MS-102 Microsoft 365 Administrator Expert Managing Intune and Device Compliance 1 — Questions and Answers
Question 1: Which enrollment method allows Windows 10/11 devices to be joined to Azure AD and automatically enrolled in Intune during the out-of-box experience (OOBE)?
- Microsoft Endpoint Configuration Manager co-management
- Windows Autopilot (Correct answer)
- Group Policy-based enrollment
- Apple Business Manager
Correct answer: Windows Autopilot
Windows Autopilot enables zero-touch deployment by joining devices to Azure AD and enrolling them in Intune automatically during the OOBE without IT needing to image the device.
Question 2: What is the default maximum number of devices a single user can enroll in Microsoft Intune?
- 3
- 5 (Correct answer)
- 10
- 15
Correct answer: 5
By default, each user is allowed to enroll up to 5 devices in Microsoft Intune, though this limit can be adjusted via enrollment restrictions.
Question 3: Which enrollment method is used for iOS/iPadOS corporate-owned devices purchased through Apple Business Manager to enable supervised, zero-touch enrollment in Intune?
- User enrollment (BYOD)
- Automated Device Enrollment (ADE) (Correct answer)
- Apple Configurator enrollment
- Android Enterprise enrollment
Correct answer: Automated Device Enrollment (ADE)
Apple's Automated Device Enrollment (ADE), formerly Device Enrollment Program (DEP), integrates with Apple Business Manager to enable supervised, zero-touch Intune enrollment for corporate iOS/iPadOS devices.
Question 4: An organization wants to ensure only compliant devices can access Exchange Online. Which Intune feature, combined with Conditional Access, enforces this requirement?
- App protection policies
- Device compliance policies (Correct answer)
- Device configuration profiles
- Endpoint security policies
Correct answer: Device compliance policies
Device compliance policies define the security rules a device must meet, and when paired with Conditional Access, Intune marks non-compliant devices as blocked from accessing Exchange Online.
Question 5: What happens to a device's compliance status in Intune when the device fails to check in before the configured compliance grace period expires?
- The device is automatically removed from Intune
- The device is marked as Not compliant (Correct answer)
- The device retains its last known compliance status indefinitely
- The device is placed in quarantine pending manual review
Correct answer: The device is marked as Not compliant
When a device exceeds the grace period without checking in, Intune marks it as Not compliant, which can trigger Conditional Access to block resource access.
Question 6: Which Android Enterprise enrollment mode in Intune provides the highest level of corporate management, including full device wipe, and is designed for corporate-owned devices used exclusively for work?
- Personally-owned work profile
- Corporate-owned work profile
- Fully managed (COBO) (Correct answer)
- Android device administrator (legacy)
Correct answer: Fully managed (COBO)
Android Enterprise fully managed (COBO — Corporate Owned, Business Only) provides complete device control, including full wipe, and is designed for devices used solely for corporate purposes.
Question 7: What information must be collected from a device and uploaded to Intune or the Microsoft 365 admin center in order to register it for Windows Autopilot?
- Device MAC address and IP address
- Device serial number and hardware hash (Correct answer)
- Device IMEI number and Azure AD object ID
- Device hostname and domain join credentials
Correct answer: Device serial number and hardware hash
Autopilot registration requires the device's hardware hash (which includes the serial number) to be uploaded so Azure AD can identify the device during the OOBE.
MS-102 Microsoft 365 Administrator Expert Managing Intune and Device Compliance 1
Which enrollment method allows Windows 10/11 devices to be joined to Azure AD and automatically enrolled in Intune during the out-of-box experience (OOBE)?