MD-102 Prepare infrastructure for devices Practice Question
Your organization uses Microsoft Intune to manage Windows 10 and Windows 11 devices. You need to ensure that only devices running Windows 11 version 23H2 or later can enroll into Intune. You also want to block enrollment for older Windows versions. What should you configure?
⚠ Common exam trap
The trap here is assuming that compliance policies or conditional access can block enrollment, but they only affect access after enrollment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An enrollment restriction for Windows devices.
To block enrollment based on OS version, you configure enrollment restrictions. Specifically, you create a Windows enrollment restriction and set a minimum OS version. Devices running versions below the minimum will be prevented from enrolling. This is a direct control over enrollment eligibility, unlike compliance policies or conditional access which operate after enrollment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A device compliance policy with a minimum OS version rule.
Why it's wrong here
A compliance policy sets conditions for device compliance but does not block enrollment. Devices can enroll regardless of compliance, and non-compliant devices are simply marked as such. It can be used with conditional access to restrict access, but it does not prevent enrollment of older Windows versions.
- ✗
A configuration profile with a Windows edition upgrade policy.
Why it's wrong here
A configuration profile with an edition upgrade policy can upgrade Windows editions (e.g., from Pro to Enterprise) but does not control enrollment eligibility. It cannot block enrollment based on OS version. It is used for post-enrollment management, not for restricting enrollment.
- ✗
A conditional access policy requiring compliant devices.
Why it's wrong here
Conditional access policies control access to resources, not enrollment. While they can require devices to be compliant, they do not prevent a device from enrolling into Intune. A device could enroll, be marked non-compliant, and then be blocked from accessing resources, but enrollment itself is not blocked.
- ✓
An enrollment restriction for Windows devices.
Why this is correct
Enrollment restrictions in Intune allow you to control which devices can enroll. You can configure a platform restriction for Windows that specifies a minimum OS version. Devices that do not meet the minimum version will be blocked from enrolling. This is the correct way to prevent older Windows versions from enrolling.
Go deeper
Related to this question
Learn chapter
Updating Devices with Windows Update for Business
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Windows 10
Windows 10 is a personal computer operating system developed by Microsoft that combines the familiarity of Windows 7 with the modern features of Windows 8, designed to run on a wide range of devices from desktops to tablets.
About these practice questions
This MD-102 question is part of Courseiva's 556-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.