Domain 1: Prepare infrastructure for devices
- Windows Autopilot requires each device to be registered in the Autopilot service by its hardware hash (a unique device identifier) before it can be auto-provisioned during OOBE; obtain the hash from the OEM/vendor or run Get-WindowsAutopilotInfo (PowerShell) to export it to CSV.
- Autopilot pre-provisioning (white glove) has a technician phase that applies device-targeted apps and policies and a user phase; if the technician phase fails, reboot and press the Windows key five times at the OOBE language screen to reach the pre-provisioning/troubleshooting menu.
- Autopilot Hybrid Entra Join requires line-of-sight to an on-premises Active Directory domain controller and the Intune Connector for Active Directory installed on-premises (it creates the computer object in AD).
- Self-deploying and pre-provisioning Autopilot modes require a TPM 2.0 chip for device attestation; the Enrollment Status Page (ESP) controls what the user sees and can do during provisioning and whether they can continue or must reset on failure.
- Automatic MDM enrollment requires a Microsoft Entra ID P1 or P2 license and the MDM user scope configured, so Entra-joined devices enroll into Intune automatically; Intune must be the MDM authority.
- Microsoft Entra join states: Entra registered is best for personal/BYOD (known to Entra ID for Conditional Access but not directory-joined); Entra joined is cloud-only corporate; Entra hybrid joined is on-premises AD joined and synced into Entra ID, bridging Group Policy/Kerberos with cloud Conditional Access and Intune.
- Enrollment restrictions include device type restrictions (block personally owned devices, set a minimum OS version) and device limit restrictions (cap how many devices a user can enroll), configured under Intune > Devices > Enrollment.
- The Windows Configuration Designer (WCD) builds provisioning packages with the .ppkg extension to apply settings without full reimaging; Windows subscription activation upgrades Pro to Enterprise in-place with a Microsoft 365 E3/E5 license, no product key and no reimaging.
- Autopilot devices can be auto-grouped with a dynamic device membership rule such as device.devicePhysicalIds -any (_ -contains "[OrderID]:ContosoGroup"), keying off the Autopilot group tag/order ID.
- Intune role-based access control (RBAC) uses built-in and custom roles plus scope tags to delegate administration; scope tags limit which objects an admin sees, aligning with a delegated or geographic support model.
- Connectors extend the enrollment infrastructure: Apple ADE/ABM tokens and a push certificate for iOS/iPadOS, the managed Google Play connection for Android Enterprise, and the Intune Connector for AD for hybrid Autopilot.
Domain 2: Manage and maintain devices
- Device configuration profile types that mirror on-premises Group Policy are the Settings catalog (modern, searchable, thousands of settings) and Administrative templates (ADMX-backed); Group Policy analytics can import a GPO and map settings to their Intune equivalents.
- When two profiles set the same setting to different values, the conflict results in the setting not being applied and a conflict status being reported in Intune.
- In Intune Windows Update rings, deferral periods delay how long a device waits after release before installing; feature update deferral is set separately from quality update deferral (for example 30 days versus 7 days).
- Compliance deadline settings for updates combine a deadline (days after which install is forced) and a grace period (extra days before a forced restart); auto install and restart at a scheduled maintenance time defers required reboots to off-hours.
- Feature updates are managed with a feature update deployment policy (Windows Update for Business) targeting a specific OS version such as Windows 11 and assigned to a device group; WUfB pulls from the Windows Update cloud source, so the update source must be Windows Update, not WSUS.
- Delivery Optimization uses peer-to-peer caching so devices on the same subnet/LAN share downloaded update content, reducing WAN bandwidth; key settings include download mode and maximum background download bandwidth percentage.
- The Wipe remote action performs a full factory reset (all data and apps removed, back to out-of-box state) for corporate devices; the Retire action removes only corporate apps/data and leaves personal data intact for BYOD.
- Fresh Start removes apps and optionally keeps user data to resolve a problematic Windows device, while Sync forces a device to check in immediately; these remote actions are run from the device object in the Intune admin center.
- Certificate-based authentication requires a trusted certificate profile (to push the root/intermediate CA) plus a SCEP or PKCS certificate profile to issue the client certificate; profiles are assigned to users or devices.
- PowerShell platform scripts and Wi-Fi, VPN, and email profiles are pushed as configuration to keep devices in the desired state; VPN and Wi-Fi profiles can reference the deployed certificate for authentication.
- Windows Hello for Business sign-in and device restriction settings (password, encryption, browser, and OS update controls) are delivered through configuration profiles targeted at device or user groups.
Domain 3: Protect devices
- An Intune compliance policy grace period defines how many days a device may stay non-compliant before being formally marked non-compliant; the countdown starts when the compliance engine detects the violation.
- The tenant-wide setting 'Mark devices with no compliance policy assigned as' (Compliant or Not compliant) determines how Intune treats devices with no compliance policy; non-compliance actions can send an email or mark the device after a scheduled delay.
- Conditional Access enforces compliance: a policy with the grant control 'Require device to be marked as compliant' checks Intune status before allowing access; other grant controls include require Entra hybrid joined device, require approved client app, require MFA, and require acceptance of a Terms of Use.
- A frequent 'why is this device non-compliant' answer is that the compliance status has not yet synced to Entra ID, or the device has not synced with Intune since a setting such as BitLocker changed; the filter device.isCompliant equals False scopes reporting or policy to non-compliant devices.
- Use an endpoint security disk encryption policy to silently enable BitLocker on Entra joined Windows devices with automatic recovery key escrow to Entra ID and no user interaction; on a device without a compatible TPM, allow BitLocker without a compatible TPM and require a startup PIN/password or USB key.
- To integrate Microsoft Defender for Endpoint with Intune, enable the connector in both portals: turn on the MDE connector in the Intune admin center and enable the Intune connection in the Defender portal (security.microsoft.com).
- Attack Surface Reduction (ASR) rules are configured in Intune endpoint security; common rules include 'Block Office applications from creating child processes' and 'Block executable content from email client and webmail'.
- Endpoint security policy categories in Intune include Antivirus, Firewall, Disk encryption, Endpoint detection and response, Attack surface reduction, and Account protection; to allow a blocked app through the firewall, add a rule permitting that specific application rather than disabling the firewall.
- Available security baselines include the Security baseline for Windows 10 and later and the Microsoft Defender for Endpoint baseline, providing Microsoft-recommended secure defaults that can be assigned and monitored for drift.
- Microsoft Defender Antivirus settings managed via Intune include real-time protection and the cloud-delivered protection level; Windows Hello for Business and local admin controls are configured under Account protection (Identity protection).
- App protection policies (MAM without enrollment) protect corporate data inside managed apps on unenrolled devices, enabling a required PIN and selective wipe of only corporate data.
Domain 4: Manage and secure applications
- To deploy a Win32 app (including .exe installers) you must first wrap it with the Microsoft Win32 Content Prep Tool to produce a single .intunewin package containing the app and its metadata.
- Win32 app detection rules verify a successful install (file, registry, or MSI product code); the most common cause of a 'failed' status on an app that is actually installed is a misconfigured detection rule.
- Intune app assignment intents are Required (installs automatically), Available for enrolled devices (shown in Company Portal for optional install), and Uninstall (removes the app from assigned devices).
- Use the built-in 'Microsoft 365 Apps for Windows 10 and later' app type to deploy Office; choose the update channel, exclude unwanted apps, and manage settings under App suite settings.
- Win32 app dependencies let one app require another (for example .NET Framework 4.8 installs first), and a supersedence relationship handles updates; 'Uninstall the previous version' set to No installs over the existing version, while Yes removes the old version first.
- App protection policies (MAM) for iOS/Android can restrict cut/copy/paste between managed and unmanaged apps, prevent backups to iCloud/iTunes, require a PIN, and allow fingerprint instead of PIN; MAM without enrollment delivers this app-level protection on unmanaged devices with selective wipe of corporate data.
- An app configuration policy for managed devices pushes configuration values to apps on enrolled devices; for Microsoft 365 Apps, configuration is set under the app suite settings.
- Android Enterprise apps require connecting Intune to a managed Google Play account, then approving the app in managed Google Play within the Intune admin center.
- VPP/volume-purchased app licenses are tracked per app: when a device or user is removed, the license is automatically revoked and returned to the pool for reassignment.
- The macOS line-of-business app type accepts only signed .pkg files; .dmg files are deployed through the separate 'macOS app (DMG)' app type, not the line-of-business type.
- App version enforcement through app protection/Conditional Access can block a user and prompt them to update when their app version is below the minimum required; Microsoft Store app auto-updates can be governed through a device configuration profile.
Domain 5: Optimize endpoint operations by using automation, monitoring, and reporting
- Upload PowerShell platform scripts under Devices > Scripts; set 'Run this script using the logged-on credentials' to No to run in the SYSTEM/admin context rather than as the signed-in user, and choose whether to enforce script signature checking.
- Proactive remediations (remediation script packages) pair a detection script with a remediation script so Intune automatically finds and fixes common issues on a schedule; results are surfaced in Endpoint analytics.
- Endpoint analytics reports on startup performance (boot and sign-in time), recommended software baselines, application reliability, and work-from-anywhere readiness, helping you improve the end-user experience proactively.
- Intune provides report types across Operational, Organizational, Historical, and Specialist categories; device compliance, device configuration, and app install status reports show assignment success and failure with per-device drill-down.
- Update compliance and Windows Update for Business reports show which devices installed a given feature or quality update and surface update failures, so you can track ring rollout progress.
- Intune audit logs record administrative create, update, delete, and remote actions with the actor and timestamp, supporting change tracking and troubleshooting of policy changes.
- Device and app monitoring blades show assignment status (succeeded, pending, error, conflict, not applicable); a conflict or error status on a profile or app points to overlapping assignments or a bad detection/requirement rule.
- Custom compliance settings use a PowerShell discovery script plus a JSON rules file to evaluate conditions Intune does not surface natively, extending compliance reporting and Conditional Access.
- Alerts and notifications, plus exporting report data through the Microsoft Graph reporting API, let you automate monitoring and integrate Intune data with external dashboards or a SIEM.
- Group Policy analytics imports on-premises GPOs, reports which settings have a modern Intune equivalent, and helps migrate configuration to the Settings catalog as part of modernizing endpoint management.
MD-102 exam tips
- Master the Entra join states and what each enables: Entra registered (BYOD, light control), Entra joined (cloud-only corporate), and Entra hybrid joined (on-prem AD plus cloud). Many infrastructure and Conditional Access questions hinge on the correct join type and prerequisites such as the Intune Connector for AD for hybrid Autopilot.
- Memorize the Wipe vs Retire vs Fresh Start distinction. Wipe = full factory reset of corporate devices; Retire = remove only corporate data on personal devices and keep personal data; Fresh Start = fix Windows while optionally keeping user data. This distinction appears repeatedly.
- Know the Win32 app lifecycle cold: wrap with the Content Prep Tool to make a .intunewin, set install/uninstall commands, configure detection rules (file/registry/MSI), and use dependencies and supersedence. A 'failed install' that is actually installed almost always points to a bad detection rule.
- Understand Windows Update for Business in Intune: deferral periods, deadlines, grace periods, restart behavior, feature update policies targeting a specific OS, and Delivery Optimization. Watch for the trap that WUfB requires the update source to be Windows Update, not WSUS.
- For protection questions, trace the full chain: compliance policy evaluation, the grace period before a device is marked non-compliant, sync timing to Entra ID, then the Conditional Access grant control that blocks or allows access. Sync delays are a frequent 'why is this device non-compliant' answer.
- For the Optimize domain, separate the tools: platform scripts for one-time actions, proactive remediations for ongoing detect-and-fix automation, Endpoint analytics for experience metrics, and Intune reports plus audit logs for compliance and change tracking.
Study guide FAQ
What is the difference between MD-102 and the retired MD-101/MD-100 exams?
MD-102: Microsoft Endpoint Administrator is the current single exam that replaced the older two-exam MD-100 (Windows Client) plus MD-101 (Managing Modern Desktops) path. Passing MD-102 alone earns the Microsoft 365 Certified: Endpoint Administrator Associate certification, with a heavy focus on managing and securing devices through Microsoft Intune.
How is the exam scored and how many questions are there?
MD-102 uses Microsoft's scaled scoring from 1 to 1000, and you need 700 or higher to pass. You typically see around 40 to 60 questions in a 120-minute session (this certification practice bank holds about 698), including multiple choice, multiple response, drag-and-drop, and case study formats.
Do I need hands-on Intune experience, or is studying theory enough?
Hands-on experience is strongly recommended. Many questions are scenario-based and ask exactly where in the Intune admin center a setting lives or which policy type to use. Use a free Microsoft 365 developer or trial tenant to practice enrollment, compliance policies, configuration profiles, app deployment, endpoint security, and reporting so the menu paths and option names become second nature.
Which areas should I prioritize given the domain weightings?
Manage and maintain devices and Prepare infrastructure for devices are the two largest areas, so prioritize enrollment and Autopilot, join states, configuration profiles, and Windows Update for Business. Do not neglect Protect devices (compliance, Conditional Access, BitLocker, Defender), Manage and secure applications (Win32 packaging, MAM), and the Optimize domain (scripts, proactive remediations, Endpoint analytics, and reporting).