MD-102 - Prepare Infrastructure for Devices (23% of the exam) - Section 1.1

Add devices to Microsoft Entra ID, including choosing a join type and planning device groups.

Choose between Microsoft Entra registration and Microsoft Entra join for a given device and ownership scenario, then join or register devices accordingly. Plan and implement device groups in Microsoft Entra ID, including dynamic group membership rules that target devices by attribute.

Microsoft Entra joinMicrosoft Entra registered devicesdevice join typedynamic group membership rulesdevice groups

Practice question for this objective

Free samplePrepare Infrastructure for Devicesmedium

You must assign a policy to every Windows device in the tenant that holds a Microsoft Entra registered state, and to no Microsoft Entra joined or Microsoft Entra hybrid joined device. Membership has to be maintained by the directory rather than by an administrator editing the group. Which dynamic device membership rule meets that requirement?

device.deviceTrustType values: AzureAd, ServerAd, Workplace

A(device.deviceTrustType -eq "AzureAd") and (device.deviceOSType -eq "Windows")
B(device.deviceTrustType -eq "Workplace") and (device.deviceOSType -eq "Windows") Correct
C(device.deviceTrustType -eq "ServerAd") and (device.deviceOSType -eq "Windows")
D(device.deviceOwnership -eq "Personal") and (device.deviceOSType -eq "Windows")

A dynamic device group selects a join type through the device trust type attribute, where Workplace means registered, AzureAd means joined and ServerAd means hybrid joined. Microsoft Entra ID records how each device obtained its identity in the device trust type attribute, and a dynamic membership rule reads that attribute directly. Registration produces the Workplace value, so the rule that filters on Workplace together with the Windows operating system type is the one whose membership resolves to registered Windows devices and is recalculated by the directory as devices are added and removed.

Why A is wrong: Tempting because the value reads like a general Microsoft Entra device, but AzureAd is the trust type recorded for a Microsoft Entra joined device, so this rule collects exactly the devices the requirement excludes.

Why B is correct: Correct because Workplace is the trust type recorded against a Microsoft Entra registered device, so combining it with the Windows operating system type resolves to registered Windows devices and to nothing else.

Why C is wrong: Wrong because ServerAd is the trust type recorded for a Microsoft Entra hybrid joined device, which is a domain joined machine given a tenant identity, and those are also excluded by the requirement.

Why D is wrong: Tempting because registered devices are commonly personally owned, but ownership is a separate attribute from trust type, so this rule would miss a registered corporate device and would collect a personally owned device that reached the tenant by another route.

See more MD-102 practice questions, answers explained.

Exam traps in Prepare Infrastructure for Devices

Answers that look right on this material and are not. Each one is a distractor from a different question in the MD-102 bank for this domain.

The membership type is settled when the group is created, so create the group with assigned membership first and then convert it to rule based membership from the group's properties afterwards.
Why it is wrong: Tempting because a security group's membership type can indeed be revisited later, but the block here is entitlement rather than the order of the steps, so the conversion would be refused for exactly the same reason.
The rule is valid because a dynamic device group evaluates the owner's attributes at the moment the device is registered and then stores the result.
Why it is wrong: Dynamic membership is recalculated as objects change rather than frozen at registration, and a device rule has no access to the owner's attributes at any point, so nothing is copied from the user object.
The join succeeds and the device is created as a Microsoft Entra registered device instead, because registration is the fallback whenever the join permission is missing.
Why it is wrong: Tempting because registration is the lighter identity state and looks like a safe degraded outcome, but there is no automatic downgrade from join to registration, and registration is a separate action with its own tenant setting.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.