MD-102 Managing and Securing Microsoft 365 Endpoints by using Intune Exam Topics and Questions

This topic sets the foundation for everything that follows. You're building the enrollment pathways, the identity layer, and the compliance framework that every device will pass through. The cost comes in two places: choosing the wrong join or enrollment method for a given device type, and misconfiguring compliance policies so that Conditional Access blocks legitimate users or lets risky devices through.

– Device identity and group membership

Microsoft Entra ID offers three ways to bring a device into scope: registration, Entra join, and hybrid join. Registration suits bring-your-own scenarios where the device keeps its consumer identity but gains conditional access to work resources. Entra join is for corporate-owned Windows devices that live entirely in the cloud. Hybrid join bridges on-premises Active Directory with Entra ID, and it remains common in environments that still run domain controllers. Dynamic groups automate membership by evaluating attributes like device name, OS version, or enrollment profile ID. The rule syntax matters: a misplaced operator or a stale attribute reference means devices never land in the group, and your policies never apply. Plan your group hierarchy before you start enrolling, because retrofitting it under load is painful.

– Enrollment paths for every platform

Intune enrollment diverges sharply by operating system. Windows supports automatic enrollment when a device joins Entra ID, and the setting lives in the Mobility (MDM and MAM) blade. For iOS and macOS, personal enrollment uses the Company Portal app, while corporate devices flow through Apple Business Manager with automated device enrollment profiles. Android offers four corporate modes: fully managed, dedicated, corporate-owned work profile, and personally owned work profile. Each mode enforces different boundaries between corporate and personal data. Samsung Knox Mobile Enrollment and Google Zero Touch both push enrollment metadata to devices at activation, removing manual steps. Enrollment restrictions let you block personal devices or specific OS versions, and they're checked before the device talks to Intune. Troubleshooting enrollment failures means reading the error code, checking group assignment, and verifying that the enrollment profile reached the device.

– Identity, roles, and compliance enforcement

Role-based access control in Intune uses built-in roles like Endpoint Security Manager and Help Desk Operator, plus custom roles when you need a tighter permission set. Scope tags partition administrative boundaries so that one team sees only their regional devices and another sees only kiosks. Multi-admin approval adds a second set of eyes to sensitive actions like retiring devices in bulk. Compliance policies define the minimum acceptable state: encryption enabled, OS version current, jailbreak not detected. When a device falls out of compliance, Conditional Access policies can block access to email or SharePoint until the issue resolves. Windows Hello for Business replaces passwords with asymmetric keys or biometrics, and Intune pushes the policy that provisions the PIN and configures attestation. Windows LAPS rotates local administrator passwords and stores them in Entra ID, closing the shared-credential risk. Managing local group membership from Intune lets you add Entra users or groups to the local Administrators group without scripting.

How Prepare infrastructure for devices is tested

Items in this topic present a scenario with a mix of device types, ownership models, or administrative boundaries, then ask you to pick the join type, enrollment method, or role assignment that satisfies all constraints. You'll see questions that describe a compliance requirement and ask which policy setting enforces it, or that give you a Conditional Access failure and ask what compliance check is blocking the user. The exam expects you to distinguish registration from join, to know which Android enrollment mode separates work data, and to recognize when a dynamic group rule will exclude devices you intended to include. Candidates lose marks by choosing hybrid join for a cloud-only tenant, by assigning a built-in role when a scope tag was needed, or by configuring Windows Hello without understanding that it requires Entra join or hybrid join. The weight of this topic means you cannot afford to guess on enrollment profiles or compliance policy mechanics.

Once devices are enrolled, you move into the operational phase: deploying Windows, applying configuration, and responding to support requests. This topic is broad, covering everything from Autopilot profiles to remote diagnostics. The two areas that trip candidates are choosing the correct Autopilot mode for a given scenario and building configuration profiles that layer correctly without conflict.

– Windows deployment and provisioning

Windows Autopilot automates out-of-box setup by applying a deployment profile tied to the device hardware hash. You choose between user-driven mode, where the end user signs in and the device joins Entra ID, pre-provisioning mode, where IT completes most setup before handing the device over, and self-deploying mode for kiosks or shared devices that require no user interaction. Device preparation policies are a newer option that apply configuration during Windows setup without requiring Autopilot registration, and they suit scenarios where hardware hashes are hard to collect. Device name templates inject variables like serial number or random digits into the computer name. The Enrollment Status Page tracks app and profile installation during setup and blocks user access until everything succeeds or times out. Windows 11 upgrades flow through Intune feature update policies, which target a specific version and monitor deployment progress. Windows 365 Cloud PCs use provisioning policies that reference a network connection, an image, and a license, and Intune manages the Cloud PC like any other endpoint. Windows Backup and Restore policies in Intune let you back up user settings and data to OneDrive, then restore them on a new device.

– Configuration profiles across platforms

Device configuration profiles push settings that the OS enforces continuously. For Windows, you can import ADMX files to manage Group Policy settings that don't yet have a native Intune equivalent, and Group Policy analytics compares on-premises GPOs to Intune policies. Android profiles vary by enrollment mode: fully managed devices accept device restrictions and Wi-Fi profiles, while work profiles enforce boundaries between corporate and personal apps. iOS and iPadOS profiles configure restrictions, passcode requirements, and AirPlay destinations. macOS profiles manage FileVault, Gatekeeper, and system extensions. Specialty devices like Teams Rooms, HoloLens 2, and Zebra scanners use custom OMA-URI settings or device-specific templates. Assignment filters let you target a profile to devices that match a rule, such as OS version greater than a threshold or device name starting with a prefix. Enrollment time grouping adds the device to a group during Autopilot, so the profile applies immediately.

– Intune Suite capabilities

Endpoint Privilege Management lets standard users elevate specific executables without granting them permanent admin rights. Elevation policies define which files can run elevated, and you monitor each elevation event in the Intune portal. The Enterprise App Catalog surfaces Win32 apps that your organization has validated, and users install them from Company Portal without opening a ticket. Remote Help is a browser-based assistance tool that integrates with Intune role-based access control, so a help desk operator can request control and the end user approves or denies. Microsoft Cloud PKI issues certificates from a cloud-based certificate authority, automating SCEP requests and monitoring certificate health. Microsoft Tunnel for MAM extends secure access to on-premises resources for devices enrolled only in mobile application management, not full device management. Advanced Analytics adds anomaly detection, proactive insights, and risk-based policy recommendations on top of the standard Endpoint Analytics telemetry.

– Remote actions and diagnostics

Intune exposes remote actions in the device blade: sync forces an immediate policy refresh, restart reboots the device, retire removes corporate data and unenrolls, and wipe performs a factory reset. Bulk actions let you retire or wipe multiple devices in one operation, filtered by group or compliance state. Updating Defender security intelligence pushes the latest signatures without waiting for the next sync cycle. Rotating BitLocker recovery keys generates a new key and escrows it in Entra ID, useful after a suspected key disclosure. Rotating local administrator passwords triggers a Windows LAPS password change on demand. Device queries use Kusto Query Language to extract custom telemetry from enrolled devices, and the results appear in the Intune portal. Collecting diagnostics gathers logs, event traces, and registry snapshots, and the Troubleshooting blade provides user-based diagnostics that show policy application history and error codes.

How Manage and maintain devices is tested

Questions in this topic describe a deployment goal or a configuration requirement, then ask which Autopilot mode, profile type, or remote action achieves it. You'll encounter scenarios where multiple profiles apply to the same device and you must predict the outcome, or where a configuration setting conflicts with a compliance policy and you need to identify the problem. The exam tests whether you know when to use pre-provisioning instead of user-driven mode, when to apply an assignment filter instead of a static group, and which remote action preserves user data versus which one wipes everything. Candidates lose marks by confusing retire with wipe, by choosing an ADMX import when a Settings Catalog policy would work, or by failing to recognize that enrollment time grouping only applies during Autopilot. The breadth of this topic means you need strong recall across Windows, Android, iOS, and macOS configuration, because a single item may reference all four.

Security moves from perimeter to endpoint. This topic covers the policies that prevent malware, encrypt data at rest, block network attacks, and keep devices patched. The two highest-cost areas are disk encryption key recovery and update ring configuration, because both have operational consequences when you get them wrong.

– Endpoint security policies

Antivirus policies in Intune configure Microsoft Defender Antivirus settings like real-time protection, cloud-delivered protection, and exclusions. Disk encryption policies manage BitLocker on Windows and FileVault on macOS, and Intune escrows recovery keys in Entra ID so that help desk can retrieve them when a user is locked out. User self-service recovery lets the end user retrieve their own BitLocker key from the Intune Company Portal or MyAccount portal, reducing tickets. Monitoring encryption compliance means checking the device compliance report for devices that report encryption as disabled or failed. Firewall policies configure Windows Defender Firewall rules, including inbound and outbound rules, domain, private, and public profiles. Attack surface reduction policies enforce rules that block executable content from email clients, Office macros, and script-based threats, and they align with Zero Trust principles by assuming breach and limiting lateral movement. Security baselines are pre-configured policy sets that apply Microsoft's recommended settings for Windows, Edge, Defender for Endpoint, and Microsoft 365 Apps. Integrating Intune with Defender for Endpoint enables Endpoint Detection and Response policies that isolate devices, collect investigation packages, and run antivirus scans. Onboarding devices into Defender for Endpoint pushes a configuration package that registers the device with the service. App Control for Business policies, formerly known as Windows Defender Application Control, define which executables, scripts, and drivers are allowed to run, using file hashes, certificates, or publisher rules.

– Device updates and patch management

Update rings for Windows define when quality updates and feature updates install, how long users can defer them, and whether the device restarts automatically. Feature update policies target a specific Windows version and hold devices on that version until you change the policy. Quality update policies accelerate or delay monthly cumulative updates. Windows Autopatch is a service that automates update deployment across a staged ring structure, and it integrates with Intune to manage the deployment schedule. Hotpatch policies apply security fixes without requiring a reboot, available on Windows Server and some Windows 11 Enterprise builds. For iOS, iPadOS, and macOS, the Settings Catalog in Intune includes software update settings that control when updates download and install. Android updates are managed through configuration profiles for devices enrolled in Android Enterprise, or through firmware-over-the-air deployments for Samsung and other OEMs that support FOTA. Delivery Optimization policies configure peer-to-peer caching and download throttling, reducing bandwidth consumption during updates. Monitoring device updates means checking the Windows update rings report, the feature update report, and the per-device update status in the Intune portal.

How Protect devices is tested

Items in this topic present a security requirement or an update failure, then ask which policy setting or integration step resolves it. You'll see questions that describe a BitLocker recovery scenario and ask where the key is stored or how the user retrieves it, or that give you an update ring configuration and ask which devices will receive a specific update on a given date. The exam expects you to distinguish between antivirus policies and attack surface reduction policies, to know which Defender for Endpoint action isolates a device versus which one collects diagnostics, and to recognize when a feature update policy conflicts with an update ring. Candidates lose marks by confusing quality updates with feature updates, by failing to configure Defender for Endpoint onboarding before deploying EDR policies, or by choosing a security baseline when a custom policy was required to meet the scenario. The operational nature of this topic means that knowing the policy exists is not enough; you need to know the order of operations and the dependencies between policies.

Application management sits at the intersection of deployment, configuration, and data protection. You're responsible for getting apps onto devices, keeping them current, and preventing corporate data from leaking to personal apps. The highest-risk area is app protection policies, because a misconfigured policy either blocks legitimate workflows or fails to protect data.

– Application deployment

Preparing an app for deployment means packaging it in a format Intune understands: Win32 apps use the .intunewin wrapper created by the Microsoft Win32 Content Prep Tool, line-of-business apps are uploaded as .msi or .appx files, and Microsoft Store apps are linked by store ID. Deploying an app requires an assignment to a user group or device group, an intent of required or available, and detection rules that tell Intune whether the app is already installed. Quiet Time policies for Android and iOS prevent app installation notifications during specified hours, useful for frontline workers who cannot be interrupted. Microsoft 365 Apps deployment uses the Office Deployment Tool to create a configuration XML that defines which apps to install, update channel, language, and architecture. You can also deploy Microsoft 365 Apps as a Win32 app through Intune, and the Intune Company Portal can install it during Autopilot. The Microsoft 365 Apps admin center provides cloud policy for Office apps, including macro settings, add-in management, and privacy controls. Platform-specific app stores integrate with Intune: Apple Volume Purchase Program lets you assign purchased apps to users or devices, and Google Play Managed Google Play lets you approve and deploy Android apps. Monitoring app deployment means checking the app installation status report and filtering by failure code to identify missing dependencies or blocked installers.

– App protection and configuration

App protection policies enforce data loss prevention rules on managed apps, whether the device is enrolled in Intune or not. For managed devices, the policy works alongside device compliance. For unmanaged bring-your-own devices, the policy is the only control you have. App protection policies define whether users can cut, copy, paste, save-as, or share corporate data, and they can require a PIN or biometric authentication to open a managed app. Conditional Access policies can require an app protection policy before granting access to Exchange or SharePoint, ensuring that only compliant apps handle corporate data. App configuration policies push settings into managed apps, like email server addresses, VPN profiles, or feature toggles. Configuration policies come in two forms: managed apps use key-value pairs delivered through the Intune MAM SDK, and managed devices use the platform's native configuration channel.

How Manage and secure applications is tested

Questions in this topic describe an app deployment failure or a data protection requirement, then ask which setting, policy type, or assignment change resolves it. You'll see scenarios that give you a mix of enrolled and unenrolled devices and ask which app protection policy configuration covers both, or that describe a Microsoft 365 Apps deployment during Autopilot and ask which tool or configuration file is required. The exam expects you to distinguish between app protection policies and app configuration policies, to know when to use available versus required assignment intent, and to recognize when a Conditional Access policy enforces app protection versus when it enforces device compliance. Candidates lose marks by choosing a device configuration profile when an app configuration policy was needed, by failing to assign an app protection policy to the correct user group, or by not understanding that app protection policies require the Intune MAM SDK in the app. The overlap between deployment and protection means you need to think about both the delivery mechanism and the data boundary in the same question.

Operational maturity means automating repetitive tasks, surfacing problems before users report them, and making decisions from data. This topic covers scripting, Copilot integration, analytics, and alerting. The cost is in knowing which tool answers which question: PowerShell for automation, Endpoint Analytics for proactive health, and Security Copilot for investigation.

– Automation and Copilot integration

Automating Intune management tasks uses PowerShell and Microsoft Graph API. The Microsoft.Graph.Intune module is deprecated; you now use the Microsoft.Graph module with specific resource paths for devices, policies, and assignments. Common automation tasks include bulk device enrollment, policy assignment audits, and compliance report exports. Security Copilot agents in Intune investigate threats by correlating alerts from Defender for Endpoint with device compliance state and policy assignment, then summarizing the timeline and suggesting remediation. Analyzing device performance with Copilot agents surfaces anomalies in startup time, battery health, or app crashes, and the agent explains which configuration or app is the likely cause. Reviewing Copilot recommendations means reading the natural-language summary, checking the supporting data, and deciding whether to apply the suggested policy change. Extending device compliance with PowerShell means writing custom detection scripts that check settings Intune doesn't natively evaluate, then returning a compliance state that Intune enforces.

– Reporting and visibility

Intune reporting includes built-in reports for device compliance, app installation, policy assignment, and enrollment status. Customizing reports means applying filters for device group, OS version, or compliance state, and exporting the results to CSV for further analysis. Workbooks and dashboards in the Intune portal visualize trends over time, like compliance drift or update deployment progress. Exporting reporting data to Log Analytics or a third-party SIEM enables long-term retention and correlation with other security signals. Endpoint Analytics collects telemetry on device health, startup performance, and application reliability. Proactive remediations are PowerShell scripts that detect and fix common issues, like clearing temp files, restarting a service, or reconfiguring a registry key. You schedule remediation runs daily or weekly, and Intune reports detection and remediation success rates. Analyzing endpoint reliability and user experience scores means looking at startup performance, which measures boot time and sign-in duration, restart frequency, which tracks unexpected reboots, and application reliability, which counts app crashes and hangs. Monitoring tenant health and Intune service communications means reviewing the service health dashboard for outages, reading message center notifications for feature changes, and establishing operational baselines so you recognize when metrics deviate. Configuring alerts and notifications for policy and compliance changes means setting up alert rules in the Intune portal that trigger when compliance drift exceeds a threshold, enrollment failures spike, or configuration conflicts appear.

How Optimize endpoint operations by using automation, monitoring, and reporting is tested

Items in this topic present an operational problem or a reporting requirement, then ask which tool, script, or configuration provides the answer. You'll see questions that describe a compliance drift scenario and ask which alert rule or report identifies the affected devices, or that give you a proactive remediation script and ask when it runs and what it returns. The exam expects you to distinguish between Endpoint Analytics health scores and Security Copilot threat investigations, to know which Microsoft Graph API path retrieves device compliance data, and to recognize when a custom detection script is required versus when a built-in compliance policy suffices. Candidates lose marks by choosing a workbook when an alert rule was needed, by writing a PowerShell script that uses a deprecated module, or by not understanding that proactive remediations require a detection script and a remediation script as separate files. The operational focus means the question will often describe a symptom and ask you to identify the tool that surfaces the root cause, not the tool that fixes it.