Microsoft Intune Device Configuration Profiles Flashcards

Which protocol does Intune use to deploy certificates to devices using a Certificate Authority integration?

Answer: SCEP (Simple Certificate Enrollment Protocol)

Intune uses SCEP to request and deliver certificates from a CA via the NDES server, enabling certificate-based authentication for Wi-Fi and VPN.

What must be configured in Intune before deploying a SCEP certificate profile to devices?

Answer: A Trusted certificate profile with the root CA certificate

A Trusted certificate profile containing the root CA certificate must be deployed to devices before SCEP certificates can be trusted and used.

Which Intune profile type delivers per-app VPN configuration on Windows 10/11 devices?

Answer: VPN profile with per-app VPN rules

A VPN profile in Intune supports per-app VPN configuration, routing only specific application traffic through the VPN tunnel.

A Windows device shows 'Error' status for a configuration profile. Where should an administrator look first to diagnose the issue?

Answer: Intune — Device > Configuration profiles > select device and view profile details with error codes

The device detail view in Intune configuration profiles shows per-profile status with error codes that identify why a specific profile failed.

Which Intune setting prevents users from adding personal Microsoft accounts to a corporate Windows device?

Answer: Block personal Microsoft account under Device restrictions > Accounts

The 'Block personal Microsoft account' setting under Device restrictions > Accounts prevents users from adding MSA accounts to corporate devices.

What is the purpose of Intune's 'Scope tags' in configuration profiles?

Answer: To restrict which Intune administrator roles can view and manage specific profiles

Scope tags control role-based access control (RBAC) visibility, restricting which Intune admin roles can see and manage profiles tagged with specific scope tags.