MD-102 Endpoint Administrator Study Guide: Intune and Autopilot Labs

MD-102 is the single exam for the Microsoft 365 Certified: Endpoint Administrator Associate certification, and you pass it by practising endpoint management in a real Microsoft Intune tenant against the five weighted domains in Microsoft's skills outline: prepare infrastructure for devices (20-25%), manage and maintain devices (25-30%), protect devices (15-20%), manage and secure applications (15-20%) and optimize endpoint operations through automation, monitoring and reporting (10-15%). This guide follows the outline labelled "Skills measured as of October 27, 2026".

Who this is for and what you will have at the end

This guide is for desktop and endpoint administrators moving from Configuration Manager or Group Policy to cloud management, for help-desk staff stepping into administration, and for anyone who passed the earlier exam and wants to see what changed. You will finish with an objective checklist, a four-week plan and a set of labs you can build in a test tenant.

Microsoft's audience profile says the candidate manages devices and client applications in a Microsoft 365 tenant by using Microsoft Intune and agentic tools and workflows, and works with the Intune Suite, Windows Autopilot, Microsoft Defender for Endpoint, Microsoft Entra ID, PowerShell, Microsoft Graph and Windows 365.

Exam facts to confirm first

The change log in the study guide marks the October 27, 2026 revisions as minor within the Enroll devices, Deploy and upgrade Windows clients, Plan and implement device configuration profiles, Intune Suite add-ons, Perform remote actions, Deploy and update apps, and Monitor and optimize health objectives. It also renames "Manage applications" to "Manage and secure applications". Because the update lands two days after this article's date, treat the published outline as the one to study, and confirm the date again on the exam page when you book.

Skills measured, domain by domain

Prepare infrastructure for devices (20-25%)

• Add devices to Microsoft Entra ID. Choose a join type, join and register devices, and plan device groups including dynamic membership rules.
• Enroll devices to Intune. Enrollment settings, automatic enrollment for Windows, personal enrollment for macOS, iOS and iPadOS, Android enrollment profiles (fully managed, dedicated, corporate-owned with work profile), enrollment restrictions and troubleshooting, Apple Business Manager integration, and Samsung Knox Mobile Enrollment or Google zero-touch enrollment.
• Implement identity and compliance. Built-in and custom roles for Intune and Windows 365, scope tags, multi-admin approval, compliance policies for all platforms, Conditional Access that requires compliance, Windows Hello for Business, Windows LAPS, and local group membership.

Manage and maintain devices (25-30%)

• Deploy and upgrade Windows clients. Autopilot deployment profiles versus device preparation policies, the three deployment modes, device name templates, the Enrollment Status Page, Windows 11 upgrades through Intune, Windows 365 Cloud PC provisioning, and Windows Backup.
• Device configuration profiles. Windows profiles including importing ADMX files and Group Policy analytics, Android, iOS/iPadOS, macOS, specialty devices such as Microsoft Teams Rooms, HoloLens 2 and Zebra, and targeting with assignment filters and enrollment time grouping.
• Intune Suite add-ons. Endpoint Privilege Management, the Enterprise App Catalog, Remote Help, Cloud PKI, Microsoft Tunnel for Mobile Application Management and Intune Advanced Analytics.
• Remote actions. Sync, restart, retire and wipe, bulk actions, Defender Antivirus intelligence updates, rotating BitLocker recovery keys and local administrator passwords, device queries using KQL, and collecting diagnostics.

Protect devices (15-20%)

• Endpoint security. Antivirus, disk encryption (including BitLocker recovery keys and self-service recovery), firewall, attack surface reduction, security baselines, Defender for Endpoint integration and onboarding, and App Control for Business.
• Device updates. Update planning, update rings, feature and quality updates, Windows Autopatch and Hotpatch policies, Apple update policies through the settings catalog, Android updates, Delivery Optimization and monitoring.

Manage and secure applications (15-20%)

• Deploy and update apps. Win32, line-of-business and Microsoft Store apps, Quiet Time policies, Microsoft 365 Apps deployment and policy, deployment during Autopilot, store-based apps through Apple Business Manager and managed Google Play, and troubleshooting installation failures.
• App protection and configuration. App protection policies for managed and BYOD devices, Conditional Access for app protection, and app configuration policies.

Optimize endpoint operations (10-15%)

• Automate. PowerShell and Microsoft Graph, Security Copilot agents in Intune for investigation and performance analysis, and extending compliance with PowerShell.
• Monitor and optimize health. Reports and workbooks, Endpoint analytics including remediations and scores, remediation scripts, tenant health and service communications, and alerts for compliance drift, enrollment failures and configuration conflicts.

A four-week study plan

Labs worth building

Use a test or trial tenant, never production, and keep a Windows 11 virtual machine you can reset. Check the licence requirements for each feature in its documentation, because some objectives, such as the Intune Suite add-ons, need separate licensing that this guide does not quote.

1. Enrollment and join. Join a virtual machine to Microsoft Entra ID, confirm it appears in Intune, then try registering a second device so you understand the difference. Review enrollment restrictions and what happens when a device is blocked.
2. Compliance and Conditional Access. Create a Windows compliance policy, assign it to a dynamic group, and create a Conditional Access policy requiring a compliant device. Test with a compliant and a non-compliant machine, using report-only mode first.
3. Autopilot comparison. Build a classic deployment profile and a device preparation policy, then note which settings each exposes, including device name templates and the Enrollment Status Page. See the site's Autopilot device preparation vs classic guide for a worked comparison and Intune Windows Autopilot deployment for the end-to-end flow.
4. Configuration and ADMX. Create a settings catalog profile, import a third-party ADMX file, and run Group Policy analytics against an exported policy.
5. Security stack. Create antivirus, firewall and BitLocker policies, then onboard the device to Defender for Endpoint. Our guides on Defender for Endpoint onboarding through Intune, silent BitLocker encryption and Windows LAPS cover three of these objectives.
6. Updates. Build an update ring and a feature update policy, then read the monitoring reports. See update rings and Hotpatch for the Hotpatch material the new outline names.
7. Apps. Package and deploy a Win32 app with a detection rule, deploy Microsoft 365 Apps, then create an app protection policy for a mobile platform. The site's Win32 packaging guide shows the detection-rule work.
8. Remote actions and queries. Run sync, restart, rotate local administrator password, rotate the BitLocker key, collect diagnostics and a device query using KQL.
9. Automation. Read a few Intune objects through Microsoft Graph PowerShell, then open Endpoint analytics and review remediation scripts.

Troubleshooting your preparation

• A feature is greyed out or missing. Read its documentation for licence and prerequisites. Learn what the feature does and where it sits even if you cannot enable it.
• You keep mixing up registered and joined. Make a table of join types and when each applies. The outline names the choice explicitly.
• Autopilot items feel like trivia. Run both Autopilot approaches once. Questions are about choosing between them for a scenario.
• Your notes mention Configuration Manager heavily. The October 2026 outline is built around Intune, Autopilot, Defender for Endpoint, Windows 365 and agentic tooling, so rebalance toward those.

Final checklist before you book

• Every line of the outline has a lab or a note.
• You have used the free practice assessment and the exam sandbox.
• You have confirmed the exam date, language, price and the October 27, 2026 update on the exam page.
• You know how to renew, since the certification expires after 12 months unless renewed.

References

• Study guide for Exam MD-102: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/md-102
• Microsoft 365 Certified: Endpoint Administrator Associate: https://learn.microsoft.com/en-us/credentials/certifications/modern-desktop/
• Microsoft Intune documentation (listed in the study guide): https://learn.microsoft.com/en-us/mem/intune/
• Windows Autopilot documentation (listed in the study guide): https://learn.microsoft.com/en-us/mem/autopilot/