Prevent Windows Insider Program Enrollment with Intune
Plan and implement device configuration profiles
Manage device updates
Answer
Correct answer: A, E — Configure a device restrictions profile to block UI access and a Windows 10 update ring policy to prevent installation of preview builds.
You have a Microsoft 365 subscription. All devices run Windows 10. You need to prevent users from enrolling the devices in the Windows Insider Program. What two configurations should you perform from the Microsoft Intune admin center? Each correct answer is a complete solution. NOTE: Each correct selection is worth one point.
Community Insight
The question tests your knowledge of where specific Windows Update for Business settings are located in Intune, specifically distinguishing between general device restrictions and update-specific policies.
This page explains how to prevent users from enrolling devices in the Windows Insider Program using Microsoft Intune. It identifies the correct combination of device restrictions and update ring policies to block preview builds.
Learners often select Device Restrictions (A) assuming it controls all Windows Update settings, or App Configuration Policies (B), which are irrelevant to OS-level enrollment features.
Community Discussion (34 comments)
ThomasE
👍 1
Selected: DE
Custom device configuration profile: Windows Update for Business setting then Manage Preview Builds. Update Rings
7a9c653
👍 1
Selected: DE
There is nothing related to Windows Insider on Device Restrictions.
ModernoDecor
👍 3
Selected: AE
Question is outdated. Windows update rings: You can only enable "Enable pre-release builds" or leave it as not configured, but it doesn't block. To disable: Configuration Profile > Settings Catalog > Manage preview builds > set to "Disable preview builds"
fartphilosopher89
👍 3
Selected: AE
A and E
_Dinkan_
👍 1
Selected: DE
D. a custom device configuration profile E. a Windows 10 and later update ring https://learn.microsoft.com/en-us/intune/intune-service/protect/windows-update-settings https://learn.microsoft.com/en-us/intune/intune-service/protect/windows-update-settings#update-settings
cd2cfde
👍 2
Selected: DE
Originally thought it was A but I checked device restriction and there was no option there for this. So it is DE
aj.davies01
👍 5
Selected: AE
A + E is the most correct and recommended answer, as it: Blocks user interaction with Insider settings (A) Enforces update policies to prevent Insider builds (E) Uses official and supported Intune methods Requires less effort and is more maintainable than using custom profiles
theptr
👍 2
Selected: AE
A and E is correct
MCI
👍 2
Selected: AE
A. a device restrictions device configuration profile E. a Windows 10 and later update ring
b3c32d7
👍 2
Selected: DE
DE are the only ways I can see in intune, in device restrictions there's no windows update options to select, but can in settings catalog, which is not an option here. In custome device config you can use following Name: Block Windows Insider Program OMA-URI: ./Vendor/MSFT/Policy/Config/Update/AllowBuildPreview Data type: Integer Value: 0 (to disable)
RJTW070
👍 2
Selected: AE
This allows you to disable access to the Windows Insider settings in the Settings app, preventing users from enrolling in the program. E. A Windows 10 and later update ring In Intune, you can configure an update ring to control Windows Update settings, including preventing devices from receiving Windows Insider builds.
458184c
👍 1
Selected: AE
To prevent users from enrolling devices in the Windows Insider Program, you can use a combination of a device restrictions configuration profile and a Windows 10 and later update ring in Microsoft Intune. The device restrictions profile allows you to explicitly disable access to features like the Windows Insider Program, ensuring users cannot enable pre-release builds. Additionally, the update ring policy can enforce update settings that block devices from downloading and installing Insider builds. These two configurations work together to provide comprehensive control over update management and prevent unauthorized enrollment in pre-release Windows programs, minimizing administrative effort and ensuring compliance with organizational policies.
Tr619899
👍 3
Selected: AE
A device restrictions device configuration profile (Option A): Create a device restrictions policy targeting Windows 10. In the settings, navigate to General and set Enable Preview Builds to Blocked to prevent devices from being enrolled in the Windows Insider Program. A Windows 10 and later update ring (Option E): Create a Windows 10 update ring policy. In the Settings section, under Update Settings, set Enable Preview Builds to Not Allowed to ensure that devices do not install preview builds from the Windows Insider Program.
ThomasE
👍 1
Looks like they've removed this option from the General section.
1655b71
👍 1
A and E To prevent access to the Windows Insider Program, the most appropriate configurations are likely: A. A device restrictions device configuration profile: This can be used to set device restrictions, including blocking access to certain system settings that could allow users to enroll in the Insider Program. E. A Windows 10 and later update ring: This can be configured to control the type of updates that devices receive, including limiting updates to stable releases and excluding Insider builds. So, the correct answers should be: A. A device restrictions device configuration profile and E. A Windows 10 and later update ring.
EUC_PRO
👍 1
Selected: AE
A and E are correct
Cezt
👍 2
A, E proven, update ring can set to not configured in case someone already enrolled device restrictions. to block access to update settings
oopspruu
👍 3
Selected: AE
A : If you set Telemetery to required in Device Restrictions, they cannot get preview builds as it needs Optional Telemetery. E: Use update ring to block preview builds. Source: I just implemented this last week.
Prasis
👍 2
A and E. To prevent users from enrolling their devices in the Windows Insider Program using Microsoft Intune, you can perform the following configurations: Device Restrictions Device Configuration Profile: This configuration allows you to set up restrictions on the devices. You can create a device restrictions profile in Intune to control features on enrolled devices. Windows 10 and Later Update Ring: This configuration allows you to manage when Windows 10 updates are received by devices in your organization. You can create an update ring in Intune to specify how and when updates are delivered to devices
SaiK1234
👍 4
DE. It is not in Device Restrictions. It is Configuration -> Setting Catalog -> Windows Update for Business -> Manage Preview Builds. This option is not there. So its D and E.
MR_Eliot
👍 2
Selected: DE
DE is correct.
Krayzr
👍 1
Selected: AE
A. Device restrictions device configuration profile: This profile allows you to restrict access to specific features and settings on devices. Under "Windows Feature Experience", configure "Allow access to diagnostic data in the Windows Insider Program" to "Block". E. Windows 10 and later update ring: Update rings control which updates devices receive through Intune. Create a new update ring with the "Update channel" set to "None (security updates only)". Assign this update ring to the devices you want to prevent from joining the Insider Program.
NoursBear
👍 1
The 30 days represents an upgrade of Windows Version through a feature update not a standard feature update
Merrybob
👍 1
Selected: DE
DE Ref: https://www.petervanderwoude.nl/post/managing-windows-insider-preview-builds-within-the-organization/
Murad01
👍 1
I would go for A and D.
frack
👍 1
Selected: AE
custom is almost legacy as it requires OMA-URI, always the last resort
Tonsku
👍 2
Selected: AE
A. Create a device restrictions device configuration profile E. Create a Windows 10 and later update ring
yosry
👍 1
seems correct
chandravamsi
👍 1
Selected: AC
Option A,C
NoursBear
👍 1
D can be used in two ways either with a custom setting and OMA-URI or using the settings catalog /Windows Update for Business/Manage Preview Builds. Nothing found under Device Restrictions
ExamKiller020
👍 15
Selected: DE
Given answers are correct. Ref: https://learn.microsoft.com/en-us/windows-insider/business/manage-builds#set-up-insider-preview-builds-using-intune Ref: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-Update?WT.mc_id=Portal-fx#managepreviewbuilds
BJS78
👍 3
Device restriction: no windows update reference, so no Insider App policy has no business here Security baseline has no Insider setting Custom profile: CSP/OMA-RUI for Update/ManagePreviewBuilds Update ring: "Enable pre-release builds" So, DE is correct
picho707
👍 6
To prevent users from enrolling their devices in the Windows Insider Program using Microsoft Intune, you should perform the following two configurations from the Microsoft Intune admin center: A. Create a device restrictions device configuration profile: This profile allows you to enforce restrictions and settings on Windows 10 devices. You can use this to prevent users from joining the Windows Insider Program. E. Create a Windows 10 and later update ring: By configuring an update ring, you can control the release of Windows updates to devices. By setting the update ring to a stable release channel, you can prevent users from receiving Insider Preview builds, which are part of the Windows Insider Program.
Grg433
👍 9
Selected: AD
I think it should be A and D. A. Device restrictions device configuration profile: You can use this profile to enforce specific settings on Windows 10 devices, including preventing enrollment in the Windows Insider Program. D. Custom device configuration profile: Creating a custom device configuration profile allows you to define specific settings and restrictions for your Windows 10 devices, including preventing enrollment in the Windows Insider Program.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
To effectively prevent enrollment in the Windows Insider Program, you must address both the user interface visibility and the actual update source. Option A (Device restrictions profile) allows you to block access to the 'Get Started' experience and related UI elements that facilitate joining the program. Option E (Windows 10 and later update ring) is the primary mechanism to control whether devices receive pre-release builds; configuring this policy ensures that even if a user bypasses UI restrictions, the device won't receive Insider builds.Why the Other Options Are Wrong
Option B (App configuration policy) is used for app-specific settings, not OS enrollment. Option C (Security baseline) provides recommended settings but does not inherently block Insider enrollment as a primary function compared to explicit update rings. Option D (Custom device configuration profile) could technically achieve this via CSPs, but standard profiles (A and E) are the intended, supported methods for these specific business goals, making them the 'complete solutions' preferred in exam contexts.Community Comment Notes
Community consensus is split, with some favoring DE (Custom Profile + Update Ring) because they believe the 'Manage Preview Builds' setting is only available in the Settings Catalog under Update Rings, not in Device Restrictions. However, others argue that blocking the UI via Device Restrictions (A) combined with the Update Ring (E) is the standard approach. One commenter noted, "It is not in Device Restrictions... So its D and E," highlighting the confusion over where the specific CSP is exposed in the Intune UI versus what is theoretically possible.Official Reference
Exam Strategy
Focus on the hierarchy of Intune policies: Use Update Rings for controlling build types and Device Restrictions for limiting user access to specific OS features or UI elements.
Frequently Asked Questions
Why isn't a Security Baseline enough?
Security baselines provide recommendations but don't explicitly block Insider enrollment by default without additional customization.
Can I use a Custom Profile instead?
Yes, via OMA-URI CSPs, but standard profiles are simpler and preferred for these common business requirements.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →