MD-102 Prepare infrastructure for devices Practice Question
You are preparing infrastructure for Microsoft Intune enrollment of Windows 11 devices. The company uses Microsoft Entra ID and requires that devices automatically enroll in Intune when users join them to Microsoft Entra ID. You also need to ensure that only users in a specific security group are allowed to enroll devices. What should you configure?
⚠ Common exam trap
Watch out — candidates often confuse enrollment restrictions or Conditional Access with the MDM user scope, which is the actual control for who can automatically enroll.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic enrollment in Intune and set the MDM user scope in Microsoft Entra ID to the security group.
Automatic enrollment is turned on in the Intune admin center, while the user scope that determines who is eligible is configured in the Microsoft Entra ID mobility settings. Pointing the MDM user scope at the chosen security group restricts automatic Intune enrollment to those users, which is exactly what the scenario requires.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a device enrollment restriction in Intune that allows only the security group and enable Windows Autopilot for those devices.
Why it's wrong here
Device enrollment restrictions control platform, version, and personal versus corporate ownership, not user group membership for automatic enrollment. Windows Autopilot is a deployment method and does not restrict which users can enroll. This combination does not enforce the requirement that only members of a specific security group can enroll devices.
- ✗
Configure automatic MDM enrollment in the Microsoft Entra ID mobility settings and assign the Intune Enrollment scope to the security group.
Why it's wrong here
The mobility (MDM and WIP) settings in Microsoft Entra ID let you define which users can automatically enroll, and you can scope it to a group. However, the Intune Enrollment scope is not a valid construct in that blade; you assign MDM user scope to a group. This option uses an incorrect term, so it does not accurately describe the configuration required.
- ✗
Configure a Conditional Access policy that requires compliant devices and assign it to the security group.
Why it's wrong here
Conditional Access policies control access to cloud apps based on conditions such as device compliance, but they do not govern automatic MDM enrollment or limit enrollment to a particular user group. This approach addresses access control after enrollment rather than the enrollment eligibility requirement described in the scenario.
- ✓
Enable automatic enrollment in Intune and set the MDM user scope in Microsoft Entra ID to the security group.
Why this is correct
Automatic MDM enrollment is enabled from the Intune portal, and the Microsoft Entra ID mobility settings include an MDM user scope that can be set to a specific security group. Setting the scope to that group ensures only its members are automatically enrolled in Intune when they join devices to Microsoft Entra ID, meeting both requirements.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
One of 556 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.