The answer is that the app must be uploaded as a .ipa file, signed with an Apple Developer Enterprise Distribution certificate. This certificate is essential because iOS line-of-business apps distributed outside the App Store require enterprise code signing to bypass Apple’s individual app approval process, enabling the device to trust and install the app via Intune without validation failures. On the Microsoft 365 Endpoint Administrator MD-102 exam, this condition tests your understanding of enterprise app distribution prerequisites, often appearing alongside traps like confusing the Enterprise certificate with a standard Developer certificate or assuming a .plist file is sufficient. Remember the key distinction: for iOS LOB app prerequisites in Intune, the .ipa file must carry the Enterprise signature—not the App Store or ad-hoc profile—because Intune relies on this trust chain for managed deployment. A simple memory tip is “Enterprise .ipa, not App Store .plist,” reinforcing that the file type and signing authority are both non-negotiable.
MD-102 Manage applications Practice Question
This MD-102 practice question tests your understanding of manage applications. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which THREE conditions must be met for an iOS line-of-business app to be successfully installed via Intune?
Why wrong: Assignment is required for deployment, but the question asks for conditions for installation, not deployment. However, without assignment it won't install. But the three correct answers are the technical prerequisites.
B
The app must be signed with an Apple Developer Enterprise Distribution certificate.
Enterprise certificate is required for LOB apps.
C
The device UDID must be registered with Apple Business Manager.
For LOB apps not distributed via VPP, each device UDID must be registered.
D
The app must be uploaded as a .ipa file.
The .ipa format is required for iOS apps.
E
The user must have an active Apple ID.
Why wrong: Apple ID is not required for managed LOB apps.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The app must be signed with an Apple Developer Enterprise Distribution certificate.
Option B is correct because iOS line-of-business (LOB) apps distributed outside the App Store must be signed with an Apple Developer Enterprise Distribution certificate to be trusted by the device. This certificate allows the app to run without being individually approved by Apple, which is required for Intune-managed enterprise deployment. Without this signing, the device will reject the installation due to code signing validation failures.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The app must be assigned to a security group.
Why it's wrong here
Assignment is required for deployment, but the question asks for conditions for installation, not deployment. However, without assignment it won't install. But the three correct answers are the technical prerequisites.
✓
The app must be signed with an Apple Developer Enterprise Distribution certificate.
Why this is correct
Enterprise certificate is required for LOB apps.
Related concept
Read the scenario before looking for a memorised answer.
✓
The device UDID must be registered with Apple Business Manager.
Why this is correct
For LOB apps not distributed via VPP, each device UDID must be registered.
Related concept
Read the scenario before looking for a memorised answer.
✓
The app must be uploaded as a .ipa file.
Why this is correct
The .ipa format is required for iOS apps.
Related concept
Read the scenario before looking for a memorised answer.
✗
The user must have an active Apple ID.
Why it's wrong here
Apple ID is not required for managed LOB apps.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the prerequisites for App Store apps (which require an Apple ID) with those for enterprise LOB apps, leading them to incorrectly select 'active Apple ID' as a requirement.
Detailed technical explanation
How to think about this question
The Apple Developer Enterprise Program allows organizations to sign apps with a distribution certificate that is trusted by all devices enrolled in MDM via a configuration profile. Under the hood, Intune uses the MDM protocol to push the .ipa file and a manifest plist to the device, which then validates the code signature against the enterprise certificate's trust chain. A real-world scenario where this matters is when an organization uses an in-house app that accesses sensitive data; without the enterprise certificate, the device would block the installation with a 'Cannot verify app' error.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MD-102 question in full detail.
Manage applications — This question tests Manage applications — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The app must be signed with an Apple Developer Enterprise Distribution certificate. — Option B is correct because iOS line-of-business (LOB) apps distributed outside the App Store must be signed with an Apple Developer Enterprise Distribution certificate to be trusted by the device. This certificate allows the app to run without being individually approved by Apple, which is required for Intune-managed enterprise deployment. Without this signing, the device will reject the installation due to code signing validation failures.
What should I do if I get this MD-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are required to deploy an iOS line-of-business app via Microsoft Intune? (Select TWO.)
easy
✓ A.iOS app package file (.ipa)
B.Apple Developer signing certificate
✓ C.iOS provisioning profile
D.Volume purchase program (VPP) token
E.MDM push certificate
Why A: An .ipa file is the app package. A provisioning profile is needed for app installation. An MDM push certificate is for device management, not app deployment. A VPP token is for volume purchasing. A signing certificate is needed for development, but the provisioning profile includes signing info. So the two required are .ipa and provisioning profile.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.