What the MD-102 exam actually feels like

MD-102 is not a pure memorization exam and it is definitely not just “Intune basics.” The real pressure comes from Microsoft stacking similar-sounding management methods in the same question: Group Policy vs Intune Settings Catalog vs configuration profiles vs compliance policies vs security baselines vs endpoint security policies. If you only know definitions, you will get trapped.

Expect a mix of standard multiple choice, multi-select, drag-and-drop/order questions, and scenario-based items. On Microsoft exams, you may also see case-study style sets and interface-heavy items. The exact count varies, but the pacing usually feels like you need to average roughly a bit over a minute and a half per item. That matters because MD-102 questions are often long, especially when they describe a tenant state, licensing, join type, and device ownership all in one prompt.

The biggest format-specific issue is that Microsoft loves bundling prerequisites into the stem. A question is rarely just “How do you deploy app X?” It is more like: a device is Microsoft Entra joined, corporate-owned, enrolled in Intune, users are remote, and you must minimize user interaction while ensuring the app installs before first sign-in. In that case, the answer is not just “deploy the app”; you need to think through Autopilot ESP, assignment type, and whether the app type even supports that installation behavior.

A few exam-interface realities matter for MD-102:

Some question sets lock navigation within a case study. If you get a case study, treat it as a closed environment and extract all the device state details before answering.
Drag-and-drop questions on this exam often test process order. Know the order for Autopilot, provisioning, update rollout, and remediation workflows.
Microsoft wording often uses “most appropriate,” “least administrative effort,” or “without reimaging.” Those are not filler words. They are usually the key to picking between wipe, fresh start, autopilot reset, retire, and delete.
If a question gives you a portal path indirectly, it is testing whether you know which workload lives in Intune admin center, Microsoft Entra admin center, Microsoft 365 Defender, or Windows settings / local device.

One blunt point: if you are slow at reading management scenarios, this exam will feel tighter on time than the raw question count suggests. The fix is not generic speed practice; it is learning to instantly identify the four things that matter in every MD-102 prompt: join type, enrollment type, ownership, and management authority.

Where the score really comes from: device management and app deployment

The center of gravity on MD-102 is modern management of Windows endpoints. If you have limited study time, put most of it into deploying and managing devices, managing apps, configuring profiles and compliance, and maintaining Windows. Microsoft can still ask identity and security questions, but the exam repeatedly returns to how an endpoint admin actually configures and maintains Windows devices in Intune.

The domains that tend to pay off most are these:

Intune enrollment and device lifecycle
- Enrollment methods
- Corporate vs personal ownership
- Co-management basics
- Join states: Microsoft Entra joined, hybrid joined, registered
Windows Autopilot
- User-driven vs pre-provisioned
- Reset/reuse scenarios
- ESP behavior
- Profile assignment and registration concepts
Application deployment
- Win32 apps vs Microsoft Store apps vs Microsoft 365 Apps vs scripts/remediations
- Detection rules, requirement rules, supersedence, dependencies
- Assignment intent and uninstall behavior
Configuration and compliance
- Device restrictions, settings catalog, templates, endpoint security
- Compliance policies and compliance actions
- Conditional Access relationship to compliance
Updates and maintenance
- Windows Update for Business rings
- Feature updates
- Quality updates / expedited updates
- Driver update management
Protection and recovery
- BitLocker, FileVault basics if mentioned, Defender for Endpoint integration, local admin management, remote actions

If you want a practical prioritization rule: spend less time on obscure one-off Windows tools and more time on how Intune implements policy at scale. This exam rewards knowing which knob to turn in cloud management, not deep desktop engineering trivia.

A pattern I saw repeatedly: Microsoft asks for the best management plane rather than whether something is technically possible. Example: if a setting can be pushed by Group Policy and by Intune, but the scenario says devices are cloud-managed and remote, the intended answer is usually the Intune-native method. The exam is testing whether you think like an Endpoint Administrator in a modern Microsoft tenant, not whether you remember every legacy option.

Autopilot and enrollment: the section that trips up almost everyone

Autopilot is one of the most testable and most misunderstood areas in MD-102. Questions here are rarely about definitions alone. They combine provisioning goals with identity and ownership constraints.

The first thing to lock down is the difference between Microsoft Entra joined, hybrid Microsoft Entra joined, and Microsoft Entra registered devices. Microsoft loves asking about enrollment eligibility, policy targeting, and sign-in experience based on join state. If you are fuzzy here, you will miss easy points.

Here are the Autopilot patterns I would expect:

User-driven deployment is the default answer when a user receives a new corporate device and completes setup themselves.
Pre-provisioned deployment is the answer when you need to reduce first-user setup time and install apps/policies before handoff.
Autopilot Reset appears when the goal is to reuse a device while keeping it managed and returning it to a business-ready state.
Wipe is broader and more destructive; it is not always the cleanest answer if the question emphasizes preserving enrollment or fast redeployment.
Fresh Start can be a trap because people pick it whenever they see “remove bloatware,” but the question may actually be about reprovisioning or maintaining management state.

The gotcha nobody should ignore: Microsoft often hides the key clue in the phrase “without touching the device on-premises” or “for remote users”. That usually eliminates answers tied to traditional imaging or on-prem dependencies. If the scenario is remote-first, think cloud-native enrollment and policy delivery.

Study these Autopilot-specific details because they show up in tricky wording:

What information is needed to register devices for Autopilot and what the hardware hash is used for.
The purpose of deployment profiles and what settings they control.
The role of the Enrollment Status Page (ESP) and when blocking app installs matter.
Dynamic group assignment based on Autopilot attributes.
Which account types can enroll devices and when device enrollment restrictions would block the process.

A classic trap is confusing device enrollment restrictions with compliance policies. Restrictions determine whether enrollment can happen at all; compliance evaluates a device after enrollment against security requirements. If the question says “prevent personally owned Windows devices from enrolling,” that is enrollment restriction territory, not compliance.

Another common trap: automatic MDM enrollment versus Autopilot. These are related but not the same. Autopilot is a provisioning experience; automatic MDM enrollment is how devices get enrolled into Intune when they join Entra under the right configuration. If Microsoft asks how to ensure devices are automatically enrolled after Azure/Entra join, do not reflexively choose Autopilot.

App deployment questions are really about Win32 behavior

If there is one topic to overprepare for, it is Windows application deployment in Intune, especially Win32 apps. This is where Microsoft can ask practical admin questions that sound simple but hinge on one tiny detail like detection logic or assignment context.

Know the differences among these app types and when Microsoft expects each one:

Win32 app: most flexible, supports dependencies, supersedence, detection rules, requirement rules. This is the one to know deeply.
Microsoft Store app (new): used for Store-delivered apps with simpler lifecycle.
Microsoft 365 Apps: separate deployment path with suite configuration options.
Line-of-business app: often appears in older-style packaging questions, but Win32 is usually the stronger answer for complex desktop apps.
Scripts / remediations: not the same as app deployment; Microsoft may tempt you with scripts when proper app packaging is the intended solution.

The exam loves these Win32 subtopics:

Detection rules: file, registry, MSI. If detection is wrong, the app may never install or may reinstall endlessly.
Requirement rules: architecture, OS version, disk space. These control applicability, not installation success.
Dependencies: install supporting components before the main app.
Supersedence: replace or upgrade older app versions.
User vs device assignment: critical when install timing and user context matter.

A very Microsoft-style trap is mixing up requirement and detection rules. Example: if the scenario asks how to determine whether an app is already present, that is detection. If it asks how to ensure only Windows 11 devices receive the app, that is requirement logic.

Another pattern: “install before the user can use the device.” That usually points toward assignment and ESP behavior, not just selecting required deployment. If the app must be present during provisioning, you need to think about whether it is targeted correctly and whether the ESP is configured to block until required apps are installed.

Also be ready for the uninstall side. Microsoft may ask how to remove an app from a subset of devices. If the app was deployed as required and you simply remove the assignment, that is not the same as explicitly assigning Uninstall. The exam expects you to know those lifecycle differences.

One more thing people underestimate: Microsoft 365 Apps deployment settings. Questions can ask which update channel, architecture, or included apps should be configured. These are not hard if you have actually walked through the admin center settings. They are annoying if you only studied flashcards.

Compliance, Conditional Access, and security: where wording gets sneaky

MD-102 security questions are less about being a security engineer and more about enforcing endpoint posture through Intune and its integrations. The dangerous part is that Microsoft often gives you two technically valid controls and asks for the one that actually enforces access.

The relationship to remember is simple:

Compliance policies evaluate device state.
Conditional Access uses signals like compliance to grant or block access.
Endpoint security policies configure security settings.
Security baselines provide bundled recommended settings.

If a question asks how to block access to Exchange Online unless devices meet standards, compliance policy alone is not enough. You need Conditional Access consuming the compliance state. This exact separation is a frequent trap.

Topics worth drilling:

BitLocker management in Intune, including escrow/recovery concepts.
Microsoft Defender for Endpoint integration and what it enables in Intune, especially risk-based compliance.
Local admin management and account protection policies.
Firewall, antivirus, disk encryption, attack surface reduction at a policy level.
Compliance actions such as notifications, grace periods, and marking devices noncompliant.

The easy-looking but dangerous area is security baselines vs endpoint security policies vs settings catalog. Microsoft likes to ask which tool is best for applying a broad security posture versus a specific setting. My rule for the exam:

If the scenario wants a broad packaged recommendation set, think security baseline.
If it focuses on a security workload like antivirus, firewall, disk encryption, account protection, think endpoint security policy.
If it asks for a specific configurable setting that may not fit cleanly elsewhere, think settings catalog.

Another gotcha is confusing retire, wipe, and delete in security or offboarding scenarios.

Retire removes managed app data and settings in a managed context, often for personal devices or selective removal.
Wipe resets the device.
Delete removes the device record from management but does not perform the same device-side action.

Microsoft will absolutely test this by describing a departing employee with a personally owned device and asking how to remove only corporate data. If you choose wipe because it sounds thorough, you missed the ownership clue.

Windows updates on MD-102: know the three policy types cold

Update management is one of the cleaner scoring areas on MD-102 if you learn the distinctions properly. Microsoft repeatedly tests whether you can choose between update rings, feature updates, and quality/expedited updates.

Use this mental model:

Update rings for Windows 10 and later control ongoing update behavior: deferrals, deadlines, restart settings, user experience.
Feature updates for Windows 10 and later pin devices to a specific Windows feature version, like keeping devices on a chosen release.
Quality updates / expedited updates accelerate delivery of monthly security fixes when speed matters.

A common trap is when the question says something like “ensure devices stay on Windows 11 version X until app validation is complete.” That is not an update ring question; that is feature updates. Rings manage cadence and experience, but feature update policy is the direct control for target version.

Another pattern: if the prompt mentions a critical zero-day or urgent security deployment, think expedited quality update rather than adjusting the whole ring. Microsoft likes testing the admin action with the smallest blast radius.

Know these extra details because they show up in distractors:

Driver updates are managed separately enough that they can be the intended answer when hardware compatibility is the issue.
Update ring settings affect restart behavior and deadlines, so if the scenario is about minimizing user disruption while still enforcing installation, ring configuration is likely central.
Reporting questions may reference device update status and deployment monitoring rather than the policy itself.

Do not ignore Windows Autopatch if it appears in your prep materials, but on MD-102 the more reliable scoring comes from understanding the base Intune update controls and how Microsoft phrases version-lock versus rollout-speed scenarios.

The last week: what I would review again for MD-102

If I had seven days left before taking MD-102 again, I would not spend that week rereading broad theory. I would do a targeted sweep of the exact areas Microsoft keeps turning into scenario questions.

Here is the review list that would give the best return:

Join and enrollment matrix
- Entra registered vs joined vs hybrid joined
- BYOD vs corporate-owned behavior
- Automatic enrollment prerequisites
- Enrollment restrictions and platform restrictions
Autopilot actions and profiles
- User-driven, pre-provisioned, reset, wipe, fresh start
- ESP behavior
- Group targeting and registration basics
Win32 deployment mechanics
- Detection vs requirement rules
- Dependencies vs supersedence
- Required vs available vs uninstall assignments
- User context vs system context implications
Policy types in Intune
- Configuration profiles
- Settings catalog
- Endpoint security
- Security baselines
- Compliance policies
Device actions
- Retire, wipe, sync, restart, fresh start, autopilot reset, remote lock where applicable
Update policy choices
- Rings vs feature updates vs expedited quality updates
Protection controls
- BitLocker recovery and escrow concepts
- Defender for Endpoint integration
- Compliance + Conditional Access chain

One highly practical prep method: take a blank sheet and write the action you would choose for each of these prompts without looking anything up:

Reuse a corporate Windows device for a new employee.
Remove only company data from a personal device.
Force a specific Windows version across a pilot group.
Deploy a legacy desktop app with prerequisites.
Block access to Microsoft 365 from devices missing encryption.
Prevent personal Windows devices from enrolling.

If you cannot answer those instantly, your weak spots are exactly where MD-102 tends to score against people.

I would also spend time in the actual portals, not just notes. MD-102 rewards visual familiarity with where settings live. Seeing the difference between Devices, Apps, Endpoint security, Reports, and Windows updates in Intune makes the exam stems much easier to parse.

Microsoft exam traps specific to MD-102

The hardest part of MD-102 is not the technology itself; it is Microsoft’s habit of giving you several answers that all sound admin-reasonable. These are the traps I would watch for.

Cloud answer vs legacy answer
- If the tenant is clearly modern-managed and remote, Microsoft usually wants the Intune/Entra-native approach, not on-prem Group Policy or imaging.
Evaluation vs enforcement
- Compliance evaluates. Conditional Access enforces access decisions. Do not swap them.
Provisioning vs enrollment
- Autopilot is provisioning. Automatic MDM enrollment is enrollment. Related, not identical.
Target version vs update cadence
- Feature update policy sets the version. Update rings control servicing behavior.
Specific security workload vs broad template
- Endpoint security for focused security controls; baseline for broad recommended posture.
Selective removal vs destructive reset
- Retire is not wipe. Delete is not retire. Fresh Start is not Autopilot Reset.

The best way to handle these traps during the exam is to reduce every long scenario to a tiny decision model:

What kind of device is it? Personal or corporate?
How is it joined and managed?
Is the task about provisioning, configuration, compliance, security, apps, or updates?
Is Microsoft asking for evaluation, enforcement, or lifecycle action?

That sounds simple, but on MD-102 it is the difference between recognizing the intended management plane and getting dragged into plausible distractors.

Last blunt warning: do not walk into this exam thinking “I know Windows, so I’m fine.” MD-102 is much more about Microsoft’s modern endpoint administration model than about traditional desktop support. If you are strongest in old-school imaging, local policy, and manual app installs, you need to consciously retrain your instincts for the exam.