MD-102 Prepare infrastructure for devices Practice Question
Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that only devices running iOS 16 or later can enroll. Which configuration should you use?
⚠ Common exam trap
MD-102 often tests the difference between enrollment restrictions (block enrollment) and compliance policies (block access after enrollment) — candidates frequently choose compliance when the scenario says 'can enroll.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.
Enrollment platform restrictions in Intune let you define the minimum and maximum OS versions allowed to enroll for each platform, including iOS/iPadOS. Setting the minimum OS version to 16.0 blocks enrollment of devices running older versions at the enrollment gate. This is the correct control because the requirement is about enrollment eligibility, not ongoing compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a device configuration profile that requires iOS 16.0.
Why it's wrong here
Device configuration profiles apply settings to devices already enrolled; they cannot gate enrolment by OS version. Enrolment restrictions define the minimum OS that may enrol, so a configuration profile cannot block iOS 15 devices from joining. It would be correct for enforcing settings on enrolled devices.
- ✗
Modify the enrollment profile to require iOS 16.0.
Why it's wrong here
Enrolment profiles (Apple) specify enrolment method and settings such as user affinity, not minimum OS version. They cannot reject devices below iOS 16 at enrolment; enrolment restrictions hold that minimum-OS condition. An enrolment profile would be correct for configuring how devices enrol, not which versions may.
- ✗
Create a compliance policy that requires iOS 16.0 or later.
Why it's wrong here
Compliance policies evaluate already-enrolled devices and mark them non-compliant; they do not prevent enrolment. A device running iOS 15 could still enrol, then be flagged, so the requirement fails. A compliance policy would be correct for conditional-access gating of enrolled devices.
- ✓
Create an enrollment platform restriction for iOS/iPadOS and set the minimum OS version to 16.0.
Why this is correct
Enrollment platform restrictions let you block or allow iOS/iPadOS enrolment and specify a minimum OS version, so devices below iOS 16 are refused at enrolment. This satisfies the requirement before device management begins, unlike a compliance policy which only flags non-compliance afterwards.
Go deeper
Related to this question
Learn chapter
Configuring Compliance Policies
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.