MD-102 Endpoint Administrator QA Tests 2026

Are you ready to prepare for the Microsoft 365 Certified Endpoint Administrator Associate Exam ?As a candidate for this exam, you have subject matter expertise managing devices and client applications in a Microsoft 365 tenant by using Microsoft Intune and agentic tools and workflows. You’re responsible for:Implementing solutions for efficient deployment and management of endpoints on various platforms and device typesImplementing and managing endpoints at scale by using Microsoft Intune, Microsoft Intune Suite, Windows Autopilot, Microsoft Defender for Endpoint, Microsoft Entra ID, PowerShell, Microsoft Graph, and Windows 365Implementing identity, security, access, policies, updates, and apps for endpointsOptimizing endpoint operations through automation, monitoring, and reportingAs an endpoint administrator, you collaborate with architects, Microsoft 365 administrators, security administrators, and other workload administrators to plan and implement a modern workplace strategy that meets the business needs of an organization.You must have experience with Microsoft Entra ID and Microsoft 365 technologies, including Intune, as well as strong skills and experience in deploying, configuring, and maintaining Windows client and non-Windows devices. You should also have an understanding of Microsoft Security Copilot, Intune agents, and Microsoft Defender XDR.MD-102 Endpoint Administrator Exam Topics -Prepare infrastructure for devices (20–25%)Manage and maintain devices (25–30%)Protect devices (15–20%)Manage and secure applications (15–20%)Optimize endpoint operations by using automation, monitoring, and reporting (10–15%)Prepare infrastructure for devices (20–25%)Add devices to Microsoft Entra IDChoose an appropriate device join type, including considerations such as device registration and Microsoft Entra joinJoin devices to Microsoft Entra IDRegister devices to Microsoft Entra IDPlan and implement groups for devices in Microsoft Entra ID, including dynamic group membership rulesEnroll devices to Microsoft IntuneConfigure enrollment settings in Microsoft IntuneConfigure automatic enrollment for WindowsConfigure personal enrollment for macOS, iOS, iPadOSConfigure enrollment profiles for Android devices, including fully managed, dedicated, corporate owned, work profile, enrollment restrictions and troubleshooting enrollment failuresConfigure corporate enrollment for macOS and iOS devices by integrating Intune with Apple Business ManagerConfigure enrollment for Android devices by integrating Intune with Samsung Knox Mobile Enrollment or Google Zero TouchImplement identity and complianceManage built-in and custom roles for Intune and Windows 365, including role assignmentsConfigure scope tags and scoped administration for multi-admin environmentsImplement and manage multi-admin approvalImplement compliance policies for all supported device platforms by using IntuneImplement Microsoft Entra Conditional Access policies that require a compliance statusConfigure Windows Hello for Business by using IntuneImplement and manage Windows Local Administrator Password Solution (Windows LAPS) by using Microsoft Intune and Microsoft Entra IDManage the membership of local groups on Windows devices by using IntuneManage and maintain devices (25–30%)Deploy and upgrade Windows clients by using cloud-based toolsChoose between Windows Autopilot deployment profiles and device preparation policiesChoose between Windows Autopilot deployment modes, including user-driven, pre-provisioning, and self-deployingApply a device name template by using Windows AutopilotImplement Windows client deployment by using Windows AutopilotCreate an Enrollment Status Page (ESP)Plan and implement device upgrades for Windows 11 by using IntuneProvision and configure Windows 365 Cloud PCs by using Intune, including provisioning policies, network connections, and image managementImplement Windows Backup and Restore by using IntunePlan and implement device configuration profilesCreate device configuration profiles for Windows devices, including importing ADMX files and using Group Policy analyticsCreate device configuration profiles for Android devicesCreate device configuration profiles for iOS/iPadOS devicesCreate device configuration profiles for macOS devicesCreate device configuration profiles for specialty devices, including Teams Rooms, HoloLens 2, and ZebraTarget a profile by using assignment filters and enrollment time groupingImplement Intune Suite add-on capabilitiesConfigure Endpoint Privilege Management including configuring elevation policies, monitoring elevated actions, and adjusting EPM settingsManage applications by using the Enterprise App CatalogConfigure Microsoft Intune Remote HelpPlan and implement Microsoft Cloud PKI, including setting up cloud-based PKI, automating certificate issuance, and monitoring certificate healthImplement Microsoft Tunnel for Mobile Application Management, including configuring Tunnel Gateway, extending support to MAM devices, and monitoring tunnel connectionsImplement Microsoft Intune Advanced Analytics, including anomaly detection, proactive insights, and risk-based policy recommendationsPerform remote actions on devicesSync, restart, retire, or wipe devicesPerform bulk remote actionsUpdate Microsoft Defender Antivirus security intelligenceRotate BitLocker recovery keysRotate locate administrator passwordsRun a device query by using KQLCollect device diagnostics and logs by using Microsoft Intune, including using the Troubleshooting blade for user-based diagnosticsProtect devices (15–20%)Configure endpoint securityCreate antivirus policies by using Microsoft IntuneCreate and manage disk encryption policies by using Microsoft Intune, including managing BitLocker recovery keys, configuring user self-service recovery, and monitoring encryption compliance statusCreate firewall policies by using Microsoft IntuneConfigure Attack surface reduction policies by using Microsoft Intune, including applying Zero Trust principles for endpoint protectionPlan and implement security baselines by using Microsoft IntuneIntegrate Intune with Microsoft Defender for Endpoint, including configuring Endpoint Detection and Response (EDR) policies, investigating endpoint threats, and triaging incidentsOnboard devices into Microsoft Defender for EndpointConfigure App Control for Business policies by using Microsoft IntuneManage device updatesPlan for device updates by using IntuneCreate and manage update rings, feature updates, and quality updates for Windows devices by using IntuneImplement Windows Autopatch and configure Hotpatch policiesCreate and manage update policies for iOS/iPadOS and macOS devices by using the Settings Catalog in Microsoft IntuneManage Android updates by using configuration profiles or firmware-over-the-air (FOTA) deploymentsConfigure Windows client Delivery Optimization by using IntuneMonitor device updates by using IntuneManage and secure applications (15–20%)Deploy and update appsPrepare applications for deployment by using IntuneDeploy apps by using Intune, including Win32 apps, line-of-business (LOB) apps, and Microsoft Store appsConfigure Quiet Time policies for Android and iOS appsDeploy Microsoft 365 Apps by using IntuneConfigure policies for Office apps by using Microsoft Intune or the Microsoft 365 Apps admin centerDeploy Microsoft 365 Apps as part of a Windows Autopilot deployment, including using the Office Deployment Tool (ODT) or Microsoft IntuneManage Microsoft 365 Apps by using the Microsoft 365 Apps admin centerDeploy apps from platform-specific app stores by using Intune, including Apple Volume Purchase Program and Google PlayMonitor app deployment status and troubleshoot installation failures by using Microsoft IntunePlan and implement app protection and app configuration policiesPlan and implement app protection policies for managed and unmanaged (BYOD) devices by using Microsoft IntuneImplement Microsoft Entra Conditional Access policies for app protection policiesPlan and implement app configuration policies for managed apps and managed devicesOptimize endpoint operations by using automation, monitoring, and reporting (10–15%)Automate management tasksAutomate Intune management tasks by using PowerShell and Microsoft GraphInvestigate threats identified by Security Copilot agents in IntuneAnalyze device performance by using Security Copilot agents in IntuneReview and respond to Security Copilot agent recommendations to make management decisionsExtend device compliance by using PowerShellMonitor and optimize healthImplement reporting and data visibility in Microsoft Intune, including customizing reports and filters, using workbooks and dashboards, and exporting reporting dataMonitor endpoint performance by using Endpoint Analytics, including proactive remediations, device health scores, and app startup performanceConfigure and manage proactive remediation scripts, including detecting and fixing common device issues, and scheduling remediation runsAnalyze endpoint reliability and user experience scores, including startup performance, restart frequency, and application reliability metricsMonitor tenant health and Intune service communications, including reviewing service health dashboards, message center notifications, and establishing operational baselinesConfigure alerts and notifications for policy and compliance changes, including setting up alert rules for compliance drift, enrollment failures, and configuration conflicts