MD-102 Protect devices Practice Question
Your organization uses Microsoft Intune to manage Windows devices. You need to deploy a PowerShell script that runs in the user context during device enrollment. Which two conditions must be met? (Select TWO.)
⚠ Common exam trap
It's easy for candidates to confuse user-context script assignment with device-context assignment, mistakenly thinking device groups can also run scripts in the user context, or they overlook the signing requirement because Intune does not enforce it unless the device's local execution policy demands it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The script must be assigned to the user scope.
PowerShell scripts deployed via Microsoft Intune that run in the user context must be assigned to user groups (user scope). When a script is assigned to users, it executes under the user's security context during enrollment, allowing access to user-specific resources and settings. Assigning to device groups would run the script in the system context, which does not satisfy the requirement for user-context execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The script must be assigned to the user scope.
Why this is correct
User context scripts must be assigned to user groups.
- ✗
The script must be saved as a .psm1 file.
Why it's wrong here
PowerShell scripts should be .ps1, not .psm1 (modules).
- ✗
The script must be assigned to device groups.
Why it's wrong here
User context scripts are assigned to user groups, not device groups.
- ✓
The script must be signed with a trusted certificate.
Why this is correct
If the execution policy requires signing, the script must be signed.
- ✗
The script must be added via a custom OMA-URI policy.
Why it's wrong here
PowerShell scripts are added via 'Scripts' in Intune, not OMA-URI.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Device enrollment
Device enrollment is the process of registering a device with a management system so that it can receive policies, apps, and security settings under organizational control.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.