Exam MD-102 topic 1 question 272 discussion

Full Cloud PC management (including provisioning policy creation and deletion). Also includes sufficient Intune permissions to manage apps and policies related to Cloud PCs.

Chatgpt said C but Deepseek said E its said its not C bcoz, Cloud PC Administrator Role: While this role allows managing Cloud PC provisioning policies, it does not cover the permissions needed for creating and assigning apps and policies in Intune.

The Cloud PC Administrator role provides the necessary permissions to create, assign, and delete Windows 365 Cloud PC provisioning policies. This role also includes the ability to manage apps and policies in Intune, which covers the requirement to create and assign apps and policies to users and devices. By assigning this built-in role, you minimize administrative effort as you don't need to create a custom role. The Cloud PC Administrator role follows the principle of least privilege by granting only the permissions needed for Admin1's specific tasks without providing unnecessary access to other areas of the system.

I was wonder whether it's D sound like we can tailor-made the permissions to Admin1 needs to perform those tasks, without granting excessive access....

Should be C in my opinion. E would be ideal and the best way but the question states that it should minimize admin effort. Creating a custom role does not fulfill that requirement. In that case we can also remove D. That leaves A / B / C. Helpdesk role can assign apps and policies to users but it CAN'T create apps and policies, which is a requirement. Cloud PC Reader has only read access as the name suggest, can't creat anything. That leaves Cloud PC Administrator, hence answer should be C. https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control#roles

Custom indeed is a solution but that requires more effort. If you assign the cloud administrator it will cover the required action at thesame time principle of least privilege plus minimize admin effort.

Answer is correct "E". Cloud PC admin doesn't have the capability to assign applications. https://learn.microsoft.com/en-us/windows-365/enterprise/role-based-access

https://learn.microsoft.com/en-us/mem/intune/fundamentals/role-based-access-control None of the built in roles can satisfy both requirements, answer is correct