Comprehensive Overview of MD-102: Microsoft Endpoint Administrator Certification

Microsoft MD-102 is an endpoint-administration examination covering the decisions required to manage devices and applications in a Microsoft 365 tenant. Its scope extends beyond configuring a Windows desktop: administrators must prepare identity and enrollment infrastructure, deliver policies, manage applications and updates, secure endpoints, and investigate the results through reporting and automation. The exam is associated with the Microsoft 365 Certified: Endpoint Administrator Associate credential, so the strongest preparation asks how these controls work across a full fleet rather than how individual screens are labeled.

For candidates testing in October 2026, the version date matters. The English skills outline for the Microsoft MD-102 exam, effective July 24, 2026, applies as of October 24; a revised English outline takes effect October 27. The upcoming version retains the five major functional areas while refining detailed skill statements. Microsoft may update localized examinations later. Confirm the relevant outline and delivery details from Microsoft rather than treating an old article or practice test as permanent exam policy.

Who the exam is for and what it actually measures

The intended audience consists of endpoint administrators who manage devices and client applications using Microsoft Intune, Windows Autopilot, Microsoft Entra ID, Microsoft Defender for Endpoint, Windows 365, and associated tools. Typical responsibilities include device onboarding, configuration, compliance, application delivery, security, updates, monitoring, and remote support. Experience with both Windows and non-Windows endpoints helps candidates understand why ownership models and platform capabilities change the appropriate management approach.

MD-102 is not the older two-exam Modern Desktop Administrator Associate path. Describing it as a Windows 10-only exam or a credential automatically awarded for one isolated Windows deployment skill misrepresents the current program. The associate certification is earned through the required current Microsoft examination and is subject to Microsoft’s credential policies, including periodic renewal requirements. It does not grant rights to modify a company’s production tenant.

Microsoft reports a passing scaled score of 700 or higher for its certification exams. The public exam information may list assessment duration and localized pricing, but question counts, case-study placement, and availability can change. Do not rely on promises of exact item counts or specific live questions from a third-party source.

Domain 1: Prepare infrastructure for devices (20–25%)

Device preparation begins with identity and enrollment eligibility. Administrators need to distinguish a device registered in Microsoft Entra ID from a joined organizational device and understand how groups, dynamic membership, roles, scope tags, and management authority affect enrollment and policy. These distinctions become operational when a device appears in one inventory but does not satisfy the join or management state expected by a service.

Microsoft Intune enrollment includes Windows automatic enrollment, corporate mobile enrollment, and personal-device paths on supported platforms. Apple Business Manager, Android Enterprise, and vendor zero-touch mechanisms serve different device ownership and onboarding requirements. A strong administrator does not assume that a personal iPhone should be subject to the same device-wide controls as a corporate Windows laptop.

Identity and compliance are connected but remain separate. Intune compliance policies evaluate selected device conditions; Conditional Access can use those conditions when Entra evaluates an access request. Windows Hello for Business, Windows LAPS, and role-based administrative boundaries support identity and privilege hygiene. Exam scenarios can require choosing the correct layer: configuring encryption is not the same action as evaluating encryption compliance or blocking noncompliant devices from a resource.

Domain 2: Manage and maintain devices (25–30%)

This domain tests deployment, configuration, remote operations, and lifecycle maintenance. Windows Autopilot supports supported provisioning experiences, including user-driven and other deployment modes. The administrator must understand registration, profile assignment, the out-of-box experience, enrollment, Enrollment Status Page behavior, and initial policy/application delivery. If device setup fails, evidence from each stage helps distinguish a targeting error from a later application or network problem.

Windows 365 Cloud PCs add provisioning, policy, connectivity, and image considerations. A virtual desktop is not merely a physical PC without a chassis; its provisioning and service connections can affect user experience and recoverability. Windows upgrades and feature-update targeting must also account for device readiness, deployment rings, restart behavior, and supported platforms. Selecting the newest release for every endpoint immediately is not necessarily a safe rollout strategy.

Configuration management involves settings-catalog profiles, templates, assignment filters, conflicts, and applicability. More policies do not always mean better management. If two teams configure the same setting through different interfaces, the administrator needs a way to identify ownership, effective state, and deliberate exceptions. Remote actions such as wipe, retire, restart, and reset should be used only after verifying device identity, ownership, authorization, and business impact.

Domain 3: Protect devices (15–20%)

Endpoint protection connects antimalware, encryption, hardening, local privilege management, and ongoing vulnerability reduction. Microsoft Defender for Endpoint, supported endpoint security policies, attack-surface reduction controls, firewall configuration, and baseline settings all contribute, but none alone demonstrates that a fleet is secure. Administrators need reliable rollout, per-device reporting, and a plan for conflicting settings or applications affected by stricter hardening.

For BitLocker, studying “enable encryption” is not enough. Recovery-key escrow, authorized access to recovery information, remediation for failures, and help-desk procedures are part of the operational model. Windows LAPS and local administrative group policies similarly require understanding permission boundaries and how changes can be audited. A security control is complete only when the organization can operate and recover it safely.

Intune security baselines are starting configurations, not universal mandates for all devices. A kiosk, privileged workstation, shared endpoint, and specialized industrial system may require different settings or compensating controls. The admin should pilot settings, measure results, document exceptions, and keep broad policy ownership clear. Compliance reporting should accurately reflect requirements without assuming that every recommended security setting is suitable for every platform.

Domain 4: Manage and secure applications (15–20%)

Application management includes assigning, packaging, deploying, updating, and protecting apps across supported endpoints. For Windows applications, requirements and detection rules are essential. A package can install correctly yet report failure if detection rules do not recognize the state; a weak detection rule can report success without a usable application. Candidates should be able to identify the evidence needed to separate installation, detection, assignment, and reporting faults.

Managed apps and application protection policies provide controls over corporate data on supported devices, including selected personal-device scenarios. Application configuration helps deliver business settings without assuming that all management objectives require full-device enrollment. In a cross-platform fleet, packaging and delivery methods differ, but the underlying control question remains constant: which user or device should receive which application, under what security and data-handling rules?

Application updates should be tested with business dependencies in mind. Version changes, authentication requirements, certificate distribution, network connectivity, and policy interaction can each affect user experience. Assignments ought to be explainable; a help-desk analyst should know whether an app is required, available, excluded, or blocked by a prerequisite before recommending an invasive device reset.

Domain 5: Optimize operations through automation, monitoring, and reporting (10–15%)

The July 2026 outline introduced this domain as a distinct category. Microsoft Graph, PowerShell, Intune remediations, Endpoint Analytics, device-health reporting, service communications, and supported intelligent operational tools help administrators manage endpoints at scale. The exam’s focus is not merely the ability to run a script, but the ability to select an appropriate automation, scope its effects, interpret its output, and verify whether it improved endpoint state.

Useful metrics include devices with stale check-ins, failing policy assignments, application deployment errors, enrollment failures, degraded startup performance, and compliance trends. These metrics help distinguish an isolated user issue from a fleet-wide change. An alert that simply counts devices without relevant ownership, severity, or remediation context may create more noise than operational value.

Agent-assisted investigation and recommendations must still operate within permission and approval boundaries. Administrators should evaluate evidence before taking high-impact actions, particularly across large groups of endpoints. Upcoming objective wording may refine which tools and operational tasks are named, so candidates should compare Microsoft’s October 27 version with the previously effective guide.

How the domains combine in a realistic support incident

Consider a new employee who receives a corporate Windows laptop directly from a hardware supplier. Registration and profile assignment prepare Autopilot. Entra ID establishes organizational device identity; Intune enrollment supplies configuration and application policies. The endpoint reports compliance, and Conditional Access uses the resulting signal when the employee opens a protected application. Monitoring observes whether the device remains healthy. One failed user sign-in may originate in any of those steps.

Suppose the application is installed locally but the management portal displays a failure. An administrator should inspect app detection before changing enrollment. If the application launches but access is blocked, inspect identity and Conditional Access evidence instead. If the device never received its expected profiles, inspect group assignment and check-in. Each diagnosis uses a different portion of the same lifecycle. This is why exams that ask for the “best first action” are testing architecture and evidence interpretation rather than tool-name recognition.

The same sequence changes for a personal phone. App protection may secure corporate data without full-device management, and the ownership boundary affects remote actions. A technically available control may still be inappropriate if it requires privileges the organization should not assert over the employee’s personal device. Sound endpoint administration weighs those consequences before choosing a deployment model.

Preparation resources and a practical readiness standard

Start with Microsoft’s official study guide and certification resources, then use approved training and hands-on labs to build the workflows described by the objectives. Practice exams can reveal gaps in technical reasoning, but should not be used as a substitute for understanding device identity, policy targeting, app deployment, security, or reporting. Use the exam sandbox to become familiar with interface interactions without assuming that the demonstration predicts the exact assessment.

A strong self-test is to explain an endpoint’s entire journey: enrollment eligibility, management assignment, configuration, compliance, application delivery, access, monitoring, and retirement. For each stage, state what success looks like, where evidence appears, and which action would be safe if the state diverges. Candidates who can do that are better positioned both for MD-102 and for the work of a Microsoft 365 endpoint administrator.