MD-102 key terms

Microsoft's cloud service for endpoint management. Administrators use the Intune admin center to enroll devices, deploy configuration and applications, enforce compliance, and run remote actions across Windows, macOS, iOS/iPadOS, Android, and Linux.

A method of registering a Windows device directly with Microsoft Entra ID (formerly Azure AD) so users sign in with a work account and the device can be managed by Intune without an on-premises domain.

A set of Microsoft cloud services that provisions new Windows devices by applying organization settings and apps during the out-of-box experience, so users receive a ready-to-use device with minimal IT contact.

A profile that defines the setup experience for Autopilot devices, including the deployment mode (user-driven, self-deploying, or pre-provisioning), the join type, and the out-of-box screens users see.

A screen shown during Windows enrollment that tracks installation of assigned apps and policies and can block the user from reaching the desktop until critical items finish.

Intune settings that control which platforms and device types users can enroll, how many devices each user may enroll, and whether personally owned devices are permitted.

A state in which Configuration Manager and Intune both manage the same Windows device, letting an organization shift workloads such as compliance or Windows Update to the cloud gradually.

An Intune label attached to policies, apps, and devices that limits which administrators can see and manage those objects when combined with role assignments.

An Intune policy that delivers device or user settings, such as Wi-Fi, certificates, restrictions, or email, to members of assigned groups.

The Intune interface that gathers settings from many configuration service providers into one searchable list, used to build configuration profiles without starting from a template.

Configuration profiles in Intune that expose the same Group Policy (ADMX) settings used on-premises, letting administrators control Windows policy settings on cloud-managed devices.

An Intune policy that uses Windows Update for Business settings to control deferrals, deadlines, active hours, and restart behavior for quality and feature updates on assigned devices.

Commands an administrator sends from Intune to a device, such as sync, restart, collect diagnostics, retire, wipe, or fresh start, performed without physical access to the hardware.

A Windows agent that Intune installs to run PowerShell scripts, install Win32 apps, and execute remediations, extending what the built-in MDM channel can do.

PowerShell scripts uploaded to Intune that run on Windows devices to change settings not exposed as policy; they execute through the Intune Management Extension and report results.

Rules Intune evaluates when a device checks in, used to include or exclude devices from an app or policy assignment based on properties such as OS version, model, or device name.

The Intune app and website where users enroll devices, install apps made available to them, and review whether their device meets compliance requirements.

Intune rules that state the conditions a device must meet, such as encryption, minimum OS version, or a PIN, and that mark each device as compliant or not compliant.

A Microsoft Entra ID policy that blocks, allows, or adds requirements such as multifactor authentication or a compliant device before a user can reach a cloud app.

A preconfigured collection of Microsoft-recommended security settings for a platform, deployed as a single profile that administrators can customize for their organization.

Intune policy types focused on antivirus, firewall, disk encryption, attack surface reduction, endpoint detection and response, and account protection, managed from the Endpoint security node.

Microsoft Defender Antivirus rules that block behaviors commonly used by malware, such as Office applications launching child processes, while logging or alerting on matching activity.

An Intune endpoint security policy that turns on BitLocker for Windows devices, sets encryption options, and escrows recovery keys so administrators can retrieve them later.

A Windows feature that gives each device a unique, automatically rotated local administrator password and backs it up to Microsoft Entra ID or Active Directory, replacing one shared password.

The process of connecting devices to Microsoft Defender for Endpoint by deploying an onboarding package through Intune, so the service receives security telemetry from them.

Intune policies that protect organizational data inside apps, including on personally owned devices, by controlling copy and paste, save-as, screenshots, and requiring a PIN.

A setting in an app protection policy that warns or blocks access when a condition fails, such as a rooted or jailbroken device, a minimum OS version, or a missing PIN.

A Windows application packaged with the Microsoft Win32 Content Prep Tool into an .intunewin file, then deployed through Intune and installed by the Intune Management Extension.

The part of a Win32 app deployment that tells Intune whether the app is already installed, using a file, folder, registry key, or MSI product code.

An app relationship in which a newer app replaces an older one, so Intune upgrades devices that have the old app and can uninstall it during the update.

A policy that supplies settings to an app, such as a server URL or account name, through managed configuration for mobile apps or registry-style settings for Office and Edge.

The Intune assignment option that decides whether an app installs automatically on targeted devices (required) or is only offered for users to install themselves (available).

An Intune service that scores devices on startup performance, application reliability, and readiness to work from anywhere, and highlights problems that affect users.

An Intune feature that runs a detection script on a schedule and, when a problem is found, runs a remediation script to fix it, reporting results for each device.

The built-in dashboards and reports in the Intune admin center covering compliance, configuration, application installs, updates, and security, with options to export the data.

A configuration that sends Intune diagnostic logs and device data to an Azure Log Analytics workspace, where administrators can query it and build workbooks and alerts.

A REST interface that exposes Intune data and operations, used to automate tasks, build custom reports, and integrate Intune with other systems.

A Microsoft cloud service that automates Windows and Microsoft 365 Apps updates by placing devices in deployment rings and monitoring update health.