Microsoft 365 Certified: Endpoint Administrator (MD-102) · glossary

MD-102 glossary

#ABCDEFGHIJKLMNOPQRSTUVWZAcronyms

#

%RAND:x%

%SERIAL% adds the serial number, and %RAND:x% adds x random digits. Lesson: Device name templates

%SERIAL%

%SERIAL% adds the serial number, and %RAND:x% adds x random digits. Lesson: Device name templates

A

Access policies

Multi admin approval uses access policies so a second admin must approve sensitive changes. Lesson: Multi admin approval

Account-driven User Enrollment

For personal iPhones and iPads, use account-driven User Enrollment (iOS/iPadOS 15+): the user signs in under Settings > General > VPN & Device Management, and Intune manages only a separate work area. Lesson: Personal iPhones and Macs

Across a private group (2)

Download mode: HTTP only, no peering (0); HTTP blended with peering behind the same NAT (1), devices behind the same public IP share; across a private group (2), devices with the same group ID share across NATs;… Lesson: Delivery Optimization

Add (Replace)

Add (Replace) makes the group exactly your list and removes everyone else, like a Restricted Group. Lesson: Managing local group membership

Add (Update)

Add (Update) adds members and leaves others alone. Lesson: Managing local group membership

ADML

Some apps ship their own Group Policy templates (an ADMX file plus a language ADML file). Lesson: Importing custom ADMX files

ADMX

Some apps ship their own Group Policy templates (an ADMX file plus a language ADML file). Lesson: Importing custom ADMX files

Advanced Analytics

Advanced Analytics builds on Endpoint analytics: anomaly detection after updates or changes, the device timeline, battery health, resource performance, custom device scopes, and device query with KQL. Lesson: Advanced Analytics

Anomaly detection

Advanced Analytics builds on Endpoint analytics: anomaly detection after updates or changes, the device timeline, battery health, resource performance, custom device scopes, and device query with KQL. Lesson: Advanced Analytics

App configuration policies

App configuration policies preset app settings. Lesson: App configuration policies

App Control for Business

App Control for Business (formerly Windows Defender Application Control) lets only trusted code run. Lesson: App Control for Business

App protection policy (APP)

An app protection policy (APP) protects company data inside apps like Outlook, Teams, Edge and OneDrive, on enrolled or unenrolled (BYOD) devices. Lesson: App protection policies

App selective wipe

When someone leaves, app selective wipe removes only the org data from the protected apps, leaving the rest of the phone alone. Lesson: Targeting and selective wipe

Apple Business Manager (ABM)

Company iPhones, iPads and Macs use Automated Device Enrollment (ADE) through Apple Business Manager (ABM). Lesson: Company devices: Apple Business Manager

Apple MDM push certificate

Every Apple enrollment needs an Apple MDM push certificate in Intune (renew it yearly with the same Apple Account). Lesson: Personal iPhones and Macs

Application permissions

Register an app in Microsoft Entra ID, grant it application permissions (for example DeviceManagementManagedDevices.Read.All) with admin consent, and authenticate with a certificate. Lesson: Unattended automation

Application reliability

Application reliability: app crashes and mean time to failure. Lesson: Endpoint analytics scores

ASR rules

ASR rules block common attack behaviors: Office apps creating child processes, executable content from email, credential stealing from LSASS, obfuscated scripts, untrusted USB processes and more. Lesson: Attack surface reduction rules

Assigned group

Intune targets policies and apps at Microsoft Entra groups. Lesson: Assigned vs dynamic groups

Assignment filter

An assignment filter narrows a group assignment by device properties. Lesson: Assignment filters

Assume breach

Zero Trust means verify explicitly, use least privilege, and assume breach. Lesson: Zero Trust thinking for endpoints

Audit mode

Start in audit mode. Lesson: App Control for Business

AuditLogs

In Reports > Diagnostic settings, send AuditLogs, OperationalLogs, DeviceComplianceOrg and IntuneDevices to a Log Analytics workspace (needs an Azure subscription). Lesson: Log Analytics, workbooks and alerts

Auto from connector

Create Endpoint security > Endpoint detection and response with the Defender for Endpoint client configuration package set to Auto from connector. Lesson: Onboarding devices with an EDR policy

Automated Device Enrollment (ADE)

Company iPhones, iPads and Macs use Automated Device Enrollment (ADE) through Apple Business Manager (ABM). Lesson: Company devices: Apple Business Manager

Autopatch groups

Autopatch groups split devices into deployment rings (a test ring, middle rings and a last ring) and create the matching update rings and feature update policies for you. Lesson: Windows Autopatch

Autopilot Reset

Autopilot Reset returns a Windows device to a business-ready state: it removes personal files, apps and settings but keeps the Entra join and Intune enrollment, ready for the next user. Lesson: Windows reset options

Available for enrolled devices

Assign with an intent: Required (installs automatically), Available for enrolled devices (users install from Company Portal) or Uninstall. Lesson: Dependencies, supersedence and assignments

Azure Monitor alert rules

Then build workbooks and dashboards, and create Azure Monitor alert rules with action groups: email when compliance drops (drift), when enrollment failures spike, or when audit logs show policy changes. Lesson: Log Analytics, workbooks and alerts

Azure network connection

A provisioning policy decides how Cloud PCs are created: join type and network (Entra join with the Microsoft-hosted network is recommended; hybrid join needs an Azure network connection, ANC), image (a gallery… Lesson: Windows 365 Cloud PCs

B

Battery health

Advanced Analytics builds on Endpoint analytics: anomaly detection after updates or changes, the device timeline, battery health, resource performance, custom device scopes, and device query with KQL. Lesson: Advanced Analytics

BitLocker

Disk encryption profiles: BitLocker for Windows (require encryption, silent encryption for standard users, encryption methods, escrow the recovery key to Entra ID before encrypting, recovery password rotation) and… Lesson: BitLocker and FileVault policies

BitLocker key rotation

BitLocker key rotation creates a new recovery password and escrows it to Entra ID. Lesson: Defender and key rotation actions

Block device use until all apps and profiles are installed

With Block device use until all apps and profiles are installed, users can't reach the desktop before the device is ready. Lesson: What the ESP shows and blocks

Block device use until these required apps are installed

Under Devices > Enrollment > Windows > Enrollment Status Page: Show app and profile configuration progress (Yes turns it on); Show an error when installation takes longer than (default 60 minutes); custom error… Lesson: Key ESP settings

Bring your own CA (BYOCA)

Option 2: bring your own CA (BYOCA): a cloud issuing CA whose CSR is signed by your private CA, such as ADCS. Lesson: Microsoft Cloud PKI

Broker app

On iPhone or Android, signing in to a work app through a broker app (Microsoft Authenticator, or Company Portal on Android) registers the device. Lesson: Registering a personal device

Bulk device actions

Devices > All devices > Bulk device actions: pick the OS, the action (restart, sync, rename, retire, wipe, delete, Autopilot Reset, collect diagnostics) and up to 100 devices at once. Lesson: Bulk device actions

Business-ready

Windows Autopilot takes the OEM's preinstalled Windows and makes it business-ready during setup (OOBE): it joins Microsoft Entra ID, enrolls in Intune, applies policies and installs apps. Lesson: What Windows Autopilot does

C

Classic Autopilot

Pick classic Autopilot when you need pre-provisioning, self-deploying mode, hybrid join, Autopilot Reset, HoloLens or Teams Rooms devices, or a long app list during setup. Lesson: Choosing between them

Cloud Device Administrator

Microsoft Entra roles work tenant-wide: Global Administrator, Intune Administrator (full control of Intune), Cloud Device Administrator (devices in Entra) and Windows 365 Administrator. Lesson: Two layers of roles

Cloud PC

A Cloud PC is a Windows desktop hosted by Microsoft. Lesson: Windows 365 Cloud PCs

Cloud PC Administrator

For Cloud PCs, Intune adds Cloud PC Administrator and Cloud PC Reader roles, and Entra has Windows 365 Administrator. Lesson: Custom roles and Windows 365

Cloud PC Reader

For Cloud PCs, Intune adds Cloud PC Administrator and Cloud PC Reader roles, and Entra has Windows 365 Administrator. Lesson: Custom roles and Windows 365

Cloud Policy

Office settings (macros, add-ins, privacy, save locations) can come from Intune: settings catalog with the Office ADMX settings, or Apps > Policies for Microsoft 365 apps, which uses the Cloud Policy service. Lesson: Policies for Microsoft 365 Apps

Co-management

Besides join-time enrollment: Windows Autopilot (month two), Group Policy auto-enrollment for hybrid joined PCs, Configuration Manager co-management, provisioning packages for bulk setup, and users adding a work… Lesson: Other Windows enrollment paths

Collect diagnostics

Collect diagnostics pulls logs, event logs and key registry data from a Windows device into a zip you download from the device's Device diagnostics page. Lesson: Collect diagnostics and the Troubleshoot pane

Company Portal

Device enrollment through Company Portal or the web is the other personal option. Lesson: Personal iPhones and Macs

Company Portal website

Users can recover their own keys on another device through the Company Portal website or My Account (Devices > View BitLocker keys), unless the Entra setting restricting non-admin key recovery is turned on. Lesson: Recovery keys and self-service

Compliance policy

A compliance policy is a list of conditions a device must meet, like BitLocker on, minimum OS version, firewall and antivirus active, or no jailbreak. Lesson: What a compliance policy does

Compliance status validity period

Compliance status validity period (default 30 days) marks a device noncompliant if it stops reporting. Lesson: Tenant-wide compliance settings

Configuration profile

A configuration profile pushes settings to devices. Lesson: Profile types

Conflict

If two profiles set the same setting to different values on one device, the report shows Conflict and the device may keep an older value. Lesson: Include, exclude and conflicts

Connect-MgGraph

Install the Microsoft Graph PowerShell SDK (Install-Module Microsoft.Graph), sign in with Connect-MgGraph and only the scopes (permissions) you need, then use cmdlets like Get-MgDeviceManagementManagedDevice to read… Lesson: Microsoft Graph PowerShell

Connector status

Connector status: Apple push certificate, ADE and VPP tokens, Managed Google Play, Defender and more (unhealthy when expired or not synced for 3+ days). Lesson: Tenant health and service communications

Corporate device identifiers

For anything else, upload corporate device identifiers (serial numbers or IMEIs) ahead of time. Lesson: Corporate vs personal

Corporate-owned work profile

Corporate-owned work profile (COPE): company phone with personal use allowed. Lesson: Four Android Enterprise profiles

Custom compliance

Custom compliance checks things built-in settings can't. Lesson: Extending compliance with PowerShell

Custom role

When no built-in role fits, create a custom role (or duplicate a built-in one) and tick exactly the permissions needed. Lesson: Custom roles and Windows 365

D

Date range

Apps > Quiet Time > Policies mutes Outlook mail and Teams notifications on iOS/iPadOS and Android after work: a Date range (holidays), Days of the week (all day or certain hours), or Non-working time (Teams, using… Lesson: Quiet Time policies

Days of the week

Apps > Quiet Time > Policies mutes Outlook mail and Teams notifications on iOS/iPadOS and Android after work: a Date range (holidays), Days of the week (all day or certain hours), or Non-working time (Teams, using… Lesson: Quiet Time policies

Deadlines

An update ring policy (Devices > Windows updates) controls the Windows Update client: quality update deferral (0-30 days), feature update deferral (0-365 days; use 0 when a feature update policy picks the version),… Lesson: Update ring settings

Declarative device management (DDM)

iOS/iPadOS: device restrictions (many need a supervised device from ADE), device features (home screen layout, wallpaper, AirPrint), Wi-Fi, VPN, email, and the settings catalog, including Apple's declarative device… Lesson: iOS/iPadOS and macOS profiles

Dedicated device

Personally owned work profile (BYOD): a separate work profile on the user's phone, enrolled through Company Portal. Lesson: Four Android Enterprise profiles

Default elevation response

Endpoint security > Endpoint Privilege Management, Windows elevation settings policy: turn EPM on, set reporting, and choose the default elevation response for files with no rule: Deny all requests, Require support… Lesson: Elevation settings policy

Defender for Endpoint client configuration package

Create Endpoint security > Endpoint detection and response with the Defender for Endpoint client configuration package set to Auto from connector. Lesson: Onboarding devices with an EDR policy

Defender Update controls

Endpoint security > Antivirus for Windows has the Microsoft Defender Antivirus profile (real-time protection, cloud-delivered protection, sample submission, potentially unwanted apps, scan schedules, exclusions),… Lesson: Antivirus policies

Delivery Optimization

A Delivery Optimization profile lets Windows devices share update and app content as peers. Lesson: Delivery Optimization

Dependencies

A Win32 app can have dependencies (install the runtime first) and supersedence (replace or update an older version). Lesson: Dependencies, supersedence and assignments

Deployment profile

A deployment profile assigned to a device group sets the mode, join type (Entra or hybrid), OOBE screens, user account type and device name template. Lesson: Classic Autopilot: deployment profiles

Detection rule

In Intune, set the install and uninstall commands, install behavior (System or User), return codes, requirements (OS, architecture, disk space), and a detection rule that proves the app is installed (MSI product… Lesson: Packaging a Win32 app

Detection script

Devices > Scripts and remediations > Remediations: a script package holds a detection script and a remediation script. Lesson: Remediations

Device diagnostics

Collect diagnostics pulls logs, event logs and key registry data from a Windows device into a zip you download from the device's Device diagnostics page. Lesson: Collect diagnostics and the Troubleshoot pane

Device enrollment manager (DEM)

A device enrollment manager (DEM) account can enroll many shared devices without the per-user cap. Lesson: Device limit restrictions

Device licensing

Synced apps then assign with device licensing (no Apple Account needed) or user licensing. Lesson: Store apps for Apple and Android

Device limit restriction

A device limit restriction caps how many devices one user can enroll, from 1 to 15. Lesson: Device limit restrictions

Device name template

In an Autopilot profile, Apply device name template renames Entra joined devices during setup. Lesson: Device name templates

Device platform restriction

A device platform restriction decides what may enroll: which platforms, minimum and maximum OS versions, Android manufacturers, and whether personally owned devices are allowed. Lesson: Device platform restrictions

Device preparation

Device preparation needs no hardware hash upload. Lesson: Autopilot device preparation

Device query

Advanced Analytics builds on Endpoint analytics: anomaly detection after updates or changes, the device timeline, battery health, resource performance, custom device scopes, and device query with KQL. Lesson: Advanced Analytics

Device restrictions

For corporate Android Enterprise devices, a device restrictions profile sets system update behavior: automatic, postponed, or a maintenance window, plus freeze periods during busy seasons. Lesson: Android updates and FOTA

Device security group

When a user signs in at OOBE, the device lands in a chosen device security group at enrollment time (enrollment time grouping; the group's owner must be the Intune Provisioning Client). Lesson: Autopilot device preparation

Device timeline

Advanced Analytics builds on Endpoint analytics: anomaly detection after updates or changes, the device timeline, battery health, resource performance, custom device scopes, and device query with KQL. Lesson: Advanced Analytics

DeviceComplianceOrg

In Reports > Diagnostic settings, send AuditLogs, OperationalLogs, DeviceComplianceOrg and IntuneDevices to a Log Analytics workspace (needs an Azure subscription). Lesson: Log Analytics, workbooks and alerts

DeviceOwnership

Useful ones: deviceOSType, deviceOwnership (Company or Personal), deviceTrustType, enrollmentProfileName (Autopilot, Apple ADE or Android profile name) and devicePhysicalIds for Autopilot tags. Lesson: Writing device rules

DevicePhysicalIds

Useful ones: deviceOSType, deviceOwnership (Company or Personal), deviceTrustType, enrollmentProfileName (Autopilot, Apple ADE or Android profile name) and devicePhysicalIds for Autopilot tags. Lesson: Writing device rules

Discovery script

Upload a discovery script (PowerShell for Windows) under Endpoint security > Device compliance > Scripts. Lesson: Extending compliance with PowerShell

Disk encryption

Disk encryption profiles: BitLocker for Windows (require encryption, silent encryption for standard users, encryption methods, escrow the recovery key to Entra ID before encrypting, recovery password rotation) and… Lesson: BitLocker and FileVault policies

Download mode

Download mode: HTTP only, no peering (0); HTTP blended with peering behind the same NAT (1), devices behind the same public IP share; across a private group (2), devices with the same group ID share across NATs;… Lesson: Delivery Optimization

dsregcmd /status

On Windows, dsregcmd /status shows the device's join state. Lesson: Proof on the device: dsregcmd /status

Dynamic group

A dynamic group holds either users or devices, never both. Lesson: Assigned vs dynamic groups

E

EDR onboarding status

Assign it to all Windows devices, and check the EDR onboarding status report until every device shows onboarded. Lesson: Onboarding devices with an EDR policy

Elevation report

Monitor in the Elevation report and approve requests under Support approvals. Lesson: Elevation rules policy

Elevation rules policy

A Windows elevation rules policy names a file by file name, path, hash or publisher certificate, then sets an elevation type: Automatic (silent), User confirmed, Support approved (an admin approves each request),… Lesson: Elevation rules policy

Elevation type

A Windows elevation rules policy names a file by file name, path, hash or publisher certificate, then sets an elevation type: Automatic (silent), User confirmed, Support approved (an admin approves each request),… Lesson: Elevation rules policy

Enable Windows Backup

Two parts: a settings catalog policy with Enable Windows Backup (Sync your settings), and the tenant-wide Windows Backup and Restore option under Devices > Enrollment > Windows, with Show restore page set to On. Lesson: Windows Backup for Organizations

Encryption report

The Encryption report under Devices > Monitor shows encryption state and TPM readiness per device. Lesson: BitLocker and FileVault policies

Endpoint analytics

Endpoint analytics scores the user experience from 0 to 100. Lesson: Endpoint analytics scores

Endpoint Privilege Management

Endpoint Privilege Management lets everyone run as a standard user and elevates only approved files when needed. Lesson: Why EPM exists

Endpoint security

Endpoint security in the Intune admin center groups focused security policies: Antivirus, Disk encryption, Firewall, Endpoint detection and response, Attack surface reduction, Account protection, App Control for… Lesson: The Endpoint security node

Enrollment

In the Microsoft Intune admin center, enrollment sits under Devices > Enrollment (Device onboarding), with a tab per platform: Windows, Apple, Android. Lesson: Where enrollment lives

Enrollment failures

Start with Devices > Monitor > Enrollment failures (or the user in Troubleshooting + support), then match the reason to the fix. Lesson: Troubleshooting enrollment failures

Enrollment Status Page

The Enrollment Status Page shows setup progress during OOBE in two phases: device setup (device policies, certificates, device apps) and account setup (user policies and apps after first sign-in). Lesson: What the ESP shows and blocks

Enrollment Status Page (ESP)

Progress shows on the Enrollment Status Page (ESP). Lesson: Classic Autopilot: deployment profiles

Enrollment time grouping

With enrollment time grouping, the device is added to a chosen static device group during enrollment, so the policies and apps assigned to that group arrive while the device is still setting up. Lesson: Enrollment time grouping

EnrollmentProfileName

Useful ones: deviceOSType, deviceOwnership (Company or Personal), deviceTrustType, enrollmentProfileName (Autopilot, Apple ADE or Android profile name) and devicePhysicalIds for Autopilot tags. Lesson: Writing device rules

Enterprise App Catalog

Enterprise App Management gives you the Enterprise App Catalog: common Win32 apps that Microsoft has prepackaged and hosts. Lesson: Enterprise App Catalog

Enterprise App Management

Enterprise App Management gives you the Enterprise App Catalog: common Win32 apps that Microsoft has prepackaged and hosts. Lesson: Enterprise App Catalog

Escrow the recovery key to Entra ID

Disk encryption profiles: BitLocker for Windows (require encryption, silent encryption for standard users, encryption methods, escrow the recovery key to Entra ID before encrypting, recovery password rotation) and… Lesson: BitLocker and FileVault policies

Essential

Block only on essential apps (security agent, VPN, line-of-business core) and let the rest install afterward. Lesson: Keeping the ESP fast and reliable

Export token

Use Intune's Export token to get the JSON. Lesson: Zero-touch and Knox Mobile Enrollment

F

Feature update

Windows gets quality updates (monthly security and fixes, cumulative) and feature updates (a new Windows version once a year, like 26H2), plus drivers. Lesson: Plan in rings

Feature update deferral

An update ring policy (Devices > Windows updates) controls the Windows Update client: quality update deferral (0-30 days), feature update deferral (0-365 days; use 0 when a feature update policy picks the version),… Lesson: Update ring settings

Feature update policy

Then create a feature update policy under Devices > Windows updates and pick the target version, for example Windows 11, version 26H2. Lesson: Upgrading to Windows 11 with Intune

Feature update uninstall period

An update ring policy (Devices > Windows updates) controls the Windows Update client: quality update deferral (0-30 days), feature update deferral (0-365 days; use 0 when a feature update policy picks the version),… Lesson: Update ring settings

FileVault

Disk encryption profiles: BitLocker for Windows (require encryption, silent encryption for standard users, encryption methods, escrow the recovery key to Entra ID before encrypting, recovery password rotation) and… Lesson: BitLocker and FileVault policies

Firmware over-the-air (FOTA)

For supported brands, firmware over-the-air (FOTA) deployments go further: Samsung Knox E-FOTA and Zebra LifeGuard Over-the-Air let you pick the exact firmware and schedule it (Intune Plan 2). Lesson: Android updates and FOTA

Freeze periods

For corporate Android Enterprise devices, a device restrictions profile sets system update behavior: automatic, postponed, or a maintenance window, plus freeze periods during busy seasons. Lesson: Android updates and FOTA

Fresh Start

Fresh Start reinstalls Windows and removes OEM apps (it can keep user data). Lesson: Windows reset options

Fully managed

Fully managed (COBO): company phone for work only. Lesson: Four Android Enterprise profiles

G

Get-MgDeviceManagementManagedDevice

Install the Microsoft Graph PowerShell SDK (Install-Module Microsoft.Graph), sign in with Connect-MgGraph and only the scopes (permissions) you need, then use cmdlets like Get-MgDeviceManagementManagedDevice to read… Lesson: Microsoft Graph PowerShell

Google zero-touch enrollment

Bulk enrollment straight out of the box: with Google zero-touch enrollment, devices bought from an authorized reseller show up in the zero-touch portal. Lesson: Zero-touch and Knox Mobile Enrollment

Grace period

Add a schedule to create a grace period. Lesson: Actions for noncompliance

Group Policy analytics

Group Policy analytics shows how your GPOs translate. Lesson: Group Policy analytics

H

Help Desk Operator

The built-in Help Desk Operator role includes the main ones. Lesson: Who can do what in Remote Help

HoloLens 2

HoloLens 2 runs Windows Holographic for Business: enroll through Autopilot for HoloLens and use Windows profiles that support Holographic. Lesson: Specialty devices

Hotpatch

A quality update policy can expedite a specific security update faster than the ring's deferral, and controls hotpatch. Lesson: Feature and quality update policies

HTTP blended with peering behind the same NAT (1)

Download mode: HTTP only, no peering (0); HTTP blended with peering behind the same NAT (1), devices behind the same public IP share; across a private group (2), devices with the same group ID share across NATs;… Lesson: Delivery Optimization

HTTP only, no peering (0)

Download mode: HTTP only, no peering (0); HTTP blended with peering behind the same NAT (1), devices behind the same public IP share; across a private group (2), devices with the same group ID share across NATs;… Lesson: Delivery Optimization

I

Imported Administrative templates

Then create a profile with the Imported Administrative templates type and configure the app's settings like any other policy. Lesson: Importing custom ADMX files

Internet peering (3)

Download mode: HTTP only, no peering (0); HTTP blended with peering behind the same NAT (1), devices behind the same public IP share; across a private group (2), devices with the same group ID share across NATs;… Lesson: Delivery Optimization

Intune Administrator

Microsoft Entra roles work tenant-wide: Global Administrator, Intune Administrator (full control of Intune), Cloud Device Administrator (devices in Entra) and Windows 365 Administrator. Lesson: Two layers of roles

Intune Data Warehouse

The Intune Data Warehouse offers an OData feed for Power BI dashboards. Lesson: Intune reports

Intune RBAC roles

Intune RBAC roles live inside Intune and can be scoped: Policy and Profile Manager, Help Desk Operator, Read Only Operator, Application Manager, Endpoint Security Manager and Intune Role Administrator. Lesson: Two layers of roles

Intune Suite

Other plans buy the Intune Suite or single add-ons. Lesson: Where the Suite features come from

IntuneDevices

In Reports > Diagnostic settings, send AuditLogs, OperationalLogs, DeviceComplianceOrg and IntuneDevices to a Log Analytics workspace (needs an Azure subscription). Lesson: Log Analytics, workbooks and alerts

iOS store

iOS store and Managed Google Play apps come from the stores. Lesson: App types

Isolate device

Triage: check severity, assign the incident, look at the device timeline and alert story, then respond: isolate device, run an antivirus scan, collect an investigation package, or restrict app execution. Lesson: Investigating and triaging

J

Join type

A provisioning policy decides how Cloud PCs are created: join type and network (Entra join with the Microsoft-hosted network is recommended; hybrid join needs an Azure network connection, ANC), image (a gallery… Lesson: Windows 365 Cloud PCs

JSON rules file

Add a JSON rules file to a compliance policy: SettingName, Operator (IsEquals, GreaterEquals...), DataType, Operand, and remediation strings users see. Lesson: Extending compliance with PowerShell

K

KQL

With Advanced Analytics, device query asks a device live questions in KQL (Kusto Query Language). Lesson: Device query with KQL

L

Line-of-business (LOB)

Line-of-business (LOB): a single MSI, MSIX/APPX, iOS .ipa or Android .apk. Lesson: App types

LOB (MSI) apps and Win32 apps

During classic Autopilot, don't mix LOB (MSI) apps and Win32 apps: both need the Trusted Installer service and can collide. Lesson: Keeping the ESP fast and reliable

M

Managed apps

Managed apps: delivered through the app protection channel to apps with the Intune SDK, enrolled or not, for example Edge's home page or the Tunnel for MAM keys. Lesson: App configuration policies

Managed devices

Managed devices: delivered through the MDM channel to enrolled iOS or Android Enterprise devices, for example Outlook account setup or allowed accounts. Lesson: App configuration policies

Managed Google Play

iOS store and Managed Google Play apps come from the stores. Lesson: App types

Managed installer

In Endpoint security > App Control for Business, use built-in controls: trust Windows components and Store apps, optionally apps with good reputation, and apps from a managed installer (the Intune Management… Lesson: App Control for Business

Mark device noncompliant

Every policy includes Mark device noncompliant, by default immediately (0 days). Lesson: Actions for noncompliance

Mark devices with no compliance policy assigned as

Under Endpoint security > Device compliance > Compliance policy settings: Mark devices with no compliance policy assigned as Compliant or Not compliant. Lesson: Tenant-wide compliance settings

Mark it applied

Verify in the Defender portal, fix through Intune (an update ring, app update or setting), then mark it applied so the next run tracks progress. Lesson: Investigating what an agent finds

MDM support

The report shows the MDM support percentage and which settings have a matching CSP, which are deprecated and which have no MDM equivalent. Lesson: Group Policy analytics

MDM user scope

MDM user scope decides whose Windows devices enroll automatically when they join or register: None, Some (pick groups) or All. Lesson: MDM user scope

Microsoft 365 Apps

Microsoft 365 Apps and Microsoft Edge have their own app types. Lesson: App types

Microsoft 365 Apps admin center

The Microsoft 365 Apps admin center (config.office.com) adds cloud policy configurations, servicing profiles that manage update rollout, and inventory and security update status. Lesson: Policies for Microsoft 365 Apps

Microsoft 365 E3

Since July 2026, Microsoft 365 E3 includes Intune Plan 2, Remote Help and Advanced Analytics. Lesson: Where the Suite features come from

Microsoft Cloud PKI

Microsoft Cloud PKI runs your certificate authority in Intune. Lesson: Microsoft Cloud PKI

Microsoft Defender Antivirus

Endpoint security > Antivirus for Windows has the Microsoft Defender Antivirus profile (real-time protection, cloud-delivered protection, sample submission, potentially unwanted apps, scan schedules, exclusions),… Lesson: Antivirus policies

Microsoft Defender portal

Connect the services both ways: in the Microsoft Defender portal (Settings > Endpoints > Advanced features), turn on the Microsoft Intune connection. Lesson: Connecting Intune and Defender

Microsoft Edge

Microsoft 365 Apps and Microsoft Edge have their own app types. Lesson: App types

Microsoft Entra hybrid joined

Microsoft Entra hybrid joined: a PC joined to on-premises Active Directory that is also synced into Entra ID, for companies that still rely on the domain. Lesson: Registered, joined, hybrid joined

Microsoft Entra ID

Microsoft Entra ID (the cloud directory behind Microsoft 365) already knows your users. Lesson: Why a device needs an identity

Microsoft Entra ID P1

Compliance plus Conditional Access needs Intune and Microsoft Entra ID P1. Lesson: How the pieces connect

Microsoft Entra joined

Microsoft Entra joined: a company Windows device. Lesson: Registered, joined, hybrid joined

Microsoft Entra Joined Device Local Administrator

When a device is Entra joined, Windows adds the Global Administrator role and the Microsoft Entra Joined Device Local Administrator role to the local Administrators group. Lesson: Who becomes local admin on a joined PC

Microsoft Entra registered

Microsoft Entra registered: a personal device (BYOD). Lesson: Registered, joined, hybrid joined

Microsoft Entra roles

Microsoft Entra roles work tenant-wide: Global Administrator, Intune Administrator (full control of Intune), Cloud Device Administrator (devices in Entra) and Windows 365 Administrator. Lesson: Two layers of roles

Microsoft Graph

The Intune admin center talks to Microsoft Graph, and so can you. Lesson: Microsoft Graph PowerShell

Microsoft Graph PowerShell SDK

Install the Microsoft Graph PowerShell SDK (Install-Module Microsoft.Graph), sign in with Connect-MgGraph and only the scopes (permissions) you need, then use cmdlets like Get-MgDeviceManagementManagedDevice to read… Lesson: Microsoft Graph PowerShell

Microsoft Intune connection

Connect the services both ways: in the Microsoft Defender portal (Settings > Endpoints > Advanced features), turn on the Microsoft Intune connection. Lesson: Connecting Intune and Defender

Microsoft Store app (new)

Microsoft Store app (new): Store apps installed through WinGet. Lesson: App types

Microsoft Teams Rooms on Windows

Microsoft Teams Rooms on Windows are Windows devices: enroll them (often with Autopilot self-deploying) and target device-based profiles. Lesson: Specialty devices

Microsoft Tunnel

Microsoft Tunnel is a VPN gateway that runs in a container on a Linux server. Lesson: Microsoft Tunnel for MAM

Microsoft Win32 Content Prep Tool

Run the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) against the setup folder to produce a .intunewin file. Lesson: Packaging a Win32 app

Microsoft-hosted network

A provisioning policy decides how Cloud PCs are created: join type and network (Entra join with the Microsoft-hosted network is recommended; hybrid join needs an Azure network connection, ANC), image (a gallery… Lesson: Windows 365 Cloud PCs

Mobility (MDM and MAM)

In the Microsoft Entra admin center, open Mobility (MDM and MAM) and select Microsoft Intune. Lesson: MDM user scope

Multi admin approval

Multi admin approval uses access policies so a second admin must approve sensitive changes. Lesson: Multi admin approval

My Account

Users can recover their own keys on another device through the Company Portal website or My Account (Devices > View BitLocker keys), unless the Entra setting restricting non-admin key recovery is turned on. Lesson: Recovery keys and self-service

N

Non-working time

Apps > Quiet Time > Policies mutes Outlook mail and Teams notifications on iOS/iPadOS and Android after work: a Date range (holidays), Days of the week (all day or certain hours), or Non-working time (Teams, using… Lesson: Quiet Time policies

O

OEMConfig

OEMConfig profiles carry vendor settings, such as Zebra's or Samsung's. Lesson: Android Enterprise profiles

Offer remote assistance

Permissions come from Intune roles: View screen, Take full control, Elevation and unattended control, plus Remote tasks Offer remote assistance. Lesson: Who can do what in Remote Help

Office Deployment Tool (ODT)

The other route is the Office Deployment Tool (ODT): setup.exe plus your XML, wrapped as a Win32 app, which gives you detection rules and return codes. Lesson: Deploying Microsoft 365 Apps

OperationalLogs

In Reports > Diagnostic settings, send AuditLogs, OperationalLogs, DeviceComplianceOrg and IntuneDevices to a Log Analytics workspace (needs an Azure subscription). Lesson: Log Analytics, workbooks and alerts

P

Pause

From an update ring, Pause stops quality or feature updates for up to 35 days, Resume restarts them, Extend adds another 35 days, and Uninstall removes the latest update of that type from devices in the ring. Lesson: Ring actions: pause, resume, uninstall

Personally owned work profile

Personally owned work profile (BYOD): a separate work profile on the user's phone, enrolled through Company Portal. Lesson: Four Android Enterprise profiles

Policy managed apps

Data protection: block backup of org data, limit transfer to policy managed apps, restrict cut/copy/paste, encrypt org data, control saving and printing. Lesson: App protection policies

Pre-provisioning

Pre-provisioning: a technician or partner presses the Windows key five times at the first OOBE screen and runs the device phase ahead of time; the user later finishes only the user part. Lesson: Three deployment modes

Provisioning policy

A provisioning policy decides how Cloud PCs are created: join type and network (Entra join with the Microsoft-hosted network is recommended; hybrid join needs an Azure network connection, ANC), image (a gallery… Lesson: Windows 365 Cloud PCs

Q

Quality update

Windows gets quality updates (monthly security and fixes, cumulative) and feature updates (a new Windows version once a year, like 26H2), plus drivers. Lesson: Plan in rings

Quality update deferral

An update ring policy (Devices > Windows updates) controls the Windows Update client: quality update deferral (0-30 days), feature update deferral (0-365 days; use 0 when a feature update policy picks the version),… Lesson: Update ring settings

Quality update policy

A quality update policy can expedite a specific security update faster than the ring's deferral, and controls hotpatch. Lesson: Feature and quality update policies

R

Recovery keys

Recovery keys escrowed to Entra ID appear on the device page (Recovery keys) in Intune and in Entra. Lesson: Recovery keys and self-service

Recovery password rotation

Disk encryption profiles: BitLocker for Windows (require encryption, silent encryption for standard users, encryption methods, escrow the recovery key to Entra ID before encrypting, recovery password rotation) and… Lesson: BitLocker and FileVault policies

Remediations

Devices > Scripts and remediations > Remediations: a script package holds a detection script and a remediation script. Lesson: Remediations

Remote Help

Remote Help is cloud-based screen sharing for the help desk. Lesson: Remote Help basics

Remove (Update)

Remove (Update) removes the listed members. Lesson: Managing local group membership

Require all the selected controls

With several grant controls, choose Require all the selected controls or Require one of the selected controls. Lesson: Building the policy

Require app protection policy

To make sure only protected apps reach company data, create a Conditional Access policy for iOS and Android with the grant Require app protection policy. Lesson: Conditional Access for app protection

Require approved client app

The older Require approved client app grant was retired on June 30, 2026: existing policies using it are read-only, and new policies should use only Require app protection policy. Lesson: Conditional Access for app protection

Require device to be marked as compliant

Grant: Require device to be marked as compliant. Lesson: Building the policy

Require one of the selected controls

With several grant controls, choose Require all the selected controls or Require one of the selected controls. Lesson: Building the policy

Require the device to be at or under the machine risk score

Then compliance policies can use Require the device to be at or under the machine risk score (Clear, Low, Medium, High). Lesson: Connecting Intune and Defender

Resource performance

Advanced Analytics builds on Endpoint analytics: anomaly detection after updates or changes, the device timeline, battery health, resource performance, custom device scopes, and device query with KQL. Lesson: Advanced Analytics

Resume

From an update ring, Pause stops quality or feature updates for up to 35 days, Resume restarts them, Extend adds another 35 days, and Uninstall removes the latest update of that type from devices in the ring. Lesson: Ring actions: pause, resume, uninstall

Retire

Retire removes company data, managed apps, profiles and management, but leaves personal data. Lesson: Retire vs wipe

Return codes

In Intune, set the install and uninstall commands, install behavior (System or User), return codes, requirements (OS, architecture, disk space), and a detection rule that proves the app is installed (MSI product… Lesson: Packaging a Win32 app

Role assignment

A built-in or custom Intune role does nothing until you assign it. Lesson: What a role assignment contains

Root CA and issuing CA

Option 1: a root CA and issuing CA both in the cloud (a two-tier hierarchy). Lesson: Microsoft Cloud PKI

Rotate local admin password

To rotate it on demand, use the Rotate local admin password device action. Lesson: Reading and rotating the password

Run remediation

Run remediation runs a package on one device on demand. Lesson: Remediations

S

Samsung Knox E-FOTA

For supported brands, firmware over-the-air (FOTA) deployments go further: Samsung Knox E-FOTA and Zebra LifeGuard Over-the-Air let you pick the exact firmware and schedule it (Intune Plan 2). Lesson: Android updates and FOTA

Samsung Knox Mobile Enrollment (KME)

With Samsung Knox Mobile Enrollment (KME), you build a profile in the Knox Admin Portal, choose Intune as the EMM, and paste the token into the custom JSON. Lesson: Zero-touch and Knox Mobile Enrollment

SCEP

Devices get certificates through a SCEP profile pointing at the issuing CA's SCEP URI. Lesson: Microsoft Cloud PKI

Scope groups

The assignment says who (an admin group), what (the role's permissions), which users and devices they may act on (scope groups) and which objects they may see (scope tags). Lesson: What a role assignment contains

Scope tag

A scope tag is a label on Intune objects: policies, apps, profiles, devices. Lesson: Scope tags

Security baselines

Security baselines are Microsoft's preconfigured groups of recommended settings: Windows security baseline, Microsoft Defender for Endpoint baseline, Microsoft Edge, Microsoft 365 Apps and Windows 365. Lesson: Security baselines

Security Copilot

Security Copilot agents run in the Intune admin center under Agents. Lesson: The Intune agents

Self-deploying mode

User-driven: the user signs in at OOBE; the device joins Entra (or hybrid joins) and installs everything for them. Lesson: Three deployment modes

Service health and message center

Service health and message center: active incidents, issues that need action, and planned changes. Lesson: Tenant health and service communications

Servicing profiles

The Microsoft 365 Apps admin center (config.office.com) adds cloud policy configurations, servicing profiles that manage update rollout, and inventory and security update status. Lesson: Policies for Microsoft 365 Apps

Settings catalog

Two parts: a settings catalog policy with Enable Windows Backup (Sync your settings), and the tenant-wide Windows Backup and Restore option under Devices > Enrollment > Windows, with Show restore page set to On. Lesson: Windows Backup for Organizations

Show app and profile configuration progress

Under Devices > Enrollment > Windows > Enrollment Status Page: Show app and profile configuration progress (Yes turns it on); Show an error when installation takes longer than (default 60 minutes); custom error… Lesson: Key ESP settings

Show restore page

Two parts: a settings catalog policy with Enable Windows Backup (Sync your settings), and the tenant-wide Windows Backup and Restore option under Devices > Enrollment > Windows, with Show restore page set to On. Lesson: Windows Backup for Organizations

Sign-in logs

When access is blocked, open Entra ID > Monitoring & health > Sign-in logs and select the sign-in. Lesson: Reading the sign-in log

Simple download (99)

Download mode: HTTP only, no peering (0); HTTP blended with peering behind the same NAT (1), devices behind the same public IP share; across a private group (2), devices with the same group ID share across NATs;… Lesson: Delivery Optimization

Software Update Enforce Latest

Or Software Update Enforce Latest with Delay in Days and an Install Time. Lesson: Apple updates with the settings catalog

Standard user

Endpoint Privilege Management lets everyone run as a standard user and elevates only approved files when needed. Lesson: Why EPM exists

Startup performance

Startup performance: boot and sign-in times, startup apps that slow sign-in, restart frequency and blue screens. Lesson: Endpoint analytics scores

Supersedence

A Win32 app can have dependencies (install the runtime first) and supersedence (replace or update an older version). Lesson: Dependencies, supersedence and assignments

Supervised

iOS/iPadOS: device restrictions (many need a supervised device from ADE), device features (home screen layout, wallpaper, AirPrint), Wi-Fi, VPN, email, and the settings catalog, including Apple's declarative device… Lesson: iOS/iPadOS and macOS profiles

Support approvals

Monitor in the Elevation report and approve requests under Support approvals. Lesson: Elevation rules policy

Sync

Sync makes the device check in now instead of at its next scheduled check-in, so new policies and apps arrive sooner. Lesson: Everyday actions

Sync-MgDeviceManagementManagedDevice

Device actions work too, such as Sync-MgDeviceManagementManagedDevice. Lesson: Unattended automation

System update

For corporate Android Enterprise devices, a device restrictions profile sets system update behavior: automatic, postponed, or a maintenance window, plus freeze periods during busy seasons. Lesson: Android updates and FOTA

T

Take full control

Permissions come from Intune roles: View screen, Take full control, Elevation and unattended control, plus Remote tasks Offer remote assistance. Lesson: Who can do what in Remote Help

Target OS Version

For iOS/iPadOS 17+ and macOS 14+, use the settings catalog's Declarative Device Management > Software Update: set a Target OS Version and a Target Date Time by which it installs (plus a details URL). Lesson: Apple updates with the settings catalog

Tenant details

Tenant details: name, location, MDM authority, service release. Lesson: Tenant health and service communications

Tunnel for MAM

Tunnel for MAM extends it to Android and iOS devices that aren't enrolled. Lesson: Microsoft Tunnel for MAM

U

Unenrolled (BYOD)

An app protection policy (APP) protects company data inside apps like Outlook, Teams, Edge and OneDrive, on enrolled or unenrolled (BYOD) devices. Lesson: App protection policies

Update channel

Intune's Microsoft 365 Apps (Windows 10 and later) app type lets you pick apps, 64-bit, update channel (Current, Monthly Enterprise, Semi-Annual Enterprise) and languages with the configuration designer, or paste a… Lesson: Deploying Microsoft 365 Apps

Update ring

An update ring policy (Devices > Windows updates) controls the Windows Update client: quality update deferral (0-30 days), feature update deferral (0-365 days; use 0 when a feature update policy picks the version),… Lesson: Update ring settings

Update Windows Defender security intelligence

Update Windows Defender security intelligence tells Microsoft Defender Antivirus to fetch the newest definitions now. Lesson: Defender and key rotation actions

Use least privilege

Zero Trust means verify explicitly, use least privilege, and assume breach. Lesson: Zero Trust thinking for endpoints

User-driven mode

User-driven: the user signs in at OOBE; the device joins Entra (or hybrid joins) and installs everything for them. Lesson: Three deployment modes

Users may join devices to Microsoft Entra ID

Whoever is allowed is set in the Microsoft Entra admin center under Devices > Device settings: Users may join devices to Microsoft Entra ID can be All, Selected or None. Lesson: Joining a Windows device

V

Verify explicitly

Zero Trust means verify explicitly, use least privilege, and assume breach. Lesson: Zero Trust thinking for endpoints

View screen

Permissions come from Intune roles: View screen, Take full control, Elevation and unattended control, plus Remote tasks Offer remote assistance. Lesson: Who can do what in Remote Help

Virtualization-based security (VBS)

Requirements: Windows 11 Enterprise 24H2 or later, an eligible license, virtualization-based security (VBS) running, the latest baseline installed, and management through Intune. Lesson: Hotpatch

Vulnerability Remediation Agent

The one still offered is the Vulnerability Remediation Agent (preview): it uses Microsoft Defender Vulnerability Management data to list CVEs on your devices, ranked by risk, with step-by-step Intune fixes. Lesson: The Intune agents

W

Windows 365 Administrator

Microsoft Entra roles work tenant-wide: Global Administrator, Intune Administrator (full control of Intune), Cloud Device Administrator (devices in Entra) and Windows 365 Administrator. Lesson: Two layers of roles

Windows Autopatch

Windows Autopatch automates update management from Intune for Windows, Microsoft 365 Apps, Microsoft Edge and Teams. Lesson: Windows Autopatch

Windows Autopilot

Besides join-time enrollment: Windows Autopilot (month two), Group Policy auto-enrollment for hybrid joined PCs, Configuration Manager co-management, provisioning packages for bulk setup, and users adding a work… Lesson: Other Windows enrollment paths

Windows Backup and Restore

Two parts: a settings catalog policy with Enable Windows Backup (Sync your settings), and the tenant-wide Windows Backup and Restore option under Devices > Enrollment > Windows, with Show restore page set to On. Lesson: Windows Backup for Organizations

Windows diagnostic data

Many need the Windows diagnostic data tenant connector turned on. Lesson: Monitoring updates

Windows Firewall

Endpoint security > Firewall: the Windows Firewall profile turns the firewall on per network profile (domain, private, public) and sets default inbound and outbound behavior. Lesson: Firewall policies

Windows Firewall rules

Windows Firewall rules profiles add allow or block rules by app, port, protocol and remote address. Lesson: Firewall policies

Windows Hello for Business

Windows Hello for Business replaces passwords with a PIN or biometric unlocking a key stored in the device's TPM. Lesson: Windows Hello for Business

Windows LAPS

Windows LAPS gives each device its own local admin password, rotates it on a schedule, and backs it up to Microsoft Entra ID (or on-premises AD). Lesson: Windows LAPS with Intune and Entra

Windows Security experience

Endpoint security > Antivirus for Windows has the Microsoft Defender Antivirus profile (real-time protection, cloud-delivered protection, sample submission, potentially unwanted apps, scan schedules, exclusions),… Lesson: Antivirus policies

Wipe

Wipe factory-resets the device and erases everything: for lost or stolen corporate devices, or before reuse. Lesson: Retire vs wipe

Work from anywhere

Work from anywhere: readiness for cloud management. Lesson: Endpoint analytics scores

Workbooks

Then build workbooks and dashboards, and create Azure Monitor alert rules with action groups: email when compliance drops (drift), when enrollment failures spike, or when audit logs show policy changes. Lesson: Log Analytics, workbooks and alerts

Z

Zebra LifeGuard Over-the-Air

For supported brands, firmware over-the-air (FOTA) deployments go further: Samsung Knox E-FOTA and Zebra LifeGuard Over-the-Air let you pick the exact firmware and schedule it (Intune Plan 2). Lesson: Android updates and FOTA

Acronyms

Microsoft, Azure, Intune and Windows are trademarks of the Microsoft group of companies. Ranger Gamez is not affiliated with or endorsed by Microsoft. The practice questions are written to the published exam objectives; they are not real exam questions.