MD-102 Protect devices Practice Question
You need to enroll a Windows 11 device into Microsoft Intune using a work or school account. The device is already joined to Microsoft Entra ID. What is the simplest enrollment method?
⚠ Common exam trap
MD-102 often tests the distinction between Autopilot (provisioning new devices) and automatic enrollment (enrolling existing Entra-joined devices), causing candidates to pick Autopilot for any enrollment scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automatic enrollment via Microsoft Entra join
When a Windows 11 device is already Microsoft Entra joined, the simplest enrollment path is automatic MDM enrollment via the Entra join process. During the Entra join, if the user's license includes Intune and the MDM user scope is configured in the Entra ID Mobility settings, the device is automatically enrolled into Intune without any additional user action. This is the least-effort method because it requires no additional configuration on the device itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Windows Autopilot
Why it's wrong here
Autopilot provisions and configures devices during OOBE, requiring hardware hash registration and a reset or new device; it does not enrol an already Entra-joined, in-use device without reprovisioning. It suits large-scale deployment of new hardware, not the simplest path for an existing joined device.
- ✗
Group Policy to configure enrollment
Why it's wrong here
Group Policy configures automatic MDM enrolment for domain-joined devices via a GPO setting, requiring Active Directory domain membership and policy refresh. The device is Entra-joined, not domain-joined, so the GPO path does not apply. Group Policy suits hybrid AD environments with on-premises infrastructure.
- ✗
Manual enrollment using the Company Portal
Why it's wrong here
Manual Company Portal enrolment requires the user to sign in and add the work account, but the device is already Entra-joined, so automatic MDM enrolment triggers on that join without user action. Company Portal suits personally owned or unenrolled devices where the user initiates enrolment themselves.
- ✓
Automatic enrollment via Microsoft Entra join
Why this is correct
Microsoft Entra join with automatic MDM enrolment configured in Intune silently enrols the device using the signed-in work or school account, requiring no user action. This is the simplest method for the already-joined Windows 11 device in the stem.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.