MD-102 cheat sheet

Intune is included in Microsoft 365 E3/E5, EMS E3/E5, and standalone plans; each enrolling user or device needs an Intune license assigned.

The MDM authority must be set to Intune (or Intune co-management) before any device can enroll; it is a tenant-wide, one-time setting.

Windows Autopilot requires a device hardware hash (CSV, one row per device) imported into Intune plus an Autopilot deployment profile assigned to a device group.

The Enrollment Status Page is configured per Autopilot profile and can block desktop access until assigned apps and policies finish; the default timeout is 60 minutes.

Apple management requires an APNs MDM push certificate renewed annually with the same Apple ID, plus an Apple Business Manager token for automated device enrollment.

Android Enterprise requires binding a managed Google Play account; fully managed, dedicated, and work profile enrollments each use a separate enrollment profile.

Dynamic group rules use syntax such as user.department -eq "Sales" or device.deviceOSType -eq "Windows"; dynamic membership requires Entra ID Premium P1.

Scope tags limit which Intune objects an admin can see; a role assignment combines an RBAC role, a scope tag, and an assigned scope group.

SCEP certificate deployment requires the Intune Certificate Connector with the NDES role; PKCS certificates require only the certificate connector.

Configuration profile types are Settings catalog, administrative templates, templates (Wi-Fi, VPN, email, certificates), and custom profiles built on OMA-URI paths.

Custom OMA-URI settings use a path of the form ./Vendor/MSFT// with a data type of string, integer, boolean, or base64.

When two policies assign different values to the same setting, Intune reports a conflict and applies neither value until one policy changes.

Noncompliance actions in a compliance policy run in the configured order after the schedule elapses (for example, mark noncompliant, email the user, remote lock).

Conditional Access can require a compliant device, a hybrid Entra joined device, or an approved client app; it needs Entra ID P1 and a compliance policy.

Windows update rings control deferral days for quality and feature updates, active hours, restart grace periods, and update deadlines.

Remote actions differ: Retire removes company data only, Wipe factory-resets, Fresh Start reinstalls Windows keeping optional user data, Autopilot Reset returns to OOBE while keeping Entra join.

Device filters are query-based (for example, device.osVersion -eq "10.0.19045") and scope assignments without creating additional Entra ID groups.

Endpoint security policies cover antivirus, disk encryption, firewall, attack surface reduction, endpoint detection and response, and account protection.

ASR rules support block, audit, and warn modes; audit mode logs the behavior that would have been blocked without blocking it.

Silent BitLocker enablement needs a TPM, an Entra joined or hybrid device, and recovery-key escrow to Entra ID or Intune; conflicting Group Policy can block it.

Defender for Endpoint integration uses a service-to-service connector in Intune, which auto-creates the Defender onboarding policy for Windows devices.

Compliance policies can require a maximum device threat level from Defender for Endpoint (deviceThreatProtectionLevel); higher risk marks the device noncompliant.

MAM app protection policies protect corporate data inside managed apps on devices that are not enrolled and support selective wipe of app data.

Windows LAPS stores local administrator passwords in Entra ID or Active Directory, rotates them per policy, and allows retrieval by authorized admins.

The MDM security baseline is delivered as a device configuration profile; settings left at default follow Microsoft recommendations and each setting can be overridden.

Win32 apps must be packaged as .intunewin with the Microsoft Win32 Content Prep Tool before upload, and require install and uninstall commands plus a detection rule.

Detection rule types are MSI product code, file or folder, registry, and PowerShell script; script detection runs in the 32-bit or 64-bit context you configure.

Requirement rules (OS version, architecture, disk space, custom script) decide whether an app installs on a device; detection rules decide whether it is already installed.

Supersedence replaces an older app with a newer one; the 'uninstall previous version' option removes the old app before the new app installs.

Dependencies install before the target app and can be marked to install automatically; circular dependencies are not supported.

Microsoft 365 Apps deployment in Intune selects the update channel, version, and which Office apps install, and can remove existing MSI versions.

App protection policies define data relocation rules (block copy/paste, block save-as, block backup) and conditional launch checks (minimum OS, jailbreak, offline grace).

App configuration policies deliver settings to managed apps and support the managed apps, managed devices, and enrolled devices channels.

iOS and macOS volume-purchased apps come from Apple Business Manager through a VPP token; Android store apps come from managed Google Play.

Endpoint analytics scores startup performance, app reliability, and work-from-anywhere; it uses enrolled Windows devices that send the required diagnostic data.

Proactive remediations pair a detection script with a remediation script, run in system or user context on a schedule (once, hourly, or daily), and log output to Intune.

Platform scripts run once by default; options include running in 64-bit PowerShell, enforcing signature check, and running with the signed-in user's credentials.

Built-in Intune reports cover device compliance, configuration, app installation, and Windows update status, and can be exported to CSV.

The Intune Data Warehouse exposes OData feeds, while Microsoft Graph and the export API provide programmatic access to reporting data.

Collect diagnostics is a remote action that gathers Windows logs from a device and uploads them to Intune for troubleshooting.

Windows Update for Business reports run in Log Analytics and depend on devices sending diagnostic data; they show update compliance and deployment failures.

Intune audit logs record administrative and service changes, are retained for one year, and can be exported or streamed to Azure Monitor or Event Hub.

Delivery Optimization download modes are HTTP only, LAN peer, Internet peer, and bypass; group IDs isolate peer caching between device sets.