Microsoft MD-102: Managing and Securing Endpoints with Intune

MD-102, Managing and Securing Microsoft 365 Endpoints by using Intune, is a current role-based exam for endpoint administrators. Microsoft’s July 24, 2026 blueprint expanded the role beyond traditional device configuration: candidates now need to understand Microsoft Intune, Intune Suite, Windows Autopilot, Microsoft Defender for Endpoint, Microsoft Entra ID, Windows 365, PowerShell, Microsoft Graph, automation, monitoring, reporting, and newer agentic workflows.

The exam is part of the Microsoft 365 Endpoint Administrator Associate path. The current blueprint groups work into preparing device infrastructure, managing and maintaining devices, protecting devices, managing and securing applications, and optimizing endpoint operations through automation and analytics. That means a successful candidate must reason about the whole endpoint lifecycle rather than memorize Intune blades.

Build a small tenant lab with Windows and at least one mobile platform. Enroll devices, create dynamic groups, configure compliance and configuration profiles, deploy apps, test Conditional Access, onboard Defender for Endpoint, apply updates, and review reports. The best preparation comes from watching policies interact on real devices.

Identity establishes whether a device can become a trusted endpoint

MD-102 starts with Microsoft Entra device identity: registration, join types, group design, and enrollment prerequisites. These decisions determine which users and devices can enter management and how identity-based controls later evaluate them. A device that is visible in Entra ID is not automatically compliant, secure, or fully managed.

Enrollment should be designed around ownership, platform, and user experience

Windows automatic enrollment, Windows Autopilot, Apple enrollment, Android Enterprise, corporate-owned and personally owned scenarios, enrollment restrictions, and enrollment status behavior all appear in the endpoint administrator’s work. A company-owned Windows laptop and a personal mobile phone should not receive identical enrollment treatment.

Map each device population to an enrollment method, ownership model, expected apps, and required controls. Then test one Windows Autopilot flow from reset device to productive desktop. The Windows Autopilot configuration scenarios help reinforce how profile choices affect deployment experience.

Configuration profiles should express intent without creating policy conflict

Endpoint administrators manage settings through templates, Settings Catalog, administrative templates, security baselines, custom profiles, platform-specific controls, and sometimes imported Group Policy analysis. The technical challenge is not simply creating a profile; it is knowing which policy source is authoritative when several settings target the same device.

Create a small configuration baseline and deliberately introduce one conflict from another profile. Diagnose the resulting state rather than deleting policies until the warning disappears. The configuration-profile and Group Policy scenarios are valuable because conflict analysis is a real operational skill.

Compliance and Conditional Access turn device state into access decisions

Compliance policies evaluate conditions such as encryption, operating-system version, threat state, password configuration, or custom signals. Conditional Access can then require a compliant device for selected resources. The two services solve different problems: Intune evaluates endpoint posture, while Entra ID uses that result during access control.

Build a policy that marks an intentionally misconfigured device noncompliant, then require compliance for a test application. Trace the user experience from device setting to compliance result to access decision. The compliance and Conditional Access scenarios help connect those layers.

Application management must balance productivity with data protection

MD-102 includes app deployment, assignment, update behavior, Microsoft 365 Apps, Win32 packaging, Enterprise App Catalog, mobile application management, app protection, and app configuration. Some organizations manage the device; others protect corporate data inside applications on an otherwise personal device.

Deploy one required Windows application and create an app protection policy for a mobile productivity app. Test copy-and-paste, save locations, and sign-in behavior. This illustrates the difference between MDM and MAM more effectively than definitions. The MDM, MAM, and compliance relationship is central to modern endpoint design.

Endpoint security combines prevention, detection, and privileged-action control

The protection domain includes security baselines, antivirus, firewall, attack surface reduction, BitLocker, Defender for Endpoint onboarding, application control, local administrator management, and Intune Suite capabilities such as Endpoint Privilege Management. These features should work together rather than become overlapping policy fragments.

Create a device security profile, onboard the endpoint to Defender, trigger a safe test alert, and review the response path. Then test a standard user who needs one approved elevated action through privilege management instead of permanent local administrator rights. This is the practical meaning of least privilege at the endpoint.

Update management is a reliability discipline, not just patch deployment

Windows updates, feature upgrades, quality updates, driver management, Autopatch, hotpatch where applicable, update rings, mobile updates, and delivery optimization all affect security and user productivity. The administrator must balance speed of remediation against application compatibility and operational disruption.

Automation and analytics now have explicit weight in the exam

The July 2026 blueprint added a distinct domain for optimizing endpoint operations with automation, monitoring, and reporting. Endpoint Analytics, advanced analytics, Microsoft Graph, PowerShell, proactive remediation-style workflows, custom compliance, health reporting, and agentic tools can help administrators manage thousands of devices consistently.

Write or adapt a small script that collects a device condition and returns a clear state. Then use reporting to identify where the issue is concentrated before applying remediation. The PowerShell and Microsoft Graph scenarios reflect the shift from manual console work to scalable operations.

Preparation should end with a device that moves through the entire lifecycle

Take a fresh device from identity and enrollment through configuration, application deployment, compliance, access control, Defender onboarding, updates, analytics, remote actions, and eventual retirement or wipe. Record which service made each decision and what evidence you would inspect when the expected state does not appear.

The Intune deployment concepts and the MD-102 objective breakdown can support review, but hands-on diagnosis should dominate preparation.

If you can explain why a device is enrolled, why it received a policy, why it is compliant or not, why an app is available, why access is allowed, and which telemetry proves endpoint health, you are working at the level MD-102 expects. The exam increasingly measures endpoint operations as an integrated cloud-managed system.

Scope and assignment troubleshooting is a major practical skill because Intune policy behavior depends on groups, filters, applicability, exclusions, platform, enrollment state, and check-in timing. When a setting does not arrive, confirm that the device is the intended target before changing the policy. Review assignment evaluation, conflict information, and device status so that the fix addresses the real cause instead of broadening scope unnecessarily.

Remote actions should also be selected according to the incident. Sync, restart, retire, wipe, Fresh Start, Autopilot Reset, password or passcode actions, and other platform-specific operations have different consequences for user data, management state, and redeployment. Build a decision table for lost corporate devices, departing employees, troubleshooting, repurposing, and personally owned devices. The administrator should know which action restores a secure state with the least unnecessary disruption.

Windows 365 adds another endpoint type that changes the hardware boundary without removing management responsibilities. A Cloud PC still requires identity, policy, application, update, security, and user-experience management. Compare what is controlled through Intune with what belongs to provisioning policy or the cloud service. This prevents the mistake of treating virtual endpoints as exempt from the same governance applied to physical devices.

Reporting should lead to action. Review compliance trends, device health, application failures, update status, endpoint analytics, and Defender signals and choose one condition that deserves remediation. Define the threshold, owner, action, and evidence of success. Mature endpoint operations use reports to prioritize work rather than simply produce dashboards for administrators to inspect.

Finally, rehearse an incident that crosses services. A user cannot access a corporate application. The device is enrolled but marked noncompliant, Defender reports a security condition, and Conditional Access blocks sign-in. Trace the problem through Intune, Defender, and Entra ID in the correct order. This type of cross-service reasoning is exactly why MD-102 now emphasizes automation, analytics, and collaboration with identity and security administrators instead of treating endpoint management as isolated device configuration.

Certificate and credential-related scenarios also deserve attention. Wi-Fi, VPN, application access, Windows Hello for Business, Cloud PKI, and other endpoint controls may depend on certificates or strong authentication. When a connection fails, separate identity, certificate issuance, profile deployment, and network reachability instead of treating the entire symptom as an Intune problem.

Operational change control matters at scale. Before deploying a new baseline, app, update ring, or security setting to thousands of devices, validate the configuration on a representative pilot group and define rollback criteria. Use filters or staged assignments when appropriate. Endpoint administration becomes safer when every large change has an observable pilot, a measured impact, and a clear recovery decision.

Endpoint lifecycle planning should include retirement from the beginning. Decide what happens to corporate data, certificates, application access, device objects, and inventory records when a device is replaced, lost, sold, or returned. Test retire and wipe behavior on representative platforms and confirm that access is revoked even if the device never checks in again. A secure endpoint program is not complete when enrollment succeeds; it is complete when devices can also leave management predictably and without leaving stale trust behind.

As a final readiness test, choose an endpoint problem and solve it without beginning in the Intune portal. Start from the user symptom, identify the control plane likely responsible, gather evidence, and only then change configuration. This prevents console-driven troubleshooting and mirrors real administration, where the same symptom may originate in identity, policy, application packaging, security state, networking, update behavior, or device health.