Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
The Microsoft 365 Certified: Endpoint Administrator Associate is Microsoft's certification for the people who enroll, configure and secure devices with Intune. This October 2026 guide covers the MD-102 exam, the five domains and weights in the October 27, 2026 outline, the 100-minute format and 700 passing score, the $165 fee, the free annual renewal, DoD 8140 status, and the roles it leads to.
The Microsoft 365 Certified: Endpoint Administrator Associate, earned by passing exam MD-102, is Microsoft's role-based certification for the people who deploy, manage and secure an organization's devices with Microsoft Intune.
The exam's full title is Managing and Securing Microsoft 365 Endpoints by using Intune, and it reaches well past Windows PCs. You enroll macOS, iOS, iPadOS and Android devices, build compliance policies that Conditional Access can enforce, deploy Windows with Autopilot, push Win32 apps and Microsoft 365 Apps, onboard devices to Microsoft Defender for Endpoint, and automate the routine work with PowerShell and Microsoft Graph. The current outline also expects you to work with Security Copilot agents inside Intune.
MD-102 carries no formal prerequisites, but Microsoft expects hands-on experience with Microsoft Entra ID, Intune and both Windows and non-Windows devices. It is issued and maintained by Microsoft, and the English exam moves to a refreshed skills-measured outline on October 27, 2026.
Entra join and registration, Intune enrollment for every platform, roles, compliance and Conditional Access. 20 to 25%.
Autopilot, Windows 365, configuration profiles, Intune Suite add-ons and remote actions. The heaviest domain at 25 to 30%.
Endpoint security policies, Defender for Endpoint, security baselines and update management. 15 to 20%.
Win32, Store and Microsoft 365 Apps deployment, plus app protection and app configuration policies. 15 to 20%.
PowerShell and Graph, Security Copilot agents, Endpoint Analytics and Intune reporting. The smallest domain at 10 to 15%.
Four reasons MD-102 is the Microsoft certification that lines up with device management work in 2026.
Microsoft built MD-102 around the endpoint administrator job role. It tests Intune across Windows, macOS, iOS, iPadOS and Android, plus Windows Autopilot, Windows 365 and the Intune Suite add-ons. If your week is spent enrolling, configuring and patching devices in a Microsoft 365 tenant, this is the certification that describes that work.
Microsoft doesn't publish the question types for a given exam, and the MD-102 page notes that you may have interactive components to complete. Scenario questions about join types, enrollment failures and conflicting policies are far easier if you've spent real time in the Intune admin center yourself.
Conditional Access, Windows LAPS and Defender for Endpoint onboarding all sit inside MD-102, which makes SC-300 and SC-200 natural next exams. MD-102 also counts toward Microsoft 365 Administrator Expert until that credential retires on November 30, 2026. Our roundup of popular Microsoft certifications shows where it fits.
MD-102 is valid for one year and renews free through an unproctored, open-book assessment on Microsoft Learn. The renewal window opens six months before your expiration date, and there is no limit on renewal attempts. Microsoft doesn't claim a DoD 8140 mapping for MD-102. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the job instead. Organizations that move device management into Intune need people who can enroll, secure and update every platform they support, and MD-102 is the Microsoft credential written for exactly that work.
The certification, the MD-102 exam, and how to keep the credential active, as of October 2026.
Most endpoint admins go deeper on identity, move toward security operations, or pick up Azure infrastructure. One older path is closing. MD-102 is one of four certifications that qualify you for Microsoft 365 Certified: Administrator Expert, but Microsoft retires that credential and its MS-102 exam on November 30, 2026.
Identity is the natural follow-on. SC-300 goes deep on Microsoft Entra, covering user identities, authentication and access management, workload identities and identity governance. MD-102 already has you joining devices to Entra ID and writing Conditional Access policies, so a good part of the groundwork is done.
SC-200 is the security operations route, covering triage, incident response and threat hunting with Microsoft Defender XDR and Microsoft Sentinel, with KQL doing the hunting. The Defender for Endpoint onboarding and KQL device queries in MD-102 give you a head start.
If your job is growing into the Azure side of the house, AZ-104 covers Azure identity and governance, storage, compute, virtual networking and monitoring. Our AZ-104 guide breaks down that exam.
MD-102 sits at the associate tier of Microsoft's role-based path. It builds on desktop support experience and Microsoft security basics, and from there the path branches into identity, security operations and Azure.
Helpful groundwork, not required
The device management credential
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue MD-102 specifically. Here's a straight answer to both.
No prerequisite credential required.
MD-102 has no formal prerequisites. You schedule it through Pearson VUE and take it at a test center or online. That makes it a realistic first Microsoft associate exam for a help desk or desktop support tech who already spends part of the day in Intune.
Reading about Intune won't carry you through it.
Microsoft expects experience with Entra ID, Intune and both Windows and non-Windows devices, plus an understanding of Security Copilot, Intune agents and Defender XDR. Work in a test tenant while you study. Enroll a Windows virtual machine and a phone, break a compliance policy on purpose, and watch what Conditional Access does with the device afterward.
MD-102 maps to the device management and modern workplace roles organizations hire for as they move Windows, Mac and mobile management into Intune.
The role MD-102 is written for. Enrolls, configures, secures and updates an organization's Windows, macOS, iOS, iPadOS and Android devices through Microsoft Intune, working alongside the Microsoft 365, identity and security admins.
Builds and maintains the Intune configuration behind a device fleet, from enrollment profiles and compliance policies to assignment filters and the PowerShell and Microsoft Graph automation that keeps a large fleet consistent.
Owns how new and rebuilt PCs reach users. Windows Autopilot, the Enrollment Status Page, Win32 app packaging and Windows 11 upgrade planning are daily work here, and all four are on the MD-102 outline.
Moves an organization from on-premises Group Policy and imaging toward cloud management with Intune, Windows 365 Cloud PCs and Microsoft 365 Apps. MD-102 covers the Group Policy analytics and ADMX import work that kind of migration starts with.
Manages phones and tablets, corporate and personal. Apple Business Manager, fully managed and work profile Android enrollment, Managed Google Play and app protection policies for personal devices all show up on the exam.
Hardens the fleet with BitLocker, firewall and attack surface reduction policies, security baselines and Microsoft Defender for Endpoint. It's also a logical stop for admins heading toward SC-200 and other Microsoft security roles.
MD-102 sits beside AZ-104 and SC-300 at Microsoft's associate tier, and CompTIA A+ covers the support groundwork that comes before it. Here's how the four line up.
| Endpoint Administrator (MD-102) | Azure Administrator (AZ-104) | Identity and Access Admin (SC-300) | CompTIA A+ | |
|---|---|---|---|---|
| Issuer | Microsoft | Microsoft | Microsoft | CompTIA |
| Level | Associate | Associate | Associate | Entry level |
| Focus | Managing and securing devices with Intune | Operating Azure environments | Identity and access with Microsoft Entra | Broad IT support fundamentals |
| Prerequisites | None | None (rec. 6 months) | None | None (rec. 12 months) |
| Exam | 1 exam, 100 min | 1 exam, 100 min | 1 exam, 100 min | 2 exams, up to 90 items, 90 min each |
| Passing Score | 700 of 1000 | 700 of 1000 | 700 of 1000 | 675 and 700 of 900 |
| Cost | $165 | $165 | $165 | About $548 for both |
| Validity | 1 year, free renewal | 1 year, free renewal | 1 year, free renewal | 3 years, CE program |
| Best For | Endpoint and Intune administrators | Cloud administrators | Identity and access administrators | Your first IT support role |
Microsoft prices exams by the country where you test, so fees vary outside the United States. AZ-104 and A+ figures come from the Training Camp AZ-104 guide and A+ guide. Microsoft associate certifications renew free each year, while CompTIA A+ runs on a three-year continuing education cycle.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
As an authorized Microsoft training partner, our Microsoft 365 Endpoint Administrator boot camp covers all five MD-102 domains in four days of live, instructor-led training, in person or online. You work from official Microsoft courseware and hands-on labs in a provided environment, finish with a full-length practice exam, and your MD-102 exam voucher and an exam retake are included.
Which Microsoft certifications people take in 2026, what's retiring, and how scoring and exam day work.
Which Microsoft exams people are actually sitting in 2026, what each one costs, who it fits, and why help desk and desktop staff who manage Intune are pointed at MD-102.
The full Microsoft map by role, with MD-102 and MS-700 named as the realistic targets for senior Microsoft 365 admins now that MS-102 is retiring.
How role-based exams replaced the product-based model, why Microsoft credentials now expire every year, and the 2026 retirements, including MS-102 on November 30.
What happened to MCSA after its January 31, 2021 retirement, how an old MCSA reads to employers now, and why current role-based certifications renew free each year.
ID, breaks, online proctoring and retake rules compared across vendors, including Microsoft's waiver process when a Pearson VUE session fails.
Why a scaled passing score of 700 on a Microsoft exam does not equal 70 percent, and how to read practice test results before you book the real thing.
A guide to first IT certifications, starting with CompTIA A+ for help desk and desktop support roles, the support groundwork that comes before a role-based exam like MD-102.
The MD-102 exam is organized into five domains, each with its own weight. Manage and maintain devices is the heaviest at 25 to 30 percent, and the automation and reporting domain is the lightest at 10 to 15. Click any domain for what it covers.
Choosing a device join type, joining and registering devices to Microsoft Entra ID, dynamic device groups, and enrolling Windows, macOS, iOS, iPadOS and Android devices in Intune, including Apple Business Manager, Samsung Knox Mobile Enrollment and Google zero-touch. It also covers Intune and Windows 365 roles, scope tags, multi-admin approval, compliance policies, Conditional Access that requires a compliant device, Windows Hello for Business and Windows LAPS.
The heaviest domain. Windows Autopilot profiles, modes and the Enrollment Status Page, Windows 11 upgrades, Windows 365 Cloud PCs, Windows Backup, configuration profiles for every platform plus Teams Rooms, HoloLens 2 and Zebra devices, the Intune Suite add-ons (Endpoint Privilege Management, Enterprise App Catalog, Remote Help, Cloud PKI, Microsoft Tunnel for MAM and Advanced Analytics), and remote actions such as wipe, BitLocker key rotation and KQL device queries.
Antivirus, disk encryption, firewall and attack surface reduction policies, security baselines, Microsoft Defender for Endpoint integration and onboarding, and App Control for Business. Update management sits here too, with update rings, feature and quality updates, Windows Autopatch, Hotpatch, Apple and Android update policies, and Delivery Optimization.
Preparing and deploying Win32, line-of-business and Microsoft Store apps, deploying and configuring Microsoft 365 Apps, adding apps from Apple Business Manager and Managed Google Play, troubleshooting failed installs, and building app protection and app configuration policies for managed and personal (BYOD) devices.
Automating Intune with PowerShell and Microsoft Graph, reviewing threats and recommendations from Security Copilot agents in Intune, Endpoint Analytics and remediation scripts, Intune reports and workbooks, tenant health and service communications, and alert rules for compliance drift and enrollment failures.
Domains and weights reflect the Microsoft MD-102 skills-measured outline that takes effect October 27, 2026. Microsoft's change log shows the same five domain weights before that date, with the fourth domain then titled Manage applications. Microsoft refreshes role-based exams periodically, so confirm the current outline on Microsoft Learn before scheduling.
The questions candidates ask most often when researching the Microsoft 365 Endpoint Administrator certification.
The Microsoft 365 Certified: Endpoint Administrator Associate, earned by passing exam MD-102, is Microsoft's role-based certification for the people who deploy, manage and secure an organization's devices with Microsoft Intune. It covers Windows, macOS, iOS, iPadOS and Android devices, along with Windows Autopilot, Windows 365, Microsoft Defender for Endpoint integration, app deployment and Intune reporting.
The current exam is MD-102: Managing and Securing Microsoft 365 Endpoints by using Intune. The English version moves to a refreshed skills-measured outline on October 27, 2026. Microsoft's change log marks the changes as minor and keeps the five domains at the same weights. Localized versions usually follow about eight weeks after the English update.
No. MD-102 has no formal prerequisites, so anyone can register and sit the exam. Microsoft does expect experience with Microsoft Entra ID and Microsoft 365 technologies such as Intune, strong skills in deploying and maintaining Windows and non-Windows devices, and an understanding of Microsoft Security Copilot, Intune agents and Microsoft Defender XDR.
The five domains are Prepare infrastructure for devices (20 to 25 percent), Manage and maintain devices (25 to 30 percent), Protect devices (15 to 20 percent), Manage and secure applications (15 to 20 percent), and Optimize endpoint operations by using automation, monitoring, and reporting (10 to 15 percent). Managing and maintaining devices carries the most weight.
Microsoft doesn't publish a question count for MD-102. Its general guidance is that most Microsoft certification exams have 40 to 60 questions, with the number varying by exam. You get 100 minutes to answer them, and Microsoft says to plan on 120 minutes of seat time for the instructions and candidate agreement. The exam is proctored and may include interactive components.
You need 700 on a scale of 1 to 1,000. Microsoft uses scaled scoring, so 700 doesn't mean 70 percent of the questions. Microsoft sets the passing line against question difficulty, so an easier set of questions takes more points to pass than a harder one.
The MD-102 exam costs $165 USD in the United States as of October 2026. Microsoft sets the price by the country where you test, and local taxes can apply. You schedule it through Pearson VUE. Training Camp's Microsoft 365 Endpoint Administrator boot camp includes the exam voucher in the program fee, along with an exam retake.
No DoD 8140 mapping is claimed for it. Microsoft doesn't list MD-102 against a DoD 8140 work role, so don't count on it to satisfy a cyber-coded position requirement on its own. Its value is practical instead, because any organization that manages devices in Intune needs people who can run it. See the full DoD 8140 work role paths.
MD-102 is valid for one year. You renew it free by passing an unproctored, open-book online assessment on Microsoft Learn before your certification expires. The assessment opens six months before your expiration date, and there's no limit on attempts, although after the second try you wait at least 24 hours between attempts.
MD-102 maps to roles such as Endpoint Administrator, Intune Engineer, Desktop Engineer, Modern Workplace Engineer, Mobile Device Administrator and Endpoint Security Engineer. It also fits help desk and desktop support staff who are taking over device management as their organization moves it into Intune.
Take the one that matches the work. MD-102 is about the devices people use, enrolling and securing laptops and phones with Intune. If your work is the subscriptions, virtual machines, storage and networks behind the services, AZ-104 is the closer fit. Both are 100-minute associate exams that cost $165 and renew free each year, so neither one is a cheaper shortcut to the other.
Not as of October 2026. Microsoft's exam retirement page, which lists exams scheduled to retire in the next 12 months, doesn't include MD-102, and the exam gets a refreshed English outline on October 27, 2026. The related MS-102 exam and the Microsoft 365 Certified: Administrator Expert credential do retire on November 30, 2026. MD-102 is one of four certifications that qualify you for that expert credential until then.
The breadth is what catches people. MD-102 spans five device platforms, Autopilot, Windows 365, the Intune Suite add-ons, Defender for Endpoint, app protection and Intune automation, and nearly every objective in the study guide starts with a task verb like configure, implement or deploy. You can open Microsoft Learn during the exam, but the clock keeps running, so it helps with a quick lookup, not with a topic you never learned.
For anyone who manages devices in a Microsoft 365 tenant, yes. It's the Microsoft certification written around the endpoint administrator role, it costs $165 with a free annual renewal, and it leads naturally into SC-300 and SC-200. It's less useful if your organization manages devices with a non-Microsoft tool, or if your work is Azure infrastructure, where AZ-104 fits better.
Tell us what you're working toward, from weighing the certification to lining up Intune training for a whole desktop team, and we'll help you plan the next step.