You have a Microsoft 365 subscription. All devices run Windows 10.
You need to prevent users from enrolling the devices in the Windows Insider Program.
What two configurations should you perform from the Microsoft Intune admin center? Each correct answer is a complete solution.
NOTE: Each correct selection is worth one point.
To prevent users from enrolling their devices in the Windows Insider Program through Microsoft Intune, you need to configure a custom device configuration profile and a Windows 10 and later update ring. A custom device configuration profile allows you to define specific settings and restrictions that are not available in the standard device restriction profiles, including settings for managing preview builds. The Windows 10 and later update ring helps you control the Windows update settings, including whether or not to allow pre-release builds, which is essential in managing Insider Program enrollments.
Given answers are correct. Ref: https://learn.microsoft.com/en-us/windows-insider/business/manage-builds#set-up-insider-preview-builds-using-intune Ref: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-Update?WT.mc_id=Portal-fx#managepreviewbuilds
I think it should be A and D. A. Device restrictions device configuration profile: You can use this profile to enforce specific settings on Windows 10 devices, including preventing enrollment in the Windows Insider Program. D. Custom device configuration profile: Creating a custom device configuration profile allows you to define specific settings and restrictions for your Windows 10 devices, including preventing enrollment in the Windows Insider Program.
To prevent users from enrolling their devices in the Windows Insider Program using Microsoft Intune, you should perform the following two configurations from the Microsoft Intune admin center: A. Create a device restrictions device configuration profile: This profile allows you to enforce restrictions and settings on Windows 10 devices. You can use this to prevent users from joining the Windows Insider Program. E. Create a Windows 10 and later update ring: By configuring an update ring, you can control the release of Windows updates to devices. By setting the update ring to a stable release channel, you can prevent users from receiving Insider Preview builds, which are part of the Windows Insider Program.
Device restriction: no windows update reference, so no Insider App policy has no business here Security baseline has no Insider setting Custom profile: CSP/OMA-RUI for Update/ManagePreviewBuilds Update ring: "Enable pre-release builds" So, DE is correct
DE. It is not in Device Restrictions. It is Configuration -> Setting Catalog -> Windows Update for Business -> Manage Preview Builds. This option is not there. So its D and E.
A. Create a device restrictions device configuration profile E. Create a Windows 10 and later update ring
DE is correct.
A and E. To prevent users from enrolling their devices in the Windows Insider Program using Microsoft Intune, you can perform the following configurations: Device Restrictions Device Configuration Profile: This configuration allows you to set up restrictions on the devices. You can create a device restrictions profile in Intune to control features on enrolled devices. Windows 10 and Later Update Ring: This configuration allows you to manage when Windows 10 updates are received by devices in your organization. You can create an update ring in Intune to specify how and when updates are delivered to devices
A : If you set Telemetery to required in Device Restrictions, they cannot get preview builds as it needs Optional Telemetery. E: Use update ring to block preview builds. Source: I just implemented this last week.
A, E proven, update ring can set to not configured in case someone already enrolled device restrictions. to block access to update settings
A device restrictions device configuration profile (Option A): Create a device restrictions policy targeting Windows 10. In the settings, navigate to General and set Enable Preview Builds to Blocked to prevent devices from being enrolled in the Windows Insider Program. A Windows 10 and later update ring (Option E): Create a Windows 10 update ring policy. In the Settings section, under Update Settings, set Enable Preview Builds to Not Allowed to ensure that devices do not install preview builds from the Windows Insider Program.
A. a device restrictions device configuration profile E. a Windows 10 and later update ring
D can be used in two ways either with a custom setting and OMA-URI or using the settings catalog /Windows Update for Business/Manage Preview Builds. Nothing found under Device Restrictions
Option A,C
seems correct
custom is almost legacy as it requires OMA-URI, always the last resort
I would go for A and D.
DE Ref: https://www.petervanderwoude.nl/post/managing-windows-insider-preview-builds-within-the-organization/
The 30 days represents an upgrade of Windows Version through a feature update not a standard feature update
A. Device restrictions device configuration profile: This profile allows you to restrict access to specific features and settings on devices. Under "Windows Feature Experience", configure "Allow access to diagnostic data in the Windows Insider Program" to "Block". E. Windows 10 and later update ring: Update rings control which updates devices receive through Intune. Create a new update ring with the "Update channel" set to "None (security updates only)". Assign this update ring to the devices you want to prevent from joining the Insider Program.
A device restrictions device configuration profile allows you to control various settings on Windows 10 devices, including preventing users from enrolling in the Windows Insider Program. A Windows 10 and later update ring allows you to control the update behavior of Windows 10 devices, including specifying which updates and builds are installed on the devices. By configuring this, you can prevent users from accessing preview builds, which are part of the Windows Insider Program.
A and E are correct
A and E To prevent access to the Windows Insider Program, the most appropriate configurations are likely: A. A device restrictions device configuration profile: This can be used to set device restrictions, including blocking access to certain system settings that could allow users to enroll in the Insider Program. E. A Windows 10 and later update ring: This can be configured to control the type of updates that devices receive, including limiting updates to stable releases and excluding Insider builds. So, the correct answers should be: A. A device restrictions device configuration profile and E. A Windows 10 and later update ring.
To prevent users from enrolling devices in the Windows Insider Program, you can use a combination of a device restrictions configuration profile and a Windows 10 and later update ring in Microsoft Intune. The device restrictions profile allows you to explicitly disable access to features like the Windows Insider Program, ensuring users cannot enable pre-release builds. Additionally, the update ring policy can enforce update settings that block devices from downloading and installing Insider builds. These two configurations work together to provide comprehensive control over update management and prevent unauthorized enrollment in pre-release Windows programs, minimizing administrative effort and ensuring compliance with organizational policies.
This allows you to disable access to the Windows Insider settings in the Settings app, preventing users from enrolling in the program. E. A Windows 10 and later update ring In Intune, you can configure an update ring to control Windows Update settings, including preventing devices from receiving Windows Insider builds.
DE are the only ways I can see in intune, in device restrictions there's no windows update options to select, but can in settings catalog, which is not an option here. In custome device config you can use following Name: Block Windows Insider Program OMA-URI: ./Vendor/MSFT/Policy/Config/Update/AllowBuildPreview Data type: Integer Value: 0 (to disable)
A and E is correct