MS-900 Describe Microsoft 365 apps and services Practice Question
An IT administrator needs to ensure that all company-issued Windows 11 devices are configured with the latest security policies and that applications are deployed automatically. Which Microsoft 365 service should they use?
⚠ Common exam trap
Many candidates confuse Microsoft Entra ID (identity management) with device management, assuming it can enforce device policies, when in fact Entra ID only provides conditional access policies that rely on Intune compliance data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Intune
Microsoft Intune is the correct choice because it is a cloud-based endpoint management solution that provides mobile device management (MDM) and mobile application management (MAM). It allows IT administrators to enforce security policies (e.g., BitLocker, Windows Defender Firewall, compliance rules) and automate application deployment to Windows 11 devices without requiring on-premises infrastructure. Intune integrates with Microsoft Entra ID for identity-based conditional access but is the primary service for device configuration and app deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Intune
Why this is correct
Microsoft Intune is the correct service—it is a cloud-based endpoint management solution that uses the Windows 10/11 MDM enrollment channel and configuration service providers (CSPs) to enforce device configuration policies, deploy applications via Intune Managed Apps or Company Portal, and assess compliance. This directly satisfies the requirement for consistent configuration of all company-issued Windows 11 devices.
- ✗
Microsoft Microsoft Entra ID
Why it's wrong here
Microsoft Entra ID (formerly Azure AD) is an identity and access management (IAM) service that provides authentication, single sign-on, and conditional access policies. While conditional access can evaluate device compliance or device trust state, Entra ID itself does not push OS configuration settings (e.g., BitLocker, Windows Update policies) or deploy software to endpoints, so it cannot fulfill the device configuration requirement.
- ✗
Microsoft Defender for Endpoint
Why it's wrong here
Microsoft Defender for Endpoint is a security operations solution focused on endpoint detection and response (EDR), antivirus, threat hunting, and vulnerability management. It can apply security configuration baseline settings or block malicious files, but it does not provide general Windows 11 policy management—such as configuring user profile settings, sideloading line-of-business apps, or managing Wi-Fi certificates—so it is not the right tool for comprehensive device configuration.
- ✗
Microsoft 365 Apps for enterprise
Why it's wrong here
Microsoft 365 Apps for enterprise is a licensing and subscription offering that delivers the Office productivity suite (e.g., Word, Excel, Outlook, Teams) and provides update management through the Office Deployment Tool. It does not include an endpoint management plane for enforcing Windows configuration policies across devices, nor does it deploy non-Office applications or manage device security settings; therefore it is unrelated to the requirement.
Go deeper
Related to this question
Learn chapter
Microsoft Teams Rooms and Meeting Devices
Key term
MDM
MDM stands for Mobile Device Management, a technology that allows IT administrators to securely manage, monitor, and enforce policies on mobile devices like smartphones and tablets from a central console.
Key term
Mobile device management
Mobile device management (MDM) is a security solution that allows IT administrators to enroll, configure, monitor, and enforce policies on smartphones, tablets, and other mobile devices used in an organization.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.