Microsoft · Exam reference
About the MD-102 Endpoint Administrator exam
MD-102 covers managing and securing Microsoft 365 endpoints with Intune: enrollment, configuration and compliance policies, app deployment and protection, endpoint security, updates, and the automation and reporting work that keeps a device estate healthy. It leads to the Microsoft 365 Certified: Endpoint Administrator Associate credential. This bank follows the blueprint Microsoft published on 24 July 2026, including the new fifth skill area.
10
Sample questions
100 min
Exam time limit
70%
Practice pass mark
$165
Exam voucher
MD-102 is the exam behind the Microsoft 365 Certified: Endpoint Administrator Associate credential. It tests whether you can run a fleet of devices from Intune: enrolling Windows, macOS, iOS, iPadOS and Android endpoints, shipping configuration and compliance policies to them, deploying and protecting apps, and keeping the whole estate patched and reporting cleanly. Microsoft rewrote the blueprint on 24 July 2026. There are now five skill areas instead of four, and the new one, Optimize endpoint operations by using automation, monitoring, and reporting, is worth 10 to 15 percent on its own. It covers PowerShell and Microsoft Graph automation, Endpoint Analytics, proactive remediation scripts, and the Security Copilot agents that now sit inside Intune. Older MD-102 question banks do not contain a single question on any of it. The exam suits Windows and endpoint administrators who already work in Intune every day. Most candidates who fail do so on the parts of the blueprint their own job never touches. If your tenant is Windows-only, the Android enrollment profiles and the Apple Business Manager integration will hurt. If you have never bought the Intune Suite, then Endpoint Privilege Management, Microsoft Cloud PKI and Microsoft Tunnel for MAM are four objectives you have no muscle memory for. You get 100 minutes and a scaled score out of 1000, with 700 to pass. Expect drag and drop, build list and active screen items alongside multiple choice, plus case studies. Microsoft does not publish a fixed question count; its own guidance puts most role-based exams between 40 and 60 questions.
Exam Domains Covered
Exam Format & Details
100 minutes. Microsoft does not publish a fixed question count for MD-102; its own guidance states that most role-based exams contain 40 to 60 questions. The exam is scored on a scale to 1000, and 700 is required to pass. Expect interactive items alongside multiple choice: drag and drop, build list, active screen and hot area, plus case studies. Booked through Pearson VUE, online or at a test centre. US list price is around 165 USD, and Microsoft prices the exam by the country or region it is proctored in.
Why Practice Questions Matter
The July 2026 blueprint change is the reason to practise on current questions rather than an older bank. A fifth skill area appeared, Perform remote actions on devices and Configure endpoint security were both reworked, and Enroll devices to Microsoft Intune changed enough that Microsoft flagged it as a major revision. Questions written before that date drill you on a version of the exam that no longer exists. The other reason is the shape of the questions. MD-102 rarely asks what a feature is. It gives you a tenant, a requirement and four ways to meet it, and only one of them survives the constraint.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the MD-102 Endpoint Administrator exam — not actual exam content.
Q1.A nightly Intune reporting job must run on a server with no signed-in user and no interactive prompt. Security requires that no credential is stored in the script file. How should the job authenticate to Microsoft Graph?
- A.Register an app, grant application permissions with admin consent, and connect using the client ID, tenant ID, and a certificate thumbprint
- B.Register an app and connect using the client ID, tenant ID, and a client secret written into the script
- C.Run Connect-MgGraph with the required delegated scopes from the scheduled task
- D.Store an Intune Administrator account password in the script and pass it to Connect-MgGraph
Domain: Optimize endpoint operations by using automation, monitoring, and reporting
Q2.One badly broken laptop crashes the same desktop application dozens of times a day. What prevents that single device from dominating the tenant-wide reliability score for the app?
- A.A maximum of ten crash events per application, per device, per day is counted
- B.Devices reporting more than ten crashes in a day are excluded from the report
- C.Mean time to failure discards values more than two standard deviations from the mean
- D.Only the ten devices with the highest usage duration contribute to an app score
Domain: Optimize endpoint operations by using automation, monitoring, and reporting
Q3.You are preparing to enable the Vulnerability Remediation Agent in Intune. Which two Security Copilot plugins must be enabled? Each correct answer presents part of the solution.
- A.Microsoft Intune
- B.Microsoft Defender
- C.Microsoft Entra
- D.Microsoft Threat Intelligence
- E.Microsoft Purview
Domain: Optimize endpoint operations by using automation, monitoring, and reporting
Q4.Which two Intune options can apply Windows Hello for Business settings to a targeted group of devices after those devices have already enrolled? Each correct answer presents part of the solution.
- A.An endpoint security Account protection policy
- B.A settings catalog policy
- C.The tenant-wide Windows Hello for Business enrollment policy
- D.An enrollment status page profile
- E.A Windows compliance policy
Domain: Prepare infrastructure for devices
Q5.You create a device platform restriction that blocks Windows and assign it to a pilot group, then test it by deploying a device with Windows Autopilot in self-deploying mode. The device enrolls successfully. Why?
- A.Restrictions only evaluate user-driven enrollments, so the default policy handled this device
- B.The restriction had not finished syncing, so it will apply on the next attempt
- C.Self-deploying mode ignores restrictions because the device has a corporate identifier
- D.Autopilot devices are exempt from restrictions unless you raise the policy to priority 1
Domain: Prepare infrastructure for devices
Frequently Asked Questions
What is included in the free MD-102 Endpoint Administrator sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full MD-102 Endpoint Administrator course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the MD-102 Endpoint Administrator course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the MD-102 Endpoint Administrator course cover?
The course covers 5 exam domains: Prepare infrastructure for devices, Manage and maintain devices, Protect devices, Manage and secure applications, Optimize endpoint operations by using automation, monitoring, and reporting.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.