MD-102 · Domain 5 of 5

MD-102 Domain 5: Optimize endpoint operations by using automation, monitoring, and reporting

Automate Intune with PowerShell and Microsoft Graph, work with Security Copilot agents that surface threats and recommendations, extend compliance with scripts, and keep the estate healthy with reports, Endpoint Analytics, Remediations and alerting.

Exam weight
10–15%
Official functional groups
2
Estimated questions estimate
5–8
Suggested study time estimate
10–14 hrs

About 11 min read Reviewed October 2026

Overview

Optimize endpoint operations by using automation, monitoring, and reporting has two functional groups and 11 listed skills. Automating management tasks covers Intune automation with PowerShell and Microsoft Graph, investigating threats identified by Security Copilot agents in Intune, analysing device performance with those agents, reviewing and acting on agent recommendations, and extending compliance with PowerShell scripts.

Monitoring and optimizing health covers Intune reports, filters, workbooks and exports, Endpoint Analytics with device health scores and app startup performance, Remediations scripts and their schedules, reliability and user experience scores, tenant health with service health and message center, and alerts for compliance drift, enrollment failures and configuration conflicts. The agent skills reflect Microsoft's audience profile, which now describes managing devices with Intune and agentic tools and workflows.

How it's tested

This section mixes tooling questions with judgement questions. Some ask which API permission, cmdlet approach or script pair performs a task. Others present a Security Copilot agent finding, an analytics score or a report, and ask what the administrator should check or do next. Favour options that verify before acting and that scale through automation.

  • Automate at scale

    A repetitive task across many devices is described, and you choose Microsoft Graph with the right permissions, PowerShell, or a Remediations script pair.

  • Act on an agent finding

    A Security Copilot agent surfaces a threat or recommendation, and you choose how to validate, approve or remediate it in Intune.

  • Read the health signal

    A startup, reliability or compliance metric looks wrong, and you identify the report, score or alert that explains or tracks it.

Reasoning it through

Devices report a disabled print spooler service that should be running, and the fix must repeat daily. A compliance policy would only flag the issue, and a configuration profile cannot restart a stopped service. A Remediations script package fits: the detection script checks the service state and exits with a non-zero code when it is stopped, triggering the remediation script, scheduled to run daily.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

5.1 Automate management tasksPowerShell and Microsoft Graph automation, Security Copilot agents in Intune, and PowerShell-based custom compliance.
What it means
This group covers moving Intune administration from manual portal work to code and AI-assisted operations: scripting tasks against Microsoft Graph with PowerShell, investigating threats that Security Copilot agents identify in Intune, analysing device performance with those agents, deciding how to respond to agent recommendations, and extending compliance with PowerShell discovery scripts.
What to understand
Intune is exposed through the Microsoft Graph deviceManagement endpoints, and the Microsoft Graph PowerShell SDK signs in with delegated scopes or, for unattended jobs, an app registration or managed identity with application permissions. Security Copilot agents in Intune, such as the Vulnerability Remediation Agent, analyse tenant data and propose prioritised actions, but administrators review and apply them under their own permissions. Custom compliance pairs a PowerShell discovery script returning JSON with a JSON rules file uploaded to the compliance policy.
How it shows up
Expect questions on Graph permissions for automation, the parts of custom compliance, and responsible handling of agent output.
Common confusion
Assuming agents change devices on their own; their findings are recommendations that an administrator reviews before acting.
5.2 Monitor and optimize healthIntune reporting, Endpoint Analytics, Remediations, reliability scores, tenant health and alerting.
What it means
This group covers watching and improving the managed estate: customizing and exporting Intune reports, using workbooks and dashboards, measuring endpoint performance and health with Endpoint Analytics, writing and scheduling Remediations, analysing startup, restart and app reliability metrics, monitoring service health and message center notices, and configuring alerts for compliance drift, enrollment failures and configuration conflicts.
What to understand
Intune reports can be filtered and exported, and diagnostic settings can send logs to Log Analytics for workbooks and alert rules. Endpoint Analytics scores startup performance, app reliability and other categories against baselines. Remediations use a detection script and an optional remediation script, run once, hourly or daily, and need qualifying Windows Enterprise or equivalent licensing. Tenant status in Intune shows service health and message center items relevant to Intune.
How it shows up
Scenarios ask which report, score or script feature reveals or fixes a problem, and how to get notified when something changes.
Common confusion
Confusing Remediations with platform scripts; platform scripts run once by design, while Remediations detect and fix on a schedule.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Microsoft Graph for Intune

    The API surface behind the Intune admin center.

    Remember
    Device management lives under deviceManagement endpoints.
    Tested as
    Automation questions.
    Trap
    Using deprecated Intune-only PowerShell modules.

  • Delegated vs application permissions

    User-context scopes versus app-only rights for Graph calls.

    Remember
    Unattended jobs need application permissions with admin consent.
    Tested as
    Scheduled automation scenarios.
    Trap
    Running a nightly job with delegated sign-in.

  • Security Copilot agents in Intune

    AI agents that analyse Intune and security data and recommend actions.

    Remember
    Need Security Copilot capacity; admins review output.
    Tested as
    Agentic operations questions.
    Trap
    Treating recommendations as already applied.

  • Vulnerability Remediation Agent

    Agent that prioritises vulnerabilities on managed devices and suggests fixes.

    Remember
    Uses Defender vulnerability data.
    Tested as
    Threat investigation skills.
    Trap
    Assuming it replaces patching policies.

  • Custom compliance

    PowerShell discovery script plus JSON rules for non-standard checks.

    Remember
    The script must return compact JSON.
    Tested as
    Extending compliance questions.
    Trap
    Uploading the script without a rules file.

  • Endpoint Analytics

    Scores device performance and experience against baselines.

    Remember
    Covers startup, app reliability and more.
    Tested as
    Health monitoring questions.
    Trap
    Expecting it to fix issues on its own.

  • Remediations

    Detection and remediation script pairs run on a schedule.

    Remember
    Exit code 1 from detection triggers remediation.
    Tested as
    Proactive fix scenarios.
    Trap
    Using platform scripts for repeating fixes.

  • Startup performance

    Measures boot and sign-in times across devices.

    Remember
    Highlights slow devices and startup processes.
    Tested as
    User experience questions.
    Trap
    Confusing it with app reliability.

  • App reliability

    Tracks app crashes and their effect on user experience.

    Remember
    Mean time to failure per app.
    Tested as
    Reliability score questions.
    Trap
    Blaming hardware without checking app data.

  • Intune report export

    Exporting report data through the portal or Graph export jobs.

    Remember
    Supports filters and large datasets.
    Tested as
    Reporting questions.
    Trap
    Copying data manually from the portal.

  • Diagnostic settings to Log Analytics

    Sends Intune audit and operational logs to Azure Monitor.

    Remember
    Enables workbooks and alert rules.
    Tested as
    Alerting and dashboard questions.
    Trap
    Expecting long-term history only from Intune views.

  • Tenant status

    Intune view of service health and message center posts.

    Remember
    Use it to separate service issues from tenant issues.
    Tested as
    Operational baseline questions.
    Trap
    Troubleshooting policies during a Microsoft outage.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Script options in Intune

ConceptMeaningKey differenceCommon trap
Platform scripts PowerShell or shell scripts run on devices Run once unless changed Using them for recurring fixes
Remediations Detection and remediation script pairs Scheduled and reported Forgetting licensing requirements
Custom compliance scripts Discovery script with JSON rules Feeds compliance state Expecting it to fix the issue

Automation and AI assistance

ConceptMeaningKey differenceCommon trap
Microsoft Graph PowerShell Scripts calling Intune APIs Deterministic, administrator-written logic Wrong permission type
Security Copilot agents AI analysis with recommendations Proposes actions for review Applying without validation
Remediations On-device detect and fix Runs on endpoints Using it for tenant-level changes

Monitoring sources

ConceptMeaningKey differenceCommon trap
Intune reports Built-in operational and organizational views Quick, filterable, exportable Expecting custom alert rules
Endpoint Analytics Experience and performance scores Device health focus Using it for compliance status
Log Analytics workbooks Custom queries over exported logs Alerts and long retention Forgetting diagnostic settings

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Agent already fixed it

    What candidates pick
    Assume a Security Copilot agent finding means the issue is resolved.
    Why it looks right
    Agents sound autonomous.
    Why it's wrong
    Intune agents analyse and recommend; administrators review, approve and apply changes with their own permissions.

    Clue to watch for Words such as recommendation, suggested action or review.

  2. Delegated permission for a runbook

    What candidates pick
    Grant a nightly runbook delegated Graph scopes.
    Why it looks right
    Delegated scopes are what interactive scripts use.
    Why it's wrong
    Unattended automation needs application permissions with admin consent, through an app registration or managed identity.

    Clue to watch for The job runs on a schedule with no user.

  3. Compliance fixes the problem

    What candidates pick
    Use a custom compliance script to restart a stopped service.
    Why it looks right
    It runs PowerShell on the device.
    Why it's wrong
    Custom compliance only reports state; Remediations detect and fix issues on a schedule.

    Clue to watch for The requirement says fix automatically.

  4. Platform script for daily checks

    What candidates pick
    Deploy a platform script to check a setting every day.
    Why it looks right
    Scripts are the familiar option.
    Why it's wrong
    Platform scripts run once per assignment unless changed; Remediations support hourly or daily schedules with reporting.

    Clue to watch for A repeating schedule is required.

  5. Alerts without log routing

    What candidates pick
    Build an Azure Monitor alert on Intune compliance changes immediately.
    Why it looks right
    Azure Monitor provides alerting.
    Why it's wrong
    Intune data must first be sent to Log Analytics through diagnostic settings before queries and alert rules can use it.

    Clue to watch for Custom alerts or workbooks over Intune events.

  6. Policy issue during outage

    What candidates pick
    Rebuild policies when many devices stop checking in at once.
    Why it looks right
    Policy errors are the usual cause.
    Why it's wrong
    Checking tenant status and service health first shows whether a Microsoft-side incident explains the symptoms.

    Clue to watch for Sudden tenant-wide failures with no recent changes.

Answer framework

Follow these steps for Domain 5 automation, agent and monitoring scenarios.

  1. Decide whether the need is automation, AI-assisted analysis, compliance extension, monitoring or alerting, because each maps to a different tool.
  2. For automation, use Microsoft Graph with least-privilege permissions, choosing application permissions and a managed identity for unattended jobs.
  3. For Security Copilot agent output, validate the finding against device data, check scope and impact, then approve and apply through normal change control.
  4. For device-side problems, use custom compliance to report a condition and Remediations to detect and fix it on a schedule.
  5. For visibility, start with Intune reports and Endpoint Analytics, route logs to Log Analytics for workbooks and alerts, and check tenant status for service incidents.

Practice question

Every night, an Azure Automation runbook must read all Intune-managed devices through Microsoft Graph and export noncompliant devices to a file. No administrator will be signed in when it runs. How should you grant access?

Want more like this? The MD-102 practice test has questions for every domain.

Checklist

0 of 11

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Spend fewer hours here than on Domain 2, but do not skip it, because the agent and automation skills are new and easy to underprepare. Read the Microsoft Learn pages on Security Copilot in Intune and the Intune agents, focusing on prerequisites, the permissions agents use, and how recommendations are reviewed and applied. If you have no Security Copilot capacity, study the documented workflows and screenshots.

Then practise automation hands-on. Install the Microsoft Graph PowerShell SDK, list managed devices, filter noncompliant ones and export them. Repeat the task using an app registration with application permissions to feel the difference. Write a small custom compliance script and rules file.

Finally, enable Endpoint Analytics on a few test devices, create a Remediations package for a simple fix, and route Intune logs to a Log Analytics workspace so you can build a workbook and an alert rule. Review tenant status and message center, then take a short practice set on this section.

FAQ

How much of MD-102 is Domain 5, Optimize endpoint operations by using automation, monitoring, and reporting?

Microsoft weights Optimize endpoint operations by using automation, monitoring, and reporting at 10–15% of MD-102, with two functional groups covering 11 listed skills.

Are Security Copilot agents really on the exam?

Yes. Three listed skills cover investigating threats found by Security Copilot agents in Intune, analysing device performance with them, and responding to their recommendations, and the audience profile mentions Intune agents.

Do I need a Security Copilot license to prepare?

It helps but is not essential. Agents require provisioned Security Copilot capacity, so many candidates study the documented workflows, prerequisites and review steps instead of running agents.

What is the difference between custom compliance and Remediations?

Custom compliance uses a discovery script to report whether a device meets a rule. Remediations detect a problem and run a fix script on a schedule.

Which Graph tool should I learn for Intune automation?

Learn the Microsoft Graph PowerShell SDK and Graph Explorer, including how delegated and application permissions differ for Intune deviceManagement endpoints.

What does Endpoint Analytics measure?

It scores startup performance, app reliability and related experience metrics against baselines, highlighting devices and apps that drag down user experience.

How do I get alerts on Intune events?

Route Intune logs to Log Analytics with diagnostic settings, then create Azure Monitor alert rules and workbooks over those logs, alongside built-in Intune notifications.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered Graph automation, Security Copilot agents, custom compliance, Endpoint Analytics, Remediations and alerting. Check that you can choose the right tool for each operations scenario.

Take the MD-102 practice test Check your MD-102 readiness

Keep going