to eliminate wrong answers

Option A is wrong because insufficient disk space would typically cause a different error, such as 'Failed to write to disk' or 'Not enough free space', not a failure to find a valid OS image package. Option B is wrong because the boot image association is critical for booting the client into WinPE, but the error occurs at the 'Apply Operating System' step, which runs after WinPE is loaded; an incorrect boot image would cause a failure earlier, during the boot process or initial task sequence start. Option D is wrong because PXE boot configuration is only relevant if the client is booting from the network; the error occurs during the task sequence execution after the client has already booted into WinPE, and the distribution point's PXE support does not affect the ability to locate an OS image package during the Apply Operating System step.

Full explanation →

591

MCQeasy

Refer to the exhibit. You deploy this compliance policy to Windows 10 devices. A device running Windows 10 version 20H2 (OS build 19042.1234) reports as compliant. However, the device does not have BitLocker enabled. Why is the device compliant?

A.The storageRequireEncryption setting is evaluated but not enforced because the device doesn't support encryption.

B.The device is not actually compliant; the report is incorrect.

C.The password requirement is not enforced because passwordRequiredType is set to deviceDefault.

D.The OS version is above the minimum, so compliance is granted regardless of encryption.

AnswerA

If the device doesn't support encryption, the policy may not fail compliance.

Why this answer

The storageRequireEncryption setting in the compliance policy requires encryption, but it is only evaluated and not enforced if the device does not support encryption (e.g., lacks TPM or compatible hardware). The device is correctly reported as compliant because the setting is not applicable. Option B is incorrect because the report is accurate; the policy is not enforced due to lack of support.

Option C is incorrect because the password requirement is unrelated to the encryption compliance. Option D is incorrect because an OS version above the minimum does not override the encryption requirement; the device would be non-compliant if encryption were enforced.

Full explanation →

592

Drag & Dropmedium

Arrange the steps to deploy Windows 10 using Microsoft Deployment Toolkit (MDT) in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

MDT deployment requires importing OS and drivers first, then creating a task sequence, updating the share, booting the client, and finally running the wizard.

Full explanation →

593

Multi-Selectmedium

Which TWO of the following are required to configure Windows Autopilot for existing devices?

Select 2 answers

A.A Windows product key.

B.A local administrator account on the device.

C.An Azure AD Premium P1 license.

D.A hardware hash (4K HH) from the device.

E.A device group that has an Autopilot deployment profile assigned.

AnswersD, E

The hardware hash is used to uniquely identify the device and register it in Autopilot.

Why this answer

The hardware hash (4K HH) is the unique identifier that Windows Autopilot uses to associate a device with an Autopilot deployment profile. This hash must be harvested from the existing device (e.g., via a PowerShell script or a provisioning package) and uploaded to the Autopilot service to register the device. Without the hardware hash, the device cannot be recognized as an Autopilot device during the out-of-box experience (OOBE).

Exam trap

The trap here is that candidates often confuse the licensing requirement (Azure AD Premium P1) with the technical prerequisite for device registration, but the hardware hash and a device group with an assigned profile are the only two mandatory components for configuring Autopilot on existing devices.

Full explanation →

594

MCQeasy

Your organization wants to use Windows Autopilot for user-driven deployment. Users should be able to self-deploy their devices by signing in with their corporate credentials. Which Autopilot deployment mode should you use?

A.Pre-provisioned deployment

B.Hybrid Azure AD join

C.User-driven (Azure AD join)

D.Self-deploying (Azure AD join)

AnswerC

User-driven mode prompts for user credentials.

Why this answer

User-driven (Azure AD join) deployment mode is correct because it allows users to self-deploy their devices by signing in with their corporate credentials during the out-of-box experience (OOBE). This mode joins the device to Azure AD and enrolls it in Microsoft Intune, enabling the user to complete the setup without IT intervention.

Exam trap

The trap here is that candidates often confuse 'self-deploying' with 'user-driven' because both involve Azure AD join, but self-deploying requires no user interaction during OOBE, making it unsuitable for scenarios where users must sign in with corporate credentials.

How to eliminate wrong answers

Option A is wrong because pre-provisioned deployment requires an IT technician to perform a pre-provisioning phase before the user receives the device, which does not align with the requirement for users to self-deploy by signing in with corporate credentials. Option B is wrong because Hybrid Azure AD join is not an Autopilot deployment mode; it is a device identity state that can be achieved through Autopilot but requires additional infrastructure like Active Directory and Azure AD Connect, and it does not describe a specific deployment mode. Option D is wrong because self-deploying (Azure AD join) mode is designed for kiosks or shared devices where no user credentials are required during OOBE; it uses a device certificate for authentication, not user sign-in.

Full explanation →

595

MCQeasy

You need to ensure that all Windows 10 devices automatically install critical security updates from Windows Update as soon as they are released. Which Windows Update for Business policy setting should you configure?

A.Set 'Update notification level' to 'Display notification'

B.Set 'Quality update deferral period' to 0 days

C.Configure active hours to allow automatic updates

D.Enable 'Pause feature updates'

AnswerB

Setting deferral period to 0 ensures updates are installed as soon as they are released.

Why this answer

Setting the 'Quality update deferral period' to 0 days ensures that critical security updates (classified as quality updates in Windows Update for Business) are installed immediately upon release, with no deferral. This policy directly controls the delay before installation, and a value of 0 means updates are applied as soon as they are available from Microsoft.

Exam trap

The trap here is that candidates often confuse 'deferral period' with 'active hours' or 'notification settings', mistakenly thinking that controlling user notifications or restart timing is equivalent to controlling update installation timing.

How to eliminate wrong answers

Option A is wrong because 'Update notification level' controls how and when users see notifications about updates, not the timing of installation; it does not force immediate installation of critical security updates. Option C is wrong because configuring active hours only prevents automatic restarts during specified times, but does not affect when updates are downloaded or installed; updates can still be deferred or delayed. Option D is wrong because 'Pause feature updates' stops feature updates (major version upgrades) from being installed, but does not affect quality/security updates, and pausing would actually prevent immediate installation of any updates.

Full explanation →

596

MCQmedium

Your organization uses Windows Autopilot and Microsoft Intune. You need to ensure that during the Autopilot deployment, the device automatically installs a set of required applications (Microsoft 365 Apps, company portal, and a line-of-business app) before the user can access the desktop. Which configuration should you use?

A.Configure the Enrollment Status Page (ESP) to block device use until required apps are installed

B.Set a device compliance policy to require all apps to be installed

C.Use a PowerShell script that runs during Autopilot to install apps

D.Configure an Autopilot deployment profile with the 'Skip EULA' option

AnswerA

ESP can be configured to block device use until all required apps are installed.

Why this answer

The Enrollment Status Page (ESP) in Windows Autopilot can be configured to block device use until specified required apps are installed. This ensures that Microsoft 365 Apps, Company Portal, and line-of-business apps are fully deployed before the user reaches the desktop, meeting the requirement of a controlled, app-ready deployment.

Exam trap

The trap here is that candidates often confuse the ESP's ability to block desktop access with compliance policies or scripts, not realizing that only the ESP provides the specific 'block until installed' functionality during Autopilot.

How to eliminate wrong answers

Option B is wrong because a device compliance policy checks the state of devices after enrollment (e.g., requiring apps to be installed for compliance), but it does not block the user from accessing the desktop during Autopilot deployment; it only flags non-compliance later. Option C is wrong because a PowerShell script running during Autopilot can install apps, but it cannot reliably block the user from accessing the desktop until all apps are installed; the ESP provides that blocking mechanism. Option D is wrong because the 'Skip EULA' option in an Autopilot deployment profile only skips the End-User License Agreement pages during OOBE, which has no effect on app installation or blocking desktop access.

Full explanation →

597

MCQhard

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to configure a device compliance policy that requires devices to run Windows version 22H2 or later. When you create the policy, which option must you select for the OS version requirement?

A.Require OS version

B.Maximum OS version

C.Minimum OS version

D.Exact OS version

AnswerC

Minimum OS version ensures the device runs at least the specified version.

Why this answer

The requirement for devices to run Windows version 22H2 or later is a minimum version constraint. In Microsoft Intune compliance policies, the 'Minimum OS version' setting enforces that the device's OS version must be equal to or greater than the specified version, which directly matches the '22H2 or later' condition.

Exam trap

The trap here is that candidates confuse 'Minimum OS version' with 'Exact OS version' or 'Require OS version', mistakenly thinking Intune can enforce a single specific build rather than a minimum threshold.

How to eliminate wrong answers

Option A is wrong because 'Require OS version' is not a valid setting in Intune compliance policies; the actual settings are 'Minimum OS version' and 'Maximum OS version'. Option B is wrong because 'Maximum OS version' would restrict devices to a version no higher than the specified one, which is the opposite of the 'or later' requirement. Option D is wrong because 'Exact OS version' is not a supported option in Intune; compliance policies do not allow pinning to a single specific build, only range-based constraints.

Full explanation →

598

MCQmedium

Your company deploys Microsoft Defender for Endpoint (Defender XDR) to all Windows devices. You need to create a custom detection rule that triggers an alert when a specific PowerShell script is executed on any device. Which action should you take in the Microsoft 365 Defender portal?

A.Create a new custom detection rule based on an Advanced hunting query.

B.Configure a Device control policy to block PowerShell.

C.Add an Indicator of compromise for the script hash.

D.Create a new attack simulation training campaign.

AnswerA

Custom detection rules allow you to define custom alerts based on advanced hunting queries.

Why this answer

A is correct because custom detection rules in Microsoft 365 Defender are built from Advanced hunting queries (Kusto Query Language) that can detect specific script execution patterns, such as a PowerShell script with a known command line or hash. This allows you to trigger an alert when the exact script runs, meeting the requirement for a custom detection rule.

Exam trap

The trap here is that candidates often confuse Indicators of compromise (IoC) with custom detection rules, thinking a hash-based IoC can create a detection rule, but IoCs are for blocking or alerting on known files, not for writing custom KQL-based detection logic.

How to eliminate wrong answers

Option B is wrong because configuring a Device control policy to block PowerShell would prevent all PowerShell execution, not create a detection rule for a specific script; it is a restrictive control, not a detection mechanism. Option C is wrong because adding an Indicator of compromise (IoC) for the script hash would block or alert on the file based on its hash, but it does not create a custom detection rule with an Advanced hunting query; IoCs are for known threats, not custom detection logic. Option D is wrong because creating an attack simulation training campaign is for phishing simulations and user awareness, not for detecting PowerShell script execution on devices.

Full explanation →

599

MCQeasy

Refer to the exhibit. You manage a Windows 11 device that is marked as compliant and has OS version 10.0.22621.0. You need to upgrade the device to Windows 11 version 23H2. Which Intune feature should you use?

A.Windows quality update profile

B.Windows feature update profile

C.Driver update policy

D.Compliance policy

AnswerB

Feature update profiles deploy OS feature updates.

Why this answer

A Windows feature update profile is the correct Intune feature to upgrade a Windows 11 device from one version to another (e.g., from 10.0.22621.0 to 23H2). Feature update profiles deploy new OS builds that enable feature-level changes, whereas quality updates deliver only security and cumulative fixes. This profile targets the specific version upgrade required for the device.

Exam trap

The trap here is confusing 'quality updates' (which are cumulative security fixes) with 'feature updates' (which are full OS version upgrades), leading candidates to incorrectly select the quality update profile for a version upgrade.

How to eliminate wrong answers

Option A is wrong because a Windows quality update profile delivers only monthly security and cumulative updates, not full OS version upgrades like 23H2. Option C is wrong because a driver update policy manages only device driver updates, not Windows OS version changes. Option D is wrong because a compliance policy evaluates device settings against rules but does not deploy OS upgrades; it can mark a device non-compliant but cannot perform the upgrade itself.

Full explanation →

600

MCQhard

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to ensure that when a device is determined to be at high risk by Defender, it is automatically blocked from accessing corporate resources. What should you configure?

A.Create a device compliance policy that uses Defender for Endpoint risk level, then use Conditional Access.

B.Configure a device compliance policy with 'Require Defender for Endpoint' setting.

C.Configure a device configuration policy to block access based on risk.

D.Configure an app protection policy to block access based on device risk.

AnswerA

This sets compliance based on risk and Conditional Access blocks non-compliant devices.

Why this answer

It combines a device compliance policy that evaluates the Defender for Endpoint risk level with a Conditional Access policy that blocks access when the device is noncompliant. This is the only supported method to automatically block corporate resource access based on real-time risk assessment from Defender for Endpoint.

Exam trap

The trap here is that candidates often think a device configuration policy or app protection policy can enforce risk-based blocking, but only the combination of a compliance policy with Defender risk evaluation and Conditional Access achieves this in Intune.

How to eliminate wrong answers

Option B is wrong because 'Require Defender for Endpoint' is a compliance setting that only checks if Defender is enabled and active, not the actual risk level. Option C is wrong because device configuration policies manage settings and features, not access control based on risk. Option D is wrong because app protection policies apply to apps on unmanaged devices and do not evaluate device-level risk from Defender for Endpoint.

Full explanation →

Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 526–600