MD-102 Certification: Endpoint Administrator Training Guide

What Is MD-102?

The MD-102: Endpoint Administrator is a Microsoft certification exam that validates the skills required to deploy, configure, manage, and protect endpoint devices across an organization. Passing MD-102 earns the Microsoft 365 Certified: Endpoint Administrator Associate credential — a widely recognized certification in the enterprise IT and cloud management space.

Endpoint administrators are responsible for managing the devices that employees use to access organizational data and applications — laptops, desktops, mobile phones, tablets, and virtual endpoints. The MD-102 exam focuses specifically on the tools and practices that modern IT professionals use to manage these devices in cloud and hybrid environments, with Microsoft Intune, Microsoft Defender for Endpoint, and Azure Active Directory (now Entra ID) at the center of the technical scope.

MD-102 replaced the MD-101 exam (formerly "Managing Modern Desktops") as Microsoft updated its certification framework to reflect the shift from on-premises management toward cloud-first device management using Intune. The current MD-102 exam emphasizes modern management approaches — Autopilot for device provisioning, Intune for policy and compliance management, and Defender for Endpoint for threat protection — reflecting how enterprise IT departments now operate at scale.

Whether you are an IT professional seeking to validate your endpoint management skills, a system administrator transitioning into Microsoft 365 environments, or an entry-level technician building toward a cloud-focused career, the MD-102 certification demonstrates proficiency in skills that organizations actively seek as they migrate workloads to Microsoft 365.

For organizations, having certified MD-102 professionals on the team accelerates the adoption and optimization of Microsoft Intune. Endpoint management is directly tied to security outcomes — misconfigurations in Intune policies, compliance gaps, or poorly managed Autopilot deployments create security vulnerabilities that attackers exploit. An MD-102 certified administrator has demonstrated the knowledge needed to design and maintain endpoint management environments that meet enterprise security standards, making this certification valuable to both the individual and the employer.

Microsoft updates the MD-102 exam periodically to reflect product changes in Intune, Windows, and the broader Microsoft 365 ecosystem. The exam objectives document specifies the current version of the exam and its effective date. Checking this document before starting your preparation ensures your study materials align with the current exam scope rather than an older version of the test.

MD-102 Exam Structure and Topics

The MD-102 exam covers five major functional domains, each weighted by its proportion of exam questions. Understanding which domains carry the most weight helps candidates allocate study time proportionally and avoid over-investing in lower-priority areas at the expense of more heavily tested content.

Deploy Windows client (25–30%): This is the highest-weighted domain and covers Windows Autopilot for zero-touch deployment, Windows deployment methods (in-place upgrade, fresh start, wipe-and-reload), deployment profiles, Autopilot scenarios (user-driven, self-deploying), and Microsoft Deployment Toolkit (MDT) basics. Candidates should understand Autopilot profile configuration, dynamic device grouping in Azure AD, and the enrollment status page (ESP) behavior in detail.

Manage identity and compliance (15–20%): This domain covers Azure AD Join, Hybrid Azure AD Join, enterprise state roaming, Windows Hello for Business, Multi-Factor Authentication (MFA) configuration, and Conditional Access policies. Understanding how identity flows through Microsoft Entra ID to endpoint management decisions is critical for both this domain and for overall exam success.

Manage, maintain, and protect devices (40–45%): The largest domain by question weight, this section tests Microsoft Intune configuration thoroughly — device enrollment, compliance policies, configuration profiles, app deployment, software update management, and endpoint security policies. Candidates must be comfortable creating and troubleshooting Intune policies and understanding how policy conflicts are resolved.

Manage apps and data (10–15%): Covers app deployment through Intune (Win32 apps, Microsoft Store apps, LOB apps), Microsoft 365 Apps management, app protection policies for mobile devices (MAM), and data loss prevention concepts relevant to endpoint management. Understanding the difference between app protection policies with and without enrollment (MAM without MDM) is a commonly tested concept.

Co-management — the configuration that allows devices to be managed simultaneously by both SCCM (Configuration Manager) and Intune — appears on the exam as a bridging concept for organizations in the process of migrating from on-premises to cloud management. Understanding co-management workloads, how to shift workloads from SCCM to Intune incrementally, and how to use co-management as a transition strategy is tested at the 200–300 level of question depth.

Windows update management through Intune update rings is a frequently tested area that surprises candidates who expect SCCM-style WSUS-based update management. Intune update rings use Windows Update for Business (WUfB) policies — cloud-native, without requiring an on-premises server. Candidates should understand how to configure quality update deferrals, feature update deferrals, active hours, pause behavior, and how update rings interact with each other in environments with multiple rings targeting overlapping device groups.

Understanding how Defender for Endpoint integrates with Intune is another frequently tested area. Candidate knowledge should cover how to connect Defender for Endpoint to Intune through the Endpoint Security node, how to configure Defender policies (antivirus, endpoint detection and response, attack surface reduction) through Intune profiles, and how Defender risk signals flow into Conditional Access policies to block risky devices from accessing corporate resources.

Prerequisites and Target Audience

MD-102 is a Microsoft Associate-level certification, meaning it targets IT professionals with some experience rather than complete beginners. Microsoft's official prerequisite recommendation is familiarity with Microsoft 365 workloads, device management concepts, and basic networking. The exam assumes knowledge of Windows client operating systems, Azure Active Directory fundamentals, and basic IT security concepts.

There is no formal prerequisite certification required before taking MD-102 — it is not gated behind another exam. However, candidates who have completed the MS-900: Microsoft 365 Fundamentals exam or hold the Microsoft 365 Fundamentals certification will find the MD-102 transition more natural, as they will have foundational knowledge of Microsoft 365 services, licensing, and the overall Microsoft cloud platform.

The ideal MD-102 candidate is an IT professional working in one of these roles: endpoint administrator, desktop administrator, system administrator, IT support engineer, or cloud infrastructure administrator in an environment using Microsoft 365. Candidates currently managing devices with on-premises tools (Group Policy, SCCM/Configuration Manager) who are transitioning their environments to cloud-managed models will find MD-102 particularly valuable as a structured learning path for modern management skills.

Entry-level IT professionals aiming to enter the endpoint management field can also pursue MD-102, but they should budget more preparation time and supplement exam study with hands-on lab work to build the practical familiarity the exam expects. Candidates without any Microsoft 365 or Azure AD experience may find 3–6 months of preparation necessary before they are ready to sit the exam confidently.

Candidates preparing for MD-102 who work in environments that have not yet adopted Intune face a particular challenge — they are studying a tool they cannot practice with in their current role. The solution is the Microsoft 365 trial tenant, which gives full access to Intune, Azure AD, and Autopilot for 30–90 days at no cost. Investing time in lab work with the trial tenant provides hands-on familiarity that is genuinely irreplaceable. Many of the most confusing exam questions involve subtle Intune behaviors that only become intuitive after you have actually seen them in a live environment.

Co-management experience in a current role is a significant differentiator among MD-102 candidates. Professionals who have personally managed the migration from SCCM workloads to Intune — even partially — have real-world context for the co-management questions that candidates without this experience must understand purely conceptually. If your organization is considering Intune adoption, volunteering to participate in a pilot deployment or proof-of-concept environment builds precisely the hands-on experience the exam rewards.

MD-102 Training and Study Guide

Effective MD-102 preparation typically requires 6–10 weeks of focused study for candidates with some Microsoft 365 experience, or 10–16 weeks for those newer to Intune and Azure AD. The preparation timeline depends heavily on existing experience — IT professionals already managing Intune environments may pass with 4–6 weeks of gap-filling preparation, while those transitioning from purely on-premises environments will benefit from a longer runway.

Start with the exam objectives: Download Microsoft's official MD-102 exam skills outline and review every listed objective. Self-rate your current knowledge for each area from 1 (unfamiliar) to 5 (proficient). This honest assessment creates your personal study roadmap, directing your effort toward gaps rather than wasting time on areas you already know well.

Use Microsoft Learn as your backbone: Work through the official MD-102 learning path on Microsoft Learn. This free resource covers all exam domains with structured modules, interactive exercises, and embedded knowledge checks. The learning path is regularly updated to reflect current exam content — a significant advantage over third-party books that may lag behind exam updates.

Build a lab environment: Hands-on practice is non-negotiable for MD-102 success. Create a free Microsoft 365 trial tenant (available at Microsoft.com) and practice enrolling devices in Intune, building Autopilot profiles, configuring compliance and conditional access policies, and deploying apps. Candidates who have logged 20+ hours of Intune hands-on time consistently outperform those who rely solely on reading and video content.

Practice scenario-based questions: MD-102 includes scenario questions — multi-step situations where you must select the best response from several technically valid options. These questions test judgment and prioritization, not just recall. Practicing with scenario-based question banks exposes you to the decision-making logic the exam rewards and helps avoid the common mistake of selecting technically correct but suboptimally ranked answers.

Microsoft Learn is consistently the most current and authoritative free study resource for MD-102. Because Microsoft maintains the learning content in parallel with product updates, the modules reflect current Intune and Azure AD capabilities rather than outdated documentation. When Microsoft updates the MD-102 exam objectives — which typically happens every 6–12 months — the corresponding learning path modules are also updated. This alignment between the exam and the free learning path makes Microsoft Learn a uniquely reliable primary resource for exam preparation.

One of the most common exam preparation mistakes for MD-102 is focusing exclusively on conceptual understanding without building procedural fluency. The exam asks not just what policies exist but how to configure them, what happens when settings conflict, and which approach is most appropriate in a given scenario. Building procedural fluency requires hands-on practice — reading about Intune compliance policies is necessary but insufficient preparation for questions about how to configure a specific compliance scenario correctly.

Exam fatigue is a real consideration for MD-102 candidates who schedule the exam without adequate preparation. Microsoft's exam environment at Pearson VUE presents complex scenario-based questions that require careful reading — rushing through questions due to time pressure leads to errors on questions where you actually know the content. Practicing full-length exams under realistic time constraints builds the mental endurance needed to maintain focus through 40–60 questions in a 120-minute window without declining performance in the later portions of the exam.

After passing MD-102, log your score report and certification details in your professional development records immediately. Microsoft certifications are tied to your Microsoft account, but maintaining a local copy of the certificate and exam transcript protects you if account access issues arise. Many employers request certification verification during hiring — being able to provide documentation quickly is a professional habit worth establishing from your first certification.

MD-102 Career Value and Salary Impact

The Microsoft Endpoint Administrator Associate certification opens doors to roles that are in strong and consistent demand as organizations continue their migration to Microsoft 365 cloud management. IT departments globally are transitioning from on-premises device management with SCCM and Group Policy to cloud-based management with Intune — and they need professionals who can lead and execute that transition.

Common job titles associated with the MD-102 skillset include: Endpoint Administrator, Modern Device Management Engineer, Microsoft 365 Administrator, Intune Administrator, Cloud PC Administrator, and Systems Administrator specializing in Microsoft 365. Many of these roles are found in mid-to-large enterprises, managed service providers (MSPs), healthcare systems, financial institutions, and government agencies — all of which have significant device fleets to manage securely.

Salary ranges for certified endpoint administrators vary by location, experience, and employer size. In the United States, entry-level Intune administrator roles typically range from $65,000–$85,000 annually. Mid-level endpoint administrators with MD-102 certification and several years of Intune experience earn $90,000–$120,000. Senior endpoint and modern workplace architects with broader Microsoft 365 expertise can command $130,000–$160,000 or more in major metropolitan markets.

The MD-102 pairs well with other Microsoft certifications for career advancement. Combined with the MS-700 (Teams Administrator) or SC-300 (Identity and Access Administrator), it positions a professional as a well-rounded Microsoft 365 specialist. For those pursuing management or architecture roles, the AZ-104 (Azure Administrator) and MS-102 (Microsoft 365 Administrator Expert) certifications build naturally on the endpoint management foundation the MD-102 provides.

For IT professionals currently managing on-premises environments with SCCM and Group Policy, the MD-102 certification signals to current and future employers that you are actively building modern management skills — not waiting to be forced into cloud adoption. This forward-looking positioning is particularly valuable in organizations undergoing digital transformation, where endpoint administrators who have proactively built cloud management expertise are better positioned for promotion to senior or lead roles overseeing the transition.

The endpoint management space is also expanding beyond traditional laptops and desktops. Windows 365 Cloud PCs, Microsoft Azure Virtual Desktop (AVD), and Android/iOS device management through Intune are all within the MD-102 scope. Professionals who develop expertise in these emerging areas of modern endpoint management — not just traditional Windows device management — add significant additional career value beyond what the base certification signals.

The networking and remote work trends accelerated by hybrid work models have made endpoint management skills more commercially valuable than ever. With employees accessing corporate resources from home networks, personal devices, and public Wi-Fi, the demand for Intune expertise in configuring compliant, secure access through Conditional Access and device-based policies is growing rather than shrinking. MD-102 certification positions professionals squarely in the growth area of enterprise IT.