MD-102 Practice Questions

The policy is configured for Unmanaged devices. This refers to devices not enrolled in Intune Mobile Device Management (MDM), a scenario often called Mobile Application Management without enrollment (MAM-WE). For app protection policies to be applied on unenrolled Android devices, the Intune Company Portal app must be installed. It acts as a required "broker app" to mediate the communication between the protected applications and the Intune service, thereby enforcing the policy. Intune App Protection Policies (APP) are fundamentally user-centric. They are always assigned to user groups, not device groups. The policy's purpose is to protect an organization's data within an application for a specific user's account. While the policy contains conditions based on device state (e.g., "Unmanaged"), the assignment itself targets users. Therefore, the policy applies to users only.

Microsoft Learn (Official Documentation): Prerequisites for app protection policies. This

document states, "For Android devices, the Intune Company Portal app is required for App

Protection Policies."

URL: https://learn.microsoft.com/en-us/mem/intune/apps/app-protectionpolicy#prerequisites

Microsoft Learn (Official Documentation): How to create and assign app protection policies.

The section "Assign the policy" demonstrates that policies are assigned by including or

excluding Azure AD user groups. It explicitly states, "App protection policies can be

assigned to user groups only, not device groups."

URL: https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policiescreate#assign-the-policy

In Microsoft Intune, compliance policy settings for iOS/iPadOS are grouped into categories. The Device Health category includes settings to verify the integrity of the operating system, such as the "Jailbroken devices" check. This setting is used to mark devices as noncompliant if they have been jailbroken. The System Security category contains settings related to securing the device at the system level. This includes password requirements, such as "Require a password to unlock mobile devices," which ensures that a device is marked as noncompliant if it does not have a passcode set.

1. Microsoft Learn | iOS/iPadOS compliance settings in Microsoft Intune: This official

documentation details the available compliance settings.

Device Health: The "Jailbroken devices" setting is listed under this section. It states, "When

enabled, evaluate devices for jailbreak status. When a device is jailbroken, it's marked as

not-compliant."

URL: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-createios#device-health

System Security: The "Require a password to unlock mobile devices" setting is listed under

this section. It states, "When set to Require, users must enter a password before they can

access their device."

URL: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-createios#system-security

Windows subscription activation is a feature that upgrades a device from Windows Pro to Windows Enterprise when a licensed user signs in. For this to occur, the device must meet two primary requirements: it must be running a qualifying base OS (Windows Pro), and it must be either Azure AD joined or Hybrid Azure AD joined.

Device1 (Windows 10 Pro, Azure AD joined) and Device3 (Windows 10 Pro, Hybrid Azure AD joined) both meet these criteria. Device2 is already running Windows Enterprise, so it does not require a step-up activation. Device4 is ineligible because it runs Windows 10 Home (not a qualifying OS) and is Azure AD registered (not joined).

A. This option is incorrect because Device3 also meets all the necessary requirements for subscription activation.

B. This option is incorrect because Device2 is already running Windows Enterprise and does not need to be upgraded.

D. This option is incorrect because Device2 is already Enterprise, and Device4 is ineligible due to its OS edition and join type.

1. Microsoft Learn. (2023). Windows subscription activation. "Requirements" section. Retrieved from https://learn.microsoft.com/en-us/windows/deployment/windows-subscription-activation#requirements. This document explicitly states that a supported version of Windows Pro is required and that devices must be Azure AD-joined or Hybrid Azure AD-joined.

2. Microsoft Learn. (2023). Deploy Windows Enterprise licenses. "Subscription Activation" section. Retrieved from https://learn.microsoft.com/en-us/windows/deployment/deploy-enterprise-licenses#subscription-activation. This source confirms that Subscription Activation is a method to "step-up" from Pro to Enterprise

which implies a device already running Enterprise (like Device2) is not a candidate for this process. It also reiterates the Azure AD join requirement.

In a Microsoft Intune compliance policy for Windows, the Device Properties settings are used to define rules based on the device's operating system attributes. This is the correct location to configure the minimum and maximum OS versions required for a device to be marked as compliant. The System Security section is used to configure fundamental security settings for the device. This includes policies for passwords, antivirus, firewall, and the requirement for data storage encryption. The setting "Require encryption of data storage on device" within this section specifically enforces that BitLocker is enabled on the device's drives. Incorrect Options Explained: Device Health: This policy section uses the Windows Health Attestation service to verify the integrity of the device during boot. While it can report on the status of features like Secure Boot and BitLocker, the primary setting to mandate encryption as a compliance rule is located under System Security. Microsoft Defender for Endpoint: This setting is used to integrate Intune with Microsoft Defender for Endpoint. It sets compliance based on the device's risk score as determined by Defender, rather than configuring specific OS features like BitLocker or version numbers.

Microsoft Learn: Windows 10/11 compliance settings in Microsoft Intune.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-createwindows

Reference for Device Properties: In the "Device Properties" section, the documentation lists

"Minimum OS version" and "Maximum OS version" as configurable settings.

Reference for System Security: In the "System Security" section, under the "Encryption"

subsection, the setting "Require encryption of data storage on device" is detailed. The

description states: "When set to Require, the device must have storage encryption enabled

(BitLocker)."

Reference for Device Health & Defender for Endpoint: The same document details the

functions of "Device Health" (Windows Health Attestation) and "Microsoft Defender for

Endpoint" (risk score), confirming they are not the primary settings for the requirements in

the question.

The assignment of roles adheres to the principle of least privilege by granting each user only the permissions necessary to perform their specified tasks. User1: User Administrator The User Administrator role is the correct choice for User1. This role grants permissions to create and manage users and all types of groups. It also includes the ability to reset user passwords. This fits User1's requirements to "create groups and manage users" without granting the excessive permissions of a Global Administrator. User2: Helpdesk Administrator The Helpdesk Administrator role is the most appropriate, least-privileged role for User2. This role is specifically designed for tasks like resetting passwords for non-administrative users and some limited administrator roles. Assigning this role ensures User2 can perform their required function without having unnecessary user or group management capabilities. Incorrect Options: Global Administrator: This is the highest-level administrative role with permissions to manage all settings and services across Microsoft 365. Assigning this role to either user would be a significant violation of the principle of least privilege, as their tasks are much more limited. Security Administrator: This role is focused on managing security features, reading security reports, and handling security configurations. It does not include the general permissions required to create users/groups or reset passwords for standard users, making it unsuitable for either User1 or User2.

Microsoft Entra built-in roles | Microsoft Learn: This document provides detailed descriptions

of all Microsoft Entra (formerly Azure AD) built-in roles.

User Administrator: Under the "User Administrator" section, it states, "Users with this role

can create users and manage all aspects of users... Additionally, this role includes the ability

to create and manage all groups."

Helpdesk Administrator: The "Helpdesk Administrator" section states, "Users with this role

can change passwords, invalidate refresh tokens, manage service requests, and monitor

service health. Invalidating a refresh token forces a user to sign in again." The permissions

are scoped to non-administrators.

URL: https://learn.microsoft.com/en-us/entra/identity/role-based-accesscontrol/permissions-reference

About Microsoft 365 admin roles | Microsoft 365 admin center: This page offers a user-

friendly overview of the most common admin roles in Microsoft 365.

User administrator: The description notes this role "Creates and manages users and

groups, and resets passwords for users, Helpdesk administrators, and User administrators."

Helpdesk administrator: It specifies that this role "Resets passwords, manages service

requests, and monitors service health. Helpdesk admins can only help non-admin users..."

URL: https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles

The deployment profile for the Windows 11, version 22H2 feature update is assigned to Group2 (the included group) but is blocked for devices in Group1 and Group3 (the excluded groups). In Microsoft Intune, an exclusion will always override an inclusion. Device1: This device is a member of the included Group2 because its operating system is "Windows." However, it is also a member of the excluded Group3 because its extensionAttribute1 is set to "Test." Since exclusions take precedence, Device1 will not be upgraded. Device2: This device is a member of the included Group2 as its OS is "Windows." It is not a member of the excluded Group1 (by assignment) or the excluded Group3 (its extensionAttribute1 is not "Test"). Therefore, Device2 will be upgraded. Device3: This device is a member of the included Group2 because its OS is "Windows." It is also an assigned member of the excluded Group1. Because exclusions override inclusions, Device3 will not be upgraded.

Microsoft Intune Documentation - Assign device profiles: This document explicitly states

that assignments to excluded groups override assignments to included groups. "If a device

is in two groups, one group that's assigned to an exclusion and another group that's

assigned for inclusion, the device is excluded and doesn't receive the policy."

Source: Microsoft Learn, "Assign user and device profiles in Microsoft Intune,"

section: Include and exclude groups.

URL: https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-assign#includeand-exclude-groups

Azure AD Documentation - Dynamic membership rules: This resource explains the syntax

for creating dynamic membership rules for groups, which is used here for Group2 and

Group3.

Source: Microsoft Learn, "Dynamic membership rules for groups in Azure Active

Directory."

URL: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamicmembership

When an administrator adds an application to Microsoft Intune, they configure the app's metadata on the "App information" page. According to official Microsoft documentation, the values entered for Information URL and Privacy URL are explicitly designed to be visible to end-users in the Company Portal. These URLs provide users with direct links to more details about the application and its privacy policy, respectively, enhancing transparency and user trust. The other fields listed are primarily for administrative tracking or are not guaranteed to be displayed.

C. Developer: The "Developer" field is an optional metadata tag. While it contains user-relevant information, its display in the Company Portal is not explicitly guaranteed, unlike the URL fields. The "Publisher" field is more consistently displayed.

D. Owner: The "Owner" field is intended for internal administrative purposes within Intune, allowing IT to categorize apps by department or responsible party (e.g., "HR Department"). This information is not shown to end-users.

1. Microsoft Learn. (2024). Add apps to Microsoft Intune. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/mem/intune/apps/apps-add.

Reference Location: In the "App information" section

the table of "Common app properties" explicitly states for both Information URL and Privacy URL: "The URL is visible to users in the Company Portal." For the Owner property

the description implies internal use ("For example

HR department") with no mention of user visibility.

2. Microsoft Learn. (2024). Add Microsoft Store apps to Microsoft Intune. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/mem/intune/apps/store-apps-microsoft.

Reference Location: Under the "Step 2: Configure app information" section

the descriptions for Information URL and Privacy URL confirm they are visible to users. The descriptions for Developer and Owner do not include this confirmation.

For deploying custom line-of-business (LOB) applications to iOS/iPadOS devices using Microsoft Intune, the app package file must be in the .ipa format. This is the standard application archive file format used by Apple's iOS. Before uploading to Intune, the .ipa file must be signed with an in-house certificate or a provisioning profile from the Apple Developer Program. Intune uses this file to distribute and install the application on enrolled devices.

A. .intunemac: This file extension is used for deploying line-of-business apps to macOS devices, not iOS devices.

C. .apk: This is the Android Package Kit file format used for distributing and installing applications on Android devices.

D. .appx: This file format (along with .msix, .appxbundle, .msixbundle) is used for deploying applications to Windows devices.

1. Microsoft Learn. (2024). Add an iOS/iPadOS line-of-business app to Microsoft Intune.

Section: Select the app package file

Quote: "In the Add app pane

click Select file. In the App package file pane

select the browse button. Then

select an iOS/iPadOS installation file with the extension .ipa."

URL: https://learn.microsoft.com/en-us/mem/intune/apps/lob-apps-ios

2. Microsoft Learn. (2024). App types in Microsoft Intune.

Section: Line-of-business (LOB) apps

Content: This document provides a table that outlines the supported LOB app file types for each platform. It explicitly lists .ipa for iOS/iPadOS

.apk for Android

.appx (and others) for Windows

and .intunemac for macOS

confirming the distinct usage for each file extension.

URL: https://learn.microsoft.com/en-us/mem/intune/apps/apps-add#line-of-business-lob-apps

To migrate Group Policy Object (GPO) settings for Microsoft Office to Microsoft Intune, the administrator must first replicate these settings within an Intune configuration profile. The process begins in the Microsoft Intune admin center by creating a configuration profile. This profile acts as a container for the settings. For GPO-like settings, the administrator would typically choose the "Administrative Templates" or "Settings Catalog" profile type for the Windows 10 and later platform. Next, the administrator must configure the Administrative Templates settings within the newly created profile. This involves navigating through the available settings (which are based on ADMX files, just like GPOs) and configuring the Microsoft Office settings to match those in the on-premises GPO. Finally, after the settings are configured, the administrator must assign the profile to an Azure AD group containing the target users or devices. Without this assignment, the configured settings will not be applied to any computers. Incorrect Options: Import an ADMX file: This action is only necessary if you need to configure settings using ADMX templates that are not already built into Intune (e.g., for third-party apps or custom settings). Standard Microsoft Office settings are natively available in Intune's Administrative Templates and Settings Catalog, making this step unnecessary for a typical migration. Create a compliance policy: Compliance policies are used to evaluate whether a device meets certain security and configuration requirements (e.g., OS version, disk encryption). They do not push specific application settings like a GPO does, so this is not the correct tool for this task. Set a scope tag to the policy: Scope tags are an optional feature used for role-based access control (RBAC) in Intune. They allow you to control which administrators can view and manage specific Intune objects. This is related to administrative management, not the technical migration and application of policy settings. Assign the policy: This is a generic term. "Assign the profile" is the more precise and correct final action in this specific workflow.

Microsoft Learn: Use Windows 10/11 Administrative Template templates to configure group

policy settings in Microsoft Intune.

URL: https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templateswindows

Reference: The article outlines the process under the "Create the template" section: "1.

Sign in to the Microsoft Intune admin center. 2. Select Devices > Configuration profiles >

Create profile... 3. In Basics, enter a name... 4. In Configuration settings, select a setting...

5. In Assignments, select the group(s) that will receive this profile." This directly supports the

correct sequence: Create, Configure, and Assign.

Microsoft Learn: Overview: Manage policies and profiles in Microsoft Intune.

URL: https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles

Reference: This document explains that a "profile" is the object created in Intune to manage

settings and that once created, it must be "assigned or 'deployed' to different user and

device groups." This confirms the fundamental workflow.

Microsoft Learn: Use ADMX templates on Windows PCs in Microsoft Intune.

URL: https://learn.microsoft.com/en-us/mem/intune/configuration/administrative-templatesimport-custom

Reference: The "Before you begin" section clarifies that you should "Use the built-in

Administrative Templates" first and that importing custom ADMX files is for settings that

"aren't available natively." This justifies why "Import an ADMX file" is not the correct first

step for migrating standard Office settings.

Enrollment device platform restrictions are used to control which devices can enroll in Intune based on their operating system, version, and manufacturer. This directly addresses the requirement to allow only approved platforms and versions. An administrator can create a policy to specify minimum and maximum OS versions for platforms like Windows, iOS, and Android. Device categories allow administrators to create a list of categories (e.g., Sales, IT, Engineering). During the enrollment process, users are prompted to select a category for their device. This category attribute can then be used to automatically add the device to a corresponding dynamic Azure AD group, fulfilling the second requirement.

1. Microsoft Learn: Set enrollment restrictions in Microsoft Intune. This document explicitly

states, "As an Intune administrator, you can create and manage enrollment restrictions that

define what devices can enroll into management with Intune. You can create restrictions

for... OS version."

URL: https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set

2. Microsoft Learn: Categorize devices into groups. This source details the process, stating,

"Microsoft Intune lets you assign devices to groups based on categories that you define...

When users enroll a device, they are presented with a list of categories you configured.

They select a category and their device becomes a member of the corresponding Microsoft

Entra group."

URL: https://learn.microsoft.com/en-us/mem/intune/enrollment/device-group-mapping