SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company uses Microsoft Defender for Endpoint (MDE) and needs to ensure that all devices report their security configuration to Microsoft Defender XDR. Which setting should they verify?
⚠ Common exam trap
Test-takers frequently confuse Intune enrollment with Defender for Endpoint onboarding, but Intune only manages policies and compliance, while onboarding is the specific process that enables security telemetry reporting to Defender XDR.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Devices are onboarded to Microsoft Defender XDR
Devices must be onboarded to Microsoft Defender XDR to report their security configuration. Onboarding registers the device with the Defender for Endpoint service, enabling the collection and forwarding of security telemetry to the Microsoft 365 Defender portal. Without onboarding, the device cannot communicate its security state, regardless of other integrations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Devices are enrolled in Microsoft Intune
Why it's wrong here
Intune enrollment provisions devices as mobile-managed objects and enforces compliance/config baselines, but it does not install or activate the Microsoft Defender for Endpoint sensor that reports security telemetry to Microsoft Defender XDR. A device can be fully Intune-managed yet never appear in the Defender XDR device inventory unless separately onboarded to MDE. The presence of an MDM profile says nothing about the state of the endpoint detection and response agent.
- ✗
Microsoft Sentinel is connected to Defender for Endpoint
Why it's wrong here
Connecting Microsoft Sentinel to Defender for Endpoint creates a data pipeline that exports MDE alerts and events into the SIEM for analysis and incident correlation, but it is a downstream consumer rather than the source of the device reports. For Sentinel to receive anything, the endpoint must already be onboarded and reporting to Defender XDR. Thus, a Sentinel connection could exist and still show zero device data if onboarding never occurred, so it cannot be the action that enables device reporting.
- ✗
Microsoft Purview Information Protection is enabled
Why it's wrong here
Microsoft Purview Information Protection handles data classification, sensitivity labels, and protection policies applied to documents and emails; it does not monitor or report endpoint security configurations, device health, or threat telemetry. Its deployment does not affect the Microsoft Defender for Endpoint sensor at all, and a tenant can have full Puff information protection while the device remains invisible to Defender XDR. Therefore, enabling Purview is irrelevant to the requirement that endpoints report to the unified security platform.
- ✓
Devices are onboarded to Microsoft Defender XDR
Why this is correct
Onboarding to Microsoft Defender XDR is the act of enrolling each device with the Defender for Endpoint agent, which then establishes the connection to the XDR backend and begins submitting raw sensor data, process events, network signals, and security alerts. This is the required technical prerequisite for a device to appear in the Defender XDR device inventory and to contribute to the unified incident story. Without onboarding, no other Microsoft service can cause the endpoint to report its security state to the XDR experience.
Go deeper
Related to this question
About these practice questions
One of 605 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.