This cheat sheet is a fast, exam-focused review of everything on MD-102 (Microsoft Endpoint Administrator). MD-102 is an associate-level exam built around real Intune administration, so treat this as a consolidation aid for your final days — pair it with a free Intune developer tenant and hands-on practice, not instead of it.
Exam Snapshot
Passing Score
700 / 1000
Cost
$165 USD
Questions
40–60
Time
~120 minutes
Prepare Infrastructure
25–30%
Manage & Maintain
30–35%
Applications
15–20%
Protect Devices
15–20%
1. Prepare Infrastructure for Devices
Device join types
| Microsoft Entra joined | Cloud-native, org-owned; authenticates directly to Entra ID, no on-prem AD. |
| Microsoft Entra hybrid joined | Joined to both on-prem AD and Entra ID; common during migration from traditional AD. |
| Microsoft Entra registered | Typically personal (BYOD) devices; gains access without being org-owned. |
| Co-management | Device managed by both Configuration Manager and Intune simultaneously; workloads shift to Intune gradually. |
Enrollment methods
| Windows Autopilot | Zero-touch provisioning using OEM hardware hash; user-driven, self-deploying, or pre-provisioned modes. |
| Bulk enrollment | Provisioning package (.ppkg) for kiosk or shared devices without per-user Autopilot. |
| Automatic enrollment (MDM push) | Devices enroll automatically at Entra join if MDM auto-enrollment is configured. |
| Apple/Android enrollment | Apple Business Manager + ADE for supervised iOS/macOS; Android Enterprise (fully managed, work profile, dedicated). |
Intune administration
| Intune role-based access control | Built-in and custom roles scoped to specific device or user groups. |
| Scope tags | Limit which admins can see/manage a given policy or app across business units. |
| Device categories & dynamic groups | Organize devices for targeted profile and app assignment. |
Most-tested distinction: Entra joined devices have no on-prem AD dependency at all; hybrid joined devices still authenticate against on-prem AD alongside Entra ID. Choose hybrid only when legacy on-prem resources still require Kerberos/NTLM.
2. Manage & Maintain Devices
Profiles & compliance
| Configuration profile | Actively applies settings — Wi-Fi, VPN, restrictions, certificates, endpoint security baselines. |
| Compliance policy | Defines rules a device must meet (encryption, min OS version, jailbreak/root detection); reports compliant/non-compliant. |
| Settings catalog | Searchable, granular list of every configurable setting — replaces most legacy profile templates. |
| Conditional Access + compliance | Require a device to be marked compliant before granting access to corporate resources. |
Updates & monitoring
| Windows Update for Business | Update rings control feature/quality update deferral and deadlines without WSUS. |
| Feature update profiles | Target and control which Windows version a device group receives. |
| Endpoint analytics | Startup performance, proactive remediations, and app reliability scoring. |
| Remote actions | Remote lock, wipe, retire, fresh start, restart, sync from the Intune console. |
Device lifecycle
| Wipe | Resets device to factory settings, removing all data and management. |
| Retire | Removes company data and management but leaves personal data intact (BYOD-friendly). |
| Fresh Start | Reinstalls a clean Windows OS while keeping the device Intune-enrolled. |
Most-tested distinction: a configuration profile actively sets a device state; a compliance policy only checks and reports state (and feeds Conditional Access). A device can be compliant without any configuration profile applied at all.
Test the concepts you just reviewed
Try 40 Free MD-102 Practice Questions
Scenario-based questions with detailed explanations. No credit card required.
Start Free Practice →3. Manage Applications
| App type | Notes |
|---|---|
| Line-of-business (LOB) app | Custom-built .msi/.msix/.ipa/.apk uploaded directly to Intune. |
| Store app | Microsoft Store, Apple App Store, or Google Play app referenced by Intune. |
| Win32 app | Traditional .exe/.msi wrapped as .intunewin; supports detection rules and dependencies. |
| Web link | Deploys a shortcut to a web app rather than installing software. |
Assignment & protection
| Required vs Available vs Uninstall | Assignment intents controlling whether an app auto-installs, appears in Company Portal, or is removed. |
| App configuration policy | Pre-set in-app settings (e.g., server URL) so users don't configure manually. |
| App protection policy (MAM) | Protects corporate data inside apps (copy/paste, save-as restrictions) without full device enrollment — works on unmanaged/BYOD devices. |
Most-tested distinction: MDM (device enrollment) manages the whole device; MAM/app protection policies protect corporate data inside specific apps without enrolling the device at all — the standard approach for personal/BYOD phones.
4. Protect Devices
| Capability | What it does |
|---|---|
| Microsoft Defender for Endpoint | EDR onboarding, threat & vulnerability management, connected to Intune for device risk signals. |
| Attack surface reduction (ASR) rules | Block specific risky behaviors (e.g., Office child processes, credential theft) at the endpoint. |
| BitLocker / device encryption | Enforce and monitor disk encryption via endpoint security policies. |
| Windows Hello for Business | Device-bound biometric/PIN sign-in replacing passwords. |
| Security baselines | Microsoft pre-configured, best-practice setting groups for Windows and Defender. |
| Device compliance + risk-based Conditional Access | Feed Defender risk score into compliance state to block risky devices automatically. |
Most-tested distinction: security baselines are a starting template you can customize; a compliance policy is the pass/fail gate that Conditional Access checks. Baselines configure; compliance policies verify.
5. Acronym Quick List
MDM — Mobile Device Management
MAM — Mobile Application Management
WHfB — Windows Hello for Business
ASR — Attack Surface Reduction
ADE — Automated Device Enrollment (Apple)
ABM — Apple Business Manager
LOB — Line-of-Business (app)
EDR — Endpoint Detection and Response
CA — Conditional Access
WUfB — Windows Update for Business
RBAC — Role-Based Access Control
PPKG — Provisioning Package
Reviewed the cheat sheet? Now prove you're ready.
Take the free 5-minute MD-102 readiness quiz — no signup required — or jump into 40 free practice questions calibrated harder than the real exam.
Common Questions
Is a cheat sheet enough to pass MD-102?
No. MD-102 is an associate-level exam with scenario and configuration questions that assume hands-on Intune experience. A cheat sheet is a fast consolidation aid for your final review — pair it with a free Intune/Entra developer tenant and hands-on practice, not instead of it.
What is the difference between a compliance policy and a configuration profile in Intune?
A compliance policy defines the rules a device must meet (e.g., encryption enabled, minimum OS version) and reports a compliant/non-compliant state, often used by Conditional Access. A configuration profile actively applies settings to a device (e.g., Wi-Fi profiles, restrictions, certificates) rather than just checking a condition.
What is the difference between Microsoft Entra joined, hybrid joined, and registered devices?
Entra joined devices are owned by the organization and authenticate directly to Entra ID with no on-prem AD dependency. Hybrid Entra joined devices are joined to both on-prem AD and Entra ID, common in environments migrating from traditional AD. Entra registered devices are typically personal (BYOD) devices that gain access without being organization-owned.
What is the passing score and cost for MD-102?
700 out of 1000 (roughly 70%). The exam costs $165 USD, has around 40–60 questions, and a time limit of about 120 minutes.
About MSCertQuiz
MSCertQuiz provides 500 practice questions per certification, calibrated harder than the real exam so test day feels easier. Questions are built by certified professionals and updated for 2026 exam objectives. Start with 40 free questions — no credit card required.