Microsoft MD-102 Cheat Sheet: Endpoint Administrator

May 1, 2026

Review the Microsoft Endpoint Administrator (MD-102) scope, Microsoft Intune, enrollment, compliance, Autopilot, app deployment, endpoint security, updates, and troubleshooting traps before practicing.

On this page

MD-102 is an endpoint-management exam. Use this cheat sheet to separate enrollment, configuration, compliance, application delivery, security baselines, updates, and troubleshooting before practicing.

Use this with practice. Review the endpoint-management checkpoints, then return to the MD-102 exam page for sample questions and update tracking.

Open MD-102 practice page Compare Microsoft 365 routes

Exam snapshot

Field	Detail
Issuer	Microsoft
Certification lane	Microsoft Endpoint Administrator
Exam code	MD-102
Main scope	Endpoint deployment, Intune management, compliance, application deployment, security, updates, and troubleshooting
IT Mastery status	Sample questions available

Endpoint map

Area	What to know	Common trap
Enrollment and identity	Microsoft Entra join, hybrid join, Intune enrollment, device ownership, and enrollment restrictions	Troubleshooting policy before confirming enrollment state
Windows Autopilot	Deployment profiles, device registration, user-driven setup, reset, and provisioning	Treating Autopilot as traditional imaging
Configuration profiles	Settings catalog, templates, baselines, filters, assignment, and conflicts	Assigning a policy to the wrong user or device group
Compliance and access	Compliance policies, device health, Conditional Access, remediation, and reporting	Assuming a compliant policy applies before the device checks in
Application management	Required, available, uninstall, detection rules, supersedence, and app protection	Ignoring detection logic when an app appears not installed
Endpoint security and updates	Defender, firewall, attack-surface reduction, security baselines, update rings, and monitoring	Patching everything at once with no staged rollout

Must-know distinctions

Distinction	How to decide
Enrollment profile vs configuration profile	Enrollment controls onboarding; configuration controls settings after management begins.
Compliance policy vs configuration profile	Compliance reports whether a device meets rules; configuration enforces settings.
Required app vs available app	Required apps install automatically; available apps are user-selectable.
User assignment vs device assignment	User targeting follows the person; device targeting follows the managed endpoint.
Autopilot vs imaging	Autopilot provisions cloud-managed devices without a traditional image refresh in many scenarios.
Device management vs app protection	Device management controls the whole device; app protection can protect data in managed apps.

High-yield checklist

Confirm enrollment, ownership, platform, and management state before policy troubleshooting.
Check assignment targeting, filters, groups, and sync status when a policy does not apply.
Use compliance with Conditional Access when access should depend on device health.
Use app protection policies when personal devices need app-level data controls.
Use security baselines and endpoint security profiles for Defender, firewall, and attack-surface settings.
Use update rings or staged groups for safe update deployment.
Use Autopilot for modern provisioning and reset scenarios.
Check conflicts and precedence when two policies set the same control.
Review reports and diagnostics before assuming Intune failed silently.

Common traps

Confusing compliance reporting with configuration enforcement.
Assigning a policy to users when the scenario requires device targeting.
Forgetting enrollment restrictions or platform support.
Troubleshooting app deployment without detection-rule evidence.
Using full device management when app protection is the less intrusive answer.
Skipping pilot rings for update rollout.

Practice strategy

For MD-102 misses, state the device lifecycle stage: enroll, configure, secure, deploy app, update, monitor, or retire. Then check whether the scenario is asking for a policy, profile, assignment, report, or troubleshooting step.

Revised on Monday, May 25, 2026