Free MD-102 Exam Braindumps
Endpoint Administrator Questions 145–152 (page: 20)

Explanation:

There are two parts to compliance policies in Intune:
Compliance policy settings Tenant-wide settings that are like a built-in compliance policy that every device receives. Compliance policy settings set a baseline for how compliance policy works in your Intune environment, including whether devices that haven't received any device compliance policies are compliant or noncompliant.
Device compliance policy Platform-specific rules you configure and deploy to groups of users or devices.
These rules define requirements for devices, like minimum operating systems or the use of disk encryption.
Devices must meet these rules to be considered compliant.

Reference:

https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

Explanation:

Box 1: Microsoft Endpoint Manager admin center
Create an Autopilot device group using Intune
1. In the Microsoft Endpoint Manager admin center, select Groups > New group.
2. Etc.

Box 2: Device serial number and hardware hash
Ensure that the CSV file meets requirements.
Device information in the CSV file where you capture hardware hashes should include:

Serial number
Windows product ID
Hardware hash
Optional group tag

Optional assigned user

Reference:

https://docs.microsoft.com/en-us/intune/enrollment-autopilot https://docs.microsoft.com/en-us/mem/autopilot/add-devices

Explanation:

Explanation:

Pending devices in Azure Active Directory
How a device gets stuck in a pending state:
There are two scenarios in which a device can be stuck in a pending state.
Sync a new on-premises domain joined device to Azure AD
A new on-premises device can get stuck in a pending state if it can't complete the device registration process.
This problem can be caused by several factors, such as that the *device can't connect to the registration service*.

To troubleshoot a device registration problem, see:
Troubleshooting hybrid Azure Active Directory joined devices *-> Test Device Registration Connectivity
Note: Pending devices are devices that are synced to Azure Active Directory (Azure AD) from your on- premises Active Directory, but haven't completed registration with the Azure AD device registration service.
When the registered state of a device is pending, the device can't complete any authorization or authentication requests, such as requesting a Primary Refresh token for single sign-on, or applying device-based Conditional Access policies.

Reference:

https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/pending-devices

Explanation:

Box 1: Every three minutes for 15 minutes, then every 15 minutes for two hours, and then around every eight hours

If devices recently enroll, then the compliance, non-compliance, and configuration check-in runs more frequently. The check-ins are estimated at:

Windows 10: Every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, and then around every 8 hours

Box 2: Every 15 minutes for one hour, and then every eight hours iOS/iPadOS: Every 15 minutes for 1 hour, and then around every 8 hours

Reference:

https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot

Explanation:

Box 1: No
Device1 belongs to Group2. Group2 has not been assigned a compliance policy. Devices with no compliance policy assigned as Not Compliant. Device1 gets a 3 day grace period, but at August 4 is it marked as Non- compliant.

Box 2: Yes
Device1 belongs to Group2. Group2 has not been assigned a compliance policy. Devices with no compliance policy assigned as Not Compliant. Device1 gets a 3 day grace period, so at August 2 it is compliant.

Box 3: No
Device2 has BitLocker Disabled. The Windows 10 compliance policy applies to Group1 which includes Device1. At August 4 Device is marked noncompliant. 5 days later, at August 9th it is retired.

Note:
* Retire the noncompliant device: This action removes all company data off the device and removes the device from Intune management.

* By default, each compliance policy includes the action for noncompliance of Mark device noncompliant with a schedule of zero days (0). The result of this default is when Intune detects a device isn't compliant, Intune immediately marks the device as noncompliant.
By configuring Actions for noncompliance you gain flexibility to decide what to do about noncompliant devices, and when to do it. For example, you might choose to not block the device immediately, and give the user a grace period to become compliant.

Compliance status validity period (days):
Specify a period in which devices must successfully report on all their received compliance policies. If a device fails to report its compliance status for a policy before the validity period expires, the device is treated as noncompliant.

Reference:

https://docs.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started https://docs.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance

Explanation:

Overview of Windows 365 deployment
After your organization has purchased one or more Windows 365 licenses, the Windows 365 node in Microsoft Intune will become active for management. At this point, you can provision Cloud PCs.
To set up your system to provision on-demand Cloud PCs to your users, follow these steps:
1. Assign licenses to users.
2. Create Azure network connection (optional).
Need one as we will use Microsoft Entra hybrid joined devices.
3. Provide localized Windows experience (optional).
4. Add device images (optional).
5. Create a provisioning policy.
Note: Create provisioning policies
Cloud PCs are created and assigned to users based on provisioning policies. These policies hold key provisioning rules and settings that let the Windows 365 service set up and configure the right Cloud PCs for your users. After provisioning policies are created and assigned to the Microsoft Entra user security groups or Microsoft 365 Groups, the Windows 365 service:
Checks for appropriate licensing for each user.
Configures the Cloud PCs accordingly.
*.> Select an ANC
You must select an ANC for your provisioning policy if you selected either of these two options in the previous section:
Join type = Hybrid Microsoft Entra Join
Join type = Microsoft Entra join and Network = Azure network connection

Reference:

https://learn.microsoft.com/en-us/windows-365/enterprise/deployment-overview https://learn.microsoft.com/en-us/windows-365/enterprise/create-provisioning-policy

Explanation:

Only VNET1 meets the DNS requirement.
Note 1: DNS requirements
As part of the Microsoft Entra hybrid join requirements, your Cloud PCs must be able to join on-premises Active Directory. That requires that the Cloud PCs be able to resolve DNS records for your on-premises AD environment.
Configure your Azure Virtual Network where the Cloud PCs are provisioned as follows:

1. Make sure that your Azure Virtual Network has network connectivity to DNS servers that can resolve your Active Directory domain.
2. From the Azure Virtual Network's Settings, select DNS Servers and then choose Custom.
3. Enter the IP address of DNS servers that environment that can resolve your AD DS domain.
Tip
Adding at least two DNS servers, as you would with a physical PC, helps mitigate the risk of a single point of failure in name resolution.
Note 2: Windows 365 networking deployment options
You have two options for network deployment of the Windows 365 service:
*-> Use Azure Network Connections (ANC)
Supports both Microsoft Entra join and Microsoft Entra hybrid join identity models.
* Use a Microsoft-hosted network
Recommended option.
Ideal for the Windows 365 Software-as-a-Service (SaaS) features of simplicity, reliability, and scalability.
Supports the Microsoft Entra join identity model.
No requirement for Azure subscription or expertise.
Azure Network Connection option
With the Azure Network Connection (ANC) deployment option, you're completely in charge of the VNet and its configuration. If you're using a Microsoft Entra hybrid join model, you must use this deployment option. This option provides line-of-sight to your on-premises Azure Directory resources and lets you customize network and security goals

Reference:

https://learn.microsoft.com/en-us/windows-365/enterprise/deployment-options https://learn.microsoft.com/en-us/windows-365/enterprise/requirements-network