25 Scenario-Based Exam Questions on Entra ID Device Settings, MDM Scope, and Dynamic Groups
Q1. Device join blocked
You set up Intune and want Windows 11 devices to be Microsoft Entra ID joined. Users report “Your organization doesn’t allow this device to be joined.” In Entra ID, where should you check first?
- A. Entra ID → Security → Conditional Access
- B. Entra ID → Devices → Device settings → Users may join devices to Microsoft Entra ID
- C. Intune → Devices → Enroll devices → Device enrollment restrictions
- D. Intune → Endpoint security → Account protection
Answer: B
Q2. MFA prompt during join
Leadership wants MFA enforced only when devices are enrolled from outside the corporate network. What is the best approach?
- A. Set “Require MFA to register or join devices” to Yes in Entra ID
- B. Use Conditional Access with named locations and require MFA based on conditions
- C. Enable Security Defaults
- D. Increase the device quota
Answer: B
Q3. Enrollment fails due to device quota
A user cannot enroll a new laptop. Error indicates device limit reached. Where are the two places you should verify device limits?
- A. Entra ID Device settings and Intune Enrollment restrictions
- B. Entra ID Device settings and Intune Device limit restrictions (Enrollment)
- C. Entra ID Groups and Intune RBAC
- D. Intune Compliance policies and Entra ID Conditional Access
Answer: B
Q4. Personal device registrations inflating quota
Users enrolled many personal phones as “registered” devices, causing Windows enrollment failures due to quota. What change most directly reduces future impact?
- A. Block all device registration in Entra ID
- B. Reduce Entra ID “user device quota”
- C. Disable ESR
- D. Turn on BitLocker key restriction
Answer: B
Q5. Need to restrict who can join Entra ID, but only for Windows
You want only a pilot group to join devices, but you plan to control platforms and enrollment later. Best practice in this situation?
- A. Set “Users may join devices” to Selected and pick pilot users
- B. Set “Users may join devices” to All and restrict device types in Intune
- C. Disable MDM user scope
- D. Require MFA in Entra ID device settings
Answer: B
Q6. BitLocker recovery key self-service decision
Security wants users prevented from retrieving BitLocker keys for their own devices. What is the expected operational impact?
- A. Fewer helpdesk calls after power events
- B. More helpdesk calls because users can’t self-recover
- C. No impact because Intune stores keys anyway
- D. Device enrollment will fail
Answer: B
Q7. Graph method to update deviceRegistrationPolicy
You are automating device registration settings using Microsoft Graph PowerShell. Which method is required for deviceRegistrationPolicy?
- A. POST
- B. PUT
- C. PATCH
- D. DELETE
Answer: B
Q8. Graph method for BitLocker key read permission policy
You are updating authorizationPolicy to control default user role permissions for BitLocker key access. Which method is required?
- A. POST
- B. PUT
- C. PATCH
- D. GET
Answer: C
Q9. Remove stale devices safely
You want a staged approach for stale devices. What is the safest sequence?
- A. Delete devices immediately after 90 days
- B. Disable at 90 days, delete at 120 days only if still disabled
- C. Delete at 120 days regardless of enabled state
- D. Disable at 30 days, delete at 60 days
Answer: B
Q10. Pagination limitation in Graph
Your cleanup script using Invoke-MgGraphRequest returns only 100 devices. What’s the most accurate explanation?
- A. You must use v1.0 for more results
- B. Microsoft Graph enforces strict tenant limits permanently
- C. You must follow
@odata.nextLinkto retrieve additional pages - D. Device objects are capped at 100 in Entra ID
Answer: C
Q11. Incorrect Graph endpoint for devices
A script uses https://graph.microsoft.com/beta/devices but fails in production with permissions errors. What’s the most likely fix?
- A. Switch to
https://graph.microsoft.com/beta/groups - B. Add correct Graph permissions (Device.ReadWrite.All) and admin consent
- C. Change HTTP method to GET
- D. Enable ESR
Answer: B
Q12. ESR benefit scenario
A user signs into a new Windows device and expects language/region settings and Edge favorites to appear automatically. Which feature provides this?
- A. OneDrive Known Folder Move
- B. Enterprise State Roaming
- C. Windows Autopatch
- D. Windows Hello for Business
Answer: B
Q13. ESR configuration location
Where do you enable ESR in Entra ID?
- A. Entra ID → Users → User settings
- B. Entra ID → Devices → Device settings → Enterprise State Roaming
- C. Intune → Devices → Windows enrollment
- D. Intune → Tenant administration → Customization
Answer: B
Q14. ESR automation approach
You need to automate ESR enablement. Why can’t you rely on Microsoft Graph for this setting (per the scenario)?
- A. Graph is deprecated for Entra
- B. ESR is only configurable via the IAM API endpoint
- C. ESR is configured only through Intune Settings Catalog
- D. ESR requires on-prem AD GPO
Answer: B
Q15. IAM API token acquisition
Your ESR automation uses device code flow and a client ID to obtain a token. What is the key characteristic of this authentication flow?
- A. Fully silent, no user interaction
- B. Requires user to visit a URL and enter a code
- C. Uses certificate-based auth only
- D. Requires managed identity on a VM
Answer: B
Q16. Group type for Intune assignments
You want a group to assign configuration profiles to users. Which group type is typically used?
- A. Microsoft 365 group with mailbox
- B. Security group
- C. Distribution list
- D. Mail-enabled security group only
Answer: B
Q17. Group-based license assignment
You want to assign Intune licenses automatically. Which capability supports this directly?
- A. Nested dynamic device groups
- B. Group-based licensing on Entra ID groups
- C. Conditional Access session controls
- D. ESR syncSelectedUsers array
Answer: B
Q18. Dynamic group delay
You create a dynamic group for Autopilot devices and import hardware hashes. Devices do not appear immediately. What is the best explanation?
- A. Autopilot requires manual group membership
- B. Dynamic membership processing can take time to evaluate rules
- C. Devices must be hybrid joined first
- D. MDM scope must be set to None
Answer: B
Q19. Autopilot dynamic device rule identifier
Which attribute is commonly used to target Autopilot devices in a dynamic device group?
- A. deviceOSType
- B. deviceCategory
- C. devicePhysicalIds containing
[ZTDID] - D. enrollmentProfileName
Answer: C
Q20. Dynamic user group for licensed users
You want a dynamic group containing only users licensed for Microsoft 365 Apps (service plan). Which approach is correct?
- A. Filter on userCountry
- B. Filter on assignedPlans servicePlanId where capabilityStatus is Enabled
- C. Filter on devicePhysicalIds
- D. Filter on userPrincipalName suffix
Answer: B
Q21. MDM scope impact
Windows devices join Entra ID successfully but do not enroll into Intune automatically. What is the most likely missing configuration?
- A. ESR is disabled
- B. MDM user scope is not enabled for the user
- C. BitLocker key restriction is enabled
- D. Too many dynamic groups exist
Answer: B
Q22. MDM vs MAM
You need to manage corporate-owned Windows devices end-to-end (policies, compliance, apps). Which is required?
- A. MAM only
- B. MDM enrollment
- C. ESR only
- D. WIP enrollment only
Answer: B
Q23. BYOD app-only management requirement
You want to protect Outlook and Teams on personal devices without enrolling the device. Which technology aligns best?
- A. MDM
- B. MAM (App protection policies)
- C. Autopilot
- D. Windows Autopatch
Answer: B
Q24. Automating MDM scope challenge
You attempt to automate MDM user scope using Graph but cannot find the setting. What’s the key reason in this scenario?
- A. MDM scope is stored only in Intune
- B. MDM scope uses the IAM API and tenant-specific policy object IDs
- C. MDM scope requires a GPO
- D. MDM scope requires Security Defaults enabled
Answer: B
Q25. Best pre-Intune configuration sequence
You are building a new tenant and want predictable enrollment. Which order is best?
- A. Create Intune policies first, then configure Entra device settings
- B. Configure Entra device settings and MDM scope first, then build Intune profiles
- C. Enable ESR last, but skip MDM scope until after Autopilot
- D. Create dynamic groups after deployment begins
Answer: B
