MD-102 is Microsoft’s endpoint administration exam for deploying, configuring, protecting, and managing Windows client devices and apps across modern Microsoft environments. Within the Microsoft 365 certification portfolio, it differs from MS-102 because the two exams measure different responsibilities and point candidates toward different day-to-day work.
Updated for 2026: MD-102 preparation should be Windows 11-first, Intune-first, and grounded in Microsoft Entra ID device identity rather than older Windows 10 imaging assumptions. Traditional tools such as Configuration Manager still matter in many organisations, but the exam increasingly rewards candidates who understand cloud management patterns, security baselines, compliance policies, and update control through Microsoft Intune.
What MD-102 Is Really Measuring
MD-102 is the required exam for the Microsoft 365 Certified: Endpoint Administrator Associate certification. It validates whether a candidate can manage Windows client devices, applications, updates, endpoint security, and identity-related device access in an enterprise environment.
The exam is aimed at people who work close to endpoints: desktop support engineers moving beyond break-fix work, Intune administrators, Configuration Manager administrators shifting toward cloud management, and IT professionals responsible for device compliance and secure access. It is less suitable for candidates whose main goal is tenant-wide Microsoft 365 administration, where MS-102 is the more relevant exam, or for candidates primarily targeting security governance and risk credentials.
A useful way to choose is to look at the object of the work. If the work is centred on Windows devices, apps, policies, Autopilot, updates, and endpoint protection, MD-102 fits. If the work is centred on Microsoft 365 tenant configuration, identity administration, Exchange, SharePoint, Teams, and organisation-wide service governance, MS-102 is closer. Security certifications can complement MD-102, but they do not replace the endpoint administration skills that the exam expects.
Exam Logistics Candidates Should Confirm Before Booking
Microsoft publishes the official MD-102 exam profile on Microsoft Learn, and registration is handled through the Microsoft exam scheduling flow with Pearson VUE. Candidates should use the official exam page for the current appointment details, local exam fee, language availability, accommodation options, scoring information, and retake rules, because these can vary by region and may change over time.
The exam may include several Microsoft question formats rather than simple recall questions alone. Microsoft’s exam item guidance describes formats such as multiple choice, case-based scenarios, build-list style tasks, matching, hot area questions, and other interactive item types. Candidates should therefore practise interpreting requirements, constraints, and policy outcomes, rather than memorising portal labels in isolation.
Retake rules are also worth checking before the first attempt. Microsoft defines waiting periods and limits on its certification policy pages, and those rules should be read directly rather than inferred from older blog posts or forum answers. From a preparation perspective, this matters because a failed attempt is most useful when the candidate has a plan for analysing weak skill areas before rebooking.
The Skills Behind the Exam Objectives
The most important shift for many candidates is the move from Group Policy and image-heavy deployment thinking toward cloud-based lifecycle management. Legacy deployment knowledge is still useful for understanding enterprise history, but MD-102 preparation should focus on Windows client management through Microsoft Intune, Windows Autopilot, Microsoft Entra ID, compliance policies, configuration profiles, security baselines, and modern update services.
Device identity is a common source of confusion. Candidates should understand the practical differences between Microsoft Entra joined, hybrid Microsoft Entra joined, and registered devices, because those states affect enrolment, Conditional Access behaviour, policy targeting, and user experience. Case-style questions often test these relationships indirectly by describing a device that fails to receive a policy, cannot access a resource, or behaves differently from another device group.
Endpoint security knowledge should also connect tools rather than treat them as isolated features. Intune compliance policies, Microsoft Defender for Endpoint signals, security baselines, attack surface reduction rules, BitLocker configuration, and Conditional Access can all influence whether a device is considered trusted enough to access corporate data. The exam expects candidates to recognise how these controls work together in a managed Windows client environment.
Building a Safe MD-102 Lab
Hands-on practice is the difference between recognising an Intune feature name and understanding how it behaves. A safe lab can be built with a test Microsoft 365 tenant, a Windows 11 virtual machine, and a small set of test users and groups. The goal is repeatable practice, not production complexity.
A lab should include device enrolment, Microsoft Entra join, compliance policy assignment, configuration profiles, app deployment, update rings, and basic Defender integration where licensing allows. Candidates using virtual machines should practise reset and re-enrolment cycles so they can see how policies arrive, how long assignments can take, and what the user sees during setup.
Autopilot requires special attention because real-world deployment involves details that short descriptions often skip. Hardware hashes must be collected or imported, devices must be registered before the intended out-of-box experience, and assignments need time to process. Pre-provisioning, formerly often called white glove, also depends on network reliability, driver and firmware readiness, and whether required apps install successfully before the device reaches the user.
When practising Autopilot, candidates should deliberately create a small failure and learn how to diagnose it. Examples include assigning a required app to the wrong group, using a dynamic group rule that does not match the device, or expecting a policy to apply before the device has completed enrolment. These mistakes mirror the troubleshooting mindset that endpoint administrators need in production environments.
Update Management Is More Than Turning on Patches
Windows Update for Business is often underestimated during MD-102 preparation. Candidates should know how update rings, quality update timing, feature update controls, safeguard holds, deadlines, and user experience settings affect managed devices. Windows Update for Business deployment service and Windows Autopatch also introduce a more service-driven approach to update orchestration, where policies, reporting, and device eligibility become as important as the update setting itself.
In practice, update management problems are rarely caused by one setting. VPN routing, metered connections, delivery optimisation, device sleep behaviour, maintenance windows from older management tools, and co-management workloads can all influence whether updates install as intended. Candidates coming from Configuration Manager should pay particular attention to workload movement, because a device may appear cloud-managed while update control still sits elsewhere.
Migration scenarios are especially relevant for administrators moving from co-management to Intune-only. They should understand how Windows app packaging with Win32 apps differs from traditional deployment packages, how remediation scripts can help correct configuration drift, and why pilot groups should be used before broad policy rollout. These details often decide whether a modern management project succeeds outside the exam room.
A Four-to-Six Week Preparation Plan
A realistic MD-102 study plan should move from objectives to practice, then from practice to scenario analysis. Candidates who spend most of their time reading often struggle with questions that describe policy conflicts, enrolment timing, or conditional access outcomes. The plan below works best when each study phase produces something visible in a tenant or lab device.
- Review the official MD-102 skills outline and map each objective to a Microsoft Intune or Windows admin task.
- Build a lab tenant with test users, groups, and at least one Windows 11 device or virtual machine.
- Practise enrolment, compliance policies, configuration profiles, app deployment, Autopilot registration, and update rings.
- Work through Microsoft Learn modules and compare the documentation with what happens in the portal.
- Answer scenario-style practice questions and write down why each wrong answer is wrong.
- Use the final review period to revisit weak areas, retake lab exercises, and confirm exam logistics on Microsoft Learn.
Structured training can help when a candidate needs guided lab time and a clearer sequence through the objectives. Readynez offers a focused Microsoft 365 Certified Endpoint Administrator MD-102 course, but the value of any course depends on whether the learner also practises in a tenant and can explain the operational trade-offs behind each configuration.
Scenario Practice: How MD-102 Questions Often Feel
MD-102 questions often provide a business goal, a device state, and several plausible management options. The strongest answer is usually the one that satisfies the requirement with the least disruption while respecting identity, enrolment, and policy scope.
| Scenario | Likely focus | What to think through |
|---|
| A company wants new Windows 11 devices shipped directly to users and enrolled with required apps during setup. | Windows Autopilot | Check device registration, deployment profile assignment, enrolment status page behaviour, app targeting, and group membership timing. |
| Some managed laptops are not receiving feature updates on the expected schedule. | Windows Update for Business | Review update ring settings, feature update policies, safeguard holds, device connectivity, co-management workload ownership, and reporting status. |
| Users can access cloud apps from compliant devices but are blocked from newly enrolled devices. | Compliance and Conditional Access | Check whether the device is correctly joined, enrolled, evaluated for compliance, and included in the intended Conditional Access policy scope. |
These examples are intentionally broader than flashcard questions. They encourage candidates to connect the admin portal setting with the underlying deployment or security outcome, which is the skill the exam is trying to measure.
Common Preparation Mistakes
One common mistake is preparing from Windows 10-era material without checking whether the guidance still reflects current Windows client and Intune behaviour. Some older resources focus heavily on MDT, imaging, or memorised deployment terminology. Those topics may still provide context, but they should not crowd out Autopilot, Intune policy design, Microsoft Entra ID device states, and Windows 11 management.
Another mistake is treating the Intune admin centre as something to read about rather than use. Candidates should create policies, assign them to groups, wait for device check-in, inspect reports, and troubleshoot failures. This builds the mental model needed to answer scenario questions where the issue is caused by targeting, timing, licensing, enrolment state, or conflicting management authority.
A third mistake is ignoring applications. MD-102 candidates should understand Microsoft 365 Apps deployment, Win32 app packaging concepts, app protection and app configuration policies, required versus available app assignment, and how app deployment interacts with Autopilot. Application delivery is often where endpoint management becomes visible to users, so it cannot be treated as a secondary topic.
Useful Microsoft References to Check
The official Microsoft Learn MD-102 exam page should be the starting point for objectives, registration, and current exam details. Candidates should also review Microsoft’s exam question type guidance and certification retake policy before booking, because those pages explain the testing process more reliably than unofficial summaries.
For technical study, Microsoft Learn documentation for Microsoft Intune, Windows Autopilot, Windows Update for Business, Windows Autopatch, Microsoft Defender for Endpoint, and Microsoft Entra ID device management provides the most relevant reference material. These pages should be used alongside lab practice, because documentation explains the feature while the lab shows the timing, dependencies, and failure modes.
Putting the Preparation Into Practice
MD-102 preparation is strongest when it mirrors the work of an endpoint administrator: enrolling devices, assigning policies, deploying apps, managing updates, protecting endpoints, and troubleshooting why the intended state did not arrive. A candidate who can explain why a device is not compliant, why an Autopilot profile did not apply, or why updates are delayed is much better prepared than someone who has only memorised objective headings.
A practical next step is to combine the official Microsoft Learn objectives with hands-on tenant practice and a clear booking plan. Those comparing broader Microsoft study options can also review Microsoft courses, explore Unlimited Microsoft Training, or contact Readynez for guidance on how MD-102 fits into a wider certification path.
FAQ
What are the basic requirements for taking the MD-102 exam?
Microsoft does not require a separate prerequisite exam before MD-102, but candidates should already understand Windows client management, Microsoft Intune, Microsoft Entra ID device concepts, networking basics, endpoint security, and application deployment. Practical experience with managed Windows devices is highly beneficial.
What is the format of the MD-102 exam?
Microsoft can use a range of exam item types, including multiple choice and scenario-based formats. Candidates should check Microsoft’s official exam item guidance before testing and should not assume that the exam will be limited to simple knowledge questions.
What topics are covered in MD-102?
MD-102 covers deploying and managing Windows client devices, managing identity and access touchpoints, configuring and protecting endpoints, managing applications, controlling updates, monitoring devices, and troubleshooting management outcomes. The official Microsoft Learn exam page should be used for the current skills outline.
Is MD-102 focused on Windows 10 or Windows 11?
Current preparation should use Windows client and Windows 11-first terminology. Older Windows 10 deployment knowledge may still help with context, especially in mixed estates, but candidates should prioritise Intune, Autopilot, Microsoft Entra ID, and modern Windows management.
How should candidates practise for MD-102?
The most useful practice is hands-on work in a test tenant: enrol a Windows 11 device, apply compliance and configuration policies, deploy apps, configure update rings, test Autopilot, and review Intune reports. Practice questions are useful, but they should reinforce lab understanding rather than replace it.
