Free MD-102 Exam Flashcards

Cloud-only device identity managed with Intune, with no on-premises Active Directory dependency. The default choice for fully remote or cloud-first Windows deployments.

Device is joined to both on-premises AD and Entra ID. Used when on-prem resources or Group Policy still apply; hybrid Autopilot needs the Intune Connector for Active Directory.

Registered = a personal/BYOD device with a workplace account added; joined = an organization-owned identity. Registration suits BYOD; join suits corporate-managed endpoints.

Entra-joined Windows auto-enrolls into Intune only if the user is in the MDM user scope. If scope is unset, the join can succeed while Intune enrollment silently never happens.

Allow or block enrollment by platform and ownership type. The correct control to block personal Windows enrollment while still permitting corporate-owned devices.

For individually assigned devices: the end user signs in and completes setup. The standard Autopilot choice for new corporate laptops shipped directly to a user.

Provisions a device with no user credentials, typically for kiosk or shared/digital-signage scenarios. Requires TPM 2.0 attestation; no per-user assignment during setup.

Controls what the user sees during Autopilot setup and whether desktop access is blocked until required apps and policies finish installing. Tunes the out-of-box experience.

Required for hybrid Entra-joined Autopilot so the device can be domain-joined during provisioning. Cloud-only Entra-joined Autopilot does not need it.

Created with Windows Configuration Designer to apply settings and bulk-enroll devices without a full reimage. An alternative to Autopilot for quick, repeatable configuration.

Defines which service manages enrolled devices; for MD-102 scenarios this is Intune. Automatic enrollment depends on Intune being the configured MDM authority for the users.

Automatic enrollment uses Entra MDM scope at join time; bulk enrollment uses a provisioning package to onboard many devices at once. Choose by deployment scale and setup flow.

Exposes a very large set of individual Windows (and cross-platform) settings and is usually the first choice for broad policy coverage, reducing the need for custom OMA-URI profiles.

Templates are grouped, prebuilt scenarios (e.g., device restrictions); the settings catalog is a flat, searchable list. Use templates for known scenarios, catalog for granular control.

Refine an assignment to a subset of devices using device properties (OS version, model, ownership) without creating new groups. Applied at assignment time, not on the policy itself.

Manages the local administrator password so each device has a unique, automatically rotating credential, reducing lateral-movement risk from shared local admin passwords.

Replaces passwords with a device-bound credential (PIN or biometric) backed by asymmetric keys. A core identity-protection control configured through Intune policy.

Wipe returns the device to factory state and removes content. Retire is less destructive: it removes only management/company data and leaves the rest of the device intact.

Removes user data and personal settings but keeps Intune enrollment and Autopilot assignment, returning the device to a business-ready state without re-imaging. Good for reassigning in-service hardware.

Reinstalls Windows and removes preinstalled OEM apps while optionally retaining user data. Useful to clean a device of bloatware without a full manual rebuild.

A managed cloud-hosted Windows desktop streamed to users and administered through Intune. Provisioning needs a Cloud PC license, a provisioning policy, and network/identity prerequisites.

Feature update policies pin devices to a specific Windows feature version; update rings control servicing behavior such as deferral periods and restart settings. They solve different problems.

Quality updates deliver security/reliability fixes. An expedite update policy pushes a critical patch quickly, overriding deferrals when urgent remediation is required.

Elevates approved processes without granting standing local-admin rights, supporting least privilege while still allowing specific business apps to run elevated.

Surfaces endpoint experience metrics such as startup performance, app reliability, and recommended remediations, helping prioritize fixes that affect user productivity.

The device status view of a configuration profile shows which devices succeeded, failed, or are pending for that specific policy, the most direct starting point for troubleshooting.

Provides authenticated, RBAC-controlled remote assistance to managed devices from within Intune, replacing ad hoc third-party remote tools for support scenarios.

The packaging format for full Win32 deployments via Intune. Supports detection rules, requirement rules, dependencies, and supersedence for richer deployment control.

Lets a newer app version replace or upgrade an older one. The recommended path to roll out an update is creating a new app version configured to supersede the prior package.

Tell Intune how to determine whether a Win32 app is already installed (file, registry, or MSI code). Incorrect detection rules cause repeated reinstalls or false success.

Required installs the app automatically on targeted devices/users; available publishes it to the Company Portal for optional, user-initiated installation.

Deploy Microsoft 365 Apps as a dedicated app type with configured channel, architecture, and language. Channel choice controls feature-update cadence for the suite.

The correct Microsoft 365 Apps activation model for devices used by multiple people (e.g., shared/pooled or VDI), so licensing aligns with shared usage rather than per-device activation.

Protect organizational data inside supported apps even on unenrolled devices, enforcing encryption, PIN, and copy/paste restrictions. A common BYOD mobile data-protection choice.

Push preconfigured settings into managed apps (e.g., server URLs, account defaults) so users do not configure them manually. Delivery differs for managed-device vs. managed-app channels.

App protection (managed apps) secures data at the app layer without enrollment; managed devices are fully MDM-enrolled. Conditional Access can require either, depending on the data-protection goal.

Surfaces and helps package common enterprise apps and shows available updates, but updates are not auto-applied; you still create a superseding version to roll them out.

A compliance policy evaluates device state; Conditional Access then requires the device be marked compliant before granting access. This pairing enforces compliant-device access.

Compliance policies evaluate and report device state for access decisions; configuration profiles set device settings. Endpoint security policies are a separate, security-focused workload.

The dedicated Intune policy area for managing BitLocker (and macOS FileVault) settings on devices, more targeted than configuring encryption through general configuration profiles.

Microsoft-recommended preconfigured security setting groups (e.g., for Windows or Defender) that you can deploy and customize as a hardened starting point rather than building from scratch.

Endpoint security rules that block risky behaviors such as suspicious Office child processes, executable content from email, and credential-theft patterns, with audit and block modes.

Devices must be onboarded to Microsoft Defender for Endpoint and the connector enabled so security signals flow between the services. A prerequisite for risk-based compliance.

An Intune compliance policy can reference the device risk level from Defender for Endpoint; Conditional Access then blocks access when risk exceeds the allowed threshold.

Refreshes the recovery key for the OS drive on supported Windows devices. The correct response after a recovery key is used or exposed, limiting the value of the old key.

Configures Microsoft Defender Antivirus behavior (scans, real-time protection, exclusions) as a focused endpoint security workload separate from general device configuration.

Manages Windows Defender Firewall profiles and rules through Intune endpoint security, controlling inbound/outbound behavior centrally rather than per device.

Requires an app protection policy (approved client app / app protection grant) before access to corporate data is allowed, protecting data on unmanaged devices.

Reduces internet bandwidth for updates and large app content by allowing peer-to-peer and cache sources. Tuned alongside update rings for efficient large-scale servicing.

Manage and maintain devices is the largest domain (30-35%), then Prepare infrastructure (25-30%); Manage applications and Protect devices are 15-20% each. Weight study time accordingly.