The MD-102 Endpoint Administrator exam is a crucial certification for IT professionals aiming to demonstrate their expertise in managing and securing endpoints in a Microsoft environment. As organizations increasingly rely on technology, the role of an endpoint administrator has become pivotal in ensuring the smooth operation of IT systems. This article explores into key areas of the MD-102 exam, providing insights into Microsoft Endpoint Manager, desktop management, device configuration, endpoint security, and compliance management. Practice with the free MD-102 - Endpoint Administrator practice test on PracticeTestGeeks (7 questions with answer explanations).
The MD-102 has 40 questions, takes about 100 minutes and costs $165[1][2] (Microsoft, verified Nov 1, 2026).
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Number of questions | Typically 40–60 questions[1] | Microsoft · Nov 1, 2026 |
| Time limit | 100 minutes[2] | Microsoft · Nov 1, 2026 |
| Exam fee | $165 USD[2] | Microsoft · Nov 1, 2026 |
| Validity | 1 year[3] | Microsoft · Nov 1, 2026 |
| Renewal | Free unproctored online assessment annually within 6-month window[4] | Microsoft · Nov 1, 2026 |
| Delivery | In-person at a Pearson VUE test center or online proctored[5] | home.pearsonvue.com · Nov 1, 2026 |
| Eligibility | Experience with Microsoft Entra ID, Microsoft 365, and Intune; no formal prerequisite[2] | Microsoft · Nov 1, 2026 |
| Score release | Within minutes of finishing the exam[6] | Microsoft · Nov 1, 2026 |
Interactive MD-102 - Endpoint Administrator Exam resources on PracticeTestGeeks, free to start:
According to Microsoft, “Most Microsoft Certification exams typically contain between 40-60 questions; however, the number can vary depending on the exam.”[1]
The content areas below are copied from the official MD-102 content outline published by Microsoft. The right-hand column shows which of our practice sets covers it.
| Official content area | Practice on this site |
|---|---|
| Manage and maintain devices[7] | MD-102 Enrolling Devices with Microsoft In... Practise enrollment methods, configuration profiles and compliance settings, and know which profile type fits each device scenario. |
| Manage and secure applications[7] | MD-102 Managing Applications in Intune Practise deploying and assigning apps in Intune, and how app protection settings control access to organizational data. |
| Optimize endpoint operations by using automation, monitoring, and reporting[7] | MD-102 Monitoring and Reporting in Endpoin... Practise reading device and compliance reports, and choosing the right monitoring tool for a given symptom. |
| Prepare infrastructure for devices[7] | MD-102 Deploying Windows Practise Windows deployment options, Autopilot requirements and the steps that must be in place before a device can be provisioned. |
| Protect devices[7] | MD-102 Protecting Endpoints with Security ... Practise compliance policies, conditional access and endpoint security policies, and how each one changes what a user can reach. |
Prepare for the MD-102 - Endpoint Administrator Exam exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: What is the minimum requirement for a device to be eligible for Windows Autopilot deployment?
Answer: B. The device hardware hash must be registered in Intune or Autopilot
Explanation:
The correct answer is that the device hardware hash must be registered in Intune or Autopilot. Autopilot identifies a device by that hash. Without it the service has no record of the device, so it cannot apply a deployment profile when the device first connects.
Domain-joined is wrong because Autopilot is built for cloud-based provisioning and does not need an on-premises domain join to start. Windows 10 Pro or higher is wrong because the edition is not the test of eligibility; registration is. TPM 2.0 is wrong because it matters for certain scenarios such as self-deploying and pre-provisioned modes, but it is not the minimum requirement for the device to be eligible at all.
Rule to remember: Autopilot works on registered devices. If a question asks what makes a device known to the service, look for the hardware hash and registration, not for hardware features or domain membership.
Question: You have a Windows 10 device named Computer1 enrolled in Microsoft Intune. You need to configure Computer1 as a public workstation that will run a single customer-facing, full-screen application. Which configuration profile type template should you use in Microsoft Intune admin center?
Answer: C. Kiosk
Explanation:
The correct answer is Kiosk. A kiosk profile locks a device to a specified app, here a single customer-facing full-screen application, and blocks access to the rest of the system. That matches a public workstation exactly.
Shared multi-user device is wrong because it configures how several different people sign in and share a device, not how to lock it to one app. Device restrictions is wrong because it controls individual settings and features, but it does not turn the device into a single-app experience. Endpoint protection is wrong because it covers security features such as firewall and encryption settings, not the user experience.
Rule to remember: when the scenario says one app, full screen, public or customer-facing, think kiosk. When it says many users on one device, think shared device. Match the wording of the scenario to the purpose of the profile template.
Question: You are assigned a task to restrict access for Android Smartphones from accessing Organizational data. You should find and restrict the access for smartphones that don’t have the latest version of the security patch and can give a maximum 90 days of grace period for the users to update their smartphones. Which of the following can be used to achieve this task?
Answer: D. Mark device non-compliant
Explanation:
The correct answer is Mark device non-compliant. In a compliance policy you set the required security patch level, then define actions for noncompliance. Those actions include a grace period, which here is the maximum 90 days. Once the grace period ends, the device is marked non-compliant, and conditional access can then block it from organizational data.
Notify end users through email is wrong because a notification alone does not restrict anything; it is only a supporting action. Google Play Protect is wrong because it scans for harmful apps and is not a patch-level enforcement control. Encryption of data is wrong because it protects stored data but does not check how current the security patch is.
Rule to remember: compliance policies decide whether a device meets your standard, and conditional access enforces the result. Grace periods belong to the noncompliance action.
Start with the official skills outline on Microsoft Learn and read it against the list of areas above. Mark each area as comfortable, shaky or unfamiliar. Be honest, because the purpose is to decide where your time goes.
Then take the practice test once without notes to see where you stand. Do not worry about the score. Use it to sort topics into those you can skip for now and those that need work.
Work through the topic sets for your weak areas, such as enrolling devices, managing applications and protecting endpoints. After each wrong answer, read the explanation, then open the matching Microsoft Learn page and find the setting in the Intune admin center if you have a test tenant. Seeing the real menu fixes the idea in memory far better than rereading.
Write a short note for every mistake: what the question was really asking and which rule decides it. Review those notes in the last days before the exam.
Finally, read the exam duration and format page on Microsoft Learn so the 100 minute limit and question style are familiar before you book.
Microsoft Endpoint Manager (MEM) is a crucial platform for managing and securing endpoints. It integrates various services, such as Microsoft Intune and Configuration Manager, to provide a unified approach to endpoint management. Key features of MEM include:
Familiarity with MEM is essential for the MD-102 exam. Candidates should understand how to configure and deploy MEM, as well as troubleshoot common issues.
Desktop management involves configuring and maintaining desktop systems to ensure they are secure, functional, and compliant with organizational policies. Key aspects include:
Effective desktop management is crucial for maintaining productivity and ensuring a consistent user experience across devices.
Device configuration is a fundamental aspect of endpoint management. This involves setting up and managing device settings to ensure they meet organizational requirements. Key elements include:
Proper device configuration helps in maintaining security, ensuring compliance, and optimizing device performance.
Endpoint security is a critical domain in the MD-102 exam. It focuses on protecting devices from threats and vulnerabilities. Key areas to cover include:
A solid understanding of endpoint security principles and practices is essential for safeguarding organizational data and ensuring a secure computing environment.
Compliance management ensures that devices and systems adhere to regulatory and organizational standards. Key topics include:
Effective compliance management is vital for avoiding legal issues and maintaining a secure and trustworthy IT environment.
The (MD-102) Endpoint Administrator Exam assesses your ability to manage and secure endpoints in a Microsoft environment. By focusing on Microsoft Endpoint Manager, desktop management, device configuration, endpoint security, and compliance management, you will be well-prepared for the exam. Invest time in understanding these key areas, practice regularly, and stay updated with the latest trends and technologies.
How we verify: editorial & fact-checking policy. Report an error: contact us.
| Pros | Cons |
|---|---|
| Validates your knowledge and skills objectively | Study materials can be expensive |
| Increases job market competitiveness | Exam anxiety can affect performance |
| Provides structured learning goals | Requires dedicated preparation time |
| Networking opportunities with other certified professionals | Retake fees apply if you don't pass |
Try these questions from our free MD-102 - Endpoint Administrator Exam practice tests. The correct answer and an explanation follow each question.
An endpoint administrator configures an update ring with a 10-day feature update deferral. What is the maximum deferral period allowed for feature updates?
Answer: C. 365 days
Feature updates can be deferred for up to 365 days (one year) using Windows Update for Business policies configured in Microsoft Intune.
An endpoint administrator wants to configure a Windows device to use a proxy server for internet traffic. Which Intune profile type supports this configuration?
Answer: C. Device configuration profile (Proxy settings)
Intune device configuration profiles include proxy settings that let administrators define proxy server address, port, and bypass rules for Windows devices.
An administrator wants to block USB drives on corporate Windows 10 devices using Intune. Which policy type should be used?
Answer: A. Endpoint security – Attack surface reduction
Attack surface reduction policies in Intune include removable storage device controls that can block USB drives and other removable media on managed Windows devices.
Which Microsoft service provides a centralized security dashboard that aggregates alerts from Defender for Endpoint, Intune compliance, and identity risk?
Answer: B. Microsoft 365 Defender portal
The Microsoft 365 Defender portal (security.microsoft.com) aggregates security signals from Defender for Endpoint, Defender for Identity, and other services into a unified security dashboard.
Take the full MD-102 - Endpoint Administrator Exam practice test