Last updated: January 2026. Microsoft 365 administration has evolved from separate desktop, identity, security, and compliance tasks into a connected operating model where device management and tenant governance often touch the same users, policies, and data.

MD-102 and MS-102 sit on different sides of that model. MD-102 is the exam for the Microsoft 365 Certified: Endpoint Administrator Associate certification, focused on Windows client devices, Microsoft Intune, Windows Autopilot, apps, updates, and device compliance. MS-102 is the exam for the Microsoft 365 Certified: Administrator Expert certification, focused on tenant-wide administration across Microsoft Entra ID, Microsoft 365 security, and Microsoft Purview compliance.

The distinction matters because the two exams are not interchangeable. An Endpoint Administrator typically spends more time deploying and securing Windows endpoints, while a Microsoft 365 Administrator works across identity, access, threat protection, and compliance services that affect the whole tenant. Both require an understanding of Microsoft Entra ID and Conditional Access, but they apply that knowledge at different levels.

MD-102 vs MS-102 at a glance

Microsoft maintains the authoritative exam outlines on Microsoft Learn, so candidates should check the official pages before scheduling. The MD-102 exam page describes the current Endpoint Administrator skills measured, while the MS-102 exam page covers the Microsoft 365 Administrator scope. Microsoft can update skills measured without changing an exam code, so the month shown on each skills outline is more reliable than older blog posts or legacy study guides.

The terminology also deserves attention. Azure Active Directory is now Microsoft Entra ID, and current exam preparation should use the updated name while still recognising older labels in documentation, portals, and community material. Candidates who study only older Windows 10-era endpoint content or MS-100/MS-101 material risk missing current service names, portal flows, and exam emphasis.

What MD-102 covers

MD-102 is about managing endpoints through their lifecycle. That includes deploying Windows clients, enrolling devices into Intune, configuring device and user policies, deploying and protecting apps, managing updates, and enforcing security and compliance requirements. The role is practical and operations-heavy: the exam expects candidates to understand how device configuration decisions affect real users and support teams.

In an Intune-first organisation, MD-102 knowledge shows up in everyday work such as setting up Windows Autopilot profiles, applying compliance policies, configuring update rings, deploying Microsoft Store or Win32 apps, and troubleshooting why a device is not considered compliant. Microsoft’s Intune documentation is useful here because the exam is tied closely to how the service is administered, not just to abstract endpoint concepts.

MD-102 is usually the stronger choice when the candidate’s work centres on Windows clients, device security, application delivery, endpoint policies, or modern desktop migration. It is especially relevant in environments moving away from traditional imaging and Group Policy toward Autopilot, cloud-managed configuration profiles, and conditional access decisions based partly on device state. Readers who need more practical deployment context can also review this Intune and Windows Autopilot deep-dive.

What MS-102 covers

MS-102 operates at the Microsoft 365 tenant level. It covers identity and access with Microsoft Entra ID, protection through Microsoft 365 Defender, and compliance and information governance through Microsoft Purview. Rather than concentrating on whether one device receives the right app or update policy, MS-102 asks whether the tenant is governed securely across users, identities, data, devices, and services.

That broader scope makes MS-102 a better match for administrators who own or influence tenant-wide decisions. Examples include configuring Conditional Access, managing privileged access, enabling threat protection capabilities, reviewing security alerts, applying compliance policies, and understanding how retention, eDiscovery, data loss prevention, and sensitivity controls fit together. Microsoft’s Microsoft Entra ID documentation is important preparation because identity decisions underpin much of the MS-102 content.

MS-102 is also where candidates need to be careful with licensing and lab expectations. Some capabilities in Conditional Access, Microsoft Purview, or Defender depend on the licensing available in a tenant, which means a personal lab may not exactly match a production environment or a training tenant. That does not make hands-on work less important; it means candidates should understand where a configuration is unavailable because of licensing rather than because they are using the wrong portal or setting.

How to choose between MD-102 and MS-102

The simplest decision is to start with the work the candidate actually performs. If most daily tasks involve Windows clients, Intune policies, app deployment, Autopilot, endpoint compliance, or update management, MD-102 is usually the more direct fit. If the role involves identity governance, Conditional Access strategy, Defender, Purview, compliance, and service-wide administration, MS-102 is usually the more appropriate exam.

Environment maturity also matters. An organisation that is actively adopting Intune, modern provisioning, device compliance, and cloud-based endpoint management will create many opportunities to use MD-102 skills immediately. By contrast, smaller IT teams or centralised Microsoft 365 teams that own identity, access, security, and compliance across the tenant may find MS-102 maps more closely to the breadth of their responsibilities.

Career direction is the third factor. MD-102 builds depth in endpoint administration and can be a logical starting point for professionals moving from desktop support into modern endpoint management. MS-102 suits candidates moving toward broader Microsoft 365 administration, security operations coordination, or governance responsibilities. Some readers may want to compare these options with adjacent credentials in a wider Microsoft 365 certifications overview before committing to one route.

A common sequence is MD-102 first, then MS-102. That path works well when a candidate already supports devices and wants to expand gradually into tenant governance. The reverse can also make sense for administrators who already manage identity and compliance but need enough endpoint knowledge to work effectively with Intune and device-based access controls.

Where the exams overlap

The main overlap is identity-aware security. Both exams assume candidates understand Microsoft Entra ID, groups, users, authentication, Conditional Access, and the idea that access decisions can depend on user risk, device compliance, app context, and policy. The difference is the lens: MD-102 often looks at whether the endpoint is correctly enrolled, configured, and compliant, while MS-102 looks at how access and protection policies support tenant-wide governance.

For example, an Endpoint Administrator may configure compliance policies in Intune so that a Windows 11 device must meet encryption and health requirements. A Microsoft 365 Administrator may use Conditional Access to require compliant devices for access to business data, while also considering identity risk, session controls, and broader security posture. The two roles depend on each other, and neither works well in isolation.

This is also why job descriptions can be confusing. Many postings use “Microsoft 365 administrator” as a broad label while still expecting endpoint duties, or they ask for Intune experience in roles that are mostly identity and security focused. Candidates who can explain where Intune management ends and tenant governance begins usually present their experience more clearly in interviews and internal promotion discussions.

Preparation mistakes that cause confusion

The most common mistake is studying the wrong generation of material. MD-102 preparation should not rely on Windows 10-only desktop deployment content that ignores Windows 11, Intune, Autopilot, and cloud-based policy management. MS-102 preparation should not be built around old MS-100 and MS-101 guides without checking how Microsoft consolidated and updated the certification path.

Another frequent issue is treating portal familiarity as the same thing as administrative skill. Candidates may know where a setting exists but struggle to predict how a policy behaves when combined with groups, exclusions, licensing, device state, or user risk. For MD-102, that means building hands-on confidence with Intune enrolment, app deployment, compliance, configuration profiles, update policies, and troubleshooting. For MS-102, it means practising identity, Defender, and Purview configuration rather than only reading definitions.

Structured training can help when it is tied to the correct exam scope rather than a generic Microsoft 365 overview. Readynez, for example, provides a Microsoft 365 Certified Endpoint Administrator MD-102 course for candidates who want guided preparation around the endpoint administration path, while broader Microsoft study options are available through Microsoft training courses. The important point is that preparation should follow the current Microsoft Learn skills outline and include practical configuration work.

Which exam is worth taking first?

Neither exam is automatically the better first choice. MD-102 is usually the better starting point for a support technician, desktop administrator, endpoint engineer, or IT professional working heavily with Windows devices and Intune. It builds a clear operational foundation and gives candidates a concrete way to demonstrate modern endpoint skills.

MS-102 is usually the better first choice for administrators already responsible for Microsoft 365 tenant configuration, identity, access, security, or compliance. It is broader, so candidates benefit from prior exposure to multiple Microsoft 365 services rather than only endpoint management. The exam’s breadth can be demanding, but it reflects the way many central Microsoft 365 administration roles operate.

From a practical perspective, the strongest preparation plan often combines the certification objective with workplace access. A candidate who can practise Autopilot, Intune policy deployment, and endpoint compliance should take advantage of that momentum for MD-102. A candidate who can work in a tenant with Entra ID, Defender, and Purview configuration opportunities may be better positioned for MS-102.

Building the right Microsoft 365 certification path

MD-102 and MS-102 answer different professional questions. MD-102 asks whether a candidate can manage and secure modern Windows endpoints through Intune and related services. MS-102 asks whether a candidate can administer Microsoft 365 at tenant level across identity, security, and compliance. The best choice is the exam that matches the responsibilities the candidate wants to perform next, not the one with the broader-sounding title.

A practical next step is to compare the current Microsoft Learn skills outline with recent work tasks and identify the larger gap. Candidates preparing across more than one Microsoft path can use Readynez options such as Unlimited Microsoft Training to structure study over time, and those who need advice on choosing between MD-102 and MS-102 can contact Readynez for guidance.

FAQ

What is the main difference between MD-102 and MS-102?

MD-102 is device-centric and focuses on endpoint administration, including Windows client deployment, Intune management, apps, updates, and device compliance. MS-102 is tenant-centric and focuses on Microsoft 365 administration across identity, access, security, and compliance.

Does MS-102 replace MS-100 and MS-101?

Yes. MS-102 replaced the older MS-100 and MS-101 route for the Microsoft 365 Administrator Expert certification. Candidates should avoid relying on legacy MS-100 or MS-101 study plans unless they have checked each topic against the current MS-102 skills outline on Microsoft Learn.

Should I take MD-102 before MS-102?

MD-102 first is a sensible route for candidates whose current work is endpoint-heavy, especially if they manage Windows devices through Intune. MS-102 first may be better for administrators already working with tenant-wide identity, Conditional Access, Defender, Purview, and Microsoft 365 governance.

Do MD-102 and MS-102 both cover Conditional Access?

Both exams require Conditional Access literacy, but they use it differently. MD-102 often connects Conditional Access to device compliance and endpoint state, while MS-102 treats it as part of broader identity and access governance across the Microsoft 365 tenant.

Is MD-102 only about Windows 10?

No. Current MD-102 preparation should include Windows 11, Intune, Autopilot, app deployment, update management, security baselines, and device compliance. Windows 10-only study material is likely to be incomplete for the current endpoint administrator role.