The MD-100 — officially titled Microsoft Windows Client — is a Microsoft certification exam that tests your ability to deploy, configure, and manage Windows client environments. It's one of two exams (alongside MD-101) that make up the Microsoft 365 Certified: Modern Desktop Administrator Associate credential. If you're working in IT support, systems administration, or desktop management, this is a foundational certification worth having.
The exam focuses on real-world Windows 10 and Windows 11 administration tasks: installing and configuring Windows, managing local users and groups, configuring network settings, maintaining Windows devices, and troubleshooting common client-side issues. It's not a theoretical exam — the questions are scenario-based and expect you to know how to actually do the work.
This guide covers the full exam blueprint, what you need to study, how to approach the trickier question types, and how practice tests fit into your preparation strategy.
The MD-100 contains 40–60 questions depending on which question types you receive. Microsoft uses several formats:
You have 120 minutes to complete the exam. The passing score is 700 on a 1000-point scale. Exams are administered by Pearson VUE at authorized testing centers or via online proctoring.
Note: Microsoft retired the standalone MD-100 exam in June 2023 as part of their certification program updates. The content is now covered under the updated Modern Desktop Administrator Associate certification path. If you're pursuing the older MD-100 specifically, verify with Microsoft's current certification catalog — some training providers and testing centers still support it under transition arrangements. Either way, the underlying technical knowledge remains fully relevant.
The MD-100 exam blueprint is divided into five main domains. Here's what each covers and roughly how much of the exam it represents:
This domain covers Windows deployment scenarios — both clean installations and upgrades. You need to know:
For Autopilot specifically, understand the deployment profiles (white glove, user-driven, self-deploying), how devices are registered, and how Autopilot interacts with Azure AD and Intune. Autopilot questions show up consistently.
The highest-weighted domain. It covers the day-to-day administration work of a Windows client administrator:
NTFS permissions and BitLocker tend to generate the most questions in this domain. Know how inherited permissions interact with explicitly set permissions, how to calculate effective permissions for a user who belongs to multiple groups, and BitLocker encryption modes (TPM, PIN, USB startup key, and combinations).
Network configuration on Windows clients:
Know when to use each VPN protocol and what their tradeoffs are. IKEv2 is preferred for modern deployments; understand why SSTP works well with firewalls (uses port 443). For wireless, understand 802.1x (RADIUS-based authentication) versus pre-shared key and when each is appropriate.
This domain covers keeping Windows clients healthy and up to date:
Scenario-based troubleshooting questions across all the other domains:
Troubleshooting questions test your methodology as much as your technical knowledge. Know the systematic approach to common problems and the right tools for each type of issue.
After reviewing what consistently trips up MD-100 candidates, a few topics deserve extra attention:
BitLocker questions are everywhere on this exam. Know the difference between BitLocker (full disk encryption) and BitLocker To Go (removable drives). Understand the hardware requirements — TPM 1.2 or higher for standard BitLocker with TPM protection. Know the authentication methods: TPM only, TPM + PIN, TPM + startup key, startup key only (when no TPM). Understand how to manage BitLocker recovery keys — storing in Active Directory, Azure AD, or on a USB drive.
Combination permission questions require you to know: when both NTFS and share permissions apply (remote access), the more restrictive permission takes effect. When only NTFS applies (local access), share permissions are irrelevant. How inherited permissions work and how to block inheritance. How Deny permissions override Allow permissions — even when a user has an Allow from group membership, an explicit Deny for that user wins.
Autopilot has become central to modern Windows deployment. Understand the prerequisites (Azure AD P1/P2, Intune subscription, device registration), the deployment profile types, the distinction between user-driven and self-deploying modes, and what happens during an Autopilot deployment sequence. Know how Autopilot works with Hybrid Azure AD join scenarios.
Questions often present a scenario and ask whether Group Policy, Intune, or local policy is the right tool. Key distinction: Group Policy requires domain membership; Intune works with Azure AD-joined devices. Modern management increasingly uses Intune. Know what settings are available in each tool and when to prefer one over the other.
MD-100 preparation is more hands-on than most certification exams. Reading documentation and watching videos helps, but you'll retain more by actually doing the tasks in a test environment. Set up a Windows 10/11 VM (Hyper-V, VMware, or VirtualBox — all work fine) and practice the configurations you're studying.
For structured content, Microsoft Learn has free official learning paths for MD-100. These are worth doing in full — they align directly to the exam objectives and include hands-on exercises. Supplement with a quality question bank to build exam-day fluency.
For timeline, 4–6 weeks of consistent study is typical for candidates with some Windows administration background. If you're newer to the content, plan 8–10 weeks. The questions are scenario-based, so depth of understanding matters more than breadth of memorization.
For case study questions: read the company background and requirements carefully before looking at the questions. Understand the constraints (domain-joined vs Azure AD-joined, on-premises vs cloud, user requirements). Then read each question against those constraints. Many wrong answers are perfectly valid solutions — just not right for the specific scenario described.
For drag-and-drop and build list questions: don't overthink the order of steps. For processes like enabling BitLocker or configuring VPN profiles, there's typically only one logical sequence. If you know how to actually do the task, the ordering is intuitive.
Time management: 120 minutes for 40–60 questions gives you roughly 2–3 minutes per question. Case studies take longer — budget 15–20 minutes per case study and don't let them steal time from the rest of the exam. Flag and revisit rather than getting stuck.
The MD-100 is a practical exam — it tests whether you can actually administer Windows client environments, not just recall facts about them. Your preparation should reflect that: combine content review with hands-on practice in a lab environment, and measure your knowledge with regular practice testing.
Start with the Microsoft Learn learning paths, build your lab environment, and use our free MD-100 practice tests to identify knowledge gaps and get comfortable with the question formats. Track your performance by domain and focus extra effort on the areas where you're weakest — particularly the high-weight Manage Devices and Data domain.
With consistent, hands-on preparation over 4–8 weeks, you'll be well-positioned to pass on your first attempt.