Prepare infrastructure for devices

Contoso is deploying 200 company-owned Android devices to its warehouse. The devices have no user accounts assigned and will be shared across shifts. Each device must run only a single inventory-scanning app in kiosk mode, and no personal or corporate user data should be tied to a specific employee. Which Android Enterprise enrollment method should you use in Microsoft Intune?

Contoso is issuing new Android smartphones to its field sales team. Each device is company-owned, but management wants employees to be able to install personal apps and keep personal data completely separate from corporate apps, which must remain fully managed by Intune. Which Android Enterprise enrollment profile type should you configure to meet these requirements?

Contoso is deploying 200 new company-owned Android devices to warehouse staff. Each device must be fully managed by Intune (device owner mode) with no personal work profile separation, and staff will sign in with their own Entra ID accounts to receive assigned apps. The devices are not eligible for Google Zero Touch or Samsung Knox Mobile Enrollment. As the endpoint administrator, what must you configure in Intune so technicians can enroll each factory-reset device into fully managed mode?

Contoso purchases 200 new corporate iPhones through an authorized Apple reseller. The endpoint administrator wants these devices to enroll in Intune automatically during the initial setup (out-of-box experience), be marked as supervised, and prevent users from removing the management profile. Which combination must the administrator configure before the devices are distributed?

Your organization has purchased 200 Mac laptops that are already enrolled in Apple Business Manager (ABM). You have connected the ABM token to Intune and created an enrollment profile. Now the security team wants you to silently deploy purchased volume apps to these Macs without requiring an Apple ID on each device. Which additional configuration in Intune is required to meet this requirement?

Contoso uses Microsoft Intune and Microsoft Entra ID. All corporate Windows and iOS devices are enrolled in Intune and evaluated by compliance policies. Management requires that users can only access Microsoft 365 services (Exchange Online and SharePoint Online) from devices that Intune reports as compliant. Non-compliant or unmanaged devices must be blocked, and you want this enforced at sign-in time. What should you configure?

Your organization uses Microsoft Intune. A specialized team is responsible only for creating, editing, and assigning device compliance policies. You must grant this team the minimum permissions needed using a custom role, and you want the role to apply only to devices in the 'Sales-Devices' Entra group. What should you do?

Contoso allows employees to use their personal Windows 11 laptops to access Microsoft 365 email and SharePoint. The security team requires these personal devices to appear in Microsoft Entra ID so Conditional Access can evaluate them, but the company must NOT take full management ownership of the personal machines or place them under a corporate account sign-in. Which device identity option should you instruct users to configure?

Your organization uses Microsoft Intune and Microsoft Entra ID. You need to create a group that automatically includes all corporate-owned Windows devices so that a compliance policy can be targeted to them without manual maintenance. The group must exclude personally owned and non-Windows devices. What should you configure?

Contoso wants a Microsoft Entra dynamic device group that automatically includes only devices that are actively managed by Microsoft Intune, so they can target a configuration profile to those devices. Which dynamic membership rule should the administrator use?

Contoso wants to automatically assign Microsoft 365 licenses and Intune app configurations to all users in the Sales department. The identity team creates an Entra ID group and wants membership to update automatically whenever a user's department attribute changes in Entra ID. Which group configuration should they use?

Contoso purchases 500 new Android Enterprise devices directly from an OEM reseller that participates in Google's device provisioning program. The endpoint administrator wants these devices to be automatically assigned to Intune as fully managed, corporate-owned devices the moment an end user powers them on and connects to Wi-Fi, without any manual QR code scanning or NFC bump. Which combination of steps must the administrator complete to achieve this?

You are configuring a Windows 10/11 compliance policy in Microsoft Intune for Contoso. Management requires that devices failing the minimum OS version check be given three days to remediate before being marked noncompliant, but after that grace period they must be blocked from corporate resources. Which action should you configure in the compliance policy's 'Actions for noncompliance' settings to meet the grace-period requirement?

Contoso allows employees to enroll personal devices into Microsoft Intune. Recently, the help desk noticed that some users have enrolled more than 10 devices each, consuming licenses and cluttering the console. Management wants to allow each user to enroll a maximum of 3 devices while leaving all other enrollment behavior unchanged. What should you configure in the Microsoft Intune admin center?

Contoso purchases 200 new MacBook devices through a reseller and wants them to enroll into Intune automatically during initial setup, with a corporate-branded Setup Assistant, no local admin rights for the user, and supervision enforced. The devices have been added to Contoso's Apple Business Manager account and assigned to the Intune MDM server token. What must you configure in Intune to control the out-of-box enrollment experience for these Macs?

Contoso wants to reduce the risk of a single compromised administrator account making harmful changes in Microsoft Intune. Specifically, they require that any deployment of a new application or any change to an existing app deployment must be requested by one administrator and explicitly approved by a second, different administrator before it takes effect. Which Intune capability should you implement to meet this requirement?

Contoso allows employees to use their personal iPhones for work email and approved apps. The security team requires that Intune manage only corporate data and that users complete enrollment themselves through the Company Portal, with each device tied to the enrolling user. No Apple Business Manager tenant is configured. Which enrollment method should you use to meet these requirements?

Contoso purchased 500 Samsung Galaxy tablets directly from a Samsung reseller for its field technicians. The devices must automatically enroll into Intune as Android Enterprise fully managed devices the first time each tablet connects to Wi-Fi, without any technician manually scanning QR codes or entering enrollment tokens. As the endpoint administrator, which service should you use to associate these Samsung devices with your Intune tenant so enrollment is triggered automatically at first boot?

Contoso has a central IT team and a separate helpdesk team based in the Madrid office. All company devices are enrolled in Microsoft Intune. You must ensure the Madrid helpdesk can only view and manage the devices and policies that belong to the Madrid region, while the central IT team retains full visibility across all objects. You have already created a custom Intune role with the appropriate remote actions. What should you configure to restrict the Madrid helpdesk to only their regional objects?

Your organization uses Windows 365 Enterprise. A group of support staff must be able to restart, reprovision, and troubleshoot users' Cloud PCs, but they must NOT be able to create new provisioning policies or modify Azure network connections. You want to grant this access using the least-privileged approach with minimal administrative effort. What should you do?