Exam MD-102 topic 1 question 22 discussion

there is no option, You have to modify assignments

I will go for A

A. Assignments: You already assigned the profile to Group1. Changing this would affect both devices unless you remove Group1 and assign Device1 directly, which increases administrative effort. B. Settings: These define what the profile does, not who it applies to. C. Scope (Tags): Used for RBAC (role-based access control), not for targeting devices.

Since Profile1 is assigned to Group1 (which includes both Device1 and Device2), modifying the applicability rules is the best way to ensure that the profile applies only to Device1 without changing the group membership. How Applicability Rules Work in Intune Applicability rules allow you to filter which devices receive a configuration profile based on OS edition, OS version, or device model. This means that even though Profile1 is assigned to Group1, it will only apply to Device1 if it matches the criteria set in the applicability rules.

LAB Experience: on Assignments tab, you can assign device 2 to another group and add that group to excluded groups.

Use a filter in Assignments.

The correct answer is D. Applicability Rules. Here's why: Applicability Rules allow you to define specific conditions under which a configuration profile should apply to devices. In this scenario, you can create an applicability rule that targets Device1 specifically, ensuring that Profile1 only applies to this device. Here's how you can create an applicability rule: Go to the Applicability Rules tab in your configuration profile. Click Add. Choose the appropriate condition, such as Device Name. Set the condition to match the name of Device1. Save the rule. With this rule in place, Profile1 will only be applied to Device1, even though it's assigned to a group that contains both devices.

The answer is A.

Scopes is for administrative restriction for configuration NOT for assigment to a device of user (group).

If you want to filter and assign to specific device/user in the group then need to use filter which is under assignments.

in Assignments we can use filter to exclude some members from groups

The correct answer is D: The question clearly states that the profile1 is only assigned to a group1, that contains 2 windows devices. To ensure that a device configuration profile applies to only one specific device within a group, such as applying Profile1 to Device1 only, you should use "Applicability Rules" - A: Assignments determine which groups receive the configuration profile. If Profile1 is assigned to Group1, both Device1 and Device2 will receive the profile. You cannot use assignments alone to target a single device within a group.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/scope-tags Assignments

The "Filter" option in Assignment section can be used to accomplish what the question is asking.

applicability rules would not make it.

Applicability rules Applies to: Windows 11 Windows 10 Applicability rules allow administrators to target devices in a group that meet specific criteria. For example, you create a device restrictions profile that applies to the All Windows 10/11 devices group. And, you only want the profile assigned to devices running Windows Enterprise.

To ensure that Profile1 applies only to Device1 within Group1, you need to modify the assignments to target only Device1. This can be done by creating a separate Azure AD group that contains only Device1 and then assigning Profile1 to that new group. Therefore, the correct answer is: A. Assignments