MD-102 Tests Picking the Right Intune Mechanism for Ownership and Platform
MD-102 is for admins who deploy and secure Windows, Apple and Android devices through Intune. Before choosing any feature, settle who owns the device, whether it is enrolled, and which licence or add-on the scenario assumes.
Check Your Readiness →Most candidates understand Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Most options are real Intune features; the deciding detail is ownership, enrollment state, TPM 2.0, user presence or add-on licensing. Choose the least destructive action that meets the goal. 700/1000 to pass in 100 minutes; Microsoft does not publish the question count.
Enroll them as dedicated devices
Dedicated mode has no user affinity and suits kiosks. Corporate-owned with work profile keeps the device under IT control while separating a personal space for Play apps. A personally owned work profile is for BYOD, not company purchases.
Add the developers to the local Administrators group
Use Endpoint Privilege Management, an Intune Suite add-on: an elevation settings policy plus an elevation rule for the file set to support-approved. Users stay standard and only the approved file runs elevated.
Pause the update rings and shorten the deferral
Deploy an expedited quality update policy for that specific fix; it overrides deferrals without permanently changing ring behaviour. Rings control timing, feature update policies pin the Windows version, and Hotpatch still needs restarts in baseline months.
Grant delegated DeviceManagement scopes to an admin account
Unattended jobs need application permissions, such as read access to managed devices, with admin consent, granted to the runbook's managed identity or an app registration. Delegated scopes require a signed-in user and would fail at night.
Send a full wipe to the device
Retire removes corporate apps, data and profiles while leaving personal content, which fits a personally owned device. Wipe resets corporate devices; delete only removes the Intune record and cleans nothing on the device itself.
Intune compliance only marks device state. Blocking Exchange Online needs Conditional Access requiring a compliant device. For Defender risk, add machine risk score to the compliance policy after enabling the Defender for Endpoint connector, then let Conditional Access act on it.
Self-deploying needs TPM 2.0 attestation, no user and Entra join only. Pre-provisioning also needs TPM 2.0 and still leaves a user phase. User-driven supports hybrid join. Device preparation policies skip hardware hash import but do not cover hybrid join.
LOB handles single MSI or app package files. EXE or scripted installers need the Win32 type, packaged as .intunewin, with detection rules, requirements, dependencies and supersedence. Weak detection rules cause false failures or reinstall loops even when setup succeeded.
App protection policies work on unenrolled iOS and Android devices; pair them with the Conditional Access grant Require app protection policy. Unenrolled devices cannot report compliance, and app configuration must use the managed apps channel, not managed devices.
Platform scripts run once per assignment unless changed. Remediations run detection and remediation pairs hourly or daily, and detection exit code 1 triggers the fix. Custom compliance scripts only report state through JSON rules; they never repair anything.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
MD-102 turns on ownership, enrollment state and licensing. See which Intune choices still trip you up.