Exam objective

MD-102

Implement identity and compliance

This objective sits in Prepare infrastructure for devices, which carries 23% of the MD-102 Endpoint Administrator exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.

Objective title verbatim from the official objectives. Microsoft Azure exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Prepare infrastructure for devices

A tenant uses Conditional Access with device compliance, and devices that were never assigned a compliance policy are still getting access. Which tenant wide setting should change?

The update ring deferral period for the device groupUpdate rings are unrelated to compliance.
The compliance status validity period, set to a shorter windowThe validity period governs how long a report stays valid, not unassigned devices.
The enrollment device limit restriction for those usersEnrollment limits govern how many devices a user enrolls.
Mark devices with no compliance policy assigned as Not compliantCorrect · your answerCorrect.

Correct.

Checked against learn.microsoft.com, September 2026

Concept

A device the service has never evaluated should not be trusted by default when access depends on that evaluation.

Why D

The compliance policy setting that marks devices with no compliance policy assigned defaults to Compliant; if Conditional Access is used with compliance policies, change it to Not compliant so only devices confirmed as compliant can access resources.

Source

If you use Conditional Access with your device compliance policies, change this setting to Not compliant to ensure that only devices that are confirmed as compliant can access your resources.

Microsoft Learn: Device compliance overview, checked September 2026
#compliance#conditional-access#tenant-settings

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Prepare infrastructure for devices

Your tenant uses Conditional Access to require compliant devices. How should you set 'Mark devices with no compliance policy assigned as'?

Sample question 2 of 3

Prepare infrastructure for devices

On a Microsoft Entra hybrid joined device, when can a user first sign in with a newly provisioned Windows Hello for Business cloud Kerberos trust PIN?

Sample question 3 of 3

Prepare infrastructure for devices

A managed device fails a compliance rule. By default, what action does every Intune device compliance policy take?

That’s 3 of the full MD-102 Endpoint Administrator bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Prepare infrastructure for devices