A large enterprise uses Intune with several custom roles and scope tags. The security team wants to require that any change to compliance policies be approved by a second administrator before it takes effect. The change must be reversible if the approver rejects it. You need to implement a solution that meets these requirements with minimal administrative overhead. What should you do?

Create a custom role that requires two administrators to be assigned to the same role assignment for any policy change.

Configure a conditional access policy that requires a second admin to sign in before any compliance policy change is saved.

Use Microsoft Entra Privileged Identity Management (PIM) to require approval for all Intune role activations.

Enable multi-admin approval in Intune and configure the approval policy to require approval for compliance policy changes.

Which Intune feature allows you to require that a second administrator approve changes to compliance policies?

Role-based access control (RBAC)

A company wants to manage the local administrator password on its Windows 10 and 11 devices using Windows LAPS. The passwords should be stored in Microsoft Entra ID and rotated automatically. You need to configure this in Intune. What should you do?

Create a compliance policy that requires the local administrator password to be rotated every 30 days.

Create a Windows LAPS policy in Intune that enables password backup to Microsoft Entra ID and configure the rotation settings.

Enable Windows LAPS in Microsoft Entra ID and assign the Intune Administrator role to the device users.

Use a PowerShell script in Intune to set the local administrator password and store it in a file.

A company has a conditional access policy that requires devices to be compliant. They also have a compliance policy that requires Windows Hello for Business to be enabled. Some users report that they cannot access Microsoft 365 apps even though they have enabled Windows Hello for Business. You need to troubleshoot the issue. What is the most likely cause?

The conditional access policy is configured to require multi-factor authentication.

The Windows Hello for Business policy is not assigned to the affected devices.

The compliance policy is set to require a device passcode, but the user has not set one.

The device is not enrolled in Intune.

What is a common use case for managing local group membership on Windows devices with Intune?

To configure network settings on devices

To enforce password policies on devices

To deploy applications to devices

To grant specific users local administrative privileges on their devices

Microsoft 365 Certified:Endpoint Administrator Associate

Domain 1Objective 3

Implement Identity and Compliance MD-102 Practice Questions (Page 2)

Part of the Prepare infrastructure for devices domain, which accounts for 20–25% of the MD-102 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

8concepts

20–25%of the exam

Questions 6–10

6expert · hard
A large enterprise uses Intune with several custom roles and scope tags. The security team wants to require that any change to compliance policies be approved by a second administrator before it takes effect. The change must be reversible if the approver rejects it. You need to implement a solution that meets these requirements with minimal administrative overhead. What should you do?
Select an answer first
7foundation · easy
Which Intune feature allows you to require that a second administrator approve changes to compliance policies?
Select an answer first
8application · medium
A company wants to manage the local administrator password on its Windows 10 and 11 devices using Windows LAPS. The passwords should be stored in Microsoft Entra ID and rotated automatically. You need to configure this in Intune. What should you do?
Select an answer first
9expert · hard
A company has a conditional access policy that requires devices to be compliant. They also have a compliance policy that requires Windows Hello for Business to be enabled. Some users report that they cannot access Microsoft 365 apps even though they have enabled Windows Hello for Business. You need to troubleshoot the issue. What is the most likely cause?
Select an answer first
10foundation · easy
What is a common use case for managing local group membership on Windows devices with Intune?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to MD-102

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “MD-102” is a trademark of its owner, used for identification only.

Implement Identity and Compliance MD-102 Practice Questions (Page 2)

Questions 6–10

Which Intune feature allows you to require that a second administrator approve changes to compliance policies?

A company wants to manage the local administrator password on its Windows 10 and 11 devices using Windows LAPS. The passwords should be stored in Microsoft Entra ID and rotated automatically. You need to configure this in Intune. What should you do?

What is a common use case for managing local group membership on Windows devices with Intune?

Keep studying — Prepare infrastructure for devices