Microsoft MD-102 Endpoint Administrator Objectives Explained: What Each Domain Really Requires

 

MD-102 is easiest to understand when you stop treating it as a list of Microsoft Intune features and start treating it as a model of endpoint operations. A modern endpoint administrator does not merely enroll devices or push applications. The role connects identity, device trust, policy, security, applications, updates, automation, monitoring, and remediation into a controlled lifecycle. The current MD-102 blueprint reflects that broader operating model more clearly than older versions of the exam.

Microsoft’s current study guide measures skills as of July 24, 2026. The five published areas are Prepare infrastructure for devices at 20–25%, Manage and maintain devices at 25–30%, Protect devices at 15–20%, Manage and secure applications at 15–20%, and Optimize endpoint operations by using automation, monitoring, and reporting at 10–15%. The last area is especially important because it makes automation and operational health explicit exam responsibilities rather than optional extras.

The certification remains Microsoft 365 Certified: Endpoint Administrator Associate, and Microsoft describes the role as managing devices and client applications in a Microsoft 365 tenant by using Intune together with technologies such as Microsoft Entra ID, Windows Autopilot, Microsoft Defender for Endpoint, PowerShell, Microsoft Graph, Windows 365, and Intune Suite capabilities. That breadth means the exam rewards candidates who can reason about relationships between services, not candidates who memorize where a setting happens to live in the portal.

Read the blueprint as a lifecycle, not five isolated silos

A useful mental model begins before a device is managed. The organization must decide how the device enters identity, how it enrolls, which administrator is allowed to manage it, which configuration and compliance rules apply, and what access decisions depend on its state. After enrollment, the device needs operating-system configuration, applications, security controls, updates, monitoring, and eventually remote actions or retirement. Every domain in MD-102 occupies part of that lifecycle.

The exam can therefore describe one business situation and make several domains relevant at once. A personally owned phone may need app protection without full device enrollment. A corporate Windows device may need Autopilot, Entra join, Intune enrollment, configuration profiles, Windows Hello for Business, compliance policy, Conditional Access, Defender integration, application delivery, update management, and monitoring. Choosing the right answer requires understanding which control belongs at which point in the lifecycle.

That is why a portal-first study method is fragile. Interfaces change, labels move, and wizards hide architecture. A stronger method is to ask five questions for every feature: what problem does it solve, what object or identity does it target, what prerequisites does it depend on, what evidence proves it worked, and what nearby feature solves a similar but different problem?

Domain 1: Prepare infrastructure for devices — 20–25%

This domain establishes trust and management before day-to-day administration begins. It combines Entra device identity, Intune enrollment, administrative delegation, compliance, and identity-linked endpoint controls. The exam is testing whether you can prepare an environment in which devices can be managed safely at scale.

Device identity: registered, joined, and the reason the distinction matters

A candidate should understand that device identity is not a cosmetic label. The way a device relates to Microsoft Entra ID affects ownership expectations, sign-in behavior, management options, and how access policy can evaluate the endpoint. You need to choose an appropriate join or registration model for the scenario rather than defaulting to the most familiar one.

Think operationally. A corporate Windows endpoint intended for centralized management has different requirements from a personally owned mobile device used only for work applications. A device that is registered for a user relationship is not equivalent to a device that is joined as an organizational endpoint. The exam may not ask you to recite definitions directly; it can describe ownership, user sign-in, provisioning, or compliance requirements and expect you to infer the correct identity state.

Dynamic device groups add another layer. The skill is not simply writing a membership rule. You should understand why grouping matters, how attributes drive policy targeting, and what happens when a device does not match the rule you expected. In production, a faulty rule can turn into a deployment or security incident because configuration, applications, or compliance may be assigned to the wrong population.

Enrollment: choose the method from ownership, platform, and scale

The July 2026 blueprint expands enrollment detail. You should know how Windows automatic enrollment works, but the role is explicitly multi-platform. macOS, iOS, iPadOS, and Android each have ownership and enrollment choices, and corporate programs such as Apple Business Manager, Samsung Knox Mobile Enrollment, and Android zero-touch can change how devices are brought under management.

The decision should start with the device and operating model. Is the device corporate owned or personal? Must the organization manage the entire device or only corporate applications and data? Is zero-touch deployment required? Is the device shared, dedicated, kiosk-like, or assigned to one person? Does enrollment need to be blocked for unsupported versions or personal ownership? Those constraints narrow the correct method before you ever open the Intune admin center.

Troubleshooting enrollment should follow dependencies. Verify licensing and scope, identity, enrollment restrictions, platform prerequisites, network access, enrollment profile assignment, and whether the device already has a conflicting management state. Randomly deleting and re-enrolling devices can hide the real cause and create repeat incidents.

For a deeper implementation treatment, the MD-102 Intune deployment guide is a useful companion when you want to move from the objective wording into deployment sequencing and operational checks.

Administrative scope, roles, and multi-admin control

MD-102 expects endpoint administrators to understand delegated administration. Built-in and custom roles, role assignments, and scope tags determine who can manage which resources. This matters in organizations where regional teams, service desks, contractors, or business-unit administrators should not automatically receive tenant-wide control.

A strong exam answer separates permissions from scope. A role can grant a capability, while scope determines where that capability applies. If an administrator can perform the correct action but cannot see or manage the target device, investigate both dimensions rather than assuming the role definition is wrong.

The current blueprint also includes multi-admin approval. The architectural idea is separation of duties for sensitive operations. When a scenario describes a need to prevent one administrator from unilaterally performing a high-impact action, think about approval workflow rather than only traditional RBAC.

Compliance and Conditional Access: state versus access decision

One of the most important distinctions in MD-102 is that compliance policy evaluates whether a device meets defined requirements, while Conditional Access uses signals such as compliance as part of an access decision. A compliance policy does not by itself protect every resource, and a Conditional Access policy does not configure the device into compliance.

Suppose an organization requires encryption, a minimum OS version, and no active high-risk condition before users access corporate applications. Intune compliance evaluates device state. Entra Conditional Access can then require that compliant state when granting access. If you troubleshoot only one side, you can miss the reason a user is blocked or allowed.

Build scenarios around this relationship. What happens if the compliance policy is assigned but the Conditional Access policy is not? What happens if Conditional Access requires compliant devices but a platform has no appropriate compliance policy? What grace period is intended? What does the user experience look like when remediation is possible? These questions teach architecture rather than menu navigation.

Windows Hello for Business, LAPS, and local-group control

The infrastructure domain also covers identity and privilege controls on endpoints. Windows Hello for Business should be understood as a strong authentication approach tied to organizational identity and device trust, not merely as a convenience feature. The important exam decisions involve deployment requirements, policy, and how it fits the sign-in model.

Windows Local Administrator Password Solution is about controlling local administrator credentials so that organizations do not rely on the same reusable password across devices. Know why password rotation, retrieval permissions, and recovery procedures matter. A scenario involving lateral-movement risk from shared local admin credentials should immediately suggest a managed local-password strategy.

Managing local-group membership through Intune similarly belongs to privilege governance. The objective is to make local administrative access deliberate and centrally controlled. You should be able to distinguish “who is allowed to administer this endpoint” from broader Entra directory roles or application access.

Domain 2: Manage and maintain devices — 25–30%

This is the largest current MD-102 area. It covers deployment, configuration, Intune Suite capabilities, remote actions, and the continuous maintenance work that keeps endpoints usable. The domain is broad because endpoint administration does not stop once a device appears in the console.

Windows Autopilot: choose a deployment model from the scenario

The current blueprint expects candidates to understand Windows Autopilot deployment profiles and newer device preparation policies, plus deployment modes such as user-driven, pre-provisioning, and self-deploying. Do not memorize the names without learning the scenario each one serves.

Start with who will interact with the device and when. A user-driven deployment assumes a user will authenticate and complete the flow. Pre-provisioning allows part of the work to happen before the device reaches the user, which can reduce user wait time and provide a better experience when applications or policies are substantial. Self-deploying scenarios fit devices that should configure without a traditional assigned-user flow, subject to platform and hardware requirements.

The Enrollment Status Page is another operational control point. It can block access to the desktop until required setup work completes. The exam may test whether you understand why a device appears “stuck,” how required applications or policies affect the experience, and when blocking is appropriate. A strict ESP can improve readiness but can also amplify a packaging or assignment error into a large deployment outage.

Device naming templates sound simple but matter at scale. Naming should support operations without embedding sensitive or unreliable information. If a naming convention depends on data not available at provisioning time, it is a design problem, not merely a syntax problem.

Windows 11 upgrades, Windows 365, and lifecycle planning

The domain extends beyond initial provisioning. You should understand how Intune can be used to plan Windows upgrades and how feature-update policy differs from ordinary quality-update behavior. Think about eligibility, compatibility, rollout rings, monitoring, and rollback rather than treating upgrades as one global switch.

Windows 365 introduces Cloud PCs as managed endpoints with provisioning policies, network choices, and image decisions. The exam can ask whether a scenario calls for a physical-device deployment approach or a Cloud PC design. The correct answer depends on user needs, network connectivity, identity, image management, and administrative model.

Windows Backup and Restore also appears in the current objective set. The relevant operational question is how user state and recovery fit the device lifecycle. A replacement process is not complete if policy re-enrolls the device but user data or settings cannot be restored as intended.

Configuration profiles: think desired state and conflict

Device configuration profiles are one of the most important Intune concepts. The exam expects Windows configuration, including Settings Catalog, imported ADMX settings, and Group Policy analytics, but also Android, iOS/iPadOS, macOS, and specialty devices.

The core skill is translating a requirement into the correct policy type and assignment scope. If the requirement is device configuration, use a configuration mechanism rather than trying to force an application or compliance policy to solve it. If a setting must differ by group, understand assignment design. If two profiles configure the same setting differently, investigate conflict rather than assuming the latest assignment wins.

Group Policy analytics matters during modern-management migration because it helps identify which existing on-premises settings have Intune equivalents and where redesign is required. Treat migration as policy rationalization, not one-to-one copying. Some legacy settings exist because of historical constraints that no longer apply.

Assignment filters and enrollment-time grouping add precision. The exam can give you a population that overlaps across groups but differs by platform, ownership, or device attribute. Filters can refine targeting without building an unmanageable group structure. As always, verification matters: know how to confirm effective assignment on the endpoint, not just the intended assignment in the portal.

This device enrollment and configuration deep dive is a useful follow-on when you want more scenario practice around the boundary between enrollment, configuration, and assignment behavior.

Intune Suite capabilities: know the problem each add-on solves

The current blueprint explicitly includes several Intune Suite capabilities. Endpoint Privilege Management is about enabling controlled elevation without permanently making users local administrators. In exam scenarios, distinguish a requirement for task-specific elevation from a requirement to grant ongoing admin rights.

The Enterprise App Catalog supports application management and packaging workflows. Remote Help provides support-oriented remote assistance under organizational control. Microsoft Cloud PKI addresses certificate issuance and lifecycle in a cloud-managed model. Microsoft Tunnel for Mobile Application Management enables protected connectivity for managed applications on devices that may not be fully enrolled. Advanced Analytics provides deeper endpoint insights, including anomaly and risk-oriented analysis.

Do not study these as marketing names. For each one, identify the operational pain point, licensing or prerequisite dependency, object being managed, and evidence of success. That approach makes scenario questions much easier because you can eliminate products that solve a different problem.

Remote actions and diagnostics: choose the least destructive action

Endpoint administrators routinely need to sync, restart, retire, wipe, collect diagnostics, rotate recovery material, update security intelligence, or perform actions across multiple devices. The exam may ask you to choose among actions that sound similar but have very different consequences.

Retire and wipe are a classic distinction. The correct choice depends on ownership, whether corporate data should be removed while preserving personal data, and whether the device is being reused or fully reset. A good administrator selects the smallest action that achieves the business goal.

BitLocker key rotation and local administrator password rotation similarly solve credential-recovery and exposure problems without requiring a full device reset. Device query using KQL and Intune troubleshooting data can help you collect evidence before taking disruptive action. This is a general MD-102 principle: diagnose first when the situation allows it.

Domain 3: Protect devices — 15–20%

Protection combines endpoint security policy with update management. The blueprint expects you to configure controls, understand their interactions, and keep endpoints current without causing unnecessary business disruption.

Antivirus, firewall, encryption, and attack-surface reduction

Microsoft Defender Antivirus policy is not just an on/off choice. Think about protection settings, scan behavior, exclusions, cloud-delivered protection, and how security operations monitor the result. A scenario that asks for standardized antivirus configuration across managed endpoints belongs in endpoint security policy, not a general configuration workaround.

Disk encryption requires more than enabling BitLocker. You should understand policy, recovery-key handling, escrow and rotation, user recovery, and compliance visibility. If encryption is required before resource access, remember the relationship between configuration, compliance state, and Conditional Access.

Firewall policy controls local endpoint traffic and can be centrally managed. Attack surface reduction policies reduce common behaviors attackers abuse. The exam may describe a security objective rather than name the feature, so learn the intent of each control. Blocking malicious behavior patterns is different from detecting post-compromise activity, and both are different from network perimeter filtering.

Security baselines package recommended configurations, but they are not a substitute for design. A baseline can accelerate standardization; it can also conflict with existing settings or operational requirements. Understand how to test, phase, monitor, and adjust rather than blindly assign tenant-wide.

Defender for Endpoint integration and EDR

MD-102 expects familiarity with integrating Intune and Microsoft Defender for Endpoint, onboarding devices, configuring endpoint detection and response policy, and responding to endpoint threats. The key architecture idea is that Intune manages endpoint policy while Defender contributes security telemetry and response capability. Their integration allows security signals to influence management decisions.

A candidate should understand the difference between preventive configuration and detection/response. Antivirus and ASR aim to prevent or reduce attack opportunities. EDR observes suspicious behavior, supports investigation, and can drive containment or remediation. In a scenario where a device is already showing indicators of compromise, merely changing a configuration profile may not be sufficient.

The current blueprint also includes App Control for Business. The important concept is application allow/control policy: deciding which code is trusted to run rather than only scanning files after execution. This is a stronger control but requires careful planning because an overly restrictive policy can block legitimate business software.

Updates: policy, deployment rings, and operational risk

Update management covers Windows update rings, feature updates, quality updates, Windows Autopatch, Hotpatch policy, and platform-specific updates for Apple and Android endpoints. The exam is testing whether you can balance security, stability, user impact, and supportability.

A good rollout uses rings or staged populations. Early groups provide signal before broad deployment. Feature updates usually require more planning than routine quality updates because compatibility and user experience can change more substantially. Monitoring is part of the deployment, not an afterthought.

Delivery Optimization matters when many Windows devices download content. The technical objective is to reduce unnecessary bandwidth use while keeping updates reliable. If a scenario involves branch bandwidth pressure, think beyond merely extending deadlines.

Cross-platform administration requires accepting that update mechanisms differ. The endpoint administrator’s responsibility is to implement policy using the supported control for each platform while maintaining a consistent security objective.

Domain 4: Manage and secure applications — 15–20%

Application management is one of the best places to test whether a candidate understands the difference between device management and data protection. MD-102 covers deployment, update behavior, Microsoft 365 Apps, platform stores, application protection, and app configuration.

Application deployment: package, target, detect, monitor

For Windows, know the differences among Win32 applications, line-of-business apps, Microsoft Store applications, and Microsoft 365 Apps deployment. Packaging is only the first step. A reliable deployment also needs requirements, detection logic, dependencies or supersedence where appropriate, assignments, and monitoring.

Detection rules deserve special attention. Intune needs a reliable way to determine whether the required application state exists. A weak detection rule can report success when the wrong version is installed or trigger repeated reinstall attempts. When troubleshooting, compare the installer behavior with the detection logic instead of assuming the package itself is always at fault.

Microsoft 365 Apps can be deployed and managed through Intune and related Microsoft 365 administration capabilities. Be able to reason about update channels, configuration, and how application deployment fits an Autopilot experience. If a large Microsoft 365 Apps install is required during ESP, for example, it can materially change provisioning time and failure risk.

Platform app stores add their own management flows, such as Apple volume-purchase mechanisms and managed Google Play. The operational principle is consistent: establish the organization relationship, make applications available to the management service, assign intentionally, and monitor outcome.

App protection versus app configuration

App protection policies protect organizational data inside applications, including scenarios where the device itself is not fully managed. This is central to bring-your-own-device strategies. Policies can control data transfer, require application-level protections, and help separate corporate data from personal use.

App configuration policies deliver application settings. They do not automatically provide the same data-protection guarantees as app protection. If the scenario asks how to preconfigure an app, think app configuration. If it asks how to stop corporate data from being copied into unmanaged personal applications, think app protection.

Conditional Access can be combined with app protection requirements. Again, separate evaluation from enforcement. The app policy defines protected behavior; Conditional Access controls whether access is granted under the required conditions.

This distinction is frequently where candidates overgeneralize “Intune manages the device.” In many modern-work scenarios, the organization intentionally does not manage the whole device. MD-102 expects you to recognize when application-level management is the correct boundary.

Domain 5: Optimize endpoint operations by using automation, monitoring, and reporting — 10–15%

This domain is new in the July 2026 blueprint and should not be treated as a minor appendix simply because its weighting is smaller. It formalizes what mature endpoint teams already do: automate repeatable work, monitor health, analyze performance, and use data to decide where intervention is needed.

PowerShell and Microsoft Graph: automate repeatable administration

Candidates should be able to reason about using PowerShell and Microsoft Graph for Intune management. The exam is unlikely to require memorizing an entire API surface, but you should understand why automation is appropriate and how to approach it safely.

A useful automation task has defined inputs, a predictable target set, error handling, logging, and idempotent behavior where possible. For example, reporting on device state is lower risk than bulk-changing configuration. When changes are required, validate scope before execution and provide a way to detect partial failure.

Graph-based automation becomes especially important at scale because not every operational need belongs in a portal workflow. You may need to inventory assignments, identify stale objects, compare policy state, export data, or enforce a repeatable administrative process. The underlying skill is translating a management question into structured data and controlled action.

The current objective set also includes extending device compliance with PowerShell. Think of custom compliance as a way to evaluate organization-specific conditions not represented by built-in checks. The script and policy must produce reliable signals; a fragile script can create false noncompliance and unexpected access problems.

Security Copilot agents: interpret recommendations, do not surrender judgment

The July 2026 objectives explicitly reference investigating threats identified by Security Copilot agents in Intune, analyzing device performance through agent capabilities, and reviewing recommendations. The exam implication is not that AI replaces the administrator. The administrator must understand the evidence, business context, and potential impact of acting on a recommendation.

A good decision workflow asks what data produced the recommendation, how confident the result is, which endpoints are affected, what change is proposed, and how success will be verified. An automated insight is an input to operations, not proof that a particular remediation is safe in every environment.

This is consistent with the rest of MD-102. Policy at scale creates leverage, and leverage increases the cost of mistakes. Human review, scoped deployment, monitoring, and rollback remain important.

Endpoint Analytics and proactive remediation

Endpoint Analytics turns user-experience and device-health data into operational signals. The blueprint calls out device health scores, app startup performance, and proactive insights. Candidates should understand how these metrics help find systemic issues that individual help-desk tickets might miss.

Proactive remediations pair detection and remediation scripts. The detection logic must correctly identify the unwanted state; the remediation must make a safe, repeatable correction; and the schedule determines how quickly drift is addressed. If detection is too broad, remediation can affect healthy devices. If remediation is not idempotent, repeated runs can create new problems.

This is an excellent lab area. Create a harmless condition, detect it with PowerShell, log the result, remediate it, and then prove that a second run makes no harmful change. That single exercise connects scripting, device state, monitoring, and operations.

Reporting, dashboards, and data visibility

Intune reporting can include built-in reports, filters, exported data, workbooks, dashboards, and deeper analysis. The exam expects you to use reporting to answer operational questions, not merely to know that a report exists.

Start with the question. Which devices are noncompliant and why? Which application deployment is failing? Which update ring is behind? Which enrollment method generates the most failures? Which devices show poor startup performance? Choose the report or dataset based on the question, then verify that scope and freshness are sufficient for the decision.

A dashboard should support action. If a metric has no owner, threshold, or response, it is not very useful operationally. Endpoint administrators need to connect visibility to remediation and trend analysis.

Cross-domain scenario 1: Corporate Windows laptops for remote employees

Imagine an organization is replacing 1,000 Windows laptops used by remote staff. Devices should arrive directly from the supplier, require minimal IT handling, join organizational identity, enroll into Intune, receive security policy and required applications, encrypt storage, require strong sign-in, and remain compliant before access to sensitive resources is allowed.

Domain 1 decisions include Entra join, automatic enrollment, compliance, Conditional Access, and Windows Hello for Business. Domain 2 covers Autopilot mode, Enrollment Status Page, device configuration, application sequencing, and remote actions. Domain 3 adds BitLocker, firewall, Defender policies, security baselines, and update rings. Domain 4 ensures required applications are deployed and protected. Domain 5 provides reporting, analytics, and remediation when provisioning or health issues appear at scale.

The exam may ask about only one step, but understanding the entire chain makes distractors easier to eliminate. For example, Conditional Access cannot compensate for a missing enrollment design, and an ESP cannot decide whether an unhealthy device should access SharePoint.

Cross-domain scenario 2: BYOD mobile access without full device management

A company allows employees to use personal iOS and Android devices for email and collaboration but does not want to enroll or manage the entire device. The business still needs to protect corporate data, require secure application behavior, and block access when the protected app conditions are not met.

The correct architecture centers on application protection and Conditional Access rather than corporate-device enrollment. App configuration may simplify settings, but it is not a replacement for data-protection policy. The device can remain personal while organizational applications and data are governed.

This scenario tests whether you understand management boundary. A candidate who assumes “Intune requirement means enroll the device” will choose controls that violate the business requirement.

Cross-domain scenario 3: A deployment is technically successful but users still fail access

Suppose devices are enrolled, profiles report success, and applications are installed, but users cannot access a protected resource. Do not immediately rebuild the devices. Trace the access decision.

Check identity and authentication, device registration/join state, compliance evaluation, Conditional Access result, licensing, policy targeting, and whether the device has recently synchronized. If the user is blocked because the device is noncompliant, identify the specific compliance reason. If the device is compliant but access still fails, inspect Conditional Access conditions and resource scope.

This scenario illustrates why MD-102 is not just configuration. The endpoint administrator must correlate device state with identity and access systems.

Cross-domain scenario 4: A security policy causes a business application outage

A new ASR rule, firewall policy, App Control policy, or security baseline can improve security while breaking an application. The correct response is not to disable security permanently. Determine the affected scope, collect evidence, identify the exact control interaction, and design the narrowest safe exception or application change.

Use phased deployment to reduce blast radius. Pilot security changes on representative devices, monitor Defender and application telemetry, and define rollback criteria. If a rule must be excluded, document the risk and review the exception rather than letting it become permanent technical debt.

The exam rewards this trade-off thinking because endpoint administration is fundamentally about balancing security and usability under policy.

Cross-domain scenario 5: Intune shows “success,” but the endpoint state is wrong

Portal status is important, but it is not infallible evidence of user outcome. A configuration can report assigned or even succeeded while another policy conflicts, the device has not applied the expected effective setting, or the application behaves differently than anticipated.

Build a habit of endpoint verification. Confirm local policy state, event or management logs, application version, security status, update state, and user experience. Then compare that evidence with service-side reporting. The difference between intended state, reported state, and observed state is often where troubleshooting begins.

Turn every objective verb into a lab action

The words Microsoft uses in the blueprint are study instructions. “Choose” means compare options and understand decision criteria. “Configure” means know prerequisites and resulting state. “Plan and implement” means understand sequencing, dependencies, and rollout. “Monitor” means know where evidence appears and what it tells you. “Troubleshoot” means distinguish likely causes from symptoms.

For Prepare infrastructure, build a small tenant lab with test users, groups, device identities, enrollment restrictions, compliance policy, and Conditional Access where licensing permits. For Manage and maintain, practice Autopilot concepts, configuration profiles, assignment logic, and remote actions. For Protect devices, configure a limited security policy and observe device evidence. For Applications, package or assign an app and validate detection. For Optimize operations, use PowerShell or Graph to read management data and create a harmless remediation exercise.

Do not try to simulate every enterprise feature if you lack licensing. The goal is to practice the decision model. You can still diagram the prerequisites, predict data flow, and explain how you would verify success.

Study priorities based on weighting and dependency

The domain percentages should influence time allocation but not rigidly dictate it. Manage and maintain devices is the largest area, yet it depends on infrastructure preparation. A candidate weak in enrollment and identity will struggle with Autopilot, compliance, and application scenarios even if they spend most of their time on the second domain.

A practical sequence is: identity and enrollment first; then configuration and deployment; then compliance and Conditional Access; then endpoint security; then applications; then updates, monitoring, and automation. Revisit the connections repeatedly rather than finishing a domain and never touching it again.

The new automation/monitoring area deserves dedicated study because older training materials may not reflect the July 2026 blueprint. If your course was recorded before that update, compare it directly with the current Microsoft study guide and add the missing objectives.

Common MD-102 reasoning traps

The first trap is confusing configuration with compliance. Configuration tries to create a desired setting. Compliance evaluates whether conditions are met. Conditional Access consumes signals to make an access decision. These layers interact but are not interchangeable.

The second trap is assuming full enrollment is always required. App protection allows important BYOD scenarios without managing the whole device. Read ownership and privacy requirements carefully.

The third trap is choosing the most destructive remote action. Wipe, retire, restart, sync, key rotation, and diagnostics solve different problems. Match the action to the business goal and preserve data when possible.

The fourth trap is thinking assignment equals effective state. Policy conflicts, prerequisites, filters, timing, and platform support can change the result. Always know how to validate on the endpoint.

The fifth trap is studying only Windows. Windows is important, but MD-102 explicitly includes Apple and Android enrollment, configuration, applications, and updates. Multi-platform scenarios are part of the role.

The sixth trap is ignoring operational scale. A setting that works for one test device can fail across thousands because of network bandwidth, app packaging, staged rollout, role scope, update timing, or reporting limitations. Look for words such as “at scale,” “remote workforce,” “multiple regions,” and “least privilege.” They often change the best answer.

The seventh trap is treating automation or AI output as automatically trustworthy. Scripts, Graph operations, proactive remediations, and agent recommendations require scope control and verification. Automation magnifies both good design and bad assumptions.

A blueprint-driven readiness checklist

For device infrastructure, you should be able to explain Entra device states, select an enrollment approach by platform and ownership, implement basic Intune enrollment controls, describe corporate enrollment integrations, delegate administration, design compliance policy, connect compliance to Conditional Access, and explain endpoint privilege controls such as Windows Hello for Business and LAPS.

For management and maintenance, you should be able to choose an Autopilot approach, explain ESP behavior, plan Windows upgrades, describe Windows 365 provisioning, build configuration-profile targeting, reason about conflicts and assignment filters, identify the purpose of Intune Suite capabilities, and select appropriate remote actions and diagnostics.

For protection, you should be able to distinguish antivirus, firewall, encryption, ASR, security baselines, EDR, and application control; describe Defender for Endpoint integration; and design a staged update approach across supported platforms.

For applications, you should be able to plan Win32 and Microsoft Store deployments, reason about application detection and dependencies, deploy Microsoft 365 Apps, work with platform stores, troubleshoot installation status, and clearly separate app configuration from app protection.

For operations optimization, you should be able to explain safe PowerShell/Graph automation, custom compliance, Security Copilot recommendations, Endpoint Analytics, proactive remediation, and how reporting turns endpoint state into operational decisions.

If any item can only be explained with “I know which portal blade contains it,” deepen your study. MD-102 rewards understanding of why a control exists and how it interacts with the rest of the endpoint lifecycle.

What each domain really requires

Prepare infrastructure for devices requires you to establish identity, enrollment, administrative boundaries, and trust signals. Manage and maintain devices requires you to deploy, configure, support, and operate endpoints at scale. Protect devices requires layered security and disciplined update management. Manage and secure applications requires reliable software delivery plus data protection across managed and unmanaged scenarios. Optimize endpoint operations requires you to use automation and telemetry without losing human judgment.

The strongest candidates connect those responsibilities. They can explain how a device moves from unknown hardware to a trusted managed endpoint, how policy turns requirements into state, how compliance influences access, how applications and security controls are delivered, how updates are staged, and how monitoring discovers drift or poor user experience.

That is the real MD-102 objective model. Learn the products, but organize them around lifecycle decisions, dependencies, evidence, and trade-offs. If you can reason from a business requirement to the correct control and then explain how you would verify and troubleshoot it, the blueprint stops feeling like a large feature list and starts looking like the endpoint-administration job it was designed to measure.