MD-102 Manage applications Practice Question
Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a VPP (Volume Purchase Program) app that is already purchased and assigned to your tenant. What is the minimum configuration required to make the app available to users?
⚠ Common exam trap
MD-102 often tests the distinction between VPP apps and LOB apps — candidates incorrectly select IPA upload because they conflate the two deployment methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sync the VPP token, then add the app from the store and assign it.
For VPP apps in Intune, the minimum requirement is to sync the VPP token so Intune can communicate with Apple's Volume Purchase Program, then add the app from the store and assign it to users or groups. Once the token is synced and the app is assigned, Intune handles license distribution automatically. No IPA upload or configuration policy is required for basic availability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a device enrollment restriction to allow the app.
Why it's wrong here
Enrollment restrictions govern which devices or platforms may enrol, not app licensing or assignment, so they cannot make a VPP app available. Such a restriction is the right control when blocking personally owned iOS devices or specific OS versions from enrolling in Intune.
- ✓
Sync the VPP token, then add the app from the store and assign it.
Why this is correct
The VPP token must be synced so Microsoft Entra ID and Intune can retrieve the purchased licences, then the app is added from the store and assigned to users. This satisfies the minimum configuration needed to make the already-purchased app available.
- ✗
Distribute the app via the Company Portal without any additional configuration.
Why it's wrong here
Company Portal distribution alone cannot deliver a VPP app; Intune requires an Apple VPP token so it can query the tenant's purchased licences and assign them. Company Portal is the delivery surface for apps already targeted to the user, and would suffice for a free App Store app added as a managed app.
- ✗
Upload the app IPA file to Intune, then create an app configuration policy.
Why it's wrong here
Uploading an IPA is the line-of-business app path, which bypasses VPP licensing entirely; VPP apps are synchronised from Apple's catalogue via a token, not uploaded. IPA upload with an app configuration policy is correct for a custom in-house iOS app that is not sold through the Volume Purchase Program.
Go deeper
Related to this question
Learn chapter
Deploying Applications with Intune
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.