MD-102 Prepare infrastructure for devices Practice Question
You are the endpoint administrator for Contoso, a company with 5,000 employees. The organization uses Microsoft Intune for device management and Microsoft Entra ID for identity. The current environment includes: - 3,000 Windows 11 Enterprise devices (corporate-owned, managed via Intune) - 1,500 iOS devices (corporate-owned, managed via Intune) - 500 Android devices (BYOD, managed via Intune with work profile) - 200 macOS devices (corporate-owned, managed via Intune)
You need to implement a solution to automatically enroll new Windows 11 devices purchased from a vendor. The devices should be pre-provisioned with the organization's configuration and applications without requiring IT staff to touch them. Additionally, you need to ensure that only compliant devices can access corporate email and documents. The solution must minimize manual effort and leverage cloud-based services.
You have the following requirements: 1. Zero-touch enrollment for new Windows 11 devices. 2. Devices must be automatically configured with security policies and required applications. 3. Conditional access to Microsoft 365 resources based on device compliance. 4. Support for both corporate and BYOD devices.
Which of the following actions should you take FIRST to meet the zero-touch enrollment requirement?
⚠ Common exam trap
Watch out — candidates often confuse post-enrollment configuration steps (like creating groups or compliance policies) with the prerequisite enrollment mechanism, leading candidates to select a step that is necessary but not sufficient for zero-touch deployment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.
Windows Autopilot is the cloud-based zero-touch deployment solution that uses hardware hashes to register devices in Intune, enabling them to automatically enroll and receive configurations without IT intervention. This directly meets the requirement for pre-provisioned Windows 11 devices with no manual touch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a dynamic device group in Microsoft Entra ID that includes all Windows 11 devices.
Why it's wrong here
Dynamic groups target or scope policy after devices exist in Microsoft Entra ID; they cannot enrol or pre-provision a vendor-supplied device. Group creation is correct for assigning policies at scale, but zero-touch requires Windows Autopilot device registration before any grouping matters.
- ✗
Assign Microsoft Intune licenses to all users who will receive the new devices.
Why it's wrong here
Licensing is a prerequisite for any Intune enrolment, but it triggers no provisioning mechanism itself; devices still need Windows Autopilot registration to achieve zero-touch. Assigning licences is the correct step when onboarding users to Intune generally, not when configuring vendor-side pre-provisioning.
- ✓
Register the devices in Windows Autopilot by providing the hardware hash to the Microsoft Intune admin center.
Why this is correct
Windows Autopilot requires each device's hardware hash registered in Intune before deployment, binding the device to the tenant. Uploading hashes establishes this identity, enabling zero-touch provisioning where the vendor ships devices directly to users without IT imaging.
- ✗
Create a compliance policy that requires BitLocker encryption and a minimum OS version.
Why it's wrong here
A compliance policy governs ongoing device health for conditional access; it performs no enrolment or configuration during out-of-box setup. Creating one is correct when defining access requirements, but here the first action must establish Autopilot registration so devices self-provision.
Go deeper
Related to this question
Learn chapter
Deploying Applications with Intune
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Windows 11
Windows 11 is Microsoft's latest desktop operating system, offering a redesigned interface, enhanced security features, and improved support for modern hardware.
About these practice questions
One of 556 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.