I85PREP
⌘ K
MD-102 study materials
MD-102 study resources

MD-102 practice questions

One question at a time. Build your MD-102 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Prepare infrastructure for devices

Which tenant-level setting identifies the MDM service that manages enrolled devices for a Microsoft 365 tenant?

  1. The default device compliance policy
  2. The MDM authority Correct answer.
  3. The Mobility (MDM and MAM) user scope
  4. The device enrollment limit restriction

Explanation

The MDM authority is the tenant-wide designation of the service that manages enrolled devices, and it is set once per tenant before enrollment can occur. Other tenant settings control eligibility, quantities, or post-enrollment evaluation rather than the managing service itself.

Question 2Prepare infrastructure for devices

By default, what is the maximum number of devices that a single user can enroll in Intune before an administrator changes the device limit restriction?

  1. 1 device
  2. 15 devices
  3. 10 devices
  4. 5 devices Correct answer.

Explanation

The default device limit restriction allows each user to enroll up to five devices. Administrators can raise or lower this value in enrollment restrictions when a business scenario requires it.

Question 3Prepare infrastructure for devices

Which built-in Intune role is intended for support staff who must run remote actions such as restart, wipe, and fresh start without being able to manage policies?

  1. Application Manager
  2. Help Desk Operator Correct answer.
  3. Policy and Profile Manager
  4. Intune Role Administrator

Explanation

Help Desk Operator grants the ability to view users and devices and to run remote device actions, which matches a least-privilege support role. Policy authoring and role management are handled by other built-in roles.

Question 4Prepare infrastructure for devices

Which item must be created with an Apple ID and uploaded to Intune before iOS and iPadOS devices can be enrolled?

  1. An Apple Push Notification service (APNs) certificate Correct answer.
  2. An Apple Volume Purchase Program (VPP) token
  3. A third-party code-signing certificate
  4. A Simple Certificate Enrollment Protocol (SCEP) certificate

Explanation

Intune communicates with Apple devices over the Apple MDM protocol by using a push certificate, which is created in the Apple Push Certificates Portal with an Apple ID and then uploaded to Intune. The certificate must be renewed before it expires or managed devices lose contact with the service.

Question 5Prepare infrastructure for devices

Which value collected from a Windows device is uploaded to Intune so that the device can be targeted with a Windows Autopilot deployment profile?

  1. The Microsoft Entra device object ID
  2. The hardware hash Correct answer.
  3. The TPM owner password
  4. The Windows product key

Explanation

Autopilot identifies a device by its hardware hash, together with the serial number and product ID, so that a deployment profile can be applied during the out-of-box experience. The record must exist before the device is started for the first time.

Question 6Prepare infrastructure for devices

Which subscription includes Intune Plan 1 for device management?

  1. Microsoft 365 Business Basic
  2. Exchange Online Plan 2
  3. Microsoft 365 Apps for enterprise
  4. Microsoft 365 E3 Correct answer.

Explanation

Microsoft 365 E3 includes the Intune Plan 1 service that provides device management capabilities. The other subscriptions listed provide productivity apps, mailboxes, or web and mobile app access without device management licensing.

Question 7Prepare infrastructure for devices

A Windows computer is joined to on-premises Active Directory and is also registered with Microsoft Entra ID. Which device identity state describes this computer?

  1. Hybrid Microsoft Entra joined Correct answer.
  2. Microsoft Entra joined
  3. Microsoft Entra joined (cloud only)
  4. Microsoft Entra registered

Explanation

Hybrid Microsoft Entra join describes a device that is joined to on-premises Active Directory and registered with Microsoft Entra ID. A cloud-only Microsoft Entra join means the device has no on-premises domain membership.

Question 8Prepare infrastructure for devices

What must be done before Managed Google Play apps can be delivered to Android Enterprise devices?

  1. Bind the tenant to Managed Google Play Correct answer.
  2. Enable Android device administrator enrollment
  3. Upload the app APK file to Intune
  4. Create a VPP token for the tenant

Explanation

Binding the Intune tenant to Managed Google Play establishes the connection to the store, after which apps are approved in Managed Google Play and synchronized into Intune. Corporate-owned Android Enterprise devices then receive those apps through normal assignments.

Question 9Prepare infrastructure for devices

Administrators must allow only corporate-owned iOS and Android devices to enroll while blocking personally owned devices. Which configuration should they use?

  1. A configuration profile that blocks the Company Portal
  2. Enrollment restrictions Correct answer.
  3. A device compliance policy assigned to all users
  4. An app protection policy for mobile devices

Explanation

Enrollment restrictions define which platforms and ownership types are permitted to enroll, so a device type restriction can block personally owned devices while leaving corporate enrollment open. Compliance and app protection policies act on devices or apps after enrollment has already happened.

Question 10Prepare infrastructure for devices

Users must accept a legal disclaimer in the Company Portal before they can enroll a device. Which object should you create and assign?

  1. A configuration profile
  2. A compliance policy
  3. An app protection policy
  4. Terms and conditions Correct answer.

Explanation

Terms and conditions are assigned to groups, and each user must accept them in the Company Portal before completing enrollment. The acceptance is recorded per user for later reference.

Question 11Prepare infrastructure for devices

Which Intune feature adds a label to resources and to role assignments so that an administrator sees only the devices that carry that label?

  1. Scope tags Correct answer.
  2. Device categories
  3. Role-based access control with device groups
  4. A device compliance policy

Explanation

Scope tags are applied to resources and included in the role assignment, filtering what the administrator can view and manage. A user who is assigned a role with a scope tag sees only resources that carry a matching tag.

Question 12Prepare infrastructure for devices

Which profile prevents a user from reaching the Windows desktop until required apps and policies have been applied during an Autopilot deployment?

  1. A Windows configuration profile
  2. A device compliance policy
  3. An Autopilot deployment profile that sets OOBE options
  4. An Enrollment Status Page profile Correct answer.

Explanation

The Enrollment Status Page tracks required app and policy installation and blocks use of the device until the specified items are complete or a timeout is reached. It is configured as its own profile and assigned to the Autopilot device groups.

Question 13Prepare infrastructure for devices

In co-management, which workload must be moved to Intune before Intune evaluates device compliance?

  1. Compliance policies Correct answer.
  2. Client apps
  3. Resource access policies
  4. Windows Update policies

Explanation

Each co-management workload is authorized by a slider, and compliance evaluation is performed by whichever authority owns the compliance policies workload. Until that workload moves to Intune, the Configuration Manager site remains responsible for compliance.

Question 14Prepare infrastructure for devices

A technician must enroll a large batch of Windows devices at a staging site without any user signing in. Which method should be used?

  1. Group Policy automatic enrollment
  2. A provisioning package with a bulk enrollment token Correct answer.
  3. Manual enrollment through the Company Portal app
  4. Windows Autopilot self-deploying mode

Explanation

A provisioning package built with Windows Configuration Designer can contain a bulk enrollment token, letting a technician join many devices to Microsoft Entra ID and enroll them in Intune without interactive user credentials. The package is applied during the out-of-box experience or from running Windows.

Question 15Prepare infrastructure for devices

What is the maximum number of devices that a single device enrollment manager (DEM) account can enroll?

  1. 500 devices
  2. 100 devices
  3. 5,000 devices
  4. 1,000 devices Correct answer.

Explanation

A device enrollment manager account is intended for staging scenarios and can enroll up to 1,000 devices. It is used instead of the five-device default limit that applies to ordinary user accounts.

Question 16Prepare infrastructure for devices

You want kiosk devices registered with Autopilot to receive a different deployment profile than laptops, without manually moving devices between groups. What should you configure?

  1. Scope tags assigned to the profile
  2. Autopilot device group tags Correct answer.
  3. Device categories
  4. Enrollment restrictions for Windows devices

Explanation

A group tag is written to the Autopilot device record and can be referenced in a dynamic group rule, so the matching deployment profile is applied automatically at enrollment. This avoids manual membership changes as devices are added.

Question 17Prepare infrastructure for devices

Which component must be installed on an on-premises server to issue SCEP certificates to devices from Intune?

  1. The Exchange ActiveSync connector
  2. The Intune Connector for Active Directory
  3. The Intune Certificate Connector Correct answer.
  4. The Microsoft Defender for Endpoint connector

Explanation

SCEP certificate delivery uses a server running the Network Device Enrollment Service together with the Intune Certificate Connector, which polls Intune for pending requests. The connector then submits approved requests to the issuing certification authority.

Question 18Prepare infrastructure for devices

Which feature requires a second administrator to approve certain changes, such as deleting a role assignment, before they take effect?

  1. Just-in-time access
  2. Privileged Identity Management
  3. Conditional Access
  4. Multi-admin approval Correct answer.

Explanation

Multi-admin approval adds a dual-authorization step to selected sensitive Intune operations so that a single administrator cannot complete them alone. The request stays pending until another authorized administrator approves or rejects it.

Question 19Prepare infrastructure for devices

Which DNS record type is used to create the EnterpriseEnrollment and EnterpriseRegistration entries that help devices locate Intune during enrollment for a custom domain?

  1. MX records
  2. SRV records
  3. TXT records
  4. CNAME records Correct answer.

Explanation

Intune enrollment discovery relies on alias records that point the EnterpriseEnrollment and EnterpriseRegistration host names to the Intune service. Creating these records for a custom domain lets users enroll by signing in with an address from that domain.

Question 20Prepare infrastructure for devices

Which Microsoft Entra setting must be configured so that users are automatically enrolled in Intune when their Windows device joins Microsoft Entra ID?

  1. The MDM user scope setting Correct answer.
  2. The device limit restriction
  3. A Conditional Access policy
  4. The MDM terms of use

Explanation

Automatic enrollment depends on the MDM user scope in the Mobility (MDM and MAM) configuration; when the scope includes a user, that user's Microsoft Entra joined device is enrolled at join time. The device must also be licensed for Intune.

Question 21Prepare infrastructure for devices

Which Android Enterprise enrollment type should be used for shared kiosk devices that have no individual user affinity?

  1. Android device administrator enrollment
  2. Corporate-owned dedicated devices Correct answer.
  3. Personally-owned work profile devices
  4. Corporate-owned work profile devices

Explanation

Corporate-owned dedicated devices run in device owner mode with no user affinity, which suits shared kiosks, digital signage, and single-purpose scenarios. Fully managed work profile enrollment and personally owned work profile enrollment both assume an individual user.

Question 22Prepare infrastructure for devices

Which component must be deployed on-premises to support Windows Autopilot with hybrid Microsoft Entra join?

  1. The NDES role installed on the domain controller that issues certificates
  2. The Intune Connector for Active Directory Correct answer.
  3. The Microsoft Entra Connect Sync tool on a member server
  4. The Intune Certificate Connector installed on a member server

Explanation

Hybrid Autopilot deployments need an offline domain join performed during the out-of-box experience, which the Intune Connector for Active Directory provides. The connector must be installed on a domain-joined server that can reach both Intune and the domain.

Question 23Prepare infrastructure for devices

Which built-in Intune role grants the ability to create custom Intune roles?

  1. Policy and Profile Manager
  2. Intune Role Administrator Correct answer.
  3. Global Administrator
  4. Help Desk Operator

Explanation

Intune Role Administrator is the built-in Intune role that manages role-based access control, including creating custom roles and assigning them. Roles that perform device or policy tasks cannot modify the permission model.

Question 24Prepare infrastructure for devices

Which condition must be met before Setup Assistant applies an Automated Device Enrollment profile to an iPhone?

  1. The serial number must be imported into Intune by using a CSV file.
  2. The device must be connected to a Mac that runs Apple Configurator.
  3. The device must be assigned to the Intune MDM server in ABM. Correct answer.
  4. The user must sign in with a Managed Apple ID during Setup Assistant.

Explanation

Automated Device Enrollment depends on the device being present in Apple Business Manager and assigned to the Intune MDM server, after which the enrollment profile is applied during Setup Assistant. No Apple Configurator connection or user sign-in is required for the profile to be delivered.

Question 25Prepare infrastructure for devices

Which requirement must be met for Windows Autopilot self-deploying mode to work?

  1. The device must have TPM 2.0 and support device attestation. Correct answer.
  2. The device must use a wired Ethernet connection during deployment.
  3. The device must be joined to on-premises Active Directory before enrollment.
  4. A device enrollment manager account must be used for enrollment.

Explanation

Self-deploying mode provisions a device with no user present, so it relies on TPM 2.0 attestation to establish device identity and enroll the device. If attestation fails, the deployment stops with an error and the device is not enrolled.

Question 26Prepare infrastructure for devices

You plan to enroll iOS and iPadOS devices in Microsoft Intune. Which item must be added to Intune before the devices can receive policies?

  1. An Apple Configurator blueprint applied to the devices
  2. A PFX imported certificate for each device
  3. An Apple volume purchasing token
  4. An Apple MDM push certificate Correct answer.

Explanation

Managing iOS and iPadOS devices requires an Apple MDM push certificate (an APNs certificate) that is created with an Apple ID and uploaded to Intune. Until that certificate is active, Intune cannot establish the management channel with the devices.

Question 27Prepare infrastructure for devices

You need to register an existing Windows device with Windows Autopilot. Which tool should you run on the device to capture the information that Intune requires?

  1. The dsregcmd /status command
  2. The Get-WindowsAutopilotInfo PowerShell script Correct answer.
  3. The Microsoft Deployment Toolkit deployment wizard
  4. Windows Configuration Designer

Explanation

Autopilot registration depends on the device hardware hash, which the Get-WindowsAutopilotInfo script collects into a CSV file that can be imported into Intune. The hash ties the physical device to its Autopilot record.

Question 28Prepare infrastructure for devices

Your company buys iOS apps in volume through Apple Business Manager and wants Intune to assign those app licenses to users. What must you add to Intune?

  1. An Apple VPP token Correct answer.
  2. A trusted root certificate profile for iOS
  3. An Apple Automated Device Enrollment profile
  4. An Apple MDM push certificate

Explanation

Volume-purchased apps and books are synchronized into Intune with an Apple VPP (Apps and Books) token obtained from Apple Business Manager. The token also lets Intune assign licenses to users and reclaim them later.

Question 29Prepare infrastructure for devices

A user is not a member of any group that has a custom device enrollment restrictions policy assigned. Which settings determine what the user can enroll?

  1. The default device enrollment restrictions policy Correct answer.
  2. The Microsoft Entra device settings configured for the tenant
  3. The Intune service plan that is assigned to the user
  4. The Company Portal access policy of the tenant

Explanation

Intune includes a default device enrollment restrictions policy that applies to every user who is not targeted by a custom policy. Assigning a custom policy to a group overrides the default for those members.

Question 30Prepare infrastructure for devices

Computers that are joined to on-premises Active Directory must enroll in Intune automatically at the next Group Policy refresh. You are not using Windows Autopilot. Which Group Policy setting should you configure?

  1. Register domain-joined computers as devices
  2. Enable automatic MDM enrollment using default Microsoft Entra credentials Correct answer.
  3. Publish the Intune service connection point and allow users to join devices to Microsoft Entra ID
  4. Allow users to join devices to Microsoft Entra ID

Explanation

The Group Policy setting Enable automatic MDM enrollment using default Microsoft Entra credentials, found under Computer Configuration > Administrative Templates > Windows Components > MDM, makes domain-joined devices enroll in Intune with the signed-in user's credentials.

Question 31Prepare infrastructure for devices

You plan to deploy SCEP certificate profiles to Windows devices. What should you deploy first so that the devices trust the certificate chain of the issuing certification authority?

  1. A PKCS imported certificate profile for each device
  2. A VPN profile that uses Extensible Authentication Protocol TLS authentication
  3. A trusted certificate profile that contains the root CA certificate Correct answer.
  4. A Wi-Fi profile that references the certification authority

Explanation

A SCEP profile causes a device to request a certificate from the certification authority, so the device must first trust that authority. Deploying the root and intermediate certificates in a trusted certificate profile establishes that trust chain.

Question 32Prepare infrastructure for devices

A support technician must be able to restart, retire and wipe devices in Intune but must not be able to change configuration profiles. Which built-in Intune role should you assign?

  1. Help Desk Operator Correct answer.
  2. Application Manager
  3. Read Only Operator
  4. Policy and Profile Manager

Explanation

Help Desk Operator includes device actions such as remote restart, retire and wipe, together with viewing device information, but it cannot edit configuration profiles. Profile editing is granted by the Policy and Profile Manager role.

Question 33Prepare infrastructure for devices

You are preparing Windows Autopilot for user-driven Microsoft Entra join. Which Microsoft Entra device setting determines whether users are allowed to join devices to Microsoft Entra ID?

  1. MDM user scope
  2. Require multi-factor authentication to join devices
  3. Users may join devices to Microsoft Entra ID Correct answer.
  4. Enterprise State Roaming

Explanation

The Users may join devices to Microsoft Entra ID setting in the Microsoft Entra admin center controls which users or groups are permitted to join devices. MDM user scope is a separate setting that controls automatic Intune enrollment.

Question 34Prepare infrastructure for devices

You want domain-joined Windows devices to register automatically with Microsoft Entra ID as hybrid joined devices so that they can enroll in Intune. Which on-premises configuration enables the automatic registration?

  1. A Group Policy object that assigns the Intune device enrollment manager role to the computers
  2. A service connection point that Microsoft Entra Connect registers in Active Directory Correct answer.
  3. An enterprise application that is published through Active Directory Federation Services
  4. A Kerberos constrained delegation entry for each device

Explanation

Automatic hybrid join relies on the service connection point (SCP) that Microsoft Entra Connect writes into Active Directory Domain Services. Domain-joined devices query the SCP to discover the Microsoft Entra tenant and register themselves.

Question 35Prepare infrastructure for devices

A user is a member of two groups and each group is assigned a different custom device enrollment restrictions policy. Which policy does Intune apply to the user?

  1. The policy with the highest priority Correct answer.
  2. Both policies, with the stricter setting applied for each individual restriction
  3. The policy that was created most recently
  4. The policy that is assigned to the group with the fewest members

Explanation

When multiple custom enrollment restrictions policies target a user, Intune applies the policy with the highest priority, which is the one with the lowest priority number. The default policy is used only when no custom policy targets the user.

Question 36Prepare infrastructure for devices

What is the purpose of device categories in Microsoft Intune?

  1. They encrypt the local data that is stored on a device.
  2. They control whether a device can enroll through Apple Automated Device Enrollment.
  3. They determine which compliance policies and configuration profiles a device receives.
  4. They label devices so that administrators can sort and filter them. Correct answer.

Explanation

Device categories are custom labels, such as Kiosk or Sales floor, that can be chosen during enrollment by the user or set by an administrator. They are used to organize and filter devices in reports and in dynamic Microsoft Entra groups.

Question 37Prepare infrastructure for devices

Which Microsoft Entra role gives an administrator full permissions in the Intune admin center?

  1. Cloud Application Administrator
  2. Intune Administrator Correct answer.
  3. Device Enrollment Manager
  4. Global Reader

Explanation

The Intune Administrator role grants full access to Intune, including creating roles, managing devices and configuring policies. Read-only and app-focused roles cannot change Intune configuration.

Question 38Prepare infrastructure for devices

Windows devices are already enrolled in Intune and you want them to become Windows Autopilot devices without reimaging them. Which deployment profile setting should you use?

  1. Join to Microsoft Entra ID as hybrid
  2. Enable pre-provisioning (white glove)
  3. Convert all targeted devices to Autopilot Correct answer.
  4. Deploy the Enrollment Status Page with blocking app installation

Explanation

Setting Convert all targeted devices to Autopilot in the deployment profile automatically registers existing Intune-enrolled devices as Autopilot devices so that the profile applies to them. The devices are not reimaged by this action.

Question 39Prepare infrastructure for devices

You have a password-protected .pfx file that contains a certificate and its private key. You must deliver this certificate to users' devices. Which Intune profile type should you create?

  1. A PKCS certificate profile that uses a certification authority
  2. A trusted certificate profile
  3. A PKCS imported certificate profile Correct answer.
  4. A SCEP certificate profile

Explanation

A PKCS imported certificate profile, previously called a PFX certificate profile, imports an existing certificate and private key from a .pfx file. A PKCS certificate profile instead requests a new certificate from a connected certification authority.

Question 40Prepare infrastructure for devices

A user wants to enroll a personally owned iPhone in Intune. What should the user do first?

  1. Connect the device to a Mac that runs Apple Configurator.
  2. Install the Intune Company Portal app from the App Store. Correct answer.
  3. Import the device hardware hash into the Autopilot devices list.
  4. Add the device serial number to Apple Business Manager.

Explanation

Personally owned iOS devices are enrolled by the user through the Intune Company Portal app, where the user signs in and follows the enrollment prompts. Apple Configurator and Apple Business Manager are used to prepare organization-owned devices.

Question 41Manage and maintain devices

A user leaves the company and returns a personally owned Android phone that was enrolled with a work profile. You must remove only the corporate data and configuration while leaving the user's personal apps and photos intact. Which action should you use?

  1. Retire Correct answer.
  2. Delete
  3. Autopilot Reset
  4. Wipe

Explanation

Retire removes the work profile, managed apps, and company data from the device and then removes the management record, while personal apps and files stay intact. The Windows-only reset actions and a factory reset do not preserve personal data in the same way.

Question 42Manage and maintain devices

You configure a compliance policy whose noncompliance action has a grace period of two days. What is the effect of the grace period?

  1. The user has two additional days to enrol the device
  2. The device is marked noncompliant now, but enforcement waits two days Correct answer.
  3. The device stays compliant for two days before it is first evaluated at all
  4. The policy is evaluated every two days instead of every day

Explanation

The grace period delays only the enforcement actions taken against a noncompliant device; the compliance state itself changes as soon as the policy is evaluated. Conditional access and other consequences start when the grace period expires.

Question 43Manage and maintain devices

You want to label devices by department so that the service desk can filter and report on them, without creating separate groups. What should you configure?

  1. Scope tags
  2. Device categories Correct answer.
  3. Assignment filters
  4. Corporate identifiers

Explanation

Device categories are labels that admins or users assign during enrollment so devices can be sorted and reported by department or location, and they can also feed dynamic group membership. They do not change which administrators see a device or which policies it receives.

Question 44Manage and maintain devices

You need to build a policy by browsing and searching all the individual settings that the configuration service providers expose, without knowing any OMA-URI paths. Which profile type should you use?

  1. Security baselines
  2. Settings catalog Correct answer.
  3. Administrative templates
  4. Custom OMA-URI profiles

Explanation

The settings catalog collects individual settings from all available configuration service providers so you can search and select them individually. Administrative templates expose only ADMX-backed policy settings, and custom profiles require you to type each OMA-URI path yourself.

Question 45Manage and maintain devices

A BitLocker-encrypted Windows device is managed by Intune, and the profile that deployed BitLocker was configured to save recovery information to Entra ID. Where can the help desk retrieve the recovery password?

  1. The local Windows event log on the device
  2. The BitLocker drive encryption report for Windows Update for Business
  3. The recovery keys stored with the device record in Intune Correct answer.
  4. The TPM chip, which the help desk can read remotely

Explanation

When recovery information is escrowed to Entra ID, the recovery keys are attached to the device object and can be read from the device record in the Intune admin center or from Entra ID by an administrator who has the required permissions.

Question 46Manage and maintain devices

What does a security baseline provide in Intune?

  1. A list of applications that must be installed on every managed device
  2. A set of preconfigured settings based on Microsoft security guidance Correct answer.
  3. A scheduled backup of device settings and user profile data
  4. A licence template that is applied to newly enrolled devices

Explanation

A security baseline is a template of settings drawn from Microsoft's security guidance for Windows, Defender, Edge, and Microsoft 365 Apps. It is deployed like any other profile, and individual settings can be adjusted after the profile is created.

Question 47Manage and maintain devices

You must record each user's acceptance of a legal disclaimer during enrollment and be able to export the acceptance details later. Which Intune object should you create?

  1. Terms and conditions Correct answer.
  2. A configuration profile
  3. A compliance policy
  4. An enrollment restriction

Explanation

A terms and conditions policy displays the disclaimer during enrollment and stores each user's acceptance, including name and date, which can be exported for reporting. Compliance policies evaluate device state and cannot capture user consent.

Question 48Manage and maintain devices

A configuration profile assigned to a Windows device has not applied yet. Which device action forces the device to check in with Intune right away?

  1. Sync Correct answer.
  2. Restart
  3. Collect diagnostics
  4. Fresh Start

Explanation

The Sync action triggers an immediate MDM check-in so the device receives pending policies, apps, and compliance evaluations. The device must have network connectivity for the action to complete.

Question 49Manage and maintain devices

You must repurpose a Windows 11 device for a new user. The device must keep its Entra ID join, its Intune enrollment, and its Autopilot registration, but all user files, apps, and settings must be removed. Which action should you use?

  1. Wipe the device and re-enroll it
  2. Autopilot Reset Correct answer.
  3. Retire the device from management
  4. Delete the device record from Intune

Explanation

Autopilot Reset removes user files, apps, and settings and returns the device to the out-of-box experience while keeping the Entra ID join, the Intune enrollment, and the Autopilot registration. That is why it is used to reassign a device without re-enrolling it.

Question 50Manage and maintain devices

Which statement describes the difference between a compliance policy and a configuration profile?

  1. A compliance policy deploys certificates; a configuration profile requires encryption
  2. A compliance policy sets desired settings on the device; a configuration profile reports whether the device meets those conditions
  3. Both deliver settings, but only compliance policies can target Windows devices
  4. A configuration profile sets desired settings; a compliance policy evaluates and reports whether a device meets conditions Correct answer.

Explanation

Configuration profiles push desired settings to devices, whereas compliance policies evaluate conditions such as OS version, encryption, and Defender state and set the device's compliance state, which conditional access can use. A device can receive every setting and still be noncompliant if a required condition is not met.