Exam MD-102 topic 1 question 27 discussion

To ensure that only Android devices using Android work profiles can enroll in Intune, you should: D. From Platform Settings, set Android device administrator to Block. B. From Platform Settings, set Android Enterprise (work profile) to Allow. This configuration ensures that only devices using Android work profiles can enroll while blocking other Android devices managed by the older device administrator method.

https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set

A + B Pros: Fine-tuned, supports corp-owned admin temporarily, recommended by MS for BYOD Cons: Might allow device admin for corp-owned unless blocked separately B + D Pros: Strong block against all device admin Cons: Overkill for BYOD-only goal; breaks corp admin if still needed A + B is the best-balanced, Intune-recommended approach. People choose B + D when they want a broad, uncompromising block, or if they aren't differentiating between personal vs corporate ownership "BD" answers were valid once, but A + B is the better answer now.

Why these configurations? A. From Platform Settings, set Android device administrator Personally Owned to Block: The Android device administrator method is an older, less secure management framework. Blocking Personally Owned Android Device Administrator ensures that only Android devices enrolled using modern methods like Android Enterprise work profiles can be enrolled. B. From Platform Settings, set Android Enterprise (work profile) to Allow: Android Enterprise (work profile) is the modern management method for managing BYOD (Bring Your Own Device) Android devices. Allowing this ensures that Android devices with work profiles can be enrolled in Intune.

you can control which devices are allowed to enroll by setting device enrollment restrictions. To ensure that only Android devices that use Android work profiles can enroll in Intune, you should: Block Android device administrator Personally Owned devices: This prevents Android devices that are not using work profiles from enrolling. Allow Android Enterprise (work profile) devices: This allows Android devices that are using work profiles to enrol. A and B are the right answers.

Ther's is no "androind Personally owned" option, only Work profile and Admin

BD agreed. Also device administrator will be out of support by Microsof very soon.

BD Ref for D: https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set#blocking-personal-android-devices

In groups where both Android platforms are allowed, devices that support work profile will enroll with a work profile. Devices that don't support work profile will enroll on the Android device administrator platform. Neither work profile nor device administrator enrollment will work until you complete all prerequisites for Android enrollment.

why is it D?

Answers are 100% correct