Exam MD-101 topic 3 question 42 discussion

Actual exam question from Microsoft's MD-101

Question #: 42
Topic #: 3

You have a Windows 10 device named Device1 that is joined to Active Directory and enrolled in Microsoft Intune.
Device 1 is managed by using Group Policy and Intune.
You need to ensure that the Intune settings override the Group Policy settings.
What should you configure?

A. a device configuration profile
B. an MDM Security Baseline profile
C. a device compliance policy
D. a Group Policy Object (GPO)

Show Suggested Answer

Suggested Answer: A 🗳️
Creating the policy -
Let's create a new policy in Intune to control the GP vs. MDM winner
1. Navigate to portal.azure.com and locate Intune
2. Select ג€Device configuration ֳ Profiles ֳ Create profileג€
3. Under Platform select Windows 10 and later
4. Under Profile type select ג€customג€ and ג€addג€
5. Name the custom setting with something intuitive
6. For OMA-URI add the policy OMA-URI string: ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP
7. For Data type select Integer and add the number
Note: The following describes which policy wins according to Windows 10 version.
Windows 10 versions 1709 and earlier Group Policy will override MDM policies, even if an identical policy is configured in MDM.
Windows 10 version 1803 and beyond there is a new Policy CSP (configuration service provider) setting called ControlPolicyConflict that includes the policy of
MDMWinsOverGP, where the preference of which policy wins can be controlled, i.e. Microsoft Intune MDM policy.
Note 2: the ControlPolicyConflict policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy
(GP) are set on the device.
Reference:
https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict https://uem4all.com/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/

by Dong1999 at July 10, 2021, 10:20 a.m.

Comments

Submit Cancel

Dong1999

Highly Voted 3 years, 10 months ago

Given answer A is correct. Creating the policy Let’s create a new policy in Intune to control the GP vs. MDM winner Navigate to portal.azure.com and locate Intune Select “Device configuration à Profiles à Create profile” Under Platform select Windows 10 and later Under Profile type select “custom” and “add” Name the custom setting with something intuitive For OMA-URI add the policy OMA-URI string: ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP For Data type select Integer and add the number 1

upvoted 26 times

...