Microsoft - MD-102: Endpoint Administrator

Sample Questions

Solution:

Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. To turn on Windows SmartScreen using an endpoint security policy, we need to create an application control attack surface reduction (ASR) policy.

Step 01: Sign in to the Microsoft Intune admin center (https://intune.microsoft.com/). Browse to Endpoint security > Manage\Attack surface reduction. Select +Create Policy.

Step 02: Select Windows as the platform and Application control as the Profile type. Then click Create.

Step 03: Enter a name for the new profile. Then click Next.

Step 04: Set Turn on Windows SmartScreen to Yes. Then click Next.

Step 05: On the Scope tags page click Next. On the Assignments page click the +Add all devices link to add All devices as included group. Then click Next.

Step 06: On the Review + create page review your configuration. Then click Create to create the endpoint security policy and to finish the task.

Reference: Microsoft Defender SmartScreen

Solution:

We need to create a Conditional Access poicy that applies to Android devices only and requires the devices to be marked as compliant when accessing Microsoft Office 365.

Step 01: Sign in to the Microsoft Entra admin center (https://entra.microsoft.com/). Expand Identity and select Protection > Conditional Access. From Conditional Access select +Create new policy.

Step 02: Enter a name for the new policy and add the sg-Legal group to the assignments.

Step 03: From Target resources, include Office 365.

Step 04: From Conditions configure the Device platforms to include Android devices only.

Step 05: From the Grant Access control, enable Require device to be marked as compliant. Then click Select.

Step 06: Set Enable policy to On. Then click Create to create the policy and to finish the task.

Reference: What is Conditional Access?

Solution:

We need to run the Get-WindowsAutopilotInfo script locally using PowerShell and upload the output file containing the hardware Id to Windows Autopilot using the Microsoft Intune admin center.

Step 01: Start Windows PowerShell in Administrator mode and enter the commands shown below.

Set-Location -Path "C:\Scripts"
Set-ExecutionPolicy RemoteSigned
.\Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv


Step 02: Sign in to the Microsoft Intune admin center (https://intune.microsoft.com/). Browse to Devices > Device onboarding\Enrollment and scroll down to the Windows Autopilot section. Then click Devices.

Step 03: Click the Import link in top navigation bar, browse to the C:\Scripts folder and select the previously generated AutopilotHWID.csv file. Then click the Import button.

Step 04: Our computer was successfully registered to Windows Autopilot. The task is completed.

Reference: Manually register devices with Windows Autopilot

Solution:

We will use the Settings app to join our existing Windows device to Microsoft Entra ID.

Step 01: Start the Settings app and click on "Accounts".

Step 02: Select "Access work or school" and click on +Connect

Step 03: Click the Join this device to Microsoft Entra ID link.

Step 04: Provide your username and password and sign in to your Microsoft Entra tenant.

Step 05: Verify the tenant and click on Join to join your computer to the tenant.

Step 06: The computer was successfully joined to Microsoft Entra ID. Click on Done. The task is completed.

Reference: Join your work device to your work or school network

Solution:

We need to configure the local admin password solution (Windows LAPS) by creating an account protection policy from the Microsoft Intune admin center.

Step 01: Sign in to the Microsoft Intune admin center (https://intune.microsoft.com). Browse to Endpoint security > Manage\Account protection and click on +Create Policy.

Step 02: Select "Windows" as the platform and "Local admin password solution (LAPS)" as the profile type. Then, click on Create

Step 03: Enter a name for the new policy and click on Next.

Step 04: Set "Backup Directory" to "Backup the password to Azure AD only". Then, click Next.

Step 05: On the "Scope tags" page click Next. On the "Assignments" page add the "All devices" group as included group and click on Next.

Step 06: On the "Review + create" page review your configuration. Click on Save to create the policy. The task is completed.

References:

Microsoft Intune support for Windows LAPS

Manage Windows LAPS policy with Microsoft Intune