Microsoft MD-102: Remote Management and Monitoring — Study Guide

By Laurynas Brazys · 5 August 2026 · #microsoft #md-102 #certification #exam-prep #study-guide

Part of the Microsoft Endpoint Administrator Associate MD-102 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Remote management and monitoring in Microsoft Intune centers on three pillars: precise device control, deep observability, and efficient support. Administrators must understand how remote actions affect user data and enrollment, how to obtain actionable insights from Endpoint analytics and Intune reports, and how to troubleshoot provisioning and compliance issues rapidly using Remote Help, diagnostics, and audit logs. Automation through Intune-delivered PowerShell scripts rounds out a complete operational toolkit.

Remote device control: retire, wipe, sync, restart, and remote lock; and data lifecycle

Remote actions are executed from the Intune admin center per device (or in bulk) and delivered via the platform push channel (WNS for Windows, APNs for iOS/iPadOS, FCM for Android). If a device is offline, actions queue until the next check-in.

Retire (selective wipe): Removes corporate footprint while preserving personal data. It unenrolls the device from Intune, removes the MDM management profile, deletes managed app data, revokes managed certificates and Wi-Fi/VPN profiles, and removes installed LOB/Win32 apps deployed as required. The OS and user-installed apps remain intact. Retire is the correct choice to remove corporate data without factory resetting the device.
Wipe (full wipe/factory reset): Restores the device to factory state, removing all user and corporate data. This is used for lost/stolen corporate devices, repurposing, or disposal. Platform-specific options can alter behavior on Windows (for example, options to persist provisioning packages or to keep enrollment state/user account in certain scenarios), but by default Wipe is a factory reset that removes the device from Intune and all local data.
Sync: Triggers an immediate device check-in to fetch policy, app, and compliance updates and to expedite pending actions. If the device is offline, the command is received at the next connectivity window.
Restart: Initiates a user-notified restart on supported platforms (e.g., Windows 10/11). Windows provides a short countdown, allowing for a graceful reboot to complete software installs or policy changes that require a restart.
Remote lock: Immediately locks the device screen, requiring the current passcode/password to unlock. It’s useful when a device is unattended or potentially at risk but not confirmed lost. (Passcode reset is a separate action on iOS/iPadOS.)

Selective wipe vs full wipe:

Selective wipe (Retire) preserves personal data and OEM apps, removing only corporate content, management profiles, and managed app data.
Full wipe (Wipe) factory-resets the device, erasing all data and settings. For corporate-owned devices, this is the most secure reset path.
Delete device record: Deleting a managed device from Intune removes it from the tenant inventory. For MDM-enrolled devices, if the device later checks in, the effect mirrors a retire by removing corporate data while leaving personal data intact (aligning with the need to remove Intune-provisioned content if a long-offline device reappears). Deletion also immediately cleans up the admin inventory view.

Use retire or delete when you want corporate data removed while preserving user data; use wipe when the endpoint must be reset to factory state.

Remote Help, auditability, and diagnostics

Remote Help provides secure, compliant remote assistance tightly integrated with Intune and requires a Remote Help license (included in the Intune Suite or as an add-on). It supports Windows 10/11 and Android Enterprise. Sessions are brokered over HTTPS, gated by Microsoft Entra ID, and enforce role-based access control so you can scope who can help which devices.

Key aspects:

Role separation and RBAC: Define who can request help and who can provide it. Scope helpers to device groups and limit elevation permissions. Integration with Conditional Access lets you require compliant devices and MFA.
Security and user consent: A just-in-time security PIN and user consent protect end users. Both parties see verified helper identity. Session activity is auditable.
Admin elevation: On Windows, helpers can request elevation to perform admin tasks when permitted by policy, reducing time-to-resolution for privileged actions.
Logging and oversight: Remote Help produces session logs visible in Intune reports to support compliance and investigations.

Diagnostics at scale:

Collect diagnostics (remote action): For Windows 10/11, Intune can remotely gather device diagnostics (IME logs, event logs, registry exports, MDM diagnostics, and other artifacts) into a ZIP available on the device pane. This accelerates triage without relying on user participation.
Audit logs: Tenant administration audit logs capture who did what, when, and to which object (for example, app assignment changes, policy edits, remote actions). Retention is typically 30 days in the portal; for longer retention and analytics, use Azure Monitor diagnostics settings to stream to Log Analytics/Event Hub/Storage.

Analytics and reporting: Endpoint analytics and Intune reports

Endpoint analytics delivers proactive insights to improve user experience and reduce support calls.

Startup performance: Measures boot and sign-in times to produce a startup score per device model and OS build. It highlights regressions after policy or driver changes and recommends targeted remediation.
App reliability: Surfaces app hangs/crashes for prevalent Win32 and Microsoft 365 Apps processes. It identifies problematic versions and outlier devices to guide patching or configuration changes.
Work from anywhere (WfA) score: Assesses device readiness for modern, remote work across core dimensions such as cloud identity (Entra ID), cloud management (Intune MDM), Windows version currency, update status, and provisioning readiness. Scores are accompanied by prioritized recommendations to close gaps.
Prerequisites: Enable Endpoint analytics in Intune. Windows 10/11 Pro/Enterprise devices enrolled in Intune (or co-managed via Configuration Manager tenant attach) automatically provide signals via the Intune management extension and OS telemetry channels required by the feature. Insights are near-real-time but optimized for trend analysis.

Intune reports provide operational and compliance visibility:

Device compliance: View per-device and per-policy status with reasons (e.g., password not compliant, BitLocker off, jailbreak detected). Use filters to find noncompliant devices, export to CSV, and trigger remediation or retire actions.
App install status: Monitor required and available apps per assignment with states like Installed, Failed, Not applicable, and In progress. Dependency chains and supersedence relationships are reflected, enabling validation that prerequisite apps installed (for example, ensuring App1 is installed before App2).
Configuration profile status: Review success, error, conflict, not applicable, and pending states. Per-setting status pinpoints which OMA-URI or template setting failed, accelerating root-cause analysis (conflicts, CSP not supported on OS build, or scope tag misalignment).

Windows Autopilot deployment monitoring and troubleshooting

Windows Autopilot streamlines provisioning and requires accurate device registration, correct profile assignment, licensing, and network readiness.

Deployment status and the ESP: The Enrollment Status Page (ESP) displays device and account setup progress, blocking the desktop until required apps/profiles are installed. Configure ESP to collect deployment logs on failure and to allow log collection at OOBE. This enables support engineers to gather Autopilot and MDM diagnostics without local admin access.
Common causes of failed enrollments:
- Device not registered or assigned: Ensure hardware hashes are imported and the device is a member of the correct dynamic group (e.g., using devicePhysicalIds with ZTDID). Confirm an Autopilot profile is assigned and targeted.
- Licensing and enrollment restrictions: Verify the user and tenant have Intune licenses, and enrollment restrictions permit the platform and join type.
- Network/proxy issues: Open required endpoints and ports for Autopilot, Intune MDM, and content delivery. Transparent proxies and SSL inspection can break OOBE flows.
- Policy/app timeouts: Large Win32 apps or misconfigured dependencies can exceed ESP timeouts. Adjust ESP blocking behavior and ordering, and use Win32 dependency rules to ensure prerequisite installs.
Troubleshooting toolkit:
- Autopilot diagnostics page during OOBE (when enabled by ESP) for step-level failures and event links.
- MDMDiagReport and IME logs for policy ingestion and Win32 app processing (for example, C:\Windows\Temp\MDMDiagReport.zip and C:\ProgramData\Microsoft\IntuneManagementExtension\Logs).
- Intune device pane for real-time status of profile and app assignments and failure codes.

Automation with PowerShell scripts in Intune

PowerShell scripts in Intune are executed by the Intune Management Extension (IME) on Windows 10/11 and support Azure AD joined and Hybrid Azure AD joined, MDM-enrolled devices. Azure AD registered-only devices are not supported for script deployment.

Key behaviors and settings:

Targeting and context: Assign scripts to devices or users. Run in system or user context depending on need (system for machine configuration, user for profile-level actions).
64-bit host: Choose to run in 64-bit PowerShell on x64 devices to avoid WOW64 redirection issues; otherwise scripts run in 32-bit host.
Logged-on credentials: When set to Yes, scripts execute under the interactive user for per-user configuration. When No, they run under LocalSystem.
Signature enforcement: You can enforce a signature check to require signed scripts; otherwise, IME invokes scripts with an execution policy that permits unsigned content.
Frequency and retry: Scripts can run once or at every check-in (use sparingly). IME retries transient failures; write idempotent scripts that safely re-run and use clear exit codes and logging.
Size and content: Script size is limited (keep under a few hundred KB). Avoid interactive prompts and UI; scripts run non-interactively. Use robust logging to file and Windows Event Log to support diagnostics.
Best practices: Use detection logic to prevent unnecessary changes, validate prerequisites (OS build, presence of apps), and prefer Win32 app packaging for complex installers where detection rules and dependencies are needed.

Practical Problem Scenario

Adobe needs to improve remote support and reliability across 6,000 Windows 11 laptops used by a hybrid workforce, reduce failed Autopilot enrollments for new hires, and ensure corporate data can be removed quickly from devices that go missing offline.

Enable Endpoint analytics and establish baselines

Action: Turn on Endpoint analytics in Intune and assign it to all Windows devices. Review Startup performance, App reliability, and Work from anywhere scores by model and region.
Why: This surfaces systemic issues (slow sign-ins, crashing apps, OS version gaps) and provides prioritized recommendations, enabling data-driven remediation rather than ad-hoc support.

Implement Remote Help with RBAC and Conditional Access

Action: Assign Remote Help licenses to support engineers, scope them with Intune RBAC to regional device groups, and enable elevation in policy. Enforce MFA and compliant-device access via Conditional Access.
Why: Remote Help shortens time-to-resolution, supports admin-elevated tasks securely, and produces auditable session records tied to Entra ID identities.

Harden data lifecycle with the correct remote actions

Action: Standardize use of Retire for selective wipe when employees leave or devices are repurposed; use Wipe for lost/stolen corporate devices. For long-offline assets, use Delete to immediately remove inventory objects while ensuring corporate data is removed if the device later checks in.
Why: This preserves user data when appropriate, ensures corporate data is purged, and keeps the device inventory accurate.

Monitor and fix Autopilot failures with ESP diagnostics

Action: Configure the Enrollment Status Page to block until required apps are installed and to allow log collection on failure. Validate dynamic group rules (using ZTDID), profile assignments, and network egress. Break down large app payloads with Win32 dependencies and adjust ESP timeouts.
Why: ESP visibility plus diagnostics reduces no-output failures at OOBE, while proper app dependency design prevents timeouts and ensures deterministic provisioning.

Deploy remediation with Intune PowerShell scripts

Action: Use device-context PowerShell scripts (64-bit host) to remediate specific misconfigurations discovered by Endpoint analytics (for example, disabling problematic startup items, fixing registry-based policy drift). Write idempotent scripts with robust logging and run-once configuration.
Why: Scripts provide fast, targeted fixes without waiting for full app packaging cycles, and running in system context ensures machine-level settings apply reliably.

Establish operational reporting and auditing

Action: Use built-in Intune reports to track device compliance, app install status, and configuration profile success. Forward Intune audit logs to Azure Monitor for long-term retention and dashboards.
Why: Consistent reporting surfaces drift and failures quickly, while audit logs provide accountability for configuration changes and remote actions across a global support team.

← Windows Lifecycle and Update Management · All domains · Data Protection and Information Governance →

Practice these questions → · Timed practice on ExamRoll.io →