Mixed Deck — All MD-101 Topics Flashcards

Which Azure AD feature integrates with Intune compliance status to block non-compliant devices from accessing corporate resources?

Answer: Conditional Access requiring a compliant device

Conditional Access can require 'device marked as compliant' as a grant control, blocking access to apps until the device meets Intune compliance requirements.

What is the difference between 'Mark device non-compliant' immediately vs. with a delay in compliance policy actions?

Answer: Immediate marking blocks access right away; delayed marking uses the grace period before CA enforcement

Marking non-compliant immediately triggers Conditional Access enforcement at once, while scheduling it with a delay creates a grace period before access is blocked.

Which Intune integration enables security administrators to manage Microsoft Defender for Endpoint settings directly from the Intune admin center?

Answer: Microsoft Defender for Endpoint — Intune connector via security settings management

The Microsoft Defender for Endpoint connector in Intune enables MDE security settings management, allowing Intune to push Defender configurations to onboarded devices.

An administrator wants to ensure that devices in a pilot ring automatically receive updates 0 days after release while production devices receive them after 14 days. How should Update Rings be configured?

Answer: Two separate Update Rings — one with 0-day deferral (pilot), one with 14-day deferral (production)

Two separate Update Rings assigned to different device groups allows independent deferral periods for pilot and production rings, providing staged update deployment.

What is the primary difference between Mobile Device Management (MDM) and Mobile Application Management (MAM) in Intune?

Answer: MDM enrolls and manages the entire device; MAM protects corporate data within apps without full device enrollment

MDM requires device enrollment for full device management, while MAM uses App Protection Policies to protect corporate data in apps on unenrolled personal devices.

What happens to a device's compliance status if it has been offline and has not checked in with Intune beyond the configured inactivity period?

Answer: It is marked Not compliant

Intune marks devices as Not compliant if they exceed the configured 'Days without checking in' threshold, which administrators set in compliance policy settings.

What Intune app type should be used to deploy a 32-bit Win32 application (.exe or .msi) to Windows 10 devices?

Answer: Win32 app (.intunewin package)

Win32 apps in Intune use the .intunewin package format and the Intune Management Extension to deploy complex Windows applications including .exe and .msi files.

An administrator configures an Update Ring with a 10-day quality update deferral and a 30-day feature update deferral. A quality update is released on March 1. When will devices receive it?

Answer: March 11

With a 10-day quality update deferral, devices will receive the March 1 update beginning March 11, after the deferral period expires.

Windows 10 devices used by your firm that are signed up with Microsoft Intune. All corporate machines have their service channel settings managed by Intune. You get a question about the status of maintenance for a certain PC. You must read the required policy report. Solution: You use software upgrades to access the audit logs. Is the aim being met by the solution?

Answer: NO

Navigating to the audit logs via Software updates in Microsoft Intune would not provide the necessary policy report to review the servicing status of a specific computer. To review the servicing status of a specific computer in Microsoft Intune, you would typically navigate to the device management portal or the Intune console, depending on the specific interface used by your organization. From there, you can access the device details and view the servicing channel settings or update status for the specific computer.

What are the two primary paths to enable co-management for existing environments?

Answer: Enrolling new devices via Autopilot or migrating existing Configuration Manager clients to co-management

Co-management is achieved either by enrolling new devices through Windows Autopilot or by enabling Intune enrollment on existing Configuration Manager-managed clients.

Which report in Intune provides a consolidated view of device compliance status across all platforms?

Answer: Compliance — Monitor > Device compliance report

The Device compliance report under Compliance > Monitor in Intune shows aggregate and per-device compliance status across all enrolled platforms.

Which Intune profile type is used to deploy trusted root certificates to managed devices?

Answer: Trusted certificate profile under Device configuration

A Trusted certificate profile in Intune deploys root CA certificates to devices, which is often a prerequisite for SCEP or PKCS certificate profiles.

Which Intune policy type configures BitLocker encryption requirements and recovery key escrow settings for Windows devices?

Answer: Endpoint security — Disk encryption policy (BitLocker)

Endpoint security Disk encryption policies in Intune configure full BitLocker settings including encryption method, recovery key escrow to Azure AD, and startup authentication.

An Intune BitLocker policy sets encryption to 'XTS-AES 256-bit' for OS drives. A device reports BitLocker as pending encryption. What is a common cause?

Answer: The device does not meet hardware requirements (no TPM 2.0)

BitLocker silent encryption requires TPM 2.0; if the device lacks TPM 2.0 or it is disabled in firmware, BitLocker remains in a pending state and cannot encrypt silently.

What must be configured in Intune to ensure a specific Autopilot profile is assigned to a group of devices?

Answer: An Autopilot deployment profile assigned to a dynamic or static device group

An Autopilot deployment profile must be created and assigned to an Azure AD device group so enrolled devices receive the correct OOBE customization.

Which Intune feature prevents users from copying corporate data from a managed app and pasting it into a personal app?

Answer: App Protection Policy — Restrict cut, copy, and paste

App Protection Policies include data transfer restrictions that control cut, copy, and paste operations between managed (corporate) and unmanaged (personal) apps.

The Windows 10 machines used by your firm are signed up for Microsoft Intune. All corporate machines have their service channel settings managed by Intune. A question on the maintenance standing of a certain machine is sent to you. You must read the required policy report. Solution: You use Device configuration to browse the device status. Is the aim being met by the solution?

Answer: NO

Intune offers integrated report views for the Windows update ring policies you deploy. These views display details about the update ring deployment and status: 1. Sign in to the Microsoft Endpoint Manager admin center. 2. Select Devices > Monitor. Then under Software updates select Per update ring deployment state and choose the deployment ring to review.

An organization deploys Outlook with an App Protection Policy requiring PIN. A user says they are not prompted for a PIN. What is the most likely cause?

Answer: The App Protection Policy is not assigned to the user's Azure AD group

If the user's group is not included in the App Protection Policy assignment, the policy never applies and no PIN prompt appears.

What network requirement must be met for Windows Autopilot to function during OOBE?

Answer: The device must have internet connectivity to reach Microsoft cloud services

Autopilot requires internet connectivity during OOBE to contact Microsoft Deployment Service and Azure AD for device registration and profile download.

What is the first thing Intune evaluates when a device checks in for compliance assessment?

Answer: Whether any compliance policies are assigned to the device or user

Intune first checks if any compliance policies are assigned; devices with no compliance policy are considered compliant by default unless the tenant setting is changed.