Microsoft Endpoint MD-102 Exam Questions 2025

The evaluation of these statements hinges on understanding how Microsoft Intune applies enrollment restrictions based on user group membership and priority. Statement 1: User2 is a member of Group2. The only restriction that applies to Group2 is Restriction2 (Priority 2). Restriction2 allows personally owned devices to enroll and requires a minimum Windows version of 10.0.22000. Device1 runs Windows 11, which has a build number of 10.0.22000 or higher, thus meeting the version requirement. Since all conditions of Restriction2 are met, User2 can enroll the personally owned Device1. Statement 2: User1 is a member of Group1. User1 is targeted by both Restriction1 (via Group1) and Restriction2 (via Group1). When multiple restrictions apply, the one with the highest priority (lowest number) is enforced. In this case, Restriction1 (Priority 1) takes precedence over Restriction2 (Priority 2). Restriction1 explicitly blocks personally owned devices. Automatic enrollment for a user's device (not provisioned via AutoPilot or DEM) is treated as a personal enrollment. Therefore, the enrollment is blocked. Statement 3: Similar to the previous statement, User1 is subject to Restriction1 due to its higher priority. Enrolling a device using the Company Portal app is the standard method for personally owned (BYOD) devices. As Restriction1 blocks the enrollment of personally owned devices, User1 cannot enroll Device3.

Microsoft Intune Documentation: Create a device platform enrollment restriction - This

document explains how to configure platform restrictions, including settings for personally

owned devices and OS versions. It also clarifies how priorities are applied when a user or

device is in multiple groups.

URL: https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set#create-adevice-platform-restriction

Microsoft Intune Documentation: Scenario: Block personal Windows devices - This guide

provides a direct example of creating a policy with the highest priority (1) to block personally

owned Windows devices from enrolling, which is the exact scenario affecting User1.

URL: https://docs.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictionsscenarios#scenario--block-personal-windows-devices

Windows 11 Release Information: This official documentation confirms that the initial

release version of Windows 11 corresponds to build 10.0.22000, which satisfies the

condition in Restriction2.

URL: https://docs.microsoft.com/en-us/windows/release-health/release-information

To collect and analyze Windows events in Azure, a Log Analytics workspace must be created. This workspace serves as the central repository for log data and provides the query and analysis tools necessary for creating alerts. To send event data from the Windows 10 computers to the Log Analytics workspace, the Azure Monitor Agent (AMA) must be installed and configured on them. The AMA is the modern, recommended agent for collecting telemetry from Windows client and server operating systems for Azure Monitor. It is configured using Data Collection Rules (DCRs) to specify which events to collect and the destination workspace.

1. Microsoft Learn | Log Analytics workspace overview: "A Log Analytics workspace is a

unique environment for log data from Azure Monitor... The workspace provides a

geographic location for the data, data isolation, and scope for configurations like data

retention."

URL: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspaceoverview

2. Microsoft Learn | Azure Monitor Agent overview: "The Azure Monitor agent (AMA) collects

monitoring data from the guest operating system of Azure and hybrid virtual machines and

delivers it to Azure Monitor... The Azure Monitor agent replaces the Log Analytics agent..."

URL: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agentoverview

3. Microsoft Learn | Collect Windows events with Azure Monitor Agent: "This article

describes how to collect Windows events from virtual machines with the Azure Monitor

Agent... You can collect events from the standard Windows event logs... To collect Windows

events, you create a data collection rule (DCR)."

URL: https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collectionwindows-events

Remote actions in Microsoft Intune, such as Locate device (Action1) and Remote lock (Action2), require that a device be enrolled in and managed by Intune. Statement 1 is No: Device1 is not managed by Intune (MDM is set to None). Therefore, Intune cannot perform any remote actions on it, including locating the device. The device must be enrolled in MDM for such actions to be available. Statement 2 is Yes: Device2 is a Windows 11 device that is managed by Microsoft Intune. The Remote lock action is fully supported for Windows devices that are enrolled in Intune. Statement 3 is Yes: Device3 is an Android device that is managed by Microsoft Intune. The Remote lock action is also supported for Android devices enrolled in Intune.

Microsoft Intune Documentation - Remotely run actions on devices: This document provides

an overview of remote actions, explicitly stating they are run on devices managed by Intune.

Source: Microsoft Learn

URL: https://learn.microsoft.com/en-us/mem/intune/remote-actions/device-management

Microsoft Intune Documentation - Locate device: This source confirms that the "Locate

device" action is only available for devices managed by Intune and lists supported

platforms, which include Windows.

Source: Microsoft Learn

URL: https://learn.microsoft.com/en-us/mem/intune/remote-actions/device-locate

Microsoft Intune Documentation - Remote lock: This document lists the platforms that

support the "Remote lock" action, including Android and Windows, and confirms the action

requires device enrollment in Intune.

Source: Microsoft Learn

URL: https://learn.microsoft.com/en-us/mem/intune/remote-actions/device-remote-lock

To enforce the use of specific passwordless MFA methods, the "Require authentication strength" grant control must be used. This control allows administrators to select a built-in or custom authentication strength that includes only passwordless methods (like FIDO2 security keys or Passwordless phone sign-in). The generic "Require multifactor authentication" option would permit any registered MFA method, not just passwordless ones. The policy must target the "Windows Azure Service Management API" cloud app. This app represents access to the Azure portal, Azure PowerShell, and the Azure CLI, which are all interfaces for managing Azure resources through the Azure Resource Manager.

Microsoft Learn | Conditional Access - Grant: This document details the "Require

authentication strength" control, explaining that it allows administrators to specify the exact

authentication methods required for access. It explicitly lists "Passwordless MFA" as a built-

in authentication strength.

URL: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-accessgrant#require-authentication-strength

Section: "Require authentication strength"

Microsoft Learn | Conditional Access - Cloud apps or actions: This documentation identifies

common cloud apps for Conditional Access policies. It specifies that to secure Microsoft

Azure Management—which includes the Azure portal, Azure PowerShell, and the Azure

CLI—the correct application to select is "Windows Azure Service Management API."

URL: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-accesscloud-apps#microsoft-azure-management

Section: "Microsoft Azure Management"

The available authentication methods for each user are determined by what they have registered in Microsoft Entra ID. Verification code: This method relies on a time-based one-time password (TOTP) generated by a software or hardware OATH token. In this scenario, User2, User3, and User4 are all registered to use a "Software OATH token," which provides such a code. Therefore, they can all use the "Use a verification code" option. Text: This method sends a verification code via an SMS message to a registered phone number. Only User1 has "Mobile phone" listed as their registered method, which enables authentication via text message or phone call. The other users are registered with app- based methods, not SMS.

Microsoft Entra Authentication Methods Documentation: This official documentation outlines

the various authentication methods available in Microsoft Entra ID.

SMS-based authentication: "With SMS-based authentication, users can sign in without

providing, or even knowing, their user name and password. The user instead enters their

phone number, receives a text message with a verification code, and enters that code in the

sign-in interface." This corresponds to User1.

OATH tokens: "Microsoft Entra ID supports the use of OATH-TOTP SHA-1 tokens...

Customers can get these tokens from the vendor of their choice. OATH software tokens are

typically available in applications such as the Microsoft Authenticator app and other

authenticator apps." This corresponds to User2, User3, and User4.

Source: Microsoft Learn, "Authentication methods and features," available at:

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods (Refer to

sections on SMS and OATH tokens).

Remote Help is a cloud-based solution available in Microsoft Intune that enables administrators to establish a secure, shared-screen connection to a user's device. This allows for direct, interactive assistance where both the administrator and the user can see the session. Endpoint Privilege Manager (EPM) is a component of the Intune Suite designed to support a zero-trust architecture and the principle of least privilege. It allows a standard user to perform tasks that require administrative rights. When an administrator is in a Remote Help session and needs to run a process with elevated permissions, EPM provides a mechanism to grant just-in-time elevation for that specific task without making the user a permanent local administrator.

Microsoft Learn | Remote Help: "Remote Help is a cloud-based solution for secure help

desk connections with role-based access controls... With the connection, your support staff

can remote connect to the user's device. During the session, the support staff can view the

device's display and if permitted by the user, take full control."

Source: Microsoft, "Use Remote Help with Microsoft Intune," Microsoft Learn,

(learn.microsoft.com/en-us/mem/intune/remote-actions/remote-help).

Microsoft Learn | Endpoint Privilege Manager: "With Microsoft Intune Endpoint Privilege

Management (EPM), your organization's users can run as a standard user (without

administrator rights) and complete tasks that require elevated privileges... When Remote

Help is used to assist a standard user, the helper can seamlessly request elevation for a

specific application on the user's device."

Source: Microsoft, "Overview of Endpoint Privilege Management with Microsoft Intune,"

Microsoft Learn, (learn.microsoft.com/en-us/mem/intune/protect/endpoint-privilege-

management).

The membership of each device is determined by mapping its "Join type" to the device.deviceTrustType attribute used in the dynamic group rules. Microsoft Entra joined maps to deviceTrustType "AzureAD". Microsoft Entra hybrid joined maps to deviceTrustType "ServerAD". Microsoft Entra registered maps to deviceTrustType "Workplace". Device1: No Device1 is Microsoft Entra hybrid joined, so its deviceTrustType is "ServerAD". It does not match the rule for Group1 ("AzureAD") or Group2 ("Workplace"). Therefore, it is not a member of either group. Device2: No Device2 is Microsoft Entra joined (deviceTrustType is "AzureAD") and its OS is Windows. It matches both conditions for Group1. However, it does not match the rule for Group2 ("Workplace"). Therefore, it is a member of Group1 only, making the statement false. Device3: Yes Device3 is Microsoft Entra registered, so its deviceTrustType is "Workplace". It matches the rule for Group2. It does not match the deviceTrustType rule for Group1 ("AzureAD"). Therefore, it is a member of Group2 only.

Microsoft Entra Documentation: Dynamic membership rules for groups in Microsoft Entra

ID. This official documentation lists the properties available for device rules. Under the

deviceTrustType property, it specifies the possible values: "The trust type of the device. The

possible values are AzureAD, ServerAD (for hybrid joined), or Workplace (for registered)."

URL: https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership

The CustomSettings.ini file contains the rules that govern the deployment process. To prompt for the local Administrator password, the AdminPassword property is left blank in this file, which causes the deployment wizard to display the corresponding page. To define a computer naming convention, the OSDComputerName property is set in CustomSettings.ini (e.g., OSDComputerName=PC-%SerialNumber%). Modifications to CustomSettings.ini are processed after the Windows Preinstallation Environment (WinPE) connects to the deployment share, and therefore do not require updating the WinPE boot image, satisfying all requirements of the question. The Bootstrap.ini file is processed by WinPE itself, and changes to it would necessitate a WinPE image update.

1. Microsoft Learn. (2023). Configure MDT deployment share rules. This document explicitly

shows how to configure rules like computer naming (OSDComputerName) in the

CustomSettings.ini file. It also explains that the wizard will prompt for information not

supplied in the rules.

URL: https://learn.microsoft.com/en-us/windows/deployment/deploy-windowsmdt/configure-mdt-deployment-share-rules

2. Microsoft Learn. (2023). MDT toolkit reference. This reference details the properties used

in MDT rules. It lists AdminPassword and OSDComputerName as properties configured in

the rules files (CustomSettings.ini). It also clarifies the distinction between Bootstrap.ini (for

connecting to the share) and CustomSettings.ini (for controlling the deployment).

URL: https://learn.microsoft.com/en-us/mem/configmgr/mdt/toolkit-reference#properties

URL: https://learn.microsoft.com/en-us/mem/configmgr/mdt/toolkitreference#understanding-rules-files

Microsoft Tunnel for Mobile Application Management (MAM) has specific operating system version requirements. It is supported on Android 10.0 and later and iOS/iPadOS 14.0 and later. Therefore, Device2 (Android 13) and Device3 (iOS 15.8.3) meet these criteria, while Device1 (iOS 13.7) does not. A standard per-app VPN is a broader capability supported by Microsoft Intune's device management for modern mobile operating systems. All three devices listed—Device1 (iOS 13.7), Device2 (Android 13), and Device3 (iOS 15.8.3)—support the configuration of a per- app VPN tunnel through Intune device configuration policies.

Microsoft Learn | Microsoft Tunnel for MAM: This official documentation specifies the

prerequisites for using Tunnel for MAM.

Source: Microsoft Official Documentation

URL: https://learn.microsoft.com/en-us/mem/intune/protect/microsoft-tunnel-mam

Specific Section: Under the "Prerequisites" section, it explicitly lists the supported platforms

and versions: "iOS/iPadOS 14.0 and later" and "Android Enterprise 10.0 and later."

Microsoft Learn | Create per-app VPN profiles: This document outlines how to set up per-

app VPN for various platforms, confirming its availability for the listed operating systems.

Source: Microsoft Official Documentation

URL: https://learn.microsoft.com/en-us/mem/intune/configuration/vpn-settings-per-app

Specific Section: The article provides configuration guidance for both "Android Enterprise"

and "iOS/iPadOS," demonstrating that this is a standard feature for both platforms managed

by Intune.

Based on the provided iOS app protection policy settings: The Access requirements section has both PIN for access and Work or school account credentials for access set to Require. The setting Recheck the access requirements after /minutes of inactivity is configured for 30 minutes. Therefore, after 30 minutes of inactivity, the user must satisfy all the required access settings, which includes providing both their PIN and their work or school account credentials. The Conditional launch section specifies the actions taken based on certain conditions. The setting Max PIN attempts is set to 5, and the corresponding Action is explicitly defined as Reset PIN. This means that after five incorrect PIN attempts, the system will force a reset of the application PIN.

Source: Microsoft Learn | Official Microsoft Intune Documentation

Reference 1: iOS/iPadOS app protection policy settings - Access requirements. This

document details the access settings for Intune app protection policies. It specifies that

when multiple access requirements like 'PIN for access' and 'Work or school account

credentials for access' are set to 'Require', and the 'Recheck the access requirements after

(minutes of inactivity)' timer expires, the user will be prompted to satisfy those requirements.

URL: https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settingsios#access-requirements

Section: Access requirements > "Recheck the access requirements after (minutes of

inactivity)"

Reference 2: iOS/iPadOS app protection policy settings - Conditional launch. This

document explains the conditional launch settings. It confirms that the Max PIN attempts

setting, when reached, triggers the configured action. The available actions are Reset PIN

or Wipe data. The exhibit shows Reset PIN is the configured action.

URL: https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settingsios#conditional-launch

Section: Conditional launch > "App PIN" settings > "Max PIN attempts"

/apps/app-protection-policy-settings-ios#restrict-cut-copy-and-paste-between-other-apps