MD-102 Prepare infrastructure for devices Practice Question
You are preparing infrastructure for Windows Autopilot at Contoso. You need to configure the environment so that devices can be deployed with Windows Autopilot in Microsoft Entra hybrid join mode. Which two components must be in place before devices can complete the hybrid join during OOBE? (Choose two.)
⚠ Common exam trap
The trap here is selecting Configuration Manager components or security policies as prerequisites, when the two essential elements are the AD connector and the hybrid-joined deployment profile.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Windows Autopilot deployment profile configured with the Microsoft Entra hybrid joined join type.
Autopilot hybrid join requires the Intune Connector for Active Directory to perform the offline domain join and a deployment profile configured for Microsoft Entra hybrid joined to direct the device through the correct OOBE path. Compliance policies, Configuration Manager enrollment proxy points, and Conditional Access policies do not perform the domain join or Entra registration steps, so they are not prerequisites for completing hybrid join.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A device compliance policy requiring BitLocker and Secure Boot.
Why it's wrong here
A compliance policy evaluates device health after enrollment and feeds Conditional Access, but it does not participate in the domain join or Entra registration process during OOBE. Requiring BitLocker and Secure Boot may be a good security practice, but it is not a prerequisite for completing hybrid join. It therefore does not belong in the list of required components.
- ✗
A Configuration Manager site system role for the enrollment proxy point.
Why it's wrong here
The enrollment proxy point is associated with Configuration Manager co-management and does not perform the domain join for Autopilot hybrid join. The offline domain join is handled by the Intune Connector for Active Directory. Adding an enrollment proxy point would not enable hybrid join and is not a required component for this scenario.
- ✓
A Windows Autopilot deployment profile configured with the Microsoft Entra hybrid joined join type.
Why this is correct
A deployment profile set to Microsoft Entra hybrid joined tells the device to perform an on-premises domain join and then register with Entra ID. Without this profile, devices default to Entra joined or do not receive the correct OOBE behavior. It is a required configuration alongside the connector for hybrid join to succeed.
- ✓
The Intune Connector for Active Directory installed on a server with access to the on-premises domain.
Why this is correct
The Intune Connector for Active Directory is the component that performs the offline domain join for Autopilot hybrid join. It must run on a Windows Server that can reach a domain controller and has outbound access to Intune. Without it, devices cannot create the computer object in AD DS and the hybrid join fails during OOBE.
- ✗
A conditional access policy requiring multifactor authentication for all users.
Why it's wrong here
Conditional Access policies govern access to resources based on conditions such as user, device, and location. They do not perform the AD DS domain join or Entra registration during OOBE. While MFA may be part of an overall security strategy, it is not a prerequisite for Autopilot hybrid join, so it is not one of the required components.
Go deeper
Related to this question
Learn chapter
Deploying Applications with Intune
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Windows Autopilot
Windows Autopilot is a cloud-based deployment technology that automates the setup and configuration of new Windows devices, reducing the need for IT staff to manually image or touch each machine.
About these practice questions
One of 556 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.