Microsoft MD-102: Managing and Securing Microsoft 365 Endpoints by using Intune

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Deploy and manage devices

   A company buys new laptops and wants users to sign in with their work accounts and receive company settings automatically on first boot, with no IT touch. Which deployment method fits best?

   1. AManual imaging of each laptop from a USB drive by IT technicians
   2. BJoining each device to an on-premises Active Directory domain by hand as a local admin
   3. CSending laptops to users to set up personally with a short guide
   4. DWindows Autopilot user-driven or self-deploying mode with Microsoft Entra join
   Show answer and explanationHide answer

   Correct answer: D

   Autopilot configures new devices from the cloud at first use, joining them to Microsoft Entra and applying Intune policies. Manual imaging, personal setup, and manual domain joins require IT or user effort that the scenario avoids.

2. Question 2Manage identity and access

   A user must access a SaaS application only from compliant corporate devices and only after multi-factor authentication. Which control enforces this?

   1. ADisabling MFA for the application for guest users
   2. BA shared password for the finance team in a wiki page
   3. CA firewall rule that allows web traffic from devices
   4. DConditional access policy requiring MFA and a compliant device
   Show answer and explanationHide answer

   Correct answer: D

   Conditional access evaluates sign-in conditions such as MFA and device compliance before granting access. Shared passwords, open firewall rules, and disabled MFA weaken security.

3. Question 3Manage security and compliance

   A compliance policy requires devices to have BitLocker enabled and a minimum OS version. Devices that do not comply should be blocked from corporate email. Which combination enforces this?

   1. AA device configuration profile setting BitLocker and OS version, with no compliance policy
   2. BA user password policy requiring a minimum length and complexity, with lockout after failed sign-ins
   3. CA compliance policy and a conditional access policy that requires a compliant device
   4. DA wallpaper policy setting the desktop background and a reminder email
   Show answer and explanationHide answer

   Correct answer: C

   Compliance policies evaluate settings such as BitLocker and OS version, and conditional access uses that state to block access. Wallpapers, reminders, and user password rules do not make the device compliance decision.

4. Question 4Manage updates

   An organization wants Windows feature updates deployed in controlled rings, starting with a pilot group before broad release. Which approach fits best?

   1. ABlocking updates via a permanent pause
   2. BWindows Update for Business deployment rings
   3. CUpdating devices reactively after users report issues
   4. DInstalling updates by hand on each device separately
   Show answer and explanationHide answer

   Correct answer: B

   Deployment rings deliver updates to pilot and broad groups in stages, which reduces risk. Manual installs are inconsistent, blocking updates leaves devices exposed, and waiting for complaints is reactive.

5. Question 5Manage applications

   A company wants to make a web application available to users as an icon on managed devices, with the same sign-in experience. Which Intune approach fits?

   1. ADeploy a web link app to managed devices
   2. BEmail the URL to each user as an attachment
   3. CInstall the browser on each device without a link
   4. DPrint the address on a poster
   Show answer and explanationHide answer

   Correct answer: A

   Web link apps place an icon or link on managed devices and can integrate with sign-in. Emailed URLs and printed posters are manual, and installing a browser alone does not provide the application entry point.