The hard set (6 questions)
The hardest MD-102 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.
An administrator configures an ESP profile with 'Install Windows quality updates' set to Yes. The target Windows 11 devices are enrolled but are NOT registered for Windows Autopilot. To which assignment must BOTH the Update Rings policy and the ESP profile be set so quality updates install during OOBE, and which Autopilot scenario cannot install them at all because it does not use the ESP?
Correct answer: D. All Devices; Windows Autopilot device preparation does not support it
For the 'Install Windows quality updates' ESP setting to work on non-Autopilot-registered devices, both the Update Rings policy and the ESP profile must be assigned to 'All Devices'. Additionally, Windows Autopilot device preparation does not use ESP at all, so this setting is not applicable and monthly security updates cannot be installed during OOBE for that scenario.
Why the other options are wrong:
- A. User-targeted assignments are not supported for the quality update installation feature. The ESP setting documentation specifically requires device-targeted (All Devices) assignment, not user-targeted assignment.
- B. Self-deploying mode is device-targeted and does support installing quality updates during OOBE, so this option's unsupported-scenario claim is false. Also, for non-Autopilot devices the assignment must be All Devices, not specific groups.
- C. Windows Autopilot user-driven mode does support the 'Install Windows quality updates' setting when the assignment and configuration requirements are met. The unsupported scenario is Windows Autopilot device preparation, not user-driven mode.
Memory hook: Quality updates during OOBE = All Devices assignment. Device preparation = no ESP = no quality updates.
Microsoft Learn: Windows enrollment status
In your Windows Autopilot deployment profile you set "Allow pre-provisioned deployment" to No because you do not want technicians using the pre-provisioning (white glove) flow. During OOBE on a target device, a technician presses the Windows key five times and attempts the pre-provisioning path anyway. What happens?
Correct answer: A. Intune enforces the profile setting and pre-provisioning fails with error 0x80180005
Pressing the Windows key five times at OOBE can invoke the pre-provisioning path, but Intune enforces the "Allow pre-provisioned deployment" setting. When it is set to No, the pre-provisioning attempt fails with error 0x80180005 instead of continuing.
Why the other options are wrong:
- B. It does not silently fall back to user-driven mode; the pre-provisioning attempt errors out.
- C. The key shortcut can invoke the path, but the profile setting is enforced and blocks it.
- D. The five-key shortcut is not gated by ESP assignment; the block comes from the profile setting being No.
Memory hook: Pre-provision set to No means the white-glove attempt dies at 0x80180005.
Microsoft Learn: Profiles
An administrator sets up Windows Autopilot device preparation. A user-driven deployment completes and users reach the desktop, but none of the apps or PowerShell scripts selected in the device preparation policy are installed, and the devices never appear in the target device security group. Which misconfiguration is the most likely cause?
Correct answer: D. The target device security group is missing the Intune Provisioning Client as an owner, or the group has 'Microsoft Entra roles can be assigned to the group' set to Yes.
Device preparation relies on Enrollment Time Grouping: at enrollment, Intune writes the device into the named static security group so assigned apps, scripts, and policies apply. For this to work, the Intune Provisioning Client service principal (AppId f1346770-5b25-470b-88bd-d5744ab7952c) must be an owner of that group, and the group must have 'Microsoft Entra roles can be assigned to the group' set to No. If the owner is missing or the group is role-assignable, the device never joins the group, so nothing assigned to it is delivered. The admin also needs the 'Enrollment time device membership assignment' RBAC permission.
Why the other options are wrong:
- A. Device preparation policies are correctly assigned to a user group by design, and the deployment reaching the desktop shows the policy applied. The failure is the device not joining the target group, not a device-group assignment.
- B. Device preparation deliberately requires no hardware-hash pre-registration. Missing hashes cannot be the cause because hashes are not used in this model.
- C. Apps for device preparation must be both selected in the policy and assigned to the device security group. But the described symptom, the device never joining the group at all, points to the Enrollment Time Grouping owner or role-assignable misconfiguration, not an app assignment gap.
Memory hook: No apps and device not in group = Intune Provisioning Client not owner, or the group is role-assignable (it must be No).
Microsoft Learn: Setup time grouping
Your organization wants to move a fleet of Microsoft Entra hybrid joined Windows laptops to Microsoft Entra join (cloud-native). A colleague suggests running Autopilot Reset on each device to flip the join type in place. What is the accurate guidance?
Correct answer: A. There is no supported path to convert an existing hybrid joined device to Entra join without a full device wipe, and Autopilot Reset does not support hybrid joined devices
Microsoft states there is no supported process to convert an existing device from hybrid join to Entra join without a Windows reset (full wipe). Additionally, Autopilot Reset does not support hybrid joined devices, so it cannot perform the conversion. The supported approach is a full wipe and re-provision as Entra join.
Why the other options are wrong:
- B. dsregcmd /leave removes the join state but does not cleanly convert the device to Entra join; a reset and re-provision is required.
- C. Autopilot Reset does not support hybrid joined devices and cannot flip the join type in place.
- D. Reassigning an Autopilot profile does not re-join an already-provisioned device; join type is set at provisioning time.
Memory hook: Hybrid to Entra join means wipe and reprovision; Autopilot Reset won't touch hybrid.
Microsoft Learn: Entra join types
During a Windows Autopilot pre-provisioned deployment, a technician completes the technician flow and sees a success screen. The device is resealed and shipped to the end user. The end user powers on the device but reports that several device-targeted apps that were assigned to the device, and should have installed during the technician flow, are missing when they reach the desktop. What configuration change would most directly prevent this outcome?
Correct answer: A. Ensure that the Enrollment Status Page (ESP) is enabled and configured to block device use until all apps are installed.
The technician flow inherits behavior from self-deploying mode and uses the ESP to hold the device in provisioning state. If the ESP is disabled or not configured to block on app installation, the Reseal button can appear before apps finish installing. Microsoft explicitly recommends keeping the ESP enabled for pre-provisioned deployments because the success screen only confirms enrollment success, not completion of app/config installation.
Why the other options are wrong:
- B. Changing to self-deploying mode would prevent user-account-based deployment entirely and is a different scenario. The pre-provisioned user-driven mode is appropriate here.
- C. Adding the user to the app-assignment group only affects user-targeted apps delivered during the user flow; it does not explain device-targeted apps missing after the technician flow, where the root cause is the ESP not holding the device until app installation completes.
- D. 'Allow pre-provisioned deployment' must already be enabled in the Autopilot profile for this scenario to work at all. Enabling it does not address apps missing after the technician flow completes.
Memory hook: ESP is the gate that holds the technician flow until apps land. Drop the gate and the device reseals half-provisioned.
Microsoft Learn: Azure ad join technician flow
An administrator creates an Enrollment Status Page (ESP) profile and sets 'Block device use until these required apps are installed' to 'Selected,' then adds App1, App2, and App3 to the blocking list. App3 and App4 are both assigned to the device as required apps. What happens during enrollment?
Correct answer: D. The ESP blocks only until App3 installs, because it is the only app in both the blocking list and the device assignment.
When 'Selected' apps are configured as blocking, the ESP uses the blocking app list as a filter against what is actually assigned to the device or user. In this scenario, App1 and App2 are in the blocking list but not assigned to the device, so they are not tracked. App3 is in both the blocking list and assigned as a required app, so the ESP waits for App3. App4 is assigned but not in the blocking list, so in non-pre-provisioning flows with Win32, Store, or Enterprise catalog apps, App4 may not install until after ESP completes.
Why the other options are wrong:
- A. The ESP does not block on App1 or App2 because they are in the blocking list but are not assigned to the device. The blocking list acts as a filter on the assigned apps, not as a standalone install mandate.
- B. App4 does get installed, just not necessarily during the ESP blocking phase. In user-driven and self-deploying modes, Win32, Store, and Enterprise catalog apps not in the blocking list install after the ESP completes.
- C. The 'Selected' blocking list filters which assigned apps the ESP waits for. It does not cause the ESP to wait for apps that are in the blocking list but not assigned (App1, App2), nor does it automatically add all assigned apps (App4) to the blocking requirement.
Memory hook: Blocking list = filter, not a grocery list. ESP only waits for apps that are BOTH in the blocking list AND assigned to the device.
Microsoft Learn: Setup status page
