Your company is migrating from legacy LAPS to Windows LAPS for their hybrid-joined devices. They want to ensure that the transition is smooth and that there are no disruptions in their OS deployment workflows. How should you implement a strategy to migrate from legacy LAPS to Windows LAPS while minimizing disruptions during the OS deployment process? Each correct answer presents part of the solution. Which three actions should you perform?
Apply the Windows LAPS policy after the OS deployment workflow is complete.
Configure the Windows LAPS policy to target a different account than the one used by the OS deployment workflow.
Disable legacy LAPS emulation mode at the beginning of the OS deployment workflow.
Enable legacy LAPS emulation mode at the beginning of the OS deployment workflow.
Use a clean staging Organizational Unit (OU) during the OS deployment workflow.
To ensure a smooth migration, you should enable legacy LAPS emulation mode at the start of the OS deployment so existing workflows continue to function. Apply the Windows LAPS policy only after deployment is complete to avoid conflicts. Targeting a different account with the Windows LAPS policy prevents overlap and ensures both legacy and new LAPS solutions can coexist during the transition. This approach minimizes disruptions and ensures a seamless migration.
Your company operates in a hybrid environment with both on-premises Active Directory and Microsoft Entra ID. They need to ensure that Windows 11 devices can access both cloud and on-premises resources seamlessly. You need to configure the devices to be Microsoft Entra hybrid joined. Each correct answer presents part of the solution. Which three actions should you perform?
Configure Microsoft Entra Connect to synchronize device objects.
Disable WS-Fed and WS-Trust protocols.
Enable device writeback in Microsoft Entra Connect.
Ensure the devices are domain-joined.
Register devices manually in Microsoft Entra ID.
Use Microsoft Entra Domain Services to manage devices.
To enable Microsoft Entra hybrid join, devices must first be domain-joined to your on-premises Active Directory. Microsoft Entra Connect must be configured to synchronize device objects to Microsoft Entra ID, and enabling device writeback allows for proper synchronization and management between on-premises and cloud directories. This setup ensures seamless access to both cloud and on-premises resources.
You want to ensure that all new Windows 11 devices are joined to Microsoft Entra ID during the out-of-box experience (OOBE). The IT department has configured the device registration service and ensured that all necessary prerequisites are met. You need to join the new Windows 11 devices to Microsoft Entra ID during the OOBE. Each correct answer presents part of the solution. Which three actions should you perform?
Provide the credentials that your organization provided.
Select ‘Set up for work or school’ when prompted.
Select ‘This device belongs to my family’ when prompted.
Skip the network connection step during setup.
Turn on the new device and start the setup process.
To join a new Windows 11 device to Microsoft Entra ID during OOBE, you must turn on the device and start setup, select ‘Set up for work or school’ to indicate it?s for organizational use, and then provide the organization-provided credentials. This ensures the device is properly joined to Microsoft Entra ID and managed by your organization.
Your company is using Microsoft Intune to manage their Windows devices. They want to implement a policy that requires all Windows devices to have a minimum OS version and to be encrypted. How should you configure the devices to enforce these requirements? Each correct answer is part of the solution. What three actions should you take?
Assign the compliance policy to a device group.
Configure actions for noncompliance to send email alerts.
Create a new device compliance policy for Windows.
Enable Windows health attestation in the compliance policy.
Set the device encryption requirement in the compliance policy.
Set the minimum OS version requirement in the compliance policy.
To enforce that all Windows devices have a minimum OS version and are encrypted, you first create a new device compliance policy for Windows. Within this policy, you set the device encryption requirement and specify the minimum OS version. These settings ensure that only devices meeting both criteria are marked as compliant in Intune.
Your company is planning to deploy Windows 11 to a large number of new devices purchased from an OEM. The devices come with Windows 11 Pro pre-installed, but Contoso needs them configured with specific organizational settings and applications. How should you streamline the deployment process to ensure minimal IT intervention while meeting Contoso’s configuration requirements? Each correct answer presents part of the solution. What two actions should you perform?
Create a provisioning package using Windows Imaging and Configuration Designer (ICD).
Deploy a custom Windows 11 image using Windows Deployment Services (WDS).
Perform an in-place upgrade from Windows 11 Pro to Windows 11 Enterprise.
Use Windows Autopilot to customize the Out-of-Box Experience (OOBE).
Creating a provisioning package with Windows ICD allows you to quickly apply organizational settings and applications to new devices without reimaging, making the process efficient for large deployments. Using Windows Autopilot to customize the OOBE further streamlines the setup, automating enrollment and configuration so devices are business-ready with minimal IT intervention. This combination is ideal for deploying new devices from an OEM with Windows 11 Pro pre-installed, ensuring they meet company requirements before being handed to users.
Your company is deploying new Windows 11 devices to its remote workforce. They want to ensure that these devices are pre-configured with necessary applications, settings, and policies before being delivered to employees. How should you implement a deployment strategy to ensure the devices are business-ready upon delivery? Each correct answer presents a complete solution. What are three possible ways to achieve this goal?
Use Windows Autopilot to automatically configure and enroll the devices into Intune.
Use Microsoft Intune to deploy PowerShell scripts that remove unnecessary built-in apps.
Create and deploy device compliance policies in Intune to ensure security settings are applied.
Create a manual deployment process for each device, configuring settings on-site.
Use Windows Server Update Services (WSUS) to push out applications and updates.
Windows Autopilot streamlines the initial setup and configuration of devices, enrolling them directly into Intune for management. Intune can deploy PowerShell scripts to automate the removal of unwanted apps, ensuring a clean environment. Device compliance policies in Intune enforce security and configuration standards, making sure all devices meet company requirements before being handed over to employees. This approach ensures devices are business-ready with minimal manual intervention.
Your company wants to implement Conditional Access policies to protect organizational data. They need to ensure that only devices compliant with their Intune policies can access Microsoft 365 services. How should you configure the devices to implement these Conditional Access policies? Each correct answer is part of the solution. What three actions should you take?
Assign the Conditional Access policy to the user group accessing Microsoft 365 services.
Configure the policy to allow access from unmanaged devices.
Create a Conditional Access policy in Microsoft Entra ID.
Enable location-based access control in the Conditional Access policy.
Enable location-based access control in the Conditional Access policy.
To ensure only compliant devices can access Microsoft 365 services, you must create a Conditional Access policy in Microsoft Entra ID, assign it to the relevant user group, and configure the policy to require device compliance from Intune. This combination enforces that only devices meeting your organization’s compliance standards are granted access, protecting organizational data.
You have a Microsoft 365 subscription that includes iOS and Android devices that are managed by using Microsoft Intune. You plan to implement a data protection framework for financial data. You need to create app protection policies for the framework to protect company data in the event that a device is rooted or jailbroken. What two actions should the policy perform? Each correct answer presents part of the solution.
Block access.
Encrypt organizational data.
Reset the PIN.
Wipe data.
If a device is detected as rooted or jailbroken, the most secure actions are to block access to company data and wipe any organizational data from the device. This ensures that sensitive information is not accessible or left on a compromised device, providing strong protection for financial and other confidential data. Encrypting data and resetting the PIN do not address the risk of a compromised device as effectively as blocking access and wiping data.
Your company is implementing a new email application for its employees. The IT department wants to ensure that the application is configured to block external images and restrict certain URLs for security reasons. Employees use a mix of iOS and Android devices, both managed and unmanaged. What two actions should you perform to apply these configurations to the email application across all devices?
Create a separate app protection policy for each device type.
Create an app configuration policy for managed apps and include the required settings.
Create an app configuration policy for managed devices and include the required settings.
Instruct employees to manually configure the email application settings.
To ensure the email app is configured correctly on both managed and unmanaged devices, you need to create app configuration policies for both managed apps (for devices not enrolled in management) and managed devices (for devices that are enrolled). This approach allows you to centrally enforce the required security settings, such as blocking external images and restricting URLs, across all device scenarios without relying on users to configure settings manually.
Your company has recently deployed Microsoft Intune to manage their mobile devices and applications. They have a mix of iOS and Android devices used by employees for both personal and work tasks. The IT department wants to ensure that corporate data is protected while allowing employees to use their devices for personal purposes. You need to configure app protection policies to secure corporate data on these devices without requiring device enrollment. Each correct answer presents part of the solution. Which three actions should you perform?
Assign the MAM policy to the user groups.
Configure app protection settings for managed apps.
Create a Mobile Application Management (MAM) policy in Intune.
Enroll all devices in Intune using Mobile Device Management (MDM).
Require users to install the Company Portal app.
To secure corporate data on personal devices without requiring device enrollment, you should create a Mobile Application Management (MAM) policy in Intune, configure app protection settings for managed apps, and assign the MAM policy to the appropriate user groups. This approach allows you to protect corporate data at the app level, even on devices that are not enrolled in Intune, ensuring security while supporting BYOD (Bring Your Own Device) scenarios. Device enrollment with MDM is not required for MAM policies.
Your company has a diverse range of devices, including Windows, macOS, and Android. The company wants to ensure that all employees have access to necessary applications while maintaining security and compliance, using Microsoft Intune for device management. How should you deploy Microsoft 365 Apps to all devices and configure the apps with specific organizational settings before users open them for the first time? Each correct answer presents part of the solution. What two actions should you perform?
Create an app configuration policy in Intune to configure the organizational settings.
Deploy Microsoft 365 Apps using Intune and include the app configuration policy during enrollment.
Manually configure the organizational settings on each device after deploying Microsoft 365
Use Group Policy to deploy Microsoft 365 Apps and configure the settings.
You should create an app configuration policy in Intune to define the organizational settings, and then deploy Microsoft 365 Apps using Intune, including the app configuration policy during enrollment. This ensures the apps are automatically configured with the correct settings before users open them for the first time.
You have a Microsoft 365 E5 subscription that uses Microsoft Intune. All devices are enrolled in Intune. You plan to use Intune to deploy Microsoft 365 apps to all supported device platforms. Which two device platforms support the app deployment? Each correct answer presents a complete solution.
Android
iOS
Linux
macOS
Windows 11
Microsoft Intune supports deploying Microsoft 365 apps (such as Office apps) to both Windows 11 and macOS devices. Android and iOS devices can receive Office mobile apps, but the full Microsoft 365 app deployment via Intune is specifically supported on Windows and macOS platforms. Linux is not supported.
Your company has developed a custom line-of-business (LOB) app for the sales team. The app needs to be deployed to both company-owned and personal devices used by the sales team. How should you deploy the LOB app using Intune while ensuring that corporate data within the app is protected? Each correct answer presents part of the solution. What two actions should you perform?
Add the LOB app to Intune as a Line-of-business app.
Apply an app protection policy to the LOB app.
Deploy the LOB app using Group Policy.
Require device enrollment for all personal devices.
Use the Microsoft Store for Business to deploy the LOB app.
Add the LOB app to Intune as a Line-of-business app: This allows you to deploy your custom app directly to both company-owned and personal devices through Intune, ensuring easy and managed distribution. Apply an app protection policy to the LOB app: App protection policies in Intune help secure corporate data within the app, even on personal devices, by enforcing restrictions such as data encryption, preventing data transfer to unmanaged apps, and requiring authentication.,m n
