MD-102 flashcards
MD-102 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- MDM authority
- Setting in Intune that determines which service manages enrolled devices; it must be set to Intune before devices can enroll and applies tenant-wide.
- Autopilot hardware hash
- Unique identifier collected with the Get-WindowsAutopilotInfo script and imported into Intune so a device can be targeted by an Autopilot deployment profile.
- Enrollment Status Page
- Autopilot screen that shows enrollment progress and can block access to the desktop until assigned apps and policies finish installing.
- Apple MDM push certificate
- Certificate uploaded to Intune from the Apple Push Certificates Portal; it is required to manage Apple devices and must be renewed yearly with the same Apple ID.
- Scope tag
- Label applied to Intune objects and to admin accounts; admins see only objects tagged with their scope tags, which limits visibility in large tenants.
- Dynamic device group rule
- Entra ID membership rule based on device attributes such as deviceOSType or deviceCategory; creating dynamic groups requires Entra ID Premium P1 licenses.
- NDES certificate connector
- On-premises Intune Certificate Connector with the NDES role that issues SCEP certificates to managed devices from an enterprise certification authority.
- OMA-URI custom profile
- Configuration profile that sets a Windows policy not exposed in the Intune UI, identified by a path such as ./Vendor/MSFT/Policy/Config.
- Compliance policy actions
- Ordered list of actions, such as sending email or remotely locking a device, that Intune runs after a device is marked noncompliant.
- Update ring deferral
- Number of days a Windows update ring waits before offering quality or feature updates to the devices assigned to it.
- Retire versus wipe
- Retire removes company data and management while leaving personal files intact; wipe resets the device to factory settings and removes everything.
- Autopilot Reset
- Remote action that removes user files, apps, and policies and returns the device to the out-of-box experience while keeping it Entra joined and Autopilot registered.
- Device filter
- Query on device properties, such as OS version or manufacturer, that scopes a policy or app assignment without creating additional Entra ID groups.
- Configuration profile conflict
- State reported when two policies assign different values to the same setting; Intune stops applying that setting until the conflict is resolved.
- Attack surface reduction rules
- Defender settings that block, audit, or warn on behaviors such as Office apps spawning child processes or code stealing credentials from lsass.exe.
- BitLocker recovery key escrow
- Storing BitLocker recovery keys in Entra ID or Intune; silent encryption on Entra joined devices requires the escrow step to succeed.
- Security baseline
- Preconfigured collection of Microsoft-recommended security settings deployed as a profile, where each setting can stay at default or be customized.
- Defender for Endpoint onboarding
- Connecting Intune to Defender for Endpoint with the service-to-service connector, then deploying the onboarding configuration to devices so they report risk.
- MAM without enrollment
- App protection policies tied to a user identity that protect corporate data in managed apps on devices that are not enrolled in MDM.
- Windows LAPS
- Feature that manages and rotates local administrator passwords and backs them up to Entra ID or Active Directory so admins can retrieve them.
- Intunewin package
- Encrypted package produced by the Microsoft Win32 Content Prep Tool that wraps an app's installer and source files for upload to Intune.
- Win32 detection rule
- Rule that tells Intune an app is installed, using an MSI product code, a file or folder, a registry key, or a custom PowerShell script.
- App supersedence
- Relationship in which a newer app replaces an older one, with the option to uninstall the previous version before the new one installs.
- App dependency
- Relationship that makes another app install first; Intune installs dependencies in order before attempting the dependent app.
- App protection conditional launch
- Requirements such as a minimum OS version or a non-jailbroken device that must be met before a managed app grants access to corporate data.
- App configuration policy
- Policy that supplies settings such as server URLs or app behavior to a managed application without managing the whole device.
- Endpoint analytics score
- Intune score built from startup performance, app reliability, and work-from-anywhere metrics collected from enrolled Windows devices.
- Proactive remediation
- Feature that pairs a detection script with a remediation script, runs them on a schedule, and reports the outcome to Intune.
- Platform script
- PowerShell script Intune sends to Windows devices; it runs once by default and can use 64-bit PowerShell or require signature checks.
- Intune Data Warehouse
- OData reporting service that stores Intune inventory, compliance, and app data so it can be queried with Power BI or custom tools.
- Collect diagnostics
- Remote action that gathers Windows logs and telemetry from a device and uploads them to Intune for troubleshooting.
- Windows Update for Business reports
- Reports built on Log Analytics that show Windows update compliance and deployment status from devices sending diagnostic data to Microsoft.