Microsoft
Free MD-102 Endpoint Admin Practice Questions
The MD-102 Endpoint Administrator exam is up to 50 questions in 100 minutes, and the voucher costs $165. CertCrush provides 400 syllabus-aligned practice questions and 20 performance-based questions across all 5 exam domains, each with a full explanation. Free to try, no account required.
MD-102 covers managing and securing Microsoft 365 endpoints with Intune: enrollment, configuration and compliance policies, app deployment and protection, endpoint security, updates, and the automation and reporting work that keeps a device estate healthy. It leads to the Microsoft 365 Certified: Endpoint Administrator Associate credential. This bank follows the blueprint Microsoft published on 24 July 2026, including the new fifth skill area.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
10
Sample questions
100 min
Exam time limit
70%
Practice pass mark
$165
Exam voucher
About the MD-102 Endpoint Administrator Exam
MD-102 is the exam behind the Microsoft 365 Certified: Endpoint Administrator Associate credential. It tests whether you can run a fleet of devices from Intune: enrolling Windows, macOS, iOS, iPadOS and Android endpoints, shipping configuration and compliance policies to them, deploying and protecting apps, and keeping the whole estate patched and reporting cleanly. Microsoft rewrote the blueprint on 24 July 2026. There are now five skill areas instead of four, and the new one, Optimize endpoint operations by using automation, monitoring, and reporting, is worth 10 to 15 percent on its own. It covers PowerShell and Microsoft Graph automation, Endpoint Analytics, proactive remediation scripts, and the Security Copilot agents that now sit inside Intune. Older MD-102 question banks do not contain a single question on any of it. The exam suits Windows and endpoint administrators who already work in Intune every day. Most candidates who fail do so on the parts of the blueprint their own job never touches. If your tenant is Windows-only, the Android enrollment profiles and the Apple Business Manager integration will hurt. If you have never bought the Intune Suite, then Endpoint Privilege Management, Microsoft Cloud PKI and Microsoft Tunnel for MAM are four objectives you have no muscle memory for. You get 100 minutes and a scaled score out of 1000, with 700 to pass. Expect drag and drop, build list and active screen items alongside multiple choice, plus case studies. Microsoft does not publish a fixed question count; its own guidance puts most role-based exams between 40 and 60 questions.
Exam Domains Covered
Exam Format & Details
100 minutes. Microsoft does not publish a fixed question count for MD-102; its own guidance states that most role-based exams contain 40 to 60 questions. The exam is scored on a scale to 1000, and 700 is required to pass. Expect interactive items alongside multiple choice: drag and drop, build list, active screen and hot area, plus case studies. Booked through Pearson VUE, online or at a test centre. US list price is around 165 USD, and Microsoft prices the exam by the country or region it is proctored in.
Why Practice Questions Matter
The July 2026 blueprint change is the reason to practise on current questions rather than an older bank. A fifth skill area appeared, Perform remote actions on devices and Configure endpoint security were both reworked, and Enroll devices to Microsoft Intune changed enough that Microsoft flagged it as a major revision. Questions written before that date drill you on a version of the exam that no longer exists. The other reason is the shape of the questions. MD-102 rarely asks what a feature is. It gives you a tenant, a requirement and four ways to meet it, and only one of them survives the constraint.
Try MD-102 Endpoint Administrator
Get a taste before you commit — no account needed. Then a free account unlocks 25 questions with readiness tracking, no card required.
Get full access to MD-102 Endpoint Administrator
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
This course
$9.99
one-time
Monthly
$12.99
per month · all courses
Takes 30 seconds — create a free account, then straight to checkout. Already have an account? Sign in
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real MD-102 Endpoint Administrator exam — marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the MD-102 Endpoint Administrator exam — not actual exam content.
Q1.Which statement about the number of accounts Windows LAPS manages through Intune is correct?
- A.Exactly one local admin account per device
- B.Every account in the local Administrators group
- C.One account per user who signs in to the device
- D.As many accounts as you list in the policy
Domain: Prepare infrastructure for devices
Q2.An employee at Contoso uses a Windows 11 laptop that she bought herself. She must be able to open work email in Outlook and get single sign-on to Microsoft 365, but the company does not own the laptop and she must keep signing in to Windows with her existing local account. Which device identity state meets the requirement?
- A.Microsoft Entra registered
- B.Microsoft Entra joined
- C.Microsoft Entra hybrid joined
- D.Joined to the on-premises Active Directory domain only
Domain: Prepare infrastructure for devices
Q3.A technician adds a new corporate Windows 11 laptop to the tenant by opening Settings, Accounts, Access work or school, selecting Connect, and typing the user's work email address on the first screen. The laptop later appears in Microsoft Entra ID with a trust type of Microsoft Entra registered instead of Microsoft Entra joined. What should the technician have selected instead?
- A.Choose "Join this device to Microsoft Entra ID" under Alternate actions
- B.Select Connect and sign in with the work email address on the first screen
- C.Sign in to the Company Portal app with the work account
- D.Add a Microsoft account under Family and other users
Domain: Prepare infrastructure for devices
Q4.Fabrikam has 4,000 Windows 11 devices joined to an on-premises Active Directory domain and managed by Group Policy. The company wants Intune management as well, must keep the existing Group Policy Objects working, and cannot reimage the fleet. Which device identity state should you target?
- A.Microsoft Entra hybrid joined
- B.Microsoft Entra joined
- C.Microsoft Entra registered
- D.Domain joined with no Microsoft Entra identity
Domain: Prepare infrastructure for devices
Q5.A Windows 11 device is currently Microsoft Entra hybrid joined. It must become Microsoft Entra joined. Which two actions must you take first? Each correct answer presents part of the solution.
- A.Unjoin the device from the on-premises Active Directory domain
- B.Unjoin the device from Microsoft Entra ID
- C.Delete the device's managed device record in Intune
- D.Edit the device's deviceTrustType attribute to AzureAD
- E.Set the MDM user scope to None for the device's primary user
Domain: Prepare infrastructure for devices
Q6.You run dsregcmd /status on a Windows 11 device. The Device State section shows AzureAdJoined: YES and DomainJoined: NO. What is the device's state?
- A.Microsoft Entra joined
- B.Microsoft Entra hybrid joined
- C.Microsoft Entra registered
- D.Domain joined with no cloud identity
Domain: Prepare infrastructure for devices
Q7.Every attempt to join a Windows 11 device to Microsoft Entra ID in your tenant fails with error 0x801c0003 and the message "This user is not authorized to enroll". The users hold Intune licences, no one is near a device limit, and the device platform restrictions allow Windows. What should you check next?
- A.Whether "Users may join devices to Microsoft Entra ID" is set to None
- B.Whether the MDM authority has been set to Intune
- C.Whether the Intune device limit restriction is set to 1
- D.Whether Company Portal branding has been configured
Domain: Prepare infrastructure for devices
Q8.In the Microsoft Entra admin center, under Devices and then Device settings, what is the default value of the Maximum number of devices setting?
- A.50
- B.15
- C.100
- D.Unlimited
Domain: Prepare infrastructure for devices
Q9.You are creating a group that will contain device objects so you can target an Intune configuration profile at them. Which group type must you select?
- A.Security
- B.Microsoft 365
- C.Distribution
- D.Mail-enabled security
Domain: Prepare infrastructure for devices
Q10.How many built-in local groups can the Local user group membership profile target?
- A.Six built-in local groups
- B.Every local group on the device
- C.Only the local Administrators group
- D.Any local group whose name you type manually
Domain: Prepare infrastructure for devices
MD-102 Endpoint Administrator guides & exam news
MD-102 Changed on 24 July 2026: New Exam Name, a New Fifth Domain and Is Your Study Guide Still Valid?
Microsoft rewrote MD-102 on 24 July 2026. The exam has a new title, a fifth domain worth 10 to 15 percent, and Security Copilot agents in the objectives. Here is exactly what changed and which parts of your revision still count.
How to Pass the Microsoft MD-102 Exam in 2026: An 8-Week Endpoint Administrator Study Plan
MD-102 was restructured on 24 July 2026 and now has five domains, including a brand new one on automation, monitoring and Security Copilot agents. Here is the full outline, the pass mark, and an 8-week study plan built for the current version.
Microsoft AZ-900 Practice Questions: 25 Exam-Style Examples With Answers and Explanations (2026 Objectives)
Twenty-five free AZ-900 practice questions written to the objectives Microsoft published on 20 July 2026, split across the three domains in their real exam proportions, with a full explanation of the correct answer and every distractor.
Microsoft AB-730 AI Business Professional Explained: Domains, Cost and Is It Worth It in 2026?
Microsoft AB-730 is the AB series exam for people who use Copilot every day rather than build it. Here are the three exam domains and their weightings, the 45-minute format, the cost, the AB-731 difference, and an honest verdict on whether it is worth sitting.
Frequently Asked Questions
Does the MD-102 Endpoint Administrator course include performance-based questions?
Yes. The MD-102 Endpoint Administrator course includes 20 performance-based questions (PBQs) — hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free MD-102 Endpoint Administrator sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full MD-102 Endpoint Administrator course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the MD-102 Endpoint Administrator course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the MD-102 Endpoint Administrator course cover?
The course covers 5 exam domains: Prepare infrastructure for devices, Manage and maintain devices, Protect devices, Manage and secure applications, Optimize endpoint operations by using automation, monitoring, and reporting.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.