MD-102 Microsoft Endpoint Administrator Exam in 2026: Outline, Weights, and Preparation

The MD-102 exam validates skills for administering managed Windows endpoints with Microsoft Intune and related Microsoft technologies. It is especially relevant for an endpoint administrator moving a mixed Windows estate to Windows 11, enrolling devices through Intune, reducing manual imaging before a hardware refresh, and managing deployment, policy, updates, compliance, applications, and security.

MD-102 is the Microsoft Endpoint Administrator exam for the Microsoft 365 Certified: Endpoint Administrator Associate credential. It validates the ability to manage Windows client devices using Microsoft Intune, Windows Update for Business, Windows Autopilot, Microsoft Entra ID, compliance policies, application management, and endpoint security controls.

What the MD-102 exam validates

The exam is aimed at administrators who manage Windows devices after they leave the box and before they are retired from service. That includes enrolment, configuration profiles, security baselines, app deployment, update policies, compliance evaluation, monitoring, and remediation. In practice, the role sits between traditional desktop administration and cloud-first endpoint operations.

The current terminology matters. MD-102 preparation should be framed around Windows 11, Microsoft Intune, Microsoft Entra ID, Windows Autopilot, and Windows Update for Business. Legacy skills such as Group Policy, imaging, and Configuration Manager knowledge may still help in hybrid environments, but the exam increasingly rewards the ability to administer endpoints through cloud-managed policy, reporting, identity, and security controls.

Registration is handled through the official Microsoft exam experience, where candidates can confirm exam delivery options, current pricing, available languages, accessibility accommodations, and the passing requirements shown at the time of scheduling. The exam page is also the source of truth for retirement notices or blueprint changes, so it should be checked before a study plan is finalised.

MD-102 is a strong fit when daily responsibilities centre on Windows client devices and endpoint management. By contrast, MS-102 is aimed at tenant-wide Microsoft 365 administration, while SC-200 is more appropriate for security operations analysts working with detection, investigation, and response. That distinction helps candidates avoid preparing for an exam that sounds adjacent but measures a different operating role.

MD-102 skills measured and how the weights translate into work

Microsoft publishes the detailed MD-102 skills outline as a PDF from the exam page. The table below summarises the major domains and turns each one into a practical preparation focus. The weights show relative emphasis, but they should not be treated as a question-count forecast because Microsoft scoring is scaled and the live exam form can vary.

The largest domain is device management, maintenance, and protection, which reflects how endpoint administrators spend much of their time after initial deployment. A candidate who can build an Autopilot profile but cannot interpret update compliance, security baseline conflicts, stale device records, or failed app installations will be underprepared for both the exam and the role.

A common preparation gap is relying too heavily on older administration patterns. Group Policy and Configuration Manager remain relevant in many estates, but MD-102 expects comfort with Intune-native profiles, Microsoft Entra join and hybrid join implications, assignment filters, security baselines, attack surface reduction rules, reporting, and cloud-based device actions. The exam is less about memorising console locations and more about understanding which management control fits the scenario.

Deployment, Autopilot, and enrolment

Deployment questions often test more than the first-run experience. Candidates need to understand how devices become known to the tenant, how users are assigned to devices, what Autopilot profiles control, how enrolment status is monitored, and what happens when a deployment does not complete as expected. Microsoft’s Windows Autopilot documentation is useful here because it explains the registration and provisioning model behind the console options.

In a lab, the useful exercise is not simply creating an Autopilot profile. The stronger exercise is to follow the device from registration to usable desktop, then compare the expected state with what Intune reports. This exposes problems that exam scenarios frequently describe indirectly, such as a missing assignment, an unexpected join type, an enrolment restriction, or a policy that does not apply because the device is outside the intended scope.

Updates, rings, and servicing decisions

Windows Update for Business is one of the areas where practical judgement matters. Update rings control settings such as rollout timing, restart behaviour, and deferrals, while feature update policies can hold devices on a specific Windows release until the organisation is ready to move. Quality updates, feature updates, drivers, firmware, expedite actions, and safeguard holds all require different operational thinking.

The trade-off is between speed, stability, and administrative control. A pilot ring helps validate changes early, but a broad ring with aggressive deadlines can disrupt users if restart settings and support processes are weak. Feature update policies are useful when an organisation wants consistency across a Windows 11 release, while update rings remain important for the ongoing quality and security update cadence. Microsoft’s documentation for Intune update rings and Windows Update for Business should be read alongside hands-on testing, because the exam can describe symptoms rather than naming the policy type.

A realistic lab uses at least a pilot device group and a broader test group. Candidates should create an update ring, assign a feature update policy, inspect reporting, and then explain what would happen if a safeguard hold or driver issue affected a subset of devices. This is also where tenant hygiene matters: stale device objects, duplicated records, and retired devices left in groups can make update compliance look worse than the actual estate.

Compliance, security, applications, and tenant hygiene

Compliance policies are often misunderstood as a reporting feature only. In an Intune-managed environment, they become part of access decisions when combined with Microsoft Entra Conditional Access. That means a poorly designed compliance policy can affect sign-in and app access, while a weak policy may report success without reflecting the organisation’s actual security expectations.

Security preparation should include endpoint security profiles, security baselines, Microsoft Defender-related settings, attack surface reduction rules, firewall policy, BitLocker configuration, and device health reporting. The goal is to recognise where a setting belongs and how conflicts are investigated. Candidates should also understand that applying every baseline setting without testing can create operational issues; a controlled pilot and clear exception process are part of mature endpoint administration.

Application management is smaller by exam weighting but important in daily work. Intune app deployment requires attention to assignment intent, detection rules, restart behaviour, dependencies, supersedence, and installation status. App protection and app configuration policies introduce another layer, particularly where organisational data must be protected on mobile or managed endpoints without relying solely on device-level controls.

Tenant administration details are easy to overlook during study. Intune role-based access control, scope tags, dynamic groups, enrolment restrictions, device cleanup rules, retirement actions, and object lifecycle management all shape what administrators can see and do. In production, these controls affect support boundaries, delegated administration, and the accuracy of reporting; in the exam, they often appear as scenario details that explain why an expected policy or action is unavailable.

What the exam experience is likely to feel like

Microsoft exam forms can include several item types, including single-answer questions, multiple-response questions, drag-and-drop ordering or matching, scenario-based items, and case studies. Candidates should read the instructions carefully because some questions require more than one answer, while others ask for the best administrative action given a constraint such as minimal user disruption or least administrative effort.

Case studies deserve particular attention. They usually provide business requirements, technical requirements, existing environment details, and sometimes proposed changes. The efficient approach is to read the requirements first, identify the constraint that matters, and avoid over-engineering the answer. Review flags are useful for uncertain questions, but candidates should avoid spending too long on an early scenario if later questions are still unseen.

Microsoft uses scaled scoring rather than simply publishing a raw percentage of correct answers for each section. As a result, domain weights indicate emphasis across the blueprint, not a guarantee that every candidate will see the same number of questions from each area. Preparation should therefore cover all domains, even when one area appears smaller in the outline.

A practical MD-102 study plan

The strongest preparation sequence starts with the Microsoft Learn exam page and the current skills outline PDF, then turns each objective into a lab task. Reading alone rarely builds the troubleshooting instinct needed for endpoint administration. A test tenant, a small set of Windows 11 virtual or physical devices, and controlled groups are enough to practise the core workflow without experimenting in production.

1. Read the current Microsoft skills outline and mark unfamiliar objectives before opening Intune.
2. Build a small test scope with pilot groups, clear naming, and limited administrative roles.
3. Register or simulate an Autopilot deployment and confirm the resulting enrolment and join state.
4. Create configuration, compliance, security, update, and app policies, then inspect their reporting status.
5. Break one setting deliberately in the lab and practise finding the cause through Intune reports and device state.
6. Review Microsoft Learn documentation for any objective that could not be explained without looking at the console.

This sequence keeps the study effort aligned with real administrator work. It also reduces a common exam-day weakness: recognising a product name without understanding the consequence of choosing one policy over another. For candidates who prefer structured preparation, the MD-102 Microsoft Endpoint Administrator course from Readynez can sit alongside Microsoft Learn and lab practice rather than replace hands-on work.

Frequently asked questions about MD-102

Is MD-102 mainly a Windows 11 exam?

MD-102 is centred on Windows client endpoint administration, and preparation should use Windows 11 terminology and workflows. The exam also expects candidates to understand the management services around the operating system, especially Intune, Microsoft Entra ID, Windows Autopilot, Windows Update for Business, compliance, security, and application management.

Does MD-102 replace older Windows administrator exams?

MD-102 reflects Microsoft’s current endpoint administrator role and should not be studied as a simple continuation of older Windows desktop exams. Candidates coming from legacy deployment, Group Policy, or Configuration Manager backgrounds should spend extra time on Intune-native policy management, cloud identity, update reporting, and modern provisioning.

Is hands-on Intune experience necessary?

Hands-on practice is strongly advisable because many exam scenarios describe administrative outcomes rather than asking for definitions. Building policies, assigning them to groups, checking reports, and troubleshooting failed deployments makes the objectives easier to apply under exam conditions.

Should candidates take MD-102, MS-102, or SC-200?

MD-102 fits administrators responsible for Windows endpoints and Intune-based device management. MS-102 is better aligned with broader Microsoft 365 tenant administration, while SC-200 is intended for security operations work involving monitoring, investigation, and response.

Preparing for the endpoint administrator role

MD-102 preparation is most valuable when it connects the exam outline to operational decisions: how a device is deployed, how it becomes compliant, how updates are controlled, how apps are protected, and how stale or misconfigured objects are cleaned up. Candidates who practise those decisions in a lab are better positioned than candidates who only memorise feature names.

Teams planning broader Microsoft skills development can also review related Microsoft training options or the Unlimited Microsoft Training route if multiple administrators need structured development across Microsoft technologies. A practical next step is to compare the MD-102 blueprint with current responsibilities, identify the weakest domain, and contact the team if guidance is needed on aligning training with endpoint administration goals.