MD-102 — frequently asked questions

Yes, Intune allows you to configure policies to automatically install iOS and iPadOS updates on managed devices.

Yes, Intune supports managing system updates for Android devices through device restriction policies and update rings.

Clients must trust the Root CA to validate the chain. Server 2 is a subordinate CA signed by the Root CA (Server 3); trusting only Server 2 would break validation if the Root CA changes.

NDES (Network Device Enrollment Service) allows non-Windows or simple devices to request certificates. It pulls requests from clients and forwards them to the Subordinate CA for issuance.

Intune supports enrollment and compliance for Linux devices, but it does NOT support app deployment to Linux devices.

Android is one of the four primary platforms supported by Intune for full app management and deployment alongside Windows, iOS, and macOS.

Although LAPS settings can be reached through the settings catalog, Intune's dedicated Windows LAPS policy is created under Endpoint security > Account protection, which is what MD-102 expects.

Windows LAPS backs up the password to Microsoft Entra ID or to Windows Server Active Directory, so the tenant needs one of those directory services available.

Critical updates are a separate category in the Intune macOS update policy; 'All other updates (OS, built-in apps)' excludes them.

No. Firmware is its own update category in macOS software update policies and requires separate configuration.

It manages Cloud PC provisioning but lacks permissions to create or assign Intune applications and policies.

No, it grants only the specific combined permissions needed, avoiding the excess access found in broader built-in roles like Global Administrator.

The System update maintenance window in Android Enterprise device restrictions lives under General, not Device experience, so choosing Device experience will not expose the maintenance window fields.

In Profile1, open General > System update, select Maintenance window, then set the maintenance window start and end times.

Intune app protection policies on Windows only support Microsoft Edge. Outlook MAM policies apply to iOS and Android devices, not Windows.

Yes, but on Windows the only supported app for app protection policies is Microsoft Edge; device configuration profiles handle other settings.

Grant controls state what a user must satisfy to gain access; they do not limit which devices the policy evaluates. Setting that Grant control blocks or challenges noncompliant devices instead of scoping the policy to them.

Use the IsCompliant property with the operator Equals and the value No (or NotEquals/Yes), configured under Conditions > Filter for devices in the Conditional Access policy.

Although Remote Help appears in the Microsoft Store, Intune's documented deployment for this exam scenario uses the Win32 app package; Store deployment is a minority community suggestion.

Yes — you can update by superseding the Win32 app in Intune, which keeps all enrolled devices current with minimal ongoing administrative effort.

Cloud PKI is provisioned under Tenant administration and creates the root and issuing CAs as a service, not as a device configuration profile, so it adds nothing to the profile count.

The SCEP certificate profile references the trusted certificate profile and returns the issuing CA in the issued chain, so a separate trusted profile for the issuing CA is not part of the minimum deployment.

Onboarding is a device-level prerequisite, but Device query also requires a tenant license that includes Intune Advanced Analytics, which Microsoft 365 E5 does not provide.

The Intune Suite includes Advanced Analytics but bundles many extra products and costs more; the question requires minimizing costs, so the standalone Advanced Analytics add-on is cheaper.

Yes. Microsoft's device registration documentation lists the Authenticator app for iOS/Android, so adding a work or school account creates an Entra registered device object.

Company Portal is another valid method, not the only one. The question only asks whether the Authenticator solution meets the registration goal, and it does.

It is a Microsoft Entra directory role, while Intune key rotation requires an Intune RBAC role with the Remote tasks Rotate BitLockerKeys permission, such as Helpdesk Operator.

Built-in Intune roles such as Helpdesk Operator include the Rotate BitLockerKeys right, or you can use a custom Intune RBAC role with that Remote tasks permission enabled.

They assume only Help Desk Operator holds the Rotate BitLockerKeys right, but Microsoft Learn lists Endpoint Security Manager with the same Rotate BitLockerKeys (preview) remote task.

No. Intune's built-in security role is named Endpoint Security Manager; 'Endpoint Security Administrator' is not one of the Intune RBAC built-in roles.

Microsoft documents the manufacturer setting only for Android device platform restrictions; Windows and iOS exposure settings cover OS version and ownership instead.

No. Windows device platform restrictions do not include a manufacturer list; use separate Windows Autopilot deployment profile filters if you need model or manufacturer targeting.

App Configuration Policies only set app-specific settings (like URLs) and cannot enforce security controls like blocking clipboard access between apps.

Yes, App Protection Policies also apply to Android devices, allowing similar DLP controls like restricting copy/paste to managed apps.

Device configuration profiles apply settings like certificates or Wi-Fi, but they cannot schedule or phase the deployment of Windows updates.

No, you need separate update rings assigned to different device groups to apply different delay timelines for QA versus production.

No, Tamper Protection is enabled centrally in the Microsoft 365 Defender portal. Intune does not have a native setting to toggle this specific feature.

It configures Windows Hello for Business, FIDO2 security keys, and Credential Guard, but it does not control antivirus disablement permissions.

Windows 365 provisioning infrastructure currently requires the legacy VHD format for custom images to ensure broad compatibility during the upload and conversion process.

Yes, you can use a Generation 2 VM, but you must still convert its disk from VHDX to VHD format before uploading it as a custom image.

Device query is limited to devices running Windows 10 or later. Device2 runs an operating system that does not meet this requirement, so it is not supported.

Yes, as long as the device runs Windows 10 or later and is enrolled in Intune, Device query can be used. The table shows Device1 as the only such device.

Yes. Device query reads the dataset collected by Endpoint analytics, so an unonboarded device has no data to query and will not appear in results.

No. Defender for Endpoint onboarding feeds Defender XDR telemetry for advanced hunting; Device query in Intune depends on Endpoint analytics data and Advanced Analytics licensing.

The zero-touch portal can claim devices for an organization, but Intune must first be connected to Managed Google Play so the claimed devices have an Android Enterprise enrollment target.

No. Enrollment restrictions control enrollment eligibility and are not the prerequisite for enabling Android Enterprise zero-touch; link the Managed Google Play account first.

Cloud Device Administrator only manages device objects in Entra ID (enable, disable, delete, read BitLocker keys). It grants no rights on the Windows client, so members never enter the local Administrators group.

No. LAPS backs up and rotates the password of a designated local administrator account; it does not add users or groups to the local Administrators group on joined devices.

Device Query requires devices to be Microsoft Entra Joined. Registered devices do not have the same level of identity integration and telemetry access required for this feature.

No, Device Query is currently only supported on Windows 10 and later devices.

EPM requires full management capabilities provided by Entra Joined or Hybrid Joined states. Registered devices lack the necessary policy enforcement and identity context for privilege escalation controls.

No, EPM is exclusively designed for Windows 10 and Windows 11 devices running on x64 or ARM64 architectures.

It is found in the Microsoft Entra admin center under Identity > Devices > Device settings.

No, User settings manage personalization and roaming; Device settings control join permissions.

Yes, Conditional Access policies can evaluate device state (registered vs. compliant), but the device itself cannot enforce policies like encryption.

Registration links the device to Entra ID for SSO; Enrollment adds the device to Intune for management and policy enforcement.

The -contains operator natively supports substring matching, so wildcards are redundant and cause syntax errors.

-contains checks if a value is a substring of another, while -in checks if the value exists in a predefined list of exact strings.

Entra join only manages identity. MDM enrollment requires a separate policy like the MDM user scope to establish the management channel.

No, Windows Information Protection is for data protection, not for enrolling devices into Intune management.

While technical provisioning exists, Company Portal is the standard user-facing method for self-service registration and enrollment in BYOD scenarios.

Company Portal performs both actions: it first registers the device with Entra ID for identity, then enrolls it in Intune for management.

Entra Connect syncs users/groups from on-prem AD to cloud, it does not manage or register endpoint devices.

Use the Microsoft Authenticator app, Settings app, or enroll via Intune Company Portal depending on the scenario.

Yes, the Help Desk Operator role includes permissions to rotate both BitLocker (Windows) and FileVault (macOS) recovery keys.

It may be marked as preview in some contexts, but the Help Desk Operator role is designed to support this remote action.

Entra joined requires full device management and often MDM enrollment, which violates the requirement to minimize organizational control on personal devices.

It allows users to sign in to Microsoft 365 services using their work credentials (SSO) without the organization having to manage or secure the device itself.

Yes, they can use Azure AD SSO or Kerberos delegation to access shares without credential prompts.

Hybrid Join increases on-premises reliance by syncing device objects to AD DS, contradicting the requirement.

No, Autopilot Reset generally requires the device to be online and enrolled to initiate the process. It does not queue like Wipe.

Retire removes management but keeps user data. Wipe performs a full factory reset, removing all data and settings.

No, Intune does not support SMS as a channel for enrollment notifications. Only email and push notifications are available.

While Teams is integrated into Microsoft 365, Intune's native enrollment notification feature does not include Teams messaging as a delivery method.

Remediations require an Intune Suite license. The verification toggle confirms your tenant has this entitlement before allowing script execution.

No. Even with E5, you must explicitly toggle the verification setting in the admin center to activate the feature for script management.

Company Portal is designed for user-initiated enrollment of personal devices. Corporate-owned fully managed devices are typically enrolled via QR codes or Zero Touch for automated, policy-driven setup.

It indicates the device is owned by the organization and has full management capabilities, allowing for complete control over apps, settings, and security policies without user interference.

App protection policies manage the app, not the hardware. Resetting a device PIN requires device management on an enrolled, managed device.

The user must supply corporate account credentials plus the app PIN or biometric prompt before the protected app grants access.

Delete only removes the device record from Intune. It does not send a wipe command to the device, so corporate data remains on the device if it reconnects later.

Yes. The retire command is queued in Intune and will be applied automatically the next time the device connects to the internet and checks in with Intune.

Yes, the Azure Monitor Agent (AMA) can collect Security events, unlike the legacy Log Analytics Agent.

Legacy configurations and the Log Analytics Agent did not support Security event collection, requiring Defender or Sentinel instead.

GPOs require connection to an on-premises Active Directory domain controller. Azure AD joined devices managed solely by Intune do not have this connectivity, making Intune-native profiles the only viable option.

While older versions of Intune placed some AV settings there, the recommended approach for comprehensive security management is now the Endpoint protection profile, which houses both Firewall and Antivirus settings centrally.

Administrative Templates profiles mirror ADMX-backed settings, but Default Domain Policy holds password, lockout and Kerberos security settings, which are not ADMX templates — and those profiles have been superseded by the Settings Catalog.

Yes. The Windows 10/11 Device restrictions template includes a Password node with minimum password length, complexity and history plus lockout threshold, duration and counter reset options.

Distribution groups have no security identifier and cannot be used to grant access, so a local group cannot accept them as members. Converting Group3 to a universal security group would make it eligible.

That table describes nesting among domain local groups inside AD DS (on domain controllers). A computer-local group on a Windows 10 workstation cannot contain any other local group.

Device Health uses Windows Health Attestation rules, including BitLocker, Secure Boot, and TPM checks; System Security also has encryption controls, but this exhibit expects Device Health.

Under Device Properties, which contains OS version and build fields such as Minimum OS version and Maximum OS version.

Security baselines provide recommendations but don't explicitly block Insider enrollment by default without additional customization.

Yes, via OMA-URI CSPs, but standard profiles are simpler and preferred for these common business requirements.

Account Protection Policies are primarily for password and Windows Hello settings. While some updates allow local group management, Device Configuration Profiles are the established, GA method for this task.

No, Intune manages devices via cloud policies. You would use a Device Configuration Profile with OMA-URI to replicate GPO-like local group settings within Intune.

Conversion requires Intune to read the device's hardware hash, which only happens on an Intune-enrolled device. An Entra ID join records directory identity, not the hardware hash, so no Autopilot profile applies.

No. Autopilot runs only during the out-of-box experience or after a Reset that re-enters setup; a Restart of an already-provisioned OS performs no Autopilot action.

The deadline is how long an update stays available before it is force installed, while the grace period is the extra time after the deadline before a restart is forced on the device.

The question asks when a restart occurs after the deadline has passed, so only the 1-day grace period applies; the 5-day deadline has already expired.

Autopilot profiles drive the out-of-box experience or a full device reset, so applying one to 2,000 in-service Windows 10 PCs would require wiping them. A GPO enrolls the machines in place at next sign-in.

The hybrid join SCP is configured through Microsoft Entra Connect, but the option listed here is an Autodiscover SCP, which is an Exchange object. The SCP is a prerequisite, while the GPO is the bulk enrollment mechanism for existing computers.

No. If a profile's connection name matches a connection already provisioned on the device, the user still sees a single VPN1 entry rather than two separate ones.

GroupA is a user group, so Connection2 applies per user: User1's GroupA membership adds the VPN2 connection on every enrolled device the user signs in to.

Autopilot's Administrator/Standard user role applies only to Autopilot-provisioned devices, not to a plain Windows 11 Entra join to the tenant.

In Microsoft Entra ID (Azure AD), go to Devices > Device settings and set "Registering user is added as local administrator on the device during Microsoft Entra join" to No.

The XML file generated by the Windows Security app is applied manually per device. An Endpoint Protection profile in Intune deploys the same Exploit Guard settings to all 500 enrolled computers centrally and keeps them enforced.

No extra onboarding is required if the devices are already enrolled in Intune; you simply assign the Endpoint Protection profile to a device group containing those computers.

Policy-specific actions only apply to devices assigned to that policy. Devices not in Group1 are unaffected by Policy1's internal settings.

It is found under Intune Admin Center > Device compliance > Compliance policy settings. It is a global tenant setting, not per-policy.

No, WDS is not strictly required for MDT to function. MDT can use WDS for network broadcasting, but it can also use SMB shares. WDS is not a component added to the MDT deployment share itself.

MDT relies on tools from the Windows ADK, such as Windows PE and DISM, to create boot images and apply operating system updates during the deployment process.

No. Scope tags only control which admins can see an object in the Intune console; assignment is determined solely by the groups you select.

Policy1 is set to mark a device noncompliant 5 days after noncompliance, and assignment occurred January 5, so the change takes effect January 10.