Win32 App Detection Rule Types in Intune
Which THREE of the following are valid detection rule types for a Win32 app in Microsoft Intune? (Select THREE.)
Quick Answer
The correct answer is file, registry, and MSI product code, as these three are the standard detection rule types for a Win32 app in Microsoft Intune. Detection rules tell Intune how to verify whether an application is already installed, and the supported methods include checking for a specific file path, a registry key or value, and an MSI product code (GUID). On the MD-102 exam, this concept tests your understanding of Win32 app deployment logic, often appearing in scenario-based questions where you must choose the appropriate detection method to avoid reinstallation loops. A common trap is confusing PowerShell scripts—which are also valid but not listed here—with DNS queries, which are not a detection rule type at all. Remember the mnemonic “FRM” (File, Registry, MSI) to quickly recall the three core detection rule types for Win32 apps.
⚠ Common exam trap
Test-takers frequently confuse 'Windows feature' (a deployment type for optional Windows features) with a valid detection rule, or assume 'DNS query' is a plausible detection method due to its use in other Intune features like compliance policies, but it is not applicable to Win32 app detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MSI product code
MSI product code detection rules allow Intune to verify the presence of a Win32 app by checking the Windows Installer (MSI) product code in the registry (HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall). This is a native detection method that directly confirms the application's installation state without requiring custom scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows feature
Why it's wrong here
Not a detection rule; Windows features are managed via policies.
- ✓
MSI product code
Why this is correct
Detects based on MSI product GUID.
- ✓
File system
Why this is correct
Detects based on file path/version.
- ✓
Registry
Why this is correct
Detects based on registry key/value.
- ✗
DNS query
Why it's wrong here
Not a detection rule type.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
Win32 app
A Win32 app is a traditional Windows program that runs directly on a Windows PC, using the same system resources and displaying a standard window with menus and buttons.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which FOUR of the following are valid detection rules for a Win32 app in Intune?
hard- ✓ A.PowerShell script (custom detection)
- ✓ B.MSI product code
- ✓ C.Registry (key or value exists)
- ✓ D.File system (file or folder exists)
- E.Network share access
Why A: For Win32 apps in Intune, the valid detection rules are: PowerShell script (custom detection), MSI product code, Registry (key or value exists), and File system (file or folder exists). Network share access is not a detection rule. Therefore, options A, B, C, and D are correct.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.