Microsoft 365 Endpoint Administrator MD-102 (MD-102) — Questions 526–600

You manage devices with Microsoft Intune. You need to implement a conditional launch policy for Microsoft Defender for Endpoint that requires the device to have a minimum version of the sensor (10.8049.22439.1043) and a healthy signal. Which JSON policy should you deploy?

You are a Microsoft Intune administrator for Tailwind Traders. The company has enrolled Windows 11 devices. You need to configure BitLocker encryption on all devices using Intune. You have created an endpoint security policy for BitLocker and assigned it to the correct group. After 24 hours, some devices still show as not encrypted. You verify that the devices are compliant with the policy's prerequisites. What should you do to force the policy to apply?

Refer to the exhibit. The JSON snippet shows a Windows Update for Business policy assigned to a device group. Users report that quality updates are installed 7 days after release. Which setting controls this behavior?

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved Microsoft Store apps can be installed on company devices. The solution must not require users to be local administrators. What should you configure?

A company uses Microsoft Intune to manage Windows 10 devices. The administrator needs to configure Windows Defender Firewall rules via a device configuration profile. Which TWO settings can be configured?

A user reports that they cannot install a company-required app from the Company Portal on their Android device. The app is assigned as 'Available for enrolled devices' in Intune. The device is enrolled and compliant. What is the most likely issue?

You are a Microsoft 365 Endpoint Administrator for Contoso Ltd. The company has 2,000 Windows 11 devices enrolled in Microsoft Intune. You need to deploy a custom line-of-business (LOB) application (AppX package) to 500 devices used by the sales team. The app must be available in the Company Portal for users to install on demand, but it should also be automatically installed on devices that have not installed it within 7 days. Additionally, you want to ensure that the app is removed if a device is unenrolled from Intune. The sales team members are in a dynamic device group called 'Sales Devices' based on device category. You have the AppX package (.appxbundle) signed with a trusted certificate. You need to choose the correct deployment approach from the four options below.

An administrator is deploying Windows 11 using Configuration Manager. The task sequence fails on some devices during the 'Apply Operating System' step with a notice that the image file is not valid. All other devices succeed. What is the most likely cause?

Your organization uses Microsoft Intune to manage Windows 10 devices. They deploy a Win32 app using detection rules. The app installs but the detection rule incorrectly reports failure, causing repeated installation attempts. What is the best way to resolve this?

You need to ensure that only compliant devices can access corporate email in Exchange Online. Which Conditional Access policy setting should you configure?

Refer to the exhibit. You have the following compliance policy assigned to a Windows 10 device running version 10.0.22000.0. The device has a password of 8 characters and is encrypted. What is the compliance status of the device?

You are troubleshooting a Windows device that is not receiving policies from Microsoft Intune. The device shows as 'Not evaluated' or 'Pending' in the Intune console. The device is enrolled and connected to the internet. What is the most likely cause?

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to enforce BitLocker encryption on all devices. Some devices are not encrypting. You check the BitLocker policy and it is assigned correctly. What is the most likely reason?

Your organization wants to deploy Windows Update for Business policies using Microsoft Intune to Windows 10 devices. Which policy type should you use?

Your organization is implementing Windows Autopilot. Which TWO prerequisites must be met before you can use Autopilot?

You have created the above custom policy but it fails to apply on Windows 10 devices. What is the most likely reason?

Your organization has an existing Microsoft Intune environment. You need to configure a Windows 11 device to automatically enroll in Intune when a user signs in with their Microsoft Entra ID credentials. The device is joined to Microsoft Entra ID. What should you do?

Your organization uses Microsoft Intune for device management. You have a compliance policy that requires Windows devices to have BitLocker enabled. A user reports that their device is marked as non-compliant even though BitLocker is turned on. What is the most likely cause?

You are planning the enrollment of 500 Android Enterprise personally-owned work profile devices. Management requires that users must not be able to remove the work profile from their device. Which enrollment method should you use?

Your company uses Microsoft Intune to manage Android Enterprise devices. You need to ensure that work apps are sandboxed from personal apps. Which enrollment type should you use?

Your organization uses Microsoft Defender for Endpoint (part of Microsoft Defender XDR) on all Windows devices. You need to ensure that devices that are not actively reporting to Defender for Endpoint are flagged as non-compliant in Intune. What should you configure?

You need to configure Windows Update for Business policies using Intune. You want to defer feature updates by 60 days and quality updates by 14 days. Which policy setting should you use?

A company plans to deploy Windows 11 to 500 new devices using Windows Autopilot. The devices are purchased from a hardware vendor that supports OEM registration. Which prerequisite must be met to ensure Autopilot can automatically enroll these devices?

You need to deploy a custom Windows 11 feature update to a pilot group of 50 devices before rolling out to the entire organization. The devices are managed by Intune and are in a 'Pilot' Azure AD group. What is the best approach?

Northwind Traders is a retail company with 500 employees. They use Microsoft Intune to manage iOS devices. The company has a custom iOS app for inventory management that they need to deploy to all store managers. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the store managers' devices. After 48 hours, several managers report that the app is not installed on their devices. The administrator checks the Intune console and sees that the app status for those devices is 'Pending install'. What should the administrator do first to resolve the issue?

You need to ensure that Windows 10 devices automatically receive Microsoft 365 Apps updates from the Internet when not connected to the corporate network. Which update channel should you configure?

Your organization uses Microsoft Intune to deploy apps to Windows 11 devices. You need to ensure that a Win32 app installs only when the device has at least 4 GB of RAM. What should you configure?

Your organization wants to use Windows Autopilot to deploy new Windows 11 devices. What is required to register a device with Windows Autopilot?

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

Your company uses Microsoft Intune to manage Windows devices. Users frequently work from public Wi-Fi and the security team is concerned about unmanaged devices accessing corporate resources. You need to ensure that only devices compliant with your security policies can access Microsoft 365 services. What should you implement?

Your organization uses Microsoft Intune to manage devices. You need to ensure that only approved applications can run on Windows 10 devices. Which THREE components can you use to implement application control? (Choose three.)

A Win32 app 'AdobeReader' is configured as 'required' but users report the app is not installed. The above log excerpt is from a device that shows 'Installed' in Intune. What is the most likely cause?

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a configuration profile that enforces FileVault encryption. The profile must allow recovery key escrow to Intune. After deploying the profile, you notice that some devices are not encrypted. What should you check first?

Which TWO troubleshooting steps should you take when a Windows 11 device fails to enroll in Intune with error code 0x80180014?

You manage Windows 10 devices with Microsoft Intune. A user reports that a device has a red shield icon in the Windows Security Center, indicating tamper protection is off. You need to re-enable tamper protection on the device using Intune. Which profile type should you configure?

Refer to the exhibit. You run this PowerShell command using the Microsoft Graph PowerShell SDK. What is the primary purpose of this command?

Your organization uses Microsoft Intune to manage macOS devices. You need to ensure that all devices have FileVault disk encryption enabled. Which configuration profile type should you use?

Refer to the exhibit. An Intune administrator created this device restrictions policy for Windows 10 devices. Which statement about the policy is true?

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You have deployed a device configuration profile that configures the device's email settings for the native Mail app. Recently, the organization decided to switch to Microsoft Outlook for iOS as the primary email client. You need to ensure that users can only use Outlook for accessing corporate email, and that the native Mail app is blocked from accessing corporate data. Which combination of Intune policies should you implement?

Which THREE factors can cause a required app deployment to fail on a Windows 10 device managed by Intune? (Choose three.)

Your organization is deploying Windows devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune when they are first powered on. What should you configure?

An administrator is configuring Microsoft Entra ID Protection. They want to create a policy that automatically blocks sign-ins when the risk level is high. However, they notice that the policy is not triggering for some users who have high risk. What is the most likely reason?

You are the Intune administrator for a company that uses Microsoft Entra ID (Azure AD) for identity. You have a line-of-business (LOB) iOS app that is distributed via Intune using volume purchase program (VPP) tokens. The app requires a configuration policy to set the server URL. You have assigned the app as 'Required' to all users in the 'Sales' group. Some users report that the app does not show the configured server URL. You verify that the app configuration policy is assigned to the same 'Sales' group. The app installs successfully. You check the Intune console and see that the app configuration policy has a status of 'Pending' for some devices. The devices are company-owned iPhones running iOS 16. What is the most likely cause of the configuration not applying?

Your organization is deploying Windows 10 devices using Windows Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are required to set up Windows Hello for Business. Which TWO configurations should you apply?

You are configuring Microsoft Intune for a school that provides iPads to students. You want students to be able to use their personal Apple IDs to install apps, but you need to ensure that the devices are enrolled in Intune and managed. Which Apple enrollment method should you use?

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy Microsoft 365 Apps for enterprise to 500 devices. The devices are in a hybrid Azure AD joined configuration. The administrator wants to use Intune to deploy the apps. Which deployment method should the administrator use?

A company manages devices with Microsoft Intune. They need to deploy a line-of-business (LOB) app to iOS devices. Which TWO of the following are required?

You are planning to enroll macOS devices in Intune. Users must authenticate with their Microsoft Entra ID credentials and then be prompted to install the Company Portal app. Which enrollment method should you use?

Your organization uses Microsoft Intune to manage Windows 10 and iOS devices. You need to deploy a certificate-based authentication solution for Wi-Fi and VPN access. You have set up a Certificate Connector for Microsoft Intune and issued a root CA certificate. You have created a trusted certificate profile for the root CA and a SCEP certificate profile for client certificates. However, iOS devices are failing to enroll for client certificates. You verify that the SCEP profile is correctly configured and assigned. What is the most likely cause?

A company uses Microsoft Intune to manage devices. They need to report on which devices have a specific Windows update installed. Which reporting method should be used?

You deploy a Windows 11 kiosk device using Intune. The kiosk should run a single app (Microsoft Edge). After assignment, the device starts but shows a blank screen. What is the most likely issue?

You manage a fleet of Android Enterprise devices. You need to ensure that only approved apps from the managed Play Store can be installed. What configuration should you enable?

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a security baseline that enforces BitLocker encryption and Windows Defender Antivirus settings. What is the recommended approach?

A company uses Microsoft Intune to manage macOS devices. They need to enforce FileVault encryption on all Macs. What should they configure?

A company uses Windows Autopilot for user-driven deployments. They want to ensure that during the out-of-box experience (OOBE), users are required to sign in with their Azure AD credentials and the device is automatically enrolled in Intune. Which Autopilot deployment profile setting should be configured?

An organization wants to enforce encryption on all Windows 10/11 devices using Intune. Which policy type should they use?

Your company has a Microsoft Intune environment with Windows devices. You need to deploy a Microsoft 365 Apps update using the Semi-Annual Enterprise Channel. You have configured the update channel in an Intune administrative template. However, devices are not receiving the updates. What is the most likely cause?

You are an enterprise administrator for Contoso Ltd. You need to configure Microsoft 365 tenant-wide settings for external collaboration. Which TWO actions should you take to meet the following goals: (1) allow only specific external domains to collaborate with your organization, and (2) ensure that external users are required to sign in with multi-factor authentication (MFA) before accessing shared resources?

Which THREE components are required for a successful Windows Autopilot deployment with user-driven Microsoft Entra ID join? (Select three.)

Contoso Ltd. is a financial services company with 2,000 users. They use Microsoft Intune to manage Windows 10 devices. The company has a strict security policy that requires all devices to have a specific set of security applications installed: an antivirus (AV) app, a disk encryption app, and a VPN client. These apps are all line-of-business (LOB) Win32 apps packaged as .intunewin files. The administrator created a Win32 app for each and assigned them as 'Required' to all devices. After the deployment, the administrator notices that the apps are not installing on approximately 10% of devices. The devices are online and have connectivity. The Intune Management Extension is running. When the administrator checks the Intune Management Extension logs on a failing device, they see the following error: 'Failed to download content. Error: 0x80070002 - The system cannot find the file specified.' What is the most likely cause?

You need to enable users to install company apps from a private store on their iOS devices. Which Microsoft Intune feature should you use?

Your organization uses Microsoft Intune to manage Android enterprise devices. You need to ensure that only approved apps from the managed Google Play store can be installed on work profiles. Which configuration should you use?

You need to ensure that Windows 10 devices automatically enroll in Intune when they join Microsoft Entra ID. Which setting should you configure?

Your organization uses Microsoft Defender for Endpoint (Defender XDR) and Intune. You need to ensure that when a device is found to have a critical vulnerability, a remediation action is automatically triggered. Which integration should you configure?

You are deploying a Win32 app that requires administrator privileges to install. The app runs on Windows 11 devices. How should you configure the app in Intune to ensure it installs with elevated privileges?

You are designing a device management strategy for a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You need to ensure that devices are managed by Intune and can access on-premises resources. Which approach should you recommend?

You manage devices with Microsoft Intune. Users report that enrollment fails on Android Enterprise personally-owned work profiles. After reviewing enrollment restrictions, you verify that Android Enterprise is allowed. What should you check next?

Your organization uses Microsoft Intune to manage Windows 10 devices. You create a device configuration profile for kiosk mode. The profile is assigned to a device group. After syncing, the device does not enter kiosk mode. What should you check first?

Match each Microsoft 365 Apps update channel to its description.

Your organization uses Microsoft Intune to manage iOS devices. You need to ensure that corporate data in Microsoft Outlook is protected even if the device is not enrolled in MDM. Which policy should you deploy?

You are deploying Windows 10 devices using Autopilot. You need to ensure that during the out-of-box experience (OOBE), users are blocked from bypassing the sign-in screen by clicking 'Skip for now'. Which setting should you configure in the Enrollment Status Page (ESP) profile?

You are managing Windows 10 devices with Intune. You need to deploy a PowerShell script that runs under the system context during device enrollment. Which approach should you use?

Your organization has Windows 10 devices managed by Intune. You need to enforce BitLocker encryption on all devices. The devices must use a TPM protector and a recovery password. What should you configure?

You are deploying a line-of-business (LOB) app to iOS devices managed by Intune. The app requires a specific configuration to access internal resources. Which approach should you use to deliver the configuration?

A user has a Windows 10 device that is enrolled in Microsoft Intune. The user reports that they cannot install a required app from the Company Portal. You check the Intune console and see that the app assignment is 'Required' but the installation status shows 'Failed'. The device is compliant. What should you check first?