Quick Answer
The answer is a domain join profile, an enrollment status page profile, and a Hybrid Azure AD Join Autopilot profile. The domain join profile is the critical component because it supplies the on-premises Active Directory domain name and organizational unit details, enabling the device to complete the domain join step during provisioning—without it, the hybrid identity state cannot be established. The enrollment status page profile ensures the device waits for required apps and policies before the user gains desktop access, while the Hybrid Azure AD Join Autopilot profile itself ties the device to your tenant. On the MD-102 exam, this question tests your understanding of the three distinct profiles required for hybrid join, often tripping candidates who forget the domain join profile or confuse it with a simple device configuration profile. A common trap is assuming a connectivity checker or network profile is required, but those are prerequisites, not components. Memory tip: think “D-E-H” for Domain, Enrollment status page, and Hybrid profile—the three pillars of hybrid Autopilot.
This MD-102 practice question tests your understanding of prepare infrastructure for devices. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your organization uses Microsoft Intune and you need to configure Windows Autopilot for hybrid Microsoft Entra ID join. Which THREE components are required?
A domain join profile (configured in Intune).
Specifies on-premises AD domain for hybrid join.
A device compliance policy.
Why wrong: Not required for initial deployment.
An Autopilot deployment profile.
Defines the deployment experience.
An MDM push certificate.
Why wrong: Not required for Windows Autopilot.
An enrollment status page profile.
Shows progress during provisioning.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
A domain join profile (configured in Intune).
A domain join profile is required for hybrid Microsoft Entra ID join because it provides the on-premises Active Directory domain information that the device needs during Autopilot provisioning. Without this profile, the device cannot complete the domain join step, which is essential for establishing the hybrid identity state.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
A domain join profile (configured in Intune).
Why this is correct
Specifies on-premises AD domain for hybrid join.
Related concept
Read the scenario before looking for a memorised answer.
A device compliance policy.
Why it's wrong here
Not required for initial deployment.
An Autopilot deployment profile.
Why this is correct
Defines the deployment experience.
Related concept
Read the scenario before looking for a memorised answer.
An MDM push certificate.
Why it's wrong here
Not required for Windows Autopilot.
An enrollment status page profile.
Why this is correct
Shows progress during provisioning.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
The trap here is that candidates often confuse the requirement for a device compliance policy with the need for a domain join profile, not realizing that compliance policies are applied after enrollment and are not prerequisites for the Autopilot hybrid join process.
Detailed technical explanation
Hybrid Microsoft Entra ID join via Autopilot requires the device to first be registered in Microsoft Entra ID and then joined to an on-premises AD domain. The domain join profile specifies the on-premises domain name and optional organizational unit, and the Autopilot deployment profile defines the enrollment and user experience settings. The Enrollment Status Page (ESP) profile is optional but commonly used to block user access until required apps and policies are installed, ensuring a consistent provisioning state.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Prepare infrastructure for devices — study guide chapter
Learn the concepts, then practise the questions
Prepare infrastructure for devices practice questions
Targeted practice on this topic area only
All MD-102 questions
991 questions across all exam domains
Microsoft 365 Endpoint Administrator MD-102 study guide
Full concept coverage aligned to exam objectives
MD-102 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise MD-102 questions linked to Prepare infrastructure for devices.
Practise MD-102 questions linked to Manage and maintain devices.
Practise MD-102 questions linked to Manage applications.
Practise MD-102 questions linked to Protect devices.
Practise MD-102 questions linked to Deploy Windows client.
Practise MD-102 questions linked to Manage identity and compliance.
Practise MD-102 questions linked to Manage, maintain, and protect devices.
Practise MD-102 questions linked to MD-102 fundamentals.
Practise MD-102 questions linked to MD-102 scenario.
Practise MD-102 questions linked to MD-102 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Prepare infrastructure for devices — This question tests Prepare infrastructure for devices — Read the scenario before looking for a memorised answer..
The correct answer is: A domain join profile (configured in Intune). — A domain join profile is required for hybrid Microsoft Entra ID join because it provides the on-premises Active Directory domain information that the device needs during Autopilot provisioning. Without this profile, the device cannot complete the domain join step, which is essential for establishing the hybrid identity state.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.