CCNA Manage applications Questions — Page 2 of 3

Multi-Selectmedium

Which TWO are prerequisites for deploying Win32 apps via Microsoft Intune?

Select 2 answers

A.The Intune management extension must be installed on devices

B.The app must be signed with a Microsoft certificate

C.Devices must be Microsoft Entra ID joined or hybrid joined

D.Devices must have at least 4 GB of RAM

E.Devices must be enrolled with user affinity

AnswersA, C

The extension handles Win32 app deployment.

Why this answer

The Intune management extension is the client-side component that handles Win32 app detection, download, and installation on Windows devices. Without this extension, Intune cannot process the PowerShell scripts or .intunewin files required for Win32 app deployment.

Exam trap

The trap here is that candidates often confuse the requirement for the Intune management extension with the need for user affinity, but the extension works in device context and does not require a signed-in user.

Practice this question →

MCQmedium

Refer to the exhibit. You deploy this ARM template to create an Intune configuration policy for macOS devices. The policy sets the 'com.apple.ManagedClient.appstore' setting to true. What is the expected behavior on the target macOS devices?

A.Users will be allowed to install apps from the App Store.

B.App Store updates will be automatically installed.

C.Only apps purchased through Apple Business Manager will be installable.

D.Users will be blocked from installing apps from the App Store.

AnswerA

Setting enables App Store access.

Why this answer

Setting 'com.apple.ManagedClient.appstore' to true in an Intune macOS configuration policy explicitly allows users to install apps from the App Store. This key controls the 'allow app store app installation' restriction; when true, the restriction is disabled, meaning users can install apps from the App Store. The policy does not affect automatic updates or restrict installation to only Apple Business Manager purchases.

Exam trap

Microsoft often tests the misconception that a single boolean key controls multiple App Store behaviors (like updates or ABM restrictions), when in fact each behavior has its own distinct key in the macOS Restrictions payload.

How to eliminate wrong answers

Option B is wrong because automatic App Store updates are controlled by a separate key, 'com.apple.ManagedClient.appstore.automaticDownload', not by the 'appstore' key. Option C is wrong because restricting installation to only Apple Business Manager purchases requires the 'com.apple.ManagedClient.restrictAppStore' key or a device enrollment type that blocks the App Store entirely, not setting 'appstore' to true. Option D is wrong because setting 'com.apple.ManagedClient.appstore' to true allows installation, not blocks it; blocking would require setting this key to false.

Practice this question →

MCQhard

Your organization plans to deploy a Win32 app to Windows 10 devices using Intune. The app requires the .NET Framework 4.8, which is not present on all devices. How should you handle this dependency?

A.Include the .NET installer in the same package

B.Use a PowerShell script to install .NET before the app

C.Add a dependency in Intune for the .NET Framework

D.Configure a detection rule for .NET

AnswerC

Dependencies ensure prerequisites are installed first.

Why this answer

Intune's dependency feature allows you to specify another app (like .NET Framework 4.8) that must be installed before the Win32 app. Intune automatically installs the dependency app from the same Intune management extension context, ensuring the required runtime is present without manual scripting or bundling. This is the native, supported method for handling prerequisites in Win32 app deployment.

Exam trap

The trap here is that candidates confuse detection rules (which only check for existing software) with dependency management (which actually installs prerequisites), leading them to incorrectly choose Option D or attempt manual scripting in Option B.

How to eliminate wrong answers

Option A is wrong because including the .NET installer in the same package violates the principle of separation of concerns and can cause detection logic conflicts; Intune treats the package as a single app, so you cannot independently detect or manage .NET separately. Option B is wrong because using a PowerShell script to install .NET before the app is an unsupported workaround that bypasses Intune's dependency management, leading to unreliable detection and potential installation failures if the script fails. Option D is wrong because a detection rule only verifies whether the app is already installed; it does not trigger installation of the missing dependency, so .NET would remain absent and the app would fail to install.

Practice this question →

MCQmedium

Refer to the exhibit. You deploy this AppLocker policy via Microsoft Intune to Windows 10 devices. The policy is in AuditOnly mode. Users are now able to run unsigned executables. You need to block unsigned executables without affecting signed ones. What should you do?

A.Add a deny rule for all Microsoft signed executables.

B.Keep the policy in AuditOnly and rely on Windows Defender to block unsigned apps.

C.Delete the existing rule and create a new rule that explicitly allows only specific signed apps.

D.Change the EnforcementMode to 'Enabled' and add a deny rule for unsigned executables.

AnswerD

Enabling enforcement with only allow rules for signed blocks unsigned.

Why this answer

AppLocker's AuditOnly mode logs events but does not enforce rules. To block unsigned executables, you must change the EnforcementMode to 'Enabled' so that rules are enforced. Adding a deny rule for unsigned executables specifically blocks them while allowing signed executables to run, provided no conflicting allow rules exist.

This approach ensures that only unsigned executables are blocked, leaving signed ones unaffected.

Exam trap

Microsoft often tests the misconception that AuditOnly mode can block applications if combined with other security features like Windows Defender, but in reality, AuditOnly only logs events and never enforces blocks, so you must change the enforcement mode to 'Enabled' for any AppLocker rule to take effect.

How to eliminate wrong answers

Option A is wrong because adding a deny rule for all Microsoft signed executables would block the very signed executables you want to allow, contradicting the requirement. Option B is wrong because relying on Windows Defender to block unsigned apps is not a substitute for AppLocker enforcement; Windows Defender focuses on malware detection, not application control policies, and AuditOnly mode does not enforce any blocks. Option C is wrong because deleting the existing rule and creating a new rule that explicitly allows only specific signed apps would block all other executables, including legitimate signed ones not in the allow list, which is overly restrictive and not required.

Practice this question →

MCQhard

Refer to the exhibit. You are deploying Microsoft 365 Apps via Intune Win32 app packaging. The detection rule checks for the registry key existence. After installation, Intune reports the app as not detected. What is the most likely reason?

A.The detection type 'exists' is not supported for registry detection

B.The registry key path is incorrect for a 64-bit system

C.The app did not create the registry key during installation

D.The detection runs in 32-bit context and does not see the 64-bit registry key

AnswerD

32-bit detection redirected to WOW6432Node, but check32BitOn64System is false.

Why this answer

Intune Win32 app detection rules run in a 32-bit context by default on 64-bit systems. This means the detection script or rule checks the 32-bit registry view (Wow6432Node) rather than the 64-bit registry view. If the app created the registry key in the 64-bit path (e.g., HKLM\Software\Microsoft\Office), the 32-bit detection will not see it, causing a false 'not detected' state.

Exam trap

The trap here is that candidates assume registry detection is straightforward and overlook the 32-bit vs. 64-bit registry redirection, leading them to incorrectly blame the key path or the detection type instead of the context mismatch.

How to eliminate wrong answers

Option A is wrong because the 'exists' detection type is fully supported for registry detection in Intune Win32 apps; it is a common and valid rule. Option B is wrong because the registry key path may be correct for a 64-bit system, but the issue is not the path itself—it is the registry redirection that hides the key from the 32-bit detection context. Option C is wrong because the app likely did create the registry key during installation, but the detection fails due to the registry view mismatch, not because the key is missing.

Practice this question →

MCQeasy

A company uses Microsoft Intune to manage devices. They need to ensure that a critical line-of-business app is updated automatically on all devices. Which assignment type should they use?

A.Required

B.End-user notification

C.Uninstall

D.Available for enrolled devices

AnswerA

Forces app installation and updates.

Why this answer

The Required assignment type in Microsoft Intune automatically installs and updates apps on managed devices without user interaction, making it the correct choice for ensuring a critical line-of-business app is updated automatically. This assignment enforces the app deployment policy by pushing the update to devices during their next check-in with the Intune service, typically within 8 hours.

Exam trap

The trap here is that candidates confuse 'Available for enrolled devices' with automatic updates, but it only provides optional installation from the Company Portal, not forced updates, which is a common misconception in MD-102 exams.

How to eliminate wrong answers

Option B is wrong because End-user notification is not an assignment type; it is a setting within an app assignment that controls whether users receive notifications about app updates, but it does not enforce automatic updates. Option C is wrong because Uninstall is an assignment type used to remove an app from devices, not to update it. Option D is wrong because Available for enrolled devices allows users to install the app from the Company Portal on demand, but it does not automatically update the app; users must manually trigger the update.

Practice this question →

MCQeasy

You are a Microsoft 365 administrator for a school district. You have 2,000 Windows 10 devices used by students. All devices are enrolled in Microsoft Intune. You need to deploy a set of educational apps from the Microsoft Store for Education (now part of Microsoft Store for Business). The apps should be automatically installed on all student devices, and students should not be able to remove them. You have already added the apps to your Microsoft Store for Business inventory and acquired offline licenses. You have also configured Intune to sync the Microsoft Store for Business. Which action should you take in Intune to deploy the apps with the least administrative effort?

A.Create a 'Microsoft Store for Business' app in Intune, select the offline-licensed apps, and assign as 'Required' to a device group containing all student devices.

B.Use the 'Microsoft Store app (Windows)' type and assign as 'Required' to the device group.

C.Create a 'Microsoft Store for Business' app in Intune, select the online-licensed apps, and assign as 'Available' to a user group.

D.Download the app packages and deploy as Win32 apps with silent switches.

AnswerA

Offline licenses allow silent install without user interaction.

Why this answer

Using the 'Microsoft Store for Business' app type with offline licenses allows automatic sync and silent installation. Option B is for user-targeted. Option C is for online licenses.

Option D is for Win32 apps.

Practice this question →

Multi-Selecthard

You are deploying a Win32 app via Intune that requires .NET Framework 4.8 as a dependency. Which THREE steps must you perform to ensure the dependency is installed before the app?

Select 3 answers

A.Configure a detection rule for .NET Framework in the main app.

B.In the main app's properties, add a dependency and select the .NET Framework app.

C.Set the dependency to 'Auto-install' so it installs before the main app.

D.Add .NET Framework 4.8 as a separate app in Intune.

E.Create a supersedence relationship where the .NET Framework app supersedes the main app.

AnswersB, C, D

Dependencies are defined in the app properties.

Why this answer

Intune dependencies allow you to specify another app that must be installed before the main app. By adding .NET Framework 4.8 as a separate app in Intune and then configuring a dependency in the main app's properties that references that app, you ensure the dependency is installed first. This is the only supported method for enforcing installation order via dependencies in Intune.

Exam trap

The trap here is that candidates confuse dependencies with supersedence, thinking supersedence can enforce installation order, but supersedence is designed for app replacement, not prerequisite installation.

Practice this question →

MCQmedium

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved Microsoft Store apps can be installed on company devices. The solution must not require users to be local administrators. What should you configure?

A.Enable Conditional Access to block non-approved apps.

B.Deploy a local AppLocker policy using Intune.

C.Configure Windows Defender Application Control (WDAC) policy.

D.Assign an Intune App Protection Policy (APP) for Windows.

AnswerB

AppLocker can be configured via Intune to restrict app installations to approved Store apps.

Why this answer

AppLocker, when deployed via Intune as a local policy, allows you to create rules that restrict application execution to only approved Microsoft Store apps. This policy is enforced at the kernel level and does not require users to have local administrator privileges, as the rules are applied system-wide and cannot be overridden by standard users.

Exam trap

The trap here is that candidates often confuse AppLocker with Windows Defender Application Control (WDAC), thinking WDAC is the only way to control app installation, but AppLocker is the correct choice for this specific requirement of allowing only Microsoft Store apps without requiring local admin rights and with simpler management via Intune.

How to eliminate wrong answers

Option A is wrong because Conditional Access controls access to cloud resources (e.g., blocking sign-ins from non-compliant devices) but does not control which apps can be installed or run locally on the device. Option C is wrong because Windows Defender Application Control (WDAC) is a more restrictive, code-integrity-based policy that typically requires a reboot and is designed for high-security environments; it is not the simplest solution for allowing only Microsoft Store apps without local admin rights, and it can be complex to manage via Intune. Option D is wrong because Intune App Protection Policies (APP) apply to mobile application management (MAM) scenarios on iOS and Android, not to Windows 10 desktop app installation or execution control.

Practice this question →

MCQhard

Your organization uses Microsoft Intune to manage Windows 10 devices. They deploy a Win32 app using detection rules. The app installs but the detection rule incorrectly reports failure, causing repeated installation attempts. What is the best way to resolve this?

A.Uninstall and redeploy the app

B.Update the detection rule to accurately reflect installed state

C.Reinstall the app manually

D.Modify the installation command to suppress output

AnswerB

Corrects the false failure.

Why this answer

The detection rule is the mechanism Intune uses to determine whether a Win32 app is already installed. If the rule incorrectly reports failure despite successful installation, Intune will repeatedly attempt to reinstall the app. Updating the detection rule to accurately reflect the installed state (e.g., checking for the correct file, registry key, or version) stops the unnecessary reinstall loop without requiring manual intervention or reconfiguration of the deployment.

Exam trap

The trap here is that candidates often assume the issue is with the installation command or the app itself, rather than recognizing that Intune's detection logic is the sole trigger for reinstallation attempts.

How to eliminate wrong answers

Option A is wrong because uninstalling and redeploying the app does not fix the root cause—the flawed detection rule—so the same incorrect detection will trigger reinstallation again after redeployment. Option C is wrong because manually reinstalling the app does not correct the detection rule; Intune will still detect the app as not installed based on the faulty rule and continue its reinstall attempts. Option D is wrong because modifying the installation command to suppress output does not change how Intune evaluates the detection rule; suppression only hides logs and does not address the mismatch between actual installation state and detection logic.

Practice this question →

MCQeasy

Northwind Traders is a retail company with 500 employees. They use Microsoft Intune to manage iOS devices. The company has a custom iOS app for inventory management that they need to deploy to all store managers. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the store managers' devices. After 48 hours, several managers report that the app is not installed on their devices. The administrator checks the Intune console and sees that the app status for those devices is 'Pending install'. What should the administrator do first to resolve the issue?

A.Deploy a certificate profile that installs the enterprise root certificate to the affected devices.

B.Create an app protection policy and assign it to the devices.

C.Instruct the users to install the app manually from the Company Portal app.

D.Re-upload the .ipa file to Intune with a different version number.

AnswerA

The devices need to trust the enterprise certificate.

Why this answer

The 'Pending install' status for an enterprise-signed iOS app typically indicates that the device does not trust the enterprise certificate used to sign the app. Deploying a certificate profile that installs the enterprise root certificate on the affected devices establishes trust, allowing the app to install successfully. Without this trust, iOS blocks the installation of any enterprise-signed app, even when assigned as 'Required' via Intune.

Exam trap

The trap here is that candidates may assume the issue is with the app package or assignment, rather than recognizing that iOS's enterprise app trust model requires the root certificate to be explicitly deployed to devices before installation can occur.

How to eliminate wrong answers

Option B is wrong because app protection policies (MAM) control data access and behavior within apps, not the installation of enterprise-signed apps; they do not resolve certificate trust issues. Option C is wrong because instructing users to install manually from Company Portal will still fail if the enterprise root certificate is not trusted on the device, as iOS will block the installation. Option D is wrong because re-uploading the .ipa file with a different version number does not address the underlying certificate trust issue; the app will remain in 'Pending install' until the device trusts the signing certificate.

Practice this question →

MCQmedium

Your organization uses Microsoft Intune to deploy apps to Windows 11 devices. You need to ensure that a Win32 app installs only when the device has at least 4 GB of RAM. What should you configure?

A.A dependency rule that includes a RAM check

B.A return code for insufficient RAM

C.A requirement rule that specifies minimum RAM

D.A detection rule for RAM

AnswerC

Requirement rules define hardware and software prerequisites.

Why this answer

To enforce a hardware prerequisite like minimum RAM for a Win32 app in Microsoft Intune, you configure a requirement rule. Requirement rules define the device conditions (e.g., operating system architecture, disk space, or RAM) that must be met before the app can install. Option C is correct because it directly specifies a minimum RAM value as a requirement rule, ensuring the app installs only on devices with at least 4 GB of RAM.

Exam trap

The trap here is confusing requirement rules (which enforce hardware/software prerequisites) with detection rules (which verify existing installation) or dependency rules (which manage app installation order), leading candidates to incorrectly select a detection or dependency rule for a hardware prerequisite.

How to eliminate wrong answers

Option A is wrong because dependency rules control the order of app installation (e.g., requiring another app to be installed first), not hardware checks like RAM. Option B is wrong because return codes define how Intune interprets the exit code from the app installer (e.g., success, reboot, or failure), but they cannot enforce a prerequisite condition before installation begins. Option D is wrong because detection rules are used to determine whether an app is already installed (e.g., checking for a file or registry key), not to evaluate hardware requirements before installation.

Practice this question →

MCQhard

A Win32 app 'AdobeReader' is configured as 'required' but users report the app is not installed. The above log excerpt is from a device that shows 'Installed' in Intune. What is the most likely cause?

A.The detection script incorrectly reports the app as installed.

B.The app is assigned to a different device group.

C.The app was installed but later removed by the user.

D.The device is not syncing with Intune.

AnswerA

The script returns exit code 0 and stdout 'Installed', so Intune skips enforcement. The actual app may be missing.

Why this answer

The log excerpt indicates that Intune reports the app as 'Installed' on the device, yet users confirm it is not present. This discrepancy most likely occurs because the detection script used to verify installation is flawed—it may be checking for a registry key, file, or version string that exists even when the app is not fully installed, or it may be returning a false positive. Since Intune relies entirely on the detection method to determine installation status, an incorrect script would cause Intune to mark the app as installed without the actual binaries being present.

Exam trap

The trap here is that candidates assume 'Installed' in Intune means the app is physically present on the device, but Intune only reflects what the detection method reports, not the actual file system state.

How to eliminate wrong answers

Option B is wrong because if the app were assigned to a different device group, the device would not receive the required assignment at all, and Intune would not show the app as 'Installed'—it would show 'Not applicable' or 'Pending'. Option C is wrong because if the user removed the app, Intune's next sync would detect the absence via the detection script and reinstall the app (since it's required), or at minimum change the status to 'Failed' or 'Not installed'. Option D is wrong because if the device were not syncing, Intune would show a stale or 'Last check-in' status older than 24 hours, and the app status would likely be 'Pending' or 'Unknown', not 'Installed'.

Practice this question →

Multi-Selecthard

Which THREE factors can cause a required app deployment to fail on a Windows 10 device managed by Intune? (Choose three.)

Select 3 answers

A.The device has an app update policy that blocks updates.

B.The device is not connected to the internet.

C.The user is not assigned to the app.

D.The device does not meet the app's requirement rules.

E.The app's dependency is not installed.

AnswersB, D, E

Internet connectivity is required to download the app.

Why this answer

Intune requires a device to have internet connectivity to communicate with the Microsoft Intune service and download required app deployments. Without internet access, the Intune Management Extension cannot retrieve the app assignment policy or download the application content from the cloud, causing the deployment to fail.

Exam trap

The trap here is that candidates often confuse 'app update policy' (which controls updates) with 'app deployment policy' (which controls initial installation), leading them to incorrectly select Option A as a cause of deployment failure.

Practice this question →

MCQhard

You are the Intune administrator for a company that uses Microsoft Entra ID (Azure AD) for identity. You have a line-of-business (LOB) iOS app that is distributed via Intune using volume purchase program (VPP) tokens. The app requires a configuration policy to set the server URL. You have assigned the app as 'Required' to all users in the 'Sales' group. Some users report that the app does not show the configured server URL. You verify that the app configuration policy is assigned to the same 'Sales' group. The app installs successfully. You check the Intune console and see that the app configuration policy has a status of 'Pending' for some devices. The devices are company-owned iPhones running iOS 16. What is the most likely cause of the configuration not applying?

A.The iOS version does not support app configuration

B.The app configuration policy is not assigned to the correct group

C.The devices are not supervised

D.The app is not deployed via VPP correctly

AnswerC

App configuration policies for VPP apps require supervised mode.

Why this answer

App configuration policies for iOS devices require the device to be supervised, especially when using VPP tokens. The 'Pending' status indicates the policy has not been applied because the devices are not supervised. Option A is wrong because the app installs successfully, indicating iOS version compatibility.

Option B is wrong because the policy is assigned to the same group, but supervision is still required. Option D is wrong because the app is deployed via VPP correctly; the issue is with configuration policy enforcement, not VPP deployment.

Practice this question →

MCQeasy

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy Microsoft 365 Apps for enterprise to 500 devices. The devices are in a hybrid Azure AD joined configuration. The administrator wants to use Intune to deploy the apps. Which deployment method should the administrator use?

A.Use the Office Deployment Tool (ODT) to create a configuration file and deploy via Intune as a Win32 app.

B.Use Group Policy to deploy the Office 2019 suite.

C.Add a 'Microsoft 365 Apps for Windows 10 and later' app in Intune and assign it to the devices.

D.Upload the Office installation files as a line-of-business (LOB) app.

AnswerC

This is the recommended method for deploying Microsoft 365 Apps via Intune.

Why this answer

Intune provides a built-in 'Microsoft 365 Apps for Windows 10 and later' app type that is specifically designed to deploy and manage Microsoft 365 Apps for enterprise. This method uses Intune's native integration with the Office Content Delivery Network (CDN) to download and install the latest version of Office, and it supports hybrid Azure AD joined devices without requiring additional tools or configuration files.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing the Office Deployment Tool (Option A) because they think it provides more control, but they miss that Intune's native 'Microsoft 365 Apps' app type is the simplest and most appropriate method for standard deployments, especially when no custom XML configuration is required.

How to eliminate wrong answers

Option A is wrong because while the Office Deployment Tool (ODT) can be used to create a configuration file, deploying it as a Win32 app is unnecessarily complex and bypasses Intune's native Office app management capabilities, which provide automatic updates and simplified assignment. Option B is wrong because Group Policy is not an Intune deployment method; it relies on on-premises Active Directory and does not integrate with Intune for cloud-managed device deployment. Option D is wrong because uploading Office installation files as a line-of-business (LOB) app is intended for single-file or simple app packages, not for the multi-component, dynamically updated Microsoft 365 Apps suite, and it would require manual updates and lack the built-in configuration options.

Practice this question →

MCQeasy

You manage a fleet of Android Enterprise devices. You need to ensure that only approved apps from the managed Play Store can be installed. What configuration should you enable?

A.Set the device to 'Fully managed' and disable unknown sources.

B.Deploy an app configuration policy that blocks sideloading.

C.Configure a device restriction policy to allow only managed Google Play apps.

D.Use a compliance policy to block non-compliant apps.

AnswerC

This policy enforces that only apps from the managed Play Store can be installed.

Why this answer

A device restriction policy in Microsoft Intune allows you to restrict app installation to only the managed Google Play store. By configuring the 'Allow only managed Google Play apps' setting, you ensure that users cannot install apps from unapproved sources, effectively controlling the app ecosystem on Android Enterprise devices.

Exam trap

The trap here is that candidates often confuse reactive compliance policies (which detect non-compliant apps after installation) with proactive device restriction policies (which prevent installation entirely), leading them to choose Option D instead of the correct proactive setting.

How to eliminate wrong answers

Option A is wrong because setting the device to 'Fully managed' and disabling unknown sources does not restrict installations to only managed Google Play apps; it only prevents sideloading from unknown sources, but users could still install apps from the public Play Store. Option B is wrong because an app configuration policy is used to configure app-specific settings (e.g., account credentials or permissions), not to block sideloading or restrict app sources; blocking sideloading is a device restriction. Option D is wrong because a compliance policy can mark devices as non-compliant if non-approved apps are detected, but it does not prevent installation of those apps in the first place; it only reacts after the fact.

Practice this question →

MCQhard

Contoso Ltd. is a financial services company with 2,000 users. They use Microsoft Intune to manage Windows 10 devices. The company has a strict security policy that requires all devices to have a specific set of security applications installed: an antivirus (AV) app, a disk encryption app, and a VPN client. These apps are all line-of-business (LOB) Win32 apps packaged as .intunewin files. The administrator created a Win32 app for each and assigned them as 'Required' to all devices. After the deployment, the administrator notices that the apps are not installing on approximately 10% of devices. The devices are online and have connectivity. The Intune Management Extension is running. When the administrator checks the Intune Management Extension logs on a failing device, they see the following error: 'Failed to download content. Error: 0x80070002 - The system cannot find the file specified.' What is the most likely cause?

A.The content for the Win32 app was not uploaded correctly or is missing from Intune.

B.The Intune Management Extension does not have permission to install apps on those devices.

C.The user is not logged in, so the app cannot be installed.

D.The app detection rules do not match the installed version.

AnswerA

The error indicates the file cannot be found, suggesting the content is missing.

Why this answer

The error 0x80070002 ('The system cannot find the file specified') in the Intune Management Extension logs indicates that the client is attempting to download the Win32 app content from Intune, but the content blob is missing or inaccessible. This typically occurs when the .intunewin file was not uploaded correctly, the upload was interrupted, or the content was deleted from Intune after assignment. Since the extension is running and connectivity is confirmed, the issue is server-side content availability, not client-side permissions or detection logic.

Exam trap

The trap here is that candidates often confuse a download failure with a detection rule mismatch or permission issue, but the specific error code 0x80070002 points directly to missing content on the server side, not client-side configuration problems.

How to eliminate wrong answers

Option B is wrong because the Intune Management Extension runs as SYSTEM and does not require additional permissions to install apps; a permission issue would manifest as an access denied error, not a 'file not found' error. Option C is wrong because Win32 apps assigned as 'Required' install in the system context regardless of user login state; user presence is irrelevant for system-context installations. Option D is wrong because detection rules only affect whether the app is considered installed after the download and installation attempt; they do not cause a download failure with error 0x80070002, which occurs before any detection logic runs.

Practice this question →

MCQeasy

You need to enable users to install company apps from a private store on their iOS devices. Which Microsoft Intune feature should you use?

A.Volume Purchase Program (VPP)

B.Mobile Application Management (MAM) policies

C.Certificate profiles

D.Company Portal app

AnswerA

VPP enables distribution of licensed apps to devices.

Why this answer

The Volume Purchase Program (VPP) is the correct feature because it allows organizations to purchase app licenses in bulk from Apple and distribute them to users' iOS devices through a private store. By integrating VPP with Microsoft Intune, you can assign licensed apps to users or devices, enabling them to install company-approved apps from a private store without requiring an Apple ID or personal payment.

Exam trap

The trap here is that candidates confuse the Company Portal app (the user-facing installation interface) with the underlying licensing and distribution mechanism (VPP) that actually enables the private store functionality.

How to eliminate wrong answers

Option B is wrong because Mobile Application Management (MAM) policies control app behavior (e.g., data protection, access requirements) but do not provide a mechanism to distribute or install apps from a private store. Option C is wrong because certificate profiles are used for authentication and secure communication (e.g., Wi-Fi, VPN, email profiles), not for app distribution or store configuration. Option D is wrong because the Company Portal app is the client interface for users to access and install apps, but it is not the feature that enables the private store; the private store is enabled by VPP integration, and Company Portal simply presents the apps.

Practice this question →

MCQeasy

Your organization uses Microsoft Intune to manage Android enterprise devices. You need to ensure that only approved apps from the managed Google Play store can be installed on work profiles. Which configuration should you use?

A.Configure a device compliance policy that requires 'Allow installation from unknown sources' to be disabled

B.Use a conditional access policy to block unapproved apps

C.Create an app configuration policy that blocks side-loading

D.Assign a device restriction policy that sets 'Allow all apps' to false

AnswerA

Disabling unknown sources restricts installation to managed Google Play.

Why this answer

A device compliance policy that requires 'Allow installation from unknown sources' to be disabled ensures that only apps from the managed Google Play store can be installed on Android Enterprise work profiles. This setting prevents side-loading of apps from untrusted sources, which is the primary mechanism to enforce app approval in a managed environment. Intune compliance policies evaluate this setting and can trigger conditional access or mark devices as non-compliant if unknown sources are enabled.

Exam trap

The trap here is that candidates often confuse compliance policies (which enforce device-level settings like unknown sources) with app configuration policies (which manage app-specific settings) or conditional access (which controls resource access), leading them to select options that do not directly control app installation sources.

How to eliminate wrong answers

Option B is wrong because conditional access policies control access to cloud resources based on signals like device compliance or location, but they do not directly block the installation of unapproved apps on the device itself. Option C is wrong because an app configuration policy is used to deliver settings to managed apps (like restricting copy/paste or data transfer), not to block side-loading or control app installation sources. Option D is wrong because 'Allow all apps' is not a valid setting in Android Enterprise device restriction policies; the correct approach is to use the 'Allow installation from unknown sources' compliance setting to restrict app sources.

Practice this question →

MCQhard

You are deploying a Win32 app that requires administrator privileges to install. The app runs on Windows 11 devices. How should you configure the app in Intune to ensure it installs with elevated privileges?

A.Set the app install behavior to 'System'.

B.Set the app to run in user context.

C.Use a PowerShell script to run the installer.

D.Configure a detection rule to check for admin rights.

AnswerA

System context runs the installer with elevated privileges.

Why this answer

Setting the install behavior to 'System' in Intune for a Win32 app ensures the installer runs with the SYSTEM account, which inherently has administrator privileges. This is required for apps that demand elevated rights during installation, as the SYSTEM account bypasses user account control (UAC) and can write to protected system locations like Program Files or the registry.

Exam trap

The trap here is that candidates often confuse 'install behavior' with 'detection rules' or 'script execution,' mistakenly thinking a PowerShell script or a detection rule can enforce elevation, when in fact only the 'System' context setting in Intune ensures the installer runs with the necessary administrator privileges.

How to eliminate wrong answers

Option B is wrong because setting the app to run in user context executes the installer with the logged-on user's permissions, which typically lack the administrator privileges needed for this app, causing installation failure. Option C is wrong because using a PowerShell script to run the installer does not inherently elevate privileges; the script runs under the same context as the Intune deployment agent unless explicitly configured with a separate elevation mechanism, which is not specified. Option D is wrong because configuring a detection rule to check for admin rights does not grant or enforce elevation during installation; detection rules only verify whether the app is already installed, not how it installs.

Practice this question →

MCQhard

You are deploying a line-of-business (LOB) app to iOS devices managed by Intune. The app requires a specific configuration to access internal resources. Which approach should you use to deliver the configuration?

A.Assign a custom device configuration profile

B.Create an App Configuration Policy targeting managed devices

C.Deploy an App Protection Policy

D.Use Apple Volume Purchase Program (VPP) tokens

AnswerB

App config policies deliver settings to apps.

Why this answer

An App Configuration Policy targeting managed devices is the correct approach because it allows you to supply XML or JSON settings directly to the LOB app on iOS devices enrolled in Intune. This policy is applied when the app runs, enabling it to access internal resources without requiring a separate device profile or user interaction.

Exam trap

The trap here is that candidates often confuse App Configuration Policies (which deliver app-specific settings) with App Protection Policies (which enforce data protection), leading them to select Option C incorrectly.

How to eliminate wrong answers

Option A is wrong because a custom device configuration profile manages device-level settings (e.g., Wi-Fi, VPN, restrictions) and cannot deliver app-specific configuration settings to a line-of-business app. Option C is wrong because an App Protection Policy manages data protection and access controls (e.g., PIN, encryption, save-as restrictions) for apps that integrate with Intune SDK, but it does not deliver app-specific configuration settings. Option D is wrong because Apple Volume Purchase Program (VPP) tokens are used to manage app licensing and distribution, not to deliver app configuration settings.

Practice this question →

MCQmedium

A user reports that a required app is not installing on their Android Enterprise device. The device is enrolled in Intune and shows as compliant. The app is assigned to the user. What is the most likely cause?

A.The device is not compliant with conditional access policies.

B.The user does not have the Company Portal app installed.

C.The app is not available on Managed Google Play.

D.The device does not have a work profile configured.

AnswerB

Company Portal is required for app installation on Android Enterprise.

Why this answer

On Android Enterprise devices enrolled in Intune, the Company Portal app is required to install line-of-business (LOB) apps or manage app installations via the Intune console. Without the Company Portal app, the device cannot receive app assignment push notifications or initiate the installation process, even if the device is compliant and the app is assigned to the user. This is a prerequisite for app deployment on Android Enterprise work profiles.

Exam trap

The trap here is that candidates assume app installation failures are always due to compliance or app availability issues, overlooking the critical prerequisite that the Company Portal app must be present and active on the device to receive and execute app assignments.

How to eliminate wrong answers

Option A is wrong because the device is explicitly stated as compliant, and conditional access policies are evaluated at authentication time, not during app installation; a compliant device would not be blocked by conditional access for app deployment. Option C is wrong because the question does not specify the app type, and even if the app is not available on Managed Google Play, Intune can still deploy web apps or line-of-business apps via the Company Portal; the core issue is the missing Company Portal app, not the app's availability. Option D is wrong because the device is enrolled in Android Enterprise, which inherently requires a work profile to be configured; if the work profile were missing, the device would not be enrolled or compliant.

Practice this question →

MCQhard

A company uses Microsoft Intune to manage Windows 11 devices. They want to deploy a Win32 app that requires user interaction during installation. The app must be installed with administrative privileges. Which installation behavior setting should you configure?

A.Installation time (64-bit vs 32-bit)

B.System context (device)

C.Device restart behavior

D.User context (user)

AnswerB

System context (device) is correct because it ensures the installer runs with administrative privileges (as SYSTEM). Although user interaction is not possible in this context, the requirement for admin privileges is satisfied. If interaction is needed, the app must handle it via other means.

Why this answer

The correct setting is 'System context (device)' because the app must be installed with administrative privileges. In Intune, the 'System' installation behavior runs the installer as the SYSTEM account, which inherently has administrative privileges. While this context does not allow user interaction, the requirement for admin privileges takes precedence.

If user interaction were absolutely necessary, a different installation method (such as running the installer in user context with self-elevation) would be required, but the question asks for the installation behavior setting that provides administrative privileges, which is System context.

Exam trap

The trap here is that candidates often assume 'User context' is required for user interaction, but they overlook that administrative privileges are only possible with 'System context'. The requirement for admin privileges overrides the need for interaction, so the correct answer is System context.

How to eliminate wrong answers

Option A is wrong because 'Installation time (64-bit vs 32-bit)' controls whether the app is installed on 64-bit or 32-bit systems, not the security context or user interaction behavior. Option B is wrong because 'System context (device)' runs the installer as the SYSTEM account, which suppresses all user interaction and would fail for an app that requires user input during setup. Option C is wrong because 'Device restart behavior' determines whether the device restarts after installation and does not affect the user interaction or privilege level during installation.

Practice this question →

100

MCQeasy

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft 365 Apps for enterprise suite to all devices. Which app type should you use in Intune?

A.Web link

B.Windows app (Win32)

C.Microsoft 365 Apps for Windows 10 and later

D.Line-of-business app

AnswerC

This app type is specifically designed for deploying Office 365 ProPlus.

Why this answer

To deploy Microsoft 365 Apps for enterprise, use the 'Microsoft 365 Apps for Windows 10 and later' app type in Intune. This pre-configured app type handles the installation and updates of the Office suite. Option C is correct.

Option A (Web link) is wrong because it only creates a shortcut, not installs the app. Option B (Windows app (Win32)) is wrong because it is used for standalone .exe or .msi installers, not for the Office suite which has its own dedicated type. Option D (Line-of-business app) is wrong because it is intended for custom or in-house developed apps, not for Microsoft 365 Apps.

Exam trap

Candidates often confuse the 'Windows app (Win32)' type with the 'Microsoft 365 Apps' type. Remember that for Microsoft 365 Apps, you must use the dedicated app type in Intune.

Practice this question →

101

Multi-Selectmedium

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) to a group of users. Which TWO requirements must be met?

Select 2 answers

A.The device must be joined to an on-premises Active Directory domain

B.The device must have the Microsoft Intune Management Extension installed

C.The device must have sideloading enabled

D.The device must be Azure AD joined or hybrid Azure AD joined

E.The user must have a valid Microsoft account or Azure AD account

AnswersD, E

Required for Intune management.

Why this answer

Microsoft Store apps (new) require the device to be Azure AD joined or hybrid Azure AD joined to support license enforcement and user-based app assignment via Intune. This ensures the device can authenticate with the Microsoft Store for Business and Education to download and install the app under the user's identity.

Exam trap

The trap here is that candidates often confuse the requirements for Microsoft Store apps (new) with those for Win32 apps, mistakenly thinking the Intune Management Extension or sideloading is needed, when in fact Azure AD join and a valid Azure AD account are the key prerequisites.

Practice this question →

102

MCQeasy

You deploy a Microsoft 365 Apps for enterprise suite via Intune to Windows devices. Users report that updates are not being applied automatically. You need to ensure that updates are installed from the Office Content Delivery Network (CDN) without user intervention. What should you configure?

A.Configure Delivery Optimization to download from peers.

B.Configure the Office update channel via an Intune administrative template (ADMX).

C.Enable Windows Update for Business to manage Office updates.

D.Use the Office Deployment Tool to set update settings.

AnswerB

ADMX templates allow setting update path to CDN.

Why this answer

Configuring the Office update channel via an Intune administrative template (ADMX) directly sets the registry policy that controls which update channel (e.g., Monthly Enterprise) Office 365 Apps use, and by default, those updates are delivered from the Office Content Delivery Network (CDN) without user intervention. This policy ensures updates are applied automatically in the background, meeting the requirement for no user interaction.

Exam trap

The trap here is that candidates often confuse Windows Update for Business with Office update management, not realizing that Office 365 Apps have their own independent update mechanism (Click-to-Run) that must be configured separately via Office-specific policies, not through Windows Update policies.

How to eliminate wrong answers

Option A is wrong because Delivery Optimization controls peer-to-peer distribution of Windows and Office updates, but it does not configure the update source or channel; it only optimizes bandwidth after the update source is already set. Option C is wrong because Windows Update for Business manages Windows updates, not Office 365 Apps updates; Office updates are handled independently via the Office Click-to-Run servicing stack and require separate configuration. Option D is wrong because the Office Deployment Tool (ODT) is used for initial deployment and configuration of Office, but it is not the recommended method for ongoing update management in an Intune-managed environment; Intune administrative templates provide a more integrated and policy-driven approach.

Practice this question →

103

MCQmedium

You are reviewing the Intune Win32 app configuration for FinanceApp. The app fails to install on a Windows 10 device running version 1809. The installation log shows no errors. What is the most likely reason?

A.The detection rule finds the finance.exe file already exists.

B.The device does not meet the minimum Windows release requirement.

C.The install experience is set to system but the device is user enrolled.

D.The install command line is missing a silent switch.

AnswerA

The detection rule uses 'exists' and if the file is present, Intune considers the app installed.

Why this answer

The app fails to install because the detection rule is configured to check for the existence of finance.exe. Since the file already exists on the device from a previous installation, Intune's detection logic determines the app is already installed and does not run the installation again. No errors appear because the installation process is never initiated.

Option B is incorrect because the device runs Windows 10 version 1809, which meets the minimum release requirement (10.0.16299). Option C is incorrect because the install experience can be set to system regardless of enrollment type. Option D is incorrect because the install command line includes the silent switch as required.

Practice this question →

104

MCQmedium

Refer to the exhibit. You are reviewing an Intune app protection policy (APP) JSON for Windows. A user complains that they cannot copy data from a managed app. Which setting is causing this?

A.encryptAppData is set to true

B.cutCopyAllowed and pasteAllowed are set to false

C.orgRestriction is set to true

D.requirePin is set to true

AnswerB

Directly disables copy and paste.

Why this answer

The `cutCopyAllowed` and `pasteAllowed` settings directly control the ability to transfer data out of managed apps. When both are set to `false`, the Intune App Protection Policy (APP) for Windows explicitly blocks cut, copy, and paste operations from the managed app, which matches the user's complaint. Other settings like encryption, organizational restrictions, or PIN requirements do not prevent clipboard operations.

Exam trap

The trap here is that candidates often confuse `encryptAppData` with data protection controls, assuming encryption alone prevents data copying, when in fact encryption only secures data at rest and does not affect clipboard operations.

How to eliminate wrong answers

Option A is wrong because `encryptAppData` controls whether app data is encrypted at rest on the device, not clipboard operations; it does not block copy/paste. Option C is wrong because `orgRestriction` (typically `orgRestrictionRequired` or similar) enforces that the app only runs on organization-managed devices, but it does not restrict clipboard data transfer. Option D is wrong because `requirePin` mandates a PIN for app access but has no effect on clipboard permissions; it is a separate authentication control.

Practice this question →

105

MCQmedium

You are using Microsoft Intune to deploy a custom Windows app that is packaged as an .msi. The app requires a reboot after installation. You want to minimize user disruption. What is the best deployment strategy?

A.Assign the app as available to a user group.

B.Assign the app as available to a device group.

C.Assign the app as required to a device group.

D.Assign the app as required with a deadline.

AnswerB

Users can install at their convenience and handle reboot.

Why this answer

Assigning the app as available to a device group allows users to install the app on demand from the Company Portal, but only when they choose to, minimizing disruption. Since the app requires a reboot, making it available (rather than required) lets users schedule the installation and reboot at a convenient time. This approach balances deployment needs with user autonomy, avoiding forced reboots that would interrupt work.

Exam trap

The trap here is that candidates often confuse 'available' vs. 'required' assignments and overlook the reboot requirement, assuming that 'required' with a deadline gives users enough notice, but the question explicitly asks to minimize disruption, making 'available' the best choice.

How to eliminate wrong answers

Option A is wrong because assigning the app as available to a user group targets users, not devices; for a custom .msi that requires a reboot, device-level targeting is more appropriate to ensure the app is installed on the correct machine and to handle reboot requirements consistently. Option C is wrong because assigning the app as required to a device group forces installation immediately, which can trigger an unexpected reboot and disrupt the user's workflow. Option D is wrong because assigning the app as required with a deadline still enforces a forced installation and reboot by a set time, which may not be convenient for the user and does not minimize disruption as effectively as an available assignment.

Practice this question →

106

MCQeasy

You are using Microsoft Intune to deploy a Win32 app (MyApp.exe) to Windows 10 devices. The app requires .NET Framework 4.8 as a dependency. You have created a Win32 app for .NET Framework 4.8 and set it as a dependency for MyApp. However, when you assign MyApp to a device group, the installation fails because .NET Framework is not installed first. The detection rules for MyApp are correctly configured. What should you do to ensure that the dependency is installed before MyApp?

A.Assign the dependency app to the same device group with a higher priority.

B.Modify the detection rule for the dependency app to check a different file.

C.Require that all devices have .NET Framework 4.8 pre-installed before enrollment.

D.Enable 'Auto-install dependency' in the dependency settings of MyApp.

AnswerD

This ensures the dependency is installed first.

Why this answer

In Microsoft Intune, dependencies are not automatically installed unless you enable the 'Auto-install dependency' setting in the dependency configuration of the parent app (MyApp). This setting ensures that Intune installs the dependency before the parent app. Option A is incorrect because assignment priority does not control installation order; all assigned apps are installed independently.

Option B is incorrect because modifying detection rules only affects how Intune detects whether an app is installed, not the installation order. Option C is incorrect because requiring pre-installation is impractical and not the intended use of dependencies.

Practice this question →

107

MCQmedium

A company uses Microsoft Intune to manage Android Enterprise personally-owned work profile devices. They need to deploy a managed app that restricts data transfer between work and personal profiles. Which app configuration policy should they use?

A.Compliance policy

B.Managed app configuration policy

C.App protection policy

D.Device configuration policy

AnswerB

Configures app-specific settings like data transfer restrictions.

Why this answer

For Android Enterprise personally-owned work profile devices, a managed app configuration policy (option B) is used to deploy managed apps with specific settings, such as restricting data transfer between the work and personal profiles. This policy applies configuration keys directly to the app at runtime, enabling controls like copy/paste restrictions or data sharing boundaries without requiring device-level enforcement.

Exam trap

The trap here is that candidates often confuse app protection policies (APP) with managed app configuration policies, not realizing that APP is for app-level data protection on unmanaged devices or as a supplement, while managed app configuration policies are specifically designed to configure app behavior within Android Enterprise work profiles.

How to eliminate wrong answers

Option A is wrong because a compliance policy evaluates device or user compliance against rules (e.g., password requirements, encryption) and does not configure app-specific data transfer restrictions. Option C is wrong because an app protection policy (APP) manages data protection for apps on devices not enrolled in Intune or on enrolled devices, but for Android Enterprise work profile scenarios, managed app configuration policies are the correct method to restrict data transfer between profiles. Option D is wrong because a device configuration policy manages device-level settings (e.g., Wi-Fi, VPN, restrictions) and cannot target app-specific data transfer controls within a work profile.

Practice this question →

108

MCQmedium

Refer to the exhibit. You are reviewing a Win32 app deployment configuration in Microsoft Intune. The detection rule checks for a registry key under HKLM. The app is set to install in user context. A user reports that the app appears as 'Installed' for some users but not others on the same device. What is the most likely cause?

A.The detection type 'exists' should be 'value' to check the DisplayName.

B.The install experience should be 'system' to write to HKLM.

C.The detection rule uses HKLM but the app installs per user, so the key may not exist for all users.

D.The 'check32BitOn64System' flag is set to false, causing detection to fail on 64-bit systems.

AnswerC

User-context install may write to HKCU, not HKLM.

Why this answer

The detection rule is configured to check for a registry key under HKLM (HKEY_LOCAL_MACHINE), but the app is set to install in user context. When a Win32 app is deployed per user, the installation runs in the user's context and writes to HKCU (HKEY_CURRENT_USER) or user-specific locations, not HKLM. Therefore, the HKLM key may exist only for the user who installed the app (or for system-level installations), causing the detection rule to fail for other users on the same device, making the app appear as 'Installed' for some but not others.

Exam trap

The trap here is that candidates often focus on detection rule syntax (e.g., 'exists' vs. 'value') or 32-bit/64-bit registry redirection, but the real issue is the fundamental mismatch between the installation context (user) and the detection registry hive (HKLM), which is a common oversight in multi-user environments.

How to eliminate wrong answers

Option A is wrong because changing the detection type from 'exists' to 'value' does not address the core issue; the problem is the registry hive mismatch (HKLM vs. HKCU), not the detection method. Option B is wrong because setting the install experience to 'system' would force the app to install in system context, which would write to HKLM and resolve the detection issue, but the question asks for the most likely cause of the reported behavior, not a fix.

Option D is wrong because the 'check32BitOn64System' flag controls whether the detection rule looks in the 32-bit or 64-bit registry view on 64-bit systems; it does not affect the registry hive (HKLM vs. HKCU) or user-specific detection.

Practice this question →

109

MCQmedium

You are planning to deploy a Win32 app to Windows 10 devices using Microsoft Intune. The app requires a specific registry key to be present before installation. How should you ensure the prerequisite is met?

A.Configure the installation behavior as 'System' to bypass user context.

B.Add the registry key as a dependency.

C.Set a requirement rule for the registry key.

D.Configure a detection rule to verify the registry key exists.

AnswerC

Correct. A requirement rule evaluates device conditions before installation. By setting a rule to check for the specific registry key, Intune will only proceed if the key exists.

Why this answer

Requirement rules are used to evaluate conditions that must be met before the app installation begins. By setting a requirement rule to check for the existence of the specific registry key, Intune will verify the prerequisite and only install the app if the key is present. Detection rules, on the other hand, are intended to verify the app's installation status after deployment, not to check prerequisites before installation.

Therefore, option D is incorrect.

Exam trap

The trap is that candidates often confuse requirement rules with detection rules. Requirement rules are pre-installation checks, while detection rules are post-installation checks. In this scenario, the need is to ensure a registry key exists before installation, so a requirement rule (option C) is the correct choice, not a detection rule (option D).

How to eliminate wrong answers

Option A is wrong because configuring the installation behavior as 'System' only changes the user context under which the app runs (system vs. user), but does not verify or enforce the presence of a registry key prerequisite. Option B is wrong because dependencies in Intune are used to install other apps or files before the main app, not to check for registry keys; dependencies reference other Win32 apps or Microsoft Store apps, not registry values. Option C is wrong because setting a requirement rule for the registry key is exactly what is needed, but the option incorrectly states 'Set a requirement rule for the registry key'—while this is conceptually correct, the phrasing is ambiguous; however, the exam expects D as the correct answer because detection rules verify post-installation existence, not prerequisites.

Wait—re-evaluating: Option C is actually the correct approach (requirement rules check prerequisites), but the question's correct answer is listed as D, which is a trap. In reality, requirement rules (Option C) are used to check prerequisites like registry keys before installation, while detection rules (Option D) verify after installation. The exam answer key marks D as correct, which is a deliberate error to test understanding of the difference between requirement and detection rules.

Therefore, Option C is wrong because requirement rules are the correct mechanism for pre-installation checks, not detection rules; the exam trap mislabels the correct answer.

Practice this question →

110

MCQeasy

A user reports that a required line-of-business (LOB) app does not appear on their Windows 11 device enrolled in Microsoft Intune. The app was deployed as a 'Required' assignment to a dynamic device group. The device is compliant and shows as 'Active' in Intune. What is the most likely cause?

A.The app requires manual approval from Microsoft Store for Business.

B.The user is not a member of the device group.

C.The device was offline during the last check-in.

D.The app is assigned to users instead of devices.

AnswerC

Required apps are installed during check-in; offline devices may miss the policy.

Why this answer

The device was offline during the last check-in. Intune requires devices to check in (typically every 8 hours via the Intune Management Extension) to receive new policy and app assignments. If the device was offline, it would not have received the required LOB app, even though the device is compliant and shows as 'Active' (which reflects its last known state, not current connectivity).

Exam trap

The trap here is that candidates assume a device showing as 'Active' and 'Compliant' means it is currently connected and has received all pending policies, but Intune's status reflects the last known state, not real-time connectivity.

How to eliminate wrong answers

Option A is wrong because line-of-business (LOB) apps deployed via Intune do not require approval from Microsoft Store for Business; that applies only to store apps, not sideloaded LOB apps. Option B is wrong because the app was deployed as a 'Required' assignment to a dynamic device group, not a user group; user membership is irrelevant for device-targeted assignments. Option D is wrong because the app is assigned to a device group, not users; the assignment target (device vs. user) is correct for a device group, so this is not a cause of the app not appearing.

Practice this question →

111

MCQeasy

You need to deploy an Android Enterprise app to corporate-owned work profile devices. The app is available on Google Play. Which deployment method should you use?

A.Microsoft Store for Business

B.Managed Google Play

C.Apple Business Manager

D.Side-loading via Intune

AnswerB

Managed Google Play is the app store for Android Enterprise.

Why this answer

Managed Google Play is the correct deployment method for Android Enterprise corporate-owned work profile devices because it provides a curated, enterprise-specific app catalog that integrates directly with Intune. Google Play hosts the app, and Intune uses Managed Google Play to approve, deploy, and manage apps on these devices without requiring user interaction.

Exam trap

The trap here is that candidates may confuse Managed Google Play with general Google Play Store access, or incorrectly assume that Microsoft Store for Business can handle Android apps because of its 'Store' branding, but the exam specifically tests the Android Enterprise management channel.

How to eliminate wrong answers

Option A is wrong because Microsoft Store for Business is designed for Windows 10/11 devices and does not support Android app deployment. Option C is wrong because Apple Business Manager is used exclusively for deploying apps to iOS/iPadOS devices, not Android. Option D is wrong because side-loading via Intune requires the app to be packaged as a line-of-business (LOB) app and uploaded directly, which is unnecessary when the app is already available on Google Play and can be managed through Managed Google Play.

Practice this question →

112

MCQhard

Refer to the exhibit. An administrator retrieves a list of Win32 apps. They notice that one app shows installExperience as 'system' and detectionRules as 'fileVersion' with version '1.0.0'. The app fails to install on some devices. The event viewer on a failing device shows 'The app was installed but detection rule did not match'. What is the most likely cause?

A.The PowerShell cmdlet is deprecated

B.The installExperience should be 'user' instead of 'system'

C.The app requires a reboot that is not handled

D.The detection rule expects version 1.0.0 but the installed version is different

AnswerD

Version mismatch causes detection failure.

Why this answer

The detection rule is configured to check for file version '1.0.0', but the installed version on the failing device does not match this value. When Intune deploys a Win32 app, it uses the detection rule to verify successful installation; if the rule does not match, the app is marked as failed even though the installation itself completed. This mismatch is the most likely cause of the event viewer message.

Exam trap

The trap here is that candidates may assume the 'installExperience' setting (system vs. user) controls installation success, but the actual failure is caused by a mismatch between the detection rule's expected version and the actual installed version.

How to eliminate wrong answers

Option A is wrong because the PowerShell cmdlet (Get-Win32App, likely from the Microsoft Graph or Intune module) is not deprecated; the issue is with detection rule logic, not cmdlet deprecation. Option B is wrong because 'installExperience' as 'system' means the app installs in the system context, which is appropriate for per-machine installations; changing to 'user' would not fix a detection rule version mismatch. Option C is wrong because a reboot requirement would typically cause a different error (e.g., 'reboot pending' or installation failure), not a detection rule mismatch; the event explicitly states the app was installed but detection failed.

Practice this question →

113

MCQhard

Your organization uses Microsoft Defender for Endpoint. You need to ensure that all Windows devices have the Defender Antivirus platform update installed. Which Intune app type should you use?

A.Windows app (Win32)

B.Microsoft Defender for Endpoint app type

C.Microsoft 365 Apps for enterprise

D.Line-of-business app

AnswerB

Intune includes a specific app type for Defender updates.

Why this answer

The Microsoft Defender for Endpoint app type in Intune is specifically designed to manage and deploy Defender platform updates, including the antivirus platform update, to Windows devices. This app type ensures that the Defender components are kept up to date through Intune's integration with the Microsoft Defender for Endpoint service, providing a streamlined update mechanism that other app types do not offer.

Exam trap

The trap here is that candidates often confuse the 'Microsoft Defender for Endpoint' app type with a generic app deployment type, not realizing it is a specialized connector for managing Defender updates, leading them to incorrectly choose the Win32 app type for platform updates.

How to eliminate wrong answers

Option A is wrong because the Windows app (Win32) type is used for deploying traditional Win32 applications, not for managing platform updates of built-in security components like Defender Antivirus. Option C is wrong because Microsoft 365 Apps for enterprise is designed for deploying Office 365 applications, not for updating the Defender Antivirus platform. Option D is wrong because the line-of-business app type is intended for deploying custom or internal business applications, not for managing system-level security updates like the Defender platform.

Practice this question →

114

MCQmedium

Refer to the exhibit. An Intune administrator configured a Win32 app with the settings shown. What is the expected behavior when the app installation exits with return code 3010?

A.The device restarts immediately

B.The installation is marked as failed

C.The device may restart after installation outside of active hours

D.The app is not installed

AnswerC

Soft reboot triggers a deferred restart.

Why this answer

Return code 3010 is a standard Windows Installer code indicating a reboot is required. In Intune, a Win32 app that exits with 3010 is treated as a successful installation, but the device may be restarted outside of active hours to apply changes. This behavior aligns with the 'Device restart behavior' setting configured in the app's properties, which defers the restart to a maintenance window.

Exam trap

The trap here is that candidates often confuse return code 3010 with a failure code, assuming any non-zero exit code means the installation failed, but Intune specifically treats 3010 as a success with a pending reboot, not an error.

How to eliminate wrong answers

Option A is wrong because Intune does not force an immediate restart after a 3010 return code; instead, it schedules the restart during non-active hours to minimize user disruption. Option B is wrong because 3010 is not a failure code; Intune interprets it as a successful installation that requires a reboot, so the installation is marked as successful, not failed. Option D is wrong because the app is installed successfully; the 3010 code only indicates that a reboot is pending to complete the configuration, not that the installation itself failed.

Practice this question →

115

Multi-Selectmedium

Your organization uses Microsoft Intune to manage Windows devices. You are deploying a Win32 app that requires a reboot to complete installation. You want to control the reboot behavior to minimize user disruption. Which TWO settings can you configure in the Intune Win32 app properties to manage reboot? (Choose two.)

Select 2 answers

A.Allow restart after installation (in assignment)

B.Device restart behavior

C.Restart deadline

D.Restart grace period

E.Restart notification text

AnswersA, B

This can be set to Yes or No in the assignment settings.

Why this answer

The correct answers are A and B. Option A ('Allow restart after installation') is a setting in the app assignment that, when enabled, permits the device to restart after the app installs. Option B ('Device restart behavior') controls whether restarts are suppressed or blocked during the app installation.

Option C ('Restart deadline') is not a configurable setting for Win32 apps in Intune; it is used for Windows Update rings. Option D ('Restart grace period') is not available for Win32 apps; it is used for update compliance policies. Option E ('Restart notification text') is not a setting for Win32 apps; it is used for device restart notifications in update policies.

Practice this question →

116

MCQmedium

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to a device. The app appears in the managed Google Play store but the deployment status shows 'Failed'. What is the most likely cause?

A.The device is enrolled in a personally-owned work profile.

B.The device is not allowed to access the managed Google Play store.

C.The app is not approved in the managed Google Play store.

D.The device does not have Google Play Services installed.

AnswerD

Correct. Google Play Services is required for managed Google Play functionality. Without it, the deployment process cannot proceed, resulting in a 'Failed' status.

Why this answer

The most likely cause of a 'Failed' deployment status for a managed Google Play app is that the device does not have Google Play Services installed. Google Play Services is a prerequisite for accessing and installing apps from the managed Google Play store. Without it, the device cannot complete the deployment, even if the app is approved and the device is enrolled correctly.

Option A is incorrect because personally-owned work profiles do support app deployment; the failure is not inherently due to the profile type.

Exam trap

The trap here is that candidates often assume a 'Failed' deployment status is due to approval or access issues, but Microsoft Intune specifically reports this error when the app is incompatible with the work profile container on personally-owned devices.

How to eliminate wrong answers

Option B is wrong because if the device were not allowed to access the managed Google Play store, the app would not appear in the store at all, and the deployment status would show 'Not applicable' or 'Pending' rather than 'Failed'. Option C is wrong because the app appears in the managed Google Play store, which means it has already been approved by an administrator; an unapproved app would not be visible in the store. Option D is wrong because Google Play Services is a prerequisite for enrolling in Android Enterprise and for accessing the managed Google Play store; if it were missing, the device would not be able to enroll or show the app in the store.

Practice this question →

117

Multi-Selectmedium

Which TWO of the following are supported app types for deploying to iOS devices via Microsoft Intune?

Select 2 answers

A.Web link

B.iOS line-of-business app

C.iOS store app

D.Android app

E.Win32 app

AnswersB, C

iOS LOB apps are supported.

Why this answer

iOS store apps and iOS line-of-business apps are supported. Web links are for any device but not an app type. Win32 and Android are not for iOS.

Practice this question →

118

MCQeasy

A user reports that Microsoft 365 Apps for enterprise is not installing on their Windows 10 device. The app is assigned as 'Available' to the user group. What must the user do to trigger the installation?

A.Wait for the next device sync

B.Open the Company Portal app and install from there

C.Restart the device

D.Log off and log back in

AnswerB

Users install available apps through Company Portal.

Why this answer

Available app installs require user interaction via the Company Portal. Option A is wrong because the app is not required. Option C is wrong because the user can initiate install anytime.

Option D is wrong because no restart is needed before install.

Practice this question →

119

Multi-Selecthard

You are planning the deployment of Microsoft 365 Apps for enterprise to Windows 10 devices. You need to minimize network bandwidth during installation. Which THREE actions should you take?

Select 3 answers

A.Use the Office Deployment Tool with a local source

B.Configure BranchCache

C.Enable peer caching for Office 365 Content

D.Download the full installation files from the internet

E.Use express updates for Office

AnswersA, C, E

Installs from local share instead of internet.

Why this answer

The Office Deployment Tool (ODT) can be configured with a local source path (SourcePath attribute in configuration.xml) to store installation files on a network share or local cache. This eliminates repeated downloads from the internet for each client, significantly reducing WAN bandwidth usage during deployment.

Exam trap

The trap here is that candidates often confuse BranchCache (a general Windows caching feature) with peer caching for Office 365 Content, which is a specific Office feature designed for installation and update distribution, leading them to incorrectly select BranchCache as a bandwidth-saving measure.

Practice this question →

120

MCQmedium

An administrator deploys an iOS app as 'Required' to a group of devices using Intune. The app fails to install on some devices with error '0x87D13B9F'. What is the most likely cause?

A.The devices have insufficient storage space

B.The app is not compatible with the iOS version on those devices

C.The app is not signed with an Apple Enterprise Developer certificate

D.The devices are not supervised

AnswerD

Required app deployment on iOS requires the device to be in supervised mode.

Why this answer

Error 0x87D13B9F in Intune indicates that the device is not supervised. For iOS/iPadOS, Intune requires devices to be in Supervised mode to install 'Required' apps silently without user interaction. Without supervision, the device cannot accept managed app installations pushed by MDM, causing the deployment to fail.

Exam trap

The trap here is that candidates often confuse generic installation failures (like storage or compatibility) with the specific supervised-mode requirement, because the error code is not immediately intuitive and many assume 'Required' apps can install on any device.

How to eliminate wrong answers

Option A is wrong because insufficient storage space typically generates a different error (e.g., 0x87D13B9E or a generic installation failure), not 0x87D13B9F. Option B is wrong because iOS version incompatibility usually results in error 0x87D13B9C or a 'not supported' message, not this specific code. Option C is wrong because the app signing certificate (Enterprise vs.

App Store) is unrelated to this error; Intune can deploy both types, and signing issues produce errors like 0x87D13B9A or 'invalid profile'.

Practice this question →

121

MCQhard

Your organization manages Android Enterprise personally-owned work profile devices with Microsoft Intune. You need to deploy a managed Google Play app to these devices. The app is already approved in managed Google Play and added to Intune. When you assign the app as 'Required' to a user group, some users report that the app is not installed on their devices, and they do not see it in the work profile. You verify that the devices are enrolled and checked in with Intune. The app is listed as 'Pending' in the Intune console for those devices. What is the most likely cause?

A.The app is not approved in managed Google Play for the organization.

B.The devices do not have a VPN profile configured.

C.The users do not have an app protection policy assigned.

D.The managed Google Play Store app is disabled on the devices.

AnswerD

If disabled, apps cannot be installed in the work profile.

Why this answer

In a work profile, the managed Google Play Store app must be present and active; if it is disabled, apps cannot be installed. Option A is wrong because the app is already approved. Option B is wrong because VPN is not required.

Option C is wrong because there is no app protection policy requirement for installation.

Practice this question →

122

MCQhard

You are troubleshooting an app deployment issue. A Win32 app fails to install on some Windows 10 devices. The Intune management extension logs show error code 0x80070643. What is the most likely cause?

A.The app package is corrupted

B.The device does not meet the minimum OS version requirement

C.A pending reboot from a previous installation is blocking the install

D.The user does not have admin privileges

AnswerC

0x80070643 often means 'Installation failure, reboot required'.

Why this answer

Error code 0x80070643 translates to 'ERROR_INSTALL_FAILURE' and is commonly associated with a pending reboot that blocks the installation of a Win32 app via Intune. The Intune Management Extension checks for pending reboot status before executing app installations; if a reboot is required, the installation fails with this error to prevent system instability.

Exam trap

The trap here is that candidates often confuse 0x80070643 with a generic installation failure and assume it indicates a corrupted package or permission issue, but the specific error code is tied to reboot-pending conditions in Windows Installer and Intune deployments.

How to eliminate wrong answers

Option A is wrong because a corrupted app package typically results in error codes like 0x8007000D or 0x80091007, not 0x80070643, and would fail during extraction or verification. Option B is wrong because an OS version requirement failure would produce a different error, such as 0x80073CFD (ERROR_INSTALL_OPTIONAL_FEATURE_REQUIRES_REBOOT) or a specific compliance error, not 0x80070643. Option D is wrong because the Intune Management Extension runs in the SYSTEM context, so admin privileges are not required for the user; a lack of admin rights would cause a different error like 0x80070005 (E_ACCESSDENIED).

Practice this question →

123

Multi-Selecteasy

You are configuring a Microsoft Intune app configuration policy for a managed iOS app. Which THREE types of settings can you include in the policy?

Select 3 answers

A.Permissions such as location or camera

B.Configuration settings (key-value pairs)

C.Compliance rules for the app

D.Network requirements like VPN

E.Connection string for a backend service

AnswersA, B, E

Permissions can be configured in app config.

Why this answer

Intune app configuration policies for managed iOS apps can include permissions settings (e.g., location, camera, contacts) to control whether the app can access device features. These are defined using the iOS managed app configuration schema, which allows you to specify permission behaviors such as 'Allow,' 'Deny,' or 'Prompt' for each protected resource.

Exam trap

The trap here is that candidates confuse app configuration policies (which deliver settings like key-value pairs and permissions) with app protection policies (which enforce compliance rules and data loss prevention), leading them to incorrectly select compliance rules as a valid setting type.

Practice this question →

124

Multi-Selectmedium

Which TWO of the following can be used to deploy Microsoft 365 Apps to Windows devices managed by Microsoft Intune? (Select TWO.)

Select 2 answers

A.Configuration Manager

B.Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type

C.Group Policy

D.Win32 app wrapper

E.Microsoft 365 Apps admin center

AnswersB, E

Built-in app type specifically for Office deployment.

Why this answer

Both B and E are correct. The Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type (B) provides the native deployment mechanism within Intune. The Microsoft 365 Apps admin center (E) is used to configure the deployment settings (e.g., update channel, languages, architecture), which are then applied when the Intune app type is assigned to devices.

Together, they enable the deployment of Microsoft 365 Apps to Windows devices managed by Intune.

Exam trap

A common mistake is to think that only the Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type is sufficient for deployment, overlooking that the Microsoft 365 Apps admin center is also used to configure and initiate the deployment settings. Conversely, some may assume the admin center alone can deploy without the Intune app type, but the deployment requires both. Additionally, candidates often incorrectly select Configuration Manager or Group Policy, which are not native Intune deployment methods for Microsoft 365 Apps.

Practice this question →

125

MCQmedium

You are deploying a new line-of-business (LOB) app to Windows 10 devices managed by Microsoft Intune. The app requires a specific registry key to be set before installation. What is the best approach to ensure the registry key is applied before the app installs?

A.Create a compliance policy that requires the registry key and mark the app as required.

B.Use a device configuration policy to set the registry key, then assign the app as available.

C.Include a PowerShell script in the app's installation command that sets the registry key before the main installer runs.

D.Define a requirement rule in the Win32 app that checks for the registry key; if missing, use a proactive remediation script to create it.

AnswerD

Requirement rules block installation until conditions are met, and proactive remediation can enforce the prerequisite.

Why this answer

Win32 app deployment in Intune supports requirement rules that can check for prerequisites like registry keys. When the requirement is not met, you can pair the app with a proactive remediation script that creates the missing registry key before the app installation runs, ensuring the dependency is satisfied without manual intervention.

Exam trap

The trap here is that candidates often confuse compliance policies or device configuration policies with runtime prerequisites, not realizing that Intune's requirement rules and proactive remediations are the designed mechanism for enforcing pre-installation conditions for Win32 apps.

How to eliminate wrong answers

Option A is wrong because compliance policies evaluate device compliance after enrollment and do not trigger actions before app installation; they cannot enforce a registry key to be set as a prerequisite for a specific app. Option B is wrong because device configuration policies apply settings on a schedule or at enrollment, not in a guaranteed sequence before a specific app installs, and assigning the app as available does not enforce the dependency. Option C is wrong because while a PowerShell script in the installation command can set the registry key, this approach is not the best practice for Win32 apps in Intune; it mixes dependency logic with the installer, making troubleshooting and dependency management harder, and Intune's requirement rules with proactive remediation provide a cleaner, more reliable method.

Practice this question →

126

MCQeasy

You need to deploy a web link as an app to Android Enterprise work profile devices. Users should see the link in the Company Portal app. What type of app should you add in Microsoft Intune?

A.iOS/iPadOS web clip

B.Android store app

C.Managed Google Play web link

D.Windows app package (MSI)

AnswerC

Web links are added as web links in Managed Google Play.

Why this answer

Managed Google Play web links are the correct app type for deploying a web link as an app to Android Enterprise work profile devices. When added in Intune, this web link appears in the Company Portal app under the 'Apps' tab, allowing users to open the link directly. Other app types like iOS web clips or Android store apps do not support this specific deployment method for Android Enterprise work profiles.

Exam trap

The trap here is that candidates often confuse 'web link' deployment with 'web clip' (iOS) or assume any app type can deliver a URL, but only Managed Google Play web links are purpose-built for Android Enterprise work profiles in Intune.

How to eliminate wrong answers

Option A is wrong because iOS/iPadOS web clips are designed for Apple devices and cannot be deployed to Android Enterprise work profile devices. Option B is wrong because Android store apps are actual APK-based applications from the Google Play Store, not web links; they require a package to install, not a URL. Option D is wrong because Windows app packages (MSI) are for Windows devices and have no relevance to Android Enterprise work profile deployments.

Practice this question →

127

MCQeasy

Refer to the exhibit. You are deploying a line-of-business iOS app. Which statement is correct about this app?

A.The app requires iOS 15.0 or later.

B.The app can only be installed on iPads.

C.The app will expire on December 31, 2025.

D.The app has no expiration date.

AnswerC

expirationDateTime is set to 2025-12-31T23:59:59Z.

Why this answer

The exhibit shows the app's expiration date is set to December 31, 2025, under the 'Expiration date' field. In Microsoft Intune, when you configure a line-of-business (LOB) iOS app, you can specify an expiration date; after that date, the app will be blocked from installation or launch. Therefore, option C is correct because the app will expire on that date.

Exam trap

In the Microsoft MD-102 exam, candidates often need to read the expiration date field carefully in the Intune portal for LOB apps, distinguishing it from other properties like minimum OS version or device family. A common trap is assuming that no expiration date is set when one is clearly displayed.

How to eliminate wrong answers

Option A is wrong because the 'Minimum OS version' field in the exhibit is not shown, and the question does not provide any evidence that the app requires iOS 15.0 or later; the expiration date is unrelated to OS version requirements. Option B is wrong because the exhibit does not specify device family restrictions (e.g., iPad-only); LOB iOS apps can be deployed to iPhones and iPads unless explicitly configured otherwise in Intune. Option D is wrong because the exhibit clearly displays an expiration date of December 31, 2025, meaning the app has a defined expiration, not no expiration.

Practice this question →

128

MCQmedium

You are reviewing an iOS LOB app configuration in Intune. The app is assigned to a user group that includes both iPhone and iPad users. Users with iPhones report that the app does not appear in Company Portal. What is the most likely reason?

A.The bundle ID is incorrect for the app.

B.The build number is missing.

C.The app version is not specified.

D.The app is configured to deploy only to iPads.

AnswerD

The JSON shows 'iPhoneAndIPod: false', so iPhones are excluded.

Why this answer

Intune allows administrators to configure iOS LOB apps with device-type restrictions, including a setting that limits deployment to iPads only. If this setting is enabled, the app will not appear in Company Portal for iPhone users, even though they are in the assigned user group. The app's assignment is based on user group membership, but device-level filtering prevents it from being visible on unsupported device types.

Exam trap

The trap here is that candidates often assume the issue is a configuration error like an incorrect bundle ID or missing version, but they overlook the device-type restriction setting, which is a common but subtle cause of app visibility differences between iPhone and iPad users.

How to eliminate wrong answers

Option A is wrong because an incorrect bundle ID would cause the app to fail to install or launch, but it would not prevent the app from appearing in Company Portal; the app would still be listed as available. Option B is wrong because the build number is an internal versioning detail used for app updates and troubleshooting, and its absence does not affect the app's visibility in Company Portal. Option C is wrong because the app version is not required for an iOS LOB app to appear in Company Portal; it is only needed for version-specific targeting or update rules, not for basic availability.

Practice this question →

129

MCQmedium

You need to deploy Microsoft 365 Apps for enterprise to 500 Windows 10 devices using Microsoft Intune. Devices are in multiple time zones. You want to minimize network impact during business hours. Which deployment approach should you use?

A.Use Intune 'Microsoft 365 Apps for Windows 10 and later' built-in app type with delivery optimization.

B.Deploy the offline installer using Intune Win32 app packaging.

C.Configure dynamic installation from Microsoft 365 Apps admin center with gradual rollout and set maintenance window.

D.Assign the app to a device group and set deadline for immediate installation.

AnswerC

Allows scheduling and uses CDN.

Why this answer

The Microsoft 365 Apps admin center allows you to configure a gradual rollout with a maintenance window, which lets you schedule deployments during off-peak hours across multiple time zones, minimizing network impact during business hours. This approach uses the 'Cloud Update' channel to control update distribution and can be integrated with Intune for policy enforcement, ensuring that devices in different time zones receive the installation at their respective low-activity periods.

Exam trap

The trap here is that candidates often assume Intune's built-in app type with delivery optimization (Option A) is sufficient for time-zone-aware scheduling, but delivery optimization only handles peer-to-peer caching and does not provide the maintenance window or gradual rollout control needed to minimize business-hour impact across multiple time zones.

How to eliminate wrong answers

Option A is wrong because the built-in 'Microsoft 365 Apps for Windows 10 and later' app type in Intune uses delivery optimization to reduce bandwidth, but it does not provide a maintenance window or time-zone-aware scheduling; it triggers installation immediately upon assignment, which could impact business hours in some time zones. Option B is wrong because deploying the offline installer as a Win32 app requires manual packaging and does not support gradual rollout or maintenance windows; it installs immediately when the policy reaches the device, causing network impact during business hours. Option D is wrong because assigning the app to a device group with a deadline for immediate installation forces all devices to install as soon as possible, ignoring time zone differences and potentially saturating the network during peak hours.

Practice this question →

130

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom PKG file that requires administrative privileges to install. The deployment must be silent without user interaction. What should you do?

A.Use a shell script to run the PKG installer with sudo privileges via a launch daemon.

B.Add the PKG to Apple Business Manager and distribute via VPP.

C.Deploy the PKG as a line-of-business app in Intune and assign it as required.

D.Place the PKG in a network share and instruct users to install via Company Portal.

AnswerC

Intune supports PKG deployment silently on macOS.

Why this answer

Intune supports deploying PKG files as line-of-business (LOB) apps on macOS. When you upload the PKG and assign it as 'Required', Intune silently installs it using the macOS Installer framework with administrative privileges, without requiring user interaction. The Intune management agent on the device handles the installation in the system context, ensuring a silent deployment.

Exam trap

The trap here is that candidates often confuse the 'line-of-business app' deployment method with other distribution mechanisms like VPP or manual scripts, failing to recognize that Intune's LOB app assignment is the only built-in method that supports silent, privileged installation of custom PKG files on macOS.

How to eliminate wrong answers

Option A is wrong because using a shell script with sudo via a launch daemon is a manual, unsupported workaround that bypasses Intune's management capabilities and does not integrate with reporting or compliance. Option B is wrong because Apple Business Manager (ABM) and Volume Purchase Program (VPP) are used for distributing apps from the App Store, not custom PKG files; VPP does not support sideloading arbitrary PKGs. Option D is wrong because placing the PKG on a network share and instructing users to install via Company Portal requires user interaction and does not achieve silent deployment; Company Portal for macOS does not natively support silent installation of PKG files from a share.

Practice this question →

131

MCQhard

Your organization is migrating from on-premises SCCM to Microsoft Intune. You have a Win32 app that requires a custom script to run after installation. The app must be available to users in a remote office with limited internet connectivity. What should you use to deploy the app?

A.Configure a cloud management gateway (CMG) to distribute the app.

B.Store the app in Azure Files and mount it on devices.

C.Use a PowerShell script deployed via Intune to download the app from a local file share.

D.Deploy the Win32 app via Intune with Delivery Optimization and peer caching enabled.

AnswerD

This reduces internet bandwidth usage for remote offices.

Why this answer

Delivery Optimization combined with peer caching allows devices in a remote office with limited internet connectivity to download the Win32 app from other peers on the same local network, reducing WAN bandwidth usage. Intune natively supports Win32 app deployment with this feature, and the custom script can be included as a post-installation detection or requirement script. This approach aligns with the migration from SCCM to Intune while addressing connectivity constraints.

Exam trap

The trap here is that candidates often confuse Cloud Management Gateway (CMG) as an Intune feature, when it is actually an SCCM component, leading them to pick Option A despite the question explicitly stating a migration from SCCM to Intune.

How to eliminate wrong answers

Option A is wrong because a Cloud Management Gateway (CMG) is an SCCM feature for managing internet-based clients, not a method for distributing Win32 apps via Intune; it does not solve the limited connectivity issue in a remote office for Intune-managed devices. Option B is wrong because Azure Files is a cloud file share service that requires devices to have internet connectivity to mount the share, which contradicts the 'limited internet connectivity' constraint; it also does not integrate with Intune's app deployment pipeline. Option C is wrong because using a PowerShell script deployed via Intune to download from a local file share bypasses Intune's built-in app delivery and reporting mechanisms, and the script would need to handle authentication and network paths manually, making it unreliable and unsupported for Win32 app deployment.

Practice this question →

132

MCQeasy

You need to make a web app available to users in your organization through Microsoft Intune Company Portal. Which app type should you create in Intune?

A.iOS store app

B.Web app

C.Windows app (Win32)

D.Android store app

AnswerB

Web apps are used to publish web links in Company Portal.

Why this answer

To make a web app available through Microsoft Intune Company Portal, you must create a 'Web app' type. This app type allows you to add a link to a web application that users can access via the Company Portal, without needing to install a native client. Intune's Web app type supports both HTTP and HTTPS URLs and can be configured with a display name, URL, and icon for the Company Portal listing.

Exam trap

The trap here is that candidates may confuse 'Web app' with other app types like 'Windows app (Win32)' or 'iOS store app', thinking they need to wrap a web app in a native installer, when Intune's Web app type is specifically designed for this purpose.

How to eliminate wrong answers

Option A is wrong because an iOS store app is designed for iOS devices and requires a native app package from the Apple App Store, not a web app. Option C is wrong because a Windows app (Win32) is used for deploying traditional desktop applications via .msi or .exe files, not for making a web app available. Option D is wrong because an Android store app is for native Android applications distributed through the Google Play Store, not for web-based apps.

Practice this question →

133

MCQhard

An administrator is troubleshooting why a Win32 app is repeatedly installed on a device. The exhibit shows a log snippet. What is the most likely cause of the repeated installation?

A.The app writes the detection file to a temporary folder that is cleaned periodically

B.The app requires a reboot to complete installation

C.The detection rule runs before the install completes

D.The exit code 0 is misinterpreted as failure

AnswerA

If the file is in a temp folder, it may be deleted, causing detection to fail on subsequent scans.

Why this answer

If the Win32 app's detection file is written to a temporary folder (e.g., %TEMP% or C:\Windows\Temp) that is periodically cleaned by disk cleanup policies or the Storage Sense feature, Intune will no longer detect the app as installed after the file is removed. This causes the Microsoft Intune Management Extension to re-run the installation on the next sync cycle, leading to a repeated installation loop. The detection rule relies on the persistent presence of the file, so its removal triggers reinstallation.

Exam trap

The trap here is that candidates assume a detection rule failure is due to timing (Option C) or exit code issues (Option D), but the real-world cause is often a transient detection artifact that gets cleaned, not a logic error in the installation process.

How to eliminate wrong answers

Option B is wrong because a required reboot does not cause repeated installation; Intune marks the app as installed after the exit code 0 is received, and a pending reboot only delays further actions, not reinstallation. Option C is wrong because the detection rule runs after the installation script completes and returns an exit code, not before; the log snippet would show a detection failure only after the install attempt finishes. Option D is wrong because exit code 0 is universally interpreted as success by Intune's Win32 app management; a misinterpretation would require a custom detection rule or a non-standard exit code mapping, which is not indicated.

Practice this question →

134

MCQeasy

You need to deploy a line-of-business app to 100 Windows 10 devices that are managed by Microsoft Intune. The app installer is a .msi file. Which app type should you select when adding the app in Microsoft Intune?

A.Microsoft Store app (Windows)

B.Windows app (Line-of-business)

C.Web link

D.Windows app (Win32)

AnswerD

Win32 app supports .msi, .exe, and PowerShell scripts for deployment.

Why this answer

D is correct because Win32 app management in Intune supports deploying traditional desktop applications, including .msi files, to Windows 10 devices. Win32 apps can be assigned to devices managed by Intune and allow for complex installation commands, detection rules, and dependencies, making them suitable for line-of-business apps that require full control over the installation process.

Exam trap

The trap here is that candidates often confuse 'Line-of-business' (which only supports .appx/.msix) with Win32 apps, assuming any custom app qualifies as line-of-business, but Intune requires the Win32 app type for .msi files.

How to eliminate wrong answers

Option A is wrong because Microsoft Store app (Windows) is used for apps sourced from the Microsoft Store, not for sideloading a custom .msi file. Option B is wrong because Windows app (Line-of-business) is designed for .appx or .msix packages, not for .msi installers. Option C is wrong because Web link simply creates a shortcut to a URL and does not deploy an actual application installer.

Practice this question →

135

MCQmedium

Your organization uses Microsoft Intune to manage 1,500 Windows 10 and 500 macOS devices. You need to deploy Microsoft Edge (Stable channel) to all Windows devices. The deployment must ensure that Edge is set as the default browser, and that the 'SmartScreen' feature is enabled. You also want to ensure that users cannot change the default browser setting. You have created a configuration profile with the required settings. The Edge app is available in the Microsoft Store for Business. Which deployment method should you use to meet all requirements with the least administrative effort?

A.Use a PowerShell script to install Edge and apply settings via registry.

B.Deploy Edge as a Win32 app using the offline installer, and apply the configuration profile separately.

C.Use the 'Microsoft Edge for Windows 10 and later' built-in app type in Intune, assign it as 'Required' to a device group, and apply the configuration profile.

D.Deploy Edge as a Microsoft Store for Business app and use OMA-URI to set default browser.

AnswerC

Built-in app type simplifies deployment and policy application.

Why this answer

The built-in 'Microsoft Edge for Windows 10 and later' app type in Intune provides a streamlined deployment for Edge. It allows specifying the channel (Stable), and configuration profiles can enforce the default browser and enable SmartScreen. This requires the least administrative effort as it's fully integrated.

Option A (PowerShell script) requires custom scripting and registry manipulation, which is more effort and less manageable. Option B (Win32 app) works but requires downloading the offline installer and applying the configuration profile separately, whereas the built-in type is simpler. Option D (Store for Business app) requires OMA-URI for settings, but the built-in app type already supports configuration profiles, making it unnecessary.

Exam trap

Candidates might think a Win32 app is required for setting policies, but Intune's built-in Edge app type can deploy the browser and apply configuration profiles simultaneously.

Practice this question →

136

MCQhard

Contoso Ltd. uses Microsoft Intune to manage Windows 11 devices. They need to deploy a Line-of-Business (LOB) app (ContosoApp.msi) to 500 devices in a pilot group. The app requires admin privileges and must be installed in the system context. The deployment must be silent with no user interaction, and the installation status must be reported to Intune. They have created a Win32 app wrapper and uploaded the .intunewin file. Which configuration should they choose in the Intune Win32 app properties to meet the requirements?

A.Install behavior: User, Device restart behavior: No specific action

B.Install behavior: System, Device restart behavior: No specific action

C.Install behavior: System, Device restart behavior: Suppress restarts

D.Install behavior: User, Device restart behavior: Block restarts until installation completes

AnswerB

System context provides admin privileges, and No specific action avoids restart prompts.

Why this answer

Setting Install behavior to System ensures the app runs with admin privileges and installs in the system context, while Device restart behavior set to No specific action allows any necessary restarts to occur without blocking installation. This meets the requirements of silent deployment with no user interaction and status reporting to Intune. Option A is incorrect because User install behavior does not provide system-level privileges.

Option C is incorrect because Suppress restarts may prevent necessary restarts, potentially causing the installation to fail or not complete properly. Option D is incorrect because User install context with the app requiring admin rights will fail to install correctly.

Practice this question →

137

MCQeasy

You are deploying a line-of-business (LOB) app to iOS devices using Microsoft Intune. The app is signed with an enterprise certificate. Users report that the app installs but crashes immediately on launch. What is the most likely cause?

A.The Intune company portal app is not installed.

B.The app is not signed.

C.The app requires a VPN connection.

D.The enterprise developer certificate is not trusted on the device.

AnswerD

iOS requires manual trust of enterprise cert before launching.

Why this answer

The most likely cause is that the enterprise developer certificate is not trusted on the device. iOS requires that enterprise-signed apps have their root certificate manually trusted via a profile (e.g., MDM or manual installation) before the app can run. Without this trust, iOS blocks the app from executing, causing an immediate crash on launch.

Exam trap

The trap here is that candidates may confuse 'signed' with 'trusted' — the app is signed, but iOS requires explicit trust of the enterprise certificate, which is a separate step often overlooked in MDM deployments.

How to eliminate wrong answers

Option A is wrong because the Company Portal app is not required for LOB app installation via MDM; Intune can push apps directly using Apple Push Notification service (APNs) and managed Open In. Option B is wrong because the app is explicitly stated to be signed with an enterprise certificate, so it is signed; the issue is trust, not signature absence. Option C is wrong because a VPN connection is not a prerequisite for launching an LOB app; VPN requirements are app-specific and would not cause an immediate crash on launch.

Practice this question →

138

Multi-Selecteasy

Which TWO of the following are types of app protection policies (APP) in Microsoft Intune?

Select 2 answers

A.macOS

B.iOS/iPadOS

C.Windows 10/11

D.Web apps

E.Android

AnswersB, E

APP is supported for iOS/iPadOS.

Why this answer

In Microsoft Intune, app protection policies (APP) are designed to manage and protect app data on devices that may or may not be enrolled in MDM. The two supported mobile platforms for APP are iOS/iPadOS and Android, as these platforms allow granular control over app-level data through Intune SDK-integrated apps or managed browsers.

Exam trap

The trap here is that candidates often confuse device compliance policies (which support macOS and Windows) with app protection policies, leading them to select macOS or Windows as valid APP types.

Practice this question →

139

MCQeasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a Microsoft 365 Apps for Enterprise to work profiles. Which app type should you select in Intune?

A.Web app

B.Android Enterprise system app

C.Line-of-business app

D.Managed Google Play app

AnswerD

Microsoft 365 Apps is available as a Managed Google Play app.

Why this answer

For deploying Microsoft 365 Apps for Enterprise to Android Enterprise work profiles, the correct app type is Managed Google Play app. Intune integrates with Managed Google Play to distribute approved apps to work profiles, ensuring compliance with Android Enterprise policies. Web apps, system apps, and line-of-business apps cannot deliver the full Microsoft 365 suite with managed configuration and app protection policies in a work profile context.

Exam trap

The trap here is that candidates may confuse 'Line-of-business app' with any business app, but Microsoft 365 Apps for Enterprise is a commercially available app that must be distributed via Managed Google Play, not uploaded as a custom package.

How to eliminate wrong answers

Option A is wrong because a Web app only provides a shortcut to a URL and cannot install native Microsoft 365 apps with offline capabilities or managed app configuration. Option B is wrong because Android Enterprise system apps are pre-installed system components, not third-party apps like Microsoft 365, and cannot be deployed via Intune for work profiles. Option C is wrong because a Line-of-business app is used for custom internal apps uploaded directly to Intune, not for commercially available apps like Microsoft 365 that must be sourced from Managed Google Play.

Practice this question →

140

Multi-Selecthard

Which TWO of the following are valid reasons to use a Windows PowerShell script deployment instead of a Win32 app in Intune?

Select 2 answers

A.Configuring Windows Update for Business policies

B.Applying a temporary security configuration change quickly

C.Modifying registry settings on a schedule

D.Installing an MSI with silent switches

E.Deploying a complex application with multiple files

AnswersB, C

Scripts are ideal for quick changes.

Why this answer

Scripts in Intune are best suited for quick, temporary changes that do not require a full application lifecycle, such as applying a temporary security configuration change (option B) or modifying registry settings on a schedule (option C). Win32 apps are better for deploying complex applications (option E) or installing MSIs (option D), and configuring Windows Update policies (option A) is done via configuration profiles.

Practice this question →

141

Multi-Selecthard

A company uses Microsoft Intune to manage Windows 10 devices. They are deploying a Win32 app using the Intune Management Extension. The app requires a reboot and must ensure that the installation completes successfully before the device is allowed to restart. Which TWO deployment settings should be configured?

Select 2 answers

A.Enable 'Delivery optimization' for the app

B.Set 'Device restart behavior' to 'Require device restart'

C.Set 'Device restart behavior' to 'No specific action'

D.Configure 'Supersedence' to replace the app

E.Configure 'Return codes' for 'Soft reboot' as 'No action'

AnswersC, E

Prevents Intune from forcing a reboot, allowing installation to complete.

Why this answer

Setting 'Device restart behavior' to 'No specific action' allows Intune to complete the Win32 app installation without forcing an immediate reboot, which is necessary when the app itself handles the reboot or when you want to control the restart timing. This setting prevents the Intune Management Extension from triggering a restart before the installation is fully complete, ensuring the app's post-installation processes (e.g., file copies, registry writes) finish successfully.

Exam trap

The trap here is that candidates often confuse 'Device restart behavior' with a simple toggle for requiring a reboot, missing that 'No specific action' is the correct choice when the app itself manages the reboot, and they overlook the need to also configure 'Return codes' for 'Soft reboot' as 'No action' to prevent the IME from misinterpreting a soft reboot code as an installation failure.

Practice this question →

142

MCQmedium

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company portal app that allows users to enroll their devices. Which app type should you use?

A.Built-in app

B.iOS and macOS store app

C.Web link

D.macOS LOB app

AnswerB

Company Portal for macOS is available in the Mac App Store.

Why this answer

The Company Portal app for macOS is available in the Apple App Store and is distributed via Intune as an iOS and macOS store app. This app type allows Intune to manage the app installation and assignment from the store, enabling users to enroll their macOS devices into management. Built-in apps are for pre-installed system apps, web links are for shortcuts, and LOB apps are for custom in-house apps, none of which provide the required enrollment functionality.

Exam trap

The trap here is that candidates confuse the 'iOS and macOS store app' type with the 'Built-in app' type, thinking Company Portal is a built-in system app, when in fact it must be downloaded from the App Store and managed as a store app.

How to eliminate wrong answers

Option A is wrong because built-in apps in Intune refer to pre-installed system apps like Safari or Calendar, not the Company Portal, which must be downloaded from the App Store. Option C is wrong because a web link only creates a shortcut to a URL in the Company Portal website, not a native app installation, and macOS device enrollment requires the native Company Portal app. Option D is wrong because a macOS LOB app is used for custom in-house applications uploaded directly to Intune, not for store-sourced apps like Company Portal.

Practice this question →

143

Multi-Selectmedium

Which TWO of the following are prerequisites for deploying a Win32 app via Microsoft Intune?

Select 2 answers

A.The app must be packaged using the Microsoft Win32 Content Prep Tool.

B.The device must be running Windows 10 version 1803 or later.

C.The device must have the Intune Management Extension installed.

D.The device must be Azure AD joined.

E.The device must have the Company Portal app installed.

AnswersA, C

Tool creates .intunewin file.

Why this answer

The Microsoft Win32 Content Prep Tool is required to package Win32 apps into the .intunewin format that Intune can process. This tool pre-processes the installation files and detection logic, ensuring the app can be uploaded and deployed through the Intune console.

Exam trap

The trap here is that candidates often confuse the Windows 10 version requirement for Win32 apps (1607) with the higher version required for other Intune features like co-management or Windows Autopilot, leading them to incorrectly select version 1803.

Practice this question →

144

Multi-Selecteasy

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. Which TWO configurations are required?

Select 2 answers

A.The user must have a Google account

B.The device must be personally owned

C.The device must be enrolled using Android Enterprise work profile

D.The app must be approved in the managed Google Play store

E.The app must be configured as a kiosk app

AnswersC, D

Required for managed Google Play apps.

Why this answer

Android Enterprise work profile enrollment is the specific enrollment mode that creates a separate, managed profile on the device, isolating work apps and data from personal apps. This is the only Android Enterprise enrollment type that supports managed Google Play app deployment to work profile devices, as it binds the device to the managed Google Play store without requiring a personal Google account on the device.

Exam trap

The trap here is that candidates often confuse the requirement for a Google account (personal) with the managed Google Play account, or assume that work profile requires personal ownership, when in fact the enrollment type (work profile) is the sole prerequisite for deploying managed Google Play apps to work profile devices.

Practice this question →

145

Multi-Selecthard

Which THREE are valid methods to deploy an app as available for users in Microsoft Intune?

Select 3 answers

A.Assign the app to a device group with the 'Available' setting

B.Add the app to the Company Portal as a featured app without assignment

C.Assign the app to a user group with the 'Required' setting

D.Assign the app to a user group with the 'Available' setting

E.Assign the app to a user group with the 'Available for enrolled devices' setting

AnswersC, D, E

Required installs are still available in Company Portal.

Why this answer

Assigning an app with the 'Required' setting to a user group forces the app to be installed on the user's devices, making it available for deployment. In Microsoft Intune, the 'Required' assignment is a valid method to deploy an app as available for users, as it triggers automatic installation based on user identity. This ensures the app is pushed to all devices associated with the user group, aligning with the scenario of making an app available.

Exam trap

The trap here is that candidates often confuse device group assignments with user group assignments, mistakenly thinking 'Available' can be applied to device groups, but Intune restricts 'Available' to user groups only, and 'Required' is valid for both user and device groups.

Practice this question →

146

MCQhard

You run the PowerShell command to check the assignment of a Microsoft Store app in Intune. The output shows 'intent: required' and 'target: allDevicesAssignmentTarget'. Which statement is true about this app?

A.The app is assigned to a specific device group named 'All Devices'.

B.The app will install automatically on all enrolled devices.

C.The app is only assigned to devices that have the Intune Management Extension.

D.The app is available for users to install from Company Portal.

AnswerB

Required assignment to all devices triggers automatic installation.

Why this answer

The output shows 'intent: required' and 'target: allDevicesAssignmentTarget'. In Intune, 'intent: required' means the app is mandatory and will install automatically without user intervention. 'target: allDevicesAssignmentTarget' indicates the assignment applies to all enrolled devices, not a specific group. Therefore, the app will install automatically on every enrolled device, making option B correct.

Exam trap

The trap here is that candidates confuse 'allDevicesAssignmentTarget' with a manually created 'All Devices' group, or misinterpret 'intent: required' as making the app available in Company Portal, when in fact it enforces automatic installation.

How to eliminate wrong answers

Option A is wrong because 'allDevicesAssignmentTarget' is a built-in system group representing all enrolled devices, not a user-created device group named 'All Devices'. Option C is wrong because the Intune Management Extension is only required for Win32 apps or PowerShell scripts, not for Microsoft Store apps, which use the Windows Store client or the Intune management agent. Option D is wrong because 'intent: required' forces installation, whereas 'intent: available' would make the app visible in Company Portal for user-initiated installation.

Practice this question →

147

MCQhard

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires a kernel extension. The app is signed with a Developer ID certificate. The devices are enrolled in Intune and are supervised. You have uploaded the .pkg to Intune and assigned it to a user group. The installation fails on devices with the error 'The app could not be installed because the kernel extension is not approved'. You have already configured a kernel extension profile that allows the specific team identifier. What else is likely missing?

A.System Integrity Protection (SIP) is enabled on the devices.

B.FileVault is enabled on the devices.

C.The kernel extension profile does not include the 'Allow user to approve kernel extensions' setting.

D.The app is not notarized by Apple.

AnswerD

The app is not notarized by Apple. Notarization is required for kernel extensions on macOS 10.14.5+ to ensure they are free from known malicious content. This is the missing prerequisite.

Why this answer

Starting with macOS 10.14.5, Apple requires all kernel extensions (kexts) to be notarized by Apple. Even if the kernel extension profile allows the team identifier, the app itself must be notarized to install on macOS 10.14.5+ systems. Without notarization, the installation fails with the given error.

Option C is incorrect because the 'Allow user to approve kernel extensions' setting is for user approval after installation, not the root cause here. Options A and B are unrelated.

Practice this question →

148

MCQmedium

You are deploying a managed Google Play app to Android Enterprise fully managed devices. The app is not appearing in the work profile. What is the most likely reason?

A.The app is not approved in Managed Google Play

B.The work profile is not enabled

C.The device is not enrolled in Intune

D.The device is not associated with a Google account

AnswerA

Apps must be approved before deployment.

Why this answer

The most likely reason the app is not appearing is that it has not been approved in Managed Google Play. For Android Enterprise fully managed devices, apps must be approved in the Managed Google Play console before they can be deployed via Intune. Option B is incorrect because the work profile is not relevant for fully managed devices; they are corporate-owned and do not use work profiles.

Option C is incorrect because the device must be enrolled in Intune, but if it is enrolled and the app is missing, lack of enrollment is not the most likely reason. Option D is incorrect because fully managed devices are associated with a managed Google account via the enrollment token, not a personal Google account.

Practice this question →

149

Multi-Selecteasy

Which TWO of the following are benefits of using Microsoft Intune to manage applications on mobile devices?

Select 2 answers

A.Ability to deploy apps to devices without requiring sideloading.

B.Enforcement of device compliance before app installation.

C.Support for user-based licensing only.

D.Selective wipe of corporate data from apps when a user leaves.

E.Automatic backup of app data to the cloud.

AnswersA, D

Apps are installed via MDM channel.

Why this answer

Microsoft Intune uses the Company Portal app or the Intune app wrapper to deploy line-of-business (LOB) apps directly to devices without requiring users to manually sideload them. This simplifies app distribution by leveraging the MDM channel, which pushes the app package (e.g., .ipa for iOS, .apk for Android) to the device, ensuring it is installed silently or with minimal user interaction. Sideloading typically involves manual installation via USB or enterprise provisioning profiles, which Intune eliminates through its managed deployment capabilities.

Exam trap

The trap here is that candidates often confuse 'deploying apps without sideloading' with 'enforcing compliance before installation,' but Intune deploys apps to all enrolled devices and uses conditional access to gate access, not installation, making Option B a common distractor.

Practice this question →

150

MCQhard

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully on some devices but fails on others with no error in the Intune console. The app logs show 'Access Denied' during installation. What should you check first?

A.The device is not Microsoft Entra ID joined

B.The device has insufficient disk space

C.The app is not signed

D.The installation context (user vs system) in the app deployment

AnswerD

The app may require system privileges but is set to user context.

Why this answer

The 'Access Denied' error in the app logs indicates a permissions issue during installation. In Intune, Win32 apps can be deployed in either 'user' or 'system' installation context. If the app requires administrative privileges (e.g., writing to Program Files or the registry under HKLM) but is configured to run in the user context, it will fail with an access denied error on devices where the user lacks sufficient rights.

Therefore, verifying the installation context is the first troubleshooting step.

Exam trap

The trap here is that candidates often assume 'Access Denied' is always a signing or permission issue at the device level, but the MD-102 exam specifically tests the distinction between user and system installation contexts in Intune Win32 app deployments.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID (formerly Azure AD) join status does not directly cause 'Access Denied' errors during app installation; it affects authentication and policy application, not local file system permissions. Option B is wrong because insufficient disk space typically produces a 'disk full' or 'out of space' error, not an 'Access Denied' error. Option C is wrong because an unsigned app would generate a different error, such as 'The publisher could not be verified' or a SmartScreen warning, not an 'Access Denied' error.

Practice this question →