What MD-102 actually tests

MD-102 is the Microsoft exam for people who deploy, protect, manage, and troubleshoot Windows client devices in a Microsoft 365 environment. If your day job includes Intune, Windows 10/11, Microsoft Entra ID, Autopilot, compliance policies, app deployment, and update rings, this exam matches real work better than many Microsoft associate exams.

This is not a pure desktop support exam and not a pure security exam. It sits in the middle. You need to understand how endpoint administration works across:

Cloud identity with Microsoft Entra ID
Modern management with Microsoft Intune
Windows client provisioning with Autopilot and provisioning packages
Policy and security baselines for endpoint hardening
Application deployment and updates
Endpoint monitoring, recovery, and troubleshooting

Expect scenario-heavy questions. Microsoft likes to test whether you know which portal, which policy type, and which feature solves a specific problem with the least administrative effort. You will see a lot of overlap between domains. For example, enrolling a device is one topic, but it also affects app deployment, compliance, Conditional Access, and updates.

At a high level, focus on these exam areas in this order:

Deploy Windows client
Manage identity and compliance
Manage, maintain, and protect devices
Manage applications

That order matters because the exam assumes a device exists, is enrolled, and is governed by identity before you can secure it or deploy apps to it.

Truekia lists 386 practice questions for this exam. That is enough volume to expose weak areas, but only if you map each question back to the objective it belongs to. Do not just grind questions. Use them to identify gaps in Autopilot, compliance, update servicing, app assignment, and troubleshooting.

Windows client deployment: where many candidates lose easy points

This domain is broad, and Microsoft often asks practical questions here because endpoint admins do this work constantly. You need to know the difference between deployment methods, enrollment paths, and post-deployment configuration.

Know the Windows deployment options cold

You should be comfortable comparing these methods:

Windows Autopilot
- User-driven deployment
- Pre-provisioned deployment (formerly white glove)
- Self-deploying mode
- Autopilot reset
- Autopilot device preparation
Provisioning packages using Windows Configuration Designer
Microsoft Intune enrollment
- Automatic MDM enrollment from Entra ID join
- Corporate-owned vs personally owned devices
Co-management with Configuration Manager
Traditional imaging concepts at a high level, even though MD-102 is much more modern-management focused

Be precise on join and registration states

Microsoft loves testing device identity states because they affect management and access:

Microsoft Entra joined
Microsoft Entra registered
Hybrid Microsoft Entra joined
What each state means for:
- Intune enrollment
- SSO
- Conditional Access
- corporate ownership and management expectations

If you confuse registered with joined, you will miss several questions.

Autopilot is a core exam topic

You should know the full Autopilot flow:

Register device hardware hash
Assign Autopilot profile
Configure enrollment status page (ESP)
Decide user-driven, self-deploying, or pre-provisioned deployment
Assign apps and policies
Validate the out-of-box experience

Study these specific details:

When to use user-driven vs self-deploying
Requirements for self-deploying mode
What pre-provisioning changes operationally
Purpose of the Enrollment Status Page
Difference between Autopilot reset, fresh start, wipe, and retire
How device naming templates work
Group assignment strategy for Autopilot profiles

Intune enrollment methods matter

You need to understand how devices get into Intune and what controls that process:

Automatic enrollment through Entra ID
Company Portal enrollment
Bulk enrollment options
Platform restrictions and enrollment restrictions
Corporate device identifiers
Device categories

Questions often ask what to configure first when enrollment is failing. Usually the answer is not "reinstall Windows." It is something like:

MDM user scope
licensing
enrollment restrictions
Windows edition support
join type mismatch

Local administration and post-deployment settings

Know how to manage local admin rights without creating permanent risk:

Local Users and Groups policy in Intune
Endpoint security account protection policies
Windows LAPS basics in Microsoft environments
Shared device configuration scenarios

What to practice

Build a small tenant lab and do this end to end:

Entra join a Windows 11 VM
Enroll it in Intune
Create an Autopilot profile
Configure ESP
Assign a compliance policy and one app
Test wipe, retire, and Autopilot reset outcomes

If you can explain why you would choose wipe over retire, or fresh start over Autopilot reset, you are at exam level.

Identity, compliance, and access: the policy engine behind endpoint control

This is where MD-102 shifts from deployment into governance. You are expected to understand how Entra ID, Intune compliance, and Conditional Access work together.

Start with Microsoft Entra ID fundamentals

You do not need to be an identity engineer, but you do need to know:

Users, groups, and dynamic group basics
Device objects in Entra ID
Administrative units at a high level
Role-based access control concepts
Self-service password reset basics
Authentication methods and their endpoint impact

For this exam, identity matters because policy targeting depends on it. Dynamic device groups are especially useful for Autopilot and app deployment questions.

Device compliance is heavily tested

You need to know what a compliance policy does and does not do.

A compliance policy evaluates device state. It does not configure all settings by itself. It checks whether the device meets required conditions such as:

Minimum OS version
Password requirements
Encryption required
Secure Boot required
Microsoft Defender status
Jailbroken/rooted state on mobile platforms

You should understand:

Difference between compliance policies and configuration profiles
What happens when a device becomes noncompliant
Compliance actions, including notifications and grace periods
How Conditional Access uses compliance state

Conditional Access questions are usually about the decision chain

Study the logic:

User signs in
Conditions are evaluated
Grant controls are applied
Device must be compliant, hybrid joined, or require MFA depending on policy

Common exam patterns:

"Users on unmanaged devices must not access Exchange Online"
"Only compliant Windows devices can access SharePoint"
"Block legacy authentication"

You should know how to combine:

Named locations
Cloud apps
Grant controls
Device filters at a high level
Report-only mode for testing

Configuration profiles and policy settings

Know the major profile types in Intune:

Settings catalog
Templates
Administrative Templates
Endpoint security policies
Custom profiles and when they are used

You should be able to choose the right tool for the requirement. Microsoft often gives several technically possible answers and expects you to choose the one that is most direct.

Examples:

Browser or OS settings across Windows devices: usually Settings catalog or Administrative Templates
Security-focused configuration: often Endpoint security
Niche CSP-based setting: Custom profile

Policy conflicts and troubleshooting

You need a working understanding of:

Assignment targeting
Include vs exclude groups
Applicability rules
Device vs user scope
Policy conflicts
Intune device configuration reports

If a configuration is not applying, think through the path:

Is the device enrolled?
Is the user/device in scope?
Is there a licensing issue?
Is the setting supported on that Windows edition/version?
Is another policy conflicting?
Has the device synced recently?

That troubleshooting sequence shows up repeatedly in exam scenarios.

Protecting and maintaining endpoints: security baselines, updates, recovery, and Defender

This is the domain that separates people who have only clicked around in Intune from people who have actually run a tenant. Microsoft expects you to know how to keep devices secure and current without breaking productivity.

Security baselines and endpoint security

Study these closely:

Security baselines in Intune
Microsoft Defender for Endpoint integration points
Firewall policies
Antivirus policies
Disk encryption policies
Attack surface reduction concepts at a high level
Account protection policies

Know the difference between deploying security settings through:

Endpoint security policies
Configuration profiles
Security baselines

Microsoft likes to ask what is the best way to implement common hardening requirements at scale. Often the cleanest answer is Endpoint security or a baseline, not a generic configuration profile.

BitLocker and encryption are fair game

You should know:

How to configure BitLocker with Intune
Recovery key storage concepts
Silent enablement considerations
BitLocker reporting basics
Differences between requiring encryption in compliance vs configuring encryption policy

This distinction matters:

Compliance policy can require encryption
Endpoint security disk encryption policy can configure BitLocker settings

Microsoft Defender for Endpoint basics

MD-102 does not go as deep as a dedicated security exam, but you still need to understand:

Onboarding devices to Defender for Endpoint
Security recommendations and exposure reduction concepts
Integration with Intune for risk-based decisions
How device risk can affect compliance and Conditional Access

Windows Update for Business is a must-study area

Do not treat updates as a minor topic. Microsoft asks a lot here.

Know these update management tools and concepts:

Update rings for Windows 10 and later
Feature updates for Windows 10 and later
Quality update policies / expedited updates concepts
Driver updates in Intune
Autopatch at a high level
Servicing channels and deferral concepts
Restart behavior and user experience settings

Be able to answer questions like:

How do you keep devices on a specific Windows version?
How do you expedite a security fix?
How do you defer feature updates but not quality updates?
Which policy controls restart deadlines?

Monitoring, reports, and remediation

Study how endpoint admins verify policy health:

Device status reports
Update reports in Intune
Endpoint analytics at a high level
Troubleshooting from the Intune admin center
Remote actions such as sync, restart, rename, lock, retire, wipe

Recovery and remote actions

Know exactly what these actions do:

Retire
Wipe
Fresh Start
Delete device record
Restart
Sync
Autopilot Reset

Microsoft likes subtle distinctions. For example:

Retire removes managed app and policy data but leaves personal data in many scenarios
Wipe returns device to factory default state
Delete often just removes the management record and is not the same as wiping the device

If you cannot explain those differences in one sentence each, revisit this domain.

Application delivery on managed endpoints

App management in MD-102 is practical rather than theoretical. You need to know how to package, assign, deploy, update, and troubleshoot apps on managed devices.

Know the Windows app types in Intune

Focus on:

Microsoft Store apps (new)
Win32 apps
Microsoft 365 Apps for enterprise
Line-of-business (LOB) apps
Web links
App protection and managed apps concepts for cross-platform awareness

For Windows, Win32 apps are especially important. Study:

Packaging with the Microsoft Win32 Content Prep Tool
Install command and uninstall command
Detection rules
Requirements rules
Return codes
Dependencies
Supersedence
Available vs required assignments

Microsoft 365 Apps deployment

Know how Intune handles Microsoft 365 Apps for enterprise:

App suite configuration
Architecture selection
Update channel basics
Included/excluded apps
Assignment strategy

Questions may ask how to standardize Office deployment or update channels across devices.

App assignment logic matters

You need to understand the practical effect of assignments:

Required means automatic install
Available for enrolled devices means user can install from Company Portal
Uninstall removes the app when supported

Also know:

User vs device group assignment implications
How dependencies influence install order
Why a detection rule can make a successful install appear failed

Troubleshooting app deployment

Common failure points you should recognize:

Incorrect install command
Bad detection rule
Requirement rule mismatch
App assigned to wrong group type or scope
Device not enrolled or not synced
Architecture mismatch
User context vs system context issue

A lot of MD-102 candidates are shaky on detection rules. Fix that. If Intune cannot detect the installed state correctly, the app deployment story falls apart.

Managed browsers and app configuration

At a lighter level, know:

App configuration policies
Managed app scenarios
Browser management basics with Microsoft Edge
Kiosk/shared device app setup concepts

You do not need deep mobile app management expertise for this exam, but you should not ignore the Intune app model outside traditional Win32 packaging.

A realistic MD-102 study plan by background

MD-102 is manageable if you already work with Microsoft 365 endpoints. It is harder if your background is old-school imaging, AD, and GPO with limited Intune exposure. The exam rewards hands-on familiarity.

If you already administer Intune and Windows endpoints: 3-4 weeks

Use this plan if you already do most of the job.

Week 1

Review official skills measured
Audit weak areas: Autopilot, compliance, update policies, app packaging
Build a checklist of every Intune policy type on the objective list

Week 2

Lab Autopilot, enrollment, compliance, Conditional Access, update rings
Deploy a Win32 app and a Microsoft 365 Apps suite
Practice remote actions and recovery scenarios

Week 3

Take practice questions in domain batches
For every wrong answer, open Microsoft Learn and verify the exact feature behavior
Memorize distinctions: retire vs wipe, compliance vs configuration, update ring vs feature update policy

Week 4

One final review pass of reports, troubleshooting, and policy targeting
Light practice only. No cramming.

If you have Windows admin experience but are new to Intune: 6-8 weeks

This is the most common candidate profile.

Weeks 1-2

Learn Entra join types, Intune enrollment, device lifecycle
Set up a Microsoft 365 developer or trial tenant if available
Enroll test Windows 11 VMs

Weeks 3-4

Work through configuration profiles, compliance, Conditional Access, and Endpoint security
Implement BitLocker and Defender-related settings in the lab

Weeks 5-6

Focus on Autopilot, update rings, feature updates, app deployment, Company Portal, and Win32 packaging
Repeat scenarios until you can do them without notes

Weeks 7-8

Practice questions mapped to objectives
Review Microsoft Learn modules for missed topics
Do one full exam-style revision pass

If you are coming from help desk or desktop support: 8-10 weeks

You need both platform knowledge and exam technique.

Spend the first two weeks learning the Microsoft 365 admin model: Entra ID, Intune, device records, policy targeting
Spend the next four weeks doing guided labs
Use the final two to four weeks for practice questions and targeted remediation

How to use the 386 Truekia questions properly

Split them by domain if possible:

Deployment and enrollment
Identity/compliance/access
Security and updates
Apps and troubleshooting

Your rule should be simple:

Below 70% in a domain: go back to docs and lab it
70-85%: review gaps and retest later
85%+: maintain, do not obsess

Do not memorize answers. Microsoft question wording changes. Understanding feature behavior is what transfers.

Resources worth your time for this exam

Use fewer resources, but use better ones.

Official resources you should start with

Microsoft Learn exam page for MD-102
- Use it to confirm the latest skills measured.
Microsoft Learn learning paths for MD-102 / Endpoint Administrator
- Focus on modules for Intune, Autopilot, app deployment, compliance, and updates.
Microsoft Intune documentation on Microsoft Learn
- Especially docs for:
  - Windows enrollment
  - Windows Autopilot
  - Compliance policies
  - Configuration profiles
  - Endpoint security
  - Windows Update for Business
  - Win32 app management
Windows Autopilot documentation
Windows Update for Business documentation
Microsoft Entra ID documentation for join types and Conditional Access basics

Video training that matches the exam well

John Savill's YouTube content
- Excellent for understanding Entra ID, Intune, Conditional Access, and Microsoft 365 architecture.
Microsoft Mechanics
- Useful for product demos and feature understanding, especially when Microsoft changes UI or naming.

Hands-on environments

Best option:

A Microsoft 365 developer tenant if available to you

If that is not possible:

Use a trial tenant and a couple of Windows 11 VMs
Snapshot often so you can repeat enrollment and policy tests

Specific tools to practice with

Intune admin center
Microsoft Entra admin center
Microsoft Defender portal at a basic level
Windows Configuration Designer
Microsoft Win32 Content Prep Tool
Company Portal
Event Viewer and Windows settings pages for local troubleshooting

Books

For this exam, Microsoft Learn plus lab work is more useful than most books because the platform changes quickly. If you prefer a structured reference, use current books on Microsoft Intune or Windows 11 administration from reputable Microsoft Press or Packt authors, but verify screenshots and workflows against current docs. Do not rely on older Endpoint Manager-era books without checking terminology changes.

How to handle the Microsoft exam itself

Microsoft exams are usually fair if you read carefully and know the product boundaries. They are unforgiving if you skim.

Before the exam

Review the current skills measured one last time
Make sure you can define these without hesitation:
- Entra joined vs registered vs hybrid joined
- compliance policy vs configuration profile
- required vs available app assignment
- wipe vs retire vs fresh start vs Autopilot reset
- update ring vs feature update policy
Do not spend your last night learning new material

During the exam

Read the last line first. Microsoft often hides the real requirement there.
Watch for qualifiers like:
- minimize administrative effort
- without user interaction
- corporate-owned devices only
- personally owned devices
- must remain on a specific Windows version
Eliminate answers that use the wrong admin plane. A lot of distractors are technically related but not the right tool.

Question types to expect

You may see:

Standard multiple choice
Multiple answer
Drag-and-drop sequencing
Case-study style scenarios

For sequencing questions, think operationally. Microsoft usually expects the real-world order: identity, enrollment, policy assignment, verification.

Time management

Do not get stuck on one tricky Conditional Access or Autopilot question. Mark it, move on, and come back. Usually your second pass is better because another question jogs your memory.

Final advice

If your prep is solid, MD-102 is less about obscure trivia and more about choosing the right Microsoft endpoint management feature for a business requirement. Study the product boundaries. Do the labs. Use the 386 practice questions to expose weak spots, not to replace understanding.

That is the difference between barely passing and actually being ready for the job.