In the full course
What you get
- 400 exam-style questions, each with a full explanation
- 20 performance-based tasks, marked with partial credit
- 200 flashcards, filtered by domain
- The full study guide, 27 chapters
- Timed mock exams matched to the real exam length
- A readiness score weighted by the official exam blueprint
Get full access to MD-102 Endpoint Administrator
All questions, timed exams, flashcards, PDF study guide download & progress tracking.
Lifetime · all courses
$29.99
One payment · future courses included
30 seconds, then straight to checkout.
Pass, or your money back
Reach 85% readiness on this course, sit the real exam, and if you don't pass we refund it in full. Applies to this single-course purchase. Terms.
More free samples
Marked, and passed
Real feedback from people who passed
“I failed my CISSP on the first attempt with another platform. Switched to CertCrush, focused on my weak domains using the tracking feature, and passed three months later. The explanations for wrong answers are genuinely useful, not just 'A is correct because A is correct'.”
“Honestly wasn't expecting much but this is probably the best ten bucks I've spent on exam prep. Did 20–30 questions every morning before work for 6 weeks. Passed with a comfortable margin. The timed exam mode is what really got me comfortable with the pressure.”
“The flashcards are underrated. I used them during my commute and it made a huge difference for the theory-heavy ITIL questions. Passed first try. Already using it again for CISM.”
MD-102 covers managing and securing Microsoft 365 endpoints with Intune: enrollment, configuration and compliance policies, app deployment and protection, endpoint security, updates, and the automation and reporting work that keeps a device estate healthy. It leads to the Microsoft 365 Certified: Endpoint Administrator Associate credential. This bank follows the blueprint Microsoft published on 24 July 2026, including the new fifth skill area.
Practice content last updated · Independently written and aligned to Microsoft’s published exam objectives.
About the MD-102 Endpoint Administrator Exam
MD-102 is the exam behind the Microsoft 365 Certified: Endpoint Administrator Associate credential. It tests whether you can run a fleet of devices from Intune: enrolling Windows, macOS, iOS, iPadOS and Android endpoints, shipping configuration and compliance policies to them, deploying and protecting apps, and keeping the whole estate patched and reporting cleanly. Microsoft rewrote the blueprint on 24 July 2026. There are now five skill areas instead of four, and the new one, Optimize endpoint operations by using automation, monitoring, and reporting, is worth 10 to 15 percent on its own. It covers PowerShell and Microsoft Graph automation, Endpoint Analytics, proactive remediation scripts, and the Security Copilot agents that now sit inside Intune. Older MD-102 question banks do not contain a single question on any of it. The exam suits Windows and endpoint administrators who already work in Intune every day. Most candidates who fail do so on the parts of the blueprint their own job never touches. If your tenant is Windows-only, the Android enrollment profiles and the Apple Business Manager integration will hurt. If you have never bought the Intune Suite, then Endpoint Privilege Management, Microsoft Cloud PKI and Microsoft Tunnel for MAM are four objectives you have no muscle memory for. You get 100 minutes and a scaled score out of 1000, with 700 to pass. Expect drag and drop, build list and active screen items alongside multiple choice, plus case studies. Microsoft does not publish a fixed question count; its own guidance puts most role-based exams between 40 and 60 questions.
Exam Domains Covered
- Prepare infrastructure for devices23%
- Manage and maintain devices28%
- Protect devices18%
- Manage and secure applications18%
- Optimize endpoint operations by using automation, monitoring, and reporting13%
Exam Format & Details
100 minutes. Microsoft does not publish a fixed question count for MD-102; its own guidance states that most role-based exams contain 40 to 60 questions. The exam is scored on a scale to 1000, and 700 is required to pass. Expect interactive items alongside multiple choice: drag and drop, build list, active screen and hot area, plus case studies. Booked through Pearson VUE, online or at a test centre. US list price is around 165 USD, and Microsoft prices the exam by the country or region it is proctored in.
Why Practice Questions Matter
The July 2026 blueprint change is the reason to practise on current questions rather than an older bank. A fifth skill area appeared, Perform remote actions on devices and Configure endpoint security were both reworked, and Enroll devices to Microsoft Intune changed enough that Microsoft flagged it as a major revision. Questions written before that date drill you on a version of the exam that no longer exists. The other reason is the shape of the questions. MD-102 rarely asks what a feature is. It gives you a tenant, a requirement and four ways to meet it, and only one of them survives the constraint.
Try 2 performance tasks free
Drag-and-drop, sequencing and configuration tasks that mirror the interactive questions on the real MD-102 Endpoint Administrator exam, marked with partial credit.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the MD-102 Endpoint Administrator exam, not actual exam content.
Q1.A nightly Intune reporting job must run on a server with no signed-in user and no interactive prompt. Security requires that no credential is stored in the script file. How should the job authenticate to Microsoft Graph?
- A.Register an app, grant application permissions with admin consent, and connect using the client ID, tenant ID, and a certificate thumbprint
- B.Register an app and connect using the client ID, tenant ID, and a client secret written into the script
- C.Run Connect-MgGraph with the required delegated scopes from the scheduled task
- D.Store an Intune Administrator account password in the script and pass it to Connect-MgGraph
Domain: Optimize endpoint operations by using automation, monitoring, and reporting
Q2.One badly broken laptop crashes the same desktop application dozens of times a day. What prevents that single device from dominating the tenant-wide reliability score for the app?
- A.A maximum of ten crash events per application, per device, per day is counted
- B.Devices reporting more than ten crashes in a day are excluded from the report
- C.Mean time to failure discards values more than two standard deviations from the mean
- D.Only the ten devices with the highest usage duration contribute to an app score
Domain: Optimize endpoint operations by using automation, monitoring, and reporting
Q3.You are preparing to enable the Vulnerability Remediation Agent in Intune. Which two Security Copilot plugins must be enabled? Each correct answer presents part of the solution.
- A.Microsoft Intune
- B.Microsoft Defender
- C.Microsoft Entra
- D.Microsoft Threat Intelligence
- E.Microsoft Purview
Domain: Optimize endpoint operations by using automation, monitoring, and reporting
Q4.Which two Intune options can apply Windows Hello for Business settings to a targeted group of devices after those devices have already enrolled? Each correct answer presents part of the solution.
- A.An endpoint security Account protection policy
- B.A settings catalog policy
- C.The tenant-wide Windows Hello for Business enrollment policy
- D.An enrollment status page profile
- E.A Windows compliance policy
Domain: Prepare infrastructure for devices
Q5.You create a device platform restriction that blocks Windows and assign it to a pilot group, then test it by deploying a device with Windows Autopilot in self-deploying mode. The device enrolls successfully. Why?
- A.Restrictions only evaluate user-driven enrollments, so the default policy handled this device
- B.The restriction had not finished syncing, so it will apply on the next attempt
- C.Self-deploying mode ignores restrictions because the device has a corporate identifier
- D.Autopilot devices are exempt from restrictions unless you raise the policy to priority 1
Domain: Prepare infrastructure for devices
Q6.A colleague asks about the difference between the Application control profile inside attack surface reduction policy and App Control for Business policy. Which statement is correct?
- A.The ASR Application control profile uses the AppLocker CSP, while App Control for Business uses the ApplicationControl CSP
- B.The ASR Application control profile uses the ApplicationControl CSP, while App Control for Business uses the AppLocker CSP
- C.Both profiles use the ApplicationControl CSP and differ only in the platform they support
- D.App Control for Business is a profile inside attack surface reduction policy
Domain: Protect devices
Q7.You test a self-deploying Windows Autopilot profile on a Hyper-V virtual machine that has a virtual TPM. The deployment times out on the Securing your hardware step with error 0x800705B4. What is the cause?
- A.Self-deploying mode requires TPM 2.0 hardware attestation, which a virtual machine cannot provide
- B.The Enrollment Status Page timeout is set below 60 minutes
- C.The virtual machine was imported without a group tag
- D.Self-deploying mode requires a device name template to be applied
Domain: Manage and maintain devices
Q8.In the Windows automatic enrollment settings, what is the effect of setting the MDM user scope to None?
- A.Automatic enrollment is off, so users must start enrollment themselves
- B.Automatic enrollment applies only to the groups you select
- C.Devices can no longer join Microsoft Entra ID
- D.Devices that are already enrolled are unenrolled at their next check-in
Domain: Prepare infrastructure for devices
Q9.Fabrikam has 4,000 Windows 11 devices joined to an on-premises Active Directory domain and managed by Group Policy. The company wants Intune management as well, must keep the existing Group Policy Objects working, and cannot reimage the fleet. Which device identity state should you target?
- A.Microsoft Entra hybrid joined
- B.Microsoft Entra joined
- C.Microsoft Entra registered
- D.Domain joined with no Microsoft Entra identity
Domain: Prepare infrastructure for devices
Q10.In the Microsoft Intune admin center you open Endpoint security > Microsoft Defender for Endpoint and see that Connection status reads Unavailable. What must you do to establish the connection?
- A.In the Microsoft Defender portal, set the Microsoft Intune connection toggle to On under Advanced features, then save preferences
- B.Create an endpoint detection and response policy in Intune and assign it to all devices
- C.Assign a device compliance policy that requires the machine risk score to be Clear
- D.Assign the Endpoint Security Manager role to every Intune administrator
Domain: Protect devices
MD-102 Endpoint Administrator guides & exam news
MD-102 Changed on 24 July 2026: New Exam Name, a New Fifth Domain and Is Your Study Guide Still Valid?
Microsoft rewrote MD-102 on 24 July 2026. The exam has a new title, a fifth domain worth 10 to 15 percent, and Security Copilot agents in the objectives. Here is exactly what changed and which parts of your revision still count.
How to Pass the Microsoft MD-102 Exam in 2026: An 8-Week Endpoint Administrator Study Plan
MD-102 was restructured on 24 July 2026 and now has five domains, including a brand new one on automation, monitoring and Security Copilot agents. Here is the full outline, the pass mark, and an 8-week study plan built for the current version.
SC-500 vs SC-200 in 2026: Which Microsoft Security Exam Should You Take?
SC-500 is for engineers who build and harden Azure, hybrid and AI workloads. SC-200 is for analysts who detect, investigate and respond. How the two 2026 exams differ, where their objectives overlap, and which to take first.
Microsoft AB-650 Exam Topics and Domain Weightings in 2026: The MS-102 Replacement, Now in Beta
AB-650 replaces MS-102 as Microsoft's tenant administration exam, and the weightings tell a different story. Security and governance take 40 to 45 percent, AI services take 35 to 40 percent, and classic tenant admin is down to a fifth of the exam.
Frequently Asked Questions
Does the MD-102 Endpoint Administrator course include performance-based questions?
Yes. The MD-102 Endpoint Administrator course includes 20 performance-based questions (PBQs): hands-on tasks that mirror the interactive questions on the real exam, including drag-and-drop matching, sequencing and configuration screens. Each one is marked with partial credit, so you can see exactly which placements were wrong, and every task includes a full explanation. The first two are free to try.
What is included in the free MD-102 Endpoint Administrator sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full MD-102 Endpoint Administrator course?
The full MD-102 Endpoint Administrator course includes 400 practice questions and 20 performance-based tasks, covering all 5 exam domains. Every question carries a full explanation for the right answer and the wrong ones.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned. They mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the MD-102 Endpoint Administrator course cover?
The course covers 5 exam domains: Prepare infrastructure for devices, Manage and maintain devices, Protect devices, Manage and secure applications, Optimize endpoint operations by using automation, monitoring, and reporting.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.
Start with 10 free questions
No account, no card. The full MD-102 Endpoint Administrator course is $9.99, once.