Microsoft Intune Interview Questions and Answers 2026 (60 Questions)

These Intune interview questions cover what endpoint, modern workplace and Microsoft 365 admin interviews actually probe in 2026: enrolment on every platform, Windows Autopilot, compliance and Conditional Access, apps, endpoint security, updates, co-management and the troubleshooting that fills an Intune engineer's week. Interviewers rarely want menu paths; they want to hear how you decide, how you roll out safely and how you find the root cause when a device, app or policy misbehaves. The 60 questions below run from fundamentals to twelve real-world scenarios, and the product details were checked against Microsoft Learn documentation.

How to use this guide

• L1/L2 support and junior admin roles: expect the fundamentals, enrolment and app sections, and at least one "the user says…" troubleshooting question.
• Intune administrator / endpoint engineer roles: expect compliance and Conditional Access design, Win32 packaging, update strategy, BitLocker and LAPS, plus scenario questions where you describe logs and checks in order.
• Senior, lead and architect roles: expect co-management and migration plans, RBAC and scope tags for a multi-team or multi-country tenant, zero trust design, automation with Microsoft Graph and where AI (Copilot in Intune) fits safely.

Contents

• Intune fundamentals (Q1–Q11)
• Enrolment and Windows Autopilot (Q12–Q19)
• Compliance, Conditional Access and configuration (Q20–Q26)
• App deployment and app protection (Q27–Q34)
• Endpoint security and Windows updates (Q35–Q42)
• Co-management, automation and architecture (Q43–Q46)
• AI in Intune (Q47–Q48)
• Real-world scenario questions (Q49–Q60)
• Key takeaways
• Interview preparation checklist
• FAQ

Intune fundamentals

1. What is Microsoft Intune and how is it different from Configuration Manager?

Answer: Intune is Microsoft's cloud-based endpoint management service. It manages Windows, macOS, iOS/iPadOS, Android and Linux devices (mobile device management, MDM) and protects data inside apps even on devices it does not manage (mobile application management, MAM). Configuration Manager (ConfigMgr, formerly SCCM) is the on-premises server product built around a site server, distribution points and a domain-joined Windows estate. Intune needs no on-premises infrastructure, works over the internet, uses Microsoft Entra ID for identity, and feeds device compliance into Conditional Access. ConfigMgr is still strong for complex OS imaging, server management and granular on-premises software distribution, which is why many enterprises run both through co-management (Q43).

2. Explain MDM versus MAM. When do you choose each?

Answer: MDM enrols the device: Intune can push settings, certificates, Wi-Fi, apps and security policy, check compliance and wipe the whole device. MAM manages only the app layer through app protection policies: PIN, encryption, copy/paste and save-as restrictions, and selective wipe of corporate data in apps like Outlook, Teams and Edge, without enrolling the device. Choose MDM for corporate-owned devices and anything that needs device-wide control. Choose MAM without enrolment for personal phones where employees will not accept full management, and combine it with a Conditional Access policy that requires app protection. Many organisations use both: MDM for corporate fleets, MAM for BYOD.

3. What are the Microsoft Entra device identity types and why do they matter for Intune?

Answer: There are three. Microsoft Entra registered is for personal devices: the user adds a work account and the device gets an identity but stays user-owned. Microsoft Entra joined is for corporate Windows devices that sign in with Entra accounts and have no dependency on on-premises AD. Microsoft Entra hybrid joined devices are joined to on-premises Active Directory and also registered in Entra ID, typically during a transition. The identity type decides which enrolment methods apply and how Conditional Access sees the device. Microsoft's guidance for new Windows deployments favours Entra join; hybrid join adds dependencies such as the Intune Connector for Active Directory and line of sight to a domain controller.

4. What is the Microsoft Intune admin center?

Answer: The Intune admin center (intune.microsoft.com) is the web console for Intune: devices, apps, endpoint security, reports, tenant administration, Windows 365 Cloud PCs and tenant-attached ConfigMgr devices. The older "Microsoft Endpoint Manager" brand has been retired and the console is now named the Microsoft Intune admin center. Identity work such as groups, Conditional Access and device settings like enabling LAPS lives in the Microsoft Entra admin center, and many interview answers need both. For automation, almost everything in the console is exposed through Microsoft Graph.

5. Compliance policy versus configuration profile: what is the difference?

Answer: A configuration profile sets something on the device: a Wi-Fi network, a password rule, a restriction, a certificate. A compliance policy evaluates the device against rules (encryption on, minimum OS version, not jailbroken, Defender risk at or below a level) and reports compliant or not compliant. Compliance does not change the device; it produces a signal that Conditional Access uses to allow or block access. A common design is to configure BitLocker with an endpoint security policy and then require encryption in the compliance policy, so the device is both made secure and measured.

6. What app assignment types exist, and what is the difference between Required and Available?

Answer: The main intents are Required (installed automatically on targeted devices or users), Available for enrolled devices (shown in the Company Portal for users to install), Available with or without enrolment for some mobile apps, and Uninstall. Required suits line-of-business tools everyone needs; Available suits optional software and reduces failed installs on devices that do not need the app. Available assignments target user groups, because the Company Portal shows apps to a user. You can add end-user notifications, deadlines and restart grace periods on Windows, and use assignment filters to include or exclude devices by property.

7. Explain Retire, Wipe, Fresh Start, Autopilot Reset and Delete.

Answer: Retire removes company data, apps and profiles that Intune deployed and unenrols the device, while leaving personal data, so it is the normal action for BYOD leavers. Wipe resets the device to factory settings, with options on Windows to keep the enrolment state and user account. Fresh Start (Windows) reinstalls Windows and removes OEM-installed apps, optionally keeping user data. Autopilot Reset returns a Windows device to a business-ready state for a new user while keeping its Entra join and enrolment. Delete only removes the device record from Intune; it does not clean the device. For app-only scenarios there is also app selective wipe under app protection, which removes corporate data from managed apps on an unenrolled phone.

8. How often do devices check in, and how do you force policy?

Answer: Intune notifies online devices when assignments change (change-based sync), and devices also run maintenance syncs at roughly eight-hour intervals. Newly enrolled devices check in much more often for the first couple of hours. You can force a sync from the admin center (Sync device action), from the Company Portal, or on Windows from Settings > Accounts > Access work or school > Info > Sync. Win32 apps, scripts and remediations come through the Intune Management Extension (IME), which has its own schedule, so restarting the IME service is a common way to speed up app delivery during testing.

9. Groups versus assignment filters: when do you use each?

Answer: Groups (Entra security groups, static or dynamic) decide who gets a policy or app. Assignment filters refine that at check-in using device properties such as OS version, manufacturer, model, ownership or enrolment profile, without changing group membership. Dynamic device groups need Entra to process membership after enrolment, which delays policy on fresh devices; filters evaluate on the device's check-in, so they are faster and more predictable. A clean pattern is to assign broadly (All devices or a large user group) and use filters to include "corporate Windows 11 laptops" or exclude kiosks.

10. How do RBAC and scope tags work in Intune?

Answer: Intune RBAC has three parts: a role (what actions are allowed, for example Help Desk Operator or Application Manager, or a custom role), members (the admin group holding the role), and scope (which users or devices they can act on, through scope groups), plus scope tags (which Intune objects such as policies, apps and devices they can see). Scope tags are how you split one tenant between teams or countries: the India service desk sees devices tagged "IN", the UK team sees "UK". Least privilege matters: some sensitive actions, such as rotating the local admin password, are not in any built-in role and must be granted through a custom role. Pair RBAC with multi admin approval for high-impact actions like wipes and script deployment.

Real-world example: Consider an IT services firm in Bengaluru running a client's global tenant: L1 support can sync and restart devices in its scope but cannot touch compliance policy.

11. What does Intune licensing look like at a high level?

Answer: Users or devices need an Intune licence, usually Microsoft Intune Plan 1, which is included in bundles such as Microsoft 365 E3/E5 and Business Premium. Microsoft groups the extra features as "advanced capabilities": Remote Help, Advanced Analytics, Endpoint Privilege Management, Enterprise App Management, Microsoft Cloud PKI, Microsoft Tunnel for MAM, specialty device management and Android firmware-over-the-air updates. According to Microsoft Learn these come through Intune Plan 2, the Microsoft Intune Suite, and select Microsoft 365 bundles, and trials are available from Tenant administration > Intune add-ons. Some features also have Windows licensing requirements; Remediations, for example, needs Windows Enterprise E3/E5 or equivalent. Because bundle contents change, say you would confirm current entitlements on Microsoft's plans page rather than quoting from memory.

Enrolment and Windows Autopilot

12. What are the Windows enrolment options in Intune?

Answer: For corporate devices: Entra join with automatic MDM enrolment (during OOBE or from Settings), Windows Autopilot (classic profiles or device preparation policies), co-management from ConfigMgr, Group Policy-triggered enrolment for hybrid-joined devices, and bulk enrolment with a provisioning package built in Windows Configuration Designer. For personal devices: adding a work account in Settings, the Company Portal app, or the "Allow my organization to manage my device" prompt after signing in to a Microsoft 365 app. Automatic enrolment needs the MDM user scope configured in Entra ID; if both MAM and MDM scopes include a user, the MAM scope wins for personal devices and they are not enrolled.

13. Explain Windows Autopilot (classic) and its deployment modes.

Answer: Autopilot turns the OEM Windows image a device ships with into a business-ready device without reimaging. The device's hardware hash is registered with the tenant (by the OEM, a reseller or by uploading a CSV collected with a script), a deployment profile is assigned, and at OOBE the device joins Entra ID (or hybrid joins), enrols in Intune and installs policies and apps, tracked by the Enrollment Status Page. Modes:

• User-driven: the user signs in and the device configures itself for them.
• Pre-provisioning: a technician or partner runs the device phase in advance so the user phase is quick.
• Self-deploying: no user, Entra join only, needs TPM 2.0 attestation; for kiosks and shared devices.
• Existing devices: a JSON profile delivered via ConfigMgr task sequence for devices that are not yet registered.
• Autopilot Reset: returns a device to a business-ready state for a new user.

OEM device -> hash registered -> profile assigned
   -> OOBE: network + Entra sign-in
   -> Entra join + Intune enrol
   -> ESP: device phase -> account phase
   -> desktop (apps, policy, compliance)

14. What is Windows Autopilot device preparation and how is it different from classic Autopilot?

Answer: Autopilot device preparation is a newer, simpler profile experience. According to Microsoft Learn, it requires Windows 11 (24H2, or 23H2/22H2 with the March 2024 update or later), supports Microsoft Entra join only, and offers user-driven and automatic (Windows 365) flows. Its key mechanism is enrolment time grouping: the device is added to a chosen device security group at enrolment, and only the apps and PowerShell scripts you select in the profile are installed during OOBE, with the rest after the desktop appears. It gives near real-time deployment reports per device, and does not require hardware hash registration; corporate identifiers are only needed if enrolment restrictions block personal devices. Classic Autopilot remains the option for pre-provisioning, self-deploying mode and hybrid join. If a device is registered for classic Autopilot and not associated with the tenant, the classic profile takes precedence.

Interview tip: The MD-102 study guide explicitly lists "choose between Windows Autopilot deployment profiles and device preparation policies", so prepare a crisp comparison.

15. What is the Enrollment Status Page (ESP)?

Answer: The ESP shows provisioning progress during OOBE and can block the user from reaching the desktop until selected apps and policies are installed. It has a device setup phase (device-targeted policies, certificates, apps) and an account setup phase (user-targeted items). Key settings: show app and profile progress, block device use until all or selected apps install, timeout, allow users to reset or continue on error, and which apps are "blocking". Keep blocking apps to the essentials (security agent, VPN, core productivity) because every extra blocking app adds time and failure risk. With device preparation, the equivalent control is the list of apps and scripts selected in the profile.

16. How do you enrol corporate iPhones and iPads?

Answer: Use Automated Device Enrollment (ADE). Prerequisites: an Apple MDM push certificate (APNs) uploaded to Intune, and Apple Business Manager (or Apple School Manager) linked with an enrolment program token. Devices bought through Apple or an authorised reseller are assigned to your MDM server in Apple Business Manager, and an enrolment profile in Intune sets supervision, user affinity, authentication and which Setup Assistant screens to skip. When the device is switched on, it enrols automatically and is supervised, which unlocks stronger restrictions and silent app installs. For devices not bought through those channels you can add them with Apple Configurator. ADE requires a reset for devices already in use.

Interview tip: Mention that the APNs certificate must be renewed every year with the same Apple ID; letting it expire breaks management for every Apple device in the tenant. This is a favourite question.

17. What are the Android Enterprise management options?

Answer: All of them need Intune connected to a managed Google Play account.

Option	Ownership	Use case
Personally owned work profile	BYOD	Separate work profile; IT manages only work apps and data
Corporate-owned work profile (COPE)	Corporate	Company device that allows personal use
Fully managed (COBO)	Corporate	Work-only device for one user, full control
Dedicated (COSU)	Corporate	Kiosks, scanners, signage; single or limited apps
AOSP (user-associated or userless)	Corporate	Devices without Google Mobile Services, such as some headsets

For bulk corporate enrolment use Google zero-touch, Samsung Knox Mobile Enrollment or QR codes. Android device administrator management is deprecated and no longer available on devices with Google Mobile Services, so any answer that still recommends it for new deployments is a red flag.

18. How do you enrol and manage macOS devices?

Answer: Corporate Macs use ADE through Apple Business Manager, the same token model as iOS, which gives supervised, user-approved MDM automatically. Personal Macs enrol through the Company Portal app. After enrolment you deploy configuration through the settings catalog (including Apple's declarative device management for software updates on supported versions), shell scripts, PKG and DMG apps, FileVault with recovery key escrow, and Platform SSO for an Entra-integrated sign-in experience. macOS compliance policies check OS version, FileVault, firewall and Gatekeeper.

19. What are enrolment restrictions, corporate identifiers and device enrolment managers?

Answer: Enrolment restrictions control which platforms, OS versions and ownership types may enrol (for example, block personal Windows devices) and how many devices a user may enrol. Corporate identifiers (serial numbers or IMEIs, and for Windows serial number plus manufacturer and model) pre-mark devices as corporate so they pass a "block personal" restriction. A device enrolment manager (DEM) is a non-admin account allowed to enrol many more corporate devices than a normal user, useful for shared-device staging, but not compatible with every method, including Apple ADE.

Compliance, Conditional Access and configuration

20. What does a compliance policy contain, and what are actions for noncompliance?

Answer: A compliance policy has platform-specific rules (minimum and maximum OS, BitLocker or FileVault, Secure Boot, password, jailbreak or root detection, Defender for Endpoint machine risk, custom compliance via a PowerShell discovery script and JSON rules on Windows) and actions for noncompliance: mark the device noncompliant (immediately or after a grace period), email the user, send a push notification, remotely lock, or add to the retire list. Tenant-wide compliance settings matter too: "Mark devices with no compliance policy assigned as" (set it to Not compliant in a zero trust tenant) and the compliance status validity period, after which a device that has not checked in is marked noncompliant. A grace period gives users time to fix issues before access is cut.

21. How do Intune compliance and Microsoft Entra Conditional Access work together?

Answer: Intune evaluates the device and writes the compliance state to the device object in Entra ID. A Conditional Access policy targets users, cloud apps and conditions, and its grant control can be "Require device to be marked as compliant", "Require Microsoft Entra hybrid joined device", "Require app protection policy" or MFA. At sign-in, Entra checks the device's state and allows or blocks. The device must be identifiable, so the client has to pass device identity (a supported browser such as Edge with the work profile, or the Company Portal or Authenticator broker on mobile).

User sign-in -> Entra ID evaluates CA policy
   |-- device known? (registered/joined)
   |-- Intune compliance state = compliant?
   |-- app protection / MFA as required
   v
Grant token  or  Block with remediation link

Interview tip: Always describe a pilot first: create the CA policy in report-only mode, review sign-in logs, exclude break-glass accounts, then enforce. Our Microsoft Entra ID course covers Conditional Access design in depth.

22. Templates, the settings catalog, Administrative Templates and custom OMA-URI: when do you use each?

Answer: The settings catalog is the default for new work: a searchable list of thousands of settings for Windows, macOS and iOS/iPadOS, mapped to the underlying configuration service providers (CSPs), with one policy able to mix settings from many areas. Templates still exist for grouped scenarios such as Wi-Fi, VPN, certificates, email and kiosk. Administrative Templates and imported ADMX files cover Group Policy-style settings for Windows, Office and Edge. Custom profiles with an OMA-URI are the last resort for a CSP setting not yet exposed in the UI; Intune does not validate the payload, so test carefully. Endpoint security policies (antivirus, firewall, disk encryption, ASR, account protection) are the preferred home for security settings, which keeps ownership clear.

23. How do you migrate Group Policy to Intune?

Answer: Export GPOs as XML backups and import them into Group Policy analytics in Intune. It reports which settings have an MDM equivalent, which are deprecated and which are unsupported, and can migrate supported settings into a settings catalog policy. Then rationalise rather than copying everything: many legacy GPO settings are obsolete or covered by security baselines. Plan around gaps (logon scripts, drive mappings, printer deployment) with alternatives such as remediation scripts, Universal Print or OneDrive Known Folder Move. For hybrid-joined devices, be aware that GPO and MDM can both set the same thing; decide which wins and avoid dual management of one setting.

24. How does Intune resolve policy conflicts?

Answer: Per Microsoft Learn: when two configuration policies set the same setting to different values, Intune shows a conflict and you must resolve it manually; it does not pick a winner for you. When two compliance policies evaluate the same setting, the most restrictive applies. Compliance settings take precedence over the same setting in configuration policies. For app protection policies, conflicting values resolve to the most restrictive option, with exceptions for numeric fields. For custom Apple profiles and OMA-URI payloads, Intune does not evaluate content, so conflicts are applied unpredictably by the OS. Conflicts often come from overlap between a security baseline, an endpoint security policy and a settings catalog policy, so check all three places.

25. What are security baselines and how do you manage them?

Answer: Security baselines are Microsoft-recommended groups of settings (for Windows, Microsoft Defender for Endpoint, Microsoft Edge, Microsoft 365 Apps and Windows 365) delivered as editable policies. They give you a secure starting point quickly. Deploy to a pilot ring, review which settings break line-of-business apps, adjust, then widen. Baselines are versioned; when Microsoft releases a new version you compare and update the profile rather than layering a second baseline on top, which causes conflicts. Do not set the same setting in a baseline and a separate policy.

26. How do you deploy certificates for Wi-Fi and VPN, and where does Cloud PKI fit?

Answer: First deploy a trusted certificate profile with your root (and intermediate) CA so devices trust issued certificates. Then issue device or user certificates with either SCEP (device generates a key pair and requests a certificate; traditionally via NDES and the Intune Certificate Connector with an on-premises CA) or PKCS (the connector requests the certificate from the CA and delivers it). Reference that certificate in Wi-Fi (EAP-TLS) and VPN profiles. Microsoft Cloud PKI, one of Intune's advanced capabilities, provides a cloud-hosted CA for issuing, renewing and revoking certificates for Intune-managed devices, removing the need for NDES and on-premises CA servers for those scenarios. Assignment order matters: the trusted root must reach the device before the SCEP or PKCS profile succeeds.

App deployment and app protection

27. Walk through packaging and deploying a Win32 app.

Answer: Wrap the installer and its files with the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) to produce an .intunewin file. In Intune, add a Windows app (Win32): install and uninstall commands (silent switches), install behaviour (System or User), restart behaviour, return codes (for example 0 success, 3010 soft reboot, 1618 retry), requirement rules (architecture, minimum OS, disk space, or a script), and a detection rule (MSI product code, file or folder version, registry value, or a custom script). Then add dependencies and supersedence if needed and assign. The Intune Management Extension downloads, installs and runs the detection rule; if detection fails after a "successful" install, Intune reports a failure even though the app installed. A precise detection rule is the single most important part of a Win32 app.

28. Explain Win32 app dependencies and supersedence.

Answer: A dependency is an app that must be installed before another (for example, a runtime before a line-of-business app); you can have Intune install it automatically or only check for it. Supersedence declares that a new app version replaces an older one, with the choice to uninstall the old version first or upgrade in place. Supersedence chains let you retire version 1 as version 3 rolls out. Pilot first: supersedence applies to every device where the superseded app is detected.

29. How do you deploy Microsoft Store apps now that Microsoft Store for Business is retired?

Answer: Microsoft Store for Business and Education was retired and Intune now integrates directly with the Microsoft Store through the Microsoft Store app (new) app type. You search the Store from inside Intune, pick the app, choose System or User install behaviour and assign it. Intune monitors installation and the apps are kept up to date. It supports UWP apps and MSIX-packaged desktop apps, and Win32 apps from the Store are in preview according to Microsoft Learn. Devices need the Intune Management Extension and access to the Store endpoints. Note that the "Turn off the Store application" policy blocks users from browsing the Store but does not stop Intune installing Store apps.

30. What are line-of-business apps and where does MSIX fit?

Answer: Line-of-business (LOB) apps are packages you upload directly: .msi, .appx/.msix for Windows, .ipa for iOS, .apk for Android, and PKG for macOS. MSIX is Microsoft's modern Windows package format with clean install and uninstall, containerised file and registry writes, and differential updates; it suits apps that have been repackaged for it, and MSIX packages must be signed with a certificate the device trusts. For Windows, Microsoft recommends using the Win32 app type for complex installers and warns that mixing Win32 and LOB MSI installs during classic Autopilot can fail installs (mixing is supported with Autopilot device preparation). In practice most enterprise Windows apps end up as Win32 apps.

31. What is Enterprise App Management?

Answer: Enterprise App Management (EAM) is an Intune advanced capability that provides the Enterprise App Catalog: Microsoft-hosted, pre-packaged Win32 apps from Microsoft and other vendors. When you add one, Intune pre-fills install and uninstall commands, detection rules, requirement rules and return codes. For updates you can use guided supersedence or, for Required assignments, auto-update so Intune moves devices to new catalog versions without you repackaging. Microsoft Learn notes limits worth stating: auto-update has no rollout rings or rollback, auto-update apps cannot be ESP or device preparation blocking apps, and you must not manage the same app with two deployment types. EAM saves packaging time for common apps; complex in-house apps still need your own Win32 packaging.

32. How do you deploy Microsoft 365 Apps with Intune?

Answer: Use the built-in Microsoft 365 Apps app type for Windows (choose apps, architecture, update channel such as Monthly Enterprise or Current, languages, shared computer activation) or, for full control, a configuration XML created with the Office Deployment Tool or the Office Customization Tool. For complex cases teams package the Office Deployment Tool as a Win32 app. Manage updates with update channels and, where licensed, Windows Autopatch, which includes Microsoft 365 Apps updates. Policy settings for Office apps can be delivered from Intune or the Microsoft 365 Apps admin center (Cloud Policy). In Autopilot, keep Microsoft 365 Apps as a blocking app only if users truly need it at first sign-in, because it is large.

33. What are app protection policies and how do they protect BYOD data?

Answer: App protection policies (APP, the MAM layer) apply to Intune-protected apps such as Outlook, Teams, OneDrive, Word, Excel and Edge, and to line-of-business apps built with the Intune App SDK or wrapped. Data protection settings: block backup to personal clouds, restrict "send org data to other apps" to policy-managed apps, restrict cut/copy/paste, restrict save-as to OneDrive or SharePoint, block screen capture on Android, encrypt org data. Access requirements: app PIN or biometrics, work account credentials. Conditional launch: block jailbroken or rooted devices, minimum OS and app versions, offline grace period then wipe data, and Mobile Threat Defense signals. Microsoft publishes a data protection framework with graded levels you can start from. APP works on enrolled and unenrolled devices, and app selective wipe removes only corporate data.

34. What is an app configuration policy?

Answer: App configuration policies push settings into apps. There are two channels: managed devices (delivered through the OS MDM channel on iOS/iPadOS and Android Enterprise) and managed apps (delivered through the Intune App SDK, works without enrolment). Typical uses: pre-configure Outlook with the user's account and allow only work accounts ("allowed accounts" on a managed device), set Edge's homepage and managed bookmarks, or configure a line-of-business app's server URL. The "allowed accounts" example stops users adding personal email accounts to a corporate-managed Outlook.

Endpoint security and Windows updates

35. How do you deploy BitLocker with Intune and make sure recovery keys are escrowed?

Answer: Create an endpoint security disk encryption policy (BitLocker) or use the settings catalog. For silent encryption on Entra-joined devices, require device encryption, disable the warning for other disk encryption, allow standard users to enable encryption, configure OS drive settings (TPM startup, encryption method), and enable "save BitLocker recovery information to Microsoft Entra ID" together with "do not enable BitLocker until recovery information is stored". That last pair is what ensures escrow happens before encryption starts. Recovery keys then appear on the device in Intune (Recovery keys) and in the Entra device object. You can rotate keys with a remote action, and configure user self-service recovery through the My Account portal. Monitor with the encryption report and require encryption in compliance policy.

36. How does Intune integrate with Microsoft Defender for Endpoint?

Answer: Enable the service-to-service connection between Defender for Endpoint and Intune, then onboard devices with an endpoint security EDR policy (Intune can fetch the onboarding package automatically). Manage Defender Antivirus, firewall, attack surface reduction rules and App Control for Business through endpoint security policies. In the compliance policy, set "require the device to be at or under the machine risk score" so a device Defender rates as high risk becomes noncompliant and Conditional Access blocks it until the threat is resolved. Defender's vulnerability data also feeds Intune's security tasks and, for Copilot customers, the Vulnerability Remediation Agent. Detect in Defender, mark noncompliant in Intune, block in Entra: that is the zero trust chain.

37. What is Windows LAPS and how does Intune manage it?

Answer: Windows LAPS is the Local Administrator Password Solution built into Windows. It randomises the local admin password per device, backs it up and rotates it. Intune manages it through an endpoint security account protection policy using the LAPS CSP: password complexity and length, backup directory (Microsoft Entra ID or on-premises Active Directory, not both), rotation schedule, post-authentication actions, and on Windows 11 24H2 and later automatic account management, which can manage the built-in Administrator or create a custom managed account. For Entra-joined devices you must first enable LAPS in the Entra device settings. Admins with the right Entra permissions view the password on the device page, and the Intune "Rotate local admin password" action needs a custom role, because no built-in role includes it. Intune's CSP-based policy takes precedence over GPO and legacy Microsoft LAPS.

38. What is Endpoint Privilege Management (EPM)?

Answer: EPM lets users run as standard users while elevating specific approved tasks. You deploy an elevation settings policy (installs the EPM client, sets reporting and the default response) and elevation rules that match files by name, path, hash, publisher certificate and arguments, with child-process controls. Elevation types: automatic, user confirmed (right-click "Run with elevated access", optionally requiring authentication or a business justification), elevate as current user, support approved (the user requests, an admin approves), and deny. Most types use an isolated virtual account, never local Administrators membership. Start from the unmanaged-elevation reports, then write rules. EPM is an advanced capability, so licensing applies.

39. What are Remediations?

Answer: Remediations (previously Proactive Remediations) are script packages with a detection script and an optional remediation script, run by the Intune Management Extension on Windows on a schedule (once, hourly or daily) or on demand for a single device. The remediation runs only if detection exits with code 1. Output is limited to 2,048 characters and can be exported. They live under Devices > Scripts and remediations. Licensing requires Windows Enterprise E3/E5, Education A3/A5 or Windows VDA per user. Typical uses: restart a stopped service, fix a registry value, or collect a value for a report. Do not include reboots, passwords or personal data in scripts.

40. Update rings, feature update policies and quality update policies: how do they differ?

Answer: Update rings (Windows Update client policies) control behaviour: quality and feature deferral days, deadlines, grace periods, active hours, pause and uninstall. Feature update policies pin devices to a specific Windows version (for example, keep the fleet on one Windows 11 release until you approve the next) and use the Windows Update for Business deployment service. Quality update policies can expedite a specific security update to devices faster than their ring would allow, for a zero-day. Driver update policies let you approve or automatically take driver and firmware updates. A solid design has a test ring (IT), a pilot ring (a cross-section of business users) and broad rings, with feature versions controlled by policy rather than deferrals alone.

41. What is Windows Autopatch?

Answer: Windows Autopatch is a cloud service that automates updates for Windows, Microsoft 365 Apps for enterprise, Microsoft Edge and Microsoft Teams, managed from the Intune admin center. It organises devices into Autopatch groups (logical containers of Entra groups and update policies) and releases updates in sequential rings, with Windows quality and feature updates (including multi-phase feature update releases), driver and firmware management, Hotpatch policies and reporting. Microsoft Learn says that in April 2025 Autopatch removed feature activation and made its features available to Business Premium and A3+ licences as well as E3+ and F3, with support requests to the Autopatch engineering team limited to E3+ and F3.

42. What is Hotpatch and when would you use it?

Answer: Hotpatch installs monthly Windows security updates without requiring a restart on eligible Windows 11 Enterprise devices (it needs supported hardware and virtualisation-based security), configured through a Hotpatch-enabled quality update policy in Intune or Autopatch. Periodic baseline updates still require a restart, so it reduces restarts rather than removing them. It suits environments where restarts are disruptive: hospital workstations, trading floors, call-centre agents on shift. Check current eligibility in Microsoft's documentation before committing.

Co-management, automation and architecture

43. What is co-management with Configuration Manager?

Answer: Co-management lets a Windows device be managed by both ConfigMgr and Intune at the same time, with workloads switched individually from ConfigMgr to "Pilot Intune" (a collection) to Intune. Workloads include compliance policies, device configuration, Windows Update policies, Endpoint Protection, client apps and Office Click-to-Run apps. Two entry paths: existing ConfigMgr clients are hybrid joined and automatically enrolled in Intune, or new Intune devices (for example, from Autopilot) receive the ConfigMgr client as an app. Co-management enables cloud features like Conditional Access with Intune compliance and Remediations while ConfigMgr keeps app deployment or OS deployment until you are ready.

Interview tip: Move compliance first (quick zero trust win, low risk), then device configuration and updates, then apps last, because app packaging migration is the largest effort.

44. What is tenant attach and how is it different from co-management?

Answer: Tenant attach uploads ConfigMgr devices to the Intune admin center so you can see and act on them in the cloud console without enrolling them in Intune or moving any workloads. Uploaded devices show "ConfigMgr" in the Managed by column, and you can run actions such as Sync Machine Policy, Sync User Policy and App Evaluation Cycle, and use further ConfigMgr features exposed in the admin center (check current docs for the list). You enable it in the Cloud Attach configuration (or in co-management properties if co-management is already on), and it can also upload Endpoint analytics and Defender for Endpoint data. Co-management means Intune actually manages workloads; tenant attach is visibility and remote actions. Tenant-attached devices get the default scope tag and cannot be assigned other scope tags.

45. How would you automate Intune with Microsoft Graph?

Answer: Intune's objects are exposed under Microsoft Graph (device management endpoints for managed devices, compliance, configuration and apps). Use the Microsoft Graph PowerShell SDK or REST calls from an app registration with least-privilege permissions, for example read-only device permissions for a report, and certificate-based or managed identity authentication rather than client secrets in scripts. Typical automations: outdated-build reports to Teams, bulk tagging, exporting policies to version control, and ServiceNow ticket enrichment. Guard destructive actions: never let a script wipe or retire without a human approval step, and protect the tenant with multi admin approval for wipes, scripts and app changes.

Real-world example: Consider a bank that exports every policy nightly to Git via Graph, so "who changed this" is answered from history. Python and PowerShell both help here; see our Python interview questions for cloud and DevOps engineers.

46. How would you design Intune for a global enterprise with several regions and teams?

Answer: Start with one tenant where possible and design the control layers:

• Groups: naming conventions per region and persona (knowledge worker, frontline, kiosk).
• RBAC and scope tags: regional support teams see only their devices; policy owners are central.
• Baseline plus exceptions: a global security baseline and compliance policy, with regional settings (language, time zone, local apps) via filters.
• Rings: test, pilot and broad rings for updates, apps and policy changes.
• Change control: multi admin approval, policy export to version control, and a change calendar aligned to the business.

Mention Windows 365 or Azure Virtual Desktop for contractors and secure remote access; Intune manages Cloud PCs and AVD session hosts too. See the Azure Virtual Desktop interview questions and the Azure interview questions for the adjacent topics.

If you want to practise these flows hands-on (Autopilot, compliance with Conditional Access, Win32 packaging and update rings in a lab tenant), Cloudsoft's Microsoft Intune training in Hyderabad runs in our Ameerpet classroom and live online.

AI in Intune

47. What is Microsoft Security Copilot in Intune and what can it do?

Answer: Copilot in Intune is the Security Copilot experience embedded in the Intune admin center. Per Microsoft Learn it needs Security Copilot set up with capacity (security compute units, SCUs) and the Intune plug-in enabled; there is no separate Intune licence for it. It respects Intune RBAC and scope tags, so admins see only data they are allowed to. Capabilities: natural-language exploration of devices, apps, policies and compliance; setting tooltips that explain a setting and its impact; "Summarize with Copilot" on policies and devices; compliance policy conflict analysis; device troubleshooting; analysing EPM requests; and generating KQL for device query (which needs Advanced Analytics). Intune also has Security Copilot agents: Change Review Agent (multi admin approval requests), Device Offboarding Agent, Policy Configuration Agent (turns documents and baselines into recommended settings) and Vulnerability Remediation Agent (uses Defender data). Features and agent status change frequently, so say you would check current availability.

Interview tip: The current MD-102 skills outline includes investigating and responding to Security Copilot agent recommendations, so expect at least one question on reviewing an agent's suggestion before acting on it.

48. How would you use AI safely in endpoint operations?

Answer: Treat AI as an assistant that reads and recommends, not an autonomous operator. Concretely: read-only access by default; any change (policy edits, remote actions) goes through a human approval and, ideally, multi admin approval; destructive actions such as wipe and retire are never automated; every AI-suggested change is tested in a pilot ring; prompts and outputs are logged for audit; and data access is scoped by RBAC so the assistant cannot see devices the operator cannot. If you build your own helpdesk assistant on Microsoft Graph, use an app identity with least-privilege permissions and an allow-list of safe actions such as sync. Our Intune endpoint troubleshooting AI agent project walks through that design, and AI for end-user computing engineers covers the wider career angle.

Real-world scenario questions

49. A user's laptop is "not compliant" and Outlook is blocked. Walk me through it.

Answer: Find which rule fails, fix the cause, then refresh the state end to end. Do not exclude the user from Conditional Access as a first move.

What I would check:

1. Intune device page > Device compliance: which policy and which setting is failing (encryption, OS version, Defender risk, "not evaluated", or "no compliance policy assigned").
2. Last check-in time; if stale, sync from the admin center or Company Portal, then re-check.
3. If BitLocker is the failing setting, check encryption state and the BitLocker policy (Q53); if OS version, check update rings and pending restarts; if Defender risk, look at the alert in Defender.
4. Entra sign-in logs for the blocked sign-in: which CA policy applied, and whether the device ID was passed at all.
5. Confirm the user and device in Entra match the Intune record (duplicate or stale device objects are common after reimaging).
6. After the fix, sync again and have the user retry; compliance and the token refresh can take a few minutes.

Production consideration: A grace period in actions for noncompliance and a user email with self-help steps cut tickets. Track the top failure reasons weekly; repeating causes should become a remediation or a policy fix.

50. Intune says the device is compliant but Conditional Access still blocks the user. Why?

Answer: Usually the sign-in did not present the device identity, or Entra holds a different device object from the one Intune evaluated.

What I would check:

1. Sign-in log details: device ID, compliance and join type as Entra saw them, and the CA policy result.
2. Browser or client: an unsupported browser or private window does not send device identity; on mobile, the broker (Authenticator or Company Portal) must be present.
3. Duplicate device objects in Entra after re-enrolment; the user may be signing in from the stale one.
4. Another CA policy in the chain (a location, risk or app protection requirement) causing the block.
5. Timing: compliance just changed and the token has not refreshed; sign out and in.

Production consideration: Use the CA "What If" tool and report-only mode before changes, and clean up stale devices with a documented process so duplicates do not pile up.

51. Autopilot is stuck at the Enrollment Status Page. How do you troubleshoot?

Answer: Identify the phase (device setup or account setup) and the exact item it is waiting on, then fix that item rather than raising the timeout.

What I would check:

1. Which phase and which category (security policies, certificates, network connections, apps) is spinning; the ESP shows this when progress display is enabled.
2. Press Shift+F10 during OOBE for a command prompt, or collect diagnostics with MdmDiagnosticsTool (Autopilot area) to get the event logs and registry.
3. For apps: the IME logs (AppWorkload.log in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs) for the blocking app; a user-context app in the device phase, an app that triggers a hard reboot, or an LOB MSI mixed with Win32 apps are classic causes.
4. For certificates or Wi-Fi: a SCEP profile waiting on a trusted root or connector.
5. For hybrid join: Intune Connector for Active Directory health, OU permissions, and domain controller reachability.
6. Network: proxy or firewall blocking Intune, Store or content endpoints during OOBE.

Production consideration: Keep the blocking list short, test new apps in an Autopilot pilot before adding them, and consider device preparation for Entra-joined Windows 11 devices, which reports per-app status in near real time.

52. A Win32 app fails on many devices. How do you investigate with the IME logs?

Answer: Determine whether the failure is download, install, or detection, because each points to a different fix.

What I would check:

1. App install status in Intune: the error code and whether failures cluster by model, OS build or region.
2. On a failing device, IntuneManagementExtension.log (check-in and policy), AppWorkload.log (download, install, detection) and AppActionProcessor.log (applicability and detection) using CMTrace.
3. If the installer returned success but detection failed, fix the detection rule (wrong version string, 32-bit vs 64-bit registry path).
4. If the installer exit code is non-zero, run the exact command manually as SYSTEM (for example with PsExec) to reproduce; check for a missing prerequisite, a pending reboot (1618 or 3010), or antivirus interfering with C:\Windows\IMECache.
5. If it is user-targeted and needs admin rights, change to System context.
6. Collect logs remotely with the Collect diagnostics action when you cannot reach the device.

Production consideration: Package with a test checklist (silent install, uninstall, detection, upgrade over the previous version) and roll out to a pilot group before Required to all.

53. BitLocker is enabled but the recovery key is not in Entra ID. What do you do?

Answer: Get the key backed up now, then fix the policy so it cannot recur.

What I would check:

1. Device and Entra device object: no key listed, and is the device actually Entra joined or hybrid joined (registered devices do not escrow this way)?
2. Event Viewer, BitLocker-API log, for backup errors.
3. The policy: is "save recovery information to Entra ID" on, and "do not enable BitLocker until recovery information is stored" on? If encryption started before the policy (for example, OEM or manual encryption), the key was never escrowed.
4. Fix: run a remediation or script that calls the BackupToAAD-BitLockerKeyProtector cmdlet for the existing protector, or use the BitLocker key rotation remote action, which generates a new key and escrows it.
5. Verify with manage-bde -protectors -get C: and confirm the key ID matches what Entra shows.

Production consideration: Build a report of encrypted devices without an escrowed key and remediate in bulk. Remember that deleting a device object in Entra deletes its stored keys, so stale-device cleanup must exclude devices you may still need to recover.

54. Two policies conflict and a setting shows "Conflict" on a device. How do you resolve it?

Answer: Find every policy setting that value, decide the single owner, and remove the setting from the others. Intune will not pick a winner between configuration policies.

What I would check:

1. Device > Device configuration: open the conflicting profile and the per-setting status to see which policies set the same setting.
2. Look across settings catalog, templates, endpoint security, security baselines and Group Policy analytics-created policies; conflicts often hide in a baseline.
3. Use Copilot (if licensed) or a Graph export to search all policies for the setting.
4. Agree the correct value with the setting owner, keep it in one policy, and remove it elsewhere.
5. For hybrid devices, also check whether a GPO sets the same thing.

Production consideration: Prevent repeats with ownership rules (security settings only in endpoint security), naming standards and periodic conflict reports.

55. Management worries that staff copy client data from Outlook on personal phones into personal apps. Design a fix.

Answer: Use MAM without enrolment plus Conditional Access, so data is protected inside the apps without managing personal devices.

What I would check:

1. Create app protection policies for iOS and Android targeting users: send and receive org data only with policy-managed apps, restrict cut/copy/paste to policy-managed apps, save copies only to OneDrive or SharePoint, block backup, require PIN, encrypt data, block printing if needed.
2. Conditional launch: minimum OS and app versions, block jailbroken or rooted devices, offline grace period then wipe org data.
3. Conditional Access for Exchange Online, SharePoint and Teams on mobile: require app protection policy, and block legacy authentication and unmanaged native mail clients.
4. Use Edge with app protection for browser access so links open in a managed browser.
5. Pilot with a business unit, collect feedback, then widen.

Production consideration: Tell employees what IT can and cannot see on personal phones, and add Purview data loss prevention and sensitivity labels for defence in depth. The same governance thinking applies to Copilot readiness, see Microsoft 365 Copilot readiness.

56. A new office opens next month with a few hundred laptops, phones and shared devices. How do you plan enrolment?

Answer: Make enrolment zero-touch and pre-tested so day one is "open the box and sign in".

What I would check:

1. Procurement: buy laptops through an OEM or reseller that registers devices for Autopilot (or associates them with the tenant for device preparation); buy iPhones through Apple Business Manager-linked channels; Android through zero-touch or Knox.
2. Profiles: an Autopilot profile or device preparation policy with a naming template and the office's group; ESP or selected apps limited to essentials; iOS ADE profile with supervision; Android fully managed or dedicated profiles for shared scanners.
3. Network: confirm the office firewall and proxy allow Intune, Autopilot, Store, Apple and Google endpoints and that Delivery Optimization can share content locally to save bandwidth.
4. Pilot: enrol a handful of each device type on the office network a week before.
5. Day one: a floor support desk with a runbook, plus enrolment and compliance reports watched live.

Production consideration: Pre-provisioning moves the heavy device phase out of the user's first hour. For a new GCC office in Hyderabad, check firewall inspection and hash registrations early; they cause most day-one surprises.

57. You must move a large ConfigMgr estate to Intune. Outline the plan.

Answer: A staged move through co-management, workload by workload, with new devices born in the cloud.

What I would check:

1. Readiness: Entra Connect and hybrid join health, licences, network, current GPO and app inventory (Group Policy analytics, app usage).
2. Enable tenant attach for visibility, then co-management with automatic enrolment, piloting with a collection.
3. Switch compliance first and add Conditional Access; then device configuration (migrated GPOs), Windows updates (rings or Autopatch), Endpoint Protection.
4. Apps last: re-package to Win32 or use the Enterprise App Catalog; keep ConfigMgr for the long tail.
5. New and refreshed hardware goes through Autopilot with Entra join, so the hybrid population shrinks naturally.
6. Decommission ConfigMgr components only when nothing depends on them.

Production consideration: The workload slider decides authority, so be clear which team owns each workload. Windows Server skills remain useful during the hybrid period; see the Windows Server course.

58. An employee leaves and another reports a stolen phone. What actions do you take?

Answer: Separate identity, data and device actions, and match the device action to ownership.

What I would check:

1. Identity first: disable the account, revoke sessions and refresh tokens in Entra, reset MFA methods if compromise is suspected.
2. Leaver with a personal phone: app selective wipe (MAM) or Retire if enrolled, which removes corporate data and keeps personal data.
3. Stolen corporate phone: remote lock, then Wipe; for iOS supervised devices, enable Lost Mode to show a message and locate.
4. Corporate laptop not returned: wipe if needed; BitLocker protects data at rest, and you can rotate the recovery key afterwards.

Production consideration: Automate the leaver flow from the HR system through a ticket and approval, but keep wipe as a human-approved step.

59. After a monthly quality update, a line-of-business app breaks on the pilot ring. What do you do?

Answer: Contain the rollout, then fix forward with the vendor or Microsoft.

What I would check:

1. Pause quality updates on the broad rings (or the Autopatch group's later rings) so the update stops spreading.
2. Confirm the correlation: affected builds, error logs, and whether unaffected devices share any difference.
3. For pilot devices, use the ring's uninstall option where supported, or a known-issue rollback if Microsoft has published one.
4. Check Windows release health and the Microsoft 365 message centre for a known issue.
5. Resume when a fix or workaround exists; never leave rings paused indefinitely, because pause has a time limit and security exposure grows.

Production consideration: This is why the pilot ring must include real business users of critical apps, not only IT staff.

60. Security wants local admin removed from all laptops, but developers say they cannot work. How do you handle it?

Answer: Remove standing admin rights and replace them with controlled, audited elevation.

What I would check:

1. Discover: EPM reports on unmanaged elevations show what users currently run as admin.
2. Remove membership with an account protection policy (local user group membership) and manage the built-in admin account with Windows LAPS.
3. Write EPM rules: automatic for trusted signed tools, user confirmed with justification for developer tools, support approved for rare cases, deny for known-risk binaries.
4. Offer alternatives: deliver common tools through the Company Portal or Enterprise App Catalog so no elevation is needed; consider a separate managed development VM or Cloud PC for heavy admin needs.
5. Pilot with one development team, tune rules, then expand.

Production consideration: Review elevation reports monthly and tighten broad rules.

Key takeaways

• Know the three control layers and how they connect: configuration sets, compliance measures, Conditional Access enforces.
• Be able to compare classic Autopilot with Autopilot device preparation, and explain the ESP and its failure modes.
• Win32 apps succeed or fail on detection rules; know the IME log files by name.
• Security answers should mention BitLocker escrow, Windows LAPS, Defender risk in compliance and EPM, not only antivirus.
• Update strategy means rings, feature version control and, where licensed, Windows Autopatch, with a pilot ring of real users.
• For migrations, co-management workload by workload; tenant attach for visibility.
• For AI, describe Copilot in Intune accurately and insist on human approval for changes.

Interview preparation checklist

• Set up a trial Intune tenant and enrol at least one Windows device, one phone and (if possible) a Mac.
• Build a compliance policy and a report-only Conditional Access policy, then read the sign-in log for a blocked attempt.
• Package one Win32 app with IntuneWinAppUtil.exe, break its detection rule deliberately, and find the failure in AppWorkload.log.
• Run a Windows Autopilot or device preparation deployment in a VM and note each ESP or progress phase.
• Deploy BitLocker with Entra key escrow and LAPS, and retrieve both from the admin center.
• Create an app protection policy and test copy/paste from Outlook to a personal app on a phone.
• Write one remediation script pair with correct exit codes.
• Draft update rings for test, pilot and broad, and explain when you would pause.
• Read the current MD-102 study guide and map each skill area to a lab you have done.
• Prepare two stories from your own work: one troubleshooting incident and one rollout you planned.

FAQ

What skills are required for an Intune administrator role?

You need Windows client fundamentals, Microsoft Entra ID identity and Conditional Access, Intune enrolment, compliance, configuration, app deployment and endpoint security, plus troubleshooting with logs and basic PowerShell or Microsoft Graph scripting.

Which certification is linked to Intune?

Exam MD-102 leads to the Microsoft 365 Certified: Endpoint Administrator Associate certification. Microsoft updates the skills outline periodically, so prepare from the current study guide on Microsoft Learn.

How should I prepare for an Intune interview?

Build a small lab tenant, practise enrolment, compliance, Win32 apps and Autopilot hands-on, and rehearse scenario answers aloud in the order you would check things, naming the logs and reports you would open.

Is Intune a good career choice in 2026?

Endpoint management remains central to security and hybrid work, and Intune skills combine well with Entra ID, Defender, Windows 365 and Azure Virtual Desktop, which opens paths into modern workplace engineering, endpoint security and cloud roles.

Do I need Configuration Manager experience for Intune jobs?

Not always, but many enterprises still run co-management, so understanding ConfigMgr basics, workloads and migration planning helps a lot in senior and migration-focused roles.

Can a fresher get an Intune job?

Freshers usually start in service desk or L1 endpoint support roles; a working lab, strong Windows and networking basics and clear troubleshooting answers help you move into Intune administration.

What is the difference between Autopilot and Autopilot device preparation in one line?

Classic Autopilot uses registered hardware hashes and deployment profiles with all modes, while device preparation is a simpler Entra-join-only Windows 11 flow that uses enrolment time grouping and gives near real-time reporting.

Is scripting important for Intune roles?

Yes. PowerShell is used for detection rules, remediations and custom compliance, and Microsoft Graph is used for reporting and automation, so basic scripting is expected at administrator level and above.

Ready to turn these answers into hands-on skill? Cloudsoft's Microsoft Intune course covers enrolment, Autopilot, compliance, app deployment, endpoint security and troubleshooting labs, in our Ameerpet classroom beside Ameerpet Metro or live online. If you want a broader path across AI, machine learning, cloud and cyber security, look at the APEX AI, ML, Cloud and Cyber Security program. Call +91 96660 19191 for a free demo.

Related Cloudsoft resources

• Microsoft Entra ID training in Hyderabad
• Project: Intune endpoint troubleshooting AI agent
• Azure Virtual Desktop interview questions
• Azure Virtual Desktop (AVD) training
• Azure interview questions and answers
• Citrix interview questions and answers
• AI for end-user computing engineers