MD-102 is a modern endpoint administration exam that expects candidates to work with Windows 11, Microsoft Intune, Microsoft Entra ID, Windows Autopilot, and Windows Update for Business, rather than relying mainly on the Windows 10 deployment and Group Policy knowledge rewarded by the old MD-100 and MD-101 path.
MD-102 is the Microsoft Endpoint Administrator exam, and its value comes from testing how devices are enrolled, configured, secured, updated, monitored, and supported across a cloud-managed estate. Candidates who prepare by memorising portal screens or relying on legacy imaging habits usually find the exam harder than expected, because the modern role is built around policy-driven management, identity-aware access, and operational troubleshooting.
What MD-102 expects from modern endpoint administrators
The MD-102 skills outline on Microsoft Learn is the starting point for preparation because it reflects the current exam scope. The exam is less about isolated Windows administration and more about how an endpoint administrator uses Intune, Entra ID, Autopilot, compliance policies, app deployment, and update controls together.
This shift matters for candidates coming from desktop support, field engineering, or on-premises administration. A Group Policy-only mindset can help with Windows fundamentals, but it is insufficient for many MD-102 scenarios, where the answer often depends on enrolment state, device identity, user assignment, compliance signals, and whether the setting is delivered through Intune rather than traditional domain tooling.
Older study materials can also create confusion. References to Windows Analytics or Microsoft Store for Business should be treated as legacy context, because current preparation should align with Windows 11, Microsoft Intune, Microsoft Entra ID, Windows Autopilot, Windows Update for Business, and Windows Autopatch where relevant.
Build a lab before reading too much theory
MD-102 preparation works best when the candidate can reproduce the administrative workflow in a safe tenant. A small lab does not need to mirror an enterprise environment, but it should allow repeated practice with enrolment, policy assignment, compliance evaluation, application deployment, and update behaviour.
A useful lab starts with a Microsoft 365 test tenant, an Intune-enabled administrative account, at least one test user, and a Windows 11 virtual machine. The goal is to practise the same tasks an endpoint administrator performs in production without placing business devices or users at risk.
Create a test tenant and confirm that Intune device management is available.
Create a test user and assign the licensing required for device enrolment.
Install a Windows 11 virtual machine and take a clean checkpoint before enrolment.
Collect the Autopilot hardware hash and upload it into Intune.
Create an Autopilot deployment profile under Devices, Windows, Windows enrollment, Deployment Profiles.
Assign the profile to a device group and test the Enrollment Status Page experience.
Create a compliance policy under Devices, Compliance policies, Policies.
Create a configuration profile under Devices, Configuration, Create.
Deploy one required application and verify installation status from the Intune admin center.
Create an update ring and a feature update policy under Devices, Windows.
These steps turn the exam outline into visible behaviour. They also expose common administrative realities, such as delayed policy sync, assignment mistakes, device group timing, and the difference between a profile being assigned and a setting actually applying on the endpoint.
The Autopilot hardware hash is a practical example because it connects deployment theory with a real administrative task. In a lab VM, the following PowerShell sequence can be used to generate a CSV for Autopilot registration, provided the machine has access to the PowerShell Gallery and the administrator understands the tenant’s script execution policy.
Example — collect an Autopilot hardware hash
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
New-Item -ItemType Directory -Path C:\Temp -Force
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile C:\Temp\AutopilotHWID.csv
This creates a hardware hash file that can be uploaded in the Intune admin center for Windows Autopilot testing. The important learning point is not the command itself, but the full registration flow: collect the hash, import the device, assign a deployment profile, reset the device, and validate the out-of-box enrolment experience.
Understand Intune policy behaviour, not only policy creation
Many candidates can create a configuration profile after following a tutorial, but MD-102 preparation requires understanding what happens when multiple settings collide. In practice, administrators often deal with overlapping Settings catalog profiles, security baselines, administrative templates, compliance policies, app protection settings, and remediation scripts that all affect the same device population.
Policy precedence is one of the areas where hands-on work pays off. If a Windows 11 device receives one profile that enables a setting and another that disables it, the endpoint administrator has to identify the conflict, confirm which profile is assigned, inspect device status, and decide whether the design should be split by group, consolidated into a single profile, or changed to avoid contradictory intent.
Compliance policies deserve the same attention. A device may become noncompliant because encryption is missing, a minimum operating system version is not met, a threat signal is present, or a setting has not yet reported back after enrolment. When compliance is used with Conditional Access, a small configuration mistake can produce access problems that appear to be identity issues even though the underlying cause is endpoint state.
A practical compliance exercise is to create a Windows compliance policy that requires BitLocker, checks a minimum Windows version, and marks devices noncompliant after a defined grace period. The candidate should then review the device’s compliance status in Intune and compare it with the local state of the Windows 11 VM, because this teaches the gap between intended configuration and reported compliance.
For deeper study, Microsoft Learn should be paired with live portal practice rather than read in isolation. Candidates who want a guided structure can use the Readynez MD-102 Endpoint Administrator course as a way to connect the official objectives with lab-based administrative tasks.
Map updates to the right management model
Update management is a recurring MD-102 theme because Windows servicing is no longer a simple question of approving patches. Microsoft Learn documentation for Windows Update for Business and Windows Autopatch is useful here because it separates administrator-controlled update policies from a managed service approach.
Windows Update for Business through Intune gives administrators direct control over update rings, deferral settings, deadlines, restart behaviour, and feature update targeting. This is often the better study model for learning the mechanics, because candidates can see how update rings and feature update policies affect devices at different stages.
Windows Autopatch is different because it automates more of the ring management and operational sequencing. From a decision perspective, Windows Update for Business is usually the clearer fit when the organisation needs direct change-control design in Intune, while Windows Autopatch becomes relevant when the organisation is eligible for the service and wants Microsoft-managed ring orchestration across supported devices.
A candidate should be able to explain when an update ring controls quality update timing, when a feature update policy pins devices to a target Windows release, and why rings should be tested with pilot devices before broad deployment. The common pitfall is to create too many overlapping policies, which makes troubleshooting difficult and can leave administrators unsure which assignment created a particular restart or deadline experience.
Troubleshooting knowledge that separates memorisation from readiness
MD-102 preparation should include troubleshooting from the start rather than saving it for the final revision period. Endpoint administration often involves proving whether a problem is caused by enrolment, assignment, policy conflict, licensing, connectivity, user scope, or reporting delay.
On Windows devices, the MDM diagnostic report is one of the most useful evidence sources because it shows enrolment and policy information from the device side. Event Viewer is also important, especially the DeviceManagement-Enterprise-Diagnostics-Provider logs, which can help identify enrolment, CSP, and policy processing issues.
Enrollment Status Page failures are another practical area to test in the lab. If required applications are assigned incorrectly, network access is unavailable, or a profile is not targeted as expected, the device may stall during provisioning or complete enrolment without the intended configuration.
Intune reporting should be interpreted carefully. A failed status in the admin center is a starting point, not the full diagnosis, and a pending status may simply reflect sync timing rather than a broken configuration. Good preparation means checking the portal, the device, the assigned groups, the policy status, and the local logs before deciding on a fix.
A focused four-week MD-102 study plan
A structured plan helps candidates avoid the common mistake of reading broadly without building operational skill. Four weeks is a practical study window for candidates with Windows administration experience, although those new to Intune or Entra ID may need more lab time before attempting practice assessments.
| Study phase |
Main focus |
Practical milestone |
| Week 1 |
Exam scope, Windows 11 management, Entra ID concepts, Intune enrolment |
Create the tenant, test user, Windows 11 VM, and first enrolment. |
| Week 2 |
Autopilot, configuration profiles, compliance policies, Conditional Access relationships |
Register an Autopilot device, assign a deployment profile, and validate compliance reporting. |
| Week 3 |
Application deployment, security baselines, update rings, feature update policies |
Deploy an app, create update policies, and troubleshoot one deliberate policy conflict. |
| Week 4 |
Monitoring, troubleshooting, review of weak objectives, practice assessment |
Generate an MDM diagnostic report, review event logs, and revisit Microsoft Learn objectives. |
The plan should start and end with the Microsoft Learn exam outline because the outline is the authority for what the exam measures. Study notes should be organised around tasks rather than product names, such as enrolling devices, configuring compliance, deploying apps, managing updates, and troubleshooting policy application.
Practice tests are useful near the end of preparation, but they should not replace lab work. If a candidate misses questions on update rings, Autopilot, or compliance, the next step should be to recreate the topic in the lab and verify the behaviour rather than memorise the wording of an explanation.
Where broader Microsoft training fits
MD-102 sits inside a wider Microsoft administration skill set. Endpoint administrators often work alongside identity, security, collaboration, and cloud infrastructure teams, so familiarity with adjacent Microsoft technologies can make the MD-102 material easier to apply in a real environment.
Candidates comparing related learning options can review the broader Microsoft training catalogue or consider an unlimited Microsoft training option if they are planning several Microsoft certifications rather than a single exam. The important point is to keep MD-102 preparation anchored to endpoint administrator tasks instead of drifting into unrelated platform study.
Frequently asked questions about MD-102 preparation
Is MD-102 mainly an Intune exam?
MD-102 is not limited to Intune, but Intune is central to many of the workflows candidates need to understand. The exam also expects knowledge of Windows client management, Entra ID relationships, Autopilot deployment, application management, compliance, security, monitoring, and update management.
Does Group Policy still matter for MD-102?
Group Policy knowledge is useful background for Windows administrators, especially in hybrid environments. Even so, candidates should not treat Group Policy as the default answer for MD-102 scenarios, because the modern exam emphasis is cloud-based management through Intune and identity-aware controls through Entra ID.
What is the most useful lab task for MD-102?
The most useful lab task is a complete Windows 11 enrolment and management cycle. That means registering a device for Autopilot, applying a deployment profile, enforcing compliance, deploying an app, assigning update policies, and then troubleshooting the result from both Intune and the local device.
Turning MD-102 preparation into administrator skill
Successful MD-102 preparation is built on repetition with real configurations. Candidates should be able to explain why a device is compliant, why an app did not install, why a policy conflicted, why an update ring behaved as configured, and where to collect evidence when the portal does not tell the full story.
The most effective next step is to compare the Microsoft Learn objectives with a working Windows 11 and Intune lab, then close each knowledge gap through configuration and troubleshooting. If structured support would help, contact Readynez to discuss MD-102 preparation without losing sight of the practical endpoint administration skills the exam is designed to validate.
