Microsoft MD-102 Endpoint Administrator Study Guide
MD-102 earns Microsoft 365 Certified: Endpoint Administrator Associate — the credential for managing devices and client applications across a Microsoft 365 tenant. It covers deploying and managing endpoints at scale with Intune, Windows Autopilot, Entra ID, Defender for Endpoint, PowerShell and Windows 365, plus the identity, security, update and application policies that sit on top. Microsoft refreshed the objectives in 2026 to add Security Copilot, Intune agents and Defender XDR, so the exam now expects familiarity with the agentic tooling as well as the console.
Overview
Level
Associate
Vendor
Microsoft
Audience
Desktop and endpoint administrators, IT support leads who own the device fleet, and Windows administrators moving from Group Policy and imaging to Intune and Autopilot. Microsoft expects real experience with Entra ID and Intune plus solid skills deploying and maintaining Windows and non-Windows devices. It is not a beginner exam — the scenarios assume you have configured compliance policies and chased an enrolment failure before.
Why get MD-102
Endpoint management has consolidated around Microsoft Intune, and MD-102 is the credential that maps directly to that job. Organizations that run Microsoft 365 need people who can enroll and configure devices with Autopilot, enforce compliance and Conditional Access, push apps, manage Windows updates, and integrate Defender for Endpoint—exactly what this exam tests. It appears in job listings for Endpoint Administrator, Intune Administrator, Modern Workplace Engineer, and M365 Administrator roles. For desktop support professionals, it is the clearest documented step from break/fix ticket work into device management at scale, which is where the salary progression actually happens. Be realistic about what it is: MD-102 signals competence with a specific, widely deployed toolset. It carries the most weight when you can pair it with hands-on Intune experience—even lab experience in a trial tenant—rather than as a standalone line on a resume.
Salary expectations
Typical salary range
$60,000 – $95,000
Desktop support roles that MD-102 candidates typically come from pay $45K–$60K. Endpoint administrator and Intune administrator roles generally land in the $60K–$85K range, with experienced modern workplace and endpoint engineers reaching $90K–$115K+. The certification supports the transition, but hands-on Intune and Autopilot experience is what actually moves compensation—treat the cert as documentation of skills, not a substitute for them.
When to get MD-102
Take MD-102 when managing endpoints is already your job, or is about to be, in a Microsoft 365 organisation. It is the most directly useful certification for anyone whose day is Intune, and it maps onto work that support technicians are frequently promoted into. Get hands-on in a tenant first — a Microsoft 365 developer tenant is free and enough to practise nearly everything on the blueprint. If you are still on the support desk and want breadth first, MS-102 or AZ-104 cover more ground; MD-102 is the specialist choice, and it is the one that matches what endpoint teams actually do.
Exam details
Exam Quick Reference
- Exam Code
- MD-102
- Vendor
- Microsoft
- Level
- Associate
- Duration
- 100 minutes
- Format
- Multiple choice, multiple select, drag-and-drop and other interactive types, sometimes including a case study. Microsoft schedules associate exams at 100 minutes (120 minutes of seat time) and does not publish a fixed question count — most of its exams run 40 to 60 questions. Passing score: 700 on a scale of 100–1000. Proctored through Pearson VUE, at a test centre or online.
- Questions
- 40–60 questions typically (Microsoft does not publish an exact count)
Renewal: The Microsoft 365 Certified: Endpoint Administrator Associate certification is valid for one year, and renewal is free: pass a short, unproctored, open-book assessment on Microsoft Learn during the six-month window before your expiry date. You can retake the assessment as often as you need, and passing extends the certification another year. Miss the window and the certification lapses — you sit the full exam again.
Facts on this page last verified September 24, 2026 against official Microsoft sources.
Skills covered
Prepare Infrastructure for Devices (20–25%)
- Microsoft Entra join, registration, and device group management
- Intune enrollment for Windows, macOS, iOS/iPadOS, and Android
- Apple Business Manager and Android enterprise enrollment integration
- Compliance policies and Conditional Access based on compliance status
- Windows Hello for Business, Windows LAPS, and role-based administration
Manage and Maintain Devices (25–30%)
- Windows Autopilot deployment profiles, modes, and Enrollment Status Pages
- Device configuration profiles across platforms, ADMX import, and Group Policy analytics
- Windows 365 Cloud PC provisioning and Windows 11 upgrades via Intune
- Intune Suite add-ons: Endpoint Privilege Management, Remote Help, Cloud PKI, Advanced Analytics
- Remote actions: wipe, retire, BitLocker key rotation, and device query with KQL
Protect Devices (15–20%)
- Antivirus, disk encryption (BitLocker), and firewall policies via Intune
- Attack surface reduction policies and security baselines
- Microsoft Defender for Endpoint onboarding and EDR policy configuration
- Update rings, feature and quality updates, Windows Autopatch and Hotpatch
- Update policies for iOS/iPadOS, macOS, and Android devices
Manage and Secure Applications (15–20%)
- Deploying Win32, line-of-business, and Microsoft Store apps with Intune
- Microsoft 365 Apps deployment, including during Autopilot provisioning
- App protection policies for managed and BYOD devices
- App configuration policies and Conditional Access for apps
- Monitoring app deployment status and troubleshooting install failures
Automation, Monitoring, and Reporting (10–15%)
- Automating Intune tasks with PowerShell and Microsoft Graph
- Security Copilot agents in Intune: threat investigation and recommendations
- Endpoint Analytics: device health scores and proactive remediation scripts
- Custom reports, workbooks, dashboards, and data export in Intune
- Alerts for compliance drift, enrollment failures, and configuration conflicts
Step-by-step study path
This sequence reflects what consistently works. Follow it in order—don't skip ahead.
- 1
Download the current MD-102 study guide
Start with the official study guide on Microsoft Learn. This matters more than usual for MD-102: the exam was restructured on July 24, 2026 from four domains to five, adding automation, monitoring, and Security Copilot content. Verify any course you buy covers the current outline—plenty of material published for the older version is still being sold.
- 2
Get a tenant you can break
MD-102 is a hands-on exam about a hands-on job. Set up a Microsoft Intune trial tenant (or use a sandbox tenant at work if you have one) so you can actually enroll devices, build compliance policies, and run an Autopilot deployment. A Windows 11 VM or spare machine to enroll makes the labs real. Reading about the Intune admin center is not the same as clicking through it.
- 3
Work through the free Microsoft Learn paths
Microsoft publishes free self-paced learning paths mapped to the exam on the MD-102 exam page. They are dry but authoritative and free. Use them as your baseline, then add a video course if you want more structure and exam-focused framing.
- 4
Drill the big three: enrollment, Autopilot, and compliance
The heaviest-weighted domains are infrastructure preparation and device management. Know the enrollment paths for every platform (Windows automatic enrollment, Apple Business Manager, Android work profiles), the differences between Autopilot deployment modes, and how compliance policies feed Conditional Access. These distinctions—which join type, which enrollment method, which policy type—are exactly what the scenario questions test.
- 5
Take the free official practice assessment
Microsoft offers a free practice assessment for MD-102 on Microsoft Learn. Take it early to find your weak domains, not just at the end to feel good. Follow up with third-party practice exams under timed conditions and target consistent scores well above passing before you book.
- 6
Close gaps with the Intune docs, not more videos
When you miss practice questions, go to the Microsoft Intune documentation for that feature rather than rewatching course sections. The exam is written against product behavior, and the docs are where the details live—especially for newer areas like Endpoint Privilege Management, Windows Autopatch, and Endpoint Analytics.
- 7
Schedule through Pearson VUE
Book in-person or online proctored. You get 100 minutes; case-study and scenario questions cost more time than they look, so pace accordingly. If you fail, you can retake after 24 hours—the fee applies again, so use the free practice assessment to make sure the first attempt is the real one. Once you pass, set a calendar reminder: renewal is annual via a free online assessment.
Ready for a structured course?
A top-rated course covers every MD-102 exam domain in order. See the paid resources section below for options and pricing.
View course options →Free resources
The definitive skills-measured list, including the change log for the July 24, 2026 exam update. Read this before buying anything.
Official, free, and matches the style and wording of real exam questions. Take it early to diagnose weak domains and again before booking.
The certification landing page with free self-paced learning paths, the exam sandbox, scheduling, and renewal details.
The product docs the exam is written against. Use them to close gaps on specific features—enrollment, Autopilot, compliance, Intune Suite add-ons.
Paid resources
The resources below are the most commonly recommended for the MD-102 exam. Prices reflect typical pricing—discounts run frequently.
| Provider | Type | Price | Best for | Link |
|---|---|---|---|---|
| Udemy – MD-102 Endpoint Administrator Course with SIMS (John Christopher) | Video Course | ~$15–$20 (on sale) | Candidates who want a structured video course with hands-on simulations and lab walkthroughs of the Intune admin center | |
| Microsoft Press – Exam Ref MD-102 Microsoft Endpoint Administrator (2nd Edition) | Book | ~$40–$50 | Candidates who prefer a written reference organized exactly by exam objective |
Udemy – MD-102 Endpoint Administrator Course with SIMS (John Christopher)
Video Course · ~$15–$20 (on sale)
Candidates who want a structured video course with hands-on simulations and lab walkthroughs of the Intune admin center
Long-running, regularly updated MD-102 course with performance-based simulations. Confirm in the course description that it covers the July 2026 objective update before relying on it alone.
Microsoft Press – Exam Ref MD-102 Microsoft Endpoint Administrator (2nd Edition)
Book · ~$40–$50
Candidates who prefer a written reference organized exactly by exam objective
The official Exam Ref line from Microsoft Press. Terse by design—best used alongside hands-on lab time, not as a standalone teach-yourself book.
Affiliate links (buttons) may earn us a commission at no extra cost to you. Plain text links are unaffiliated references and earn us nothing. Affiliate disclosure →
Vouchers & exam cost
US price is $165; pricing varies by country and is confirmed at checkout on the official exam page. Register with a personal Microsoft account, not a work account—exam records tied to an employer account are lost if you leave.
Frequently asked questions
Is MD-102 worth it?
If you work in (or are targeting) an organization that runs Microsoft 365 with Intune, yes—it maps directly to the endpoint administrator job and appears in listings for Intune and modern workplace roles. If your environment is not a Microsoft shop, its value drops sharply. It is a role-specific credential, not a general-purpose one like Security+.
How hard is the MD-102 exam?
Moderate. It is harder than fundamentals exams like MS-900 because it tests applied product knowledge—which enrollment method, which policy type, which Autopilot mode for a given scenario. Candidates with real Intune experience typically prepare in 4–8 weeks; those coming from pure help desk backgrounds without Intune exposure should plan for 8–12 weeks including serious lab time.
Are there prerequisites for MD-102?
No formal prerequisites—you can sit the exam directly. Microsoft recommends experience with Microsoft Entra ID, Microsoft 365, and Windows client administration. In practice, trying MD-102 with zero Intune hands-on experience is the most common failure mode; a trial tenant fixes that cheaply.
How much does MD-102 cost?
The US price is $165, and pricing varies by country or region—confirm on the official exam page when scheduling. If you fail, you can retake after 24 hours, paying the fee again each attempt. Microsoft periodically offers Exam Replay bundles that include a retake; check the deals page before buying.
How long is the certification valid?
One year. Renewal is free: an online, unproctored assessment on Microsoft Learn, available starting six months before expiration. This is easier than recertifying with most vendors, but it does mean an annual commitment—miss it and the certification expires.
What changed in the July 2026 exam update?
On July 24, 2026, the English exam moved from four domains to five. A new domain—Optimize endpoint operations by using automation, monitoring, and reporting (10–15%)—covers PowerShell and Microsoft Graph automation, Security Copilot agents in Intune, and Endpoint Analytics. 'Manage applications' became 'Manage and secure applications,' and enrollment and deployment objectives were reworked. Localized exam versions update roughly eight weeks after English. Study from the current study guide.
What jobs can I get with MD-102?
Endpoint Administrator, Intune Administrator, Modern Workplace Engineer, Desktop Engineer, and Microsoft 365 Administrator roles are the direct targets. For current desktop support staff, it is a lever for moving into device management rather than an immediate salary jump—the pay increase comes with the role change, and the role change usually requires demonstrable Intune skills, not just the badge.
Jobs where MD-102 shows up
One role in our Career Navigator list MD-102 as worth having. Each page covers what the job involves day to day, its honest downside, and the typical pay.
Not sure which of these fits you? Take the free Navigator assessment →
More Microsoft certifications
- AZ-900Foundation
- MS-900Foundation
- SC-900Foundation
- Microsoft AZ-104 Azure AdministratorAssociate
- PL-300Associate
Ready to study?
Start with the free resources above, then add a top-rated course and practice exams when you're ready to test yourself.