MD-102 Notarization Practice Question
Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires a kernel extension. The app is signed with a Developer ID certificate. The devices are enrolled in Intune and are supervised. You have uploaded the .pkg to Intune and assigned it to a user group. The installation fails on devices with the error 'The app could not be installed because the kernel extension is not approved'. You have already configured a kernel extension profile that allows the specific team identifier. What else is likely missing?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The app is not notarized by Apple.
Starting with macOS 10.14.5, Apple requires all kernel extensions (kexts) to be notarized by Apple. Even if the kernel extension profile allows the team identifier, the app itself must be notarized to install on macOS 10.14.5+ systems. Without notarization, the installation fails with the given error. Option C is incorrect because the 'Allow user to approve kernel extensions' setting is for user approval after installation, not the root cause here. Options A and B are unrelated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System Integrity Protection (SIP) is enabled on the devices.
Why it's wrong here
System Integrity Protection (SIP) protects system files and does not block kernel extension installation based on approval.
- ✗
FileVault is enabled on the devices.
Why it's wrong here
FileVault is full-disk encryption and does not affect kernel extension installation or approval.
- ✗
The kernel extension profile does not include the 'Allow user to approve kernel extensions' setting.
Why it's wrong here
The 'Allow user to approve kernel extensions' setting controls whether users can approve extensions after installation. However, without notarization, the extension is blocked entirely on macOS 10.14.5+.
- ✓
The app is not notarized by Apple.
Why this is correct
The app is not notarized by Apple. Notarization is required for kernel extensions on macOS 10.14.5+ to ensure they are free from known malicious content. This is the missing prerequisite.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
About these practice questions
This MD-102 question is part of Courseiva's 942-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.