MD-102 · Domain 2 of 5

MD-102 Domain 2: Manage and maintain devices

The heaviest MD-102 section: deploy Windows with Autopilot and Windows 365, build configuration profiles for every platform, use Intune Suite add-ons such as EPM, Cloud PKI and Remote Help, and run remote actions from wipe to KQL device query.

Exam weight
25–30%
Official functional groups
4
Estimated questions estimate
12–15
Suggested study time estimate
22–30 hrs

About 13 min read Reviewed October 2026

Overview

Manage and maintain devices is the largest section, with four functional groups and 27 listed skills. Deploying and upgrading Windows covers Autopilot deployment profiles versus device preparation policies, deployment modes, naming templates, the Enrollment Status Page, Windows 11 upgrades, Windows 365 Cloud PC provisioning and Windows Backup. Configuration profiles cover Windows, including ADMX import and Group Policy analytics, plus Android, Apple and specialty devices, with assignment filters and enrollment time grouping.

The Intune Suite group covers Endpoint Privilege Management, the Enterprise App Catalog, Remote Help, Microsoft Cloud PKI, Microsoft Tunnel for MAM and Advanced Analytics. The remote actions group covers sync, restart, retire, wipe, bulk actions, Defender intelligence updates, BitLocker key and local admin password rotation, KQL device query and diagnostics collection. Breadth is the challenge here, so build a mental map of where each feature lives in the admin center.

How it's tested

Domain 2 questions often describe a deployment goal, a user experience requirement or a support incident, then offer several Intune features that each sound plausible. Look for the constraint that rules options out: whether hardware hashes exist, whether a user is present, which platform is involved, whether an add-on license is owned, or whether personal data must survive.

  • Choose the Autopilot path

    Given whether hashes are registered, whether a user is present and the join type, pick a deployment profile mode or a device preparation policy.

  • Replace Group Policy

    An on-premises GPO must move to the cloud, so you choose the settings catalog, imported ADMX templates or Group Policy analytics.

  • Pick the remote action

    A lost, reassigned or misbehaving device is described, and you select retire, wipe, restart, key rotation, device query or diagnostics.

Reasoning it through

A kiosk device must provision with no user at the keyboard and be Entra joined automatically. User-driven mode needs someone to sign in, and pre-provisioning still finishes with a user phase. Self-deploying mode fits because it needs no credentials, but it requires TPM 2.0 attestation and Entra join, and the hardware hash must already be registered in Autopilot so the profile can be assigned.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

2.1 Deploy and upgrade Windows clients by using cloud-based toolsAutopilot profiles and device preparation, deployment modes, naming, ESP, Windows 11 upgrades, Windows 365 and Windows Backup.
What it means
This group covers delivering ready-to-work Windows devices from the cloud. It includes choosing between classic Autopilot deployment profiles and newer device preparation policies, picking user-driven, pre-provisioned or self-deploying modes, naming devices with templates, tracking setup with the Enrollment Status Page, upgrading to Windows 11, provisioning Windows 365 Cloud PCs and enabling Windows Backup for organizations.
What to understand
Deployment profiles rely on registered hardware hashes and support all three modes. Device preparation policies need no hash import, place the device in a chosen group during setup and focus on Entra join. Naming templates use macros such as %SERIAL% and %RAND:x% within 15 characters. The ESP can block desktop access until required apps and policies install. Cloud PC provisioning policies choose the join type, a Microsoft-hosted network or Azure network connection, and a gallery or custom image.
How it shows up
Expect to choose the Autopilot approach and mode from stated constraints, or the provisioning policy settings that get Cloud PCs onto the right network.
Common confusion
Assuming device preparation policies support hybrid join or pre-provisioning in the same way deployment profiles do.
2.2 Plan and implement device configuration profilesProfiles for Windows, Android, iOS/iPadOS, macOS and specialty devices, plus filters and enrollment time grouping.
What it means
This group covers configuring device settings through Intune profiles: the settings catalog and templates for Windows, imported ADMX and ADML files for third-party policies, Group Policy analytics for migrating GPOs, profiles for Android, Apple and macOS devices, specialty hardware such as Microsoft Teams Rooms, HoloLens 2 and Zebra devices, and precise targeting with assignment filters and enrollment time grouping.
What to understand
The settings catalog is the main place for Windows and Apple settings. Group Policy analytics imports GPO backup XML and reports which settings have MDM equivalents, then helps migrate them to the catalog. Imported ADMX templates handle applications whose policies are not built in. Assignment filters include or exclude devices by properties such as model, OS version or enrollment profile at evaluation time, avoiding extra groups. Enrollment time grouping places devices into a static group during provisioning so policies apply sooner.
How it shows up
Scenarios ask how to migrate GPOs, configure an unusual device or narrow a profile to a subset of a large group without new groups.
Common confusion
Using a dynamic group when a filter would apply faster; dynamic membership can lag, while filters evaluate at check-in.
2.3 Implement Intune Suite add-on capabilitiesEndpoint Privilege Management, Enterprise App Catalog, Remote Help, Cloud PKI, Microsoft Tunnel for MAM and Advanced Analytics.
What it means
This group covers the premium Intune capabilities licensed through the Intune Suite or individual add-ons: letting standard users elevate approved files with Endpoint Privilege Management, deploying prepackaged apps from the Enterprise App Catalog, giving help desk staff secure remote sessions, issuing certificates from a cloud certification authority, extending VPN access to unenrolled mobile apps, and using deeper device analytics.
What to understand
EPM uses an elevation settings policy to enable the client and set defaults, and elevation rules that allow automatic, user-confirmed or support-approved elevation for specific files. Remote Help needs the license, RBAC permissions and the app on both sides. Cloud PKI creates root and issuing CAs in Intune and issues certificates through SCEP profiles without on-premises servers. Tunnel for MAM uses a Linux-hosted gateway with the Defender app as the client on unenrolled devices.
How it shows up
Questions test which add-on solves a stated problem, and the configuration order needed to make it work.
Common confusion
Treating EPM as a way to make users local administrators; it elevates specific approved files while users stay standard.
2.4 Perform remote actions on devicesSync, restart, retire, wipe, bulk actions, Defender updates, key and password rotation, device query and diagnostics.
What it means
This group covers the actions administrators run against enrolled devices from the Intune admin center: forcing a policy sync or restart, retiring or wiping devices, applying actions to many devices at once, updating Microsoft Defender Antivirus security intelligence, rotating BitLocker recovery keys and Windows LAPS passwords, querying a device live with KQL and gathering diagnostics and logs.
What to understand
Retire removes company data, apps and profiles but leaves personal data, which suits BYOD. Wipe resets the device, with options to keep enrollment state and user accounts on Windows. Bulk device actions apply supported actions to up to 100 devices. BitLocker key rotation requires an encryption policy that enables recovery password rotation. Device query uses KQL against live device state and needs the Advanced Analytics license. The Troubleshooting pane gives a user-centric view of assignments and failures.
How it shows up
Expect incident scenarios where the best action preserves or removes the right data, or gathers the evidence needed to diagnose a failure.
Common confusion
Choosing wipe for an employee's personal phone; retire removes only corporate data and leaves personal content alone.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Autopilot device preparation

    A newer Autopilot approach configured by policy, without importing hardware hashes.

    Remember
    Uses a device group assigned during setup.
    Tested as
    Choosing the Autopilot approach.
    Trap
    Assuming it covers hybrid join like deployment profiles.

  • Self-deploying mode

    Autopilot mode that provisions with no user credentials.

    Remember
    Needs TPM 2.0 attestation and Entra join.
    Tested as
    Kiosk and shared device questions.
    Trap
    Picking user-driven mode for an unattended device.

  • Pre-provisioning

    A technician or partner completes the device phase before shipping, then the user finishes.

    Remember
    Reduces user wait time; needs TPM 2.0.
    Tested as
    Deployment speed scenarios.
    Trap
    Thinking it removes the user phase entirely.

  • Enrollment Status Page

    Setup screen that tracks and can block until apps and policies install.

    Remember
    Configure which apps block and the timeout.
    Tested as
    Out-of-box experience questions.
    Trap
    Blocking on too many apps and causing timeouts.

  • Windows 365 provisioning policy

    Defines join type, network and image for new Cloud PCs.

    Remember
    Microsoft-hosted network or Azure network connection.
    Tested as
    Cloud PC deployment questions.
    Trap
    Using an Azure network connection when no on-premises access is needed.

  • Group Policy analytics

    Imports GPO XML and shows MDM support for each setting.

    Remember
    Can migrate supported settings to the settings catalog.
    Tested as
    GPO migration scenarios.
    Trap
    Confusing it with importing ADMX templates.

  • Assignment filters

    Include or exclude devices from an assignment by device properties.

    Remember
    Evaluated at check-in, so no group membership delay.
    Tested as
    Precise targeting questions.
    Trap
    Creating many dynamic groups instead.

  • Endpoint Privilege Management

    Lets standard users run approved files elevated.

    Remember
    Elevation settings policy plus elevation rules policy.
    Tested as
    Least-privilege scenarios.
    Trap
    Granting local admin instead of an elevation rule.

  • Microsoft Cloud PKI

    Cloud-hosted root and issuing CAs managed in Intune.

    Remember
    Certificates delivered through SCEP profiles.
    Tested as
    Certificate-based Wi-Fi and VPN scenarios.
    Trap
    Planning NDES servers when the scenario wants no on-premises PKI.

  • Microsoft Tunnel for MAM

    VPN gateway access for protected apps on unenrolled iOS and Android devices.

    Remember
    Gateway runs on Linux; Android uses the Defender app as client, iOS uses the Tunnel for MAM SDK.
    Tested as
    BYOD access to on-premises apps.
    Trap
    Requiring device enrollment for the tunnel.

  • Retire vs wipe

    Retire removes corporate data; wipe resets the device.

    Remember
    Retire for personal devices, wipe for corporate ones.
    Tested as
    Lost or departing user scenarios.
    Trap
    Wiping a personal phone.

  • Device query

    Live KQL query against a single device's current state.

    Remember
    Requires Intune Advanced Analytics.
    Tested as
    Troubleshooting and investigation questions.
    Trap
    Expecting historical data from it.

  • Collect diagnostics

    Remote action that gathers logs and registry data into a downloadable package.

    Remember
    Available for supported Windows devices.
    Tested as
    Support escalation scenarios.
    Trap
    Asking the user to export logs manually.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Autopilot deployment modes

ConceptMeaningKey differenceCommon trap
User-driven User signs in and setup completes Supports Entra join and hybrid join Choosing it for unattended kiosks
Pre-provisioning Technician phase then user phase Apps install before the user receives it Forgetting the TPM 2.0 requirement
Self-deploying No user credentials during setup Entra join only, TPM attestation Expecting user-assigned apps to install

Autopilot profiles vs device preparation

ConceptMeaningKey differenceCommon trap
Deployment profile Assigned to registered hardware hashes Requires hash import or OEM registration Missing hash registration
Device preparation policy Policy-driven setup with enrollment time grouping No hash import required Assuming hybrid join support

Device removal actions

ConceptMeaningKey differenceCommon trap
Retire Removes company apps, data and profiles Personal data stays Using it on a stolen corporate laptop
Wipe Factory resets the device Removes everything unless options retain state Using it on BYOD
Delete Removes the record from Intune Does not clean the device Expecting it to remove data

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. User-driven for kiosks

    What candidates pick
    User-driven mode for a shared kiosk with no assigned user.
    Why it looks right
    It is the most common Autopilot mode.
    Why it's wrong
    User-driven needs someone to sign in; self-deploying mode provisions shared devices without credentials.

    Clue to watch for No user, kiosk, shared device or digital sign.

  2. Hashes for device preparation

    What candidates pick
    Import hardware hashes before using a device preparation policy.
    Why it looks right
    Classic Autopilot always required hash registration.
    Why it's wrong
    Device preparation policies work without hash import; they rely on the device group assigned at enrollment.

    Clue to watch for The scenario wants to avoid collecting hardware hashes.

  3. Dynamic group for quick targeting

    What candidates pick
    Create a dynamic group of one device model to scope a profile.
    Why it looks right
    Dynamic groups are a familiar targeting tool.
    Why it's wrong
    An assignment filter on the model property evaluates immediately at check-in without membership processing delays.

    Clue to watch for Target a subset of an existing group with minimal delay.

  4. Local admin for one app

    What candidates pick
    Add users to local Administrators so a tool can run elevated.
    Why it looks right
    It solves the immediate problem quickly.
    Why it's wrong
    Endpoint Privilege Management elevates only the approved file while users stay standard, which preserves least privilege.

    Clue to watch for Users must stay standard users.

  5. NDES for cloud certificates

    What candidates pick
    Deploy NDES and an on-premises CA for Wi-Fi certificates.
    Why it looks right
    It is the traditional SCEP design.
    Why it's wrong
    Microsoft Cloud PKI provides cloud-hosted CAs and issues certificates through Intune with no on-premises servers.

    Clue to watch for No on-premises infrastructure is allowed.

  6. Wipe on BYOD

    What candidates pick
    Run a full wipe on a departing employee's personal phone.
    Why it looks right
    Wipe guarantees corporate data is gone.
    Why it's wrong
    Retire removes corporate data and apps while leaving personal content, which is appropriate for personally owned devices.

    Clue to watch for The device belongs to the employee.

Answer framework

Apply this sequence to Domain 2 deployment, configuration and support scenarios.

  1. Classify the task: provisioning, configuring settings, using a premium add-on, or acting on an existing device, since each lives in a different admin center area.
  2. For provisioning, check hash registration, user presence, TPM 2.0 and join type, then pick a deployment profile mode, device preparation policy or Windows 365 provisioning policy.
  3. For settings, prefer the settings catalog, use imported ADMX for third-party policies, and use Group Policy analytics when migrating existing GPOs.
  4. Narrow assignments with filters or enrollment time grouping, and confirm whether an Intune Suite add-on license is assumed before choosing EPM, Remote Help or Cloud PKI.
  5. For incidents, choose the least destructive action that meets the goal: sync or restart first, rotate secrets when exposed, retire for personal devices, wipe for corporate ones.

Practice question

Developers are standard users on Intune-managed Windows 11 devices. They occasionally need to run one signed installer elevated, and the security team wants each elevation reviewed by IT before it runs. The company owns Intune Suite licenses. What should you configure?

Want more like this? The MD-102 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this section the largest share of your hours, since it carries the most weight. Start with Windows provisioning in a lab: register a virtual machine's hardware hash, run a user-driven Autopilot deployment with an ESP, then repeat with a device preparation policy and note what changed. Provision a Windows 365 Cloud PC if a trial license is available.

Move to configuration next. Export a real GPO, import it into Group Policy analytics, and migrate the supported settings. Build a settings catalog profile, then narrow it with an assignment filter. Skim the profile types for Android, Apple and specialty devices so you recognize their settings.

Cover Intune Suite features through trial licenses or documentation walkthroughs, focusing on the configuration order for EPM, Cloud PKI and Tunnel for MAM. End by running each remote action on a test device and writing down what it removes or keeps. Revisit weak areas with timed practice sets.

FAQ

How much of MD-102 is Domain 2, Manage and maintain devices?

Manage and maintain devices is weighted 25–30%, the largest MD-102 section, with four functional groups and 27 listed skills.

Do I need to import hardware hashes for Autopilot?

For classic deployment profiles, yes, unless the OEM or reseller registers devices for you. Autopilot device preparation policies do not require hash import.

Is Windows 365 tested in MD-102?

Yes. The study guide includes provisioning and configuring Windows 365 Cloud PCs through Intune, covering provisioning policies, network connections and image management, and also Windows 365 roles in Domain 1.

Which Intune Suite features are in scope?

Endpoint Privilege Management, the Enterprise App Catalog, Remote Help, Microsoft Cloud PKI, Microsoft Tunnel for MAM and Intune Advanced Analytics.

What is the difference between assignment filters and groups?

Groups define who or what receives an assignment. Filters refine that assignment by device properties at check-in, so you avoid building extra groups for every variation.

When should I use retire instead of wipe?

Use retire for personally owned devices or when a user leaves but keeps the device, because personal data stays. Use wipe for corporate devices being reset or reassigned.

What does device query need?

Device query runs KQL against a single device's live state and requires the Intune Advanced Analytics add-on, part of the Intune Suite.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered Autopilot and Windows 365 provisioning, configuration profiles, Intune Suite add-ons and remote actions. Try timed questions that make you pick the right deployment mode and device action.

Take the MD-102 practice test Check your MD-102 readiness

Keep going