MD-102 Protect devices Practice Question
Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Intune. You need to create a device group that dynamically includes all devices with a threat level of 'High' from MDE. You then plan to apply a compliance policy to force those devices to be non-compliant. Which method should you use to create the dynamic group?
⚠ Common exam trap
Candidates often assume Intune can directly query MDE threat levels for dynamic groups, but Intune's dynamic groups are limited to enrollment-based rules, while the actual threat tag integration is handled through Microsoft Entra ID's device object and security tags.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a dynamic device group in Microsoft Entra ID using a rule that includes device.securityTags with the tag 'HighThreat'
Microsoft Defender for Endpoint (MDE) automatically tags devices with a 'HighThreat' security tag when they reach a high threat level. You can create a dynamic device group in Microsoft Entra ID using a rule that queries `device.securityTags -contains 'HighThreat'`, which will automatically include any device that receives this tag from MDE. This group can then be targeted with a compliance policy in Intune to mark those devices as non-compliant, enabling automated remediation or conditional access blocking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a security group in Microsoft Entra ID and manually add devices with high threat
Why it's wrong here
Manual management is not dynamic and not recommended.
- ✓
Create a dynamic device group in Microsoft Entra ID using a rule that includes device.securityTags with the tag 'HighThreat'
Why this is correct
Microsoft Defender for Endpoint can tag devices with threat levels, and Entra ID dynamic groups can use these tags.
- ✗
Create a device group in Microsoft Defender for Endpoint and assign it to a compliance policy
Why it's wrong here
MDE machine groups cannot be assigned to Intune compliance policies.
- ✗
Create a dynamic device group in Microsoft Intune using a rule based on threat level
Why it's wrong here
Intune does not support dynamic groups based on MDE threat level.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Compliance policy
A compliance policy is a set of rules that ensures devices, users, and applications meet an organization's security and regulatory requirements before they can access corporate resources.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
Courseiva writes every MD-102 question from scratch — 942 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.