You have a Microsoft 365 E5 subscription and 100 unmanaged iPad devices.
You need to deploy a specific iOS update to the devices. Users must be prevented from manually installing a more recent version of iOS.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
To deploy a specific iOS update and prevent users from manually installing a more recent version, you need to follow two primary steps. First, create a device configuration profile which allows administrators to manage and enforce configuration settings on the enrolled devices. Second, enroll the devices in Microsoft Intune using Apple Business Manager (ABM). This is essential because only devices enrolled via ABM can be supervised, which is required for managing updates and enforcing restrictions on manual installations.
Correct. You need to create a configuration profile to avoid users running the update. Also, with the Apple Business Manager you can install a specific iOS Version manually to the device.
Stupid question. You can set iOS update policy ONLY on SUPERVISED devices, so yes, ABM is required. iOS update policy is REQUIRED to define the exact update to have, but does not block you to update manually, for that you need a Device restriction policy in place. That also blocks the user up to 90 days only, after that user can install update manually again.
AE seems correct
Compliance or app provisioning is irrelevant. To manage updates, you need device configuration profile so that's a given. Enrollment is required though you need to via ABM to manage updates ref: https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios
A and E https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios
The answer is correct. However it sucks for users since they need to reset their device.
AE is correct https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios
Config profiles sill allow you to prevent user from updating for up to 90 days but it will not deploy specific updates or versions. to deploy specific updates or versions, you must create an iOS update policy but this is not one of the answer choices however, the only way to achieve either of the other 2 steps, the device MUST be supervised and the ONLY way a device can be is if it is enrolled via ABM. Devices enrolled via company portal are NOT supervised.
https://download.microsoft.com/download/e/6/2/e6233fdd-a956-4f77-93a5-1aa254ee2917/msft-intune-enrollment-options.pdf https://learn.microsoft.com/en-us/mem/intune/fundamentals/deployment-guide-enrollment-ios-ipados Device enrollment with Company Portal: This option is a typical enrollment in the Company Portal app for personal devices. The device is managed, not just specifics apps or features. With this option, consider the following information: You can deploy certificates that apply to the whole device. Users must install updates. Only devices enrolled using Automated Device Enrollment (ADE) can receive updates using MDM policies or profiles. A user must be associated with the device. This user can be a device enrollment manager (DEM) account.
Correct
Create a device configuration profile, to configure settings on the devices, preventing users from manually installing a more recent version of iOS. Enroll using Apple Business Manager to manage the devices and deploy the iOS update.
Configure defer software update in Configuration profiles, but iOS need to be enrolled via Intune company portal.