Microsoft Certification
57 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Microsoft Endpoint Administrator (MD-102) certification validates professional expertise in Microsoft technologies. This study guide covers all 57 practice questions from our MD-102 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You need to configure Windows Update for Business settings across multiple devices in your organization. Which feature allows you to defer feature and quality updates for specific periods?
Update rings in Intune allow administrators to define deployment schedules and deferral periods for Windows updates across groups of devices. This is the primary Intune mechanism for managing Windows Update for Business.
A user's device fails to enroll in Intune. You check the enrollment restrictions and find that the device ownership type is blocked. What enrollment restriction setting controls which device ownership types can enroll?
Device ownership restrictions determine whether personally owned devices (BYOD) or corporate-owned devices can enroll in Intune. This is a key enrollment policy setting.
You want to ensure that corporate devices cannot be used for personal purposes. Which compliance policy setting should you configure to verify that the device is registered as a corporate-owned device?
The device ownership requirement compliance setting allows you to enforce that only devices marked as corporate-owned can remain compliant with your organization's policies.
Your organization requires strong password policies on all managed devices. You create a device compliance policy requiring passwords of at least 8 characters with complexity requirements. What happens to a device that fails this compliance check?
When a device fails compliance, it is marked as noncompliant and Azure AD conditional access policies determine what actions occur (such as blocking access to corporate resources). Automatic actions like wiping require explicit configuration.
You are configuring mobile application management (MAM) for iOS devices that are not enrolled in Intune. Which authentication method should users employ to establish the initial MAM policy?
For unenrolled iOS devices, users authenticate through the Company Portal or Microsoft Authenticator app, which enables MAM policies to be applied without full device enrollment.
An administrator wants to restrict which cloud storage services employees can use on their managed devices. Which Intune policy type is best suited for this requirement?
Application protection policies (MAM) can restrict data movement to unmanaged cloud storage services, controlling where corporate data can be saved or shared from managed apps.
You need to deploy certificates to devices for authentication purposes. Which Intune profile type should you use to distribute trusted root and intermediate certificates?
Trusted certificate profiles distribute root and intermediate CA certificates to devices to establish certificate chains for authentication and secure communications.
Your organization uses a hybrid Azure AD joined environment. When a user attempts to reset their password using Windows, which service must be available for the password reset to succeed?
In hybrid Azure AD joined scenarios, Windows Password Reset requires communication with both Azure AD for verification and on-premises domain controllers to update the password.
You want to prevent users from installing applications from the Microsoft Store on corporate Windows 11 devices. Which configuration method is most appropriate?
AppLocker can be configured through device configuration profiles to restrict or block the Microsoft Store application and control software installation on Windows devices.
A device is marked as noncompliant due to a missing security update. The user contacts support and confirms they have applied the update. What should the endpoint administrator check first to resolve the compliance status?
Devices must sync with Intune to report their current status. Forcing a sync will trigger a fresh compliance evaluation reflecting the applied security update.
Your organization requires that all corporate data on personal devices be wiped if the device is no longer managed. Which MAM policy setting enables this capability?
The 'Wipe corporate data when device unenrolls' setting in app protection policies ensures that managed corporate data is removed if the device is no longer under management.
You are configuring Autopilot for a large group of devices. The organization needs devices to join Azure AD but does NOT want to join on-premises Active Directory. Which Autopilot mode should you select?
User-driven mode with Azure AD join allows devices to enroll directly into Azure AD without requiring on-premises Active Directory domain join during Autopilot.
An administrator creates a device configuration profile with settings for password requirements. After assigning it to 100 devices, only 50 devices report compliance. What is the most likely reason?
Devices require time to sync with Intune, and policy conflicts or incompatibilities may prevent some devices from adopting the configuration. Checking device sync status and policy conflicts would diagnose the issue.
You need to configure a VPN connection that uses certificate-based authentication. Which Intune profile type should you deploy?
A VPN profile combined with a SCEP certificate profile enables certificate-based authentication for VPN connections, with the certificate automatically deployed and renewed.
Your organization wants to allow personal device usage while protecting corporate data. Users will access corporate resources through the Company Portal and managed apps. Which approach best describes this scenario?
MAM without device enrollment allows corporate data protection through managed apps on personal devices without managing the entire device, which is ideal for BYOD scenarios.
You deploy a configuration profile that blocks the use of external USB drives on Windows devices. A few users report that their USB drives still function. What is a likely cause?
Policy conflicts or incompatible hardware drivers can prevent device restriction policies from applying correctly. Device conflict reports and policy evaluation logs would reveal the root cause.
An administrator configures a compliance policy requiring encrypted storage. A Windows device reports as compliant even though encryption is disabled. What should the administrator verify first?
Compliance evaluation relies on accurate device reporting. The administrator should verify that BitLocker is actually enabled and reporting its status correctly to Intune's compliance engine.
You want to deploy Microsoft Edge with specific security settings to all managed devices. What is the most efficient method to configure Edge settings at scale?
Intune app configuration policies allow you to deploy and manage Edge settings at scale across all managed devices, including cloud-only and hybrid scenarios.
A user's corporate-owned Windows device is lost. What is the first action an endpoint administrator should take to protect company data?
Immediately issuing a remote wipe command through Intune removes corporate data from the lost device before it can be accessed by an unauthorized user.
Your organization implements conditional access policies that require device compliance for accessing Microsoft 365. A compliant device suddenly loses access. What is the most probable cause?
If a previously compliant device misses check-ins or fails a compliance evaluation, it becomes noncompliant and the conditional access policy blocks access to Microsoft 365 resources.
An administrator needs to ensure that sensitive corporate documents are watermarked when opened on any device. Which solution best addresses this requirement?
Azure Information Protection labels with visual markings (watermarks) can be configured to automatically watermark sensitive documents when opened, regardless of device type.
You are configuring Windows Autopilot for hybrid Azure AD join in a corporate environment. Which service role must be configured on-premises to support the domain join during Autopilot?
Azure AD Connect must be properly configured to synchronize identity data and support authentication during the hybrid join process in Autopilot scenarios.
A compliance policy requires that devices have antivirus software from a specific vendor installed. What type of compliance rule should be configured?
System security settings in compliance policies allow verification that specific security software (such as particular antivirus vendors) is installed and functioning.
You need to enroll Windows 10 devices into Microsoft Intune. Which enrollment method is most appropriate for BYOD (Bring Your Own Device) scenarios?
Self-enrollment through Company Portal is the standard method for BYOD scenarios as it allows users to enroll their personal devices without IT intervention. Windows Autopilot and Azure AD join are typically used for corporate devices.
What is the primary purpose of Windows Autopilot in endpoint management?
Windows Autopilot simplifies device deployment by allowing pre-configured devices to be shipped directly to users, who then follow a guided setup process. The device is automatically enrolled and configured according to organizational policies.
You are configuring Conditional Access policies in Azure AD for Intune-enrolled devices. Which condition would require a device to be marked as compliant before allowing access to company resources?
The 'Device state' condition in Conditional Access allows administrators to require devices to be marked as compliant according to defined compliance policies. This ensures only devices meeting security standards can access resources.
A user's Windows 10 device fails a compliance check because the antivirus definition file is outdated. What is the primary remediation action that Intune can take automatically?
When a device fails compliance, Intune marks it as non-compliant, which triggers Conditional Access policies to block access. Users receive notifications to remediate the issue. Device wipe is a more severe action applied in specific scenarios, not automatically.
You need to deploy a line-of-business (LOB) application to 500 managed devices using Intune. The application requires administrative privileges to install. Which deployment method is most suitable?
Device-context (system-context) deployment allows applications to be installed with administrative privileges on managed devices. This is ideal for LOB applications requiring elevated permissions that users cannot install themselves.
What is the primary benefit of using Mobile Application Management (MAM) without Mobile Device Management (MDM)?
MAM-only policies protect corporate data at the application level without requiring device enrollment, making it ideal for BYOD scenarios where IT doesn't manage the entire device. Users can still use personal apps and settings.
You are implementing device compliance policies for iOS devices. Which setting would prevent users from jailbroken devices from accessing company email through Outlook?
The jailbreak detection setting in iOS compliance policies specifically identifies compromised devices and marks them as non-compliant. Combined with Conditional Access, this blocks access to company resources like email.
A department requires a VPN connection to be active before users can access internal applications on their Windows 10 devices. How should this be configured in Intune?
A VPN profile deployment combined with device configuration ensures the VPN is installed and configured. To enforce it before access, configure it at the network level in device configuration or use compliance policies that check for active VPN status.
Which role in Intune has the minimum permissions required to enroll devices and assign applications but cannot modify compliance policies or conditional access?
The Application Manager role is limited to application assignment and management. It does not include permissions for compliance policies, conditional access, or device enrollment configurations.
You need to configure BitLocker encryption for Windows 10 devices in your organization. What is the recommended approach using Intune?
A device configuration profile allows centralized deployment of BitLocker settings to Windows 10 devices in Intune, ensuring consistent encryption across the organization regardless of domain join status.
An organization wants to allow users to access cloud apps from non-compliant devices but log and monitor such access for security auditing. Which Conditional Access control is most appropriate?
Session controls in Conditional Access allow monitoring and logging of access from non-compliant devices while permitting the connection. Multi-factor authentication adds an additional security layer without blocking access entirely.
What is the primary function of the Intune admin center's 'Devices' section?
The Devices section in Intune admin center provides visibility into enrolled devices and enables administrators to manage them through policy assignment, remote actions, and monitoring of compliance status.
You want to ensure that only devices with encryption enabled can access SharePoint Online. Which combination of technologies should be used?
A device compliance policy that requires encryption, combined with a Conditional Access policy that blocks non-compliant devices, ensures only encrypted devices can access SharePoint Online.
An employee uses multiple devices (Windows PC, iPhone, and iPad) for work. What is the most efficient way to ensure all devices receive the same security policies?
Assigning policies to user groups ensures all devices owned by a user receive applicable policies automatically, regardless of platform. Intune then applies platform-specific policies as needed for each device type.
You are troubleshooting why a compliance policy is not applying to a Windows 10 device. What is the first diagnostic step you should take?
The first diagnostic step is verifying that the policy is correctly assigned to the user or device group and checking the device's reported compliance status. This identifies whether the policy is reaching the device or if there are assignment issues.
Which statement best describes the relationship between Azure AD and Intune in Microsoft endpoint management?
Azure AD serves as the identity backbone for Intune, providing user and device identities. Intune leverages this identity information to manage policies, compliance, and conditional access decisions.
You need to restrict personal app store installations on iOS devices while allowing access to managed apps. Which Intune policy type should be used?
An iOS device configuration profile allows granular control over app store access and installation permissions. It can restrict personal app store while allowing management of enrolled apps through Intune.
An organization has hybrid Azure AD-joined devices. What is the primary advantage of configuring co-management with Configuration Manager and Intune?
Co-management allows organizations to manage devices through both Configuration Manager and Intune simultaneously, enabling a gradual transition to cloud management while maintaining existing on-premises Group Policy controls.
A user reports that they cannot install a required company application from the Company Portal. What is the most likely reason if their device is compliant and they have the correct group assignment?
Common installation failures occur when devices lack sufficient storage, have an OS version below the application's minimum requirement, or lack necessary prerequisites. Checking device compatibility and available storage should be the first troubleshooting step.
You are configuring a password policy for Windows 10 devices. The policy requires passwords to contain uppercase, lowercase, numbers, and symbols with a minimum length of 14 characters. After deployment, some devices report non-compliance. What could explain this?
Password policies typically apply at the next password change or credential refresh. Devices with cached credentials may show non-compliance until users update their passwords. This is expected behavior during policy rollout.
Which Windows 10 feature allows IT administrators to monitor and remotely manage devices without full enrollment in Intune?
Microsoft Defender for Endpoint (MDE) allows organizations to monitor devices for threats and manage security endpoints without requiring full Intune enrollment, though integration with Intune enhances capabilities.
An organization wants to deploy a custom configuration to only devices owned by the Finance department. What is the correct approach in Intune?
Dynamic device groups automatically populate based on Azure AD attributes such as department. Assigning policies to these groups ensures scalability and automatic updates when devices move between departments.
You need to implement certificate-based authentication for VPN access on managed devices. What is the recommended configuration sequence in Intune?
Intune allows automated deployment of SCEP or PKCS certificates to devices, which can then be referenced in VPN profiles. This ensures certificate-based authentication is configured consistently without manual intervention.
What does the 'Intune data warehouse' provide for endpoint administrators?
The Intune data warehouse collects and stores historical data, allowing administrators to create custom reports and analytics on device compliance, inventory, and policy effectiveness over time.
You need to configure Windows Update for Business settings in Intune to ensure devices receive updates on a specific schedule. Which setting controls the deferral period for quality updates?
The 'Quality update deferral (days)' setting in Windows Update for Business allows you to specify how many days to defer quality updates after their release date.
Your organization requires conditional access policies to block access to Microsoft 365 from non-compliant devices. Which Azure AD conditional access component evaluates device compliance status?
The 'Require device to be marked as compliant' grant control in conditional access policies evaluates whether the device meets organizational compliance requirements before allowing access.
You are deploying Microsoft 365 Apps using Intune. Which deployment method allows you to target specific user groups with phased rollout capabilities?
Microsoft 365 Apps for enterprise can be deployed through Intune with support for targeted group assignments and phased rollout configurations.
An organization needs to ensure that BitLocker recovery keys are securely stored and accessible for administrators. Where should BitLocker recovery keys be backed up in an Intune-managed environment?
BitLocker recovery keys should be backed up to Azure AD (or Azure Information Protection) to ensure secure storage and administrator accessibility for Intune-managed devices.
You configure a device compliance policy in Intune that requires all Windows 10 devices to have Defender antimalware enabled. Which action occurs when a device fails to meet this requirement?
When a device fails a compliance policy requirement, it is marked as non-compliant, which can then trigger conditional access policies to restrict access to company resources.
Your organization uses hybrid Azure AD joined devices. Which PowerShell module should you use to manage these devices in Intune?
The Microsoft.Graph.Intune PowerShell module provides cmdlets to manage Intune resources including hybrid Azure AD joined devices through the Microsoft Graph API.
You need to deploy a custom line-of-business application to Windows devices using Intune. The application requires administrative privileges to install. Which app type should you use?
Win32 apps in Intune support deployment of traditional Windows applications that require administrative privileges and can be packaged using the Intune Win32 Content Prep Tool.
Your organization implements a data loss prevention (DLP) policy that restricts copying data from Microsoft 365 apps to personal cloud storage. Which Intune feature enables this control?
Intune app protection policies allow you to implement DLP controls such as preventing data transfer to unmanaged apps and personal cloud storage accounts without requiring device enrollment.
You are configuring automatic enrollment for Windows 10 devices in Azure AD. Which prerequisite must be configured in Azure AD to enable MDM auto-enrollment?
To enable automatic MDM enrollment, you must configure the MDM user scope setting in Azure AD and ensure users have appropriate Intune or Microsoft 365 licenses.
An organization needs to restrict which USB devices can connect to corporate Windows devices. Which Intune feature should you use to implement this control?
Device Control settings within Intune device configuration profiles allow administrators to manage which USB and external storage devices can connect to Windows endpoints, enabling granular hardware access controls.
You've reviewed all 57 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free