Certification guide
MD-102Microsoft 365 Certified: Endpoint Administrator Associate: the honest guide
MD-102 is the Intune exam, and the study guide's audience profile is the whole modern endpoint job: Intune and the Intune Suite, Windows Autopilot, Defender for Endpoint, Entra ID, PowerShell, Microsoft Graph and Windows 365, across Windows, macOS, iOS, iPadOS and Android.
The July 2026 revision changed its shape. A fifth skill area on automation, monitoring and reporting is new, weight moved from managing devices into preparing infrastructure, and the security, enrolment and remote action objectives were rewritten. Material from before that date is not a safe guide to the exam.
Who MD-102 Endpoint Administrator is for
A good fit if
- You administer Intune, or you are being handed it, and you want the credential that matches.
- You come from Configuration Manager or Group Policy and your organization is moving device management to the cloud.
- You are a Microsoft 365 or Entra administrator who owns compliance and Conditional Access and needs the device half of the picture.
- You need a current Microsoft 365 associate credential and endpoint work is closer to your job than messaging or Teams.
Probably not, if
- You want a security operations credential. MD-102 touches Defender for Endpoint onboarding and policies, but investigation and response are SC-200's ground.
- You manage only mobile devices on another MDM. Most of the exam assumes a Windows estate joined to Entra ID, and the platform-specific objectives are secondary.
- You have never used Entra ID. The exam assumes join types, dynamic groups and Conditional Access as background, and it does not teach them.
Is MD-102 Endpoint Administrator worth it?
For anyone who runs or is about to run Intune, yes, clearly. The curriculum is the job: enrolment, compliance, Autopilot, configuration profiles, app deployment, update rings, endpoint security and, since July 2026, the reporting and automation that keep all of it honest.
It is also the credential that most directly names the current Microsoft device tooling. Configuration Manager experience is respected, but job descriptions for endpoint roles now ask for Intune and Autopilot by name, and MD-102 is the one exam that covers both.
It is a weaker purchase for someone with no Microsoft 365 background hoping for an entry point. The exam assumes tenant administration and Entra ID fluency, and a fundamentals exam is a better first step.
What the exam actually asks you to do
Multiple choice and multiple response, plus drag-and-drop ordering, hot area items where you click a region of a screenshot, and case studies that hold one scenario across several linked questions.
Item formats
- Multiple choice
- Multiple response
- Drag and drop
- Hot area
- Case study
The highlighted formats are the ones you cannot answer from memory alone. Microsoft Learn, exam duration and question types ↗
Domain breakdown
Manage and maintain devices is the heaviest domain at 28 percent, followed by Prepare infrastructure for devices at 23 percent.
Weights are the midpoints of the vendor's published ranges (for example 20 to 25 percent recorded as 23). Skills measured as of July 24, 2026. The fetched credential page states the exam price varies by region and publishes no USD figure, so the 165 USD cost reflects the standard Microsoft associate exam fee and is not quoted from a fetched page. Duration (100 minutes), passing score (700), retake policy, and annual renewal are sourced from the fetched credential and study-guide pages.
- Prepare infrastructure for devices23%
- Manage and maintain devices28%
- Protect devices18%
- Manage and secure applications17%
- Optimize endpoint operations by using automation, monitoring, and reporting14%
Where to focus: Manage and maintain devices is the single largest area (25 to 30 percent), so spend the most preparation time on Autopilot deployment modes, the Enrollment Status Page, device configuration profiles, Intune Suite add-ons, and remote actions before moving to the smaller protect and apps areas.
Study plans by experience level
Working Intune administrator
3 to 4 weeksat 6 hours
- 1Week 1: read the July 2026 study guide and mark what you do not run. For most administrators that is the Intune Suite add-ons, Windows 365 provisioning and the new automation and reporting area.
- 2Week 2: the marked items in a trial tenant, with a short paid period for the add-ons if your production tenant does not license them. Configure each once; the exam asks what they are for and where they are set.
- 3Week 3: the security objectives as rewritten: EDR policies, attack surface reduction, App Control for Business, Autopatch and Hotpatch, and the Defender for Endpoint integration.
- 4Week 4: the free practice assessment twice, and a full-length timed form.
Configuration Manager or Group Policy administrator
8 to 10 weeksat 8 hours
- 1Weeks 1 to 2: Entra ID join types, device registration, dynamic groups and Conditional Access, because the exam assumes them and Group Policy did not need them.
- 2Weeks 3 to 4: enrolment on every platform, then Autopilot end to end on a virtual machine: hardware hash, deployment profile against device preparation policy, the three deployment modes and the Enrollment Status Page.
- 3Weeks 5 to 6: configuration profiles including ADMX import and Group Policy analytics, which is the bridge from what you know, then compliance and Windows LAPS.
- 4Weeks 7 to 8: apps and updates, then the security objectives with Defender for Endpoint.
- 5Weeks 9 to 10: the automation and reporting area with PowerShell and Graph, Endpoint Analytics and proactive remediations, then the practice assessment and a timed form.
Microsoft 365 administrator new to devices
10 to 12 weeksat 6 hours
- 1Weeks 1 to 3: enrolment and identity. Join types, enrolment settings, platform enrolment programs, roles, scope tags and multi-admin approval.
- 2Weeks 4 to 6: managing devices at 25 to 30 percent, the largest area: Autopilot, configuration profiles on every platform, assignment filters, remote actions and device query with KQL.
- 3Weeks 7 to 8: protecting devices and managing apps, which together are 30 to 40 percent and share the Conditional Access material you already know.
- 4Weeks 9 to 10: the Intune Suite add-ons and Windows 365, on a short paid license.
- 5Weeks 11 to 12: automation, monitoring and reporting, then the practice assessment and a timed full-length form.
Common mistakes
- Studying from material written before July 2026
- The skills measured changed on 24 July 2026: a new fifth area, moved weightings and rewritten enrolment, remote action and security objectives. A course or book aimed at the old outline will leave the automation, monitoring and reporting questions unprepared for entirely.
- Treating Autopilot as one thing
- The study guide asks you to choose between deployment profiles and device preparation policies, and between user-driven, pre-provisioning and self-deploying modes. Those comparisons are the questions; having run one mode once does not answer them.
- Skipping the Intune Suite add-ons because your tenant lacks them
- Endpoint Privilege Management, Remote Help, Cloud PKI, Tunnel for MAM and Advanced Analytics are a named objective group inside the largest skill area. One paid billing period is enough to configure each once, which is the level the exam asks at.
- Assuming Group Policy knowledge transfers directly
- Settings catalog, ADMX import, security baselines and endpoint security policies overlap in what they can set, and the exam asks which platform fits a described requirement. A Group Policy answer applied to an Intune question is the classic wrong option.
- Ignoring the reporting and automation area because it is the smallest
- At 10 to 15 percent it is a tenth of the exam, it is new, and it is the least likely part to be in a working administrator's routine. Endpoint Analytics, proactive remediations, Graph automation and the Security Copilot agent objectives are each an evening and each reliably asked about.
What comes after passing
The certification is valid for one year and renews free through the unproctored assessment on Microsoft Learn, with the window opening six months before expiry.
The renewal assessment tracks the current study guide, which is worth having on a product where the admin center and the policy platforms are reorganised regularly.
Natural next steps split by direction. SC-200 if the Defender for Endpoint half of the job is becoming security operations, or SC-300 if identity and Conditional Access are.
The durable part is the policy model. Knowing the difference between a compliance policy, a configuration profile and an endpoint security policy, and which one Conditional Access can see, is the skill that survives every rename of the admin center.
Costs across the full renewal cycle are on the MD-102 Endpoint Administrator cost page.
Frequently asked questions
What changed in MD-102 in July 2026?
The skills measured as of 24 July 2026 added a fifth area, optimizing endpoint operations by using automation, monitoring and reporting, at 10 to 15 percent. Preparing infrastructure grew to 20 to 25 percent, managing devices fell to 25 to 30 percent, and the enrolment, remote action and endpoint security objectives were rewritten. The study guide's change log lists each edit.
Can I practice for free?
Mostly. A Microsoft 365 trial tenant includes Intune, and enrolment, compliance, Conditional Access, configuration profiles, app deployment and update rings all work inside it with a Windows virtual machine. The Intune Suite add-ons and Windows 365 need a paid license, and one short billing period is enough to see each configured.
Is MD-102 hard?
It is broad rather than deep. The difficulty is coverage across five platforms and five skill areas, and the number of near-equivalent tools whose differences the questions turn on: deployment profiles against device preparation policies, settings catalog against security baselines, compliance against configuration. Working administrators find it fair; candidates without Entra ID background find the assumed knowledge the hard part.
How long is the certification valid?
One year, renewed free through an online assessment on Microsoft Learn that opens six months before expiry. If it lapses there is no renewal route, and recovery means paying $165 and sitting the full proctored exam again.
What score do I need and how long is the exam?
A score of 700 or greater on a 1 to 1000 scale passes. Microsoft lists the exam at 40 to 60 questions in 100 minutes, with multiple choice, multiple response and interactive item types.
Keep reading
- MD-102 Endpoint Administrator practice questions
Free sample questions with the full explanation on every answer.
- Free MD-102 Endpoint Administrator practice test
10 original questions, playable now. No account, no card.
- MD-102 Endpoint Administrator exam objectives
The full official blueprint, with practice pages on covered objectives.
- MD-102 Endpoint Administrator exam format
How many questions, how long, what the items look like, and how long it stays valid.
- MD-102 Endpoint Administrator passing score
The exact cut score, what kind of number it is, and the retake terms.
- How hard is MD-102 Endpoint Administrator?
An honest difficulty read from the format, the clock and the weights.
- What MD-102 Endpoint Administrator costs
The voucher price, the retake, and what renewal costs across the cycle.
Practice MD-102 Endpoint Administrator for free while you decide
Original questions written from the published objectives, with the concept, the reasoning, and a note on every wrong option. No account needed to start.
Start free MD-102 Endpoint Administrator questions