Auto-Register and Enroll Existing Domain PCs

MD-102 By islever Editorial Last updated

Add devices to Microsoft Entra ID Enroll devices to Microsoft Intune

Short answer

B Link a Group Policy object that triggers hybrid Microsoft Entra ID registration and automatic Intune MDM enrollment for the existing domain computers.

Question

Your network contains an Active Directory domain. The domain contains 2,000 computers that run Windows 10.
You implement hybrid Azure AD and Microsoft Intune.
You need to automatically register all the existing computers to Azure AD and enroll the computers in Intune. The solution must minimize administrative effort.
What should you use?
  1. an Autodiscover address record
  2. a Group Policy object (GPO) Correct Answer
  3. an Autodiscover service connection point (SCP)
  4. a Windows Autopilot deployment profile

Key Takeaways

The question tests choosing the lowest-touch bulk enrollment method for already-deployed domain computers; the trap is picking Windows Autopilot (D) because it sounds automated, when Autopilot is an out-of-box/reset-based path and does not silently convert existing production machines.

This MD-102 scenario asks how to bulk-register 2,000 existing Windows 10 domain-joined computers to Microsoft Entra ID (hybrid Azure AD join) and enroll them in Intune with the least administrative effort. The Microsoft-documented answer is a Group Policy object, which targets the computer objects already in Active Directory and triggers both registration and MDM enrollment at next user sign-in.

Common mistake: Option D (Windows Autopilot deployment profile) is the most tempting wrong pick because Autopilot sounds like the 'zero-touch' choice, but Autopilot applies to device provisioning during OOBE or a full reset — it would wipe 2,000 in-service computers, which is the opposite of minimal effort.

Expert Analysis

Why the Answer Is Correct

A Group Policy object (B) is Microsoft's documented method for enrolling existing Windows 10 domain devices automatically: once the GPO is linked to the OU holding the computers, the devices perform hybrid Microsoft Entra ID registration and Intune MDM enrollment the next time a user signs in with Entra ID credentials. Because the objects already exist in Active Directory, no per-device touch, reset, or reimage is required — one GPO covers all 2,000 machines, which is exactly the "minimize administrative effort" requirement. The Microsoft Learn article "Enroll a Windows 10 device automatically using Group Policy" is the authoritative source for this workflow, and the related prerequisites (SCP configuration via Microsoft Entra Connect) are infrastructure prep, not the enrollment mechanism the question asks you to choose.

Why the Other Options Are Wrong

Option A and C both describe Autodiscover artifacts — an Autodiscover address record is a DNS record used by Outlook to find Exchange Online/Exchange Server settings, and the Autodiscover service connection point is an Exchange object in Active Directory; neither registers devices with Entra ID nor enrolls them in Intune. Option D, a Windows Autopilot deployment profile, is designed for provisioning new or reset devices through the out-of-box experience; applying it to 2,000 production Windows 10 computers would require reconfiguring or wiping them, which dramatically increases rather than minimizes effort. Note the distinction that trips people up: the hybrid join SCP is configured with Microsoft Entra Connect, but it is not an "Autodiscover SCP," so option C is a distractor built on that confusion.

Community Comment Notes

Fortind1974 gave B and linked the official Learn page "enroll-a-windows-10-device-automatically-using-group-policy," which is the direct authority for this scenario. Krayzr explained that once the GPO applies, "computers will automatically register with Azure AD and enroll in Intune when users sign in with their Azure AD credentials." oopspruu added that "the GPO policy can hybrid join existing devices to Intune without resetting," while h38jhd38k argued that Autopilot would be least effort but acknowledged it "would reset the devices." MR_Eliot wrote "Correct answer is C. Key is lease administrative effort!!!" — but the SCP he references is only the hybrid-join prerequisite configured through Entra Connect, not the enrollment mechanism, and option C explicitly says Autodiscover SCP, which is Exchange.

Official Reference

https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks for the lowest-effort way to affect already-deployed machines, favor a centrally linked policy (GPO, Intune configuration profile) over any option that implies resetting, reimagining, or touching each device. Read option wording literally — 'Autodiscover SCP' is an Exchange construct, not the Entra Connect hybrid join SCP.

Frequently Asked Questions

Why is a Windows Autopilot deployment profile not the lowest-effort option here?

Autopilot profiles drive the out-of-box experience or a full device reset, so applying one to 2,000 in-service Windows 10 PCs would require wiping them. A GPO enrolls the machines in place at next sign-in.

Isn't the service connection point (SCP) what registers devices for hybrid join?

The hybrid join SCP is configured through Microsoft Entra Connect, but the option listed here is an Autodiscover SCP, which is an Exchange object. The SCP is a prerequisite, while the GPO is the bulk enrollment mechanism for existing computers.

More MD-102 FAQ →

Discussion 26 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 26

  1. Fortind1974 👍 19 Answered B
    B. a Group Policy object (GPO) https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy
  2. sergioandreslq 👍 6
    ChatGPT is lost in the answer, instead of just copy paste ChatGPT's answer, I recommend you analyze it a little bit more the answer before publishing it here, This kind of answer just adds noise to people you are trying to add value why the answer.
  3. h38jhd38k 👍 5
    It is a trick question because least administrative is Windows Autopilot which would reset the devices. If resetting the device is a concern then it would GPO. Hopefully the exam isn't as vague as this question is
  4. Krayzr 👍 4
    Here's why: GPOs are the most efficient way to automate registration and enrollment for existing devices in a hybrid Azure AD environment. They allow you to apply settings to a large number of devices centrally, minimizing the administrative effort involved. Here's how it works: Create a GPO: Use the Group Policy Management Console (GPMC) to create a new GPO that targets the computers you want to enroll. Enable automatic MDM enrollment: Within the GPO, enable the policy setting for "Enable automatic MDM enrollment using default Azure AD credentials." Configure MDM user scope: Specify whether the enrollment applies to all users or a specific group of users. Apply the GPO: Link the GPO to the appropriate Active Directory organizational unit (OU) to apply it to the targeted computers.
  5. Krayzr 👍 4
    Once the GPO is applied, computers will automatically register with Azure AD and enroll in Intune when users sign in with their Azure AD credentials. Why the other options are not suitable: Autodiscover address record and Autodiscover service connection point (SCP): These are used for discovering Exchange server settings in Outlook clients, not for device registration or enrollment. Windows Autopilot deployment profile: This is used for streamlining the setup of new devices, not for managing existing devices.
Show 21 more comments
  1. VirtualJP 👍 3 Answered B
    Agreed
  2. Pasado 👍 2
    ChatGPT: To automatically register all existing computers to Azure AD and enroll them in Intune with minimal administrative effort, you should use Windows Autopilot deployment profile (option D). Autopilot allows you to pre-register devices with Azure AD and enroll them in Intune as part of the out-of-box experience for end-users. This helps streamline the deployment process and reduces the need for manual intervention.
  3. Cezt 👍 2 Answered C
    https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy#:~:text=Service%20connection%20point%20(SCP)%20configuration.%20For%20more%20information%2C%20see%20configuring%20the%20SCP%20using%20Microsoft%20Entra%20Connect
  4. oopspruu 👍 2 Answered B
    the GPO policy can hybrid join existing devices to Intune without resetting. That has been the standard practice when you want to go from fully on-prem to Intune managed.
  5. BJS78 👍 2
    GPO and Autopilot both can do it, but as we migrate prod devices, it is quite possible we don't want to reset the devices, so this way "B" is better.
  6. MR_Eliot 👍 2 Answered B
    Correct answer is C. Key is lease administrative effort!!! https://youtu.be/Q15ZXyvzQfs?si=8Am2s2H-qN2TtvLa
  7. Krayzr 👍 2 Answered B
    The answer is B. a Group Policy object (GPO).
  8. chandravamsi 👍 2 Answered B
    Group policy Object
  9. Amir1909 👍 2
    B is correct
  10. chandravamsi 👍 2 Answered D
    Optin: D
  11. 2938b52 👍 1
    You are wrong! You have an AD domain, you have to register computers to Azure AD & enroll in Intune. Service Connection Point (SCP) is used by devices to find tenant info for Azure AD registration, but it does NOT perform the subsequent Intune enrollment. Having an AD domain (on-prem) should be a clue to use GPO. For 2K existing domain-joined computers, a GPO allows you to centrally push configuration settings to all devices simultaneously. A GPO can be used to enable the automatic MDM enrollment of hybrid-joined devices. Once the policy is linked to the appropriate Organizational Unit (OU), the enrollment process triggers automatically upon the next policy refresh or reboot without manual intervention on individual devices. Easy peasy.
  12. CJL324 👍 1
    B. a Group Policy object (GPO). You can create and deploy a Group Policy object (GPO) that configures the devices for hybrid Azure AD join and Intune enrollment. This GPO can include settings such as enabling hybrid Azure AD join and configuring automatic enrollment in Intune. Once applied, the GPO will automatically register all existing computers to Azure AD and enroll them in Intune, ensuring they are properly managed without requiring manual intervention on each device.
  13. marcelina50 👍 1
    The administrative effor would be extended to perform Windows Autopilot for 2k devices. The question is only about add the devices to Entra ID and enroll them in intune. A simple GPO to joined them to Entra ID (hybrid join) and automatic enrollment (simple confi) would be less effort then Autopilot. This is my opinion, could be wrong but i would go with the GPO answer.
  14. ModernoDecor 👍 1 Answered B
    Deploy Hybrid Join GPO: Enable "Automatic MDM enrollment using default Microsoft Entra credentials" so PCs automatically enroll in Intune. ○ Computer Configuration > Administrative Templates > Windows Components > MDM> Enable automatic MDM enrollment using default Microsoft Entra credentials > link the GPO to the Security group with required PCs
  15. CheMetto 👍 1 Answered B
    https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join Guys, it's an SCP! it's just one-time. Within GPO you need to: Apply gpo to all OU you have Be sure GPO is applied Remember to apply it when you create new ou With SCP -> configure it -> done. you can forget about it!
  16. mhmyz 👍 1 Answered C
    I think SCP is most simple way.I have experience configuring it. https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join The second method is GPO. Used when joining partial devices to Hybrid AD.
  17. lwd947 👍 1 Answered D
    Why not D? Autopilot reset would be the least privilige for this requirement in my opinion.
  18. ThomasE 👍 1
    I think the minimizing administrative effort rules out the SCP?
  19. TMpics 👍 1
    B. a Group Policy object (GPO) Correct
  20. Krayzr 👍 1 Answered B
    B. a Group Policy object (GPO)
  21. MR_Eliot 👍 1
    Answer is C!

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide