Prepare Infrastructure
25-30%of exam
Manage Devices
30-35%of exam
Manage Applications
15-20%of exam
Protect Devices
15-20%of exam
Quick Facts
- Exam
- MD-102
- Credential
- Endpoint Administrator Associate
- Time
- 100 min
- Pass
- 700 scaled
- Provider
- Pearson VUE
- Platform
- Microsoft Intune
- Renewal
- Annual
- Blueprint
- Apr 28 2026
ICE Access
Identify, check, enforce access.
IdentityComplianceEnforcement
Joined vs Registered
Joined
- Corporate ownership
- Work sign-in
- Full management
Registered
- Personal ownership
- Workplace access
- Light identity
Own vs access
Identity Picker
- Cloud corporate Windows→Entra joined
- Personal work access→Entra registered
- Legacy AD needed→Hybrid joined
- Need Intune enrollment→MDM scope
- Require healthy device→Compliance policy
- Block resource access→Conditional Access
Device Identity
- Entra joined
- Cloud corporate Windows
- Entra registered
- BYOD workplace identity
- Hybrid joined
- AD plus Entra
- Workgroup
- No cloud identity
- Dynamic device
- Attribute membership
- Security group
- Management targeting
- MDM scope
- Auto enrollment gate
- Primary user
- User device affinity
Compliance vs Conditional Access
Compliance
- Evaluate device
- Reports health
- Marks status
Conditional Access
- Enforces access
- Grant controls
- Blocks resources
Measure vs enforce
Enrollment
- Automatic enrollment
- Windows MDM join
- Device limit
- Per-user cap
- Platform restriction
- Block platform ownership
- Enrollment profile
- Platform setup
- Android fully managed
- Corporate user device
- Android dedicated
- Kiosk shared device
- Work profile
- BYOD Android container
- Apple bulk
- Automated enrollment
Identity + Compliance
- Compliance policy
- Health evaluation
- Grace period
- Delayed noncompliance
- CA policy
- Access enforcement
- Require compliant
- Grant control
- WHfB
- Passwordless sign-in
- Windows LAPS
- Local admin rotation
- Intune RBAC
- Admin permissions
- Local groups
- Windows membership
UPS Autopilot
User, pre-stage, self-deploy.
User-drivenPre-provisionedSelf-deploying
Autopilot vs Provisioning Package
Autopilot
- Cloud OOBE
- Profile assigned
- Internet required
Package
- Offline capable
- Technician applies
- Staged settings
Cloud vs staged
Deployment Picker
- User receives laptop→User-driven Autopilot
- Kiosk no user→Self-deploying Autopilot
- Technician stages apps→Pre-provisioned Autopilot
- Limited internet setup→Provisioning package
- Persistent contractor desktop→Windows 365
- Shared cloud sessions→Azure Virtual Desktop
Autopilot
- User-driven
- User receives device
- Self-deploying
- Kiosk no user
- Pre-provisioned
- Technician stages first
- Existing devices
- Convert during deploy
- Hardware hash
- Manual device import
- ESP
- Block until ready
- Name template
- Automated device names
- Provisioning package
- Offline staged setup
User-Driven vs Self-Deploying
User-driven
- User signs in
- Primary user
- Personal laptop
Self-deploying
- No user affinity
- Kiosk devices
- Shared endpoints
Person vs kiosk
Configuration
- Settings catalog
- Granular settings
- Templates
- Scenario profiles
- ADMX import
- Custom Windows settings
- Filters
- Assignment narrowing
- Windows multi-session
- AVD session hosts
- Configuration profile
- Device settings
- Policy set
- Grouped assignments
- Assignment status
- Deployment evidence
Intune Suite
- EPM
- Privilege elevation
- Enterprise App Catalog
- Packaged apps
- Advanced Analytics
- Endpoint insights
- Remote Help
- Assisted support
- Cloud PKI
- Cloud certificates
- Tunnel MAM
- App-level VPN
- Device query
- KQL inventory
- Bulk action
- Many devices
Remote Actions
- Sync
- Force check-in
- Restart
- Reboot device
- Retire
- Remove corporate data
- Wipe
- Factory reset
- Fresh Start
- Clean Windows
- Autopilot Reset
- Keep Entra identity
- Rotate key
- BitLocker recovery change
- Update intelligence
- Defender signatures
Cloud Desktops
- Windows 365
- Managed Cloud PC
- AVD
- Azure VDI platform
- Cloud PC policy
- Provisioning rules
- Multi-session
- Shared Windows host
- Resize
- Change Cloud PC
- Reprovision
- Recreate Cloud PC
- Restore
- Rollback Cloud PC
- Region
- Cloud PC location
MAM Boundary
Manage app data, not device.
Managed appsDLPSelective wipe
App Protection vs Compliance
App protection
- App data
- No enrollment possible
- Selective wipe
Compliance
- Device health
- Enrollment required
- Access signal
App vs device
App Picker
- Force app install→Required assignment
- Let users install→Available assignment
- Protect BYOD data→App protection
- Configure app settings→App configuration
- Package Windows installer→Win32 app
- Deploy Office suite→Microsoft 365 Apps
App Types
- Win32 app
- IntuneWin package
- LOB app
- Custom installer
- Store app
- Platform marketplace
- Web link
- URL shortcut
- Required
- Forced install
- Available
- Company Portal
- Uninstall
- Remove app
- Detection rule
- Install proof
Microsoft 365 Apps
- ODT
- XML deployment tool
- OCT
- Config designer
- Apps admin center
- Office servicing
- Office policy
- App settings
- Autopilot apps
- Install during ESP
- Update channel
- Office cadence
- Shared activation
- Multi-user Office
- Assignment intent
- Install behavior
App Protection
- MAM
- App management
- MAM-WE
- Without enrollment
- Managed app
- Policy-capable app
- DLP
- Data movement rules
- Selective wipe
- Remove corporate data
- Conditional launch
- App health gate
- App PIN
- Managed access
- Managed browser
- Protected web access
App Configuration
- Managed devices
- MDM app config
- Managed apps
- MAM app config
- IntuneMAMUPN
- iOS user hint
- IntuneMAMOID
- iOS object hint
- IntuneMAMDeviceID
- iOS device hint
- Configuration designer
- Key-value UI
- App filter
- MAM targeting
- Policy delivery
- App sign-in dependent
SAFE Protection
Secure, assess, fix, enforce.
Security policyDefender riskRemediationCA
Configuration vs Endpoint Security
Configuration
- General settings
- Platform profiles
- ADMX import
Endpoint security
- Security workload
- Firewall encryption
- ASR antivirus
Settings vs protection
Security Picker
- Need recommended defaults→Security baseline
- Configure BitLocker→Disk encryption
- Block attack techniques→ASR policy
- Use threat risk→Defender connector
- Set patch cadence→Update rings
- Pin Windows release→Feature updates
Endpoint Security
- Antivirus
- Malware protection
- Disk encryption
- BitLocker policy
- Firewall
- Network protection
- ASR
- Attack reduction
- EDR
- Endpoint detection
- Account protection
- Identity hardening
- Security baseline
- Recommended settings
- Security task
- Defender remediation
Update Rings vs Feature Updates
Update rings
- Deferrals
- Deadlines
- Restart behavior
Feature updates
- Target release
- Version hold
- Windows level
Timing vs version
Defender
- Connector
- Intune MDE link
- Onboarding
- Enroll into Defender
- Device risk
- Threat signal
- Risk compliance
- Access condition
- Security intelligence
- AV definitions
- Tamper protection
- Security setting lock
- Endpoint detection
- EDR telemetry
- Remediation task
- Fix request
Updates
- Update rings
- Cadence restart rules
- Feature updates
- Target Windows release
- Quality updates
- Monthly patches
- Expedited updates
- Urgent security patches
- Driver updates
- Hardware drivers
- Delivery Optimization
- Bandwidth sharing
- Apple updates
- iOS macOS policy
- FOTA
- Android firmware updates
Common Traps
Registration Is Not Join
Entra registered ≠ Entra joined
Compliance Is Not Enforcement
Compliance policy ≠ Conditional Access policy
BYOD Data Is App
App protection ≠ Full enrollment
Kiosk Avoids User Affinity
Self-deploying mode ≠ User-driven mode
Retire Is Not Wipe
Corporate data removal ≠ Factory reset
Rings Are Not Versions
Update timing ≠ Feature target
Assignment Is Not Success
Assigned policy ≠ Device applied
Last Minute
- 1.Prepare plus Manage dominate weight
- 2.Entra join before Intune policy
- 3.Compliance evaluates, CA enforces
- 4.Filters narrow assignments dynamically
- 5.Autopilot needs device registration
- 6.ESP blocks until required setup
- 7.MAM protects unenrolled BYOD apps
- 8.Required installs; Available offers
- 9.Baselines are recommended defaults
- 10.Defender risk can drive compliance
- 11.Rings schedule; feature pins version
- 12.Retire removes company data
Buy on Amazon
Take courses on Udemy
Learning path on PluralsightSame family resources
Explore More Microsoft Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
VideoFREE MD-102 Exam Guide 2026: Pass Microsoft Endpoint Administrator (Intune, Autopilot, Windows 11)This examVideoPL-300 Power BI Data Analyst Exam Guide 2026 (FREE)ArticleFREE MD-102 Exam Guide 2026: Pass Microsoft Endpoint Administrator (Intune, Autopilot, Windows 11)24 min readArticleFREE DP-600 Exam Guide 2026: Pass Microsoft Fabric Analytics Engineer (Direct Lake, DAX, Semantic Models)27 min readArticleFREE MS-102 Exam Guide 2026: Pass Microsoft 365 Administrator (Entra, Defender XDR, Purview)24 min readArticleFREE PL-400 Power Platform Developer Exam Guide 2026: Pass First Try16 min read