Updated for July 2026 Exam Objectives

MD-102 Practice Test

Microsoft 365 Certified: Endpoint Administrator Associate

Intune questions that match real MD-102 difficulty.

The MD-102 tests real-world Intune scenarios, not definitions. Our 500 questions cover Autopilot, compliance policies, and Defender integration at the same complexity level — so exam day holds no surprises.

Start Free Practice — 40 Questions

No credit card required. Upgrade to full 500 questions for $19.99 when ready.

500 Exam-Style Questions

7-Day Money-Back Guarantee

Is this for you?

Your MD-102 exam is in the next 2-4 weeks

You've studied the concepts but aren't sure you'll pass

You want questions harder than the real exam

You want to understand why answers are correct, not just memorize

This is NOT for you if:

You're looking for braindumps or exam leaks

You haven't started studying the concepts yet

Most successful candidates start practice 2-3 weeks before their exam

Updated for the July 2026 exam blueprint

MD-102 Exam Details

What to expect on exam day

Questions

40-60 questions

Duration

120 minutes

Passing Score

700/1000

Exam Cost

$165 USD

Exam Domains Covered

Master all topics tested on the MD-102 exam

Prepare infrastructure for devices (20-25%)

Manage and maintain devices (25-30%)

Protect devices (15-20%)

Manage and secure applications (15-20%)

Optimize endpoint operations by using automation, monitoring, and reporting (10-15%)

Test Yourself Right Now

Try 5 real practice questions — no signup needed

🎯

5 Free MD-102 Questions

See how ready you are for the MD-102 exam. Each question includes a detailed explanation so you learn as you go.

No account requiredTakes 2-3 minutesInstant results

Sample MD-102 Practice Questions

10 real questions from the free MD-102bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. A user has just left an organization. The IT admin wants to ensure company data is removed from the user's personal iPhone without wiping the device or affecting personal apps and data. The iPhone was not MDM-enrolled but was configured with app protection policies. Which action should the administrator perform in Intune?
- A. Perform a full device wipe from the Intune admin center, which factory-resets the iPhone and erases both corporate and personal content, returning the device to its out-of-box state
- B. Delete the user's device record from Microsoft Entra ID, which revokes active access tokens but does not purge corporate data already cached inside the protected app
- C. Remove the app protection policy assignment from the user, which stops future policy enforcement but does not itself erase the organizational data already on the device
- D. Issue an App selective wipe (Wipe request) in Intune, which removes only organizational data from MAM-protected apps and leaves personal apps and data intact
Show answer
Correct answer: D
For a personally-owned iOS device that is MAM-registered but not MDM-enrolled, an App selective wipe (a Wipe request under Intune App protection) removes only the corporate data managed by app protection policies - app tokens, cached email, and documents - without touching personal apps or photos. A full device wipe (A) would also erase personal data, which is inappropriate for BYOD. Deleting the Entra ID record (B) does not purge cached app data, and removing the policy assignment (C) does not trigger a wipe.
2. You are deploying a Win32 app that writes per-user registry settings and must run in the context of the signed-in user, not the SYSTEM account. Where do you configure this in Intune?
- A. Set "Install behavior" to "User" in the app's Program section
- B. Set the assignment type to "Available for enrolled devices"
- C. Enable "Run as logged on user" in the Intune Management Extension settings
- D. Configure a device configuration profile to set UAC to prompt for credentials
Show answer
Correct answer: A
The "Install behavior" setting in the Win32 app Program section controls whether Intune runs the installer as the SYSTEM account (System) or as the signed-in user account (User). Setting it to "User" is required for apps that need to install per-user components or access the user's profile during installation.
3. What is the primary purpose of Microsoft Intune?
- A. To provide cloud email and calendaring services for an organization's users
- B. To manage and secure devices, applications, and the data they access
- C. To host and run virtual machines and server workloads in the cloud
- D. To provide on-premises Active Directory domain controller services
Show answer
Correct answer: B
Microsoft Intune is a cloud-based endpoint management solution that manages and secures devices, applications, and data, controlling how devices access corporate resources (answer B). The distractors describe other Microsoft services - email, IaaS compute, and on-premises directory - that Intune does not provide.
4. An administrator needs to verify that all iOS devices with a required app assignment show a compliant App Protection Policy status. Which report in Intune shows per-user App Protection Policy compliance across managed apps?
- A. Apps > Monitor > App protection status
- B. Apps > select the specific app > Device install status
- C. Reports > Device compliance > Per-setting status
- D. Endpoint security > Account protection > Policy report
Show answer
Correct answer: A
The "App protection status" report under Apps > Monitor in Intune shows per-user and per-app compliance with App Protection Policies. It reports whether users are using a protected app, the policy check-in status, and whether the user's access is compliant with the configured App Protection Policy settings.
5. A company wants to enforce Microsoft Outlook configuration settings on both MDM-enrolled corporate devices and personally-owned iOS devices that have not been enrolled in Intune. An administrator is creating an App Configuration Policy and must choose the target type. What is the key difference that determines which target type covers the unenrolled devices?
- A. "Managed devices" requires MDM enrollment and delivers config via MDM channel; "Managed apps" uses the Intune App SDK and works on enrolled and unenrolled devices
- B. 'Managed devices' applies to corporate-owned devices and 'Managed apps' applies to personal devices, tied to ownership rather than enrollment state
- C. 'Managed devices' configures device OS settings while 'Managed apps' configures Microsoft 365 service-side settings
- D. 'Managed devices' requires Intune Plan 2 while 'Managed apps' works with the free Intune tier
Show answer
Correct answer: A
App Configuration Policies for 'Managed devices' deliver settings through the MDM channel and require enrollment, while 'Managed apps' use the Intune App SDK (MAM channel) and work on both enrolled and unenrolled devices, supporting BYOD (answer A). The distractors misattribute the difference to ownership, server-side settings, or licensing.

Show 5 more questions

6. A user wants to use their personal Windows 11 device to access company resources. Which device identity option should they use?
- A. Microsoft Entra joined
- B. Microsoft Entra registered
- C. Microsoft Entra hybrid joined
- D. Active Directory domain joined
Show answer
Correct answer: B
Microsoft Entra registered (formerly Microsoft Entra ID registered) is designed for BYOD scenarios where users want to access organizational resources from their personal devices without full organizational control over the device.
7. Which Intune section provides the dedicated Antivirus policy type for configuring Microsoft Defender Antivirus settings - including scan schedules, exclusions, and real-time protection - on Windows devices?
- A. Device configuration profiles, using a Windows Defender template section to configure antivirus scan and exclusion settings
- B. Compliance policies, which evaluate antivirus state for reporting rather than configuring Defender settings
- C. The Settings Catalog under Device configuration, building a Defender Antivirus policy from individual MDM-backed CSP settings as an alternative path
- D. Endpoint security > Antivirus, the dedicated Antivirus policy type for Defender Antivirus scan schedules, exclusions, and real-time protection
Show answer
Correct answer: D
Antivirus policies are configured in the Endpoint security section under Antivirus, the dedicated policy type for Microsoft Defender Antivirus scan schedules, exclusions, and real-time protection (answer D). Device configuration templates (A) and the Settings Catalog (C) are alternative paths, and compliance policies (B) evaluate rather than configure.
8. What is the purpose of device configuration profiles in Intune?
- A. To control which devices are permitted to enroll in Intune
- B. To configure device settings and features
- C. To assign and track application license entitlements
- D. To create and manage user accounts in Microsoft Entra ID
Show answer
Correct answer: B
Device configuration profiles allow you to configure settings and features on devices. Profiles can configure WiFi, VPN, email, device restrictions, certificates, and many other settings.
9. What is the primary purpose of Endpoint Detection and Response (EDR) in Defender for Endpoint?
- A. Preventing malware from executing at installation time
- B. Detecting and investigating advanced threats and breaches
- C. Maintaining the hardware and software inventory of devices
- D. Distributing operating system and application updates
Show answer
Correct answer: B
EDR provides advanced threat detection, investigation, and response capabilities. It enables security teams to detect sophisticated attacks and investigate incidents across endpoints.
10. A Windows device managed in Intune is integrated with Microsoft Defender for Endpoint. In the Defender for Endpoint device inventory, the device shows both a Risk level and an Exposure level value. Which statement correctly describes what these two fields are each based on?
- A. Device hardware age, installed OS build version, and the date of the last Intune policy sync - these indicate how current the device's management configuration is but don't feed either the Risk level or the Exposure level shown in Defender for Endpoint
- B. User sign-in frequency, failed authentication attempts, and sign-in location anomalies - these are Microsoft Entra ID Identity Protection signals and don't feed Defender for Endpoint's device-level Risk level or Exposure level
- C. Risk level reflects the device's active alerts, alert severity, and unresolved alert history, while Exposure level separately reflects the device's vulnerability posture based on pending Defender Vulnerability Management security recommendations - they are two distinct fields, not one combined score
- D. Available disk storage, memory utilization percentage, and CPU load average - Defender uses these for performance monitoring, but they don't factor into either the Risk level or the Exposure level
Show answer
Correct answer: C
The Defender for Endpoint device risk score is calculated based on three primary inputs: active security alerts (incidents and detections triggered on the device), software vulnerabilities discovered by Defender Vulnerability Management (unpatched CVEs weighted by exploitability and severity), and the device's exposure score based on security configuration gaps such as missing security controls or misconfigurations. Hardware metrics, user sign-in patterns, and Intune sync timing do not contribute to the MDE risk score. The Intune compliance policy surfaces this risk score to gate Conditional Access.

MD-102 study resources

Why Practice with MSCertQuiz?

Microsoft Learn teaches concepts. We prepare you for the actual exam.

Scenario-based Intune questions that match MD-102's real-world testing style

Explanations teach the reasoning behind Autopilot, compliance, and Defender answers

Calibrated to associate-level difficulty so you're not under-prepared

Updated for the latest 2026 exam objectives — no outdated material

Aligned to Microsoft's "skills measured as of" update: July 24, 2026

Not sure if you're ready for the MD-102 exam?

Take the free MD-102 Readiness Check →

What Our Users Say

“Autopilot and compliance policy questions were exactly what I needed. The real MD-102 had very similar scenarios. Passed with 780 on my first attempt.”

Alex W.

Endpoint Administrator

“Managing 2000+ devices at work and still almost failed MD-102 the first time because the exam tests specific Intune configurations. MSCertQuiz filled in the gaps. Passed on attempt two.”

Karen J.

MD-102 Certified

“The Defender for Endpoint questions were the most helpful — I kept confusing it with Defender for Office 365. Clear explanations finally sorted that out.”

Ryan M.

Passed MD-102 first try

Choose Your Plan

Start free, upgrade when you're ready to get serious

Free

Good for exploring the platform

40 practice questions
Practice mode only
Progress tracking
No exam simulation mode

Start Free

MD-102 Full Access

Best if your exam is in the next 2-4 weeks

$19.99one-time

500 practice questions
Practice & Exam modes
Detailed explanations
Lifetime access

Get MD-102 Access — $19.99

7-day money-back guarantee

BEST VALUE

Pro — All Certs

Best if you're planning multiple Microsoft exams

$14.99/month

ALL certifications included
Unlimited questions
New certs added free
Cancel anytime

View Pro Plans

Save 30% vs buying individually

Your MD-102Exam Won't Wait

Candidates who complete at least 2 full mock exams pass at significantly higher rates than those who only study passively.

Don't risk $165 USD on the real exam without testing yourself first.

Start Free Practice Now

No credit card required • 40 free questions • Upgrade for $19.99 when ready

Official Microsoft Resources

Our practice questions are aligned with official Microsoft exam objectives. We recommend studying with Microsoft Learn first, then using MSCertQuiz to test your readiness.

View Official MD-102 Exam Details

MD-102 Frequently Asked Questions

Everything you need to know about the MD-102 Endpoint Administrator certification

What is the MD-102 certification?

The MD-102 (Microsoft 365 Certified: Endpoint Administrator Associate) is a Microsoft certification that validates your skills in managing modern endpoints using Microsoft Intune. It covers device deployment, configuration, security, and application management across Windows, macOS, iOS, and Android platforms.

Is MD-102 the same as Intune certification?

Yes, MD-102 is commonly referred to as the Intune certification because Microsoft Intune is the primary technology covered in the exam. The certification validates your ability to use Intune for endpoint management, device compliance, app deployment, and security configuration.

How hard is the MD-102 exam?

MD-102 is moderately difficult — roughly 30% of first-time candidates fail. It is designed for IT professionals with hands-on experience in endpoint management, and the scenario-based questions test specific Intune configurations rather than general concepts. Most candidates need 6–10 weeks of preparation combining Microsoft Learn modules, hands-on Intune lab time, and realistic practice questions. Common failure points include Conditional Access policy logic, app protection policy scoping, and distinguishing Defender for Endpoint from Defender for Office 365.

What are the prerequisites for MD-102?

There are no formal prerequisites for MD-102, but Microsoft recommends experience with Microsoft 365 workloads, Microsoft Entra ID, and Windows client administration. Familiarity with networking concepts, PowerShell, and endpoint security is also beneficial.

How many questions are on the MD-102 exam?

The MD-102 exam contains 40-60 questions and you have 120 minutes to complete it. Questions include multiple choice, drag-and-drop, case studies, and scenario-based questions. A passing score is 700 out of 1000.

What jobs can I get with MD-102 certification?

The MD-102 certification qualifies you for roles such as Endpoint Administrator, Desktop Support Engineer, IT Administrator, Systems Administrator, Intune Administrator, and Microsoft 365 Administrator. Average salaries for these roles range from $65,000 to $120,000 depending on experience and location.

Is MD-102 worth it in 2026?

Yes, MD-102 is highly valuable in 2026 as organizations continue adopting cloud-based endpoint management and Zero Trust security. With the shift to hybrid work, skilled Endpoint Administrators who can manage devices anywhere are in high demand. The certification demonstrates current, relevant skills to employers.

What replaced MD-100 and MD-101?

MD-102 replaced both MD-100 (Windows Client) and MD-101 (Managing Modern Desktops) exams. Microsoft consolidated these into a single, more comprehensive exam focused on modern endpoint management with Intune rather than traditional on-premises tools.

How much does the MD-102 exam cost in 2026?

The MD-102 exam costs $165 USD in 2026. This is the standard Microsoft Associate-level certification price. Pricing varies by country: approximately ₹4,800 INR in India, £113 GBP in the UK, and €165 EUR in most European markets. Confirm the current price on the official Microsoft Learn scheduling page for your region before booking. Microsoft Ignite, Enterprise Skills Initiative (ESI) for partner organizations, and Microsoft Learn Cloud Skills Challenges occasionally provide free or discounted vouchers.

What is the MD-102 passing score in 2026?

The MD-102 passing score is 700 out of 1000 in 2026. Microsoft uses scaled scoring, so it is not a simple 70% — some questions are weighted more heavily and case studies count for multiple points. Consistently scoring 80%+ on realistic practice tests gives you a comfortable margin on exam day.

Does the MD-102 certification expire?

Yes — MD-102 is a role-based Associate certification and expires one year after the pass date. Renewal is free through a shorter online assessment on Microsoft Learn. The renewal assessment opens 6 months before expiry and you can retake it for free until you pass. Unlike the original $165 exam, renewal assessments are typically 25–35 questions and focus on what has changed in Intune since your last pass.

How is MD-102 different from MS-102?

MD-102 is the Endpoint Administrator certification focused on Microsoft Intune, Windows Autopilot, device compliance, app protection, and Defender for Endpoint — managing the devices themselves. MS-102 is the Microsoft 365 Administrator certification focused on M365 tenant management, Microsoft Entra ID, Defender XDR, and Purview compliance — managing the cloud tenant. MD-102 administrators manage what is on the devices; MS-102 administrators manage the cloud services those devices connect to. Both are $165 Associate-level certifications with annual renewal. Many enterprise admins eventually earn both because they cover complementary halves of modern Microsoft administration.

How is MD-102 different from AZ-104?

MD-102 covers endpoint and device administration — Microsoft Intune, Windows Autopilot, device compliance policies, app protection, and Defender for Endpoint. AZ-104 covers Azure cloud infrastructure administration — VMs, virtual networks, storage, Entra ID for Azure, RBAC, and governance. MD-102 is for endpoint and desktop administrators; AZ-104 is for Azure cloud engineers. They cover entirely different roles with minimal technical overlap. Both are $165 Associate-level certifications.

What are the MD-102 exam topics for 2026?

Microsoft restructured MD-102 on July 24, 2026, from four domains to five. Current domains: (1) Prepare infrastructure for devices (20–25%) — Entra ID device enrollment, compliance policies, Conditional Access, Windows Hello for Business. (2) Manage and maintain devices (25–30%) — Windows Autopilot deployment, configuration profiles, Intune Suite add-ons, remote actions. (3) Protect devices (15–20%) — antivirus, disk encryption, Attack Surface Reduction, Defender for Endpoint integration, update management. (4) Manage and secure applications (15–20%) — Win32/LOB/Store app deployment, Microsoft 365 Apps, app protection policies. (5) Optimize endpoint operations by using automation, monitoring, and reporting (10–15%) — PowerShell and Microsoft Graph automation, Security Copilot agents in Intune, Endpoint Analytics, proactive remediation.

What is the average MD-102 salary in 2026?

MD-102-certified Endpoint Administrators in the US earn $70,000–$105,000 USD on average in 2026, depending on experience and location. Entry-level desktop support roles with MD-102 start around $55,000–$75,000, mid-level endpoint administrators average $80,000–$100,000, and senior endpoint engineers managing large device fleets reach $105,000–$130,000. MD-102 pairs well with MS-102 (Microsoft 365 Administrator) and SC-200 (Security Operations Analyst) to unlock higher-paying enterprise endpoint security roles.

MD-102 Exam Cost 2026

The MD-102 exam costs $165 USD in 2026. This is the standard Microsoft Associate-level certification price. Pricing varies by country due to Microsoft's market-based pricing — approximately ₹4,800 INR in India, £113 GBP in the UK, and roughly €165 EUR in most European markets. Always confirm the current price on the official Microsoft Learn scheduling page for your region before booking.

There are no formal prerequisites, though Microsoft strongly recommends hands-on Microsoft Intune experience and prior completion of MS-900 or AZ-900 fundamentals. MD-102 is a role-based Associate certification and expires annually — renewal is free via a shorter online assessment on Microsoft Learn. Microsoft Ignite, Enterprise Skills Initiative (ESI), and Microsoft Learn Cloud Skills Challenges occasionally offer free or discounted exam vouchers.

MD-102 vs MS-102: Devices vs Tenant

Two of the most-confused Microsoft administrator certifications. Both are Associate-level and $165, but they cover different halves of modern Microsoft administration.

	MD-102	MS-102
Role	Endpoint Administrator	Microsoft 365 Administrator
Manages	Devices (Intune, Autopilot, compliance, app protection, Defender for Endpoint)	M365 tenant (Defender XDR, Entra ID, Purview, tenant configuration)
Cost	$165 USD	$165 USD
Duration	120 min	120 min
Best for	Desktop engineers, endpoint admins, mobility specialists	M365 admins, collaboration platform engineers
Salary (US)	$70K–$105K	$75K–$115K
Expires?	Annual renewal (free)	Annual renewal (free)

Many enterprise administrators eventually earn both — they cover complementary halves of modern Microsoft administration. If you mostly work with deploying and securing devices, take MD-102. If you mostly work with M365 tenant policies, identity, and compliance, take MS-102.

MD-102 vs AZ-104: Endpoints vs Azure Cloud

MD-102 covers endpoint and device administration — Microsoft Intune, Windows Autopilot, device compliance, app protection, and Defender for Endpoint. AZ-104 covers Azure cloud infrastructure — VMs, virtual networks, storage, Entra ID for Azure, RBAC, and governance. MD-102 administrators manage what runs on user devices; AZ-104 administrators manage what runs in the Azure cloud. They cover entirely different roles with minimal technical overlap, but both are $165 Associate-level certifications. Take MD-102 if your role is endpoint or desktop engineering; take AZ-104 if your role is Azure cloud administration.

MD-102 Salary and Career Outlook (2026)

MD-102-certified endpoint administrators in the US earn the following reported salaries in 2026:

• Desktop support / IT support (with MD-102): $55,000–$75,000 USD
• Endpoint administrator (2–5 yrs): $80,000–$100,000 USD
• Senior endpoint engineer / Intune lead: $105,000–$130,000 USD
• MD-102 + MS-102 (M365 admin combo): $95,000–$125,000 USD
• MD-102 + SC-200 (security-focused endpoint roles): $100,000–$135,000 USD

MD-102 is especially valuable in 2026 as enterprises continue migrating from traditional desktop management (Group Policy, SCCM) to cloud-first management with Microsoft Intune. Remote work and BYOD scenarios have made unified endpoint management a board-level priority — MD-102 signals you can deliver it.

MD-102 Exam Topics 2026: Domain Breakdown

MD-102 covers four domains. Microsoft periodically refines the wording but the weights remain stable. Always verify the latest objectives on the official Microsoft Learn MD-102 page before exam day.

Prepare Infrastructure for Devices

25–30%

Plan and implement device enrollment, configure Microsoft Entra ID device settings (Entra join, hybrid join, registered), plan and implement Windows Autopilot (self-deploying, user-driven, pre-provisioning), configure device profiles and platform-specific settings.

Manage and Maintain Devices

30–35%

Device compliance policies (Windows, iOS, Android, macOS), device configuration profiles, Conditional Access integration with compliance, Windows Update for Business and Update Rings, device monitoring and reporting, remote actions.

Manage Applications

15–20%

App deployment (Win32 apps, Microsoft Store, line-of-business apps), app protection policies (MAM and MAM-WE), app configuration policies, M365 Apps for enterprise deployment, app usage monitoring.

Protect Devices

15–20%

Microsoft Defender for Endpoint onboarding and policies, attack surface reduction rules, BitLocker and disk encryption, Windows Hello for Business, security baselines, endpoint detection and response basics.

About the MD-102 Endpoint Administrator Certification

The MD-102 certification (Microsoft 365 Certified: Endpoint Administrator Associate) is Microsoft's premier credential for IT professionals who manage modern endpoints using Microsoft Intune. This Intune certification validates your ability to deploy, configure, secure, and monitor devices across your organization.

Why Choose Our MD-102 Practice Test?

Our MD-102 practice test includes 500 exam-style questions covering all four domains of the Endpoint Administrator exam. Each question includes detailed explanations to help you understand why answers are correct, making this the most comprehensive MD 102 exam preparation resource available.

Skills Measured

• Deploy devices using Windows Autopilot
• Configure Microsoft Intune policies
• Implement device compliance
• Manage app protection policies
• Configure Microsoft Defender for Endpoint

Career Opportunities

• Endpoint Administrator
• Intune Administrator
• Desktop Support Engineer
• IT Systems Administrator
• Microsoft 365 Administrator

MD-102 Exam Preparation Tips

To pass the MD102 certification exam, focus on hands-on experience with Microsoft Intune in addition to using our practice tests. The exam tests real-world scenarios that Endpoint Administrators face daily, including:

• Configuring Autopilot deployment profiles for different scenarios
• Creating compliance policies for Windows, iOS, and Android devices
• Implementing Conditional Access policies with device compliance
• Managing Windows updates through Intune
• Deploying and protecting applications across platforms

Start with our free MD-102 practice test questions to assess your current knowledge, then unlock the full question bank to thoroughly prepare for exam day. Our questions are regularly updated to reflect the latest exam objectives for 2026.

Training your whole team on MD-102? Per-seat pricing covers every certification, with a manager dashboard to see who's exam-ready.

See team pricing →

Also Preparing For

Candidates studying MD-102 often prepare for these certifications next.

MS-900

Microsoft 365 Fundamentals

Practice test →AZ-104

Azure Administrator

Practice test →SC-900

Security, Compliance, and Identity Fundamentals

Practice test →