The MD-102 (Microsoft 365 Endpoint Administrator) exam tests your ability to deploy, configure, secure, manage, and monitor devices and applications in an enterprise Microsoft 365 environment. If you manage endpoints using Intune, Windows Autopilot, or Configuration Manager, this exam validates your skills.
These 25 questions mirror real exam scenarios — no trivial definitions, only applied knowledge. Want broader exam context? Check out our MD-102 study guide or visit the MD-102 certification page for full details.
What You'll Get:
- ✓25 scenario-based questions across all exam domains
- ✓Detailed explanations for every answer option
- ✓Real exam format — same style as Microsoft questions
- ✓Scoring guide to assess your readiness
What These Questions Cover
📝 Practice Test Instructions
- • Each question has ONE correct answer
- • Read each scenario carefully before selecting your answer
- • Keep track of your answers before scrolling to the answer key
- • Aim to complete all 25 questions in 25 minutes
Deploy Windows Client
Questions 1–8
Windows Autopilot
Your organization is deploying 500 new laptops to remote employees. The devices will ship directly from the manufacturer. You want employees to self-provision their devices without IT involvement, with all apps and policies applied automatically upon first sign-in.
Which deployment method should you use?
Autopilot Deployment Profile
You are configuring a Windows Autopilot deployment profile. You need to ensure the device is joined to Microsoft Entra ID (formerly Azure AD) and enrolled in Intune during OOBE, but the user should NOT be prompted to set up a PIN during initial setup.
Which setting should you configure in the deployment profile?
Windows Update Rings
Your company wants to control how Windows feature updates are deployed to devices. The IT team should receive updates first (within 7 days), the general workforce after 21 days, and critical production systems after 45 days.
What should you configure in Microsoft Intune to achieve this staged rollout?
Enrollment Status Page
During Autopilot deployment, users are reporting they can reach the desktop before their required security apps finish installing. A user accidentally deleted a required app before it finished enrolling. You need to block access to the desktop until all required apps are installed.
What should you configure?
Co-management
Your organization uses Configuration Manager for device management. You want to gradually move workloads to Microsoft Intune, starting with compliance policies, while keeping software distribution in Configuration Manager.
What should you enable to achieve this?
Autopilot Reset
An employee is leaving the company. Their device needs to be wiped and reconfigured for a new employee while retaining the device's Autopilot registration. The device is Entra ID joined and managed by Intune.
What is the MOST efficient approach?
Windows Subscription Activation
Your organization has Microsoft 365 E3 licenses. You want Windows 10 Pro devices to automatically upgrade to Windows 10 Enterprise when users sign in with their Microsoft 365 credentials, without any manual intervention.
Which feature enables this automatic upgrade?
Delivery Optimization
Your organization has 1,000 devices in a branch office connected to HQ via a 50 Mbps WAN link. Windows updates are consuming the majority of this bandwidth during business hours. You want devices to share update content with each other locally rather than downloading from the internet individually.
Which feature should you configure?
Manage Identity & Compliance
Questions 9–16
Entra ID Join vs Hybrid Join
Your company is migrating from on-premises AD to a cloud-first model. New devices will never need to access on-premises resources directly. You need the simplest identity join option that allows Intune management and SSO to Microsoft 365.
Which join type should you use for new devices?
Intune Compliance Policies
You create a compliance policy in Intune requiring BitLocker encryption and a minimum OS version of Windows 11 22H2. A device fails compliance because BitLocker is not enabled. You want non-compliant devices to automatically lose access to Microsoft 365 after a 3-day grace period.
What must you configure in addition to the compliance policy?
Conditional Access
Your security team wants to ensure that only devices enrolled in Intune and marked compliant can access Exchange Online. BYOD devices that are not enrolled should be blocked.
What is the correct configuration?
App Protection Policies
Your organization allows employees to use personal iOS devices to access corporate email via the Outlook app. You do NOT want to enroll these personal devices in Intune. You need to prevent users from copying corporate data from Outlook to personal apps.
What should you configure?
Enrollment Restrictions
Your company wants to prevent Android devices with OS versions below Android 10 from enrolling in Intune. Existing enrolled devices that are below this version should remain enrolled but new enrollments must be blocked.
What should you configure?
BitLocker Management
You need to deploy BitLocker encryption to all company Windows 11 devices using Intune. Recovery keys must be automatically backed up to Microsoft Entra ID so IT can retrieve them if needed.
Which Intune policy type should you create?
Microsoft Defender for Endpoint Integration
You want to use the device risk level from Microsoft Defender for Endpoint in Intune compliance policies. Devices with high risk scores should automatically be marked non-compliant.
What must you configure first before using risk scores in compliance policies?
Windows Hello for Business
Your organization wants to eliminate password-based sign-in on all Intune-managed Windows 11 devices. Users should authenticate using a PIN or biometrics that is tied to the device and backed by TPM. Entra ID is used as the identity provider.
What should you configure?
Manage, Maintain & Protect Devices
Questions 17–25
Intune Device Configuration Profiles
You need to configure all Windows 11 devices to disable USB storage devices, enforce a screensaver after 5 minutes of inactivity, and configure Windows Firewall settings. All settings must be centrally managed through Intune.
What should you create?
Intune App Deployment
You need to deploy Microsoft Teams to all enrolled Windows devices silently in the background without user interaction. If the deployment fails on any device, you want to be notified.
What app assignment type should you use in Intune?
Remote Actions
An employee reports their laptop was stolen. You need to immediately prevent anyone from accessing company data on the device, but the device has not checked in to Intune in 48 hours. You want to take the MOST immediate action available.
What remote action should you initiate from Intune?
Intune Filters
You have a single device configuration profile that should only apply to Windows 11 devices running version 22H2 or later. You do not want to create separate groups for these devices.
What Intune feature allows you to scope a policy to devices matching specific properties without creating new device groups?
Windows Defender Antivirus
You need to configure Microsoft Defender Antivirus scan schedules, exclusion paths, and real-time protection settings for all Intune-managed Windows devices through a single policy.
Where in Intune should you configure these Defender Antivirus settings?
Attack Surface Reduction Rules
Your security team wants to prevent Office applications from spawning child processes, block executable content in email, and prevent credential theft from the Windows local security authority (LSA). These rules should be enforced (not just audited).
Where should you configure Attack Surface Reduction rules in Intune?
Intune Reporting
Your management team wants a weekly report showing how many devices are compliant vs. non-compliant broken down by OS version and assignment group. They want to receive this report by email automatically.
What is the BEST way to deliver this in Intune?
Windows Information Protection
Your organization needs to prevent users from copying work data from managed apps to personal apps on corporate Windows devices enrolled in Intune, without encrypting personal data on the device.
Which feature provides this separation between work and personal app data?
Endpoint Analytics
Your help desk reports that many users experience slow boot times and application startup delays. You want to proactively identify devices with poor performance scores and understand which startup processes are causing the delays, without running scripts on each device.
Which Microsoft Endpoint Manager feature provides these startup performance insights?
✋ Stop Here Before Scrolling!
Have you answered all 25 questions? Complete the test before checking the answers below.
Pro tip: Write down your answers (1–25)
Track which topics you struggled with for focused study
📝 Answer Key with Detailed Explanations
Review each explanation carefully, even for questions you answered correctly
Quick Answer Reference
Question 1: Windows Autopilot
✓ Correct Answer: A) Windows Autopilot user-driven mode
Why this is correct:
User-driven mode is designed for scenarios where devices ship directly to end users. The user signs in with their corporate credentials and the device joins Entra ID, enrolls in Intune, and receives all assigned apps and policies automatically — no IT intervention needed at the device.
Why other answers are incorrect:
💡 Key Concept:
User-driven = employee signs in themselves. Self-deploying = no user, uses device identity (TPM). Pre-provisioned = IT does partial setup then ships.
Question 2: Autopilot Deployment Profile
✓ Correct Answer: B) Set Join to Azure AD as Entra ID joined and skip PIN setup in the enrollment status page
Why this is correct:
The Autopilot deployment profile controls the join type (Entra ID vs Hybrid). PIN setup is controlled through the ESP (Enrollment Status Page) or Windows Hello for Business policy — you can skip specific OOBE pages in the profile settings.
Why other answers are incorrect:
💡 Key Concept:
In Autopilot profiles you can hide specific OOBE screens: privacy settings, EULA, keyboard, account type. Windows Hello PIN skip is a separate setting.
Question 3: Windows Update Rings
✓ Correct Answer: C) Windows Update for Business policies with different deferral periods per group
Why this is correct:
Windows Update for Business (configured in Intune as Update Rings) allows you to set deferral periods for feature and quality updates. By assigning different rings with 7, 21, and 45-day deferrals to different device groups, you achieve staged rollout without on-premises infrastructure.
Why other answers are incorrect:
💡 Key Concept:
Update Ring deferral: 0 days = gets update immediately after release. 7 days = 7 days after release. Rings should be assigned to AAD groups (pilot, broad, critical).
Question 4: Enrollment Status Page
✓ Correct Answer: D) Set the Enrollment Status Page to block device use until required apps are installed
Why this is correct:
The ESP (Enrollment Status Page) has a setting "Block device use until all apps and profiles are installed." When enabled, users cannot access the desktop until all required apps finish installing. This is specifically designed to prevent users from using a partially configured device.
Why other answers are incorrect:
💡 Key Concept:
ESP applies during Autopilot enrollment AND regular Intune enrollment. You can target specific apps as "blocking apps" in the ESP profile.
Question 5: Co-management
✓ Correct Answer: A) Co-management with a workload pilot for compliance policies moved to Intune
Why this is correct:
Co-management allows organizations running Configuration Manager to simultaneously manage devices with Intune. Individual workloads (compliance, device configuration, resource access, etc.) can be moved to Intune independently using pilot collections, enabling a gradual migration.
Why other answers are incorrect:
💡 Key Concept:
Co-management workloads (7 total): Compliance, Device Configuration, Resource Access Policies, Endpoint Protection, Windows Update for Business, Client Apps, and Office Click-to-Run.
Question 6: Autopilot Reset
✓ Correct Answer: B) Use Windows Autopilot Reset from Intune
Why this is correct:
Windows Autopilot Reset removes user data and resets the device to a ready-to-deploy state while preserving the device's Autopilot registration, Entra ID join, and Intune enrollment. The next user can sign in and receive their profile automatically. It's faster than re-imaging and doesn't lose the device registration.
Why other answers are incorrect:
💡 Key Concept:
Autopilot Reset vs Wipe vs Retire: Reset = reconfigure for new user, keeps Autopilot. Wipe = factory reset, may remove Autopilot. Retire = removes corporate data, leaves personal data.
Question 7: Windows Subscription Activation
✓ Correct Answer: C) Windows Subscription Activation
Why this is correct:
Windows Subscription Activation (formerly Windows 10/11 Enterprise E3/E5 via subscription) automatically upgrades Windows Pro to Enterprise when a user signs in with a Microsoft 365 license that includes Windows Enterprise rights. No imaging or manual upgrade required — the license does it automatically.
Why other answers are incorrect:
💡 Key Concept:
Subscription Activation requires: Windows Pro device + Microsoft 365 E3/E5 or Windows 10/11 Enterprise subscription + Entra ID user account. The upgrade happens transparently.
Question 8: Delivery Optimization
✓ Correct Answer: D) Delivery Optimization with LAN peer-to-peer mode
Why this is correct:
Delivery Optimization is a built-in Windows feature that enables peer-to-peer content sharing. In LAN mode, devices download updates once from the internet then share with other devices on the same local network, dramatically reducing WAN bandwidth consumption.
Why other answers are incorrect:
💡 Key Concept:
Delivery Optimization modes: HTTP only, LAN (P2P), Group (P2P across subnets/VLANs), Internet (P2P across internet), Simple (no P2P), Bypass. Configure via Intune Update Ring or DO policy.
Question 9: Entra ID Join vs Hybrid Join
✓ Correct Answer: A) Microsoft Entra ID Join
Why this is correct:
Entra ID Join (formerly Azure AD Join) is the cloud-native option — perfect for devices that only need access to cloud resources (Microsoft 365, Azure). It's simpler to configure than Hybrid Join, doesn't require domain controllers or line-of-sight to on-premises AD, and enables full Intune management.
Why other answers are incorrect:
💡 Key Concept:
Decision tree: Need on-prem resources (file shares, printers via LDAP) → Hybrid Join. Cloud-only workloads → Entra ID Join. Personal BYOD → Register/Workplace Join.
Question 10: Intune Compliance Policies
✓ Correct Answer: B) A conditional access policy that grants access only to compliant devices
Why this is correct:
Compliance policies alone only mark devices as compliant or non-compliant — they don't enforce access restrictions by themselves. You must pair them with a Conditional Access policy that uses "Require device to be marked as compliant" as a grant control. The 3-day grace period is configured in the compliance policy itself.
Why other answers are incorrect:
💡 Key Concept:
Compliance + Conditional Access = enforcement. Compliance alone = reporting/marking only. Always pair compliance policies with CA policies to block non-compliant access.
Question 11: Conditional Access
✓ Correct Answer: C) Create a conditional access policy requiring a compliant device as a grant control, targeting Exchange Online
Why this is correct:
Conditional Access with "Require device to be marked as compliant" grant control checks Intune compliance before granting access to the specified cloud app (Exchange Online). BYOD devices not enrolled in Intune can never be marked compliant, so they're effectively blocked.
Why other answers are incorrect:
💡 Key Concept:
Common CA grant controls: MFA, Compliant device, Hybrid AD joined, Approved client app, App protection policy. For full device blocking, use "Require compliant device."
Question 12: App Protection Policies
✓ Correct Answer: D) Intune app protection policy (MAM without enrollment)
Why this is correct:
Mobile Application Management (MAM) without enrollment (also called MAM-WE or MAM-only) allows Intune to manage apps on personal devices without enrolling the device. App protection policies can prevent copy/paste between managed and unmanaged apps, require PIN to open managed apps, and remotely wipe corporate data from the app only.
Why other answers are incorrect:
💡 Key Concept:
MAM-WE protects: Outlook, Teams, OneDrive, Edge, and other managed apps on unenrolled devices. It can enforce cut/copy restrictions, PIN, and selective wipe of corporate data only.
Question 13: Enrollment Restrictions
✓ Correct Answer: A) A device enrollment restriction with minimum OS version set to Android 10
Why this is correct:
Device enrollment restrictions in Intune allow you to control which devices can enroll based on platform, OS version, and whether they're personally owned. Setting a minimum Android version blocks new enrollments for older devices without affecting already-enrolled devices.
Why other answers are incorrect:
💡 Key Concept:
Enrollment restrictions are evaluated BEFORE enrollment. Compliance policies are evaluated AFTER enrollment. Use restrictions to prevent old/unsupported devices from enrolling.
Question 14: BitLocker Management
✓ Correct Answer: B) Endpoint security — Disk Encryption policy with BitLocker settings and recovery key backup to Azure AD
Why this is correct:
The Endpoint Security > Disk Encryption policy in Intune is specifically designed for BitLocker and FileVault management. It includes settings for recovery key storage location (Azure AD is a supported option), encryption algorithms, and startup authentication. Recovery keys backed up to Entra ID can be retrieved by admins or self-served by users.
Why other answers are incorrect:
💡 Key Concept:
BitLocker recovery key backup: Intune Disk Encryption policy → Configure "Save BitLocker recovery information to Azure AD" = Required. Keys then appear in Entra ID device properties or Intune device details.
Question 15: Microsoft Defender for Endpoint Integration
✓ Correct Answer: C) Create a service-to-service connection between Intune and Microsoft Defender for Endpoint
Why this is correct:
To use MDE device risk levels in Intune compliance policies, you must first establish a service connection in the Intune admin center (Endpoint security > Microsoft Defender for Endpoint > Open the Microsoft Defender for Endpoint admin console). This connection allows Intune to receive device risk signals from MDE.
Why other answers are incorrect:
💡 Key Concept:
MDE-Intune integration steps: 1) Enable connection in Intune, 2) Enable connection in MDE, 3) Create a compliance policy using "Require the device to be at or under the machine risk score," 4) Assign CA policy.
Question 16: Windows Hello for Business
✓ Correct Answer: D) Windows Hello for Business via Intune identity protection profile
Why this is correct:
Windows Hello for Business (WHfB) replaces passwords with strong two-factor authentication using PIN or biometrics backed by TPM. Configured through Intune's Identity Protection profile (or Endpoint Security > Account Protection), it binds credentials to the device's TPM, making them non-exportable and phishing-resistant.
Why other answers are incorrect:
💡 Key Concept:
WHfB vs FIDO2: WHfB = built into Windows, uses device TPM, PIN+biometrics. FIDO2 = external hardware key or passkey. Both are passwordless but WHfB is the built-in Windows solution.
Question 17: Intune Device Configuration Profiles
✓ Correct Answer: A) Three separate device configuration profiles (Device Restrictions, Endpoint Protection, Administrative Templates)
Why this is correct:
In Intune, different settings categories are managed through different profile types. USB restrictions fall under Device Restrictions, firewall settings under Endpoint Protection, and screensaver under Administrative Templates (ADMX-backed policies). While you could use Settings Catalog to combine them, creating separate targeted profiles is best practice for manageability.
Why other answers are incorrect:
💡 Key Concept:
Intune profile types: Device Restrictions (general limits), Endpoint Protection (Defender, firewall, BitLocker), Administrative Templates (ADMX policies), Settings Catalog (combines all settings in one place).
Question 18: Intune App Deployment
✓ Correct Answer: B) Required
Why this is correct:
"Required" assignment in Intune installs the app automatically on targeted devices/users without user interaction. The device will install the app silently in the background. Intune reports installation status per device, and you can view failed installations in the app deployment report.
Why other answers are incorrect:
💡 Key Concept:
App assignment types: Required = force install, Available = self-service install via CP, Uninstall = force remove, Available without enrollment = BYOD self-service. Silent install requires Win32 app or MSI package with silent install switches.
Question 19: Remote Actions
✓ Correct Answer: C) Wipe (factory reset)
Why this is correct:
When a device is stolen, Wipe (factory reset) removes ALL data including corporate data and returns the device to factory state. Even though the device hasn't checked in, the wipe command is queued in Intune and will execute when the device next connects to the internet. This is the most complete data protection action.
Why other answers are incorrect:
💡 Key Concept:
Wipe vs Retire: Wipe = full factory reset (nuclear option). Retire = selective wipe of corporate data only (good for BYOD offboarding). Both queue and execute on next check-in.
Question 20: Intune Filters
✓ Correct Answer: D) Assignment filters
Why this is correct:
Assignment filters let you target policies to devices matching specific properties (OS version, device model, enrollment type) at assignment time, without creating separate device groups. They use managed device properties and evaluate dynamically when a device checks in.
Why other answers are incorrect:
💡 Key Concept:
Filter syntax example: (osVersion -startsWith "10.0.19045") targets Windows 11 22H2. Filters can be used as Include or Exclude at the assignment level of any policy.
Question 21: Windows Defender Antivirus
✓ Correct Answer: A) Endpoint security — Antivirus — Windows Defender Antivirus policy
Why this is correct:
The Endpoint Security > Antivirus section in Intune is the dedicated area for configuring Microsoft Defender Antivirus settings. It provides a clean interface for scan schedules, exclusions, real-time protection, and cloud-delivered protection, with clear reporting on AV status per device.
Why other answers are incorrect:
💡 Key Concept:
Endpoint Security in Intune has dedicated blades: Antivirus, Disk Encryption, Firewall, EDR, Attack Surface Reduction, and Account Protection — use the matching blade for each security domain.
Question 22: Attack Surface Reduction Rules
✓ Correct Answer: B) Endpoint security — Attack surface reduction policy
Why this is correct:
Attack Surface Reduction (ASR) rules are configured in Intune under Endpoint Security > Attack surface reduction. You can set each rule to Audit (log only), Block (enforce), or Off. The three rules mentioned (Office child processes, executable email content, LSASS protection) are all standard ASR rules.
Why other answers are incorrect:
💡 Key Concept:
Common ASR rules to know for MD-102: Block Office apps from creating executable content, Block credential stealing from LSASS, Block untrusted/unsigned processes from USB, Block Office from creating child processes.
Question 23: Intune Reporting
✓ Correct Answer: C) Configure a scheduled report in the Intune Reports section with email delivery
Why this is correct:
Intune's built-in Reports section (Reports > Device compliance) supports scheduled reports that can be automatically emailed to specified recipients on a weekly basis. You can filter by OS, compliance state, and configure the exact columns needed.
Why other answers are incorrect:
💡 Key Concept:
Intune scheduled reports: Reports > select a report > Configure schedule > set recurrence (daily/weekly/monthly) > add email recipients. Available for compliance, device configuration, and app reports.
Question 24: Windows Information Protection
✓ Correct Answer: D) Windows Information Protection (WIP) with Intune
Why this is correct:
Windows Information Protection (WIP) separates corporate and personal data on Windows devices. It tags corporate data and prevents it from moving to unmanaged apps (copy/paste, save as, share). It doesn't encrypt personal files — only corporate-tagged data is protected, avoiding user privacy concerns.
Why other answers are incorrect:
💡 Key Concept:
WIP protection levels: Silent (log violations, allow override), Override (warn user), Block (prevent data movement). WIP is being deprecated in favor of Microsoft Purview Information Protection — know both for the exam.
Question 25: Endpoint Analytics
✓ Correct Answer: A) Endpoint Analytics — Startup performance
Why this is correct:
Endpoint Analytics collects telemetry from Intune-managed devices and provides insights including startup performance scores, boot time breakdowns by phase (BIOS/OS/login), and app reliability scores. It identifies devices with poor scores and drills into specific processes causing delays — no scripts needed.
Why other answers are incorrect:
💡 Key Concept:
Endpoint Analytics provides: Startup performance, App reliability, Work from anywhere score, Battery health, Resource performance. All derived from Intune telemetry — zero additional agents needed.
📊 How Did You Score?
Ready for More MD-102 Practice?
These 25 questions are just a sample. The actual MD-102 exam has 40–60 questions.
MSCertQuiz MD-102 includes 500 questions covering:
- ✓ Windows Autopilot all modes (user-driven, self-deploying, pre-provisioned)
- ✓ Intune compliance, configuration, and app policies in depth
- ✓ Endpoint security — Defender AV, ASR, EDR, firewall
- ✓ Co-management and workload migration scenarios
- ✓ All question formats: scenario, drag-and-drop, and ordering
$14.99 One-Time Payment
Lifetime access • No subscription • 500 questions