The Microsoft 365 Certified: Endpoint Administrator Associate credential, earned through MD-102, assesses how professionals manage and secure devices and client applications in a Microsoft 365 environment. Practical endpoint administration means maintaining dependable devices across onboarding, policy assignment, application updates, security incidents and retirement, not merely learning individual Intune screens.
Microsoft’s English MD-102 objectives effective October 27, 2026 organize the work into five areas. This overview explains how an endpoint team connects those responsibilities into a coherent service model. It is distinct from a detailed examination study schedule or a career progression article.
Choose device identity and ownership first
An endpoint may be personally owned, shared or issued by the organization. Microsoft Entra registration, join and supported enrollment configurations describe different identity and management arrangements. A personally owned phone with protected corporate applications is not equivalent to a fully managed company workstation.
A reliable design begins with the supported platforms and ownership models, which user groups require management and what happens when a device is lost or replaced. Define enrollment prerequisites before issuing devices at scale; a successful login alone does not show that Intune management and configuration are effective.
Windows Autopilot provisioning can streamline onboarding when hardware registration, assignment, identity and network requirements are satisfied. A stalled Enrollment Status Page is a diagnostic clue, not a reason to delete every device record.
Trace policy assignment through the effective device state
Intune configuration profiles, compliance policies, assignment groups and filters control different aspects of endpoint management. A policy assigned to a group is not necessarily applicable to every device in that group. The administrator must check platform and version support, enrollment state and conflicting configuration.
Microsoft Entra Conditional Access can use device compliance as a sign-in condition. When an application is blocked, examine the actual Entra sign-in evaluation and Intune device compliance findings. Changing a global access policy before identifying the failing condition could weaken protection across the estate.
Delegated Intune roles, scope tags and multi-admin approval can also limit which teams are allowed to change policies. A help-desk technician resolving device issues should not automatically have the ability to retrieve every recovery secret or disable tenant security controls.
Maintain operating systems without uncontrolled disruption
Windows endpoint management involves deployment, feature and quality updates, support of existing applications and coordinated recovery. Update rings, version targeting and compatibility pilots answer different questions. One control determines which version to pursue, while another influences timing and user experience.
Mobile-platform updates vary by operating system and management mode, including Apple and Android ownership requirements. Unsupported settings cannot be fixed by copying a Windows profile into another platform’s enrollment group. Track which vendor controls and Intune interfaces actually apply.
Windows 365 Cloud PCs and specialized devices add provisioning, image, network and health-monitoring concerns. A cloud-hosted endpoint can have different recovery mechanics from a physical laptop while sharing identity and access principles. Document the responsibility boundaries before a service incident.
Protect devices and verify the security effect
Microsoft Defender for Endpoint integration, antivirus, firewall, attack surface reduction and encryption are complementary safeguards. A successful security-policy deployment is not proof the effective device state is healthy; confirm telemetry, evaluated rules and user impact.
If an attack surface reduction rule blocks a line-of-business workflow, determine which event triggered it and whether an exception is justified. Disabling broad protection for every user is rarely a defensible response to one reproducible application issue.
BitLocker recovery is a sensitive operation. Ensure that authorized staff can retrieve a key when necessary, that exposed keys can be rotated by the supported process and that recovery information is protected and monitored. A support incident should not result in emailing recovery keys in plaintext.
Manage applications from deployment through support
A Win32 app may install successfully but continue reporting a failure because the detection rule is wrong. A different application may be unavailable because the user lacks its entitlement or app-protection requirements are unmet. These conditions belong to different services and should be investigated separately.
Intune app protection policies can secure supported organizational data in apps, including some personally owned device scenarios, without requiring unrestricted management of the entire device. Conditional Access and app configuration may interact with those controls; test the whole authorization path.
Microsoft 365 Apps deployment also requires a supported update and configuration strategy. Assignment success alone cannot establish that an application is operational across Windows and mobile platforms. A monitored pilot can reveal defects before they affect the full population.
Monitor cohorts and automate with an explicit scope
Endpoint Analytics, Intune reporting, compliance views and device diagnostics reveal patterns behind repeated support incidents. Track practical outcomes such as enrollment success, application installation reliability, device performance and unresolved exceptions rather than counting policies created.
PowerShell and Microsoft Graph can help gather inventory and make authorized bulk changes. First inspect the impacted cohort read-only, then test a limited correction with logging, approval and rollback. An automation that changes a thousand devices incorrectly is not a productivity improvement.
The current exam profile also addresses Security Copilot agents and agentic workflows. These can recommend or analyze a response, but an accountable administrator still validates permissions, evidence, impact and recovery before acting.
Worked case: opening a regional office
A company opens a branch with 70 laptops used partly from home. The endpoint team selects a cloud identity strategy, scoped Intune enrollment, staged Autopilot profiles and policies for encryption, applications and updates. It also documents how the help desk handles failed provisioning.
The pilot discovers three problems. One laptop has the wrong Autopilot assignment, another a configuration conflict, and a third is correctly enrolled but fails application access because an encryption requirement is unmet. One global reset would hide these separate causes.
The team isolates each responsible service, applies a narrow correction and checks the resulting device state. Later, reporting reveals that one app fails on a particular OS release. The team pauses that cohort, verifies the detection and compatibility evidence, then documents rollback and ownership.
Connect the operating model to the current examination
The five current MD-102 areas are Prepare infrastructure for devices (20–25%), Manage and maintain devices (25–30%), Protect devices (15–20%), Manage and secure applications (15–20%), and Optimize endpoint operations through automation, monitoring and reporting (10–15%).
Use MD-102 exam objectives for current testing details. The endpoint-administrator career roles are a different reader question about work responsibilities and progression, not a duplicate syllabus.
A strong endpoint administrator can explain how a device moves from identity and enrollment through controlled operation, support and safe retirement. Each important claim should be supported by observable device or policy evidence, rather than by the presence of a configured setting.