MS-102 Practice Question: Manage security and threats by using Microsoft Defender XDR
A company is planning to deploy Microsoft Defender for Endpoint to its Windows 10 devices. The devices are managed by Microsoft Intune. The security team wants to ensure that the MDE sensor is installed automatically on new devices that are enrolled in Intune. Which method should the team use?
⚠ Common exam trap
MS-102 often tests the misconception that Group Policy or Configuration Manager are required for automatic deployment, when in fact Intune's native Endpoint security policies are the recommended method for cloud-managed devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an Endpoint security policy in Intune to deploy MDE.
The correct method is to create an Endpoint security policy in Intune specifically for Microsoft Defender for Endpoint. This policy type allows you to configure the MDE onboarding blob and automatically deploy the MDE sensor to Windows 10 devices enrolled in Intune. It is the native, cloud-based approach that ensures new devices receive the sensor without manual intervention or on-premises infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually install MDE on each device.
Why it's wrong here
Manual installation cannot satisfy automatic onboarding of newly enrolled devices; each device needs an administrator to run the package. It suits small, unmanaged or air-gapped estates. Intune-managed Windows 10 devices should receive the MDE sensor through the built-in Defender for Endpoint connector, which deploys automatically at enrolment.
- ✗
Use Group Policy to deploy the MDE installation package.
Why it's wrong here
Group Policy applies only to domain-joined machines within scope, so Intune-enrolled devices that are not domain members would be missed. It is tempting because Group Policy can push MSI packages. The Intune Defender for Endpoint connector installs the sensor automatically on enrolment, independent of Active Directory.
- ✗
Deploy MDE using Microsoft Configuration Manager.
Why it's wrong here
Configuration Manager only reaches devices it manages, so Intune-enrolled devices outside its site boundaries would not receive the sensor automatically. It is tempting where co-management already exists. The Intune Defender for Endpoint connector deploys the sensor to newly enrolled devices without Configuration Manager involvement.
- ✓
Create an Endpoint security policy in Intune to deploy MDE.
Why this is correct
Creating an Endpoint security policy in Intune deploys the MDE sensor automatically during enrolment, satisfying the requirement that new Windows 10 devices receive it without manual intervention. This built-in connector pushes the onboarding package to Intune-managed devices, unlike configuration profiles or scripts, which need extra packaging and assignment.
Go deeper
Related to this question
Learn chapter
Windows Autopilot Deployment
Key term
Endpoint security policy
An endpoint security policy is a set of rules that controls how devices like laptops, phones, and servers connect to a network and what security protections they must have to keep data safe.
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.