Before you read a single question: most Intune interview lists online were written in 2021 and never updated. If you walk into a 2026 interview and describe Autopilot as "hardware hash upload," or call the old Endpoint Protection templates the current way to configure policy, the interviewer will place you three years behind.
The four things that changed and are being asked about right now: Autopilot device preparation (often called Autopilot v2), the Intune Suite add-ons, Settings Catalog replacing legacy templates, and the March 2026 scope tag behaviour change. All covered below.
We built this from placement feedback across Cloud Soft Solutions' NEXUS batches — questions candidates actually faced at service companies, product companies and MSPs in Hyderabad, Bengaluru, Pune and Chennai, plus what our own trainers ask when screening. Answers are written the way you should say them out loud: direct first, detail second.
Part 1 — What changed in 2026 (read this first)
These are the items separating candidates who are current from candidates repeating 2022 material.
1. Autopilot device preparation is a separate product, not an upgrade
Windows Autopilot device preparation — informally "Autopilot v2" — is not a successor to classic Autopilot and does not replace it. They are two distinct solutions for the same goal. The headline difference: device preparation does not require hardware hash registration. Saying "v2 replaced v1" is a common and costly mistake.
2. Autopilot device preparation now supports 25 apps (January 2026)
The app limit in a device preparation policy was raised to 25, and this now includes Windows 365 provisioning. It also supports Enterprise App Catalog apps.
3. Managed installer applies during device preparation (March 2026)
The managed installer policy is now applied during OOBE, before Win32, Microsoft Store and Enterprise App Catalog apps install. Previously these types were skipped to avoid conflicts. This makes app delivery during provisioning far more reliable — a strong point to raise unprompted.
4. Scope tags no longer merge across role assignments (March 2026)
Admins can now keep scope tags from different role assignments separate rather than merged, preventing accidental over-permissioning. A new Permissions Assessment Report lets you model the impact before enabling it. This is a favourite question for senior RBAC-focused roles.
5. OOBE installs monthly security updates by default (January 2026)
Windows OOBE now installs the latest monthly security update by default. A new ESP setting, "Install Windows quality updates (might restart the device)", lets you allow or block this. Interviewers use it to test whether you keep up with release notes.
6. Windows 10 end of support drove 2025–26 migration work
Windows 10 reached end of support on 14 October 2025. Almost every enterprise ran a Windows 11 migration through 2025–26, so expect at least one question on how you drove it — feature update policies, readiness reporting, hardware compliance for TPM 2.0, and handling non-upgradeable estate.
Part 2 — Fundamentals (0–2 years)
1. What is Microsoft Intune?
Intune is Microsoft's cloud-based endpoint management service — the MDM and MAM component of Microsoft Intune Suite, formerly branded Endpoint Manager. It manages Windows, iOS/iPadOS, macOS, Android and Linux (Ubuntu) devices, and manages applications and their data even on devices it does not own.
2. Difference between MDM and MAM?
MDM manages the device — enrollment, configuration, compliance, wipe. MAM manages the application and its corporate data, and works without enrolling the device at all. MAM is what you use for BYOD where users refuse enrollment: you protect the Outlook and Teams data without touching their personal phone.
What's really being tested: whether you know MAM-WE (MAM without enrollment) exists. Say the phrase.3. What licences include Intune?
Microsoft 365 E3 and E5, Microsoft 365 Business Premium, EMS E3/E5, and standalone Intune Plan 1. Intune Plan 2 and the Intune Suite are paid add-ons layered on Plan 1. F1/F3 have restricted device management. Every device you manage needs a licensed user.
4. What is the difference between Intune Plan 1, Plan 2 and Intune Suite?
Plan 1 is core MDM/MAM. Plan 2 adds Microsoft Tunnel for mobile, advanced endpoint analytics and specialised device management. The Intune Suite bundles all add-ons — Endpoint Privilege Management, Remote Help, Enterprise App Management, Advanced Analytics, Microsoft Cloud PKI and Microsoft Tunnel for MAM.
5. What is a device object versus a user object in Entra ID?
A device object represents the machine's identity in Entra ID; a user object represents the person. Compliance and Conditional Access evaluate both. Understanding this matters because device-targeted policy applies in system context and user-targeted policy in user context — mixing them up is the root cause of many "policy not applying" tickets.
6. Entra registered vs Entra joined vs Hybrid Entra joined?
| Type | Identity | Typical use |
|---|---|---|
| Entra registered | Personal device, work account added | BYOD |
| Entra joined | Cloud-only, org-owned | Modern corporate devices |
| Hybrid Entra joined | Joined to on-prem AD and synced to Entra | Estates with on-prem dependencies |
7. What is the Company Portal?
The client application users use to enroll, view compliance status, install available apps and take self-service actions like remote lock or reset. On Windows it is also the app catalog surface. Available in the Microsoft Store and each platform's app store.
8. What is the default Intune device sync interval?
Roughly every 8 hours for Windows, 6 hours for iOS/macOS and 8 hours for Android — with a faster cadence immediately after enrollment (3, 15 and 60 minutes, then the standard cycle). Users can force a sync from Company Portal; admins can push one from the console.
2026 addition worth mentioning: the admin centre now shows per-device sync progress in real time, so you can watch each stage from notification to compliance calculation.9. What is a configuration profile?
A policy object that pushes settings to enrolled devices — Wi-Fi, VPN, certificates, restrictions, endpoint protection, custom OMA-URI. In 2026 the great majority should be built in the Settings Catalog rather than legacy templates.
10. What is the Settings Catalog and why does it matter?
A single searchable surface exposing thousands of settings sourced directly from the CSPs, with no template categorisation. It is the strategic direction — Microsoft is not adding new settings to legacy templates. Say you build new policy in Settings Catalog and migrate legacy templates as you touch them.
11. What is a compliance policy?
A set of rules a device must satisfy — BitLocker on, minimum OS build, Defender running, not jailbroken. It does not enforce anything by itself. It marks the device compliant or non-compliant, and Conditional Access consumes that signal to allow or block resource access.
The trap: candidates say compliance policy "blocks access." It does not. CA does. State the separation clearly.12. What are actions for non-compliance?
Mark non-compliant (immediately or after a grace period), send email to the user, send a push notification, remotely lock, or retire the device. Grace periods are the difference between a controlled rollout and a helpdesk flood.
13. Difference between Retire and Wipe?
Retire removes company data, apps and policy and leaves personal data intact — the BYOD offboarding action. Wipe is a full factory reset — for corporate devices, lost devices, or hardware being reissued. Delete only removes the record from the console and does nothing on the device.
14. What is a scope tag?
An RBAC label applied to objects — policies, apps, devices — that restricts which admins can see and manage them. The standard use is regional or business-unit delegation: an India admin sees only India-tagged objects.
15. What are Intune filters and how do they differ from groups?
A group is a static or dynamic membership list. A filter is evaluated at assignment time against device properties — OS version, model, ownership, enrollment profile — and narrows an assignment without creating another group. Filters are faster to evaluate and avoid group sprawl.
Strong answer: "I assign broadly to a group and narrow with a filter, rather than maintaining dozens of dynamic groups."16. Include vs exclude assignment — which wins?
Exclude always wins. If a user is in both an included and an excluded group, the policy does not apply. This is also the standard way to carve out a pilot or an exception group.
17. What is an OMA-URI / custom profile?
A custom configuration that targets a CSP path directly when the setting is not exposed in the UI. Useful, but the answer that scores is: "I check Settings Catalog first — most things that needed OMA-URI three years ago are now native."
18. What is Endpoint analytics?
Reporting on the end-user experience — startup performance, application reliability, recommended software baselines, and anomaly detection in the advanced tier. It gives you a Score you can trend, which is what leadership asks for.
19. Can Intune manage Linux?
Yes — Ubuntu LTS desktop is supported for enrollment, compliance and Conditional Access, with configuration via custom scripts. Coverage is narrower than Windows or macOS; do not overclaim.
20. What is Microsoft Graph in the Intune context?
The single REST API surface behind the Intune admin centre. Everything the portal does, Graph can do — which is how you automate bulk operations, reporting and CI/CD-driven policy management.
Part 3 — Enrollment & Autopilot
21. What is Windows Autopilot?
A provisioning service that takes an OEM-shipped device and configures it into a corporate device without imaging. The device's hardware hash is registered against the tenant; at first boot it recognises the tenant, applies the deployment profile, joins Entra, enrolls in Intune and runs through the ESP.
22. What is Windows Autopilot device preparation, and how is it different?
A newer, streamlined provisioning solution — sometimes called Autopilot v2 — designed for faster setup, near real-time reporting and simpler troubleshooting. The critical differences: no hardware hash registration required, it uses a device group plus a user group rather than a hardware-identity-driven profile, and it is available in GCC High and DoD.
Say this explicitly: "It's a separate solution, not a replacement for classic Autopilot — they coexist and suit different scenarios." Candidates who call it an upgrade get marked down.23. How many apps can a device preparation policy deliver?
Up to 25 as of the January 2026 update, including Windows 365 provisioning profiles, and including Enterprise App Catalog apps. Apps and scripts must be assigned to the device group and deployed in system context.
24. What are the Autopilot deployment modes?
User-driven (user signs in and the device provisions for them), Self-deploying (no user credentials — kiosks, digital signage, shared devices; requires TPM 2.0), Pre-provisioning (formerly White Glove — partner or IT runs the technician phase, user gets a near-ready device), and Autopilot Reset to return an existing device to a known state.
25. How do you collect a hardware hash?
Get-WindowsAutopilotInfo from the PowerShell Gallery, run in an elevated session, exporting to CSV. At scale you take it from the OEM directly, or from a CSP partner who registers on your behalf. In pre-provisioning scenarios the technician phase can register it.
26. What is the Enrollment Status Page (ESP)?
The screen shown during provisioning that blocks the user from reaching the desktop until required apps, policies and certificates have applied. You configure which apps are blocking, the timeout, and whether the user may use the device on failure.
27. What ESP setting was added in 2026?
"Install Windows quality updates (might restart the device)." Since January 2026, OOBE installs the latest monthly security update by default; this setting lets you allow or block that behaviour. Blocking it shortens provisioning; allowing it means devices are patched from first boot.
28. What are the Windows enrollment methods?
Autopilot, Autopilot device preparation, bulk enrollment via a provisioning package, automatic enrollment on Entra join, Group Policy–triggered enrollment for hybrid devices, co-management from ConfigMgr, and manual user-driven enrollment via Settings.
29. How is iOS/iPadOS corporate enrollment done?
Automated Device Enrollment (ADE) through Apple Business Manager or School Manager, with an Apple MDM push certificate and an enrollment program token. Devices bought through ABM are supervised and enrollment is non-removable. User enrollment or device enrollment via Company Portal covers BYOD.
30. What are the Android Enterprise enrollment modes?
| Mode | Meaning | Use |
|---|---|---|
| Work profile (BYOD) | Container on a personal device | Employee-owned |
| Corporate-owned work profile (COPE) | Org-owned, with personal container | Dual-use |
| Fully managed (COBO) | Org-owned, fully controlled | Corporate handsets |
| Dedicated (COSU) | Kiosk / single-purpose | Retail, logistics, field |
| AOSP management | Devices without Google Mobile Services | Rugged, some regions |
31. What are enrollment restrictions?
Rules that control which platforms may enroll, minimum and maximum OS versions, whether personally-owned devices are permitted, and a device limit per user. There is also a corporate device identifier upload (CSV) so only trusted devices enroll.
Gotcha to know: if the personal-device restriction blocks personal devices and corporate identifiers aren't in place for Windows, device preparation enrollment will fail outright.32. What is the Apple MDM push certificate and what happens if it expires?
It authorises Intune to manage Apple devices. It is valid one year. If it expires, all Apple devices lose management and must be re-enrolled — it cannot be recovered by renewing late, and it must be renewed with the same Apple ID that created it. Every real-world admin has a calendar reminder for this.
33. What is device categorisation?
Prompting the user at enrollment to select a category, which then drives dynamic group membership and therefore policy targeting. Useful when you cannot distinguish device purpose from attributes alone.
34. What is corporate device identifier enrollment?
Uploading IMEI, serial number or (for Windows) a CSV of identifiers so devices are recognised as corporate-owned at enrollment rather than personal. This changes which restrictions and policies apply and what data you can collect.
35. Autopilot profile is assigned but the device still enrolls as a normal device. Why?
Most often: the hardware hash was never imported, or was imported into a different tenant; the device was already enrolled and needs a reset; profile assignment has not finished (assignment status must read "Assigned"); or the device is in a group the profile does not target. Check the Autopilot devices blade, not the profile.
Part 4 — Configuration & compliance
36. Two profiles set the same setting to different values. What happens?
A conflict. Neither value applies and the device reports Conflict. Intune does not merge or pick a winner for most CSP settings. Resolve by consolidating policies, using filters to prevent overlap, or excluding one group.
Nuance that impresses: for security baselines and some endpoint security policies the most restrictive value can win. Knowing where the exception lies shows real experience.37. What is a security baseline?
A pre-configured, Microsoft-recommended group of settings — Windows security baseline, Defender for Endpoint baseline, Edge baseline. You deploy them as a starting point and customise. They are versioned, so you must periodically migrate profiles to the newest version.
38. How do you deploy certificates through Intune?
Three routes: SCEP (with NDES and the Intune Certificate Connector), PKCS (also via the connector, with the private key generated at the CA), and Microsoft Cloud PKI — an Intune Suite add-on that removes the on-prem CA and NDES infrastructure entirely. Always deploy the trusted root certificate profile first.
39. What is the difference between SCEP and PKCS?
SCEP generates the private key on the device and never transmits it — more secure, but needs NDES and is harder to operate. PKCS generates the key at the CA and delivers it in a package — simpler, better for user certificates that must roam across devices.
40. How do you configure BitLocker with Intune?
Endpoint security → Disk encryption, or a Settings Catalog policy. Key points: require TPM, set encryption method (XTS-AES 256), and enable key escrow to Entra ID — without escrow you will eventually lock someone out permanently. Recovery keys are then visible on the device object.
41. What is a custom compliance policy?
A compliance check driven by a PowerShell detection script plus a JSON definition of expected values — used when a required condition is not a built-in setting, for example verifying a specific agent version or registry state. macOS custom compliance settings were added in 2026.
42. What is a remediation script (proactive remediation)?
A pair of scripts — detection and remediation — run on a schedule. Detection reports whether the issue exists; remediation fixes it. Classic uses: clearing a stuck service, correcting a registry value, fixing certificate placement. Requires Windows Enterprise E3/E5 or equivalent.
43. Difference between a platform script and a remediation script?
A platform script runs once per device (unless changed), is fire-and-forget, and reports only success or failure. A remediation script runs repeatedly on a schedule with detection logic and reports state over time. Use platform scripts for setup, remediations for drift.
44. How do you deploy Wi-Fi and VPN profiles?
Configuration profile per platform. For enterprise Wi-Fi with 802.1X you also deploy the trusted root and a SCEP/PKCS certificate, and the Wi-Fi profile references that certificate profile. Sequence matters — certificate first, then Wi-Fi.
45. What is administrative templates / ADMX-backed policy?
Group Policy settings exposed through CSPs so you can apply familiar GPO settings to cloud-managed devices without a domain controller. In Settings Catalog these appear natively; for third-party ADMX you can ingest the file via custom policy.
46. How do you migrate from Group Policy to Intune?
Use Group Policy analytics in the admin centre: export the GPO to XML, import it, and Intune reports which settings have a CSP equivalent and what percentage is supported. Then it can generate a Settings Catalog policy from the supported set. Unsupported settings need custom CSP or a rethink.
47. How do you enforce a device naming convention?
In the Autopilot deployment profile — apply a device name template using %SERIAL% and %RAND:x% tokens, within the 15-character NetBIOS limit. For non-Autopilot, a platform script running Rename-Computer.
Part 5 — Application management
48. What app types can Intune deploy to Windows?
Win32 (.intunewin), Microsoft Store apps (new Store, winget-backed), Line-of-business (.msi), Microsoft 365 Apps, web links, and Enterprise App Catalog apps — pre-packaged, Microsoft-maintained third-party apps that come with the Intune Suite's Enterprise App Management.
49. How do you package a Win32 app?
Use the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) to wrap the source folder and setup file into a .intunewin. Then in the console define install and uninstall commands, install behaviour (system or user), detection rules, requirements, dependencies and supersedence.
50. What are detection rules and why do they matter?
They tell Intune whether the app is already installed — file/folder existence and version, registry key or value, MSI product code, or a custom PowerShell detection script. Bad detection rules are the single biggest cause of Win32 app failures: the app installs, detection fails, Intune retries forever.
Say this: "I always validate detection independently of install — if detection is wrong, nothing downstream works."51. What is supersedence?
A relationship declaring that one app version replaces another, with an option to uninstall the previous version first or upgrade in place. It is how you drive version upgrades without maintaining separate uninstall assignments.
52. What are app dependencies?
Apps that must install first — a runtime, a prerequisite framework. Intune installs dependencies automatically, up to five levels deep. Circular dependencies fail.
53. Difference between Required, Available and Uninstall assignments?
Required installs automatically. Available appears in Company Portal for the user to choose. Uninstall removes it. Note that Available for enrolled devices is user-targeted only — you cannot make an app "available" to a device group.
54. What is an App Protection Policy (APP)?
MAM policy controlling what an app may do with corporate data — block copy/paste to unmanaged apps, require a PIN, prevent Save As to personal storage, enforce encryption, and selectively wipe corporate data. It works with or without enrollment, which is what makes it the BYOD answer.
55. What is App Configuration Policy and how does it differ from App Protection?
App Configuration pre-populates settings inside the app — server URL, default account, feature toggles — so the user does not configure it. App Protection restricts data movement. Configuration is convenience; protection is security.
56. What is a managed installer policy?
A WDAC-based designation marking Intune as a trusted installer, so apps it deploys are allowed even under application control. As of March 2026 this applies during Autopilot device preparation OOBE, before Win32, Store and Enterprise App Catalog apps install — which fixed a long-standing provisioning reliability gap.
57. How do you deploy Microsoft 365 Apps?
Use the built-in Microsoft 365 Apps app type — select architecture, update channel, languages, and whether to remove existing MSI installations. Behind it this generates an Office Deployment Tool XML, which you can also supply directly for complex configurations.
58. An app shows Success in Intune but is not on the device. What do you check?
Detection rule matching something else — a leftover registry key or file from a prior version — so Intune believes it succeeded. Verify by running detection logic manually, then check IntuneManagementExtension.log for the actual install exit code.
59. What is Enterprise App Management?
An Intune Suite capability giving a catalog of pre-packaged, Microsoft-maintained third-party applications with automatic update packaging — removing the repackaging burden for common apps like Chrome, Zoom or Notepad++.
Part 6 — Endpoint security & Conditional Access
60. How do Intune and Conditional Access work together?
Intune evaluates compliance and writes the result to the device object in Entra ID. Conditional Access reads that signal and grants or blocks access to resources, optionally requiring a compliant device, a hybrid-joined device, MFA, or an approved client app. Intune produces the signal; CA enforces on it.
61. What is device-based versus app-based Conditional Access?
Device-based requires the device to be compliant or hybrid-joined — appropriate for corporate hardware. App-based requires an approved client app with an App Protection Policy — appropriate for BYOD where you cannot demand enrollment.
62. What is Microsoft Defender for Endpoint integration?
Connecting MDE to Intune lets you onboard devices via policy, surface MDE's device risk score as a compliance condition, and drive Conditional Access from risk level. A high-risk device becomes non-compliant and loses access automatically.
63. What are Attack Surface Reduction (ASR) rules?
Defender rules blocking common attack behaviours — Office child processes, credential theft from LSASS, executable content from email. Each can be set to Block, Audit or Warn. Always deploy in Audit first and review before enforcing; ASR breaks line-of-business apps if rolled out blind.
64. What is Endpoint Privilege Management (EPM)?
An Intune Suite add-on that lets standard users run specific approved actions with elevated rights — either automatically by rule or via a user-requested approval flow — so you can remove local admin rights without breaking the business.
Why it comes up: removing local admin is a live project at most enterprises. Talking about EPM signals you are working on current problems.65. What is Local Administrator Password Solution (LAPS) in Intune?
Windows LAPS managed through Intune policy — it rotates the local administrator password on a schedule and escrows it to Entra ID, retrievable by authorised admins. It removes shared local admin passwords across the estate.
66. What is multi-admin approval (MAA)?
An access policy requiring a second administrator to approve sensitive changes — app deployments, script deployments, certain policy changes — before they take effect. It protects against both mistakes and a single compromised admin account.
67. Explain the March 2026 scope tag change.
Previously, when an admin held multiple role assignments, their scope tags merged, which could silently widen their effective permissions. Intune now allows scope tags from different role assignments to be kept separate. A Permissions Assessment Report lets you evaluate the impact before enabling it.
68. How do you implement least privilege in Intune?
Built-in or custom RBAC roles scoped to the minimum permission set, scope tags to partition objects, Entra PIM for just-in-time elevation of Intune Administrator, multi-admin approval on sensitive operations, and now separated scope tags with the Permissions Assessment Report to verify effective access.
69. What is Microsoft Cloud PKI?
An Intune Suite service issuing and managing certificates from the cloud — removing on-prem AD CS, NDES and the certificate connector. It is the modern answer to "how do I do 802.1X and VPN certificates without server infrastructure."
70. What is Microsoft Tunnel?
A VPN gateway running in a Linux container on-prem or in Azure, giving managed iOS and Android devices access to internal resources. Tunnel for MAM extends this to unenrolled devices via App Protection Policies, and is an Intune Suite feature.
Part 7 — Windows Update & Autopatch
71. What is a Windows Update ring?
Policy defining deferral periods for quality and feature updates, active hours, deadlines, grace periods and restart behaviour. The standard design is three or four rings — pilot, early adopters, broad, critical/exempt — with increasing deferrals.
72. Difference between update rings, feature update policy and quality update policy?
The ring controls cadence and deferral. A feature update policy pins devices to a specific Windows version and holds them there — this is what you use to control a Windows 11 migration. A quality update policy lets you expedite a specific security update outside the normal ring cadence, for zero-days.
73. How did you handle the Windows 10 end of support migration?
A strong answer covers: readiness assessment via Endpoint analytics and hardware compliance reporting for TPM 2.0 and CPU support; a feature update policy pinning eligible devices to Windows 11; ring-based phased rollout; a compliance policy flagging devices still on Windows 10 after the cut-off; and a hardware refresh plan for the non-upgradeable remainder. Windows 10 support ended 14 October 2025.
74. What is Windows Autopatch?
A Microsoft-run service that manages update deployment for you — automatically ringing devices, monitoring rollout health, and pausing or rolling back on detected failure. As of 2026 it includes a full update readiness experience. Included with Windows Enterprise E3/E5.
75. What are driver update policies?
Policy controlling how driver and firmware updates from Windows Update reach devices, with manual approval for individual drivers. Critical in regulated environments where an untested driver can take out a fleet.
76. How do you control Samsung firmware updates?
Through the Samsung E-FOTA integration surfaced in Intune — target existing device groups, hold production on a known version while testing, then schedule installation with maintenance windows, battery level requirements and postponement limits.
77. What is Delivery Optimization?
Peer-to-peer content distribution so devices pull update and app content from each other rather than every device hitting the internet. Configured via policy — download mode, group ID, bandwidth limits. Essential for branch offices on thin links.
78. How do you expedite a zero-day patch?
Create an expedited quality update policy targeting the specific KB. It bypasses the normal deferral in your update rings and forces installation with a defined restart grace period. Use it sparingly — it overrides your change control by design.
Part 8 — Intune Suite add-ons
79. What does the Intune Suite include?
Endpoint Privilege Management, Remote Help, Microsoft Tunnel for MAM, Advanced Endpoint Analytics, Enterprise App Management, Microsoft Cloud PKI, and specialised device management. It is licensed as a bundle on top of Plan 1, or components can be bought individually.
80. What is Remote Help?
An Intune-integrated remote assistance tool with Entra-authenticated sessions, role-based permissions, compliance warnings before connecting, and a full audit trail. The differentiator over third-party tools is that trust and identity are handled by Entra, not a separate account system.
81. What is Advanced Endpoint Analytics?
Adds anomaly detection, device-scoped restart analysis, enhanced device timeline and battery health reporting on top of standard Endpoint analytics — for finding the small subset of devices degrading a fleet's score.
82. What is Device Query?
An on-demand query capability letting you inspect a device's live state — installed software, running processes, application versions, hardware and security attributes — using a KQL-like syntax, rather than waiting for the next inventory cycle.
Part 9 — Co-management & SCCM migration
83. What is co-management?
Managing a Windows device with both ConfigMgr and Intune simultaneously. The device has an SCCM client and an MDM enrollment, and each workload is assigned to one authority. It is the standard migration bridge, not a permanent design.
84. Name the co-management workloads.
Compliance policies, Windows Update policies, Resource access policies, Endpoint Protection, Device configuration, Office Click-to-Run apps, and Client apps. Each can be set to ConfigMgr, Pilot Intune (a collection) or Intune.
85. In what order would you move workloads?
Start with low-risk and easily reversible: Compliance policies, then Windows Update, then Resource access and Endpoint Protection. Move Device configuration and Client apps last — they carry the most operational risk and the most rework. Always use Pilot Intune with a small collection before flipping the whole estate.
What's being tested: risk sequencing. Any candidate can list workloads; few can justify an order.86. Tenant attach vs cloud attach vs co-management?
Tenant attach surfaces ConfigMgr devices in the Intune admin centre for limited actions, with no MDM enrollment required. Co-management is dual management with workloads split. Cloud attach is the umbrella term covering both plus Endpoint analytics integration.
87. What happens if a setting is configured in both SCCM and Intune?
The workload slider decides. Whichever authority owns that workload wins; the other's policy is ignored for that workload. Conflicts within a workload are therefore an authority misconfiguration, not a policy conflict.
Part 10 — Scenario questions (3–8 years)
88. 5,000 devices, a Win32 app shows 30% failure. Walk me through your approach.
Segment the failures first — by OS build, model, region, enrollment date — using the app install report. Pull IntuneManagementExtension.log from three failing and one succeeding device and compare exit codes. Validate the detection rule independently. Check requirement rules (disk space, architecture, OS version) since these silently exclude. Verify dependencies installed. If exit codes vary by model, it is usually a driver or prerequisite gap; if uniform, it is packaging.
89. Executives complain provisioning takes 90 minutes. Reduce it.
Cut blocking apps in the ESP to the true minimum — everything else can install after desktop. Consider Autopilot pre-provisioning so the technician phase absorbs the heavy work. Evaluate the new ESP quality-update setting, since OOBE now installs monthly security updates by default and that adds time. Use Delivery Optimization. Move large apps to Available rather than Required. And evaluate Autopilot device preparation, which is designed specifically for a faster, more consistent flow.
90. BYOD users refuse enrollment but need Outlook and Teams. Design it.
MAM-WE: App Protection Policies on the Microsoft apps with PIN, encryption, block copy-paste to unmanaged apps and block Save As. App Configuration Policies to pre-set accounts. Conditional Access with an app-based grant requiring an approved client app and app protection policy — which blocks the native mail client. Selective wipe on offboarding. No enrollment, no personal data touched.
91. A compliance policy marked 800 devices non-compliant overnight and they lost email. What now?
Immediate: identify the change in audit logs and either revert it or add a temporary CA exclusion group to restore access — restore service first, diagnose second. Then determine whether the devices genuinely fail the condition or whether it is a reporting or grace-period issue. Prevent recurrence with a grace period, phased assignment via a pilot filter, and multi-admin approval on compliance changes.
What they want to hear: "restore service first." Candidates who start troubleshooting before restoring access fail this question.92. Design RBAC for a global org with regional helpdesks.
Scope tags per region applied to devices, policies and apps. Custom RBAC roles giving helpdesk read plus specific remote actions, no policy edit. Assign each regional role to that region's scope tag only. Use the 2026 separated-scope-tag behaviour so an admin with two assignments does not accumulate merged access, and run the Permissions Assessment Report before enabling. Reserve Intune Administrator for PIM-elevated just-in-time use, and enable multi-admin approval on app and script deployment.
93. Migrate 12,000 devices from SCCM to Intune. Give me the plan.
Phase 1 — enable tenant attach for visibility with no risk. Phase 2 — enable co-management, enroll via auto-enrollment, keep all workloads on ConfigMgr. Phase 3 — run Group Policy analytics to size the configuration gap and rebuild policy in Settings Catalog. Phase 4 — move workloads in risk order using Pilot Intune collections, starting with Compliance and Windows Update. Phase 5 — repackage apps, using Enterprise App Catalog where it covers the app. Phase 6 — move Device configuration and Client apps. Phase 7 — new devices go cloud-native via Autopilot; decommission the on-prem estate as hardware refreshes.
94. Security wants local admin rights removed from 3,000 developers. They will revolt.
Endpoint Privilege Management. Start in audit to capture what elevation is actually used. Build automatic elevation rules for the legitimate recurring cases — specific signed installers, known dev tooling. Configure user-requested elevation with approval for the long tail. Pilot with a volunteer group, publish the request SLA, then remove admin rights ring by ring. The technical part is easy; the sequencing and communication are what make it succeed.
95. How do you handle a device that is lost while holding sensitive data?
Remote lock immediately, then locate if the platform supports it. If recovery is unlikely, issue a wipe for corporate-owned or a retire for BYOD. Revoke the user's Entra sessions and reset credentials. Confirm BitLocker or FileVault was on and the key is escrowed. Then check what the device held — this is where compliance reporting and disk encryption enforcement pay for themselves.
Part 11 — Troubleshooting
96. Which logs do you check for Windows app and script issues?
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\ — chiefly IntuneManagementExtension.log for Win32 apps, PowerShell scripts and remediations, plus AgentExecutor.log and ClientHealth.log. Read them with CMTrace or Support Center OneTrace.
97. How do you collect MDM diagnostics from a Windows device?
Settings → Accounts → Access work or school → Info → Create report, or mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;Autopilot -zip C:\Temp\logs.zip. From the console, use Collect diagnostics on the device to pull them remotely without touching the machine.
98. Policy shows "Not applicable." What does that mean?
The device does not meet the policy's applicability — wrong OS platform, wrong edition (many settings need Enterprise), OS version below the minimum, or the setting does not exist on that build. It is not a failure; it means the policy was correctly skipped.
99. Autopilot fails at the ESP with a timeout. Diagnose it.
Check which blocking app is hanging in the ESP report. Common causes: an app too large for the timeout, a dependency chain failing, a required app targeted at the user when ESP is in device phase, or network restrictions blocking the CDN. Reduce blocking apps, extend the timeout, and confirm required endpoints are allowed through the proxy.
100. A user says policy is not applying. What is your sequence?
Confirm the device is enrolled and syncing (check last check-in). Confirm assignment actually targets them — remember exclude beats include, and filters silently narrow scope. Check for conflicts. Force a sync from Company Portal and wait a full cycle. Check the per-setting status in the device's policy view. Then go to logs.
101. Devices are enrolled but not showing in Entra as compliant. Why?
Usually no compliance policy is assigned at all — with no policy, the tenant-level "mark devices with no compliance policy as" setting decides, and if it is set to Compliant you get a false green. Otherwise: the device has not evaluated yet, a grace period is active, or the CA policy is reading hybrid-join rather than compliance.
Part 12 — PowerShell & Graph API
102. How do you connect to Graph for Intune from PowerShell?
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All",
"DeviceManagementConfiguration.ReadWrite.All"
Get-MgDeviceManagementManagedDevice -All |
Select-Object DeviceName, OperatingSystem, ComplianceStateFor unattended automation, use an app registration with certificate authentication and application permissions rather than delegated.
103. Which Graph endpoint holds Intune data?
https://graph.microsoft.com/v1.0/deviceManagement/ and its beta equivalent. Many newer Intune features appear in beta first — worth saying, because it explains why production scripts sometimes have to target beta and why you version-pin them.
104. How would you export all non-compliant devices?
Get-MgDeviceManagementManagedDevice -All |
Where-Object ComplianceState -ne 'compliant' |
Select-Object DeviceName, UserPrincipalName, OperatingSystem,
OsVersion, LastSyncDateTime, ComplianceState |
Export-Csv .\noncompliant.csv -NoTypeInformation105. How do you back up and restore Intune policy as code?
Export configuration via Graph to JSON, store it in Git, and use a pipeline to deploy into test then production tenants. The community tooling most often named is IntuneCD. This answer signals DevOps maturity and lands well for senior roles.
Part 13 — Salary bands and the HR round
Indicative 2026 ranges for Intune / Modern Endpoint Management roles in India. Treat as a negotiating reference, not a promise — product companies and US-shift MSP roles pay above these.
| Experience | Typical title | Range (₹ LPA) |
|---|---|---|
| 0–2 years | Desktop / Endpoint Engineer L1 | 3.5 – 6 |
| 2–4 years | Intune Administrator L2 | 6 – 11 |
| 4–7 years | Modern Workplace / MEM Engineer | 11 – 20 |
| 7–10 years | MEM Architect / Lead | 20 – 34 |
| 10+ years | Endpoint Architect / Practice Lead | 34 – 55+ |
Questions you should ask them
- How many endpoints, and what is the platform split across Windows, macOS, iOS and Android?
- Are you co-managed with ConfigMgr, or cloud-native? If co-managed, which workloads have moved?
- Do you hold the Intune Suite, and which add-ons are actually deployed?
- Is policy managed through the portal or as code?
- Who owns Conditional Access — this team, or the identity team?
Certifications that carry weight in 2026
- MD-102: Endpoint Administrator — the core certification for these roles
- SC-300: Identity and Access Administrator — because Conditional Access sits next to everything you do
- AZ-104 — useful where the role touches broader Azure
- SC-200 — if the role leans toward Defender and security operations
Prepare for these interviews with Cloud Soft Solutions
Our NEXUS program covers Cloud, DevOps, SRE and AIOps, with a dedicated Modern Endpoint Management track built around Intune, Entra ID, Autopilot and Conditional Access — including live lab environments, mock interviews and resume preparation. 5,500+ alumni placed.
📍 513, 5th Floor, Aditya Enclave, Nilagiri Block, Beside Ameerpet Metro Station, Ameerpet, Hyderabad – 500016
📞 +91 96660 19191 · +91 99496 16388 · ✉️ info@cloudsoftsol.com
How to use this list
Do not memorise it. Interviewers in this space test depth by following up, and a memorised answer collapses on the second question. Instead:
- Build a trial tenant. Microsoft gives you a free Intune trial and Entra P2 trial. Enroll a VM, break something, fix it.
- Package one Win32 app end to end — including a detection rule you wrote yourself and verified independently.
- Run one Autopilot deployment and one device preparation deployment so you can describe the difference from experience rather than from a blog.
- Read the "What's new in Intune" page monthly. It takes ten minutes and is the single highest-return habit for this role.
- Prepare three stories: a migration you drove, an outage you resolved, and a security control you rolled out.
Note on accuracy: Intune ships monthly and features move between preview and general availability quickly. Details here reflect the product as of August 2026. Always verify against Microsoft Learn's "What's new in Microsoft Intune" before an interview.
