MD-102 Exam: Endpoint Administrator Guide for India (2026)
MD-102, Managing and Securing Microsoft 365 Endpoints by using Intune, earns the Microsoft 365 Certified: Endpoint Administrator Associate certification. It is the natural next step for desktop and service desk engineers who want to manage laptops and phones at scale with Intune, Windows Autopilot and Defender for Endpoint. There is no prerequisite, 700 passes, and the English exam moves to a refreshed outline on 27 October 2026.
At a glance
- Exam: MD-102, Managing and Securing Microsoft 365 Endpoints by using Intune
- Certification: Endpoint Administrator Associate, renewed free every 12 months
- Outline: skills measured as of 27 October 2026, with minor changes across seven sub-areas
- Biggest area: manage and maintain devices, 25 to 30%
- Pass mark: 700
- Exam time: 100 minutes, as stated on the certification page
- Languages: English and six others; no Indian language
- Expert path: MS-102 and Microsoft 365 Administrator Expert retire on 30 November 2026
What MD-102 measures from 27 October 2026
The MD-102 study guide lists five skill areas. The weights below apply from 27 October.
| Skill area | Weight | What it covers |
|---|---|---|
| Prepare infrastructure for devices | 20 to 25% | Entra join, enrolment on every platform, compliance, Conditional Access, Windows LAPS |
| Manage and maintain devices | 25 to 30% | Autopilot, Windows 11 upgrades, Windows 365, configuration profiles, Intune Suite, remote actions |
| Protect devices | 15 to 20% | Antivirus, BitLocker, firewall, attack surface reduction, Defender for Endpoint, updates |
| Manage and secure applications | 15 to 20% | Win32 and Store apps, Microsoft 365 Apps, app protection and app configuration policies |
| Optimise endpoint operations | 10 to 15% | PowerShell and Microsoft Graph, Security Copilot agents, Endpoint Analytics, remediations |
Two things stand out. First, this is not a Windows-only exam. Android, iOS, iPadOS and macOS enrolment and configuration run through it, including Samsung Knox Mobile Enrollment and Google zero-touch enrollment for corporate Android phones. If your company hands Android devices to field or sales staff, those objectives are your daily work. Second, agents have arrived. You are expected to investigate threats and device performance findings raised by Security Copilot agents in Intune, and to decide what to do with their recommendations.
From service desk to endpoint administrator
The jump from support desk to endpoint admin is mostly a change of scale. You stop fixing one machine and start writing the policy that fixes every machine.
| Service desk habit | Endpoint admin equivalent | Exam area |
|---|---|---|
| Reimage a laptop from a USB stick | Windows Autopilot or Autopilot device preparation | Manage and maintain |
| Install software by hand | Package and deploy Win32 apps through Intune | Applications |
| Share one local admin password | Windows LAPS with password rotation | Prepare infrastructure |
| Chase users to restart for patches | Update rings, Windows Autopatch and hotpatch | Protect devices |
| Look up BitLocker keys in a spreadsheet | Escrow and rotate keys from Intune | Protect devices |
| Fix the same issue on every PC | Remediation scripts in Endpoint Analytics | Optimise |
| Remote in with a separate tool | Remote Help, an Intune Suite add-on | Manage and maintain |
Windows 10 reached end of support on 14 October 2025. Microsoft's Windows lifecycle FAQ says those PCs no longer get security updates unless they are enrolled in the paid Extended Security Updates programme. MD-102 covers planning Windows 11 upgrades with Intune, so if your organisation still has Windows 10 machines, upgrade planning is a practical way to apply the skill at work and talk about it in interviews.
Autopilot in 2026: two options, and the exam asks you to choose
The skills list asks you to choose between Windows Autopilot deployment profiles and Windows Autopilot device preparation policies. Microsoft's comparison page is the source for these differences:
| Requirement | Use |
|---|---|
| Microsoft Entra hybrid join | Windows Autopilot |
| Pre-provisioning or self-deploying kiosks | Windows Autopilot |
| Windows 10 devices, Teams Rooms or HoloLens | Windows Autopilot |
| No hardware hash upload before shipping | Device preparation |
| Win32 and line-of-business apps in one deployment | Device preparation |
| Near real-time deployment monitoring | Device preparation |
Device preparation supports Microsoft Entra join only and runs on Windows 11. It uses enrollment time grouping, adding the device to a security group during setup so apps and scripts arrive quickly. Classic Autopilot still uses the Enrollment Status Page, and you should be able to create and troubleshoot one. A common mistake is treating device preparation as a straight replacement. Microsoft says both will run side by side, and a device runs only one of them.
Build a home lab in 30 days
You do not need your employer's tenant to prepare.
- Intune trial. Microsoft's free trial runs for 30 days and creates a new tenant with an Enterprise Mobility and Security subscription, which includes Microsoft Entra ID P1 or P2 and Intune. The card you enter is used for verification and is not charged unless you buy something. Write your lab list before you sign up so no trial days are wasted.
- Windows 11 virtual machines. Run two or three on your laptop with a virtual TPM. Use them for Entra join, enrolment, both Autopilot options and remote actions.
- Your own phone. Test app protection policies for unmanaged devices. These protect work data inside apps such as Outlook without enrolling the phone, so your personal data stays untouched.
- Intune Suite add-ons. Endpoint Privilege Management, Enterprise App Catalog, Cloud PKI, Remote Help and Advanced Analytics are add-on capabilities, and your company tenant may not have them. Microsoft's advanced capabilities page describes a 90-day trial for each capability, for up to 250 users per tenant, started from Tenant administration and then Intune add-ons. Start these trials in the second half of your lab month so they do not run out before you reach them.
- Apple corporate enrolment. This needs Apple Business Manager, which most learners do not have. Read the documentation and walk through the Intune screens instead.
Automation with Microsoft Graph is a named skill. This PowerShell snippet lists devices by compliance state, a useful first script:
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"
Get-MgDeviceManagementManagedDevice -All |
Select-Object DeviceName, OperatingSystem, ComplianceState, LastSyncDateTime |
Sort-Object ComplianceState
A six-week plan
| Week | Focus |
|---|---|
| 1 | Trial tenant, users and groups, Entra join, enrolment restrictions, scope tags |
| 2 | Autopilot profiles and device preparation, Enrollment Status Page, Windows 11 upgrade policy |
| 3 | Configuration profiles, the Settings Catalog, ADMX import, assignment filters |
| 4 | BitLocker, Windows LAPS, attack surface reduction, Defender onboarding, update rings |
| 5 | Win32 packaging, Microsoft 365 Apps, app protection on your own phone |
| 6 | Graph PowerShell, remediations, reports, the free practice assessment and weak areas |
Book the exam with a personal Microsoft account rather than your employer's, so your certification history stays with you when you change jobs. Our guide to Microsoft exam costs in India explains how to check the current price.
What about MS-102 and the expert path?
MD-102 is one of the prerequisites for Microsoft 365 Certified: Administrator Expert, which also needs MS-102. Microsoft's exam retirement page lists MS-102 and that certification as retiring on 30 November 2026. Unless you can pass both exams in the next five weeks, treat MD-102 as a stand-alone goal. Microsoft's October 2026 partner announcements say the new Microsoft 365 Certified: AI Services Administrator Associate (AB-650) is being added to partner skilling requirements to address the MS-102 retirement.
From MD-102, a strong next step is information protection. Our SC-401 guide for India explains that path. If you are earlier in your career, read which Microsoft certification to take first as a fresher.
How CertTulen Academy can help
CertTulen Academy runs the MD-102 Endpoint Administrator course as live, MCT-led online classes with hands-on labs covering Intune, both Autopilot options, endpoint security and app management. Professional certification courses include an exam voucher, mock practice tests and lab access; the course page has the details, with prices in INR and UPI, card or netbanking checkout. For IT support teams we run private corporate cohorts. Contact us or WhatsApp +91 93618 83583 for a batch that suits your time zone.
Frequently Asked Questions
Is MD-102 suitable for freshers in India?+
It is possible, but it is not a beginner exam. Microsoft expects experience with Microsoft Entra ID, Microsoft 365 and Intune, plus deploying and maintaining Windows and non-Windows devices. A fresher can close part of that gap with an Intune trial tenant and Windows 11 virtual machines, but the scenarios are far easier to answer after some hands-on time on a service desk or desktop support team.
Is MD-102 retiring along with MS-102?+
No. As of 25 October 2026, Microsoft's exam retirement page lists only MS-102 and the Microsoft 365 Administrator Expert certification, retiring on 30 November 2026. MD-102 has no retirement date listed, and Microsoft is refreshing its outline on 27 October 2026, so the Endpoint Administrator Associate certification continues for now.
Can I prepare for MD-102 without access to a company tenant?+
Yes. The Microsoft Intune free trial runs for 30 days and creates a new tenant that includes Microsoft Entra ID P1 or P2 and Intune. Pair it with Windows 11 virtual machines and your own phone for app protection policies. Plan your labs before you sign up so the trial covers enrolment, Autopilot, security, apps and reporting.
How long is the MD-102 exam and what score do I need?+
The certification page gives 100 minutes for the assessment, and you need a score of 700 or more to pass. Microsoft does not publish which exams contain labs, so check the time shown when you book. You can open Microsoft Learn during role-based exams, but the clock keeps running while you read.
Should I take MD-102 or AZ-104?+
Choose by the work you do or want. MD-102 is about the devices people use every day: laptops, phones, apps, updates and endpoint security, managed through Intune. AZ-104 is about Azure infrastructure: virtual machines, networks, storage and identity in the cloud. Service desk and desktop engineers usually find MD-102 the closer fit.
Sources
- Study guide for Exam MD-102: Managing and Securing Microsoft 365 Endpoints by using Intune
- Microsoft 365 Certified: Endpoint Administrator Associate
- Compare Windows Autopilot device preparation and Windows Autopilot
- Step 1 - Sign up for a free trial and configure a Microsoft Intune tenant
- Lifecycle FAQ - Windows
- Exam and assessment lab retirement
- October 2026 announcements
- Microsoft Intune advanced capabilities
Checked on 25 October 2026. Exams, products and rules change, so confirm on the official page before you book or decide.
Written by
Microsoft Certified Trainer (MCT), founder of CertTulen Academy
CertTulen Academy · Microsoft Training Services Partner · Microsoft AI Cloud Partner

