Updated 1 Nov 2026 · 5 min read
On this page
What the Microsoft MD-102 is and who it is for
The MD-102, Managing and Securing Microsoft 365 Endpoints by using Intune, is the exam behind the Microsoft 365 Certified: Endpoint Administrator Associate certification. Microsoft rates it intermediate and aims it at administrators who manage devices and client apps in a Microsoft 365 tenant with Microsoft Intune and, in Microsoft's words, agentic tools and workflows.
The toolset is wide: Intune and the Intune Suite, Windows Autopilot, Microsoft Defender for Endpoint, Microsoft Entra ID, PowerShell, Microsoft Graph and Windows 365. Microsoft expects experience deploying and maintaining Windows client and non-Windows devices, plus an understanding of Microsoft Security Copilot, Intune agents and Microsoft Defender XDR.
One date matters: Microsoft updates the English version on 27 October 2026. Sit it in English before then and you get the skills measured as of 24 July 2026. The five domains and weights are the same in both versions, and the FAQ covers what changes.
Microsoft MD-102 at a glance
| Item | Detail |
|---|---|
| Exam code | MD-102 |
| Time allowed | 100 minutes |
| Passing score | 700 out of 1,000, scaled |
| Exam fee | US$165 in the US, priced by the country or region where you sit it |
| Languages | English, Chinese (Simplified), German, Spanish, French, Japanese and Portuguese (Brazil) |
| Where you sit it | Pearson VUE, online proctored or at a test centre |
| Certification valid for | 12 months, renewed with a free online assessment |
Microsoft does not publish a question count for the MD-102. It says most of its certification exams typically contain between 40 and 60 questions, but that the number varies by exam, so pace yourself against the 100 minutes.
What is on the exam
Prepare infrastructure for devices (20 to 25%). You choose between Entra join and device registration, build dynamic device groups and set up Intune enrollment for every platform, including Apple Business Manager, Samsung Knox Mobile Enrollment and Google zero-touch. The identity half covers Intune and Windows 365 roles, scope tags, multi-admin approval, compliance policies, Conditional Access that requires a compliant device, Windows Hello for Business and Windows LAPS.
Manage and maintain devices (25 to 30%). The largest domain. You choose between Autopilot deployment profiles and device preparation policies, and between user-driven, pre-provisioning and self-deploying modes, then build the Enrollment Status Page. It also covers Windows 11 upgrades, Windows 365 Cloud PCs, and configuration profiles for every platform, including specialty devices such as HoloLens 2, targeted with assignment filters. Then come the Intune Suite add-ons, such as Endpoint Privilege Management, Remote Help and Cloud PKI, and remote actions such as wipe, BitLocker key rotation and KQL device queries.
Protect devices (15 to 20%). Endpoint security policies for antivirus, disk encryption, firewall and attack surface reduction, security baselines, Defender for Endpoint onboarding and EDR, and App Control for Business. The update side covers update rings, feature and quality updates, Windows Autopatch and Hotpatch, Apple and Android updates, and Delivery Optimization.
Manage and secure applications (15 to 20%). Deploying Win32, line-of-business and Store apps, Microsoft 365 Apps (including during Autopilot, with the Office Deployment Tool or Intune), store apps through Apple Business Manager and Managed Google Play, and troubleshooting failed installs. It closes with app protection policies for managed and BYOD devices and app configuration policies.
Optimize endpoint operations by using automation, monitoring, and reporting (10 to 15%). Automating Intune with PowerShell and Microsoft Graph, Security Copilot agents in Intune, Endpoint Analytics and remediation scripts, reporting, and alert rules for compliance drift.
Why people fail it
Many MD-102 objectives start with a choice, such as the device join type or the Autopilot deployment mode, so expect to be tested on the decision, not a definition to recall. Candidates who know Intune from daily work but have not practised that style lose marks on the decision itself: which join type, which Autopilot mode, which policy actually solves the problem.
Breadth is the second trap. Many administrators live in Windows and have never set up Android enrollment profiles, Apple Business Manager or Knox Mobile Enrollment, yet the exam expects all of them. The same goes for the Intune Suite add-ons. If you have never switched on Cloud PKI, Endpoint Privilege Management or Microsoft Tunnel in a tenant, those objectives are pure reading unless you build a lab.
A study plan that fits the exam
Seven weeks suits most people who already administer Intune. The first two domains carry about half the weight, so they get four weeks.
- Week 1: Entra ID and enrollment. Join and register test devices, write a dynamic group rule and enroll one device per platform. Take the free MD-102 practice questions to find your gaps.
- Week 2: identity and compliance. Custom roles, scope tags, multi-admin approval, compliance policies tied to Conditional Access, Windows Hello for Business and Windows LAPS.
- Week 3: Autopilot and configuration. Compare deployment profiles with device preparation policies, run each mode, build an ESP, then create configuration profiles with assignment filters and import an ADMX file.
- Week 4: Intune Suite and remote actions. Work through Endpoint Privilege Management, Cloud PKI, Remote Help and Tunnel, then practise wipe, retire, bulk actions, key rotation and a KQL device query.
- Week 5: protection and updates. Endpoint security policies, Defender for Endpoint onboarding, App Control, update rings, Autopatch and Apple and Android update policies.
- Week 6: apps and operations. Deploy a Win32 app and Microsoft 365 Apps, set app protection for BYOD, then script a task with Graph and review Endpoint Analytics and remediations.
- Week 7: timed runs. Work through the questions-only copy in the MD-102 practice question pack in 100 minute blocks and read the explanation for every miss.
On exam day
You schedule through Pearson VUE and can sit online or at a test centre. Microsoft recommends registering with a personal Microsoft account, because records tied to a work or school account are lost if you leave that organisation.
You get 100 minutes, and Microsoft suggests allowing 120 minutes of seat time in total. Breaks are allowed, but the clock keeps running and you cannot return to questions seen before the break. You can open Microsoft Learn in a split screen during the exam, but no extra time is added, so save it for one detail.
If the exam is not offered in your preferred language, you can request an extra 30 minutes. There is no penalty for guessing, so answer every question.
Frequently asked questions
What changes on 27 October 2026?
The English exam moves to a new set of skills measured. Microsoft's change log marks no skill area as changed, only minor edits inside seven objective groups. Most of the edits rename features: Windows Backup and Restore becomes Windows Backup, the Apple Volume Purchase Program and Google Play become Apple Business Manager and Managed Google Play, and proactive remediations become Remediations. Localised versions follow about eight weeks later.
Is the practice question pack enough on its own?
No. It is practice, not a course. The 409 questions with explanations show how Microsoft frames each decision and where your gaps are, but the MD-102 rewards hands-on time in a tenant. Build the policies yourself, then use the questions to check and rehearse under time.
What happens if I fail the MD-102?
You can retake it after 24 hours. After that, Microsoft requires 14 days between attempts, with a maximum of five attempts in the 12 months from your first. Each retake is normally paid for. Your score report shows performance by skill area, so use it to plan the next round.
How do I keep the certification?
It lasts 12 months. You renew for free by passing a short, unproctored, open-book assessment on Microsoft Learn during a six-month window before it expires. Passing extends it by one year from the expiry date.
Try the free questions first, then get all 409 MD-102 practice questions with full explanations for US$39, pass or your money back: get the MD-102 pack.
Sources
The official pages the facts in this guide were checked against.
- learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/md-102
- learn.microsoft.com/en-us/credentials/certifications/modern-desktop/
- learn.microsoft.com/en-us/credentials/certifications/exams/md-102/
- web.archive.org/web/20260909141333/https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/md-102
- learn.microsoft.com/en-us/credentials/certifications/exam-scoring-reports
- learn.microsoft.com/en-us/credentials/exam-pricing.json
- learn.microsoft.com/en-us/credentials/certifications/online-exams
- learn.microsoft.com/en-us/credentials/support/exam-duration-exam-experience
- learn.microsoft.com/en-us/credentials/support/retake-policy
- learn.microsoft.com/en-us/credentials/certifications/renew-your-microsoft-certification