1. App Management & Security
Q1: What are the main capabilities of Intune for app management?
A: Intune can deploy, update, protect, and remove applications across devices. It supports multiple app types—Microsoft Store apps, Win32 apps, line-of-business (LOB) apps, and mobile apps. It also applies App Protection Policies (APP) to secure corporate data even on unmanaged devices.
Q2: How does Intune handle app updates for managed devices?
A: Updates can be managed automatically via Intune’s app deployment settings. For Store apps, updates happen through Microsoft Store for Business integration; for Win32/LOB apps, new versions are deployed as updates through Intune.
Q3: What’s the difference between app protection policies and device compliance policies?
A:
-
App Protection Policies secure data within apps (e.g., block copy/paste to personal apps).
-
Device Compliance Policies ensure the device itself meets security requirements (e.g., encryption, password policy).
Q4: Scenario – How would you deploy Microsoft Teams to all mobile devices but prevent data sharing with personal apps?
A: Deploy the Teams app through Intune’s app deployment feature, then apply an App Protection Policy that blocks data transfer to unmanaged apps and enforces data encryption.
2. Identities
Q5: How does Azure AD integrate with Intune for identity management?
A: Intune uses Azure AD for authentication, user and group management, and conditional access. Azure AD determines which users and devices are allowed to access company resources based on Intune policies.
Q6: What are custom roles in Intune?
A: Custom roles are user-defined Role-Based Access Control (RBAC) profiles that allow granular admin permissions—for example, a role to only wipe devices without altering compliance settings.
Q7: Scenario – The helpdesk should reset devices but not change security policies. How do you set it up?
A: Create a custom RBAC role in Intune with only “Remote tasks” permissions, assign it to the Helpdesk group, and exclude policy management permissions.
Q8: What is policy assignment in Intune?
A: Policy assignment is the process of targeting configurations or compliance rules to specific Azure AD groups or users, ensuring policies only apply to intended recipients.
3. Device Management & Security
Q9: What is the difference between compliance policies and configuration profiles?
A:
-
Compliance Policies check if devices meet security requirements (e.g., OS version, encryption).
-
Configuration Profiles push settings or configurations (e.g., Wi-Fi profiles, VPN settings).
Q10: How does Intune handle BYOD vs. corporate-owned devices?
A: Corporate devices are fully enrolled and managed; BYOD devices can be enrolled in MDM or managed with App Protection Policies only, allowing separation of personal and work data.
Q11: Scenario – A remote employee loses their laptop. What do you do in Intune?
A:
-
Use Locate Device (if enabled).
-
Trigger a Remote Wipe to erase corporate data.
-
Revoke the device’s compliance status in Azure AD to block access.
-
Monitor for unusual sign-in activity.
Q12: What is Microsoft Tunnel in Intune?
A: It’s a VPN solution that allows mobile devices to securely access on-premises resources while being managed by Intune.
4. Integration, Reporting & Advanced Features
Q13: How does Intune integrate with Microsoft Defender for Endpoint?
A: Integration allows Defender’s threat intelligence to feed into Intune compliance policies, enabling actions like blocking access for devices with high threat levels.
Q14: What is Endpoint Analytics in Intune?
A: A tool that provides insights into device performance, boot times, policy impact, and user experience to proactively resolve IT issues.
Q15: What is Windows Autopatch?
A: A cloud service integrated with Intune that automates updates for Windows, Microsoft 365 Apps, Edge, and Teams to keep devices secure without manual patching.
Q16: Scenario – Security wants to block devices without antivirus from accessing email. How do you do it?
A:
-
Integrate Intune with Defender for Endpoint.
-
Create a compliance policy that requires antivirus.
-
Use Conditional Access in Azure AD to block non-compliant devices from accessing Exchange Online.