Exam MD-101: Managing Modern Desktops — Questions and Answers

Question 1: What is the maximum number of devices a standard user can join to Azure AD by default, relevant to Autopilot user-driven deployments?

20
10 (Correct answer)
Unlimited
5

Correct answer: 10

By default, Azure AD allows users to join up to 10 devices, though this limit can be changed in Azure AD settings.

Question 2: What is the purpose of Intune's 'Scope tags' in configuration profiles?

To filter which devices receive a profile based on hardware properties
To tag profiles for compliance reporting
To apply profiles only during certain hours
To restrict which Intune administrator roles can view and manage specific profiles (Correct answer)

Correct answer: To restrict which Intune administrator roles can view and manage specific profiles

Scope tags control role-based access control (RBAC) visibility, restricting which Intune admin roles can see and manage profiles tagged with specific scope tags.

Question 3: What is the purpose of assigning a device to a user in Windows Autopilot?

To associate a primary user with the device for a pre-assigned user experience during OOBE (Correct answer)
To pre-assign user credentials so no login is required
To enable co-management with Configuration Manager
To license the device for Windows Enterprise

Correct answer: To associate a primary user with the device for a pre-assigned user experience during OOBE

Pre-assigning a user to an Autopilot device populates the sign-in page with the user's email during OOBE, reducing steps for the end user.

Question 4: What tool is used to upload hardware hashes to Microsoft Intune for Autopilot registration?

Microsoft Endpoint Manager Admin Center CSV import only
Windows Configuration Designer
Get-WindowsAutoPilotInfo PowerShell script (Correct answer)
Azure AD Connect

Correct answer: Get-WindowsAutoPilotInfo PowerShell script

The Get-WindowsAutoPilotInfo PowerShell script collects the hardware hash from a device and can upload it directly to Intune.

Question 5: What must be configured in Intune to ensure a specific Autopilot profile is assigned to a group of devices?

A Windows Update ring targeting the device group
A compliance policy targeting the device group
A device configuration profile with Autopilot settings
An Autopilot deployment profile assigned to a dynamic or static device group (Correct answer)

Correct answer: An Autopilot deployment profile assigned to a dynamic or static device group

An Autopilot deployment profile must be created and assigned to an Azure AD device group so enrolled devices receive the correct OOBE customization.

Question 6: Which PowerShell cmdlet resets an Autopilot device so it can be re-provisioned from OOBE?

Reset-AutopilotProfile
Invoke-AutopilotReset (Correct answer)
Reset-WindowsAutoPilotDevice
Start-MgDeviceManagementManagedDeviceAction

Correct answer: Invoke-AutopilotReset

Invoke-AutopilotReset triggers a remote Autopilot reset via Intune, returning the device to OOBE while retaining its Autopilot registration.

Question 7: Which setting in an Intune App Protection Policy requires users to authenticate with a PIN or biometric before accessing corporate apps?

Conditional launch — Max PIN attempts
Require device lock
Data protection — Encrypt org data
Access requirements — PIN for access (Correct answer)

Correct answer: Access requirements — PIN for access

The 'PIN for access' setting under Access requirements in an App Protection Policy enforces PIN or biometric authentication before accessing the protected app.

Question 8: A Windows 10 device fails to enroll in Intune with error 0x80180014. What is the most likely cause?

The user account lacks an Intune license (Correct answer)
BitLocker must be enabled first
The device already has an MDM enrollment from another provider
The device is not Azure AD joined

Correct answer: The user account lacks an Intune license

Error 0x80180014 typically indicates the user does not have an Intune license assigned, preventing enrollment.

Question 9: Which tool converts Win32 app installers into the .intunewin format required for Intune deployment?

Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) (Correct answer)
Intune Admin Center packaging tool
DISM application packager
Windows Configuration Designer

Correct answer: Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe)

The Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) packages Win32 app installers and their dependencies into the .intunewin format for Intune upload.

Question 10: Which Delivery Optimization download mode distributes Windows Update content among peers on the same local network without needing a local cache server?

Mode 1 – LAN (Correct answer)
Mode 0 – HTTP only
Mode 99 – Simple download
Mode 2 – Group

Correct answer: Mode 1 – LAN

Delivery Optimization Mode 1 (LAN) allows devices on the same local network to share update content directly with each other.

Question 11: Which Azure AD feature integrates with Intune compliance status to block non-compliant devices from accessing corporate resources?

Conditional Access requiring a compliant device (Correct answer)
Privileged Identity Management
Azure AD Access Reviews
Azure AD Identity Protection

Correct answer: Conditional Access requiring a compliant device

Conditional Access can require 'device marked as compliant' as a grant control, blocking access to apps until the device meets Intune compliance requirements.

Question 12: A Conditional Access policy requires MFA for all users accessing Exchange Online. A user with a compliant Intune device still gets prompted for MFA. What is the likely cause?

The user's device is not Azure AD joined
The Conditional Access policy requires both MFA and compliant device — both controls must be satisfied (Correct answer)
MFA is only required for non-compliant devices
Intune compliance grants bypass all Conditional Access controls

Correct answer: The Conditional Access policy requires both MFA and compliant device — both controls must be satisfied

When Conditional Access requires multiple grant controls with 'Require all selected controls', users must satisfy all requirements including MFA even if device is compliant.

Question 13: What information does the Microsoft Defender for Endpoint 'Device Inventory' in the Microsoft 365 Defender portal provide?

A report of all Intune compliance violations
A list of all Azure AD users and their devices
An inventory of all installed apps across the organization
A comprehensive list of onboarded devices with risk level, OS version, and last seen information (Correct answer)

Correct answer: A comprehensive list of onboarded devices with risk level, OS version, and last seen information

The Device Inventory in Microsoft 365 Defender shows all MDE-onboarded devices with risk levels, exposure scores, OS details, and last activity timestamps.

Question 14: In Windows Autopilot for Hybrid Azure AD Join, what additional infrastructure component is required?

Microsoft Identity Manager
Intune Connector for Active Directory installed on an on-premises server (Correct answer)
Azure AD Application Proxy
Azure AD Domain Services

Correct answer: Intune Connector for Active Directory installed on an on-premises server

The Intune Connector for Active Directory must be installed on an on-premises server to create computer objects in AD during Hybrid Azure AD Join Autopilot.

Question 15: What format does Intune use for administrative templates (ADMX-backed policies) to configure Group Policy-equivalent settings?

Administrative Templates profile type in Device configuration (Correct answer)
Custom OMA-URI profiles only
PowerShell scripts deployed via Intune
Windows Information Protection policies

Correct answer: Administrative Templates profile type in Device configuration

Intune's Administrative Templates profile type provides a cloud-based equivalent to ADMX Group Policy settings for Windows 10/11 devices.

Question 16: What is the purpose of Microsoft Defender for Endpoint's 'Attack Surface Reduction (ASR)' rules?

To encrypt device storage before threats can access files
To block all internet access from managed devices
To scan email attachments in real time
To prevent specific behaviors commonly exploited by malware, such as Office macro spawning processes (Correct answer)

Correct answer: To prevent specific behaviors commonly exploited by malware, such as Office macro spawning processes

ASR rules block specific attack vectors used by malware, such as Office applications spawning child processes, executing content from email, and credential theft from LSASS.

Question 17: Which setting in a Device restrictions profile prevents users from resetting their device using the Settings app?

Block factory reset (Correct answer)
Block manual unenrollment
Disable recovery mode
Require device lock

Correct answer: Block factory reset

The 'Block factory reset' setting in a Device restrictions profile prevents users from using the Settings app to reset the device to factory defaults.

Question 18: Which Intune feature provides a centralized way to rotate BitLocker recovery keys for a specific device?

Compliance policy remediation
PowerShell script deployment
Remote wipe action
BitLocker key rotation via Device > Recovery keys > Rotate BitLocker keys in Intune (Correct answer)

Correct answer: BitLocker key rotation via Device > Recovery keys > Rotate BitLocker keys in Intune

Intune provides a 'Rotate BitLocker keys' device action that triggers the device to generate a new recovery key and escrow it back to Azure AD, invalidating the old key.

Question 19: An Intune compliance policy sets minimum OS version to Windows 10 21H2. A device running 21H1 is enrolled. What is the device's compliance state?

Compliant
In grace period
Not evaluated
Not compliant (Correct answer)

Correct answer: Not compliant

A device running an OS version lower than the required minimum is immediately marked Not compliant by the Intune compliance policy.

Question 20: What is the effect of the 'Require password change' Conditional Access grant control when user risk is high?

Removes the user's MFA methods
Blocks access permanently until IT resets the password
Forces the user to reset their password via self-service password reset before gaining access (Correct answer)
Disables the user account in Azure AD

Correct answer: Forces the user to reset their password via self-service password reset before gaining access

The 'Require password change' grant control forces high-risk users to complete a secure SSPR password reset before they can access resources.

Question 21: Which Microsoft tool is used to analyze Windows Update compatibility issues and deployment readiness before upgrading to a new Windows version?

Windows Update for Business reports
Microsoft Assessment and Planning Toolkit
Upgrade Readiness in Log Analytics
Desktop Analytics (now integrated into Endpoint analytics) (Correct answer)

Correct answer: Desktop Analytics (now integrated into Endpoint analytics)

Desktop Analytics (now integrated into Microsoft Endpoint analytics) assesses app and driver compatibility before Windows feature update deployments.

Question 22: Which Intune report shows the protection status of apps across users, including whether App Protection Policies have been applied?

Endpoint analytics — App reliability
App protection status report under Apps > Monitor (Correct answer)
App install status report
Device compliance report

Correct answer: App protection status report under Apps > Monitor

The App protection status report under Apps > Monitor in Intune shows per-user and per-app protection policy application status.

Question 23: What is the primary purpose of Windows Autopilot in an enterprise environment?

To automate device provisioning and setup without IT intervention (Correct answer)
To reimage devices using PXE boot
To configure BitLocker encryption remotely
To deploy software updates to managed devices

Correct answer: To automate device provisioning and setup without IT intervention

Windows Autopilot automates the provisioning and setup of new Windows devices so users can be productive without IT needing to image the hardware.

Question 24: Your company has a number of Windows 10 Microsoft Azure Active Directory (Azure AD) joined workstations. These workstations have been enrolled in Microsoft Intune. You are responsible for ensuring that the workstations can only execute programs that you have specifically authorized. Solution: You make use of Windows Defender Application Guard. Does the solution meet the goal?

No (Correct answer)
Yes

Correct answer: No

Use Windows Defender Application Control instead (WDAC). Windows Defender Application Control and code integrity protection based on virtualization.

Question 25: Which Intune profile type delivers per-app VPN configuration on Windows 10/11 devices?

App protection policy
VPN profile with per-app VPN rules (Correct answer)
Device restrictions
Custom OMA-URI only

Correct answer: VPN profile with per-app VPN rules

A VPN profile in Intune supports per-app VPN configuration, routing only specific application traffic through the VPN tunnel.

Question 26: During Windows Autopilot Pre-provisioning (White Glove), at which stage does the technician complete their portion?

After the user signs in for the first time
During the user's first OOBE experience
Before the device is shipped to the user, during the Technician Flow (Correct answer)
After all Intune policies are applied post-enrollment

Correct answer: Before the device is shipped to the user, during the Technician Flow

In White Glove, the technician flow runs before the device reaches the user, applying device-targeted apps and policies so the user experience is fast.

Question 27: An administrator configures a Win32 app with a detection rule using registry key existence. What happens if the registry key is found on the device?

The app is reinstalled to ensure freshness
The app is flagged as non-compliant
Intune considers the app as already installed and skips installation (Correct answer)
The detection rule fails and triggers uninstall

Correct answer: Intune considers the app as already installed and skips installation

When a detection rule condition is met (e.g., registry key found), Intune marks the app as installed and does not attempt reinstallation on that device.

Question 28: Which feature allows an organization to enforce that Windows Hello for Business is set up before a user can complete the Autopilot enrollment process?

Windows Hello provisioning policy
Identity Protection policy
Conditional Access requiring MFA
Enrollment Status Page (ESP) (Correct answer)

Correct answer: Enrollment Status Page (ESP)

The Enrollment Status Page (ESP) can block device use until required apps and policies, including Windows Hello, are configured.

Question 29: What is the purpose of a Conditional Access Named Location in access policies?

To name Conditional Access policies for reporting purposes
To name Azure AD groups used in CA policies
To label compliant device groups
To define trusted IP ranges or countries for use in access conditions (Correct answer)

Correct answer: To define trusted IP ranges or countries for use in access conditions

Named Locations define trusted IP address ranges or geographic regions that can be used as conditions in Conditional Access policies.

Question 30: Which Intune policy type configures BitLocker encryption requirements and recovery key escrow settings for Windows devices?

Device restrictions — Data Protection section
Compliance policy — Require BitLocker
Endpoint security — Disk encryption policy (BitLocker) (Correct answer)
Administrative Templates — BitLocker settings

Correct answer: Endpoint security — Disk encryption policy (BitLocker)

Endpoint security Disk encryption policies in Intune configure full BitLocker settings including encryption method, recovery key escrow to Azure AD, and startup authentication.

Question 31: Which Azure AD join type allows devices to be managed by both on-premises Group Policy and Microsoft Intune?

Azure AD registered
Azure AD joined
Hybrid Azure AD joined (Correct answer)
Workplace joined

Correct answer: Hybrid Azure AD joined

Hybrid Azure AD joined devices are joined to on-premises AD and registered in Azure AD, enabling management by both Group Policy and Intune.

Question 32: What is 'MAM without enrollment' (MAM-WE) specifically designed for?

Protecting corporate data in Office apps on personal (BYOD) devices that are not enrolled in Intune MDM (Correct answer)
Deploying apps to devices that cannot enroll
Enrolling devices without user interaction
Applying compliance policies to unenrolled devices

Correct answer: Protecting corporate data in Office apps on personal (BYOD) devices that are not enrolled in Intune MDM

MAM-WE allows App Protection Policies to protect corporate data in supported apps on personal devices without requiring full MDM device enrollment.

Question 33: What is the difference between 'Mark device non-compliant' immediately vs. with a delay in compliance policy actions?

There is no functional difference
Delayed marking never triggers Conditional Access
Immediate marking blocks access right away; delayed marking uses the grace period before CA enforcement (Correct answer)
Immediate marking retires the device; delayed sends an email

Correct answer: Immediate marking blocks access right away; delayed marking uses the grace period before CA enforcement

Marking non-compliant immediately triggers Conditional Access enforcement at once, while scheduling it with a delay creates a grace period before access is blocked.

Question 34: Which Microsoft Defender for Endpoint feature provides network-level protection by blocking connections to malicious IPs and URLs?

Controlled Folder Access
Exploit Protection
Attack Surface Reduction rules
Network Protection (Correct answer)

Correct answer: Network Protection

Network Protection extends SmartScreen to block outbound connections to malicious IPs, domains, and URLs at the network layer on managed endpoints.

Question 35: Which Autopilot deployment mode is designed for kiosk or shared devices that require no user affinity?

Self-deploying mode (Correct answer)
Hybrid Azure AD join
User-driven Azure AD join
Pre-provisioned mode

Correct answer: Self-deploying mode

Self-deploying mode provisions a device with no user affinity, making it ideal for kiosks, digital signage, and shared devices.

Question 36: What network requirement must be met for Windows Autopilot to function during OOBE?

A domain controller must be reachable on the local network
An on-premises MDM server must be accessible
A DHCP server with PXE options must be available
The device must have internet connectivity to reach Microsoft cloud services (Correct answer)

Correct answer: The device must have internet connectivity to reach Microsoft cloud services

Autopilot requires internet connectivity during OOBE to contact Microsoft Deployment Service and Azure AD for device registration and profile download.

Question 37: Which Intune compliance setting verifies that Windows devices have Microsoft Defender Antivirus real-time protection enabled?

Microsoft Defender Antivirus — Require real-time protection (Correct answer)
Secure boot required
Require Windows Defender ATP device risk score
Require BitLocker

Correct answer: Microsoft Defender Antivirus — Require real-time protection

The 'Require real-time protection' setting in Intune compliance policies checks that Microsoft Defender Antivirus real-time protection is active.

Question 38: A user leaves the company. The administrator needs to remove corporate data from the user's personal device enrolled via BYOD without affecting personal data. Which Intune action should be used?

Wipe
Fresh Start
Retire (Correct answer)
Delete

Correct answer: Retire

The Retire action removes corporate apps and data managed by Intune from a personal device while leaving personal data intact.

Question 39: To determine if it is correct, you must take into account the underlined portion. You must access the For Developers setting in the Windows 10 Settings app under Update & Security to enable sideloading. In the event that the underlined part is accurate, choose "No adjustment necessary." Choose the accurate answer if the underlined portion is accurate.

Delivery Optimization
Activation
No adjustment required (Correct answer)
Widows Insider

Correct answer: No adjustment required

How to allow Windows 10 to sideload apps on your computer 1. Open Settings 2. Click on Update & Security 3. Click on For developers 4. Under "Use developer features," select the Sideload apps option.

Question 40: To determine if it is correct, you must take into account the underlined portion. You recently made a provisioning package with the device name Comp%RAND:1%. Up to 5 devices can be used to successfully execute the package. In the event that the underlined part is accurate, choose "No adjustment necessary." Choose the accurate answer if the underlined portion is accurate.

No adjustment required
20
15
10 (Correct answer)

Correct answer: 10

The %RAND:1% variable inserts one random decimal digit, and a single digit has 10 possible values (0–9), so the package supports up to 10 devices, not 5. The underlined value is therefore incorrect and should be changed to 10.

Question 41: You need to deploy a Win32 app to Intune-managed devices. What file format must you convert the installer to before uploading to Intune?

.appx
.intunewin (Correct answer)
.msix
.msi

Correct answer: .intunewin

Win32 apps must be packaged as .intunewin files using the Microsoft Win32 Content Prep Tool before uploading to Intune.

Question 42: Windows 10 devices used by your firm that are signed up with Microsoft Intune. All corporate machines have their service channel settings managed by Intune. You get a question about the status of maintenance for a certain PC. You must read the required policy report. Solution: You use software upgrades to access the audit logs. Is the aim being met by the solution?

YES
NO (Correct answer)

Correct answer: NO

Navigating to the audit logs via Software updates in Microsoft Intune would not provide the necessary policy report to review the servicing status of a specific computer. To review the servicing status of a specific computer in Microsoft Intune, you would typically navigate to the device management portal or the Intune console, depending on the specific interface used by your organization. From there, you can access the device details and view the servicing channel settings or update status for the specific computer.

Question 43: In a co-management scenario where both Configuration Manager and Intune apply settings to the same area, what determines which settings take effect?

Intune settings always override Configuration Manager settings
Configuration Manager settings always take precedence over Intune
The configured workload authority slider determines which platform's settings apply (Correct answer)
Both sets of settings are merged and applied together on the device

Correct answer: The configured workload authority slider determines which platform's settings apply

The workload authority configured in the co-management settings (the slider for each workload) determines which management platform's policies are authoritative and applied to devices.

Question 44: An Intune configuration profile shows a status of 'Not applicable' for several devices. What does this mean?

The profile settings do not apply to the OS version or device type (Correct answer)
The devices are offline and have not checked in
The profile failed to deploy to those devices
The profile requires manual approval

Correct answer: The profile settings do not apply to the OS version or device type

'Not applicable' means the profile's settings are not compatible with the device's OS, platform, or version, so the profile is intentionally skipped.

Question 45: When configuring co-management workloads, what does setting a workload slider to 'Pilot Intune' mean?

Intune manages the workload only for new devices enrolled via Autopilot, not existing clients
The workload is fully managed by Intune for all co-managed devices in the organization
The workload is in a testing mode where neither Configuration Manager nor Intune enforces policies
Only devices in the designated pilot collection have that workload managed by Intune; all others remain with Configuration Manager (Correct answer)

Correct answer: Only devices in the designated pilot collection have that workload managed by Intune; all others remain with Configuration Manager

The 'Pilot Intune' setting applies Intune workload management only to devices that are members of the specified pilot collection, allowing controlled testing before a full rollout.

Question 46: One hundred Windows 10 devices linked to Microsoft Azure Active Directory (Azure AD) are under your management. Make sure users cannot connect their own computers to Azure AD. Which of the below activities ought you to perform?

You should configure the Enrollment restriction settings via the Azure Active Directory admin center (Correct answer)
You should configure the Enrollment restriction settings via the Security & Compliance admin center
You should configure the Enrollment restriction settings via the Windows Defender Security Center
You should configure the Enrollment restriction settings via the Device enrollment blade in the Intune admin center

Correct answer: You should configure the Enrollment restriction settings via the Azure Active Directory admin center

A central location for managing device IDs and keeping track of associated event data is provided by Azure Active Directory (Azure AD).

Question 47: Which built-in Windows tool generates the MDMDiagReport.xml file used for troubleshooting co-management and MDM enrollment issues?

Windows Event Log export tool from Event Viewer
Configuration Manager client diagnostics utility (CCMDiag)
MDMDiagnosticsTool.exe run with the -out parameter (Correct answer)
Windows Management Instrumentation (WMI) diagnostic console

Correct answer: MDMDiagnosticsTool.exe run with the -out parameter

MDMDiagnosticsTool.exe, run with the -out flag to specify an output folder, generates MDMDiagReport.xml along with supporting logs useful for diagnosing MDM enrollment and co-management issues.

Question 48: What is the purpose of setting 'Active hours' in a Windows Update Ring?

To schedule when updates are downloaded
To define the time window when Windows will NOT restart the device to complete updates (Correct answer)
To restrict when users can work on the device
To configure when compliance checks run

Correct answer: To define the time window when Windows will NOT restart the device to complete updates

Active hours define the time range during which Windows will not restart devices to apply updates, ensuring updates complete outside of working hours.

Question 49: Which Windows Update for Business setting controls the maximum number of days a feature update can be deferred?

365 days (Correct answer)
180 days
90 days
60 days

Correct answer: 365 days

Windows Update for Business allows feature updates to be deferred for up to 365 days.

Question 50: What is the minimum Configuration Manager current branch version required to enable co-management?

Configuration Manager version 2002
Configuration Manager version 1710 (Correct answer)
Configuration Manager version 2012 R2
Configuration Manager version 1902

Correct answer: Configuration Manager version 1710

Co-management support was introduced in Configuration Manager current branch version 1710, making it the minimum supported version.

Question 51: What is the deadline setting in a Windows Update Ring used for?

To set the last day Microsoft supports the update
To force devices to install updates by a specific number of days after the update becomes available, overriding active hours if needed (Correct answer)
To schedule a compliance audit after updates are applied
To notify users of upcoming update restarts

Correct answer: To force devices to install updates by a specific number of days after the update becomes available, overriding active hours if needed

The deadline setting ensures devices install updates within a defined number of days, and can override active hours restrictions to enforce restart compliance.

Question 52: Which Intune report shows the Autopilot deployment status for individual devices including each ESP phase result?

Device compliance report
Windows Autopilot deployments report (Correct answer)
Enrollment failures report
Device configuration state report

Correct answer: Windows Autopilot deployments report

The Windows Autopilot deployments report in Intune shows per-device deployment status including each ESP phase outcome and error codes.

Question 53: Which deployment mode allows a user to complete the Autopilot setup experience themselves, joining the device to Azure AD?

Self-deploying mode
Pre-provisioned (White Glove)
Hybrid Azure AD join mode
User-driven mode (Correct answer)

Correct answer: User-driven mode

User-driven mode lets the end user complete the Out-of-Box Experience (OOBE) and join the device to Azure AD with their credentials.

Question 54: Which Update Ring setting in Intune controls how long a device user can postpone a Windows update restart notification?

Active hours
Engaged restart snooze period (Correct answer)
Deadline grace period
Update deferral period

Correct answer: Engaged restart snooze period

The engaged restart snooze period controls how many days a user can snooze (postpone) restart notifications after an update is ready.

Question 55: What is the primary function of Windows Update for Business (WUfB)?

To replace WSUS for all organizations with cloud-only deployments
To control when and how Windows updates are deployed to devices using policy (Correct answer)
To host Windows update files on-premises for bandwidth savings
To allow end users to choose their own update schedule

Correct answer: To control when and how Windows updates are deployed to devices using policy

Windows Update for Business enables administrators to control update deployment timing, deferral periods, and pause updates for Windows 10/11 devices via policy.

Question 56: What happens to a device's Autopilot registration when it is deleted from Azure AD?

The device keeps its Autopilot profile but loses Intune enrollment
The Autopilot profile is automatically re-applied on next boot
Nothing changes; the registration persists independently
The device loses its Autopilot registration and must be re-registered (Correct answer)

Correct answer: The device loses its Autopilot registration and must be re-registered

Deleting a device from Azure AD removes the associated Autopilot registration, requiring the hardware hash to be re-uploaded for future Autopilot provisioning.

Question 57: Which setting in an Autopilot deployment profile controls whether users receive local administrator rights after OOBE?

OOBE settings: Skip admin page
Join to Azure AD as: Administrator
Account type: Administrator or Standard User (Correct answer)
Device restrictions: Local admin

Correct answer: Account type: Administrator or Standard User

The 'User account type' setting in the Autopilot deployment profile determines whether the provisioned user gets Administrator or Standard User rights.

Question 58: A Conditional Access policy is set to 'Report-only' mode. What effect does it have on users?

It applies only to pilot group users
It evaluates the policy and logs what would have happened without enforcing any controls (Correct answer)
It blocks access and logs the result
It enforces MFA but does not block access

Correct answer: It evaluates the policy and logs what would have happened without enforcing any controls

Report-only mode evaluates Conditional Access policies and records results in sign-in logs without enforcing any grant or session controls on users.

Question 59: What is the purpose of an OMA-URI setting in a custom Intune configuration profile?

To configure Azure AD Conditional Access rules
To configure BitLocker recovery keys
To apply settings not exposed in Intune's built-in profile UI using raw MDM CSP paths (Correct answer)
To push scripts to managed devices

Correct answer: To apply settings not exposed in Intune's built-in profile UI using raw MDM CSP paths

OMA-URI settings allow administrators to configure MDM CSP paths directly when Intune's built-in templates don't expose the needed setting.

Question 60: What is a 'pilot collection' used for in co-management configuration?

Gradually moving specific devices to Intune workload management before a full organization-wide rollout (Correct answer)
Testing Windows Autopilot deployment profiles on a subset of new devices
Piloting Windows feature updates to a controlled test group before broad deployment
Collecting hardware inventory data from a representative sample of managed devices

Correct answer: Gradually moving specific devices to Intune workload management before a full organization-wide rollout

Pilot collections allow administrators to switch specific workloads to Intune only for a defined subset of devices, validating the change before applying it to all co-managed devices.

Exam MD-101: Managing Modern Desktops

MD-101 validates IT professionals' ability to deploy Windows clients, manage identity and access, configure compliance policies and configuration profiles, maintain and protect devices, and manage apps in enterprise environments. This exam retired September 30, 2023 and was replaced by MD-102.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds