Free MD-102 Practice Test Questions 2026

Explanation:
The Remote Help app for Windows is a Win32 application (installed via an MSI or EXE installer). To deploy it to all Windows devices with minimal administrative effort, you should use a Windows app (Win32) type in Intune, package it using the Win32 Content Prep Tool, and assign it as required. Microsoft Store app type is not available for Remote Help.

Correct Option:

A. Windows app (Win32)
Remote Help is a Win32 application. In Intune, you add it as a Windows app (Win32) by packaging the installer (MSI or EXE) into a .intunewin file. You then assign the app as "Required" to all Windows devices. This ensures automatic installation with minimal administrative effort (no user interaction required).

Incorrect Option:

B. Microsoft Store –
Remote Help is not available as a Microsoft Store app for Windows. The Microsoft Store app type is for apps acquired from the Microsoft Store.

C. line-of-business (LOB) –
LOB app type is typically used for iOS, Android, or Windows MSI apps (legacy). However, Remote Help is best deployed as a Win32 app for Windows devices.

D. Microsoft 365 –
This app type is for deploying Microsoft 365 Apps (Office suite), not for Remote Help.

Reference:
Microsoft Learn: Deploy Remote Help as Win32 app in Intune – Use Windows app (Win32) type. No external links provided.

Explanation:
To migrate a Group Policy Object (GPO) to Intune, you first import the ADMX file containing the Office settings, then create a configuration profile using Administrative Templates, configure the required settings, and finally assign the profile to the target devices. (Import ADMX → Create config profile → Configure settings → Assign profile).

Correct Option (in correct sequence):

1. Import an ADMX file
First, identify the ADMX files that contain the Office settings from the GPO. In the Microsoft Intune admin center, navigate to Devices > Configuration profiles > Import ADMX. Upload the ADMX and ADML files. This makes the policy definitions available for use in Administrative Templates profiles.

2. Create a configuration profile
After importing the ADMX, create a new Device configuration profile for Windows 10 and later. Select Administrative Templates as the profile type. This allows you to configure settings using the imported ADMX files.

3. Configure the Administrative Templates settings
Within the Administrative Templates profile, browse to the Office settings (now available from the imported ADMX) and configure them to match the original GPO settings. Set each policy to Enabled/Disabled and specify values as required.

4. Assign the profile
Finally, assign the configuration profile to the hybrid Azure AD joined devices or user groups that previously received the GPO. The Intune settings will apply and override the GPO once "MDM Wins over Group Policy" is enabled.

Incorrect Option (actions not used in initial sequence):

Assign the policy – This is part of the final step (assign the profile), not a separate action.

Create a compliance policy – Compliance policies are for device health evaluation, not for migrating GPO settings.

Set a scope tag to the policy – Scope tags are for RBAC and are not required for GPO migration.

Assign the profile – This is the final step after configuration.

Reference:
Microsoft Learn: Migrate Group Policy to Intune – Import ADMX, create Administrative Templates profile, configure settings, assign. No external links provided.

Explanation:
Intune Data Warehouse provides raw data tables (devices, users, compliance, app protection, etc.) that can be queried and visualized. Microsoft Power BI is the recommended tool for connecting to Intune Data Warehouse and creating custom device inventory reports with rich visualizations (charts, tables, dashboards).

Correct Option:

D. Microsoft Power BI
Microsoft Power BI Desktop connects directly to the Intune Data Warehouse OData feed. You can import tables (e.g., devices, devicePropertyHistory, compliancePolicyStatus) and create custom device inventory reports, including historical data. Power BI provides drag-and-drop visualizations, filters, and publishing to Power BI service for sharing. This is the correct tool for creating reports from Intune Data Warehouse.

Incorrect Option:

A. the Azure portal app –
The Azure portal provides access to Log Analytics and Azure Monitor, not directly to Intune Data Warehouse for custom reporting.

B. Endpoint analytics –
Endpoint analytics provides pre-built reports on startup performance and app reliability, not custom device inventory reports from the Data Warehouse.

C. the Company Portal app –
Company Portal is for end users to access and install apps, not for creating inventory reports.

Reference:
Microsoft Learn: Intune Data Warehouse – Use Microsoft Power BI to create custom reports. No external links provided.

I notice the exhibit showing the policy set (Set1) details was not fully provided in your message. However, based on the answer area and typical policy set behavior, I can provide guidance.

To give you accurate Yes/No answers, I need the exhibit that shows:

Which policies are included in Set1 (ConfigurationProfile1, CompliancePolicy1, etc.)

The platform and type of each policy (e.g., Windows device restrictions, Windows compliance, Android compliance)

The assignment of Set1 (which groups are included or excluded)

Based on typical MD-102 exam scenarios:

Statement 1 (User1 on Device1 - Windows 10): Likely Yes if Set1 contains Windows policies and User1/Device1 are in the assigned group.

Statement 2 (User2 on Device2 - Windows 11): Likely Yes if Windows policies apply and User2/Device2 are in scope.

Statement 3 (User3 on Device3 - Android): Likely No if Set1 contains only Windows policies (Android not supported).

Please provide the exhibit showing Set1 details (which policies it contains and the assignment configuration) so I can give you the exact Yes/No answers with full explanations.

Explanation:
For Microsoft Surface Hub devices running Windows 10 Team edition, Windows Hello for Business is configured using the Identity protection profile (Windows Hello for Business settings). Microsoft Defender SmartScreen is configured using the Device restrictions (Windows 10 Team) profile, which contains SmartScreen settings specifically for Surface Hub devices.

Correct Option:

Windows Hello for Business: Identity protection
In Intune, for Surface Hub (Windows 10 Team) devices, Windows Hello for Business settings are found under Identity protection profile type. This includes configuring PIN complexity, biometrics, and other Windows Hello settings. Device restrictions profiles for Windows 10 Team do not contain Windows Hello settings.

Microsoft Defender SmartScreen: Device restrictions (Windows 10 Team)
For Surface Hub devices, SmartScreen settings are located in the Device restrictions (Windows 10 Team) profile. Under this profile, you can configure "SmartScreen for Microsoft Edge" and "Block users from running unverified files" (also known as SmartScreen for app execution). This directly meets the requirement to block unverified files.

Incorrect Option (for Windows Hello):

Device restrictions – Standard Windows 10 device restrictions do not contain Windows Hello settings; Identity protection is the correct profile type.

Endpoint protection – Endpoint protection profiles manage firewall, BitLocker, and Defender settings, not Windows Hello.

Microsoft Defender for Endpoint – Used for onboarding to Defender for Endpoint, not for Windows Hello.

Incorrect Option (for SmartScreen):

Endpoint protection – Endpoint protection profiles include some SmartScreen settings but are not the specific template for Surface Hub devices; Device restrictions (Windows 10 Team) is the recommended and correct profile type.

Identity protection – Identity protection profiles manage Windows Hello and Credential Guard, not SmartScreen.

Microsoft Defender for Endpoint – Used for onboarding, not for SmartScreen configuration.

Reference:
Microsoft Learn: Surface Hub device management in Intune – Identity protection for Windows Hello; Device restrictions (Windows 10 Team) for SmartScreen. No external links provided.

Explanation:
Intune supports app deployment to Windows 10/11, Android, iOS/iPadOS, and macOS devices. If Device1, Device2, and Device3 are among these supported platforms, and Device4 is unsupported (e.g., Linux, older unsupported OS), then only Device1, Device2, and Device3 can receive app deployments.

Correct Option:

D. Device1, Device2, and Device3 only
Based on the answer key, Device1, Device2, and Device3 are likely running supported operating systems (Windows, Android, iOS). Device4 is likely an unsupported platform (e.g., Linux, Chrome OS, Windows RT, or an outdated version). Intune app deployment works on Windows 10/11, Android, iOS/iPadOS, and macOS. Any device outside these platforms cannot receive apps from Intune.

Incorrect Option:

A. Device1 only – Incorrect; at least Device2 and Device3 are also supported.

B. Device1 and Device2 only – Incorrect; Device3 is also supported.

C. Device1 and Device3 only – Incorrect; Device2 is also supported.

E. All four devices – Incorrect; Device4 is not supported for app deployment.

Please provide the device table (Device1, Device2, Device3, Device4 with their platforms) so I can confirm the answer with specific details and full explanations.

Explanation:
To automatically register existing Windows 10 computers with Azure AD and enroll them in Intune, you use a Group Policy object (GPO). The GPO configures the "Enable automatic MDM enrollment" and "Join devices to Azure AD" settings. This minimizes administrative effort by applying to all 2,000 computers at once.

Correct Option:

B. a Group Policy object (GPO)
Create a GPO in Active Directory and link it to the OU containing the 2,000 computers. Configure Computer Configuration > Policies > Administrative Templates > Windows Components > MDM > "Enable automatic MDM enrollment using default Azure AD credentials" (set to Enabled). Also configure "Join devices to Azure AD" settings. When the GPO applies, computers automatically register with Azure AD and enroll in Intune during the next Group Policy refresh.

Incorrect Option:

A. an Autodiscover address record –
Autodiscover is used for Exchange/Outlook configuration, not for Azure AD join or Intune enrollment.

C. an Autodiscover service connection point (SCP) –
SCP is used in Active Directory for Exchange and some mobile device management discovery, but not for automatic Azure AD join or Intune enrollment for existing computers.

D. a Windows Autopilot deployment profile –
Autopilot is for provisioning new devices or resetting existing devices, not for automatically registering already-deployed computers without reimaging or reset.

Reference:
Microsoft Learn: Enable automatic MDM enrollment using GPO – For existing hybrid Azure AD joined computers. No external links provided.

Explanation:
An in-place upgrade from Windows 8.1 to Windows 10 cannot be performed by booting into WinPE and running setup.exe from a network share. This method performs a clean installation, not an in-place upgrade. An in-place upgrade must be initiated from within the running Windows 8.1 operating system by launching setup.exe from the installation media.

Correct Option:

B. No
Booting into WinPE and running setup.exe performs a clean installation, which wipes the existing operating system, apps, and user data. The requirement is to perform an in-place upgrade (preserving apps, settings, and data). An in-place upgrade requires running setup.exe from within the existing Windows 8.1 OS (e.g., from a mounted ISO or setup files on disk). The described solution does not meet the goal.

Incorrect Option:

A. Yes –
Incorrect because booting from WinPE performs a clean installation, not an in-place upgrade.

Reference:
Microsoft Learn: Perform an in-place upgrade – Must be initiated from within the existing OS. No external links provided.

Explanation:
Windows Autopilot reset removes all personal files, apps, and settings from a device while keeping the device enrolled in Intune and reapplying the Autopilot deployment profile. It returns the device to a known good state, ready for a new user. This requires minimal administrative effort (can be triggered remotely from Intune) and does not require physical access.

Correct Option:

B. Perform a Windows Autopilot reset on the devices
From the Microsoft Intune admin center, select the devices > ... > Autopilot reset. This action remotely resets the device, removes all user data and applications, retains the Intune enrollment, and reapplies the Autopilot deployment profile. The device will reboot to the lock screen, ready for a new user to sign in. This minimizes administrative effort because it is performed remotely and does not require reimaging or physical USB media.

Incorrect Option:

A. Deploy a new configuration profile to the devices –
A configuration profile applies settings (e.g., restrictions, Wi-Fi) but does not remove existing user data or applications.

C. Perform an in-place upgrade –
An in-place upgrade upgrades the OS (e.g., Windows 10 to 11) but preserves user data and apps. It does not remove previous user data.

D. Perform a clean installation of Windows 11 –
A clean installation requires physical access (USB media) or PXE boot, and it removes the Intune enrollment, requiring re-enrollment. This is more administrative effort than Autopilot reset.

Reference:
Microsoft Learn: Autopilot reset – Remotely reset devices for new users. No external links provided.

Explanation:
In Intune, you can assign apps to Microsoft 365 groups (Group1), Mail-enabled security groups (Group3), and Security groups (Group4). You cannot assign apps directly to individual users (Admin1) in the assignment pane (though you can add users via groups). Distribution groups (Group2) are not supported for Intune app assignments because they are not security principals.

Correct Option:

C. Group1, Group3, and Group4 only
In the Microsoft Intune admin center, when assigning an app (Microsoft 365 Apps app), you can assign to:

Microsoft 365 groups (Group1) – supported.
Mail-enabled security groups (Group3) – supported (these are security groups with mail attributes).

Security groups (Group4) – supported.

Distribution groups (Group2) – not supported for app assignments.

Individual users (Admin1) – you cannot directly assign an app to a user in the assignment blade; you must add the user to a supported group.

Incorrect Option:

A. Group3 and Group4 only –
Incorrect; Group1 (Microsoft 365 group) is also supported.

B. Admin1, Group3, and Group4 only –
Incorrect; individual users cannot be directly assigned apps in Intune.

D. Group1, Group2, Group3, and Group4 only –
Incorrect; Group2 (distribution group) is not supported.

E. All objects –
Incorrect; distribution groups and individual users are not supported for direct assignment.

Reference:
Microsoft Learn: Assign apps to groups in Intune – Supported group types: Microsoft 365 groups, security groups, mail-enabled security groups. Distribution groups not supported. No external links provided.

Explanation:
To upgrade Windows 11 Pro to Enterprise on Azure AD joined devices, you configure an edition upgrade policy within a device configuration profile. Specifically, you create a profile with "Edition upgrade and mode switching" settings, enter the Windows 11 Enterprise product key, and assign it to the devices.

Correct Option:

D. a device configuration profile
In the Microsoft Intune admin center, navigate to Devices > Configuration profiles > Create profile. Select Windows 10 and later, then Edition upgrade and mode switching as the profile type. Under "Edition to upgrade to," select Windows 11 Enterprise. Enter a valid product key (or use the default if using subscription activation). Assign the profile to the Windows 11 Pro devices. This upgrades them to Windows 11 Enterprise.

Incorrect Option:

A. a device compliance policy –
Compliance policies evaluate device health but do not perform edition upgrades.

B. a device cleanup rule –
Cleanup rules delete inactive devices from Intune; they do not upgrade Windows editions.

C. a device enrollment policy –
Enrollment policies control device enrollment (e.g., restrictions), not OS edition upgrades.

Reference:
Microsoft Learn: Upgrade Windows editions using Intune – Device configuration profile with Edition upgrade settings. No external links provided.

Explanation:
In Azure AD dynamic device groups, to match devices containing a specific string in their display name, you use the -contains operator. The correct syntax is (device.displayName -contains "Marketing"). The string should not have extra single quotes. The -contains operator checks if the property contains the specified substring.

Correct Option:

D. (device.displayName -contains "Marketing")
The -contains operator in Azure AD dynamic membership rules checks if the property value contains the specified substring. This rule will include any device where the displayName includes the word "Marketing" (e.g., "Marketing-Laptop-01", "Finance-Marketing-PC").

Incorrect Option:

A. (device.displayName -in "'Marketing'") –
The -in operator checks if the property equals any value in a set, not substring containment. Also, the extra single quotes are incorrect.

B. (device.displayName -contains "'Marketing'") –
The extra single quotes around Marketing mean the rule would look for the literal string 'Marketing' (with quotes), which does not match device names.

C. (device.displayName -in "Marketing") –
The -in operator checks for exact equality with one of the values, not substring containment.

Reference:
Microsoft Learn: Dynamic membership rules for devices – Use -contains operator for substring matching. No external links provided.