MD-102 Manage and maintain devices Practice Question
Which THREE conditions can be used to create a dynamic device group in Microsoft Entra ID for Intune management? (Choose three.)
⚠ Common exam trap
It's easy for candidates to confuse dynamic device group rules (which only support device attributes) with dynamic user group rules or compliance policies, leading them to select user-based or application-based conditions like 'Last sign-in time' or 'Installed application version'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enrollment profile name (e.g., 'Autopilot Profile')
Option A is correct because dynamic device groups in Microsoft Entra ID support the device property enrollmentProfileName, which matches the Autopilot enrollment profile name such as 'Autopilot Profile', allowing devices to be grouped by how they were provisioned. Option D is correct because the deviceModel attribute is a supported device property that can be used in a dynamic membership rule, so a rule like device.deviceModel -eq "Surface Pro 7" will correctly populate the group. Option E is correct because operatingSystemVersion is also a valid device property for dynamic device membership rules, enabling grouping by OS build such as Windows 11 22H2. Option B is not valid because last sign-in time is a user attribute (signInActivity), not a device property available for dynamic device group rules. Option C is not valid because installed application versions are not exposed as Microsoft Entra ID device attributes; app inventory data lives in Intune and cannot be used directly in an Entra dynamic device membership rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enrollment profile name (e.g., 'Autopilot Profile')
Why this is correct
Enrollment profile name is a valid device rule for dynamic groups, letting you target devices provisioned with a specific Autopilot profile. This satisfies the stem's requirement for a supported membership condition, since Autopilot-assigned profiles are written to the device object's attribute.
- ✗
Last sign-in time of the user
Why it's wrong here
Dynamic device group rules can only reference device attributes; last sign-in time is a user property, available for dynamic user groups, not device groups. It is tempting because sign-in activity is visible in Microsoft Entra ID and useful for licence or access cleanup, but it cannot drive device membership.
- ✗
Installed application version
Why it's wrong here
Dynamic device group rules evaluate device attributes such as deviceId, deviceOSType, deviceOwnership, enrolmentProfileName and managementType; installed application version is not an available device property. It is tempting because Intune reports detected apps per device, but that inventory is not exposed to Microsoft Entra ID dynamic membership rule syntax.
- ✓
Device model (e.g., 'Surface Pro 7')
Why this is correct
Device model is a supported device property for dynamic membership rules, so a rule such as device.model -eq "Surface Pro 7" evaluates correctly. It satisfies the stem's need for a valid condition that Microsoft Entra ID can query against enrolled device objects.
- ✓
Operating system version (e.g., 'Windows 11 22H2')
Why this is correct
Operating system version is a queryable device attribute, so rules using deviceOSVersion match devices on a specified build such as Windows 11 22H2. This satisfies the stem's requirement for a supported condition that Microsoft Entra ID evaluates for dynamic device membership.
Go deeper
Related to this question
Learn chapter
Deploying Applications with Intune
Key term
Enrollment profile
An enrollment profile is a set of rules and settings that tells a device or user how to join and follow an organization’s network, security, and application policies.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 556 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.