MD-102 Managing and Securing Microsoft 365 Endpoints by using Intune Exam Topics and Questions
These Microsoft Managing and Securing Microsoft 365 Endpoints by using Intune (MD-102) exam topics are organized according to official exam domains to help candidates quickly verify coverage and focus on assessment rather than theory. Each domain is paired with topic-wise MD-102 sample questions that reflect how objectives are tested in the actual exam. This structure enables efficient review, targeted self-assessment, and rapid identification of weak areas when preparing for the Microsoft Managing and Securing Microsoft 365 Endpoints by using Intune certification exam.
Let's Practice Free Microsoft MD-102 Questions Aligned with Official Exam Topics
This topic sets the foundation for everything that follows. You're building the enrollment pathways, the identity layer, and the compliance framework that every device will pass through. The cost comes in two places: choosing the wrong join or enrollment method for a given device type, and misconfiguring compliance policies so that Conditional Access blocks legitimate users or lets risky devices through. β Device identity and group membership Microsoft Entra ID offers three ways to bring a device into scope: registration,...
This topic sets the foundation for everything that follows. You're building the enrollment pathways, the identity layer, and the compliance framework that every device will pass through. The cost comes in two places: choosing the wrong join or enrollment method for a given device type, and misconfiguring compliance policies so that Conditional Access blocks legitimate users or lets risky devices through.
β Device identity and group membership
Microsoft Entra ID offers three ways to bring a device into scope: registration, Entra join, and hybrid join. Registration suits bring-your-own scenarios where the device keeps its consumer identity but gains conditional access to work resources. Entra join is for corporate-owned Windows devices that live entirely in the cloud. Hybrid join bridges on-premises Active Directory with Entra ID, and it remains common in environments that still run domain controllers. Dynamic groups automate membership by evaluating attributes like device name, OS version, or enrollment profile ID. The rule syntax matters: a misplaced operator or a stale attribute reference means devices never land in the group, and your policies never apply. Plan your group hierarchy before you start enrolling, because retrofitting it under load is painful.
β Enrollment paths for every platform
Intune enrollment diverges sharply by operating system. Windows supports automatic enrollment when a device joins Entra ID, and the setting lives in the Mobility (MDM and MAM) blade. For iOS and macOS, personal enrollment uses the Company Portal app, while corporate devices flow through Apple Business Manager with automated device enrollment profiles. Android offers four corporate modes: fully managed, dedicated, corporate-owned work profile, and personally owned work profile. Each mode enforces different boundaries between corporate and personal data. Samsung Knox Mobile Enrollment and Google Zero Touch both push enrollment metadata to devices at activation, removing manual steps. Enrollment restrictions let you block personal devices or specific OS versions, and they're checked before the device talks to Intune. Troubleshooting enrollment failures means reading the error code, checking group assignment, and verifying that the enrollment profile reached the device.
β Identity, roles, and compliance enforcement
Role-based access control in Intune uses built-in roles like Endpoint Security Manager and Help Desk Operator, plus custom roles when you need a tighter permission set. Scope tags partition administrative boundaries so that one team sees only their regional devices and another sees only kiosks. Multi-admin approval adds a second set of eyes to sensitive actions like retiring devices in bulk. Compliance policies define the minimum acceptable state: encryption enabled, OS version current, jailbreak not detected. When a device falls out of compliance, Conditional Access policies can block access to email or SharePoint until the issue resolves. Windows Hello for Business replaces passwords with asymmetric keys or biometrics, and Intune pushes the policy that provisions the PIN and configures attestation. Windows LAPS rotates local administrator passwords and stores them in Entra ID, closing the shared-credential risk. Managing local group membership from Intune lets you add Entra users or groups to the local Administrators group without scripting.
How Prepare infrastructure for devices is tested
Items in this topic present a scenario with a mix of device types, ownership models, or administrative boundaries, then ask you to pick the join type, enrollment method, or role assignment that satisfies all constraints. You'll see questions that describe a compliance requirement and ask which policy setting enforces it, or that give you a Conditional Access failure and ask what compliance check is blocking the user. The exam expects you to distinguish registration from join, to know which Android enrollment mode separates work data, and to recognize when a dynamic group rule will exclude devices you intended to include. Candidates lose marks by choosing hybrid join for a cloud-only tenant, by assigning a built-in role when a scope tag was needed, or by configuring Windows Hello without understanding that it requires Entra join or hybrid join. The weight of this topic means you cannot afford to guess on enrollment profiles or compliance policy mechanics.
A practice test gives you the volume needed to see how Microsoft phrases join-type scenarios, compliance-policy questions, and role-assignment items across different contexts. The free demo shows you the item style before you pay, so you know whether the question bank matches the way you study.
The question below asks you to choose the enrollment method that fits a set of device ownership and platform constraints.
You have a Microsoft 365 tenant that uses Microsoft Intune.
You use the Company Portal app to access and install published apps to enrolled devices.
From the Microsoft Intune admin center, you add a Microsoft Store app.
Which two App information types are visible in the Company Portal?
NOTE: Each correct selection is worth one point.
Once devices are enrolled, you move into the operational phase: deploying Windows, applying configuration, and responding to support requests. This topic is broad, covering everything from Autopilot profiles to remote diagnostics. The two areas that trip candidates are choosing the correct Autopilot mode for a given scenario and building configuration profiles that layer correctly without conflict. β Windows deployment and provisioning Windows Autopilot automates out-of-box setup by applying a deployment profile tied to the device hardware hash. You choose between...
Once devices are enrolled, you move into the operational phase: deploying Windows, applying configuration, and responding to support requests. This topic is broad, covering everything from Autopilot profiles to remote diagnostics. The two areas that trip candidates are choosing the correct Autopilot mode for a given scenario and building configuration profiles that layer correctly without conflict.
β Windows deployment and provisioning
Windows Autopilot automates out-of-box setup by applying a deployment profile tied to the device hardware hash. You choose between user-driven mode, where the end user signs in and the device joins Entra ID, pre-provisioning mode, where IT completes most setup before handing the device over, and self-deploying mode for kiosks or shared devices that require no user interaction. Device preparation policies are a newer option that apply configuration during Windows setup without requiring Autopilot registration, and they suit scenarios where hardware hashes are hard to collect. Device name templates inject variables like serial number or random digits into the computer name. The Enrollment Status Page tracks app and profile installation during setup and blocks user access until everything succeeds or times out. Windows 11 upgrades flow through Intune feature update policies, which target a specific version and monitor deployment progress. Windows 365 Cloud PCs use provisioning policies that reference a network connection, an image, and a license, and Intune manages the Cloud PC like any other endpoint. Windows Backup and Restore policies in Intune let you back up user settings and data to OneDrive, then restore them on a new device.
β Configuration profiles across platforms
Device configuration profiles push settings that the OS enforces continuously. For Windows, you can import ADMX files to manage Group Policy settings that don't yet have a native Intune equivalent, and Group Policy analytics compares on-premises GPOs to Intune policies. Android profiles vary by enrollment mode: fully managed devices accept device restrictions and Wi-Fi profiles, while work profiles enforce boundaries between corporate and personal apps. iOS and iPadOS profiles configure restrictions, passcode requirements, and AirPlay destinations. macOS profiles manage FileVault, Gatekeeper, and system extensions. Specialty devices like Teams Rooms, HoloLens 2, and Zebra scanners use custom OMA-URI settings or device-specific templates. Assignment filters let you target a profile to devices that match a rule, such as OS version greater than a threshold or device name starting with a prefix. Enrollment time grouping adds the device to a group during Autopilot, so the profile applies immediately.
β Intune Suite capabilities
Endpoint Privilege Management lets standard users elevate specific executables without granting them permanent admin rights. Elevation policies define which files can run elevated, and you monitor each elevation event in the Intune portal. The Enterprise App Catalog surfaces Win32 apps that your organization has validated, and users install them from Company Portal without opening a ticket. Remote Help is a browser-based assistance tool that integrates with Intune role-based access control, so a help desk operator can request control and the end user approves or denies. Microsoft Cloud PKI issues certificates from a cloud-based certificate authority, automating SCEP requests and monitoring certificate health. Microsoft Tunnel for MAM extends secure access to on-premises resources for devices enrolled only in mobile application management, not full device management. Advanced Analytics adds anomaly detection, proactive insights, and risk-based policy recommendations on top of the standard Endpoint Analytics telemetry.
β Remote actions and diagnostics
Intune exposes remote actions in the device blade: sync forces an immediate policy refresh, restart reboots the device, retire removes corporate data and unenrolls, and wipe performs a factory reset. Bulk actions let you retire or wipe multiple devices in one operation, filtered by group or compliance state. Updating Defender security intelligence pushes the latest signatures without waiting for the next sync cycle. Rotating BitLocker recovery keys generates a new key and escrows it in Entra ID, useful after a suspected key disclosure. Rotating local administrator passwords triggers a Windows LAPS password change on demand. Device queries use Kusto Query Language to extract custom telemetry from enrolled devices, and the results appear in the Intune portal. Collecting diagnostics gathers logs, event traces, and registry snapshots, and the Troubleshooting blade provides user-based diagnostics that show policy application history and error codes.
How Manage and maintain devices is tested
Questions in this topic describe a deployment goal or a configuration requirement, then ask which Autopilot mode, profile type, or remote action achieves it. You'll encounter scenarios where multiple profiles apply to the same device and you must predict the outcome, or where a configuration setting conflicts with a compliance policy and you need to identify the problem. The exam tests whether you know when to use pre-provisioning instead of user-driven mode, when to apply an assignment filter instead of a static group, and which remote action preserves user data versus which one wipes everything. Candidates lose marks by confusing retire with wipe, by choosing an ADMX import when a Settings Catalog policy would work, or by failing to recognize that enrollment time grouping only applies during Autopilot. The breadth of this topic means you need strong recall across Windows, Android, iOS, and macOS configuration, because a single item may reference all four.
Practicing with a full question bank helps you see the same Autopilot and configuration-profile concepts tested from different angles, so you learn to recognize the pattern even when the wording changes. Timed conditions let you work through the breadth of this topic at exam pace.
The sample question tests your understanding of which Autopilot deployment mode matches the scenario constraints and user experience requirements.
You have a Microsoft 365 subscription that uses Microsoft Intune Suite.
You use Microsoft Intune to deploy and manage Windows devices.
You have 100 devices from users that left your company.
You need to repurpose the devices for new users by removing all the data and applications installed by the previous users. The solution must minimize administrative effort.
What should you do?
Security moves from perimeter to endpoint. This topic covers the policies that prevent malware, encrypt data at rest, block network attacks, and keep devices patched. The two highest-cost areas are disk encryption key recovery and update ring configuration, because both have operational consequences when you get them wrong. β Endpoint security policies Antivirus policies in Intune configure Microsoft Defender Antivirus settings like real-time protection, cloud-delivered protection, and exclusions. Disk encryption policies manage BitLocker on Windows and FileVault on macOS, and...
Security moves from perimeter to endpoint. This topic covers the policies that prevent malware, encrypt data at rest, block network attacks, and keep devices patched. The two highest-cost areas are disk encryption key recovery and update ring configuration, because both have operational consequences when you get them wrong.
β Endpoint security policies
Antivirus policies in Intune configure Microsoft Defender Antivirus settings like real-time protection, cloud-delivered protection, and exclusions. Disk encryption policies manage BitLocker on Windows and FileVault on macOS, and Intune escrows recovery keys in Entra ID so that help desk can retrieve them when a user is locked out. User self-service recovery lets the end user retrieve their own BitLocker key from the Intune Company Portal or MyAccount portal, reducing tickets. Monitoring encryption compliance means checking the device compliance report for devices that report encryption as disabled or failed. Firewall policies configure Windows Defender Firewall rules, including inbound and outbound rules, domain, private, and public profiles. Attack surface reduction policies enforce rules that block executable content from email clients, Office macros, and script-based threats, and they align with Zero Trust principles by assuming breach and limiting lateral movement. Security baselines are pre-configured policy sets that apply Microsoft's recommended settings for Windows, Edge, Defender for Endpoint, and Microsoft 365 Apps. Integrating Intune with Defender for Endpoint enables Endpoint Detection and Response policies that isolate devices, collect investigation packages, and run antivirus scans. Onboarding devices into Defender for Endpoint pushes a configuration package that registers the device with the service. App Control for Business policies, formerly known as Windows Defender Application Control, define which executables, scripts, and drivers are allowed to run, using file hashes, certificates, or publisher rules.
β Device updates and patch management
Update rings for Windows define when quality updates and feature updates install, how long users can defer them, and whether the device restarts automatically. Feature update policies target a specific Windows version and hold devices on that version until you change the policy. Quality update policies accelerate or delay monthly cumulative updates. Windows Autopatch is a service that automates update deployment across a staged ring structure, and it integrates with Intune to manage the deployment schedule. Hotpatch policies apply security fixes without requiring a reboot, available on Windows Server and some Windows 11 Enterprise builds. For iOS, iPadOS, and macOS, the Settings Catalog in Intune includes software update settings that control when updates download and install. Android updates are managed through configuration profiles for devices enrolled in Android Enterprise, or through firmware-over-the-air deployments for Samsung and other OEMs that support FOTA. Delivery Optimization policies configure peer-to-peer caching and download throttling, reducing bandwidth consumption during updates. Monitoring device updates means checking the Windows update rings report, the feature update report, and the per-device update status in the Intune portal.
How Protect devices is tested
Items in this topic present a security requirement or an update failure, then ask which policy setting or integration step resolves it. You'll see questions that describe a BitLocker recovery scenario and ask where the key is stored or how the user retrieves it, or that give you an update ring configuration and ask which devices will receive a specific update on a given date. The exam expects you to distinguish between antivirus policies and attack surface reduction policies, to know which Defender for Endpoint action isolates a device versus which one collects diagnostics, and to recognize when a feature update policy conflicts with an update ring. Candidates lose marks by confusing quality updates with feature updates, by failing to configure Defender for Endpoint onboarding before deploying EDR policies, or by choosing a security baseline when a custom policy was required to meet the scenario. The operational nature of this topic means that knowing the policy exists is not enough; you need to know the order of operations and the dependencies between policies.
Working through a question bank lets you see how encryption, firewall, and update policies are tested in combination, not in isolation. Checking your weak areas in the practice test helps you focus review time on the sub-topics that cost you marks.
The question that follows asks you to identify which disk encryption setting or action satisfies the recovery and compliance requirements in the scenario.
Application management sits at the intersection of deployment, configuration, and data protection. You're responsible for getting apps onto devices, keeping them current, and preventing corporate data from leaking to personal apps. The highest-risk area is app protection policies, because a misconfigured policy either blocks legitimate workflows or fails to protect data. β Application deployment Preparing an app for deployment means packaging it in a format Intune understands: Win32 apps use the .intunewin wrapper created by the Microsoft Win32 Content Prep...
Application management sits at the intersection of deployment, configuration, and data protection. You're responsible for getting apps onto devices, keeping them current, and preventing corporate data from leaking to personal apps. The highest-risk area is app protection policies, because a misconfigured policy either blocks legitimate workflows or fails to protect data.
β Application deployment
Preparing an app for deployment means packaging it in a format Intune understands: Win32 apps use the .intunewin wrapper created by the Microsoft Win32 Content Prep Tool, line-of-business apps are uploaded as .msi or .appx files, and Microsoft Store apps are linked by store ID. Deploying an app requires an assignment to a user group or device group, an intent of required or available, and detection rules that tell Intune whether the app is already installed. Quiet Time policies for Android and iOS prevent app installation notifications during specified hours, useful for frontline workers who cannot be interrupted. Microsoft 365 Apps deployment uses the Office Deployment Tool to create a configuration XML that defines which apps to install, update channel, language, and architecture. You can also deploy Microsoft 365 Apps as a Win32 app through Intune, and the Intune Company Portal can install it during Autopilot. The Microsoft 365 Apps admin center provides cloud policy for Office apps, including macro settings, add-in management, and privacy controls. Platform-specific app stores integrate with Intune: Apple Volume Purchase Program lets you assign purchased apps to users or devices, and Google Play Managed Google Play lets you approve and deploy Android apps. Monitoring app deployment means checking the app installation status report and filtering by failure code to identify missing dependencies or blocked installers.
β App protection and configuration
App protection policies enforce data loss prevention rules on managed apps, whether the device is enrolled in Intune or not. For managed devices, the policy works alongside device compliance. For unmanaged bring-your-own devices, the policy is the only control you have. App protection policies define whether users can cut, copy, paste, save-as, or share corporate data, and they can require a PIN or biometric authentication to open a managed app. Conditional Access policies can require an app protection policy before granting access to Exchange or SharePoint, ensuring that only compliant apps handle corporate data. App configuration policies push settings into managed apps, like email server addresses, VPN profiles, or feature toggles. Configuration policies come in two forms: managed apps use key-value pairs delivered through the Intune MAM SDK, and managed devices use the platform's native configuration channel.
How Manage and secure applications is tested
Questions in this topic describe an app deployment failure or a data protection requirement, then ask which setting, policy type, or assignment change resolves it. You'll see scenarios that give you a mix of enrolled and unenrolled devices and ask which app protection policy configuration covers both, or that describe a Microsoft 365 Apps deployment during Autopilot and ask which tool or configuration file is required. The exam expects you to distinguish between app protection policies and app configuration policies, to know when to use available versus required assignment intent, and to recognize when a Conditional Access policy enforces app protection versus when it enforces device compliance. Candidates lose marks by choosing a device configuration profile when an app configuration policy was needed, by failing to assign an app protection policy to the correct user group, or by not understanding that app protection policies require the Intune MAM SDK in the app. The overlap between deployment and protection means you need to think about both the delivery mechanism and the data boundary in the same question.
A question bank shows you how app deployment, app protection, and Conditional Access policies are tested together, so you learn to spot which layer the question is really asking about. The demo lets you verify coverage before committing.
The sample question below turns on your ability to choose the correct app protection policy setting or Conditional Access condition for the data protection requirement.
Operational maturity means automating repetitive tasks, surfacing problems before users report them, and making decisions from data. This topic covers scripting, Copilot integration, analytics, and alerting. The cost is in knowing which tool answers which question: PowerShell for automation, Endpoint Analytics for proactive health, and Security Copilot for investigation. β Automation and Copilot integration Automating Intune management tasks uses PowerShell and Microsoft Graph API. The Microsoft.Graph.Intune module is deprecated; you now use the Microsoft.Graph module with specific resource paths for...
Operational maturity means automating repetitive tasks, surfacing problems before users report them, and making decisions from data. This topic covers scripting, Copilot integration, analytics, and alerting. The cost is in knowing which tool answers which question: PowerShell for automation, Endpoint Analytics for proactive health, and Security Copilot for investigation.
β Automation and Copilot integration
Automating Intune management tasks uses PowerShell and Microsoft Graph API. The Microsoft.Graph.Intune module is deprecated; you now use the Microsoft.Graph module with specific resource paths for devices, policies, and assignments. Common automation tasks include bulk device enrollment, policy assignment audits, and compliance report exports. Security Copilot agents in Intune investigate threats by correlating alerts from Defender for Endpoint with device compliance state and policy assignment, then summarizing the timeline and suggesting remediation. Analyzing device performance with Copilot agents surfaces anomalies in startup time, battery health, or app crashes, and the agent explains which configuration or app is the likely cause. Reviewing Copilot recommendations means reading the natural-language summary, checking the supporting data, and deciding whether to apply the suggested policy change. Extending device compliance with PowerShell means writing custom detection scripts that check settings Intune doesn't natively evaluate, then returning a compliance state that Intune enforces.
β Reporting and visibility
Intune reporting includes built-in reports for device compliance, app installation, policy assignment, and enrollment status. Customizing reports means applying filters for device group, OS version, or compliance state, and exporting the results to CSV for further analysis. Workbooks and dashboards in the Intune portal visualize trends over time, like compliance drift or update deployment progress. Exporting reporting data to Log Analytics or a third-party SIEM enables long-term retention and correlation with other security signals. Endpoint Analytics collects telemetry on device health, startup performance, and application reliability. Proactive remediations are PowerShell scripts that detect and fix common issues, like clearing temp files, restarting a service, or reconfiguring a registry key. You schedule remediation runs daily or weekly, and Intune reports detection and remediation success rates. Analyzing endpoint reliability and user experience scores means looking at startup performance, which measures boot time and sign-in duration, restart frequency, which tracks unexpected reboots, and application reliability, which counts app crashes and hangs. Monitoring tenant health and Intune service communications means reviewing the service health dashboard for outages, reading message center notifications for feature changes, and establishing operational baselines so you recognize when metrics deviate. Configuring alerts and notifications for policy and compliance changes means setting up alert rules in the Intune portal that trigger when compliance drift exceeds a threshold, enrollment failures spike, or configuration conflicts appear.
How Optimize endpoint operations by using automation, monitoring, and reporting is tested
Items in this topic present an operational problem or a reporting requirement, then ask which tool, script, or configuration provides the answer. You'll see questions that describe a compliance drift scenario and ask which alert rule or report identifies the affected devices, or that give you a proactive remediation script and ask when it runs and what it returns. The exam expects you to distinguish between Endpoint Analytics health scores and Security Copilot threat investigations, to know which Microsoft Graph API path retrieves device compliance data, and to recognize when a custom detection script is required versus when a built-in compliance policy suffices. Candidates lose marks by choosing a workbook when an alert rule was needed, by writing a PowerShell script that uses a deprecated module, or by not understanding that proactive remediations require a detection script and a remediation script as separate files. The operational focus means the question will often describe a symptom and ask you to identify the tool that surfaces the root cause, not the tool that fixes it.
Practicing with a full question bank helps you see how automation, analytics, and alerting questions are phrased, so you recognize whether the item is asking for a report, a script, or a Copilot action. Volume matters here because the topic is wide and the tools overlap.
The question that follows asks you to identify which automation tool, analytics feature, or alert configuration satisfies the operational requirement in the scenario.
Ready to Start Practicing?
Access all questions and start your exam preparation journey
Upgrade to Full MD-102 Exam Questions π