nerdexam
Microsoft

MD-102 · Question #588

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets…

The correct answer is B. No. The proposed solution to add User1 to the BitLocker recovery key readers role will not allow User1 to rotate BitLocker recovery keys using Intune.

Submitted by dimitri_ru· Apr 18, 2026Manage and maintain devices

Question

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 E5 subscription. The subscription contains devices that are Microsoft Entra joined and enrolled in Microsoft Intune. You create a user named User1. You need to ensure that User1 can rotate BitLocker recovery keys by using Intune. Solution: From the Microsoft Entra admin center, you assign the Cloud Device Administrator role to User1. Does this meet the goal?

Options

  • AYes
  • BNo

How the community answered

(39 responses)
  • A
    31% (12)
  • B
    69% (27)

Why each option

The proposed solution to add User1 to the `BitLocker recovery key readers` role will not allow User1 to rotate BitLocker recovery keys using Intune.

AYes

Adding a user to the `BitLocker recovery key readers` role only provides read access to the keys, not the ability to rotate them, which is a separate administrative or automated function.

BNoCorrect

The `BitLocker recovery key readers` role in Microsoft Entra ID grants permission to view stored BitLocker recovery keys, but it does not provide the capability to initiate or perform key rotation actions. Key rotation in Intune is typically an administrative device action or an automatic process, not a self-service function granted by this reader role.

Concept tested: BitLocker key rotation permissions

Source: https://learn.microsoft.com/en-us/mem/intune/protect/bitlocker-recovery-keys-view

Topics

#BitLocker key rotation#Intune RBAC#Microsoft Entra roles#Device enrollment

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full MD-102 Practice