Microsoft 365 Administrator Expert Managing Intune and Device Compliance Flashcards

What is the key difference between Intune App Protection Policies (APP/MAM) and device compliance policies?

Answer: APP protects organizational data within apps without requiring device enrollment in Intune

App Protection Policies (MAM) protect corporate data within managed apps on any device — including unenrolled personal devices — without requiring full device management through Intune enrollment.

An organization wants to prevent users from pasting content from the corporate Outlook mobile app into a personal notes app on their iOS device. Which Intune feature should be configured?

Answer: App protection policy with data transfer restrictions

App protection policies include Data transfer settings that can restrict cut, copy, and paste between policy-managed and unmanaged apps, preventing data leakage to personal applications.

What is 'co-management' in the context of Microsoft Intune and Microsoft Endpoint Configuration Manager (MECM)?

Answer: Sharing device management workloads between Configuration Manager and Intune simultaneously

Co-management connects existing ConfigMgr-managed Windows devices to Intune and allows organizations to progressively shift specific management workloads (e.g., Compliance, Device Configuration) from on-premises ConfigMgr to cloud-based Intune.

Which Microsoft Intune capability uses machine learning to provide insights into device startup performance, app reliability, and recommendations to improve end-user experience?

Answer: Endpoint analytics

Endpoint analytics analyzes device startup performance, policy processing times, app reliability scores, and other metrics, using machine learning to surface actionable recommendations.

When an administrator performs a 'Fresh Start' remote action on a Windows 10/11 device in Intune, what is the outcome?

Answer: Windows is reinstalled, OEM pre-installed apps are removed, and user data can optionally be retained

Fresh Start reinstalls a clean version of Windows 10/11, removes OEM bloatware, and gives the administrator the option to keep the user's personal files while ensuring a clean OS state.

Which Intune policy type should be used to configure Windows Defender Antivirus settings — such as real-time protection, cloud-delivered protection, and exclusions — on managed Windows 10/11 devices?

Answer: Endpoint security – Antivirus policy

Endpoint security Antivirus policies in Intune provide a dedicated interface for configuring Windows Defender Antivirus settings, separate from broader device configuration profiles.

An administrator needs to require users to enter a PIN when accessing corporate apps managed by Intune on iOS after 30 minutes of inactivity. Where is this setting configured?

Answer: App protection policy – Access requirements

App protection policies include Access requirements settings where administrators can configure PIN requirements, timeout periods (recheck access requirements after), and biometric options for managed apps on iOS/iPadOS.