Auto-Register and Enroll Existing Domain PCs
Answer
Correct answer: B — link a Group Policy object that triggers hybrid Microsoft Entra ID registration and automatic Intune MDM enrollment for the existing domain computers.
Your network contains an Active Directory domain. The domain contains 2,000 computers that run Windows 10. You implement hybrid Azure AD and Microsoft Intune. You need to automatically register all the existing computers to Azure AD and enroll the computers in Intune. The solution must minimize administrative effort. What should you use?
Community Insight
The question tests choosing the lowest-touch bulk enrollment method for already-deployed domain computers; the trap is picking Windows Autopilot (D) because it sounds automated, when Autopilot is an out-of-box/reset-based path and does not silently convert existing production machines.
This MD-102 scenario asks how to bulk-register 2,000 existing Windows 10 domain-joined computers to Microsoft Entra ID (hybrid Azure AD join) and enroll them in Intune with the least administrative effort. The Microsoft-documented answer is a Group Policy object, which targets the computer objects already in Active Directory and triggers both registration and MDM enrollment at next user sign-in.
Option D (Windows Autopilot deployment profile) is the most tempting wrong pick because Autopilot sounds like the 'zero-touch' choice, but Autopilot applies to device provisioning during OOBE or a full reset — it would wipe 2,000 in-service computers, which is the opposite of minimal effort.
Community Discussion (27 comments)
ModernoDecor
👍 1
Selected: B
Deploy Hybrid Join GPO: Enable "Automatic MDM enrollment using default Microsoft Entra credentials" so PCs automatically enroll in Intune. ○ Computer Configuration > Administrative Templates > Windows Components > MDM> Enable automatic MDM enrollment using default Microsoft Entra credentials > link the GPO to the Security group with required PCs
CheMetto
👍 1
Selected: B
https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join Guys, it's an SCP! it's just one-time. Within GPO you need to: Apply gpo to all OU you have Be sure GPO is applied Remember to apply it when you create new ou With SCP -> configure it -> done. you can forget about it!
ThomasE
👍 1
I think the minimizing administrative effort rules out the SCP?
lwd947
👍 1
Selected: D
Why not D? Autopilot reset would be the least privilige for this requirement in my opinion.
marcelina50
👍 1
The administrative effor would be extended to perform Windows Autopilot for 2k devices. The question is only about add the devices to Entra ID and enroll them in intune. A simple GPO to joined them to Entra ID (hybrid join) and automatic enrollment (simple confi) would be less effort then Autopilot. This is my opinion, could be wrong but i would go with the GPO answer.
Cezt
👍 2
Selected: C
https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy#:~:text=Service%20connection%20point%20(SCP)%20configuration.%20For%20more%20information%2C%20see%20configuring%20the%20SCP%20using%20Microsoft%20Entra%20Connect
oopspruu
👍 2
Selected: B
the GPO policy can hybrid join existing devices to Intune without resetting. That has been the standard practice when you want to go from fully on-prem to Intune managed.
CJL324
👍 1
B. a Group Policy object (GPO). You can create and deploy a Group Policy object (GPO) that configures the devices for hybrid Azure AD join and Intune enrollment. This GPO can include settings such as enabling hybrid Azure AD join and configuring automatic enrollment in Intune. Once applied, the GPO will automatically register all existing computers to Azure AD and enroll them in Intune, ensuring they are properly managed without requiring manual intervention on each device.
TMpics
👍 1
B. a Group Policy object (GPO) Correct
mhmyz
👍 1
Selected: C
I think SCP is most simple way.I have experience configuring it. https://learn.microsoft.com/en-us/entra/identity/devices/how-to-hybrid-join The second method is GPO. Used when joining partial devices to Hybrid AD.
2938b52
👍 1
You are wrong! You have an AD domain, you have to register computers to Azure AD & enroll in Intune. Service Connection Point (SCP) is used by devices to find tenant info for Azure AD registration, but it does NOT perform the subsequent Intune enrollment. Having an AD domain (on-prem) should be a clue to use GPO. For 2K existing domain-joined computers, a GPO allows you to centrally push configuration settings to all devices simultaneously. A GPO can be used to enable the automatic MDM enrollment of hybrid-joined devices. Once the policy is linked to the appropriate Organizational Unit (OU), the enrollment process triggers automatically upon the next policy refresh or reboot without manual intervention on individual devices. Easy peasy.
MR_Eliot
👍 2
Selected: B
Correct answer is C. Key is lease administrative effort!!! https://youtu.be/Q15ZXyvzQfs?si=8Am2s2H-qN2TtvLa
MR_Eliot
👍 1
Answer is C!
Krayzr
👍 1
Selected: B
B. a Group Policy object (GPO)
Pasado
👍 2
ChatGPT: To automatically register all existing computers to Azure AD and enroll them in Intune with minimal administrative effort, you should use Windows Autopilot deployment profile (option D). Autopilot allows you to pre-register devices with Azure AD and enroll them in Intune as part of the out-of-box experience for end-users. This helps streamline the deployment process and reduces the need for manual intervention.
sergioandreslq
👍 6
ChatGPT is lost in the answer, instead of just copy paste ChatGPT's answer, I recommend you analyze it a little bit more the answer before publishing it here, This kind of answer just adds noise to people you are trying to add value why the answer.
Krayzr
👍 4
Once the GPO is applied, computers will automatically register with Azure AD and enroll in Intune when users sign in with their Azure AD credentials. Why the other options are not suitable: Autodiscover address record and Autodiscover service connection point (SCP): These are used for discovering Exchange server settings in Outlook clients, not for device registration or enrollment. Windows Autopilot deployment profile: This is used for streamlining the setup of new devices, not for managing existing devices.
Krayzr
👍 2
Selected: B
The answer is B. a Group Policy object (GPO).
Krayzr
👍 4
Here's why: GPOs are the most efficient way to automate registration and enrollment for existing devices in a hybrid Azure AD environment. They allow you to apply settings to a large number of devices centrally, minimizing the administrative effort involved. Here's how it works: Create a GPO: Use the Group Policy Management Console (GPMC) to create a new GPO that targets the computers you want to enroll. Enable automatic MDM enrollment: Within the GPO, enable the policy setting for "Enable automatic MDM enrollment using default Azure AD credentials." Configure MDM user scope: Specify whether the enrollment applies to all users or a specific group of users. Apply the GPO: Link the GPO to the appropriate Active Directory organizational unit (OU) to apply it to the targeted computers.
Amir1909
👍 2
B is correct
yosry
👍 2
Selected: B
B IS CORRECT
chandravamsi
👍 2
Selected: D
Optin: D
chandravamsi
👍 2
Selected: B
Group policy Object
h38jhd38k
👍 5
It is a trick question because least administrative is Windows Autopilot which would reset the devices. If resetting the device is a concern then it would GPO. Hopefully the exam isn't as vague as this question is
VirtualJP
👍 3
Selected: B
Agreed
BJS78
👍 2
GPO and Autopilot both can do it, but as we migrate prod devices, it is quite possible we don't want to reset the devices, so this way "B" is better.
Fortind1974
👍 19
Selected: B
B. a Group Policy object (GPO) https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A Group Policy object (B) is Microsoft's documented method for enrolling existing Windows 10 domain devices automatically: once the GPO is linked to the OU holding the computers, the devices perform hybrid Microsoft Entra ID registration and Intune MDM enrollment the next time a user signs in with Entra ID credentials. Because the objects already exist in Active Directory, no per-device touch, reset, or reimage is required — one GPO covers all 2,000 machines, which is exactly the "minimize administrative effort" requirement. The Microsoft Learn article "Enroll a Windows 10 device automatically using Group Policy" is the authoritative source for this workflow, and the related prerequisites (SCP configuration via Microsoft Entra Connect) are infrastructure prep, not the enrollment mechanism the question asks you to choose.Why the Other Options Are Wrong
Option A and C both describe Autodiscover artifacts — an Autodiscover address record is a DNS record used by Outlook to find Exchange Online/Exchange Server settings, and the Autodiscover service connection point is an Exchange object in Active Directory; neither registers devices with Entra ID nor enrolls them in Intune. Option D, a Windows Autopilot deployment profile, is designed for provisioning new or reset devices through the out-of-box experience; applying it to 2,000 production Windows 10 computers would require reconfiguring or wiping them, which dramatically increases rather than minimizes effort. Note the distinction that trips people up: the hybrid join SCP is configured with Microsoft Entra Connect, but it is not an "Autodiscover SCP," so option C is a distractor built on that confusion.Community Comment Notes
Fortind1974 gave B and linked the official Learn page "enroll-a-windows-10-device-automatically-using-group-policy," which is the direct authority for this scenario. Krayzr explained that once the GPO applies, "computers will automatically register with Azure AD and enroll in Intune when users sign in with their Azure AD credentials." oopspruu added that "the GPO policy can hybrid join existing devices to Intune without resetting," while h38jhd38k argued that Autopilot would be least effort but acknowledged it "would reset the devices." MR_Eliot wrote "Correct answer is C. Key is lease administrative effort!!!" — but the SCP he references is only the hybrid-join prerequisite configured through Entra Connect, not the enrollment mechanism, and option C explicitly says Autodiscover SCP, which is Exchange.Official Reference
Exam Strategy
When a question asks for the lowest-effort way to affect already-deployed machines, favor a centrally linked policy (GPO, Intune configuration profile) over any option that implies resetting, reimagining, or touching each device. Read option wording literally — 'Autodiscover SCP' is an Exchange construct, not the Entra Connect hybrid join SCP.
Frequently Asked Questions
Why is a Windows Autopilot deployment profile not the lowest-effort option here?
Autopilot profiles drive the out-of-box experience or a full device reset, so applying one to 2,000 in-service Windows 10 PCs would require wiping them. A GPO enrolls the machines in place at next sign-in.
Isn't the service connection point (SCP) what registers devices for hybrid join?
The hybrid join SCP is configured through Microsoft Entra Connect, but the option listed here is an Autodiscover SCP, which is an Exchange object. The SCP is a prerequisite, while the GPO is the bulk enrollment mechanism for existing computers.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →