Microsoft Endpoint MD-102 Exam Questions 2025

Updated:
Reviews Demo Exam Description

Our MD-102 Exam Questions provide authentic and updated questions for the Microsoft Endpoint Administrator certification, carefully reviewed by Microsoft experts. Each set includes verified answers with detailed explanations and insights into incorrect options to help you strengthen your endpoint management skills. With free demo questions and our online exam simulator, Cert Empire makes preparing for the MD-102 exam simple, effective, and reliable.

Exam Questions

Question 1

Your on-premises network contains an Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains a domain controller named dc1.contoso.com. You have a Microsoft 365 E5 subscription that uses Microsoft Intune Suite. You have an Azure subscription that contains the resources shown in the following table. MD 102 - Endpoint Administrator Associate exam question The subscription contains the virtual networks shown in the following table. MD 102 - Endpoint Administrator Associate exam question You plan to deploy Windows 365 Enterprise Cloud PC. You need to create an Azure network connection (ANC) that will use Microsoft Entra hybrid join. Which virtual network can you use for the ANC?

Options
A:

A. VNet1 only
B:

B. VNet2 only
C:

C. VNet3 only
D:

D. VNet1 and VNet2
E:

E. VNet1 and VNet3
Show Answer
Correct Answer:

A

Explanation

To create an Azure Network Connection (ANC) for Windows 365 that uses Microsoft Entra hybrid join, the selected virtual network (VNet) must have network line-of-sight to an on- premises Active Directory Domain Services (AD DS) domain controller. This connectivity allows the Cloud PCs to join the on-premises domain. An ANC is configured to use a single VNet and a single subnet within that VNet. While any of the three VNets could potentially be configured with the required connectivity (e.g., via a VPN gateway or ExpressRoute), the question asks which single VNet can be used. Without any information indicating that VNet2 or VNet3 have the required connectivity, and given that VNet1 is a valid VNet in a supported region, it stands as a viable candidate for this configuration.

Why Incorrect Options are Wrong

VNet2 only: There is no information provided to indicate that VNet2 has the necessary on- premises connectivity while VNet1 does not. VNet3 only: Similar to VNet2, there is no information confirming that VNet3 has the required connectivity to the on-premises domain controller. VNet1 and VNet2: An Azure Network Connection is configured for a single virtual network. You cannot select multiple VNets for a single ANC. VNet1 and VNet3: This option is incorrect for the same reason; an ANC maps to one specific VNet, not multiple.

References

Microsoft Documentation - Create an Azure network connection: This document outlines the

requirements for creating an ANC. For Microsoft Entra hybrid join, it explicitly states, "The

virtual network must have connectivity to your on-premises domain controller." It also shows

that the creation process involves selecting a single virtual network.

URL: https://learn.microsoft.com/en-us/windows-365/enterprise/create-azure-networkconnection

Microsoft Documentation - Azure network connection health checks: This document details

the verification checks performed on an ANC, which include "AD domain join" and "Domain

name resolution." These checks would fail if the selected VNet lacks line-of-sight and proper

DNS configuration to reach the on-premises domain controller.

URL: https://learn.microsoft.com/en-us/windows-365/enterprise/health-checks

Question 2

HOTSPOT - You have a Microsoft 365 subscription. You have 25 Microsoft Surface Hub devices that you plan to manage by using Microsoft Intune. You need to configure the devices to meet the following requirements: Enable Windows Hello for Business. Configure Microsoft Defender SmartScreen to block users from running unverified files. Which profile type template should you use for each requirement? To answer, select the appropriate options in the answer area. MD 102 - Endpoint Administrator Associate exam question

Show Answer
Correct Answer:

ENABLE WINDOWS HELLO FOR BUSINESS: IDENTITY PROTECTION CONFIGURE MICROSOFT DEFENDER SMARTSCREEN TO BLOCK USERS FROM RUNNING UNVERIFIED FILES: DEVICE RESTRICTIONS

Explanation

In Microsoft Intune, specific configuration tasks are mapped to dedicated profile templates for streamlined management. 1. Windows Hello for Business is an identity and credential management feature. The Identity protection profile template is designed exclusively for configuring Windows Hello for Business settings on Windows 10/11 devices, including Surface Hubs. 2. Microsoft Defender SmartScreen settings are part of the broader device security and feature controls. The Device restrictions profile template for Windows 10 and later contains a specific category for "Microsoft Defender SmartScreen," which includes the options to control how it handles unverified files and applications.

References

1. Microsoft Learn | Manage Windows Hello for Business on devices with Microsoft Intune:

"To manage settings for Windows Hello for Business on Windows 10/11 devices, you'll use

an Identity protection profile as part of a device configuration policy."

URL: https://learn.microsoft.com/en-us/mem/intune/protect/identity-protection-configure

2. Microsoft Learn | Windows 10/11 device settings to allow or restrict features using Intune:

This document details the settings available in the Device restrictions template. Under the

"Microsoft Defender SmartScreen" section, it lists settings such as "Block users from

ignoring SmartScreen warnings" and "Prevent bypassing SmartScreen warnings for files,"

which directly address the requirement.

URL: https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictionswindows-10

3. Microsoft Learn | Manage Surface Hub with Microsoft Intune: This document confirms

that Surface Hub devices running Windows 10/11 Team edition are managed using

standard Windows device configuration profiles in Intune, including the aforementioned

templates.

URL: https://learn.microsoft.com/en-us/surface-hub/manage-surface-hub-with-intune

Question 3

HOTSPOT - You have a Microsoft 365 E5 subscription that contains the security groups shown in the following table. MD 102 - Endpoint Administrator Associate exam question The subscription contains devices that run Windows 11, version 21H2 as shown in the following table. MD 102 - Endpoint Administrator Associate exam question You have a feature update deployment profile named Deployment1 as shown in the following table. MD 102 - Endpoint Administrator Associate exam question For each of the following statements, select Yes if the statement is true. Otherwise, select No. MD 102 - Endpoint Administrator Associate exam question

Show Answer
Correct Answer:

DEVICE1 WILL BE UPGRADED TO WINDOWS 11, VERSION 22H2. NO DEVICE2 WILL BE UPGRADED TO WINDOWS 11, VERSION 22H2. YES DEVICE3 WILL BE UPGRADED TO WINDOWS 11, VERSION 22H2. NO

Explanation

The deployment profile for the Windows 11, version 22H2 feature update is assigned to Group2 (the included group) but is blocked for devices in Group1 and Group3 (the excluded groups). In Microsoft Intune, an exclusion will always override an inclusion. Device1: This device is a member of the included Group2 because its operating system is "Windows." However, it is also a member of the excluded Group3 because its extensionAttribute1 is set to "Test." Since exclusions take precedence, Device1 will not be upgraded. Device2: This device is a member of the included Group2 as its OS is "Windows." It is not a member of the excluded Group1 (by assignment) or the excluded Group3 (its extensionAttribute1 is not "Test"). Therefore, Device2 will be upgraded. Device3: This device is a member of the included Group2 because its OS is "Windows." It is also an assigned member of the excluded Group1. Because exclusions override inclusions, Device3 will not be upgraded.

References

Microsoft Intune Documentation - Assign device profiles: This document explicitly states

that assignments to excluded groups override assignments to included groups. "If a device

is in two groups, one group that's assigned to an exclusion and another group that's

assigned for inclusion, the device is excluded and doesn't receive the policy."

Source: Microsoft Learn, "Assign user and device profiles in Microsoft Intune,"

section: Include and exclude groups.

URL: https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-assign#includeand-exclude-groups

Azure AD Documentation - Dynamic membership rules: This resource explains the syntax

for creating dynamic membership rules for groups, which is used here for Group2 and

Group3.

Source: Microsoft Learn, "Dynamic membership rules for groups in Azure Active

Directory."

URL: https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamicmembership

Question 4

HOTSPOT - You have a Microsoft 365 E5 subscription that uses Microsoft Intune. You need to ensure that users can only enroll devices that meet the following requirements: Android devices that support the use of work profiles. iOS devices that run iOS 11.0 or later. Which two restrictions should you modify? To answer, select the restrictions in the answer area. MD 102 - Endpoint Administrator Associate exam question

Show Answer
Correct Answer:

1. ANDROID DEVICE ADMINISTRATOR 2. IOS/IPADOS

Explanation

Block the Android device administrator platform in the enrollment device type restriction so only Android Enterprise Work Profile-capable devices can enroll. Then edit the iOS/iPadOS restriction to set a minimum OS version of 11.0, ensuring only iPhones/iPads running iOS 11 or later are accepted.

References

1. Microsoft Intune “ Create a device platform restriction

https://learn.microsoft.com/mem/intune/enrollment/enrollment-restrictions-platform

Blocking Android device administrator forces enrollment through Android Enterprise Work

Profile.

Platform restrictions let you set minimum iOS/iPadOS version (e.g., 11.0).

Question 5

You have a Microsoft 365 subscription that uses Microsoft Intune Suite. You use Intune to manage Windows 11 devices. You need to implement Windows Local Administrator Password Solution (Windows LAPS). What should you configure?

Options
A:

A. a configuration profile
B:

B. an account protection policy
C:

C. an app protection policy
D:

D. a device compliance policy
Show Answer
Correct Answer:

B

Explanation

To implement Windows Local Administrator Password Solution (LAPS) in Microsoft Intune, you must create an Account protection policy. This policy type is located within the Endpoint security workload of the Intune admin center. It is the specific, purpose-built profile for configuring all LAPS settings, such as the backup directory (Azure AD or on-premises Active Directory), password age, complexity, and the name of the administrator account to manage.

Why Incorrect Options are Wrong

A. a configuration profile: While configuration profiles are used for many device settings, Intune provides a dedicated Account protection policy specifically for LAPS, making it the most precise and correct tool. C. an app protection policy: These policies manage data security within applications (e.g., preventing copy/paste) and are not used for configuring operating system-level account management features. D. a device compliance policy: A compliance policy evaluates a device's state against a set of rules to determine if it is compliant; it does not actively configure features like LAPS.

References

Microsoft Learn: "Create a LAPS policy." This official documentation explicitly states: "Use

the following steps to create a policy to manage Windows LAPS... In the Microsoft Intune

admin center, go to Endpoint security > Account protection > select Create Policy."

URL: https://learn.microsoft.com/en-us/mem/intune/protect/windows-laps-configure#createa-laps-policy

Microsoft Learn: "Manage Windows LAPS with Microsoft Intune." This document provides

an overview and confirms that LAPS policies are part of the Account protection policies in

Endpoint security.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/windows-laps-overview

Question 6

You have a Microsoft 365 subscription that contains 500 computers that run Windows 11. The computers are Microsoft Entra joined and are enrolled in Microsoft Intune. You plan to manage Microsoft Defender for Endpoint on the computers. You need to prevent users from disabling Microsoft Defender for Endpoint. What should you do?

Options
A:

A. From the Microsoft Intune admin center, create a security baseline.
B:

B. From the Microsoft Intune admin center, create an antivirus policy.
C:

C. From the Microsoft Entra admin center, create a Conditional Access policy.
D:

D. From the Microsoft Intune admin center, create a device compliance policy.
Show Answer
Correct Answer:

B

Explanation

The most direct and precise method to prevent users from disabling Microsoft Defender for Endpoint is to enable Tamper Protection. In Microsoft Intune, Tamper Protection is a specific setting configured within an Endpoint security antivirus policy. This type of policy is purpose- built for managing all aspects of Microsoft Defender Antivirus, including enforcing settings that prevent unauthorized changes by local users or malicious applications. Creating an antivirus policy allows an administrator to granularly control Defender settings without applying a broader, potentially disruptive set of configurations.

Why Incorrect Options are Wrong

A. From the Microsoft Intune admin center, create a security baseline: While a security baseline can enable Tamper Protection, it applies a wide range of pre-configured settings, making it less precise than a targeted antivirus policy for this specific requirement. C. From the Microsoft Entra admin center, create a Conditional Access policy: Conditional Access policies are used to grant or block access to cloud resources based on conditions. They do not configure security settings directly on the endpoint itself. D. From the Microsoft Intune admin center, create a device compliance policy: A compliance policy can check if Defender is enabled and report the device as non-compliant if it's not. However, it is a reactive measure and does not prevent the user from disabling it.

References

1. Microsoft Learn: "Protect security settings with tamper protection." This document

explicitly states the primary method for configuration: "In the Microsoft Intune admin center,

go to Endpoint security > Antivirus, and then choose + Create Policy. ... For Profile, select

Microsoft Defender Antivirus." This confirms that the antivirus policy is the correct tool.

URL: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/preventchanges-to-security-settings-with-tamper-protection?view=o365-worldwide#manage-

tamper-protection-for-your-organization-using-microsoft-intune

2. Microsoft Learn: "Antivirus policy for endpoint security in Intune." This document

describes the purpose of antivirus policies: "Use endpoint security Antivirus policies to help

your security admins focus on managing the discrete group of antivirus settings for

managed devices."

URL: https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-antiviruspolicy

3. Microsoft Learn: "Use compliance policies to set rules for devices you manage with

Intune." This source clarifies that compliance policies are for evaluating and reporting on

device state, not for enforcing configuration settings.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

Question 7

You have a Microsoft 365 subscription that includes Microsoft Intune. You need to deploy a custom app to Android devices. The app uses the APK file format. Which type of app should you select for the deployment?

Options
A:

A. built-in
B:

B. Android store
C:

C. Managed Google Play
D:

D. line-of-business (LOB)
E:

E. web link
Show Answer
Correct Answer:

LINE-OF-BUSINESS (LOB)

Explanation

In Microsoft Intune, a line-of-business (LOB) app is an application that is added from an app installation file, which is typically developed in-house. For Android devices, this specifically refers to uploading the app installation package file (APK) directly into the Intune admin center for deployment. This method is used for custom apps that are not intended for the public Google Play Store.

Why Incorrect Options are Wrong

built-in: This app type is for a curated list of common applications, such as Microsoft 365 apps, that Intune makes easy to deploy, not for custom APKs. Android store: This option is used to deploy publicly available applications directly from the official Google Play Store. Managed Google Play: This is the enterprise app store for Android Enterprise. While you can publish private apps to it, the direct upload of an APK file into Intune is categorized as a LOB app. web link: This option deploys a shortcut to a web app or website on the device's home screen, not an installable APK file.

References

Microsoft Learn. (2024). Add an Android line-of-business app to Microsoft Intune. Microsoft

Docs. Retrieved from https://learn.microsoft.com/en-us/mem/intune/apps/apps-lob-android

Microsoft Learn. (2024). App types in Microsoft Intune. Microsoft Docs. Retrieved from

https://learn.microsoft.com/en-us/mem/intune/apps/apps-add#app-types-in-microsoft-intune

Question 8

You have a Microsoft 365 E5 subscription. You use Microsoft Intune to manage all devices. You need to prepare a Win32 app named App1.exe for deployment. What should you do first?

Options
A:

A. From the Microsoft Intune admin center, create an app configuration policy.
B:

B. Change App1.exe to the INTUNEWIN format.
C:

C. From the Microsoft 365 Apps admin center, create a deployment configuration.
D:

D. Upload App1.exe to Azure Blob Storage.
Show Answer
Correct Answer:

CHANGE APP1.EXE TO THE INTUNEWIN FORMAT.

Explanation

Before a Win32 application can be deployed using Microsoft Intune, it must be prepared and packaged. The required first step is to use the Microsoft Win32 Content Prep Tool to convert the application's setup files (in this case, App1.exe) into a single .intunewin file. This packaging process wraps the installer and any other necessary files into a format that Intune can distribute and manage. This prepared file is then uploaded to Intune when creating the application deployment.

Why Incorrect Options are Wrong

From the Microsoft Intune admin center, create an app configuration policy: App configuration policies are used to supply custom settings to an app after it is installed, not to prepare the app package itself. From the Microsoft 365 Apps admin center, create a deployment configuration: This admin center is specifically for managing Microsoft 365 Apps (Office), not for preparing or deploying general Win32 applications. Upload App1.exe to Azure Blob Storage: You upload the prepared .intunewin file to Intune during the app creation wizard, not the raw .exe file to a separate Azure Blob Storage account.

References

Microsoft Learn. (2024). Win32 app management in Microsoft Intune. Microsoft Docs.

Retrieved from https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-appmanagement

Microsoft Learn. (2024). Prepare Win32 app content for upload. Microsoft Docs. Retrieved

from https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-prepare (This

document explicitly states, "Before you can add a Win32 app to Microsoft Intune, you must

prepare the app by using the Microsoft Win32 Content Prep Tool.")

Question 9

You have a Microsoft 365 E5 subscription that includes Microsoft Intune. For macOS devices, you create an update policy named Policy1 that has the following settings: All other updates (OS, built-in apps): Download and install Assignments: Included groups: All Devices Which two types of updates can be downloaded and installed by using Policy1? Each correct answer presents part of the solution.

Options
A:

A. configuration file
B:

B. macOS
C:

C. firmware
D:

D. critical
E:

E. built-in app
Show Answer
Correct Answer:

B, E

Explanation

The Microsoft Intune update policy for macOS devices includes a setting specifically named "All other updates (OS, built-in apps)". The scenario states that Policy1 configures this exact setting to "Download and install". This setting is designed to manage updates for the core operating system (macOS) and the applications that are included with the OS by default (built-in apps). Therefore, Policy1 will download and install both macOS updates and built-in app updates.

Why Incorrect Options are Wrong

configuration file: This is a separate, distinct category within the macOS update policy for managing security data files (e.g., XProtect) and is not governed by the "All other updates" setting. firmware: Firmware updates are managed by their own specific setting within the Intune policy, separate from the "All other updates" category. critical: Critical updates are also a distinct, configurable category within the macOS update policy, allowing them to be managed independently of other OS and app updates.

References

Microsoft Learn: Manage macOS software update policies in Intune. This official

documentation details the configurable settings for macOS update policies. It explicitly lists

"Critical updates," "Firmware updates," "Configuration file updates," and "All other updates

(OS, built-in apps)" as separate, distinct settings, confirming that the latter only controls OS

and built-in app updates.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos (Refer

to the "Update policy settings" section).

Question 10

HOTSPOT - You have a Microsoft 365 E5 subscription that includes Microsoft Intune. The subscription contains a group named Group1. Group1 contains devices enrolled in Intune. You deploy Remote Help in Intune. You need to configure Remote Help to only allow support administrators to join Remote Help sessions from the devices in Group1. Which type of Microsoft Entra object should you create, and which type of policy should you configure? To answer, select the appropriate options in the answer area. MD 102 - Endpoint Administrator Associate exam question

Show Answer
Correct Answer:

MICROSOFT ENTRA OBJECT: AN ENTERPRISE APPLICATION POLICY: CONDITIONAL ACCESS

Explanation

To restrict access to a cloud application like Remote Help based on the device a user is signing in from, you must use a Conditional Access policy. This type of policy allows administrators to create "if-then" rules for access control. In this scenario, the rule would be: IF a user in the "support administrators" group tries to access... ...the Remote Help cloud application... THEN they must be using a device that is a member of Group1. The Remote Help service is represented within Microsoft Entra ID as an enterprise application. The Conditional Access policy is configured to target this specific enterprise application. The policy's conditions then use a device filter to ensure the user's device is in the required group (Group1).

References

Microsoft Intune Documentation | Use Conditional Access with Intune: This document

explains how Conditional Access policies are the primary mechanism for controlling access

to resources. It states, "Conditional Access policies can be used to require devices to be

compliant... With Conditional Access, you can control access to apps and services." This

directly supports using Conditional Access to control access to the Remote Help app.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/conditional-access

Section: "Ways to use Conditional Access with Intune"

Microsoft Entra Documentation | What are enterprise applications in Microsoft Entra ID?:

This source defines an enterprise application as the object you configure and manage

within your tenant. "An enterprise application is an object in Microsoft Entra ID that

represents an application... You can configure properties for the application, such as user

assignment, and create policies like Conditional Access policies." This confirms that the

enterprise application is the correct object type to which policies are applied.

URL: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/what-is-an-enterprise-application

Section: "Overview"

Microsoft Intune Documentation | Configure Conditional Access for Remote Help: This

guide provides a specific example of creating a Conditional Access policy for Remote Help.

The steps clearly show selecting "Remote Help" from the list of cloud apps (which are

enterprise applications) and applying conditions to it. This directly validates both chosen

answers.

URL: https://learn.microsoft.com/en-us/mem/intune/remote-actions/remote-help#configure-conditionalaccess-for-remote-help

Section: "Configure Conditional Access for Remote Help"

Unlock All 35 Questions

Sale!
MD-102 exam questions
Total Questions376
Last Update Check October 02, 2025
Online Simulator PDF Downloads
50,000+ Students Helped So Far
$30.00 $60.00 50% off
Rated 5 out of 5
 5.0 (2 reviews)

Instant Download & Simulator Access

Secure SSL Encrypted Checkout

100% Money Back Guarantee

What Users Are Saying:

Rated 5 out of 5

“The practice questions were spot on. Felt like I had already seen half the exam. Passed on my first try!”

Sarah J. (Verified Buyer)

Download Free Demo PDF Free MD-102 Practice Test
CertEmpire White Footer Logo - Trusted Exam Dumps Provider

CERTEMPIRE is your one-stop shop to access IT Certification Exam Dumps. We have helped thousands of people achieve their dreams of becoming certified in their desired certifications through exam dumps that surely appear in exams. We can help you achieve your goals too.

Contact Us

[email protected]

Helpful links

Top Exams

Popular Exams

Copyright © 2025 Cert Empire.
Shopping Cart
Scroll to Top

FLASH OFFER

Days
Hours
Minutes
Seconds

avail $6 DISCOUNT on YOUR PURCHASE

  • USE THE CODE GIVEN BELOW ON YOUR CHECKOUT
OFFME6