Microsoft MD-102: Intune Administration and Governance — Study Guide

By Laurynas Brazys · 5 August 2026 · #microsoft #md-102 #certification #exam-prep #study-guide

Part of the Microsoft Endpoint Administrator Associate MD-102 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Intune administration and governance centers on least-privilege access, scoped visibility, controlled change, and repeatable configuration. Role-based access control (RBAC) and scope tags define who can do what and where. Approval workflows gate high-risk actions. Specialized connectors integrate with on-premises Active Directory for hybrid join scenarios. Education tenants use simplified flows driven by roster data. The Microsoft Intune Suite extends operational capabilities with advanced analytics, secure remote assistance, and per-app VPN. Finally, disciplined export/import and “configuration as code” practices enable tenant-to-tenant moves and business continuity.

Role-based administration, scope tags, and multi-admin approval

Use Entra ID roles to grant tenant-wide Intune privilege, and Intune RBAC to apply granular rights within Intune. The Intune Administrator role (formerly Intune Service Administrator) in Microsoft Entra ID grants full administrative control of Intune. Reserve it for platform owners. Within Intune, built-in RBAC roles grant scoped, task-specific privileges. Help Desk Operator is designed for front-line support: it can read device and user details and perform limited remote actions (for example, sync, remote lock, passcode reset), but cannot create, edit, or delete policies. Other built-in roles such as Policy and Profile Manager, Application Manager, Endpoint Security Manager, and Read Only Operator cover common responsibilities without broad elevation. Create custom roles when you must tailor permission sets beyond the built-ins; select only the permissions required and avoid grant-by-habit.

RBAC assignments pair a role with:

Administrative group (the users/admins receiving the role)
Scope (groups of devices/users the role can manage)
Scope tags (labels that limit which objects the admin can see and target)

Scope tags enforce a “slice” of the tenant. Tag your objects (apps, policies, scripts, profiles) and apply the same tags to the role assignment. An admin with a role assignment limited to scope tag “Region-EU” will only see and act on objects tagged “Region-EU.” Scope tags don’t control policy targeting; they control admin visibility and impact. Plan tags to reflect operational boundaries such as region, subsidiary, or environment (Production, Pilot). Keep a small, stable tag set, assign default tags during object creation, and periodically audit untagged objects.

Multi-admin approval (MAA) protects sensitive Intune changes by requiring a second admin to approve before the action completes. From Tenant administration, define approval policies that specify which resource types and operations are gated (for example, creating, updating, deleting, or assigning apps and policies; deploying scripts; or applying actions that affect many users/devices, such as assigning to All Users/All Devices). Assign trusted approver groups and set expiration windows for requests. Requestors can’t approve their own changes, and activity is recorded in audit logs. MAA is enforced through the Intune admin center and Graph, supporting defense-in-depth for high-impact operations and aligning with separation-of-duties requirements.

Education tenants and the Intune Connector for Active Directory

Intune for Education is a streamlined portal and policy model tailored for schools. It surfaces common device settings through simplified templates, optimizes Windows for shared use (Shared PC mode), and makes app assignment to classes straightforward. School Data Sync (SDS) ingests rosters from student information systems or CSV to create and maintain classes, teachers, and student groups in Entra ID. These dynamic groups become the backbone for device and app assignments—teachers get teacher apps; students receive curriculum apps; labs inherit kiosk or exam lockdown profiles. Integrate with Apple School Manager and Google enrollment for Apple and Android fleets respectively, and use Autopilot for rapid Windows provisioning with minimal IT touch. The education view masks complexity while preserving standard Intune underpinnings for RBAC, scope tags, and reporting.

Hybrid Azure AD join with Autopilot requires the Intune Connector for Active Directory. Install the connector on a domain-joined Windows Server with line-of-sight to domain controllers and outbound HTTPS to Intune. Autopilot hybrid uses an offline domain join (ODJ) workflow: during provisioning, Intune signals the connector to create the computer account in the target OU defined by the domain join profile, returns the ODJ blob to the device, and completes domain join. The device must be able to reach domain controllers during provisioning. Favor wired or on-premises network access during OOBE, or use Autopilot pre-provisioning to stage devices inside the network. Maintain multiple connectors for resiliency and restrict their permissions to the OU tree they manage.

Intune Suite add-ons and Microsoft Tunnel

The Microsoft Intune Suite extends Intune’s operational toolkit:

Advanced Endpoint Analytics augments core analytics with anomaly detection, deeper app reliability insights, and recommended remediations. It helps you quantify user experience, pinpoint regressions after updates, and prioritize fixes by business impact.
Remote Help provides secure remote assistance for Windows and Android Enterprise. It integrates with Intune RBAC and Conditional Access, supports in-session elevation for UAC prompts, and logs rich session telemetry for audit. Require device compliance to connect and restrict helpers to the Help Desk Operator role or a custom role.
Tunnel provides per-app VPN and “Tunnel for Mobile App Management (MAM)” for unenrolled BYOD. It enforces least-privilege network access from only managed or policy-managed apps.

The Microsoft Tunnel VPN gateway runs on Linux (Ubuntu LTS or RHEL) behind your firewall. In Intune, create a Tunnel site, generate a server configuration, and use the install script to deploy containers and services on one or more Linux servers. Use a public TLS certificate trusted by devices; open TCP 443 from the internet to the gateway; cluster multiple servers per site for high availability. Define VPN profiles in Intune that enable per-app VPN so only designated iOS/iPadOS and Android apps send traffic through the tunnel. On Android and iOS, the Microsoft Defender for Endpoint app functions as the tunnel client for both MDM-managed and MAM scenarios. Assign per-app VPN alongside app configuration and app protection policies to build a zero-trust path: compliant device, sanctioned identity, protected app, least-privilege network. For BYOD on unenrolled devices, Tunnel for MAM pairs with Intune app protection policies to deliver per-app network access without device enrollment.

Tenant migration and configuration backup

Intune has no single-button backup. Treat configuration as code and automate exports. Inventory and sequence dependencies before any tenant-to-tenant migration or DR rehearsal:

Foundational identities and connectors: Apple MDM Push Certificate (preserve the original Apple ID), Apple VPP/ASM tokens, Google Enterprise bindings, certificate connectors (PKCS, SCEP, PFX), Windows Store connections, TeamViewer or Remote Help, Tunnel sites, and the Intune Connector for AD
Core objects: scope tags, RBAC roles and assignments, filters, device categories, compliance policies, configuration profiles (settings catalog and templates), endpoint security policies, Windows Update rings and feature/quality updates, scripts, ASR and firewall baselines, Enrollment Status Page, Autopilot profiles, enrollment restrictions and tokens
Apps: Microsoft 365 Apps, store apps, LOB packages (.msi, .intunewin, .ipa, .apk or Google Play links), app configuration and app protection policies, dependencies, supersedence, and delivery optimization settings
Assignments: user/device groups and filters referenced by all of the above

Use Microsoft Graph with the Graph PowerShell SDK or automation scripts to export each policy’s JSON and associated assignments. Store exported configuration in version control and tag releases. For LOB and Win32 apps, preserve original packages; you must reupload content in the target tenant. Rebuild identity connectors first in the destination (APNs, ABM/ASM, Google, cert connectors), then import RBAC and scope tags, followed by filters, compliance, configuration, security policies, and finally apps. Recreate Autopilot profiles and ESP, export device hashes from source (or capture at OEM), and register devices to the destination tenant. Validate assignments with staged pilot groups; monitor device and app deployment status, policy conflicts, and endpoint analytics score regressions. Freeze changes during cutover and document rollback steps. Establish a recurring export schedule for ongoing backup, and include audit logs and Data Warehouse extracts to preserve operational context.

Practical Problem Scenario

Starbucks faces three challenges: segmenting admin duties across regions, securing high-risk changes, and enabling secure access to a legacy intranet from mobile devices without enrolling every phone.

Define RBAC and scope tags

Create scope tags for AMER, EMEA, and APAC. Build custom roles for App Curator and Policy Curator with only create/read/update on apps or device profiles, no delete permissions. Assign App Curator (EMEA) to the EMEA engineering admin group, scoping to EMEA device/user groups and the EMEA scope tag. This enforces least privilege and regional separation of duties.

Why: Scope tags constrain visibility to regional objects, preventing cross-region drift. Custom roles reduce blast radius compared to full Intune Administrator.

Enable multi-admin approval

In Tenant administration, create approval policies to require approval for app assignments to All Users/All Devices and for deletion of apps and device configuration profiles. Set approvers to a global Intune platform owner group and require a different approver than the requestor.

Why: Gating high-impact changes prevents accidental tenant-wide outages and supports auditability.

Deploy Microsoft Tunnel with per-app VPN

Stand up a Microsoft Tunnel site with two Ubuntu LTS servers behind a load balancer, publish TCP 443, and bind a public TLS certificate. Create per-app VPN profiles for iOS and Android that route only traffic for the Starbucks mobile ordering and HR apps. Use the Microsoft Defender for Endpoint app as the tunnel client and pair with app protection policies. For contractors’ BYOD, use Tunnel for MAM to avoid device enrollment while still enforcing per-app data protection.

Why: Per-app VPN limits network exposure to only sanctioned apps and routes just necessary traffic. Tunnel for MAM delivers secure access without managing the entire device.

Harden hybrid Autopilot join where needed

Install the Intune Connector for Active Directory on two domain-joined servers with restricted OU permissions. Configure Autopilot domain join profiles per region and require wired onboarding in corporate offices or pre-provisioning by IT.

Why: Ensures reliable offline domain join with least-privilege directory access and avoids OOBE failures due to domain reachability.

Establish configuration backup and migration readiness

Automate nightly export of policies and assignments via Microsoft Graph to a Git repository. Archive Win32 packages externally. Document and calendar renewals for APNs, VPP/ASM, and Google bindings.

Why: Source-controlled configuration and preserved app content enable rapid recovery and smooth migration, with full traceability of changes.

← Data Protection and Information Governance · All domains

Practice these questions → · Timed practice on ExamRoll.io →