Microsoft MD-102: Device Configuration Profiles and Policies — Study Guide

By Laurynas Brazys · 5 August 2026 · #microsoft #md-102 #certification #exam-prep #study-guide

Part of the Microsoft Endpoint Administrator Associate MD-102 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Device configuration and policy management in Microsoft Intune establishes consistent, secure operating states across Windows, macOS, iOS/iPadOS, and Android. Admins combine configuration profiles, endpoint security policies, compliance policies, Delivery Optimization, and Windows Update for Business so that devices are provisioned with required settings, enforced for security posture, continuously updated, and allowed access to resources based on compliance state. Effective design hinges on understanding settings sources (Settings Catalog, Administrative Templates, device restrictions, and custom OMA-URI), security policy scope and precedence, assignment mechanics (include/exclude and filters), and the integration between compliance and Conditional Access.

Configuration Profiles and Settings Sources

Configuration profiles deliver operating system and application settings. For Windows, core profile types include device restrictions, endpoint protection (legacy template), administrative templates (ADMX-backed), and Settings Catalog. When a required setting is unavailable in templates, a custom OMA-URI profile targets the underlying MDM CSP.

Device restrictions are curated templates that centralize common controls such as password and sign-in requirements, browser and Store controls, privacy, Bluetooth and peripheral access, and kiosk/Single App Mode. On Android Enterprise (work profile and fully managed), kiosk configuration is in the Device experience category. On iOS/iPadOS, restrictions include app install controls, AirDrop, screen capture, and iCloud settings. On Windows, device restrictions cover BitLocker prerequisites, account controls, and UX lockdowns.

The endpoint protection device profile template predates Endpoint security and configures Windows Defender Antivirus, Firewall, BitLocker, SmartScreen, and Exploit Guard settings. For new deployments, favor Endpoint security profiles for these domains to streamline posture reporting and reduce cross-template conflicts; keep endpoint protection device profiles only where a needed knob is absent elsewhere.

Administrative Templates map to ADMX-backed policies via the ADMX-backed MDM CSP. They mirror familiar Group Policy paths for Windows and Microsoft 365 Apps. Use them when you want the GPO-like model (e.g., Office policy settings) and for consistency in migrations from on-premises GPOs.

Settings Catalog is the most flexible, forward-looking source that enumerates nearly all CSP and ADMX-backed settings with search, categories, and scope to device/user. Prefer Settings Catalog when you need precise selection, cross-template settings in one profile, or to replace monolithic templates.

Custom OMA-URI profiles configure any CSP directly when a setting isn’t exposed in Intune UI. Define the exact OMA-URI path (for example, ./Vendor/MSFT/Policy/Config/Defender/ScanAvgCPULoadFactor), data type, and value. Use this also to ingest third-party ADMX for ADMX-backed CSP scenarios, or to push macOS/iOS payloads (e.g., plist keys) that aren’t in native templates.

To minimize conflicts, configure a given setting in only one policy source. Intune will flag a per-setting Conflict if multiple assigned policies set the same key; device behavior may be undefined or last-write, so consolidation is best practice.

Endpoint Security Profiles and Threat Surface

The Endpoint security node delivers purpose-built policies with security-centric reporting. Use these in priority order over general configuration profiles for security settings:

Antivirus: Configure Microsoft Defender Antivirus real-time protection, cloud-delivered protection, scan schedules, remediation, and MAPS settings. Attack surface protections such as Network Protection and Controlled Folder Access can be set here or in ASR policies. Tamper Protection is managed via security settings and Defender for Endpoint and should remain on to block unauthorized changes.
Disk encryption: Enforce BitLocker for OS, fixed, and removable drives; require TPM with or without PIN; silently enable encryption where hardware allows; escrow recovery keys to Azure AD; rotate recovery passwords automatically after use to reduce insider risk. On macOS, use FileVault encryption profiles with escrow of personal recovery keys to Intune.
Firewall: Configure Windows Defender Firewall per profile (Domain/Private/Public), block inbound by default, allow/deny rule merging with local policies, and deploy inbound/outbound rules. Enable logging and define IPSec exemptions as needed.
Attack surface reduction: Set ASR rules by GUID (block, audit), enable Controlled Folder Access, Network Protection, and Exploit Protection. ASR rules help prevent credential theft, Office macro abuse, and script-based attacks. Integrate with audit mode before enforcing to reduce disruption.

For Microsoft Defender for Endpoint onboarding, create an Endpoint detection and response (EDR) policy in Intune to deploy the onboarding package and enable sensor data collection. On macOS, apply Defender AV settings through a configuration profile using the Defender preference domain to minimize administrative effort.

Security baselines are curated collections of recommended security settings. Use them to quickly reach a defensible baseline, then layer Endpoint security profiles for exceptions and advanced controls.

Compliance, Conditional Access, and Assignment Mechanics

Compliance policies evaluate device posture against organizational requirements and produce a binary compliant/noncompliant state (with an “in grace period” indicator). Common Windows rules include OS version/build thresholds, password complexity, BitLocker required, Microsoft Defender status, TPM presence, and Microsoft Defender for Endpoint device risk level. For mobile, require PIN, encryption, block jailbroken/rooted, and OS version minimums.

Actions for noncompliance define enforcement timing and escalation. The default action marks the device noncompliant; you can schedule additional actions such as sending email notifications to users and admins and remotely locking the device on supported platforms. Each action supports a grace period (in days). While a device is in grace, it remains compliant for Conditional Access evaluation, enabling user remediation without immediate access loss.

Conditional Access uses compliance state to gate access. A common pattern is “Require device to be marked as compliant” for cloud apps, which relies on Intune to assert compliance. Combine with additional conditions such as client app types to control legacy authentication. Pairing device compliance with CA ensures only trusted and managed devices access corporate resources.

Assignments determine scope. Include groups (user/device) to target; use group exclusions to remove subsets. Exclusions win over inclusions. Filters refine assignments at evaluation time based on device properties (OS version, manufacturer, enrollment type, ownership, join type, etc.) with include or exclude logic, especially useful when assigning to “All devices/users” while targeting only eligible endpoints. To avoid policy conflicts, align ownership and platform scoping, avoid setting the same CSP keys across multiple policy types, and prefer a single source (e.g., Endpoint security) for security controls. For Windows Update policies, remember precedence: a Feature updates policy that pins a specific release overrides Update ring feature deferral; Expedited quality updates override deferrals and deadlines for the selected update.

Windows Update for Business and Delivery Optimization

Windows Update for Business (WUfB) keeps devices current without WSUS or SCCM. Use three complementary policy types:

Update rings for Windows 10 and later control servicing channel, deferral periods for quality and feature updates, restart behavior, active hours, auto-restart deadlines, and UX. Create rings (e.g., Pilot, Broad, Critical) to stage rollout with progressive deferrals and deadlines.
Feature updates for Windows 10 and later lock devices to a target Windows version until you advance it. This policy takes precedence for feature upgrades over ring deferrals, giving deterministic control of when a device moves between releases.
Expedited updates for Windows 10 and later deliver a specific quality update rapidly to remediate vulnerabilities. Expedited updates override ring deferrals and apply within hours, leveraging Windows push notifications and Update Health Tools. Use sparingly for zero-day scenarios.

Delivery Optimization (DO) reduces WAN utilization by peer-sharing content such as Windows updates, Microsoft 365 Apps, Intune Win32 apps, and Microsoft Store apps. Configure DO with a Settings Catalog or Delivery Optimization profile. Key controls include download mode, bandwidth limits, cache behavior, and VPN awareness. Typical modes are:

HTTP only: no peer-to-peer; download from Microsoft CDN only.
LAN: peer with devices behind the same NAT; best for most offices.
Group: peer within a defined group (site-ID), ideal for distributed enterprises; set the Group ID consistently via policy or DHCP.
Internet: include internet peers; rarely recommended due to unpredictability.
Simple or Bypass modes: troubleshooting or to temporarily disable advanced DO features.

Set bandwidth as a percentage of measured throughput or as absolute limits, distinguish foreground vs background, cap upload bandwidth, define cache size and file age, and block peering on VPN. Combine DO with WUfB rings to minimize risk and bandwidth impact while maintaining update velocity.

Practical Problem Scenario

Contoso Ltd. operates 2,500 Windows 11 laptops across global offices and 300 macOS devices used by engineering. They must: enforce disk encryption, standardize Defender protections, control Windows update rollout with emergency patch ability, reduce WAN usage, and block access to Microsoft 365 unless devices are compliant. Some Windows devices are used by contractors and shouldn’t receive kiosk or corporate UX restrictions.

Create Endpoint security Disk encryption policies

Windows: Configure BitLocker for silent enablement with TPM, escrow recovery keys to Azure AD, and enable automatic recovery key rotation. macOS: Configure FileVault with institutional and personal key escrow to Intune. Why: Endpoint security Disk encryption provides platform-native encryption and key escrow with minimal user friction and centralized recovery.

Create Endpoint security Antivirus and Attack surface reduction policies

Enable Defender AV real-time and cloud-delivered protection, schedule scans, enable Network Protection and key ASR rules in audit for one ring, then enforce after validation. Turn on Controlled Folder Access for finance devices via assignment filters. Why: Endpoint security policies give focused security reporting and avoid conflicts with legacy endpoint protection templates; ASR reduces common attack vectors.

Onboard to Microsoft Defender for Endpoint

Deploy an EDR onboarding policy to Windows and macOS collections and integrate device risk level with Intune compliance. Why: EDR signals inform compliance and Conditional Access while improving detection and response.

Define compliance policies with grace periods and actions

Windows: Require BitLocker, Defender healthy, OS ≥ target build. macOS: Require FileVault and OS baseline. Configure email notifications at day 0, mark noncompliant at day 3. Why: Grace periods preserve productivity while driving remediation; compliance becomes the enforcement lever for access.

Configure Conditional Access

Create a policy that requires device to be marked as compliant for Exchange Online, SharePoint, and Teams; exclude break-glass accounts; add client app condition to block legacy authentication. Why: Ties access to verified posture, closing gaps from unmanaged or legacy-auth clients.

Implement Windows Update for Business

Create Update rings: Pilot (0-day deferral), Broad (7/14-day deferrals), and Critical (short deadlines). Create a Feature updates policy pinning Windows 11 23H2 until readiness to move. Enable Expedited quality updates for zero-day patch capability. Why: Rings provide predictable staging; Feature updates create deterministic feature control; Expedited updates allow emergency remediation.

Optimize content with Delivery Optimization

Set Download mode to LAN for offices and Group for regions with defined Group IDs. Limit background bandwidth to 20% and cap uploads; disable peering on VPN. Why: Reduces WAN load and accelerates patch/app distribution without additional infrastructure.

Assign with groups and filters; avoid conflicts

Target policies to dynamic device groups by OS and ownership; use assignment filters to include corporate-owned only for security posture and exclude contractor-owned from UX restrictions. Consolidate settings by source (Endpoint security for security, Settings Catalog for DO/WUfB) to prevent CSP conflicts. Why: Group and filter strategy ensures precision targeting, minimal conflict risk, and clean reporting.

This approach uses Intune Endpoint security for hardened posture, compliance plus Conditional Access for access control, WUfB for controlled updates with emergency response, and Delivery Optimization for bandwidth efficiency—mapped to Contoso’s mixed ownership and multi-platform environment for reliable, scalable endpoint management.

← Device Enrollment and Azure AD Join · All domains · Application Management and Deployment →

Practice these questions → · Timed practice on ExamRoll.io →