MD-102: Endpoint AdministratorDemo

You have a Microsoft 365 subscription that uses Microsoft Intune and includes 100 Windows 10 devices.

You need to create Intune configuration profiles to perform these actions on the devices:

• Deploy a custom Start layout.
• Rename the local Administrator account.

Which profile type template should you use for each action?

You have a Microsoft 365 E5 subscription linked to a Microsoft Entra tenant named contoso.com. The subscription includes User1 and a new Windows 11 device named Device1.

User1 must automatically enroll Device1 in Microsoft Intune. Ensure that no other users can use automatic enrollment.

Which three actions should you perform, in order?

You have a Microsoft 365 subscription that includes Microsoft Intune and Microsoft Defender for Endpoint.

Users have devices that run Windows 11.

You deploy a connection from Defender for Endpoint to Intune.

You need to ensure that when a device is enrolled in Intune, the device is automatically onboarded to Defender for Endpoint.

What should you configure, and which portal should you use?

You have a Microsoft 365 tenant that uses Microsoft Intune to manage the devices shown in the following table.

You must deploy a compliance solution that meets these requirements:

• Marks devices as Not Compliant when they fail to meet compliance policies.
• Remotely locks noncompliant devices.

What is the minimum number of compliance policies required, and which devices support the remote lock action?

You have a Microsoft 365 E5 subscription and use Microsoft Intune.

You purchase 50 Windows devices.

You configure automatic enrollment to Intune for Microsoft Entra joined devices.

You need to use a provisioning package to join the devices to Microsoft Entra.

What should you use to create the provisioning package, and what is the maximum period for which you can use the package for bulk enrollment?

You have a Microsoft 365 subscription that uses Microsoft Intune.

You plan to use Windows Autopilot to provision 25 Windows 11 devices.

During device provisioning, you must meet these requirements:

• Display the progress of app and profile deployments.
• Join the devices to Azure AD.

What should you configure for each requirement? Each setting may be used once, more than once, or not at all.

You have a Microsoft 365 subscription containing devices enrolled in Microsoft Intune, as shown in the following table.

On which devices can Device query be used?

You have a Microsoft 365 subscription that uses Microsoft Intune Suite.

You use Microsoft Intune for device management.

The devices are shown in the following table.

Which devices can be changed to Windows 11 Enterprise by using subscription activation?

You have devices enrolled in Microsoft Intune, as shown in the following table.

Which devices can have app configuration policies applied for managed devices?

You have a Microsoft 365 subscription that uses Microsoft Intune.

You add apps to Intune as shown in the following table.

You need to create an app configuration policy named Policy1 for the Android Enterprise platform.

Which apps can you manage by using Policy1?

HOTSPOT

You have the devices shown in the following table.

You need to migrate app data from Device1 to Device2. The data must be encrypted and stored on Server1 during the migration.

Which command should be run on each device?

You have a Microsoft Intune subscription.

Devices are enrolled in Intune as shown in the following table.

An app named App1 is installed on every device. What is the minimum number of app configuration policies needed to manage App1?

You have an Azure AD tenant named contoso.com.

You need to make sure users are not automatically added to the local Administrators group when they join their Windows 11 device to contoso.com.

What should you configure?

You have a Hyper-V host that hosts the virtual machines shown in the following table.

On which virtual machines can Windows 11 be installed?

You have an Azure subscription and an on-premises Windows 11 device named Device1. You plan to monitor Device1 by using Azure Monitor, and you create a data collection rule (DCR) named DCR1 in the subscription.

What should DCR1 be associated with?

You have a Microsoft 365 subscription that uses Microsoft Intune and contains the users shown in the following table.

Group2 is assigned to the Enrollment Status Page.

You have the devices shown in the following table.

You capture and upload the hardware IDs for devices in the marketing department.

You configure Windows Autopilot.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

You have a Microsoft 365 E5 subscription.

You use Microsoft Intune to manage every Windows 11 device.

You create an attack surface reduction (ASR) policy named Profile1 by using the Attack Surface Reduction Rules profile, and assign Profile1 to all devices.

A user reports that an Adobe Reader plug-in is now blocked.

You need to make sure that the plug-in is unblocked.

What should you do?

You have a Microsoft 365 E5 subscription that includes Microsoft Intune and has a user named Admin1.

Admin1 must use the Microsoft Intune admin center to complete the following tasks:

• Create and assign apps and policies to users and devices by using Intune.
• Create, assign, and delete Windows 365 Cloud PC provisioning policies.

You need to assign the necessary roles to Admin1. The solution must meet these requirements:

• Follow the principle of least privilege.
• Minimize administrative effort.

What should you do?

You have a Microsoft 365 E5 subscription containing three Windows devices named Device1, Device2, and Device3. Microsoft Intune manages the devices. Each device has a file named Script1.ps1.

Users do not have local administrator permissions on the devices.

The subscription contains the groups shown in the following table.

You create two Endpoint Privilege Management (EPM) elevation settings policies with these settings:

• Name: Policy1

  • Endpoint Privilege Management: Enabled
  • Default elevation response: Deny all requests
  • Allow Elevation Detection: No
  • Send elevation data for reporting: No
  • Assignments:
    • Included groups: Group1

• Name: Policy2

  • Endpoint Privilege Management: Require support approval
  • Allow Elevation Detection: No
  • Send elevation data for reporting: No
  • Assignments:
    • Included groups: Group3

You create an EPM elevation rules policy named RulesPolicy1 with the following configuration:

• Rule name: Rule1
  • Elevation type: Automatic
  • Child process behavior: Deny all
  • File name: Script1.ps1
  • File hash:
• Assignments: Group 1, Group2

For each statement, select Yes if it is true. Otherwise, select No.

You have the MDM Security Baseline profile shown in the MDM exhibit. (Select the MDM tab.)

You have the ASR Endpoint Security profile shown in the ASR exhibit. (Select the ASR tab.)

You plan to deploy both profiles to devices enrolled in Microsoft Intune.

Identify how these settings will be configured on the devices:

• Block Office applications from creating executable content
• Block Win32 API calls from Office macro

The settings are currently disabled locally on every device.

What are the effective device settings?

You have a Microsoft 365 E5 subscription containing 500 Windows devices and the resources shown in the following table.

Both devices have Microsoft 365 Apps installed.

You need to create and assign a Policies for Office Apps policy that blocks macros from running in Office files from the internet.

Which portal should you use, and what should the policy scope be?

You use the Microsoft Deployment Toolkit (MDT) to deploy Windows 11.

You create a new task sequence by using the Standard Client Task Sequence template to deploy Windows 11 Enterprise to new computers. The computers each have a single hard disk.

You need to modify the task sequence so that it creates a system volume and a data volume.

Which task-sequence phase should you modify?

You have a Microsoft Entra tenant containing the users shown in the following table.

When you sign in to the tenant, the available verification methods appear as shown here.

Which users are prompted for the verification-code method, and which are prompted for the text method?

You have a Microsoft 365 E5 subscription that includes the devices in the following table.

You need to implement Microsoft Tunnel for Mobile Application Management (MAM) to give the devices access to an on-premises web app named App1.

What action should you take on each device?