MD-102 · Domain 4 of 5

MD-102 Domain 4: Manage and secure applications

Package and deploy Win32, line-of-business and store apps, deliver Microsoft 365 Apps during Autopilot, troubleshoot installs, and protect corporate data inside apps on managed and personal devices with app protection, configuration and Conditional Access.

Exam weight
15–20%
Official functional groups
2
Estimated questions estimate
7–10
Suggested study time estimate
14–18 hrs

About 11 min read Reviewed October 2026

Overview

Manage and secure applications has two functional groups and 12 listed skills. Deploying and updating apps covers preparing packages, deploying Win32, line-of-business and Microsoft Store apps, Quiet Time policies for Android and iOS apps, deploying and configuring Microsoft 365 Apps through Intune or the Microsoft 365 Apps admin center, including during Autopilot with the Office Deployment Tool, store apps from Apple Business Manager and Managed Google Play, and troubleshooting failed installs.

The second group covers app protection policies for enrolled and personal devices, Conditional Access that requires an app protection policy, and app configuration policies delivered through the managed device or managed app channel. Microsoft renamed this section from Manage applications to Manage and secure applications in the October 2026 update, which signals the weight placed on protecting data inside apps.

How it's tested

App questions usually describe an application format, a target platform and a delivery requirement, or a data protection goal on devices you may not manage. You choose the app type, assignment intent, deployment tool or policy channel. Watch for whether the device is enrolled, because that decides between device-based and app-based controls throughout this section.

  • Match package to app type

    An installer format and dependency needs are given, and you choose Win32, line-of-business, store or Microsoft 365 Apps deployment.

  • Protect data without enrollment

    Users bring personal phones, so you choose an app protection policy and Conditional Access instead of device compliance.

  • Configure the app

    An app needs preset settings, and you choose a managed devices or managed apps configuration policy based on enrollment.

Reasoning it through

An EXE installer needs a prerequisite runtime and must replace an older version. A line-of-business app only accepts single MSI, MSIX or APPX files and cannot express dependencies. Packaging the installer as a Win32 app with the Content Prep Tool allows a detection rule, a dependency on the runtime and a supersedence relationship that uninstalls or upgrades the previous version.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

4.1 Deploy and update appsApp preparation, Win32, LOB and Store apps, Quiet Time, Microsoft 365 Apps, store integrations and install troubleshooting.
What it means
This group covers getting applications onto devices with Intune: preparing installers, choosing among Win32, line-of-business and Microsoft Store app types, setting Quiet Time for mobile apps, deploying Microsoft 365 Apps and their policies, including during Autopilot, managing Microsoft 365 Apps from its admin center, distributing apps through Apple Business Manager and Managed Google Play, and monitoring and fixing failed installs.
What to understand
Win32 apps are wrapped into .intunewin files and support detection rules, requirements, dependencies and supersedence. Assignment intents are required, available and uninstall. The Microsoft Store app type uses the winget-based store source. Microsoft 365 Apps can deploy through the built-in app type or a Win32 package with ODT XML, and policies can come from Intune or the Cloud Policy service. Apple volume purchased apps need a location token, and Google Play apps must be approved first.
How it shows up
Expect questions on choosing the app type, ordering dependencies, deploying Office during provisioning and reading install status or logs.
Common confusion
Assuming available assignments install automatically; available apps appear in Company Portal for users to choose.
4.2 Plan and implement app protection and app configuration policiesApp protection for managed and BYOD devices, Conditional Access for protected apps and app configuration policies.
What it means
This group covers protecting corporate data inside apps rather than on the whole device, using Intune app protection policies for enrolled and unenrolled devices, requiring those policies through Conditional Access, and pushing settings to apps with app configuration policies for managed apps or managed devices.
What to understand
App protection policies control data transfer such as copy, paste and save locations, access rules such as PIN or biometrics, and conditional launch checks such as minimum OS or jailbreak detection, with selective wipe of app data. They work without enrollment. Conditional Access can require an app protection policy before granting access. Managed device configuration uses the MDM channel, while managed app configuration uses the Intune SDK and works without enrollment.
How it shows up
Scenarios ask how to stop corporate data leaking to personal apps, or how to preconfigure Outlook or another app on different device types.
Common confusion
Thinking app protection requires enrollment; it is designed to work on unenrolled personal devices too.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Win32 app

    Installer wrapped as .intunewin with full deployment logic.

    Remember
    Supports detection, requirements, dependencies and supersedence.
    Tested as
    App type selection.
    Trap
    Using a LOB app for an EXE with prerequisites.

  • Detection rules

    Checks that tell Intune whether a Win32 app is installed.

    Remember
    Wrong detection causes false failures or reinstall loops.
    Tested as
    Install troubleshooting.
    Trap
    Blaming the installer when detection is wrong.

  • Supersedence

    Relationship that updates or replaces an older Win32 app.

    Remember
    Can uninstall the previous version.
    Tested as
    App update scenarios.
    Trap
    Using dependencies for upgrades.

  • Assignment intents

    Required, available for enrolled devices, and uninstall.

    Remember
    Available apps show in Company Portal.
    Tested as
    Deployment behaviour questions.
    Trap
    Expecting available apps to auto-install.

  • Microsoft 365 Apps deployment

    Built-in Intune app type or ODT-based Win32 package.

    Remember
    Choose update channel and architecture.
    Tested as
    Office deployment and Autopilot questions.
    Trap
    Mixing architectures on the same device.

  • Cloud Policy service

    User-based Microsoft 365 Apps policies from the Microsoft 365 Apps admin center.

    Remember
    Applies even on unmanaged devices where users sign in.
    Tested as
    Office policy questions.
    Trap
    Assuming device enrollment is required.

  • Apple VPP location token

    Token linking Apple Business Manager purchased apps to Intune.

    Remember
    Enables device or user licensed app assignment.
    Tested as
    iOS and macOS store app questions.
    Trap
    Expecting store apps to sync without the token.

  • Managed Google Play

    Google store integration for Android Enterprise apps.

    Remember
    Apps must be approved before assignment.
    Tested as
    Android app deployment.
    Trap
    Searching for apps that were never approved.

  • Quiet Time policies

    Policies that mute app notifications outside working hours on mobile devices.

    Remember
    Targeted to users for Android and iOS apps.
    Tested as
    Wellbeing and notification scenarios.
    Trap
    Looking for this in device configuration profiles.

  • App protection policies

    Data, access and launch controls within managed apps.

    Remember
    Work on enrolled and unenrolled devices.
    Tested as
    BYOD data protection.
    Trap
    Requiring device enrollment for them.

  • Require app protection policy

    Conditional Access grant that permits only protected apps.

    Remember
    Blocks unprotected apps reaching Microsoft 365.
    Tested as
    Access control on mobile devices.
    Trap
    Using device compliance for unenrolled phones.

  • App configuration channels

    Managed devices uses MDM; managed apps uses the Intune SDK.

    Remember
    Enrollment state decides the channel.
    Tested as
    App preconfiguration questions.
    Trap
    Choosing managed devices for BYOD phones.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Windows app types

ConceptMeaningKey differenceCommon trap
Win32 Wrapped installer of any type Full logic: detection, dependencies, supersedence Skipping detection rules
Line-of-business Single MSI, MSIX or APPX file Simpler, fewer controls Using it for EXE installers
Microsoft Store Store app through the winget source Updates handled from the store Packaging store apps manually
Microsoft 365 Apps Built-in Office deployment app type Channel and app selection Mixing with existing Office versions

Device vs app controls

ConceptMeaningKey differenceCommon trap
Compliance policy Evaluates the whole enrolled device Needs enrollment Using it for BYOD without enrollment
App protection policy Protects data inside managed apps Works without enrollment Expecting device-level control
App configuration policy Pushes settings to apps Channel depends on enrollment Choosing the wrong channel

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. LOB for EXE

    What candidates pick
    Upload a setup.exe as a line-of-business app.
    Why it looks right
    LOB sounds like any in-house app.
    Why it's wrong
    LOB supports single MSI or app package files; EXE installers with logic need the Win32 app type.

    Clue to watch for An EXE, a script installer or dependencies.

  2. Compliance for personal phones

    What candidates pick
    Require device compliance for unenrolled personal phones.
    Why it looks right
    Compliance is the standard Conditional Access grant.
    Why it's wrong
    Unenrolled devices cannot report compliance; app protection plus the matching Conditional Access grant fits.

    Clue to watch for Users will not enroll their personal devices.

  3. Available means installed

    What candidates pick
    Assign as available and expect the app on every device.
    Why it looks right
    Assignment feels like deployment.
    Why it's wrong
    Available apps wait in Company Portal; required assignments install automatically.

    Clue to watch for The app must be present without user action.

  4. Dependency for upgrade

    What candidates pick
    Use a dependency to replace an old version.
    Why it looks right
    Dependencies link two apps.
    Why it's wrong
    Supersedence is the relationship that upgrades or replaces a previous version.

    Clue to watch for A newer version must replace an older one.

  5. Managed devices config on BYOD

    What candidates pick
    Use a managed devices app configuration policy for unenrolled phones.
    Why it looks right
    It is the first option in the wizard.
    Why it's wrong
    Without enrollment the MDM channel is unavailable; managed apps configuration through the SDK reaches the app.

    Clue to watch for Devices are not enrolled in Intune.

  6. Office policy only through Intune

    What candidates pick
    Assume Office settings need an enrolled device.
    Why it looks right
    Most Intune settings target devices.
    Why it's wrong
    The Cloud Policy service applies user-based Microsoft 365 Apps policies wherever users sign in.

    Clue to watch for Users work from unmanaged or personal Windows PCs.

Answer framework

Work through these steps when a Domain 4 scenario asks how to deliver or secure an app.

  1. Identify the installer format and platform, then choose Win32, line-of-business, Store, Microsoft 365 Apps or a platform store integration such as VPP or Managed Google Play.
  2. Decide the assignment intent, and add detection rules, requirements, dependencies and supersedence where the app type supports them.
  3. For Microsoft 365 Apps, choose the built-in type or an ODT package, and decide whether settings come from Intune or the Cloud Policy service.
  4. Check enrollment state: enrolled devices can use device controls, while personal devices need app protection and managed apps configuration.
  5. Close the access gap with Conditional Access requiring an app protection policy, then monitor install status and logs to fix failures.

Practice question

Employees use personal iPhones that are not enrolled in Intune to read work email in Outlook. Security wants to stop users copying email content into personal apps and to block any mail client that lacks Intune protection. What should you implement?

Want more like this? The MD-102 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with Windows app packaging because it generates many scenario questions. Wrap a simple EXE installer with the Content Prep Tool, deploy it as a required Win32 app with a file or registry detection rule, then add a dependency and a superseding version. Break the detection rule on purpose and watch the result in Intune and the Intune Management Extension logs.

Next, deploy Microsoft 365 Apps twice: once with the built-in app type and once with an ODT configuration file, and include it in an Autopilot test with the ESP. Open the Microsoft 365 Apps admin center and create a Cloud Policy configuration.

Finish with mobile apps. Connect Managed Google Play and review Apple VPP token steps. Create an app protection policy for Outlook on unenrolled devices, then a Conditional Access policy requiring it, and test copy and paste behaviour on a phone. Review both app configuration channels before attempting practice questions.

FAQ

How much of MD-102 is Domain 4, Manage and secure applications?

Manage and secure applications is weighted 15–20%, with two functional groups covering 12 listed skills on app deployment and app-level protection.

Why did the section name change?

In the 27 October 2026 update Microsoft renamed Manage applications to Manage and secure applications. The change log marks the section itself as unchanged, with minor edits to the deploy and update apps group.

When should I use a Win32 app instead of a line-of-business app?

Use Win32 for EXE installers, scripts, multi-file packages, or whenever you need detection rules, dependencies or supersedence. Line-of-business suits single MSI or app package files.

How can I deploy Microsoft 365 Apps during Autopilot?

Assign Microsoft 365 Apps as a required app, using the built-in app type or a Win32 package with an ODT configuration file, and track it on the Enrollment Status Page.

Do app protection policies need device enrollment?

No. They protect data inside supported apps on enrolled and unenrolled devices, which makes them the main control for personal phones.

What is the difference between the two app configuration types?

Managed devices configuration is delivered through MDM to enrolled devices. Managed apps configuration is delivered through the Intune App SDK and works without enrollment.

Where do I start troubleshooting a failed Win32 install?

Check the device and user install status in Intune, then review the Intune Management Extension logs on the device and verify the detection rule matches what the installer creates.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered Win32 and store app deployment, Microsoft 365 Apps and app protection for managed and personal devices. Test your app decisions against timed scenarios.

Take the MD-102 practice test Check your MD-102 readiness

Keep going