MD-102 Protect devices Practice Question
You have a Microsoft 365 subscription that includes Microsoft Intune. You have 100 Windows 11 devices enrolled in Intune. You need to ensure that BitLocker recovery keys are automatically escrowed to Microsoft Entra ID when BitLocker is enabled. What should you configure?
⚠ Common exam trap
The trap here is assuming that a compliance policy or a simple encryption requirement will automatically escrow keys, when escrow requires explicit configuration in the BitLocker settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Endpoint protection profile with 'BitLocker' settings configured to save recovery information to Microsoft Entra ID
The Endpoint protection profile in Intune provides native BitLocker settings, including the option to save recovery information to Microsoft Entra ID. Enabling this setting ensures that when BitLocker is activated, the recovery key is automatically escrowed to Entra ID, allowing administrators to retrieve it if needed. This is the most direct and supported method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An Endpoint protection profile with 'BitLocker' settings configured to save recovery information to Microsoft Entra ID
Why this is correct
In Intune, the Endpoint protection profile includes BitLocker settings where you can specify 'Save BitLocker recovery information to Microsoft Entra ID' and choose to store recovery keys. This directly ensures automatic escrow of recovery keys to Microsoft Entra ID, meeting the requirement without additional scripts.
- ✗
A device configuration profile with the 'Encrypt devices' setting set to 'Require'
Why it's wrong here
This setting enforces BitLocker encryption but does not automatically escrow recovery keys to Microsoft Entra ID. Key escrow requires a separate configuration in the Endpoint protection profile or via the BitLocker CSP. Without escrow, recovery keys are stored locally, which can lead to data loss if the device fails.
- ✗
A compliance policy that requires BitLocker and marks devices without escrowed keys as non-compliant
Why it's wrong here
A compliance policy can check for BitLocker status and even require key escrow, but it does not perform the escrow itself. It only reports compliance. To actually escrow keys, you need a configuration that writes the keys to Entra ID, not just a compliance check.
- ✗
A PowerShell script deployed via Intune that runs 'manage-bde -protectors -adbackup'
Why it's wrong here
This script backs up recovery keys to Active Directory, not Microsoft Entra ID. While it could be modified for Entra ID using other cmdlets, it requires custom scripting and does not leverage built-in Intune settings. It increases administrative effort and may not work reliably for Entra ID-only environments.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Windows 11
Windows 11 is Microsoft's latest desktop operating system, offering a redesigned interface, enhanced security features, and improved support for modern hardware.
Key term
BitLocker
BitLocker is a full-disk encryption feature built into Windows that protects data by encrypting the entire drive so that unauthorized users cannot access files without the correct recovery key.
About these practice questions
Courseiva writes every MD-102 question from scratch — 556 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.