SC-100 Certification Practice Question #50

Question

You have a Microsoft 365 subscription that contains a group named Group1. The subscription contains 1,000 Windows devices that are joined to a Microsoft Entra tenant and managed by using Microsoft Intune. All users sign in to the devices by using standard user accounts.

You plan to deploy a new app named App1 to the members of Group1. The Group1 members must have administrative rights to install new versions of App1.

You need to ensure that the Group1 members can install new versions of App1. The solution must follow the principles of Zero Trust.

What should you implement?

Accepted Answer

The requirement is to let standard users install new versions of a specific app (App1) with administrative rights while honoring Zero Trust least privilege on Intune-managed Windows devices. Intune EPM is purpose-built for exactly this: users stay standard, and approved binaries elevate just-in-time, app-scoped, time-bound, and audited — granting no standing local admin. MS Learn explicitly names "application installs" as a target task and ties EPM to Zero Trust least privilege. PIM elevates Entra directory/Azure roles (wrong plane), LAPS only manages the local administrator account password, and entitlement management handles access packages — none deliver per-app local elevation, leaving B as the clear answer.

More SC-100 practice questions