Which setting of the compliance policy should you configure for each requirement?

DRAG DROP

You have a Microsoft 365 subscription. The subscription contains computers that run Windows 11 and are enrolled in Microsoft Intune.

You need to create a compliance policy that meets the following requirements:

• Requires BitLocker Drive Encryption (BitLocker) on each device

• Requires a minimum operating system version

Which setting of the compliance policy should you configure for each requirement? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

View Answer

Answer:

Explanation:

Device Compliance settings for Windows 10/11 in Intune

As part of your mobile device management (MDM) solution, use these settings to require BitLocker, set a minimum and maximum operating system, set a risk level using Microsoft Defender for Endpoint, and more.

Box 1: Device Health

Device Health

Windows Health Attestation Service evaluation rules

Require BitLocker:

Windows BitLocker Drive Encryption encrypts all data stored on the Windows operating system volume. BitLocker uses the Trusted Platform Module (TPM) to help protect the Windows operating system and user data. It also helps confirm that a computer isn’t tampered with, even if its left unattended, lost, or stolen. If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys can’t be accessed until the TPM verifies the state of the computer.

Not configured (default) – This setting isn’t evaluated for compliance or non-compliance. Require – The device can protect data that’s stored on the drive from unauthorized access when the system is off, or hibernates.

Box 2: Device Properties

Requires a minimum operating system version

Device Properties

Operating System Version

To discover build versions for all Windows 10/11 Feature Updates and Cumulative Updates (to be used in some of the fields below), see Windows release information. Be sure to include the appropriate version prefix before the build numbers, like 10.0 for Windows 10 as the following examples illustrate.

Minimum OS version:

Enter the minimum allowed version in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver.

Etc.

Reference: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows