Exam MD-101: Managing Modern Desktops — Questions and Answers

Question 1: Which Intune feature allows administrators to deploy a specific Windows 11 feature update version to targeted devices?

Delivery Optimization profile
Update rings — feature update deferral
Windows Autopilot deployment profile
Feature updates policy — target a specific Windows version (Correct answer)

Correct answer: Feature updates policy — target a specific Windows version

Feature updates policies in Intune allow administrators to target a specific Windows 10/11 version, ensuring devices are upgraded to exactly that version.

Question 2: What must be configured in Intune to ensure a specific Autopilot profile is assigned to a group of devices?

A Windows Update ring targeting the device group
An Autopilot deployment profile assigned to a dynamic or static device group (Correct answer)
A device configuration profile with Autopilot settings
A compliance policy targeting the device group

Correct answer: An Autopilot deployment profile assigned to a dynamic or static device group

An Autopilot deployment profile must be created and assigned to an Azure AD device group so enrolled devices receive the correct OOBE customization.

Question 3: What does the Intune compliance policy 'grace period' setting control?

How long a device can remain offline before being marked non-compliant
The number of days a non-compliant device retains access before Conditional Access blocks it (Correct answer)
How long a user has to enroll their device after joining Azure AD
The time between compliance evaluation cycles

Correct answer: The number of days a non-compliant device retains access before Conditional Access blocks it

The grace period gives users a defined number of days to remediate non-compliance before Conditional Access enforces the block, preventing immediate access disruption.

Question 4: What is the primary purpose of Windows Autopilot in an enterprise environment?

To automate device provisioning and setup without IT intervention (Correct answer)
To reimage devices using PXE boot
To deploy software updates to managed devices
To configure BitLocker encryption remotely

Correct answer: To automate device provisioning and setup without IT intervention

Windows Autopilot automates the provisioning and setup of new Windows devices so users can be productive without IT needing to image the hardware.

Question 5: What tool is used to upload hardware hashes to Microsoft Intune for Autopilot registration?

Azure AD Connect
Get-WindowsAutoPilotInfo PowerShell script (Correct answer)
Windows Configuration Designer
Microsoft Endpoint Manager Admin Center CSV import only

Correct answer: Get-WindowsAutoPilotInfo PowerShell script

The Get-WindowsAutoPilotInfo PowerShell script collects the hardware hash from a device and can upload it directly to Intune.

Question 6: What is the effect of the 'Require password change' Conditional Access grant control when user risk is high?

Blocks access permanently until IT resets the password
Forces the user to reset their password via self-service password reset before gaining access (Correct answer)
Removes the user's MFA methods
Disables the user account in Azure AD

Correct answer: Forces the user to reset their password via self-service password reset before gaining access

The 'Require password change' grant control forces high-risk users to complete a secure SSPR password reset before they can access resources.

Question 7: To determine if it is correct, you must take into account the underlined portion. Run the Install-Package cmdlet in Windows 10 to allow sideloading of a LOB application. In the event that the underlined part is accurate, choose "No adjustment necessary." Choose the accurate answer if the underlined portion is accurate.

Install-PackageProvider
No adjustment required
Save-Package
Add-AppxPackage (Correct answer)

Correct answer: Add-AppxPackage

Add-AppxPackage is the correct PowerShell cmdlet for sideloading a line-of-business AppX application onto Windows 10. Install-Package, Install-PackageProvider, and Save-Package manage general software packages or providers, not the installation of AppX app packages.

Question 8: Which Intune capability allows managed apps to open documents only in other managed apps, preventing data leakage to personal apps?

App configuration policies
Conditional Access App Control
Device restrictions profile
Managed Open-In / Share extension restriction via App Protection Policy data transfer settings (Correct answer)

Correct answer: Managed Open-In / Share extension restriction via App Protection Policy data transfer settings

App Protection Policy data transfer settings restrict 'Send org data to other apps' to 'Policy managed apps only', enforcing Managed Open-In on iOS and Android.

Question 9: Which Autopilot profile setting prevents users from skipping the privacy settings page during OOBE?

Skip AD connectivity check
User account type = Standard
Convert all targeted devices to Autopilot = Yes
Privacy settings = Hide (Correct answer)

Correct answer: Privacy settings = Hide

Setting Privacy settings to Hide in the Autopilot profile suppresses the privacy settings screen during OOBE, enforcing a consistent setup experience.

Question 10: What is the first thing Intune evaluates when a device checks in for compliance assessment?

Whether any compliance policies are assigned to the device or user (Correct answer)
Whether the device has internet connectivity
Whether BitLocker is enabled
Whether the user has a valid Intune license

Correct answer: Whether any compliance policies are assigned to the device or user

Intune first checks if any compliance policies are assigned; devices with no compliance policy are considered compliant by default unless the tenant setting is changed.

Question 11: What is the check-in interval for Intune-managed Windows devices to retrieve new policies?

Every 8 hours with an initial check-in within 15 minutes of enrollment (Correct answer)
Every 5 minutes
Only when a user signs in
Every 24 hours

Correct answer: Every 8 hours with an initial check-in within 15 minutes of enrollment

Windows devices check in with Intune approximately every 8 hours, with an initial sync within 15 minutes of enrollment and after device restart.

Question 12: What is the deadline setting in a Windows Update Ring used for?

To notify users of upcoming update restarts
To force devices to install updates by a specific number of days after the update becomes available, overriding active hours if needed (Correct answer)
To set the last day Microsoft supports the update
To schedule a compliance audit after updates are applied

Correct answer: To force devices to install updates by a specific number of days after the update becomes available, overriding active hours if needed

The deadline setting ensures devices install updates within a defined number of days, and can override active hours restrictions to enforce restart compliance.

Question 13: What network requirement must be met for Windows Autopilot to function during OOBE?

A DHCP server with PXE options must be available
An on-premises MDM server must be accessible
A domain controller must be reachable on the local network
The device must have internet connectivity to reach Microsoft cloud services (Correct answer)

Correct answer: The device must have internet connectivity to reach Microsoft cloud services

Autopilot requires internet connectivity during OOBE to contact Microsoft Deployment Service and Azure AD for device registration and profile download.

Question 14: Which Azure AD feature integrates with Intune compliance status to block non-compliant devices from accessing corporate resources?

Privileged Identity Management
Azure AD Identity Protection
Azure AD Access Reviews
Conditional Access requiring a compliant device (Correct answer)

Correct answer: Conditional Access requiring a compliant device

Conditional Access can require 'device marked as compliant' as a grant control, blocking access to apps until the device meets Intune compliance requirements.

Question 15: An administrator configures a Win32 app with a detection rule using registry key existence. What happens if the registry key is found on the device?

Intune considers the app as already installed and skips installation (Correct answer)
The app is reinstalled to ensure freshness
The detection rule fails and triggers uninstall
The app is flagged as non-compliant

Correct answer: Intune considers the app as already installed and skips installation

When a detection rule condition is met (e.g., registry key found), Intune marks the app as installed and does not attempt reinstallation on that device.

Question 16: Which Intune feature allows configuration profiles to be applied only when devices are on a corporate network?

Applicability rules
Conditional Access
Scope tags
Filters (Correct answer)

Correct answer: Filters

Intune filters allow profiles to be dynamically included or excluded based on device properties, including network location when combined with Conditional Access.

Question 17: What is the maximum number of days an administrator can defer Windows 11 feature updates using an Intune Update Ring?

30 days
90 days
180 days
365 days (Correct answer)

Correct answer: 365 days

Feature updates can be deferred for up to 365 days using Windows Update for Business deferral policies configured via Intune Update Rings.

Question 18: Which type of Intune app deployment installs the app silently without any user interaction on enrolled Windows devices?

Uninstall deployment
Required deployment (Correct answer)
Available without enrollment
Available for enrolled devices

Correct answer: Required deployment

A 'Required' app deployment in Intune silently installs the application on enrolled devices without user initiation or approval.

Question 19: What happens to a device's compliance status if it has been offline and has not checked in with Intune beyond the configured inactivity period?

It remains compliant indefinitely
It is automatically wiped
It is moved to a quarantine group
It is marked Not compliant (Correct answer)

Correct answer: It is marked Not compliant

Intune marks devices as Not compliant if they exceed the configured 'Days without checking in' threshold, which administrators set in compliance policy settings.

Question 20: An Intune configuration profile shows a status of 'Not applicable' for several devices. What does this mean?

The profile settings do not apply to the OS version or device type (Correct answer)
The profile requires manual approval
The devices are offline and have not checked in
The profile failed to deploy to those devices

Correct answer: The profile settings do not apply to the OS version or device type

'Not applicable' means the profile's settings are not compatible with the device's OS, platform, or version, so the profile is intentionally skipped.

Question 21: An administrator wants to ensure that devices in a pilot ring automatically receive updates 0 days after release while production devices receive them after 14 days. How should Update Rings be configured?

One ring with 7-day average deferral for both groups
Configure WSUS with different approval groups
Two separate Update Rings — one with 0-day deferral (pilot), one with 14-day deferral (production) (Correct answer)
One ring with conditional deferral based on device group

Correct answer: Two separate Update Rings — one with 0-day deferral (pilot), one with 14-day deferral (production)

Two separate Update Rings assigned to different device groups allows independent deferral periods for pilot and production rings, providing staged update deployment.

Question 22: A sizable number of Windows 10 PCs are part of the Active Directory domain that belongs to your firm. Microsoft Intune and hybrid Azure Active Directory (Azure AD) have recently been set up in the environment. Ensure that every PC in use right now is automatically registered with Azure AD and signed up for Intune. The approach you use should make it easier to accomplish your aim administratively. Which of the below activities ought you to perform?

You should make use of Windows Reset
You should make use of a device configuration profile
You should make use of a n Autodiscover service connection point (SCP)
You should make use of a Windows AutoPilot deployment profile (Correct answer)

Correct answer: You should make use of a Windows AutoPilot deployment profile

A Windows AutoPilot deployment profile automates Azure AD join and Intune enrollment, letting you register a large number of existing devices with minimal per-device administrative effort. A device configuration profile only applies settings to already-enrolled devices, Windows Reset wipes machines, and an Autodiscover SCP is unrelated to enrollment automation.

Question 23: Which deployment mode allows a user to complete the Autopilot setup experience themselves, joining the device to Azure AD?

Self-deploying mode
User-driven mode (Correct answer)
Pre-provisioned (White Glove)
Hybrid Azure AD join mode

Correct answer: User-driven mode

User-driven mode lets the end user complete the Out-of-Box Experience (OOBE) and join the device to Azure AD with their credentials.

Question 24: What is the purpose of a Conditional Access Named Location in access policies?

To define trusted IP ranges or countries for use in access conditions (Correct answer)
To name Conditional Access policies for reporting purposes
To label compliant device groups
To name Azure AD groups used in CA policies

Correct answer: To define trusted IP ranges or countries for use in access conditions

Named Locations define trusted IP address ranges or geographic regions that can be used as conditions in Conditional Access policies.

Question 25: WeylandIndustries.com is the Active Directory domain for your business. Microsoft Azure Active Directory (Azure AD) and the domain are synchronised, and Microsoft Intune has been installed on every workstation. You're getting ready to do a Fresh Start activity on several business devices. Which of the following operating systems is capable of doing a Fresh Start? Decide which options apply.

Windows Vista
iOS
Windows 8.1
Windows 10 (Correct answer)

Correct answer: Windows 10

The Fresh Start action is specific to Windows 10 operating system. It is a feature provided by Windows Defender Security Center that allows you to perform a clean installation of Windows 10 while preserving user data. Fresh Start reinstalls a clean and up-to-date version of Windows 10, removing any non-Microsoft apps and settings that may have been installed on the device. It is a useful option for troubleshooting or restoring a device to its original state while keeping user files intact.

Question 26: Which Autopilot deployment mode is designed for kiosk or shared devices that require no user affinity?

Self-deploying mode (Correct answer)
Hybrid Azure AD join
User-driven Azure AD join
Pre-provisioned mode

Correct answer: Self-deploying mode

Self-deploying mode provisions a device with no user affinity, making it ideal for kiosks, digital signage, and shared devices.

Question 27: Which protocol does Intune use to deploy certificates to devices using a Certificate Authority integration?

OCSP
Kerberos
LDAP
SCEP (Simple Certificate Enrollment Protocol) (Correct answer)

Correct answer: SCEP (Simple Certificate Enrollment Protocol)

Intune uses SCEP to request and deliver certificates from a CA via the NDES server, enabling certificate-based authentication for Wi-Fi and VPN.

Question 28: Which PowerShell cmdlet resets an Autopilot device so it can be re-provisioned from OOBE?

Reset-WindowsAutoPilotDevice
Start-MgDeviceManagementManagedDeviceAction
Invoke-AutopilotReset (Correct answer)
Reset-AutopilotProfile

Correct answer: Invoke-AutopilotReset

Invoke-AutopilotReset triggers a remote Autopilot reset via Intune, returning the device to OOBE while retaining its Autopilot registration.

Question 29: An organization onboards devices to Microsoft Defender for Endpoint. Which Intune policy type deploys the MDE onboarding configuration package?

Administrative Templates profile
Endpoint detection and response (EDR) policy under Endpoint security (Correct answer)
Device compliance policy
Win32 app deployment

Correct answer: Endpoint detection and response (EDR) policy under Endpoint security

The Endpoint detection and response policy in Intune Endpoint security deploys the MDE onboarding package that connects devices to the MDE service.

Exam MD-101: Managing Modern Desktops

MD-101 validates IT professionals' ability to deploy Windows clients, manage identity and access, configure compliance policies and configuration profiles, maintain and protect devices, and manage apps in enterprise environments. This exam retired September 30, 2023 and was replaced by MD-102.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Retake policy, passing score, fees, time limit, exam information · verified Oct 2026
home.pearsonvue.com — Test delivery · verified Oct 2026