Deploy a Windows LOB App Signed with Untrusted Certificate — Enable Sideloading Policy
Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. What should you do to ensure the app installs successfully?
Quick Answer
The answer is to enable the Sideloading policy for the device group. This is correct because Windows requires a trusted certificate chain to install standard LOB apps, but enabling the Sideloading policy bypasses that trust requirement, allowing deployment of apps signed with an untrusted certificate directly from Intune. On the MD-102 exam, this scenario tests your understanding of app deployment policies versus device configuration profiles—a common trap is confusing sideloading with requiring the Microsoft Store or disabling automatic updates. Remember that sideloading is an app-specific policy you toggle on for a device group, not a device restriction. A useful memory tip: think of sideloading as a “side door” that lets untrusted-signed apps in without needing a trusted certificate, so you enable it when your certificate isn’t trusted.
⚠ Common exam trap
Watch out — candidates often confuse 'sideloading' with 'allow sideloading' in a device configuration profile, but Intune requires a specific Sideloading policy (under Apps or Device configuration) rather than a generic configuration profile setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Sideloading policy for the device group.
Enabling the Sideloading policy for the device group allows installation of line-of-business (LOB) apps signed with a certificate not trusted by the devices. In Microsoft Intune, sideloading bypasses the requirement for the app's signing certificate to be trusted by the device's trusted root store, enabling successful installation of internally developed or signed LOB apps on Windows 11 devices managed via Intune.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a device configuration profile to allow sideloading.
Why it's wrong here
Sideloading is controlled via app deployment policy, not device configuration.
- ✗
Add the app to the Microsoft Store for Business.
Why it's wrong here
Adding to the store does not bypass signing requirements.
- ✗
Disable automatic app updates for the device group.
Why it's wrong here
Disabling updates does not affect sideloading capability.
- ✓
Enable the Sideloading policy for the device group.
Why this is correct
Sideloading allows installation of apps signed with untrusted certificates.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Device group
A device group is a logical collection of devices managed together for applying policies, configurations, and updates in an enterprise IT environment.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Intune to manage devices. You need to deploy a custom Windows 10 line-of-business app that is not signed. Which action must you take on the target devices to allow installation?
medium- ✓ A.Enable sideloading on the devices.
- B.Enable Developer Mode on the devices.
- C.Add the app publisher to the trusted publisher store.
- D.Turn off Windows Defender SmartScreen.
Why A: To install an unsigned line-of-business (LOB) app on Windows 10 via Intune, sideloading must be enabled on the target devices. Sideloading allows the installation of apps that are not signed by the Microsoft Store, which is required for custom LOB apps that lack a valid signature. This setting can be configured via a device configuration profile in Intune using the 'Allow sideloading of apps' policy.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.