MD-102: Endpoint Administrator Exam Resource Guide (April 2026 Update)

The MD-102 exam is about to receive a minor update, only changing the Windows LAPS domain objective. So far we aren’t seeing any impact on the exam topics based on the recent addition of Intune suite capabilities into some Microsoft 365 suites, so that might be something we see in a future update.

Prepare infrastructure for devices (25–30%)

Add devices to Microsoft Entra

• Choose an appropriate device join type
  • Plan your Microsoft Entra device deployment
  • Enrollment for Microsoft Entra hybrid joined devices
• Join devices to Microsoft Entra ID
  • What is a Microsoft Entra joined device?
  • What is a Microsoft Entra hybrid joined device?
• Register devices to Microsoft Entra ID
  • What are Microsoft Entra registered devices?
• Plan and implement groups for devices in Microsoft Entra ID
  • Dynamic group rule syntax

Enroll devices to Microsoft Intune

• Configure enrollment settings
  • Android device enrollment guide for Microsoft Intune
  • Connect your Intune account to your Managed Google Play account.
  • Set up automatic enrollment
• Configure automatic enrollment for Windows and bulk enrollment for iOS/iPadOS and Android
  • Set up automatic enrollment
  • Device enrollment manager
• Configure enrollment profiles for Android devices, including fully managed, dedicated, corporate owned, and work profile
  • Android, Android Enterprise, AOSP

Implement identity and compliance

• Manage roles in Intune
  • Role-based access control
• Implement compliance policies for all supported device platforms by using Intune
  • Create a device compliance policy
  • Actions for noncompliance
  • Monitor device compliance
  • Troubleshoot policies and profiles
• Implement Microsoft Entra Conditional Access policies that require a compliance status
  • Device-based Conditional Access policy
• Configure Windows Hello for Business
  • Windows Hello for Business
• Implement and manage Local Administrative Passwords Solution (LAPS)
  • Windows LAPS and Entra ID
• Manage the membership of local groups on Windows devices by using Intune
  • How to manage local administrators on Microsoft Entra joined devices

Manage and maintain devices (30–35%)

Deploy and upgrade Windows clients by using cloud-based tools

• Choose between Windows Autopilot and provisioning packages
  • Windows Deployment Scenarios
• Choose a Windows Autopilot deployment mode
  • Windows Autopilot Scenarios and capabilities
• Apply a device name template
  • Configure Autopilot profiles
• Implement Windows client deployment by using Windows Autopilot
  • Configure Autopilot profiles
  • Adding devices
  • Demonstrate Autopilot deployment on a VM
  • Windows Autopilot Troubleshooting Overview
• Create an Enrollment Status Page (ESP)
  • Enrollment Status Page
• Plan and implement provisioning packages
  • Provisioning packages overview
  • Create a provisioning package (desktop wizard)
• Plan and implement device upgrades for Windows 11
  • Windows upgrade and migration considerations
• Implement a Windows 365 cloud PC deployment
  • Windows 365 deployment overview
  • Windows 365 deployment options

Plan and implement device configuration profiles

• Create device configuration profiles for Windows devices, including importing ADMX files
  • Use policy sets
  • Troubleshoot policies and profiles
  • How Intune resolves policy conflicts
  • Use PowerShell scripts on Windows 10/11 devices in Intune
  • Prepare a device for kiosk configuration
  • Kiosk settings for Windows and Holographic devices in Microsoft Intune
• Create device configuration profiles for Android devices
  • Android, Android Enterprise, AOSP
• Create device configuration profiles for iOS/iPadOS devices
  • Create iOS/iPadOS or macOS device profile with Microsoft Intune
• Create device configuration profiles for Mac OS devices
  • Create iOS/iPadOS or macOS device profile with Microsoft Intune
• Create device configuration profiles for Windows 11 Enterprise multi-session devices
  • Shared or multi-user Windows device settings in Microsoft Intune
• Target a profile by using filters
  • Create a filter

Implement Intune Suite add-on capabilities

• Configure Endpoint Privilege Management
  • Configure policies to manage Endpoint Privilege Management with Microsoft Intune
• Manage applications by using the Enterprise App Catalog
  • Microsoft Intune Enterprise Application Management
• Implement Microsoft Intune Advanced Analytics
  • What is Microsoft Intune Advanced Analytics
  • What is Endpoint analytics?
• Configure Microsoft Intune Remote Help
  • Use Remote Help
• Identify use cases for Cloud PKI
  • Microsoft Cloud PKI for Microsoft Intune
• Implement Microsoft Tunnel for Mobile Application Management
  • Microsoft Tunnel for MAM Overview
  • Microsoft Tunnel overview

Perform remote actions on devices

• Sync, restart, retire, or wipe devices
  • Sync
  • Restart
  • Retire
  • Wipe
• Perform bulk remote actions
  • Use bulk device actions
• Update Microsoft Defender Antivirus security intelligence
  • Manage how and where Microsoft Defender Antivirus receives updates
• Rotate BitLocker recovery keys
  • BitLocker key rotation
• Run a device query by using KQL
  • Device query

Manage applications (15–20%)

Deploy and update apps

• Prepare applications for deployment by using Intune
  • Add a Win32 app
• Deploy apps by using Intune
  • Add apps to Microsoft Intune
• Deploy Microsoft 365 Apps by using Intune
  • Add Microsoft 365 apps to Windows 10/11 devices with Microsoft Intune
• Configure policies for Office apps
  • Policies for Office apps in Intune
  • Change the update channel with Group Policy
  • Administrative Template files (ADMX/ADML) for Microsoft 365 Apps for enterprise
• Deploy Microsoft 365 Apps as part of a Windows Autopilot deployment by using the Office Deployment Tool (ODT) or Office Customization Tool (OCT)
  • Deployment guide
  • Overview of the Office Customization Tool
  • Overview of the Office Deployment Tool
  • Deploy Microsoft 365 Apps from a local source
• Manage Microsoft 365 Apps by using the Microsoft 365 Apps admin center
  • Overview of the Office cloud policy service for Microsoft 365 Apps for enterprise
• Deploy apps from platform-specific app stores by using Intune
  • How to get Android apps
  • How to get iOS/iPadOS apps
  • Microsoft Store apps

Plan and implement app protection and app configuration policies

• Plan and implement app protection policies
  • App protection policies and work profiles (Android)
  • App configuration policies
• Implement  Microsoft Entra Conditional Access policies for app protection policies
  • App-based Conditional Access
• Plan and implement app configuration policies for managed apps and managed devices
  • iOS managed devices
  • Android managed devices

Protect devices (15–20%)

Configure endpoint security

• Create antivirus policies
  • Enable and configure always-on protection and monitoring
• Create disk encryption policies
  • Disk encryption
• Create firewall policies
  • Manage firewall settings with endpoint security policies
• Configure Attack surface reduction policies
  • Windows Defender Application Control design guide
  • Enable exploit protection
  • Microsoft Defender Application Guard
  • Protect derived domain credentials with Credential Guard
  • Securing privileged access
• Plan and implement security baselines
  • Manage security baselines
• Integrate Intune with Microsoft Defender for Endpoint
  • Onboarding using Microsoft Intune
• Onboard devices into Microsoft Defender for Endpoint
  • Onboard to the Microsoft Defender for Endpoint service
  • Endpoint detection and response overview
  • Evaluate capabilities
  • Security operations dashboard
  • Threat protection reports

Manage device updates by using Intune

• Plan for device updates
  • Windows as a Service
  • Prepare servicing strategy for Windows client updates
  • Manage iOS/iPadOS software update policies in Intune
• Create and manage update rings by using Intune
  • Configure Windows Update for Business
  • Deploy updates using Windows Update for Business
• Create and manage update policies by using Intune, including iOS/iPadOS and Mac OS
  • Configure Windows Update for Business
  • Deploy updates using Windows Update for Business
• Manage Android updates by using configuration profiles or firmware-over-the-air (FOTA) deployments
  • Android Enterprise device settings to allow or restrict features using Intune
• Configure Windows client delivery optimization by using Intune
  • Configure Delivery Optimization for Windows updates
• Monitor updates
  • Windows Update compliance reports
  • Troubleshoot policies and profiles