DRAG DROP (Drag and Drop is not supported) (Drag and Drop is not supported)You have a Microsoft 365 E5 subscription that includes Microsoft Intune.The subscription contains Android Enterprise devices that are enrolled in Intune and have personally-owned work profiles. All the Android devices are members of a group named Group1.You need to ensure that end users and Intune administrators receive an email message when an Android device does NOT have an up-to-date security provider.Which actions should you perform from the Microsoft Intune admin center in sequence? To answer, drag the appropriate actions to the correct order. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Answer(s): A
Step 1: Create a compliance policy.Configure actions for noncompliant devices in IntuneAs part of a compliance policy that protects your organizations resources from devices that don't meet your security requirements, compliance policies also include Actions for noncompliance. Actions for noncompliance are one or more time-ordered actions that are taken by a policy to help protect devices and your organization. As an example, an action for noncompliance can remotely lock a device to ensure it's protected, or send a notification to devices or users to help them understand and resolve the noncompliant status.Available actions for noncomplianceFollowing are the available actions for noncompliance:* Mark device non-compliant*-> Send email to end user: This action sends an email notification to the user. When you enable this action:- Select a Notification message template that this action sends. You Create a notification message template before you can assign one to this action. When you create the custom notification, you customize the message locale, subject, message body, and can include the company logo, company name, and other contact information.- Choose to send the message to more recipients by selecting one or more of your Microsoft Entra groups.* Etc.Step 2: From Compliance policies, create a notification message template.
https://learn.microsoft.com/en-us/mem/intune/protect/actions-for-noncompliance
You have a Microsoft 365 E5 subscription that includes Microsoft Intune and contains a user named Admin1.Admin1 must use the Microsoft Intune admin center to perform the following tasks:Create and assign apps and policies to users and devices by using Intune.Create, assign, and delete Windows 365 Cloud PC provisioning policies.You need to assign the required roles to Admin1. The solution must meet the following requirements:Follow the principle of least privilege.Minimize administrative effort.What should you do?
Answer(s): E
Windows 365 Enterprise, Role-based access controlRole-based access control (RBAC) helps you manage who has access to your organization's resources and what they can do with those resources. You can assign roles for your Cloud PCs by using the Microsoft Intune admin center.Custom rolesYou can create custom roles for Windows 365 in Microsoft Intune admin center.The following permissions are available when creating custom roles.Etc.Incorrect:Not A:Global Reader (This role is equivalent to the Intune Help Desk Operator role).Read-only permissions.---Cloud PC built-in rolesThe following built-in roles are available for Cloud PC:(not C) * Cloud PC Administrator (not Create and assign apps and policies to users and devices by using Intune)Manages all aspects of Cloud PCs, like:OS image managementAzure network connection configurationProvisioning(not B) * Cloud PC Reader Administrator (not Create and assign apps and policies to users and devices by using Intune)Views Cloud PC data available in the Windows 365 node in Microsoft Intune, but can't make changes.
https://learn.microsoft.com/en-us/windows-365/enterprise/role-based-access
You have a Microsoft 365 E5 subscription.All devices are enrolled in Microsoft Intune.You create a Conditional Access policy named Policy1 that requires multifactor authentication (MFA).You need to ensure that Policy1 only applies to devices marked as noncompliant.Which settings of Policy1 should you configure?
Answer(s): B
HOTSPOT (Drag and Drop is not supported)Your network contains an on-premises Active Directory Domain Services (AD DS) domain.You have a Microsoft 365 E5 subscription that includes Microsoft Intune and syncs with the AD DS domain.Windows Local Administrator Password Solution (Windows LAPS) is enabled in Microsoft Entra ID.The subscription has the custom roles shown in the following table.Microsoft Entra contains the users shown in the following table.You have the devices shown in the following table.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: NoNo - User1 can use Microsoft Entra to read the local administrator password of Device1.Device1 is joined to AD DS, but that does not support LAPS.Box 2: NoNo - User2 can use Microsoft Entra to read the local administrator password of Device2.User2 is Security Reader.User2 is assigned the custom role Role2Role2 has the permission microsoft.directory/deviceLocalCredentials/standard/read, but this meet the LAPS requirement.Box 3: YesYes - User3 can use Microsoft Entra to read the local administrator password of Device3.User3 is assigned the custom role Role3Role2 has the permission microsoft.directory/deviceLocalCredentials/password/read, which meet the LAPS requirement.Device3 is Microsoft Entra Joined, which also meets the LAPS requirement.Note: Windows Local Administrator Password Solution in Microsoft Entra ID Join typesLAPS is supported on Microsoft Entra joined or Microsoft Entra hybrid joined devices only. Microsoft Entra registered devices aren't supported.Required roles or permissionOther than the built-in Microsoft Entra roles like Cloud Device Administrator and Intune Administrator that are granted device.LocalCredentials.Read.All, you can use Microsoft Entra custom roles or administrative units to authorize local administrator password recovery. For example:Custom roles must be assigned the microsoft.directory/deviceLocalCredentials/password/read permission to authorize local administrator password recovery. You can create a custom role and grant permissions using the Microsoft Entra admin center, Microsoft Graph API or PowerShell. Once you create a custom role, you can assign it to users.
https://learn.microsoft.com/en-us/entra/identity/devices/howto-manage-local-admin-passwords
You have a Microsoft Entra tenant named contoso.com.You have a workgroup computer named Computer1 that runs Windows 11.You need to add Computer1 to contoso.com.What should you use?
You join a computer to a domain, including an Azure AD domain in the Settings panel in Windows 10, under System->About
https://aadguide.azurewebsites.net/aadjoin/
You have a Microsoft 365 subscription.You use Microsoft Intune to manage Windows 11 devices.You need to implement passwordless authentication that requires users to use number matching.Which authentication method should you use?
Number matching is a key security upgrade to traditional second factor notifications in Authenticator.
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match
HOTSPOT (Drag and Drop is not supported)You have a Microsoft Entra tenant that contains the users shown in the following table.When you sign in to the tenant, the available verification methods are shown in the following exhibit.Which users will be prompted for the verification code method, and which users will be prompted for the text method? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Verification code: User3 and User4 onlyText: User1 onlyVerification code: Since the verification code method is based on the use of apps such as Microsoft Authenticator (push notifications, OATH tokens), it will be available for users who have registered those methods. According to the table, the users who have registered for verification code methods (such as Microsoft Authenticator) are User3 and User4.Text: This method is available for users who have registered their mobile phone for multifactor authentication. According to the table, User1 has registered a mobile phone, so only User1 will be prompted for the text method.
You have a Microsoft 365 E5 subscription and use Microsoft Intune.You plan to implement a Microsoft Cloud PKI solution that will deploy personal user certificates to all Windows devices.What is the minimum number of configuration profiles required to support the solution?
To implement a Microsoft Cloud PKI solution and deploy personal user certificates to Windows devices, you typically need at least two configuration profiles:SCEP (Simple Certificate Enrollment Protocol) or PKCS Certificate Profile: This profile is required to issue and deploy the user certificates to devices.Trusted Certificate Profile: This profile is necessary to distribute the trusted root or intermediate certificate authority (CA) to ensure that the certificates issued by the CA are trusted by the devices.These two profiles are essential for deploying and managing personal certificates using Microsoft Intune.
Post your Comments and Discuss Microsoft MD-102 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the MD-102 content, but please register or login to continue.