MD-102 Prepare infrastructure for devices Practice Question
You are preparing infrastructure for device management at Adventure Works. The company has an on-premises Active Directory Domain Services (AD DS) environment and uses Microsoft Intune. You need to configure a Windows Autopilot deployment profile that will be used for Microsoft Entra hybrid join. During testing, devices fail at the domain join step. You verify that the Intune Connector for Active Directory is installed and online. What should you check next?
⚠ Common exam trap
The trap here is stopping at the connector's online status and overlooking that the connector still needs a valid OU path and an account with rights to create computer objects.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The organizational unit (OU) specified in the deployment profile exists and the connector service account has permission to create computer objects in it.
When the Intune Connector for Active Directory is online but hybrid join still fails, the next checks are the organizational unit specified in the deployment profile and the permissions of the connector's service account. The connector creates the computer object in that OU, so an invalid OU path or insufficient rights prevents the domain join. TPM, UEFI, group assignment, and join type are not the cause when devices already reach the domain join step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The device has a TPM 2.0 chip and is UEFI-enabled.
Why it's wrong here
TPM 2.0 and UEFI are requirements for features such as BitLocker and some Autopilot scenarios, but they are not the cause of a domain join failure during hybrid join. A missing TPM would more likely block device preparation or encryption, not the offline domain join. The scenario already indicates failure at the domain join step, so the OU and permissions are the relevant checks.
- ✓
The organizational unit (OU) specified in the deployment profile exists and the connector service account has permission to create computer objects in it.
Why this is correct
For hybrid join, the Intune Connector for Active Directory uses a service account to create the computer object in the OU specified in the Autopilot deployment profile. If the OU path is invalid or the account lacks Create Computer Objects permission, the domain join fails even when the connector is online. Verifying the OU and permissions is the logical next step.
- ✗
The Microsoft Entra ID join type is set to Microsoft Entra joined instead of Microsoft Entra hybrid joined.
Why it's wrong here
If the join type were set to Microsoft Entra joined, the device would not attempt an on-premises domain join at all and would not fail at that step. The scenario states devices fail at the domain join step, implying the hybrid join path is active. Therefore, the OU path and connector service account permissions are the correct items to verify.
- ✗
The Windows Autopilot deployment profile is assigned to a device group and not a user group.
Why it's wrong here
Autopilot deployment profiles are assigned to device groups, and assigning to a user group is a common misconfiguration, but it would prevent the profile from applying at all rather than cause a domain join failure after the profile is applied. Since devices reach the domain join step, the profile is being applied. The OU and connector permissions are the more likely cause.
Go deeper
Related to this question
Learn chapter
Deploying Applications with Intune
Key term
Deployment profile
A deployment profile is a set of configuration settings and policies that IT administrators apply to enroll and configure devices in an organization, automating the setup process.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.