EnglishDeutschFrançaisEspañolPortuguês

Microsoft · MD-102 · Associate

Microsoft 365 Endpoint Administrator (MD-102) — Practice Questions and Mock Exam

The MD-102 certification validates skills in deploying, configuring, and managing modern Windows client devices and applications using Microsoft Intune and related services.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing MD-102 freeBuy MD-102 access for $29.99
50Questions per Pass-IT mock exam
100minPass-IT mock exam time limit

Official MD-102 exam: 700 out of 1000 points to pass.

Checked against Microsoft · August 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a MD-102 sample question and read the explanation with its source. Right here, with no sign-up.

Prepare infrastructure for devices1 / 5

You are reviewing the Microsoft Intune admin center. You need to find where to configure automatic MDM enrollment for Windows devices joined to Microsoft Entra ID. Identify the correct location for MDM auto-enrollment settings.

AlexFull explanation from Alex

Automatic MDM enrollment enrolls Windows devices into Intune when eligible users join or register devices with Microsoft Entra ID. In the Intune admin center, use Devices > Device onboarding > Enrollment > Windows > Automatic Enrollment, then configure MDM user scope as None, Some, or All. This requires Microsoft Entra ID P1 or P2. Exam tip: use the current Intune path when the stem asks for the Intune admin center; Microsoft Entra Mobility is an alternate portal path, not the requested location.

Sourcelearn.microsoft.com

Optimize endpoint operations by using automation, monitoring, and reporting2 / 5

PowerShell scripts deployed through Intune automatically re-execute every time the Intune Management Extension checks in.

AlexFull explanation from Alex

False. PowerShell scripts deployed through Intune run once per device by default and do not re-execute on subsequent IME check-ins. Per Microsoft docs: "once the script executes, it doesn't execute again unless there's a change in the script or policy." To force re-execution, modify the script content (changing its hash) or reset execution tracking. The IME checks for new or changed scripts after each reboot, but previously successful scripts are skipped. True is incorrect — scripts are not re-run at every sync. This is a common misconception tested on the exam.

Sourcelearn.microsoft.com

Manage and secure applications3 / 5

You need to configure Intune to automatically install the Company Portal app on Windows devices enrolled through Autopilot. How should you deploy the Company Portal?

AlexFull explanation from Alex

The Company Portal must be explicitly deployed as a Required Microsoft Store app to Autopilot-enrolled devices — it is NOT auto-installed during Autopilot enrollment. In the Intune admin center, create a Microsoft Store app (new) for Company Portal, set Install behavior to System (device context), and assign it as Required to your Autopilot device group. This ensures it installs before user sign-in. Including it in ESP required apps (the option “Include the Company Portal in the Enrollment Status Page…”) only gates ESP completion but doesn't deploy it. PowerShell scripts (the option “Deploy the Company Portal via a PowerShell script”) are unreliable for store apps. Ref: learn.microsoft.com/intune/app-management/deployment/add-company-portal-autopilot

Sourcelearn.microsoft.com

Manage and maintain devices4 / 5

A Windows device restrictions profile is assigned to the All devices group. The profile must apply to corporate-owned devices and not to personal devices. The targeting must take effect when the devices check in, without waiting for group membership to be evaluated. What should you add to the assignment?

AlexFull explanation from Alex

Assignment filters narrow an existing assignment by device properties such as OS version, manufacturer, model, category, or ownership. You attach a filter to the assignment in Include or Exclude mode, and Intune evaluates it when the device enrolls or checks in. Because filters do not depend on group membership processing, they avoid the delay that dynamic groups can introduce. Dynamic groups are still useful for cross-workload targeting such as Conditional Access or licensing. Scope tags control which admins can see objects, and a device category is just a property you would still need to target. Exam tip: targeting Intune workloads by a device property with no group evaluation delay is the use case Microsoft gives for assignment filters.

Sourcelearn.microsoft.com

Protect devices5 / 5

Your kiosk devices run Windows 11 Enterprise LTSC and are enrolled in Microsoft Intune. You need Intune to control quality update deferrals and restart deadlines on these kiosks. Which type of policy should you use?

AlexFull explanation from Alex

Intune splits Windows update management across several policy types. Update rings set client behavior such as quality and feature deferrals, deadlines, grace periods, and restart experience. Feature update policies pin or move devices to a specific Windows version, and Microsoft lists Windows Enterprise LTSC as not supported for them, with update rings as the alternative. Driver update policies approve driver and firmware updates. Compliance policies can report on a minimum OS version, but they do not install updates. For LTSC kiosks that need quality update deferrals and restart deadlines, update rings are the fit. Exam tip: LTSC in the scenario rules out feature update policies.

Sourcelearn.microsoft.com

How to prepare for MD-102 with Pass-IT.

Currently 401 practice questions for MD-102, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · MD-102

Intune script execution

  1. You

    Does my PowerShell script run at every Intune check-in?

  2. Alex · AI tutor

    No. A successfully executed script does not rerun simply because the extension checks in again.

    Read the Microsoft documentation ↗
  3. You

    What distinction matters in the question?

  4. Alex · AI tutor

    A check-in is not the same as a scheduled script execution. Do not assume every check-in repeats the script.

    Read the Microsoft documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

MD-102 · Question excerpt

Intune script execution

View the full question

PowerShell scripts deployed through Intune automatically re-execute every time the Intune Management Extension checks in.

Understand the correct answer.

False

Intune PowerShell scripts are not automatically rerun on every extension check-in.

Read the Microsoft documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your MD-102 mock exam

Questions
50
Minutes
100

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for MD-102.

Exam topics, relevant practice and sources you can check.

Device identity and enrollment20–25% of the exam62 QuestionsPass-IT questions

Prepare device identities, enrollment and access controls for Intune management.

  • Choose device registration or Entra join, add devices and organize them with device groups and dynamic membership rules.
  • Configure personal and corporate enrollment for Windows, Apple and Android devices, including platform integrations, enrollment profiles, restrictions and failure diagnosis.
  • Configure Intune and Windows 365 roles, scope tags and multi-admin approval; enforce compliance and Conditional Access, Windows Hello, LAPS and local group membership.
Official Microsoft objectives
Deployment, configuration and remote actions25–30% of the exam147 QuestionsPass-IT questions

Deploy and configure devices and use Intune tools to maintain them remotely.

  • Choose Autopilot profiles, preparation policies and deployment modes, configure device naming and enrollment status, upgrade Windows, provision Cloud PCs and configure Windows backup and restore.
  • Create configuration profiles for Windows, Android, Apple and specialty devices, use ADMX and Group Policy analytics and target profiles with filters and enrollment-time groups.
  • Configure Intune Suite privilege elevation, Enterprise App Catalog, Remote Help, Cloud PKI certificates, Tunnel for mobile app management and Advanced Analytics.
  • Run individual or bulk remote actions, update antivirus intelligence, rotate recovery keys and administrator passwords, query devices with KQL and collect diagnostics and logs.
Official Microsoft objectives
Endpoint protection and updates15–20% of the exam97 QuestionsPass-IT questions

Apply endpoint security policies and keep operating systems updated.

  • Configure antivirus, encryption and recovery keys, firewall, attack surface reduction, security baselines and App Control for Business policies.
  • Integrate Defender for Endpoint, onboard devices, configure detection and response policies and investigate threats and incidents.
  • Plan and monitor Windows, Apple and Android updates; configure update rings, feature and quality updates, Autopatch, Hotpatch and Delivery Optimization.
Official Microsoft objectives
Application deployment and protection15–20% of the exam70 QuestionsPass-IT questions

Distribute apps and control how corporate data is used on managed and personal devices.

  • Prepare and deploy Win32, business and store apps, set Quiet Time policies and monitor and troubleshoot installations.
  • Deploy Microsoft 365 Apps through Intune or Autopilot and manage Office settings and updates through the relevant admin tools.
  • Configure app protection for managed and personal devices, require it through Conditional Access and apply app configuration policies.
Official Microsoft objectives
Automation and operational health10–15% of the exam25 QuestionsPass-IT questions

Automate administration and use reports and diagnostics to improve device health.

  • Automate Intune and compliance checks with PowerShell and Microsoft Graph, investigate Security Copilot findings and act on its management recommendations.
  • Customize reports, exports and dashboards, analyze endpoint performance and reliability and schedule remediation scripts for detected device issues.
  • Monitor tenant and service health, establish baselines and configure alerts for compliance drift, enrollment failures and policy conflicts.
Official Microsoft objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.
Drag & Drop
Match items to the appropriate targets.
Ordering
Put steps in the correct order.
Dropdown
Choose the appropriate entry from a dropdown list.

These are Pass-IT practice formats. Check the Microsoft certification page for the official exam information.

The ranges describe the weighting of exam topics. See Official Microsoft objectives for the current exam objectives.

Frequently asked questions

Your preparation

How much study time should I plan for MD-102?

For planning, Pass-IT estimates roughly 30–75 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam.

How long does my MD-102 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the MD-102 exam

Where can I take the MD-102 exam?

Pearson VUE online proctored or at authorized testing centers worldwide.

How long is the Microsoft 365 Endpoint Administrator exam?

The MD-102 exam has 50 questions and a 100-minute time limit.

Is MD-102 the Intune certification?

In practice, yes. Microsoft does not publish an exam called "Intune certification", and MD-102 is the one that tests Intune device management, compliance policies, app protection and Autopilot. If you are looking for a credential covering endpoint management, this is it.

How often do you renew MD-102?

Every year. Microsoft renews it through a free online assessment on Microsoft Learn that opens six months before expiry, so you do not resit the full exam.

What happens if you fail MD-102?

A retake is available after 24 hours. Each further attempt needs a 14-day wait, capped at five attempts in any 12-month window.

Your preparation for MD-102

$29.99one-time

12 months of access for MD-102 · No automatic renewal

Buy MD-102 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →