Microsoft 365 Certified: Endpoint Administrator Associate — Practice Set 1

Question 1

You are an endpoint administrator. Your organization wants to join Windows 11 devices to Microsoft Entra ID and manage them exclusively through Microsoft Intune, without on-premises Active Directory domain join. Which device join type should you choose?

Accepted Answer

Microsoft Entra joined is the appropriate device join type for cloud-only or cloud-first organizations that want to join Windows devices directly to Microsoft Entra ID without on-premises Active Directory. These devices are fully managed through Microsoft Intune. Microsoft Entra hybrid joined requires on-premises Active Directory and Microsoft Entra Connect. Microsoft Entra registered is for personal (BYOD) devices that are not organization-owned. Active Directory domain joined only uses on-premises management without cloud identity.

Question 2

Your organization needs to automatically enroll new Windows 11 devices in Microsoft Intune when employees sign in with their Microsoft Entra ID credentials during the Windows out-of-box experience (OOBE). Which enrollment method should you configure?

Accepted Answer

Automatic MDM enrollment is triggered when a device is joined to Microsoft Entra ID during the OOBE setup by the user signing in with their Microsoft Entra credentials. If automatic enrollment is configured in Microsoft Intune (MDM and MAM scope set to include users), the device is automatically enrolled in Intune without any additional steps. Windows Autopilot provides a more customized zero-touch deployment experience but requires pre-registration. Bulk enrollment uses provisioning packages for shared or kiosk devices. Group Policy enrollment is for on-premises Active Directory scenarios.

Question 3

Your organization needs to ensure that only compliant Windows 11 devices can access Microsoft 365 services. You have created a compliance policy in Microsoft Intune that requires BitLocker encryption and an up-to-date antivirus. You need to block access to Microsoft 365 services for devices that are not compliant. What must you configure in addition to the compliance policy?

Accepted Answer

A Microsoft Intune compliance policy alone marks devices as compliant or noncompliant but does not block access to resources. To enforce the compliance state as an access condition, you must configure a Microsoft Entra Conditional Access policy with the grant control set to 'Require device to be marked as compliant'. This integration between Intune compliance and Conditional Access blocks noncompliant devices from accessing Microsoft 365 services. App protection policies protect app data on unmanaged devices but do not require device compliance.

Question 4

Your organization wants to configure Windows Hello for Business on Microsoft Entra joined Windows 11 devices managed by Microsoft Intune. You need to ensure that users authenticate using a PIN or biometric instead of a password. Which two steps are required? Choose 2.

Accepted Answer

To deploy Windows Hello for Business for Microsoft Entra joined devices via Intune, you need to: (1) enable Windows Hello for Business in Microsoft Entra ID tenant settings (this configures the cloud trust or key trust model at the tenant level), and (2) create an Intune device configuration profile (or use the Account protection policy under Endpoint security) to configure and enforce Windows Hello for Business settings on enrolled devices. Active Directory Certificate Services is required for certificate trust deployments in hybrid scenarios, not for cloud-only deployments. A RADIUS server is not required for Windows Hello for Business.

Question 5

Your organization needs to manage local administrator passwords on Windows devices enrolled in Microsoft Intune to prevent lateral movement attacks. Each device must have a unique, automatically rotated local administrator password stored securely in Microsoft Entra ID. Which solution should you implement?

Accepted Answer

Windows Local Administrator Password Solution (Windows LAPS) manages and rotates the local administrator password on Windows devices. When integrated with Microsoft Intune and Microsoft Entra ID, LAPS automatically generates unique complex passwords for each device's built-in administrator account, stores them in Microsoft Entra ID, and rotates them on a configurable schedule. This prevents attackers from using the same local admin password across multiple devices (pass-the-hash attacks). PIM manages privileged roles in Microsoft Entra ID, not local device passwords.

Question 6

Your organization is enrolling Android devices in Microsoft Intune. You need to enroll corporate-owned Android devices that will be used by a single employee and should have a work profile separating corporate and personal apps and data. Which Android enrollment profile type should you use?

Accepted Answer

Android Enterprise corporate-owned with work profile (COPE — Corporate Owned, Personally Enabled) is designed for corporate-owned devices issued to individual employees. It creates a work profile for corporate apps and data while allowing a personal profile for personal use. This separation ensures corporate data is protected while respecting employee privacy. Fully managed devices are corporate-owned with no personal profile. Dedicated devices are shared-use kiosk devices. Android device administrator is a legacy enrollment method with limited management capabilities.

Question 7

Your organization wants to implement role delegation in Microsoft Intune so that a regional IT team can only manage devices and policies for users in their region, without having visibility into other regions' devices. Which Intune feature provides this scoped administration?

Accepted Answer

Intune scope tags provide role-based access control (RBAC) scoping in Microsoft Intune. By assigning scope tags to Intune objects (devices, policies, apps) and including those scope tags in custom Intune roles assigned to administrators, you can limit which objects a specific IT team can see and manage. This allows regional IT teams to manage only the resources tagged for their region. Microsoft Entra administrative units scope directory role permissions in Microsoft Entra ID, not Intune-specific management. Device categories help organize devices but do not scope administrative access.

Question 8

Your organization is deploying Windows 11 to new devices using Windows Autopilot. You want the setup experience to be pre-configured so that users only need to sign in with their Microsoft Entra credentials and the device is automatically configured without IT intervention. Which Windows Autopilot deployment mode should you use?

Accepted Answer

Windows Autopilot user-driven mode allows end users to set up their own devices by simply signing in with their Microsoft Entra ID credentials during OOBE. The device is automatically Microsoft Entra joined and Intune enrolled, and all policies and apps are applied without IT intervention. Self-deploying mode is for kiosk or shared devices with no user sign-in required. Pre-provisioning (white glove) is a hybrid mode where IT or a partner pre-provisions the device before handing it to the user. Autopilot for existing devices deploys Windows Autopilot on devices currently running Windows 10.

Question 9

You are configuring Windows Autopilot for your organization. During device setup, you want users to see a progress screen that shows the status of device configuration, app installations, and policy applications before the user can access the desktop. Which feature should you configure?

Accepted Answer

The Enrollment Status Page (ESP) is an Intune feature that displays a progress screen during Windows Autopilot enrollment, showing the status of device setup, policies, and app installations. The ESP can be configured to block user access to the desktop until all required configurations are applied. This ensures devices are fully compliant and configured before users can use them. Autopilot deployment profiles control the OOBE experience but do not provide the step-by-step status display. Kiosk mode is for single-app or restricted desktop experiences.

Question 10

Your organization manages Windows 11 devices using Microsoft Intune. You need to create a device configuration profile to configure specific settings that are not available in the standard Intune templates but are available as ADMX-backed Group Policy settings. How should you configure these settings in Intune?

Accepted Answer

Microsoft Intune supports importing custom ADMX files from third-party vendors or for applications not covered by built-in templates. Once an ADMX file is imported into Intune, its settings appear as a configurable template in device configuration profiles, allowing familiar Group Policy-style settings to be configured and deployed via Intune. Custom OMA-URI profiles can also configure ADMX-backed settings but require manually specifying the OMA-URI paths. Importing ADMX files provides a more user-friendly interface for the settings exposed in those files.

Question 11

Your organization uses Microsoft Intune Suite. You need to allow standard users to install specific approved applications and run certain administrative tasks without requiring local administrator rights on their Windows 11 devices. Which two Intune Suite features should you configure? Choose 2.

Accepted Answer

Endpoint Privilege Management (EPM) allows standard users to temporarily elevate privileges for specific approved tasks or applications without being a local administrator. Rules can be configured to allow elevation for specific processes, installers, or apps. The Enterprise App Catalog provides a curated catalog of managed Win32 applications that can be deployed via Intune, simplifying app management and ensuring approved applications are available. Advanced Analytics provides device and user analytics. Remote Help provides a remote support tool. Cloud PKI is a certificate authority service.

Question 12

Your organization uses Microsoft Intune to manage Windows 11 devices. A device belonging to a terminated employee needs to be securely wiped and removed from management. You need to remove all company data and settings and return the device to factory defaults so it can be redeployed. Which remote action should you perform?

Accepted Answer

The Wipe remote action in Microsoft Intune factory resets a device by removing all data, settings, and enrolled configuration, returning it to the out-of-box state. This is appropriate for corporate-owned devices that will be redeployed. The Retire action removes company data and apps from a device but leaves personal data intact — it is designed for BYOD scenarios. Delete removes the device record from Intune but does not wipe the device. Sync forces the device to check in with Intune for policy updates.

Question 13

Your organization uses Microsoft Intune Advanced Analytics. You need to investigate why a specific device is experiencing high CPU usage and poor performance, and you want to query detailed device telemetry data using a query language to identify running processes and installed software. Which Intune Suite feature should you use?

Accepted Answer

Microsoft Intune Advanced Analytics (part of the Intune Suite) includes a device query capability that allows administrators to run Kusto Query Language (KQL) queries against individual devices to retrieve real-time telemetry data including running processes, installed software, hardware inventory, and system information. This is ideal for troubleshooting performance issues on specific devices. Remote Help provides a remote control session. Endpoint analytics provides trend analysis across the device fleet. Microsoft Defender for Endpoint device timeline shows security events.

Question 14

You are an endpoint administrator. A BitLocker-encrypted device has been locked and the user cannot access it. You need to retrieve the BitLocker recovery key from Microsoft Intune. Which action should you take in the Microsoft Intune admin center?

Accepted Answer

For Microsoft Entra joined and Intune-managed devices with BitLocker escrow configured, BitLocker recovery keys are stored in Microsoft Entra ID and can be retrieved by authorized administrators from Microsoft Entra ID > Devices, selecting the specific device, and viewing the BitLocker keys. The Intune admin center also provides a link to view recovery key details for managed devices. The 'Rotate BitLocker recovery keys' remote action generates a new key (useful after a key is used) but would not help retrieve the current key needed immediately. Active Directory BitLocker Recovery Password Viewer is for on-premises AD-joined devices.

Question 15

Your organization manages macOS devices using Microsoft Intune. You need to create a configuration profile that configures specific system preferences that are not available as standard Intune templates. You have a custom macOS configuration payload in XML format (a .mobileconfig file). How should you deploy this configuration to macOS devices via Intune?

Accepted Answer

Microsoft Intune supports a 'Custom' device configuration profile type for macOS that allows administrators to upload a .mobileconfig XML payload file containing custom Apple configuration settings. This is the supported method for deploying Apple mobile configuration profiles to macOS devices managed by Intune. Shell scripts can also deploy configurations but are run as one-time scripts rather than enforced profiles. OMA-URI is a Windows-specific approach. Apple Configurator 2 is a direct-to-device tool that does not scale for large deployments via Intune.

Question 16

Your organization needs to deploy Microsoft 365 Apps (Word, Excel, Outlook, etc.) to Windows 11 devices managed by Microsoft Intune. You want to customize the installation to include only specific apps, set the update channel to Current Channel, and configure the language. Which deployment approach should you use?

Accepted Answer

Microsoft Intune has a built-in Microsoft 365 Apps for Windows app type (also called the Office app suite) that provides a guided configuration experience. You can select specific apps to include, choose the update channel (Current, Monthly Enterprise, Semi-Annual), select languages, and configure additional settings using the Office Configuration Service. This is the recommended method for deploying Microsoft 365 Apps via Intune. Uploading as a Win32 app is possible but more complex and does not provide the same integrated configuration experience.

Question 17

Your organization has personal (BYOD) iOS devices that are not enrolled in Microsoft Intune. Employees use their personal iPhones to access corporate email using the Outlook app. You need to ensure that corporate data in Outlook cannot be copied to personal apps on these unenrolled devices. Which Intune policy should you use?

Accepted Answer

App protection policies (APP) in Microsoft Intune are designed to protect corporate data within managed apps on unenrolled (BYOD) devices. An APP targeting Microsoft Outlook can restrict actions like copy/paste between Outlook and unmanaged apps, require a PIN to open Outlook, and prevent corporate data from being backed up to personal cloud storage — all without requiring device enrollment. Device compliance and configuration profiles require device enrollment. A Conditional Access policy requiring enrollment would block unenrolled devices entirely.

Question 18

Your organization is deploying a Win32 application via Microsoft Intune. You need to ensure the application installs only on devices that meet specific criteria, and you want to efficiently manage bandwidth during deployment to remote office devices. Which two Intune features should you use? Choose 2.

Accepted Answer

Applicability rules (filters) on Win32 app assignments allow you to target the app to only specific devices based on properties such as OS version, device model, or custom attributes, ensuring the app only installs where appropriate. Windows Delivery Optimization configured via Intune allows devices to download app content from local peers (other devices on the same network) rather than always downloading from the internet or Microsoft CDN, significantly reducing bandwidth consumption at remote sites. Microsoft Store for Business is not used for Win32 apps. WSUS is for Windows Updates, not Win32 app deployment. App configuration policies configure app settings, not deployment targeting.

Question 19

Your organization wants to deploy a line-of-business iOS app that is distributed through the Apple App Store to managed iOS devices enrolled in Microsoft Intune. You want Intune to manage this app and apply configuration settings. Which app type should you use when adding the app in Intune?

Accepted Answer

When deploying an app that is publicly available in the Apple App Store to managed iOS devices via Intune, you add it as an iOS store app. Intune can then deploy, manage, and apply app configuration policies to store apps on enrolled devices. An iOS LOB app is used for apps distributed via a custom .ipa file that is not in the App Store (enterprise-distributed apps). Managed Google Play is for Android devices. Web apps create shortcuts to web URLs.

Question 20

Your organization needs to pre-configure Outlook settings on managed iOS devices so that the corporate Exchange account is automatically added when users first launch the Outlook app. Which Intune feature allows you to push these configuration settings to Outlook on managed iOS devices?

Accepted Answer

App configuration policies for managed devices in Microsoft Intune allow administrators to pre-configure application settings for specific apps on enrolled devices. For Microsoft Outlook on iOS, an app configuration policy can pre-configure the Exchange account, email signature, focused inbox settings, and other app preferences that are applied when the app launches. This is distinct from an app protection policy, which controls data protection behaviors. A device configuration profile with email settings creates a native mail profile, not Outlook-specific settings.

Question 21

Your organization needs to enable BitLocker drive encryption on all Windows 11 devices managed by Microsoft Intune. You want to enforce encryption and automatically save recovery keys to Microsoft Entra ID. Which Intune endpoint security policy type should you create?

Accepted Answer

The Disk encryption policy in Microsoft Intune endpoint security is used to configure and enforce BitLocker encryption on Windows devices. This policy can enable BitLocker, configure encryption settings, and require recovery key escrow to Microsoft Entra ID. Antivirus policies configure Microsoft Defender Antivirus settings. Attack surface reduction policies configure ASR rules to block malicious behaviors. Security baselines are pre-configured sets of security settings but the disk encryption policy is the targeted approach for BitLocker management.

Question 22

Your organization uses Microsoft Intune to manage Windows 11 devices and Microsoft Defender for Endpoint for threat protection. A new Windows 11 device has been enrolled in Intune but is not appearing in the Microsoft Defender for Endpoint device inventory. What must you configure to ensure Intune-managed devices are onboarded to Microsoft Defender for Endpoint?

Accepted Answer

To integrate Microsoft Intune with Microsoft Defender for Endpoint, you must first enable the Defender for Endpoint service-to-service connection in the Intune admin center (connectors and tokens). Then, create an Endpoint detection and response (EDR) policy under Endpoint security in Intune — this deploys the Defender for Endpoint onboarding configuration to devices automatically. This cloud-native approach is the recommended method for Intune-managed devices and does not require manual onboarding or Group Policy.

Question 23

Your organization wants to reduce the attack surface on Windows 11 devices managed by Intune. You need to block macros in Microsoft Office documents from the internet and prevent credential theft from the Windows Subsystem Authority (LSASS). Which two Attack Surface Reduction (ASR) rules should you enable? Choose 2.

Accepted Answer

The ASR rule 'Block Office macros from downloading content from the internet' prevents Office VBA macros from making internet connections and downloading malicious payloads. The ASR rule 'Block credential stealing from the Windows local security authority subsystem (lsass.exe)' prevents attackers from dumping credentials from LSASS memory (used in pass-the-hash and pass-the-ticket attacks). These two rules directly address the stated requirements. Blocking Office child processes and obfuscated scripts provide additional protection but do not specifically address internet macro downloads or LSASS credential theft.

Question 24

Your organization needs to manage Windows Update for Business to control when feature updates and quality updates are installed on Windows 11 devices. You want to defer quality updates by 7 days and feature updates by 30 days to allow time for testing before deployment. Which Intune policy type should you create?

Accepted Answer

Windows Update ring policies in Microsoft Intune are used to configure Windows Update for Business settings including deferral periods for quality updates and feature updates. Update rings allow you to define ring-based deployment (e.g., pilot, broad) with different deferral settings for each ring. A 7-day quality update deferral and 30-day feature update deferral are configured directly in an update ring policy. Compliance policies require a minimum OS version but do not control update installation timing. Software update policies under Endpoint security are used for iOS/macOS updates.

Question 25

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a set of security configurations based on Microsoft's recommended security baseline for Windows 11. You want to apply these settings quickly without manually configuring individual settings. Which Intune feature provides pre-configured security settings based on Microsoft's recommendations?

Accepted Answer

Microsoft Intune security baselines are pre-configured groups of Windows settings that represent Microsoft's best-practice security recommendations for Windows 11, Microsoft Edge, Microsoft Defender for Endpoint, and other products. Deploying a security baseline policy applies all recommended settings in one operation, saving significant configuration time compared to configuring individual settings. The baselines are maintained and updated by Microsoft. Custom ADMX templates provide configuration flexibility but require manual setting selection. Defender for Endpoint security recommendations and Secure Score provide guidance but not automated Intune policy deployment.

MD-102 — Microsoft 365 Certified: Endpoint Administrator Associate