MD-102: Microsoft Endpoint Administrator Practice Exam

What the MD-102 exam covers

• Prepare infrastructure for devices165 questions
• Manage and maintain devices188 questions
• Protect devices122 questions
• Manage and secure applications131 questions
• Optimize endpoint operations by using automation, monitoring, and reporting92 questions

Free MD-102 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 698.

1. Question 1Manage and maintain devices

   Your organization plans to deploy Windows 11 to 500 new devices using Windows Autopilot. You need to ensure that devices are automatically enrolled in Microsoft Intune during the out-of-box experience (OOBE). What must you do first?

   • AInstall the Microsoft Intune Company Portal app on each device
   • BCreate a Group Policy Object (GPO) that enables automatic MDM enrollment
   • CRegister the hardware hashes of the devices in Windows AutopilotCorrect
   • DCreate a provisioning package using Windows Configuration Designer
   ✓ Correct answer: C

   Windows Autopilot requires devices to be registered by their hardware hashes in the Autopilot service before deployment. The hardware hash is a unique identifier that associates the physical device with your tenant and enables Autopilot to recognize and provision the device automatically during OOBE. Registration with hardware hashes is the foundational step that must be completed before any other Autopilot configuration takes effect.

   Why the other options are wrong

   • AInstall the Microsoft Intune Company Portal app on each device is incorrect because the Company Portal is installed automatically during enrollment as part of the OOBE process, not as a prerequisite.
   • BCreate a Group Policy Object (GPO) that enables automatic MDM enrollment is incorrect because GPOs apply only to on-premises domain-joined devices and are not part of the Autopilot registration process.
   • DCreate a provisioning package using Windows Configuration Designer is incorrect because provisioning packages are optional tools that can supplement Autopilot deployment but are not required for basic hardware registration.
2. Question 2Prepare infrastructure for devices

   A user is unable to sign in to their Windows 11 device using Windows Hello for Business. The device is Microsoft Entra ID joined and enrolled in Intune. The user reports that the PIN option is grayed out. What should you verify first?

   • AThe device has a TPM 2.0 chipCorrect
   • BThe device is running Windows 11 Enterprise
   • CThe user has a Microsoft 365 E5 license
   • DMulti-factor authentication is disabled
   ✓ Correct answer: A

   Windows Hello for Business requires a Trusted Platform Module 2.0 for secure PIN storage and biometric credential management. When the PIN option appears grayed out, TPM 2.0 is the first requirement to verify because without it, the device cannot provide the cryptographic protections that Windows Hello requires. Modern Windows 11 devices typically include TPM 2.0, but legacy hardware may lack this component.

   Why the other options are wrong

   • BThe device is running Windows 11 Enterprise is incorrect because Windows Hello for Business is available in Windows 11 Pro and higher editions-Enterprise is not mandatory.
   • CThe user has a Microsoft 365 E5 license is incorrect because Windows Hello for Business does not require specific Microsoft 365 licenses-authentication licensing is separate from feature availability.
   • DMulti-factor authentication is disabled is incorrect because MFA configuration is not required for Windows Hello PIN setup; users can configure Windows Hello without MFA enabled.
3. Question 3Prepare infrastructure for devices

   A device compliance policy in Microsoft Intune can use Microsoft Defender for Endpoint risk scores as a compliance condition, marking devices as non-compliant if their risk level exceeds the configured threshold.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   This is True. Microsoft Intune integrates with Microsoft Defender for Endpoint so that a device's machine risk score (Clear, Low, Medium, or High) can be consumed as a compliance rule. In a device compliance policy you set Require the device to be at or under the machine risk score, and if Defender for Endpoint reports a risk level above that threshold, Intune marks the device non-compliant. Combined with Conditional Access, a non-compliant, high-risk device can then be blocked from corporate resources until the risk is remediated and the device returns to a compliant state. This is a standard MD-102 integration between endpoint security and compliance, so the statement is true.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true. This is True. Microsoft Intune integrates with Microsoft Defender for Endpoint so that a device's machine risk score (Clear, Low, Medium, or High) can be consumed as a compliance rule.
4. Question 4Protect devicesSelect all that apply

   Contoso wants to configure endpoint security in Microsoft Intune. Which three of the following endpoint security policy types are available in Intune? (Choose three.)

   • AAntivirusCorrect
   • BNetwork load balancing
   • CFirewallCorrect
   • DVirtual private network
   • EDisk encryptionCorrect
   ✓ Correct answer: A, C, E

   Intune endpoint security provides three primary policy types aligned with security foundations: Antivirus policies for malware protection through Windows Defender or third-party solutions, Firewall policies for network perimeter control and inbound/outbound connection management, and Disk encryption policies for protecting data at rest through BitLocker or FileVault. These three categories represent core endpoint security controls that address protection at the software, network, and storage layers respectively, forming a comprehensive defense strategy for managed devices.

   Why the other options are wrong

   • BNetwork load balancing is incorrect because load balancing is an infrastructure service, not an endpoint security policy type available in Intune.
   • DVirtual private network is incorrect because while VPN profiles exist in Intune, they are classified as device configuration features rather than endpoint security policy types in the Endpoint Security node.
5. Question 5Manage and maintain devices

   Remote Help in Microsoft Intune allows help desk technicians to establish a remote assistance session with enrolled devices without requiring a third-party remote desktop tool.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   This is True. Remote Help is a first-party Microsoft add-on (part of the Intune Suite, licensed separately) that provides a secure, cloud-based remote assistance session integrated with Intune, removing the need for a third-party remote desktop tool. A helper and a sharer authenticate with their Microsoft Entra ID accounts, and role/compliance checks plus permissions such as view-only or full control are enforced through Intune. It supports Windows, and has expanded to Android and macOS, including attended scenarios and, on supported platforms, unattended access. Because it delivers native remote assistance within Intune, the statement is true.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true. This is True. Remote Help is a first-party Microsoft add-on (part of the Intune Suite, licensed separately) that provides a secure, cloud-based remote assistance session integrated with Intune, removing the need for a third-party remote desktop tool.
6. Question 6Manage and secure applications

   You are troubleshooting a Win32 app installation failure on a Windows 11 device. The app shows a status of 'Failed' in the Intune admin center. Where should you look for detailed installation logs on the device?

   • AC:\Users\<user>\AppData\Local\Temp
   • BC:\Windows\SoftwareDistribution\Download
   • CC:\ProgramData\Microsoft\IntuneManagementExtension\LogsCorrect
   • DC:\Windows\System32\winevt\Logs
   ✓ Correct answer: C

   Detailed Win32 application installation logs for Intune-managed deployments are stored in the IntuneManagementExtension logs directory on the device. This directory contains comprehensive installation records, including success and failure details, making it the primary location for troubleshooting application deployment issues. These logs provide step-by-step installation activity and error codes that help administrators identify the root cause of installation failures reported in the Intune admin center.

   Why the other options are wrong

   • AC:\Users\<user>\AppData\Local\Temp is incorrect because this directory contains general temporary files created by various applications during runtime. While some application logs may be stored here temporarily, it is not the primary location for Intune application installation logs.
   • BC:\Windows\SoftwareDistribution\Download is incorrect because this directory is used by Windows Update for downloading and storing Windows and driver updates, not for Intune-managed application logs. It is specific to the Windows Update mechanism, not Intune deployments.
   • DC:\Windows\System32\winevt\Logs is incorrect because this directory contains Windows Event Viewer logs for system events, driver behavior, and security events. Intune-specific application deployment logs are not stored in the Windows Event Viewer directory.
7. Question 7Protect devicesSelect all that apply

   An administrator at Datum Corporation is planning to use Windows Update for Business. Which two of the following are requirements or features of this solution? (Choose two.)

   • AQuality update managementCorrect
   • BFeature update deferral policiesCorrect
   • CMDT deployment
   • DWindows Autopilot profiles
   • EBusiness for Update Windows
   ✓ Correct answer: A, B

   Windows Update for Business is a cloud-based set of policies that lets administrators control how and when Windows devices receive updates. Quality update management governs the deployment of monthly security and cumulative (quality) updates, including the ability to defer them and assign devices to update rings. Feature update deferral policies let administrators delay the rollout of new Windows feature (version) updates for a defined number of days, giving time to validate compatibility before broad deployment. Together these capabilities form the heart of a Windows Update for Business configuration, allowing organizations to schedule, defer, and stage both quality and feature updates without relying on on-premises tooling.

   Why the other options are wrong

   • CMDT is a legacy on-premises image-deployment tool and is not part of the cloud-based Windows Update for Business service.
   • DWindows Autopilot profiles provision and configure devices during enrollment; they are not an update-management feature of Windows Update for Business.
   • E'Business for Update Windows' is a garbled, non-existent term and is not a real component.
8. Question 8Manage and maintain devicesSelect all that apply

   An administrator at Woodgrove Bank is planning to use device configuration profiles. Which two of the following are requirements or features of this solution? (Choose two.)

   • AMicrosoft Intune device compliance
   • BBulk device actionsCorrect
   • CProfiles configuration device
   • DAutopilot reset
   • EEndpoint detection and responseCorrect
   ✓ Correct answer: B, E

   Although the scenario references device configuration profiles, the listed valid components relate to managing and protecting devices at scale. Bulk device actions let administrators apply operations such as restart or sync across many devices at once, and endpoint detection and response provides the threat monitoring and remediation layer for those managed devices. Treating these as the solution's elements reflects fleet-wide management and security capabilities. They are the valid components among the options.

   Why the other options are wrong

   • AMicrosoft Intune device compliance evaluates posture but is not the bulk-action and EDR pairing selected here.
   • CProfiles configuration device is a scrambled restatement of the feature name and does not denote a separate configurable component.
   • DAutopilot reset reprovisions a single device to its baseline and is not the fleet-management and detection components this scenario emphasizes.
9. Question 9Prepare infrastructure for devices

   An administrator needs Conditional Access to require that users authenticate specifically with a FIDO2 security key or Windows Hello for Business when accessing a sensitive finance application, and not merely 'any MFA'. Which Conditional Access grant control should be used?

   • ARequire authentication strengthCorrect
   • BRequire multi-factor authentication
   • CRequire approved client app
   • DRequire password change
   ✓ Correct answer: A

   Authentication strengths are policies that define which combinations of authentication methods satisfy a sign-in. The built-in phishing-resistant MFA strength accepts only FIDO2, Windows Hello for Business, and certificate-based authentication, allowing you to require those methods specifically rather than accepting weaker MFA such as SMS.

   Why the other options are wrong

   • BRequire multi-factor authentication accepts any registered second factor, including SMS or voice, and cannot mandate a specific method.
   • CRequire approved client app enforces use of a Microsoft-approved app for access but does not control the authentication method.
   • DRequire password change forces a credential reset and is unrelated to enforcing strong authentication methods.
10. Question 10Optimize endpoint operations by using automation, monitoring, and reporting

    You need a scheduled PowerShell script to add a device to an Entra ID security group used for Intune targeting, by calling Microsoft Graph app-only. Which application permission is the least-privilege choice that lets the app manage group memberships?

    • AGroupMember.ReadWrite.AllCorrect
    • BDirectory.ReadWrite.All
    • CUser.ReadWrite.All
    • DDeviceManagementManagedDevices.Read.All
    ✓ Correct answer: A

    Adding or removing members of an Entra ID group through Microsoft Graph is a group membership operation. The scoped application permission for this is GroupMember.ReadWrite.All, which grants exactly the ability to read and modify group memberships. Following least privilege, you avoid broader permissions that grant far more than needed.

    Why the other options are wrong

    • BDirectory.ReadWrite.All grants extensive write access across the directory, far more than managing group membership requires.
    • CUser.ReadWrite.All governs user objects, not group memberships, so it is both wrong and broader than needed.
    • DDeviceManagementManagedDevices.Read.All is read-only for managed devices and cannot modify group membership.

Related Microsoft resources

• MD-102 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

MD-102 practice exam FAQ