Question 1

What is Microsoft Intune?

Accepted Answer

Intune is Microsoft's cloud-based Mobile Device Management (MDM) and Mobile Application Management (MAM) platform. It manages Windows, macOS, iOS, and Android devices and protects corporate data across them.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 2

How does a compliance policy work?

Accepted Answer

Defines conditions a device must meet (OS version, encryption, jailbreak status, password complexity). Devices report status to Intune. Non-compliant devices can be blocked from corporate resources via Conditional Access.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 3

What is an App Protection Policy?

Accepted Answer

APP defines how managed apps behave regardless of device enrolment: PIN, encryption, copy-paste restrictions, screenshot blocking, remote wipe. Works on BYOD without enrolling the device.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 4

What is iOS supervised mode?

Accepted Answer

Full management control over iOS devices (required for corporate-owned). Enabled via Apple Configurator or ADE. Allows restrictions unsupervised devices cannot enforce (single app mode, no App Store, etc.).
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 5

Explain certificate deployment via Intune.

Accepted Answer

Use SCEP (auto-renews from your PKI) or PFX (delivers existing certs). Requires a trusted root CA profile deployed first. Use case: Wi-Fi, VPN, email signing, app authentication.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 6

What is Endpoint Security in Intune?

Accepted Answer

Policy category for security controls: Antivirus (Defender), Disk Encryption (BitLocker/FileVault), Firewall, ASR rules, Account Protection. Separate from compliance but evaluated together for Conditional Access.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 7

How would you handle a lost device?

Accepted Answer

Remote wipe via Intune — full wipe for corporate-owned, selective wipe for BYOD (removes managed apps and data only). Verify the wipe completed. Update asset inventory.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 8

What is the difference between required and available apps?

Accepted Answer

Required apps install automatically on assigned devices. Available apps show in the Company Portal for user-initiated install. Use required for productivity (Office, Teams); available for LOB apps.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 9

What is the difference between MDM and MAM?

Accepted Answer

MDM (Mobile Device Management) enrols and manages the entire device — requires full control. MAM (Mobile Application Management) protects only the apps and data you manage, leaving personal apps untouched. MAM is the preferred model for BYOD; MDM for corporate-owned devices.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 10

How do compliance policies work in Intune?

Accepted Answer

A compliance policy defines conditions a device must meet (OS version, encryption, jailbreak status, password complexity). Devices evaluate against the policy and report status to Intune. Non-compliant devices trigger Conditional Access to block access to corporate resources.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 11

What is a configuration profile?

Accepted Answer

A configuration profile deploys settings to devices: Wi-Fi, VPN, email, certificates, restrictions. Profiles are platform-specific (Windows, iOS, Android, macOS). They replace Group Policy for modern endpoints.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 12

How does Windows Autopilot work?

Accepted Answer

Autopilot provisions new Windows devices out-of-the-box. The OEM ships the device to the user; on first boot, the device joins Entra ID, enrolls in Intune, applies policies, and installs apps. Zero-touch deployment — no IT involvement per device.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 13

Explain iOS supervised mode.

Accepted Answer

Supervised mode gives full management control over iOS devices — required for corporate-owned iPhones/iPads. Enabled via Apple Configurator or ADE (Automated Device Enrollment). Supervised devices can apply restrictions that unsupervised devices cannot (e.g. disallow App Store, force single app mode).
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 14

What is the Intune Company Portal?

Accepted Answer

The Company Portal is the self-service app for end users — install work apps, enrol devices, check compliance, contact IT. Available on iOS, Android, Windows. Critical for BYOD enrolment flow.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 15

How do you protect data on BYOD devices?

Accepted Answer

Use MAM-WE (Mobile Application Management for Windows) or MAM for iOS/Android. Configure app protection policies: require PIN to open managed apps, prevent copy-paste between managed and unmanaged apps, encrypt app data, remote wipe on unenrolment.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 16

What are Endpoint Security policies in Intune?

Accepted Answer

Endpoint Security policies configure security controls on devices: Antivirus (Defender), Disk Encryption (BitLocker/FileVault), Firewall, Attack Surface Reduction (ASR) rules, Account Protection. Separate from compliance policies but often evaluated together.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 17

How do you deploy certificates via Intune?

Accepted Answer

Use SCEP (Simple Certificate Enrollment Protocol) or PFX profiles. SCEP integrates with your PKI (AD CS, EJBCA, Venafi) and auto-renews certificates. PFX delivers existing certs. Both require a trusted root CA profile deployed first.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 18

What is the difference between user-based and device-based deployment?

Accepted Answer

User-based deployment installs an app for a specific user across all their devices. Device-based deployment installs the app on a specific device regardless of user. Choose user-based for productivity apps, device-based for shared kiosks and line-of-business apps.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 19

How does App Protection Policy (APP) work?

Accepted Answer

APP defines how managed apps behave on enrolled or unenrolled devices: PIN, encryption, copy-paste restrictions, screenshot blocking, jailbreak detection, remote wipe. APP works even on unenrolled BYOD devices — it only protects the apps, not the whole device.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 20

What is Windows Hello for Business?

Accepted Answer

WHfB replaces passwords with key-based or biometric authentication (PIN, fingerprint, face). The credential is tied to the device and the user. Integrates with Entra ID for SSO. Significantly stronger than passwords against phishing.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.

Question 21

How would you handle a lost or stolen device?

Accepted Answer

Remote wipe via Intune (full wipe for corporate, selective wipe for BYOD). For BYOD, selective wipe removes only managed apps and data. Verify the wipe completed in the Intune console. Notify the user and update asset inventory.
This is a preview of the first 20% of this content. Unlock full access with a Learning Pass.