MD-102 Cheat Sheet 2026

The 30 highest-yield MD-102 facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which Intune feature enforces BitLocker encryption on Windows devices and can store the recovery key in Azure AD? → Endpoint security Disk encryption policy
2. Which feature in Microsoft Endpoint Manager provides insights into device performance metrics like startup times and application reliability scores? → Endpoint analytics
3. An administrator wants to require devices to be Azure AD joined before granting access to a SharePoint site. Which policy type should be used? → Azure AD Conditional Access policy
4. Which tool provides a unified view of update compliance for Windows 10 devices managed by Windows Update for Business? → Windows Update for Business reports (in Azure Monitor)
5. A company wants to prevent users from copying corporate data from managed apps to personal apps on iOS. Which Intune feature should be configured? → App protection policy (MAM)
6. A user needs to sign in to Windows 10 using Windows Hello for Business. Which authentication method does Windows Hello for Business replace? → Password-based authentication
7. Which Azure AD feature can automatically detect risky sign-in events and prompt for MFA or block access based on a risk score? → Identity Protection
8. What are some of the more commonly used device compliance settings? Choose 2 Options → Maximum OS version allowed
9. Which Self-Service Password Reset (SSPR) setting allows users to reset their password using an authenticator app notification? → Mobile app notification
10. What is the primary requirement for a device to be eligible for Windows Autopilot? → Device hardware hash must be registered in Intune/Autopilot
11. A user has left the organization. Which action should an administrator take in Azure AD to immediately prevent the user from signing in? → Disable the user account
12. An admin wants to use Microsoft Intune reporting to understand how effectively Windows security updates are being applied. Which report type is most relevant? → Windows Update compliance reports
13. An administrator wants to prevent users from enrolling more than 3 devices into Intune. Where is this configured? → Enrollment device limit restriction
14. The forest root domain contains objects that don’t exist in other domains in the forest. → True
15. Which Intune app deployment type should be used to deploy a line-of-business (LOB) Win32 application to Windows 10 devices? → Win32 app (IntuneWin package)
16. What is the purpose of the 'Delivery Optimization' setting in Windows update management? → Reduces bandwidth by allowing devices to share update content with each other
17. Which tool is used to migrate user files and settings from an old Windows device to a new one during a PC refresh or replacement? → USMT (User State Migration Tool)
18. A Windows 10 device shows as 'Not evaluated' in the Intune compliance report. What is the most likely reason? → The device has no compliance policies assigned
19. Which Windows connectivity feature allows devices to sync work files from a corporate file server over HTTPS without requiring a full VPN connection? → Work Folders
20. An administrator wants to test feature updates on a pilot group before deploying to all users. Which Intune feature enables this staged deployment approach? → Feature update deployments
21. Which Intune feature integrates with Microsoft Defender for Endpoint to allow Intune compliance policies to use device risk scores? → Mobile Threat Defense connector
22. What tool can be used to extract and upload Windows hardware hashes to Autopilot in bulk? → Get-WindowsAutoPilotInfo PowerShell script
23. What does the Enrollment Status Page (ESP) do during Windows Autopilot deployment? → It blocks the user from accessing the desktop until required apps and policies are applied
24. An administrator needs to remotely remove all corporate data from a user Windows device while leaving personal data intact. Which Intune action achieves this? → Retire
25. Which tool is used to capture a Windows image (.wim file) for deployment using Microsoft Deployment Toolkit (MDT)? → DISM (Deployment Image Servicing and Management)
26. An admin wants to track all administrative changes made in Intune, such as policy creation and device wipes. Which feature should be used? → Audit logs
27. Which action in Intune allows an administrator to remove corporate data from a device while leaving personal data intact? → Retire
28. Which Intune setting enables administrators to enforce a minimum PIN length or password complexity on Windows devices as part of a device compliance policy? → Device compliance System security settings
29. What is the minimum requirement for a device to be eligible for Windows Autopilot deployment? → The device hardware hash must be registered in Intune or Autopilot
30. An administrator needs to see which devices are not compliant with corporate policies. Which Intune report provides this information? → Device compliance report