Question 1

A device and its signed-in user are each in scope for a different custom Enrollment Status Page (ESP) profile, and a tenant default ESP profile also exists. The deployment is a standard user-driven Autopilot deployment. Which ESP profile applies, and how would that differ in a self-deploying deployment?

Accepted Answer

Correct answer: A. Intune resolves ESP profiles in order: the highest-priority profile targeted at the device, then (only when there is a user) the highest-priority profile targeted at the user, then the default profile. So in user-driven mode a device-targeted profile takes precedence over a user-targeted one. In self-deploying and pre-provisioning (technician) flows there is no user context, so only device-targeted ESP profiles are evaluated and user-targeted profiles are ignored.

Question 2

After configuring a Windows Autopilot user-driven deployment, an administrator finds that target devices join Microsoft Entra ID during OOBE but never enroll in Intune, receive no deployment profile, and never show the Enrollment Status Page. In the automatic enrollment configuration, MDM user scope is set to None. What is the effect of this setting, and what should it be?

Accepted Answer

Correct answer: D. The MDM user scope controls automatic MDM enrollment. When it is set to None, automatic enrollment does not occur, so an Autopilot user-driven device joins Microsoft Entra ID (using the user's credentials) and then stops: no Intune enrollment, no profile, no ESP. Setting MDM user scope to Some (scoped to a pilot group) or All lets automatic enrollment proceed. Automatic enrollment requires Microsoft Entra ID P1 or P2.

Question 3

A lab device was provisioned once with Windows Autopilot self-deploying mode. An engineer wipes it and tries to run it through Autopilot again, but provisioning now fails with error 0x80180014. The Autopilot profile and enrollment settings are unchanged. What must the engineer do so the device can be redeployed?

Accepted Answer

Correct answer: C. A device provisioned with self-deploying mode (or pre-provisioning mode) can't automatically re-enroll through Windows Autopilot. When such a device is reused, reset, or redeployed, it fails with error 0x80180014. The fix is to delete the device record in the Intune admin center (Devices, then All devices, then select the device, then Delete), or use Unblock device on the Autopilot device record, before rerunning the deployment. A separate cause of 0x80180014 is Windows MDM enrollment being blocked by an enrollment restriction.

Question 4

A new corporate Windows 11 laptop shipped with many preinstalled OEM manufacturer apps ('bloatware'). An administrator wants an Intune remote action that removes installed apps to clean up the device, while offering the option to keep the signed-in user's files. Which action is designed for this?

Accepted Answer

Correct answer: C. The Fresh Start action removes apps from a managed Windows device, which is specifically useful for removing preinstalled OEM apps that ship on a new PC. Choosing 'Retain user data on this device' keeps the device Microsoft Entra joined, automatically re-enrolls it in MDM at next sign-in, and preserves the user's Home folder while still removing apps and settings. If user data isn't retained, the device returns to a clean OOBE-completed state.

Question 5

Your organization wants to move a fleet of Microsoft Entra hybrid joined Windows laptops to Microsoft Entra join (cloud-native). A colleague suggests running Autopilot Reset on each device to flip the join type in place. What is the accurate guidance?

Accepted Answer

Correct answer: A. Microsoft states there is no supported process to convert an existing device from hybrid join to Entra join without a Windows reset (full wipe). Additionally, Autopilot Reset does not support hybrid joined devices, so it cannot perform the conversion. The supported approach is a full wipe and re-provision as Entra join.

Question 6

An administrator has assigned two different Windows Autopilot device preparation policies to the same user group. During a user-driven deployment, the administrator needs to predict which policy the device will use. How does Windows Autopilot device preparation resolve which policy applies when a user is targeted by more than one?

Accepted Answer

Correct answer: A. When multiple Windows Autopilot device preparation policies are deployed to a user, the policy with the highest priority applies. In the Device preparation policies list the highest-priority policy sits at the top and shows the smallest number in the Priority column, and you reorder policies (changing priority) by dragging them within the list. This is deliberately different from classic Windows Autopilot deployment profiles, where a device that lands in multiple assigned groups receives the oldest-created profile.

Question 7

In your Windows Autopilot deployment profile you set "Allow pre-provisioned deployment" to No because you do not want technicians using the pre-provisioning (white glove) flow. During OOBE on a target device, a technician presses the Windows key five times and attempts the pre-provisioning path anyway. What happens?

Accepted Answer

Correct answer: A. Pressing the Windows key five times at OOBE can invoke the pre-provisioning path, but Intune enforces the "Allow pre-provisioned deployment" setting. When it is set to No, the pre-provisioning attempt fails with error 0x80180005 instead of continuing.

Question 8

An administrator configures an ESP profile with 'Install Windows quality updates' set to Yes. The target Windows 11 devices are enrolled but are NOT registered for Windows Autopilot. To which assignment must BOTH the Update Rings policy and the ESP profile be set so quality updates install during OOBE, and which Autopilot scenario cannot install them at all because it does not use the ESP?

Accepted Answer

Correct answer: D. For the 'Install Windows quality updates' ESP setting to work on non-Autopilot-registered devices, both the Update Rings policy and the ESP profile must be assigned to 'All Devices'. Additionally, Windows Autopilot device preparation does not use ESP at all, so this setting is not applicable and monthly security updates cannot be installed during OOBE for that scenario.

Question 9

During a Windows Autopilot pre-provisioned deployment, a technician completes the technician flow and sees a success screen. The device is resealed and shipped to the end user. The end user powers on the device but reports that several device-targeted apps that were assigned to the device, and should have installed during the technician flow, are missing when they reach the desktop. What configuration change would most directly prevent this outcome?

Accepted Answer

Correct answer: A. The technician flow inherits behavior from self-deploying mode and uses the ESP to hold the device in provisioning state. If the ESP is disabled or not configured to block on app installation, the Reseal button can appear before apps finish installing. Microsoft explicitly recommends keeping the ESP enabled for pre-provisioned deployments because the success screen only confirms enrollment success, not completion of app/config installation.

Question 10

An administrator creates an Enrollment Status Page (ESP) profile in Intune with 'Block device use until all apps and profiles are installed' set to Yes and 'Block device use until these required apps are installed' set to Selected with App1, App2, and App3 listed. The device also has App4 assigned but App4 is not in the blocking list. What happens if App4 fails to install during the device setup phase of the ESP?

Accepted Answer

Correct answer: A. The ESP blocking app list filters which apps are tracked as blocking. If App4 is assigned to the device but not included in the 'Selected' blocking apps list, the ESP does not wait for App4 to complete. The deployment can succeed even if App4 fails. Importantly, for some app types (Win32, Microsoft Store, Enterprise app catalog apps), non-blocking apps are not installed during ESP at all and will install after the ESP completes.

Question 11

An administrator creates an Enrollment Status Page (ESP) profile and sets 'Block device use until these required apps are installed' to 'Selected,' then adds App1, App2, and App3 to the blocking list. App3 and App4 are both assigned to the device as required apps. What happens during enrollment?

Accepted Answer

Correct answer: D. When 'Selected' apps are configured as blocking, the ESP uses the blocking app list as a filter against what is actually assigned to the device or user. In this scenario, App1 and App2 are in the blocking list but not assigned to the device, so they are not tracked. App3 is in both the blocking list and assigned as a required app, so the ESP waits for App3. App4 is assigned but not in the blocking list, so in non-pre-provisioning flows with Win32, Store, or Enterprise catalog apps, App4 may not install until after ESP completes.

Question 12

A company is deploying shared kiosk devices using Windows Autopilot. The devices should provision automatically with no user interaction at all (including no language or keyboard selection prompts) when connected via Ethernet. Which Windows Autopilot deployment mode should the administrator choose?

Accepted Answer

Correct answer: C. Windows Autopilot self-deploying mode requires little to no user interaction. When a device is connected via Ethernet, the entire provisioning process is fully automated with no prompts for language, locale, keyboard, or credentials. This mode is designed for kiosk, digital signage, and shared devices. It requires TPM 2.0 and is only supported with Microsoft Entra join (not hybrid join).

Question 13

During a Windows Autopilot self-deploying deployment, a device fails with error 0x800705B4. What is the most likely cause?

Accepted Answer

Correct answer: B. Windows Autopilot self-deploying mode uses TPM 2.0 hardware to authenticate the device into the Microsoft Entra tenant without user credentials. If a device does not support TPM 2.0 (including Hyper-V virtual machines with virtual TPMs), the attestation process fails with the 0x800705B4 timeout error. This is a hard requirement for self-deploying mode.

Question 14

In an Enrollment Status Page profile, an administrator wants that if a tracked app fails during provisioning, the end user is given a button to bypass the ESP and start using the device rather than being forced to reset it. The administrator also wants to raise how long the ESP waits before showing a timeout error. Which two ESP settings should be configured?

Accepted Answer

Correct answer: D. 'Allow users to use device if installation error occurs' = Yes gives users the option to bypass the ESP and use the device when an installation fails, as opposed to 'Allow users to reset device if installation error occurs,' which offers a reset instead. The ESP timeout is controlled by 'Show an error when installation takes longer than specified number of minutes,' which defaults to 60 minutes; enter a higher value to allow more time before the timeout error appears. Both are configured on the ESP profile's Settings page.

Question 15

An organization has enabled co-management. Before moving compliance management for the whole fleet to Intune, the team wants to shift the Compliance policies workload to Intune for only a small set of test machines defined by a Configuration Manager collection. On the co-management Workloads tab, which slider setting does this, and what must be defined?

Accepted Answer

Correct answer: D. On the co-management Workloads tab, moving a workload slider to Pilot Intune switches that workload to Intune only for the devices in the pilot collection, which you specify on the Staging tab of the co-management properties. Setting the slider to Intune instead switches the workload for all co-managed Windows devices. Pilot Intune is the staged/test setting; Intune is the all-devices setting. Each workload can use a different pilot collection.

Question 16

A device is a member of two Microsoft Entra security groups, and each group has a different Windows Autopilot deployment profile assigned to it. Neither profile is the tenant default. Which profile does the device receive?

Accepted Answer

Correct answer: B. When a device belongs to multiple groups that each have a Windows Autopilot deployment profile assigned, Intune resolves the conflict by applying the oldest created profile. The creation date, visible in the Created field under Essentials on the profile, is the tiebreaker, not the newest profile, group size, or assignment order. This trips up engineers who assume the most recently created profile wins.

Question 17

You want new Autopilot Windows devices to stay locked on the Enrollment Status Page until three specific business-critical apps finish installing, but you do not want the ESP to wait on every other assigned app. Which ESP setting achieves this?

Accepted Answer

Correct answer: A. The ESP lets you either block on all apps and profiles, or specify a filtered blocking list via "Block device use until these required apps are installed." You can choose up to 100 apps; the ESP then waits only for the listed apps that are also assigned to the user or device, not for every assigned app.

Question 18

An administrator sets up Windows Autopilot device preparation. A user-driven deployment completes and users reach the desktop, but none of the apps or PowerShell scripts selected in the device preparation policy are installed, and the devices never appear in the target device security group. Which misconfiguration is the most likely cause?

Accepted Answer

Correct answer: D. Device preparation relies on Enrollment Time Grouping: at enrollment, Intune writes the device into the named static security group so assigned apps, scripts, and policies apply. For this to work, the Intune Provisioning Client service principal (AppId f1346770-5b25-470b-88bd-d5744ab7952c) must be an owner of that group, and the group must have 'Microsoft Entra roles can be assigned to the group' set to No. If the owner is missing or the group is role-assignable, the device never joins the group, so nothing assigned to it is delivered. The admin also needs the 'Enrollment time device membership assignment' RBAC permission.

Question 19

An organization ships Microsoft Entra hybrid join Autopilot devices directly to remote employees who have no corporate network connectivity at first boot. To let these devices complete the on-premises domain join over a VPN, which Autopilot deployment profile setting must be changed, and what companion requirement applies?

Accepted Answer

Correct answer: C. For off-premises Microsoft Entra hybrid join, set Skip Domain Connectivity Check to Yes so provisioning does not fail when a domain controller cannot be pinged. This does not remove the need to reach a DC; it relies on a VPN that Intune deploys and configures before the user signs in. The VPN must be deployable through Intune and cannot be one that uses user certificates or a non-Microsoft UWP VPN plug-in from the Store, because the user context is not established when the connection must be made.

Question 20

You need to push configuration settings (for example, default account setup) to Microsoft Outlook on iOS and Android devices, but many of those devices are personally owned and NOT enrolled in Intune MDM. Which type of app configuration policy must you create so the settings reach unenrolled devices?

Accepted Answer

Correct answer: A. Managed apps app configuration policies are delivered over the MAM channel and require only that the app is Intune App SDK integrated and has an app protection policy; the device's enrollment state and how the app was delivered do not matter. Managed devices policies use the MDM OS channel and require enrollment.

Question 21

An administrator manages Apple volume-purchased (VPP) apps in Intune. The Apple Business Manager location token is nearing its one-year expiry. Where in the Microsoft Intune admin center is the existing token renewed, and from where is the replacement token downloaded?

Accepted Answer

Correct answer: C. VPP/location tokens are managed under Tenant administration, then Connectors and tokens, then Apple VPP tokens. To renew, download a fresh content token from Apple Business Manager (Preferences, then Payments and Billing, then Apps and Books, then Content Tokens), then Edit the existing token's Basics and upload the new file. Each location token is valid for one year. This is a deliberately different location from the ADE enrollment program token, which lives under Devices, then Enrollment, then Apple.

Question 22

A company uses Apple User Enrollment (BYOD with a Managed Apple Account) for personal iPhones and wants VPP apps to appear in Company Portal for those users. The administrator assigned the VPP apps using the default license type. Users on User Enrollment devices report the assigned apps never appear in Company Portal, while the same apps install fine on the company's supervised, MDM-enrolled iPads. What is the cause?

Accepted Answer

Correct answer: B. New VPP assignments default to device licensing. Device licensing is not supported on Apple User Enrollment devices, and Company Portal does not show device-licensed apps on User Enrollment devices; only user-licensed apps can be installed there. The supervised iPads accept device-licensed apps, which is why they work. To reach the User Enrollment users, reassign the app with user licensing so each user consumes a license under their Managed Apple Account. Do not assign both device and user licenses to the same user or device.

Question 23

An administrator configures a custom PowerShell detection script for a Win32 (.intunewin) app. On test devices where the app is definitely installed, Intune keeps reporting it as not detected and re-attempts the install, even though the script exits with code 0 and writes the expected string to output. Which script behavior would cause Intune to evaluate the app as 'not installed' despite a 0 exit code and STDOUT output?

Accepted Answer

Correct answer: B. The custom detection contract is: the app is 'installed' only when the script exits with code 0 AND writes a string to STDOUT. Critically, if the script writes anything to the STDERR stream, the result is evaluated as not installed even if the exit code is 0 and STDOUT contains data. A stray Write-Error, a non-terminating error, or a warning routed to the error stream silently breaks detection and causes Intune to re-offer the app. Write to STDOUT only.

Question 24

A retailer deploys supervised, user-less iPad kiosks enrolled through ADE. A device restrictions profile blocks the App Store, and no Apple Accounts are signed in on the devices. The admin must push a volume-purchased app to these iPads. Which VPP license type must be used, and why?

Accepted Answer

Correct answer: B. Device licensing ties the license to the device, requires no Apple Account and no App Store sign-in, and installs/updates the app over the MDM channel only - ideal for supervised, user-less kiosks where the App Store is blocked. User licensing requires each end user to sign in with a unique Apple Account (and the ABM invitation itself needs App Store access), so disabling the App Store breaks it. New VPP assignments now default to device licensing.

Question 25

An administrator adds an app with the 'Microsoft Store app (new)' type and assigns it as Available in user context to a group of Microsoft Entra registered (workplace-joined) Windows devices. When users click Install in Company Portal, they receive 'Requirements Not Met.' Which change resolves this, and what component delivers this app type?

Accepted Answer

Correct answer: B. On Microsoft Entra registered devices, the install behavior for a Microsoft Store app (new) must be System context; a user-context Available assignment returns 'Requirements Not Met.' The Microsoft Store app (new) type is winget-backed and requires the Intune Management Extension on the device (plus at least two processor cores and network access to the Store and its CDN). Microsoft Entra joined devices do not have the user-context restriction.

Question 26

An admin assigns a Windows line-of-business (MSIX) app as Available for enrolled devices and targets a device group. Enrolled users report the app never appears in the Company Portal. What is the most likely cause?

Accepted Answer

Correct answer: B. For almost all app types and platforms, Available assignments are only valid when assigned to user groups, not device groups (Win32 apps are the notable exception that can target either). Because this MSIX LOB app was assigned Available to a device group, it will not surface in the Company Portal.

Question 27

An administrator uses the Microsoft 365 Apps admin center to manage Microsoft 365 Apps. They want to ensure that a specific update channel is enforced and that users cannot change the channel themselves. What is the correct approach using the tools available in the Microsoft 365 Apps admin center?

Accepted Answer

Correct answer: D. The Microsoft 365 Apps admin center includes Cloud update (previously surfaced as servicing profiles), which lets administrators enforce an update channel and control update timing for Microsoft 365 Apps. It is assigned by Microsoft Entra group and takes priority over other update-management tools on the device, so local or user channel settings cannot override it. This is the purpose-built channel-enforcement path inside the Microsoft 365 Apps admin center.

Question 28

A security team wants to use Microsoft Tunnel for Mobile Application Management (MAM) to provide BYOD Android devices with access to on-premises resources without enrolling those devices in Intune. Which license is required in addition to a standard Microsoft Intune Plan 1 subscription?

Accepted Answer

Correct answer: A. Microsoft Tunnel for Mobile Application Management (MAM) is an Intune Suite add-on capability. It requires Microsoft Intune Plan 2 or Microsoft Intune Suite as an add-on license beyond the base Intune Plan 1. Standard Intune Plan 1 alone is insufficient. The base Microsoft Tunnel (for enrolled MDM devices) is included in Intune Plan 1, but extending Tunnel to unenrolled MAM devices requires the additional Plan 2 or Suite license.

Question 29

You're troubleshooting a failed Win32 app installation directly on a managed Windows client. The Intune Management Extension logs are in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs. Which log file is dedicated to Win32 app deployment activity (downloads, applicability, installs, and detection)?

Accepted Answer

Correct answer: D. AppWorkload.log is the log dedicated to Win32 app deployment activities on the client - app check-ins, installs, applicability, and detection. It lives in the IntuneManagementExtension\Logs folder alongside the other IME logs and is the primary file for diagnosing a failed Win32 install locally.

Question 30

You deploy the Microsoft 365 Apps for Windows 10 and later suite using the configuration designer. Target devices still have an older MSI-based Office installation. In the app suite settings you set Remove other versions to Yes. What is the effect on targeted devices?

Accepted Answer

Correct answer: D. Remove other versions uninstalls every MSI-based Office product on the device, not just the apps chosen in Configure App Suite. The sweep is deliberate: a Microsoft 365 Apps (Click-to-Run) install will not succeed while pre-existing MSI Office apps are present.

Question 31

A user installs Outlook on a personal, unenrolled Android phone. The administrator has assigned an Android app protection policy to that user, but the App protection status report shows nothing for the user and no PIN or data controls ever appear in the app. What is the most likely reason?

Accepted Answer

Correct answer: B. On Android, much of the app protection functionality is built into the Company Portal app, which acts as the broker that retrieves and delivers policy from the Intune service. Device enrollment is not required, but the Company Portal app is always required. Without it installed, no app protection policy reaches the device and the status report stays empty for that user.

Question 32

A company uses Microsoft Tunnel for Mobile Application Management (MAM) to give unenrolled iOS devices secure access to on-premises resources. A developer's line-of-business iOS app needs to use the Tunnel VPN connection. What integration is required in the iOS app itself to support Tunnel for MAM?

Accepted Answer

Correct answer: A. For an iOS line-of-business app to use Microsoft Tunnel for MAM, it must integrate the Intune App SDK for iOS, the Tunnel for MAM SDK for iOS, and use the Microsoft Authentication Library (MSAL) for authentication. Additionally, a Microsoft Entra app registration is required. These SDK integrations allow the app to establish the per-app VPN connection through the Tunnel gateway on unenrolled devices.

Question 33

A Windows laptop is a member of two Microsoft Entra device groups. Using the same app object, a design app is assigned as Required to the first group and as Uninstall to the second group. There are no other assignments for this app. What does Intune do on this device?

Accepted Answer

Correct answer: B. A single group cannot carry two intents, but a device that is a member of two groups with different intents produces a documented resolution. In Intune's app-intent conflict matrix, Device Required plus Device Uninstall resolves to Required (the same is true for User Required plus User Uninstall). Required wins over Uninstall, so the app is installed. Intent is resolved before any assignment filter is evaluated.

Question 34

A 32-bit line-of-business app is packaged as a Win32 app and set to install in system context. It installs to C:\Program Files (x86)\Contoso and writes keys to HKLM\SOFTWARE\WOW6432Node\Contoso, but Intune keeps reporting it as 'not installed' and re-attempts the install every IME cycle. The file and registry detection rules point to C:\Program Files\Contoso and HKLM\SOFTWARE\Contoso. What is the root cause and fix?

Accepted Answer

Correct answer: C. On a 64-bit client, file and registry detection rules default to 64-bit context, so %ProgramFiles% resolves to C:\Program Files and the registry rule reads the native hive, neither of which is where a 32-bit installer writes (C:\Program Files (x86) and WOW6432Node). The install succeeds, detection never matches, and Intune re-offers the required app about every 24 hours. Set 'Associated with a 32-bit app on 64-bit clients' to Yes on the file and registry detection rules so they evaluate the 32-bit locations. The install context (system versus user) is unrelated.

Question 35

A Win32 app uses a custom PowerShell detection script. The script exits with code 0 and writes the string Detected to STDOUT, but it also writes a warning line to STDERR. In AppWorkload.log the app is reported as not installed and Intune keeps retrying the install. What is causing detection to evaluate as not installed?

Accepted Answer

Correct answer: C. For a custom detection script, the app is detected only when the script exits with code 0 AND writes to STDOUT AND writes nothing to STDERR. If any data is written to STDERR, the result is evaluated as not installed regardless of the STDOUT output and the zero exit code.

Question 36

An organization deploys Microsoft 365 Apps to Windows devices through Intune. Occasionally the Enrollment Status Page hangs during app installation when Microsoft 365 Apps is deployed using the 'Microsoft 365 Apps (Windows 10 and later)' app type alongside other Win32 apps. What is the recommended solution to prevent ESP hangs?

Accepted Answer

Correct answer: C. Microsoft documentation specifically notes that the ESP can hang when Microsoft 365 Apps is deployed using the 'Microsoft 365 Apps (Windows 10 and later)' app type and another Win32 app is being tracked by ESP at the same time, because both use TrustedInstaller and simultaneous installations conflict. The recommended workaround is to deploy Microsoft 365 Apps via Intune using the Win32 app type, which avoids the installer conflict and prevents the ESP hang.

Question 37

An administrator opens the Managed Google Play iframe in the Intune admin center, searches for a public app, chooses Approve, and syncs. Days later, users on Android Enterprise personally owned work profile devices report the app never appears in their work Play Store, even after multiple device syncs. The app shows as approved in the iframe. What did the administrator miss?

Accepted Answer

Correct answer: C. Approving an app in Managed Google Play only makes it available for management; it does not deploy it. Only apps that have been assigned to a user or device group in Intune show up in the Managed Google Play store on the device. Approval without an assignment is a silent no-op from the user's perspective. The fix is to create an assignment (Available or Required) for the app and sync.

Question 38

An administrator deploys an iOS app protection policy (APP) and sets 'Send org data to other apps' to 'Policy managed apps.' A user on an enrolled iPhone attempts to open a Word document attachment in the Intune-managed Outlook app and then share it to an unmanaged third-party app. What is the expected behavior?

Accepted Answer

Correct answer: D. When 'Send org data to other apps' is set to 'Policy managed apps' on an enrolled iOS device, users may still be able to transfer content via Open-in or Share extensions to unmanaged apps through iOS native mechanisms. However, Intune encrypts the transferred data so that unmanaged apps cannot read it. The document content is protected even if the transfer mechanism allows the file to land in an unmanaged app.

Question 39

After enabling Endpoint analytics and assigning the Intune data collection policy to a Windows device, an admin still does not see that device in the Startup performance report. Which requirement most likely explains the delay?

Accepted Answer

Correct answer: D. Devices configured for data collection must be restarted to fully enable analytics, and it can take up to 25 hours after that before the device shows in the Device performance tab. The minimum for a meaningful score is 5 devices, and boot/sign-in events are retained for 29 days.

Question 40

An administrator configures an Intune compliance policy for Windows devices that requires the device to be at or below a 'Low' machine risk score using Microsoft Defender for Endpoint integration. A device has medium-level threats detected. What is the compliance status of this device?

Accepted Answer

Correct answer: B. When the Intune compliance policy is set to 'Low' for the machine risk score, the device is evaluated as compliant only if it has no threats or only low-level threats. A device with medium-level threats exceeds the Low threshold and is marked as noncompliant. When combined with a Conditional Access policy that requires device compliance, the noncompliant device will lose access to corporate resources automatically.

Question 41

Two Settings Catalog device configuration profiles are assigned to the same Windows device. Each configures the identical setting, but to different values. What does Intune do with that setting?

Accepted Answer

Correct answer: C. When two configuration profiles set the same setting to different values, the setting is not applied - Intune shows the conflict and you must resolve it manually. This is different from compliance policies (where the most restrictive value wins) and different from ESP profiles (which use priority).

Question 42

An administrator needs to run a targeted query against an enrolled Windows device in Intune to check whether a specific registry key is present. Which remote action supports this scenario?

Accepted Answer

Correct answer: C. The 'Run a device query using KQL' remote action in Intune allows administrators to query device properties, installed software, registry values, and other attributes on individual Windows devices using Kusto Query Language (KQL). This is part of the Microsoft Intune Advanced Analytics capability included in the Intune Suite.

Question 43

A Windows configuration profile (PolicyA) is assigned to three device groups: GroupA's assignment uses a filter in Include mode, GroupB's assignment uses a different filter in Exclude mode, and GroupC's assignment uses no filter. A device belongs to all three groups and matches the rules of the Exclude filter. Does PolicyA apply to that device?

Accepted Answer

Correct answer: D. For assignment filters, Exclude mode takes precedence over No filter, which takes precedence over Include. Because the device matches an Exclude-mode filter, it is dropped from the assignment and no further filter evaluation is performed, so PolicyA does not apply.

Question 44

An Intune compliance policy is created for Windows devices with the default 'Mark device noncompliant' action unchanged. A Conditional Access policy is also configured to block access to Exchange Online for noncompliant devices. A user's device falls out of compliance. When does Conditional Access block the user's Exchange Online access?

Accepted Answer

Correct answer: C. When a compliance policy is created, the 'Mark device noncompliant' action is automatically included with a default schedule of 0 days, meaning the device is marked noncompliant immediately when noncompliance is detected. Conditional Access evaluates compliance status, so access is blocked immediately upon the device being marked noncompliant. A grace period only applies if an administrator manually changes the schedule from 0 to a positive number of days.

Question 45

An administrator sets up Android Enterprise corporate-owned work profile (COPE) enrollment and creates an enrollment profile that produces an enrollment token and QR code. The admin schedules an annual reminder to renew the token, assuming it expires yearly like the Apple ADE and VPP tokens. Which statement is correct?

Accepted Answer

Correct answer: D. Android Enterprise corporate-owned work profile enrollment tokens do not expire automatically; the annual-renewal reflex the admin is applying belongs to Apple, whose ADE and VPP tokens each expire after one year. If an admin revokes a COPE token, its profile is hidden from the active list, though you can still view it by filtering for Inactive policy states. Separate gotcha: the afw#setup and NFC enrollment methods for COPE are only supported on Android 8-10, not Android 11 and later.

Question 46

In a tenant on the current Intune release, an admin opens Devices, then Configuration, and tries to create a new Administrative Templates profile under Templates for Windows, but the profile type is deprecated and read-only. Where should they now configure these ADMX-backed Windows settings?

Accepted Answer

Correct answer: B. Starting with the December 2024 (2412) service release, the standalone Administrative Templates profile type under Templates is deprecated and read-only. The ADMX-backed settings are now available inside the settings catalog, built in with no download or OMA-URI required.

Question 47

A company issues corporate-owned Android 13 phones that employees may also use for personal apps, with work and personal data kept in separate profiles. The admin enrolls them as Android Enterprise corporate-owned devices with a work profile (COPE). A junior technician proposes provisioning them by typing the afw#setup identifier or by tapping an NFC tag during setup. What should the admin tell the technician?

Accepted Answer

Correct answer: D. For corporate-owned work profile (COPE) devices, the afw#setup (DPC identifier) method and NFC provisioning are only supported on Android 8-10; they are not available on Android 11 and later. On Android 11+ COPE devices the supported provisioning methods are QR code, Google Zero Touch, and Knox Mobile Enrollment. The afw#setup identifier is a fully managed-only method and cannot be used for COPE provisioning at all.

Question 48

Contoso currently manages mobile devices with Basic Mobility and Security for Microsoft 365, so the tenant's MDM authority shows "Office 365." Contoso buys Intune licenses and wants to move only the sales team to Intune while every other user stays on Basic Mobility and Security. What is the correct approach?

Accepted Answer

Correct answer: B. Basic Mobility and Security coexistence is enabled by adding the Intune MDM authority. Once coexistence is on, each user's management authority is decided by their license: assigning an Intune license (with Intune policies staged first to avoid losing settings) moves that user's devices to Intune on next check-in, while unlicensed users remain on Basic Mobility and Security.

Question 49

A company is rolling out Conditional Access that requires devices to be marked compliant. During a review, the security team notices that some enrolled devices that have never been assigned any compliance policy are still being treated as compliant and are gaining access. Which tenant-wide setting explains this, and what is its default value?

Accepted Answer

Correct answer: C. The tenant-wide compliance policy setting 'Mark devices with no compliance policy assigned as' defaults to Compliant, meaning any device that has never received a compliance policy is treated as compliant for Conditional Access purposes. Microsoft recommends switching it to Not compliant once policy coverage is solid, so that only confirmed-compliant devices gain access. It lives under Endpoint security, then Device compliance, then Compliance policy settings.

Question 50

In Endpoint analytics, the Startup performance report shows a tenant startup score. How is the startup score derived, and what does a status of "Insufficient data" indicate?

Accepted Answer

Correct answer: C. The startup score is a weighted average of the boot score and the sign-in score, expressed 0 (poor) to 100 (excellent). A status of "Insufficient data" means there are not enough devices reporting - currently at least 5 devices are required for a meaningful score.

Question 51

You must build an automated nightly job that pulls the full device-compliance dataset out of Intune into an external SIEM as CSV or JSON, with no one clicking in the portal. Which approach is the current, supported way to export the report?

Accepted Answer

Correct answer: A. Intune reports that were migrated to the modern reporting infrastructure are exported through a single top-level Graph endpoint: POST deviceManagement/reports/exportJobs with a reportName (for example DeviceNonCompliance). You then GET the job by id until status is completed and download the compressed CSV/JSON from the url field. This is the documented, automatable path.

Question 52

A company co-manages Windows devices with Configuration Manager and Microsoft Intune. The endpoint team wants to evaluate Intune compliance policy on only a 50-device subset before moving everyone, while Configuration Manager keeps managing compliance for all other devices. In the co-management properties, which configuration achieves this?

Accepted Answer

Correct answer: B. Each co-management workload (including Compliance policies) has its own slider. The Pilot Intune setting switches that workload only for the devices in the pilot collection you designate on the Staging tab; every other device continues to be managed by Configuration Manager. This is exactly the staged-pilot pattern Microsoft prescribes before flipping a workload to Intune for everyone.

Question 53

On co-managed Windows devices, an admin creates and assigns a Settings Catalog device configuration profile in Intune, but the settings never apply. In the co-management properties, the Device configuration workload slider is set to Configuration Manager, while the Compliance policies and Windows Update policies sliders are set to Intune. What is the most likely reason the Settings Catalog profile isn't applied?

Accepted Answer

Correct answer: C. A Settings Catalog policy is controlled by the Device configuration workload slider regardless of what settings it contains - the trap is expecting the policy's content to decide which workload governs it. That slider still points to Configuration Manager, so Intune is not the device-configuration authority for these devices and the profile is ignored. Moving the Device configuration workload to Intune (or Pilot Intune for that collection) resolves it.

Question 54

An employee is leaving the company and returning to their personal, BYOD-enrolled iPhone. IT must remove the corporate email profile, the VPN and Wi-Fi profiles, managed apps and their data, and unenroll the device from Intune, but must not touch the user's personal photos, personal apps, or reset the phone. Which Intune remote action should be used?

Accepted Answer

Correct answer: C. The Retire action removes company data (managed apps and their data, email/VPN/Wi-Fi and certificate profiles, and configuration) and unenrolls the device from Intune, while leaving personal data intact. It is the correct action for BYOD offboarding. The action takes effect the next time the device checks in with Intune.

Question 55

An administrator is configuring Windows LAPS in Intune. The devices are Microsoft Entra joined (not hybrid joined). Which backup directory must be selected in the LAPS policy, and what prerequisite must be completed in Microsoft Entra before the backup will work?

Accepted Answer

Correct answer: A. For Microsoft Entra joined devices (cloud-only join), the LAPS backup directory must be set to the cloud option (Microsoft Entra ID). Additionally, LAPS must be explicitly enabled in Microsoft Entra under Identity, then Devices, then Device settings, then 'Enable Local Administrator Password Solution (LAPS)'. Hybrid joined devices do not require this step, but pure Entra join does.

Question 56

To stop employees from enrolling home PCs, you create a device platform restriction that blocks personally owned Windows devices. A field technician reports that choosing "Set up for work or school" in Windows Settings on a new corporate laptop and signing in fails with error 80180014. Which enrollment method would let that corporate laptop enroll despite the personal-Windows block, without weakening the restriction for everyone?

Accepted Answer

Correct answer: A. When personal Windows enrollment is blocked, Intune only permits Windows enrollments that are pre-authorized as corporate. Windows Autopilot (and GPO / Configuration Manager co-management auto-enrollment) count as corporate enrollments, so an Autopilot-registered device is not blocked. The manual Settings-based "Set up for work or school" path is treated as personal and is blocked with error 80180014.

Question 57

An organization has a stock of previously used corporate iPads that are NOT registered in Apple Business Manager. IT must enroll them as supervised corporate devices with user affinity (so each iPad is associated with its assigned user and can use the Company Portal). A Mac with USB cables is available. Which Apple Configurator enrollment method meets these requirements, and what preparation is mandatory?

Accepted Answer

Correct answer: B. Apple Configurator offers two modes. Setup Assistant enrollment wipes the device, produces a supervised device, and supports user affinity (and therefore Company Portal) - but it requires the device serial numbers to be pre-imported into Intune and assigned to the enrollment profile before the device connects. Direct enrollment does not wipe the device and needs no serial numbers, but it only supports enrollment without user affinity and does not support Company Portal, so it cannot satisfy the 'supervised + user affinity' requirement. A Mac running Apple Configurator 2 with a USB connection to each device is required.

Question 58

You manage Microsoft Defender Antivirus exclusions exclusively through Intune and want those exclusions to also be protected by tamper protection so a local administrator can't remove them. Besides meeting the minimum Defender platform version and onboarding to Defender for Endpoint, which additional setting must you configure on the devices?

Accepted Answer

Correct answer: A. For antivirus exclusions to be tamper-protected, exclusions must be managed in Intune (or Configuration Manager) only, the device must run a supported Defender platform, and DisableLocalAdminMerge must be enabled so local exclusion lists don't merge with the org-managed policy.

Question 59

You want Delivery Optimization peering to work between branch-office devices that sit on different subnets and behind different NATs, restricting peers to a specific group you define with a Group ID. Which DODownloadMode value must you configure?

Accepted Answer

Correct answer: D. Download mode 2 (HTTP blended with peering across a private group) is the mode that uses a Group ID, and its peering crosses NAT boundaries - exactly what's needed to peer devices on different subnets/domains that share the same Group ID. The Group ID source setting even requires Download mode be set to mode 2.

Question 60

Your organization runs an isolated network where Intune can't complete the service-to-service connection to Microsoft Defender for Endpoint. You still need to onboard the Windows devices to Defender for Endpoint using an Intune Endpoint detection and response (EDR) policy. In the EDR profile, how should you set the 'Microsoft Defender for Endpoint client configuration package type'?

Accepted Answer

Correct answer: D. When the Intune-Defender connection isn't established, the EDR profile can't use 'Auto from connector.' For disconnected environments you choose 'Onboard' and supply the WindowsDefenderATP.onboarding blob content manually.

Question 61

An organization wants Windows Hello for Business enabled only for a specific pilot group of users, not for every device that enrolls. An administrator notices the tenant-wide Windows Hello for Business policy (under Devices, then Windows, then Windows Enrollment) is set to enabled. What is the recommended approach, and why?

Accepted Answer

Correct answer: A. The tenant-wide Windows Hello for Business policy applies to all devices enrolling in Intune and is evaluated only at enrollment time; later changes to it don't reach already-enrolled devices. Because of this, the common pattern is to set the tenant-wide policy to Disabled and then enable Windows Hello for Business through a targeted policy (Account protection policy, Settings catalog, security baseline, or identity protection template) assigned to a specific security group. Targeted policies apply after enrollment and refresh on normal policy intervals, giving you group-level control.

Question 62

You create a Windows driver update policy set to 'Automatically approve all recommended driver updates' with a 7-day deferral. A targeted device currently runs display driver version 5; the OEM's newest recommended version is version 4. What happens on that device?

Accepted Answer

Correct answer: A. Windows Update installs an approved driver only when its version is newer than what is already on the device, so version 4 is never offered to a device running version 5. The 7-day deferral is the distractor: it delays automatically approved recommended drivers, but an update that will never be offered has nothing to defer.

Question 63

A team onboards Windows clients to Microsoft Defender for Endpoint through the Intune EDR policy and confirms the devices now appear in the Microsoft Defender portal's device inventory. They then build an Intune compliance policy using "Require the device to be at or under the machine risk score" plus a Conditional Access policy that blocks noncompliant devices. In testing, the risk-based rule never marks any device noncompliant, even on a device with active malware. The organization licenses Microsoft Defender for Endpoint Plan 1. What is the cause?

Accepted Answer

Correct answer: C. Defender for Endpoint Plan 1 provides next-generation protection, attack surface reduction, device control, endpoint firewall, and network protection, but not endpoint detection and response (EDR). The machine risk score used by the "Require the device to be at or under the machine risk score" compliance setting is an EDR-derived signal, which is a Plan 2 capability. With P1, devices onboard and appear in the Defender portal, but no risk score is produced, so the compliance rule has nothing to act on and Conditional Access never sees a noncompliant result. Plan 2 (included in Microsoft 365 E5 / Windows E5) is required for the device-risk-to-compliance flow.

Question 64

Three separate Intune Antivirus (endpoint security) policies each define a different set of Microsoft Defender Antivirus file path exclusions, and all three are assigned to the same device. What is the resulting behavior on that device?

Accepted Answer

Correct answer: A. Defender Antivirus exclusion settings (Excluded Paths, Excluded Processes, Excluded Extensions) support policy merge, so Intune evaluates all applicable policies and combines their exclusions into a single superset delivered to the device. The most-secure / last-modified / none tiebreakers apply only to settings that do not support policy merge.

MD-102 practice questions, with full explanations

Windows Autopilot and Deployment (19 questions)