MD-102 · Domain 1 of 5

MD-102 Domain 1: Prepare infrastructure for devices

Get devices into Microsoft Entra ID and Intune the right way, then control who administers them and what makes a device trusted: join types, enrollment methods per platform, RBAC with scope tags, compliance, Windows Hello for Business and Windows LAPS.

Exam weight
20–25%
Official functional groups
3
Estimated questions estimate
10–13
Suggested study time estimate
16–22 hrs

About 13 min read Reviewed October 2026

Overview

Prepare infrastructure for devices has three functional groups and 18 listed skills. Adding devices to Microsoft Entra ID covers choosing between registration and Microsoft Entra join, performing each, and building device groups with dynamic membership rules. Enrolling devices to Microsoft Intune covers enrollment settings and restrictions, automatic Windows enrollment, personal enrollment for Apple devices, Android Enterprise profiles, Apple Business Manager, Samsung Knox Mobile Enrollment and Google zero-touch.

The third group, implementing identity and compliance, is the largest. It asks you to manage Intune and Windows 365 roles with scope tags, protect sensitive changes with multi-admin approval, write compliance policies for each platform, feed compliance into Conditional Access, and configure Windows Hello for Business, Windows LAPS and local group membership through Intune. Almost every later task in the exam assumes these foundations are already in place.

How it's tested

Domain 1 items tend to describe who owns a device, which platform it runs and what the organization needs to control. You then pick a join type, an enrollment method, an RBAC design or a compliance setting. Several options are usually valid Intune features, so the deciding detail is ownership, licensing or the scope of an administrator.

  • Ownership to enrollment method

    A scenario states corporate or personal ownership and a platform, and you choose the Entra join type or Intune enrollment path that fits.

  • Least-privilege administration

    A delegation requirement is given, and you combine an Intune role, member groups, scope groups and scope tags so admins see only their devices.

  • Compliance into access

    Users must reach Microsoft 365 only from healthy devices, so you pair a compliance policy with a Conditional Access grant control.

Reasoning it through

A company buys iPads in bulk and wants them supervised and enrolled without the user doing anything. Personal enrollment through Company Portal cannot supervise devices, so it is out. The answer is Automated Device Enrollment through Apple Business Manager, which requires an Apple MDM push certificate in Intune and an enrollment program token, plus an enrollment profile assigned to the device serials synced from Apple.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

1.1 Add devices to Microsoft Entra IDJoin type selection, joining and registering devices, and device groups with dynamic rules.
What it means
This group covers choosing between Microsoft Entra registration and Microsoft Entra join, performing each on Windows devices, and organizing devices in Microsoft Entra groups, including dynamic membership rules that place devices automatically based on attributes such as operating system, ownership or Autopilot identifiers.
What to understand
Registration suits personal devices: the user adds a work account and the device keeps a local or consumer identity. Microsoft Entra join suits organization-owned Windows devices, where users sign in with work accounts and the device is fully managed. Hybrid join exists for devices that must stay in on-premises Active Directory. Dynamic device groups need Microsoft Entra ID P1 and use rules such as device.deviceOSType or devicePhysicalIds containing ZTDId for Autopilot devices.
How it shows up
A scenario describes ownership and sign-in needs, and you pick registration, Entra join or hybrid join, or you write the dynamic rule that collects the right devices.
Common confusion
Treating registration and join as interchangeable; registration leaves the personal identity in place while join makes the work account the device sign-in.
1.2 Enroll devices to Microsoft IntuneEnrollment settings, restrictions and the enrollment paths for Windows, Apple and Android devices.
What it means
This group covers how devices become managed by Intune: enrollment restrictions and device limits, automatic MDM enrollment for Windows, user-initiated enrollment for personal macOS, iOS and iPadOS devices, Android Enterprise profiles, troubleshooting failed enrollments, and the corporate channels provided by Apple Business Manager, Samsung Knox Mobile Enrollment and Google zero-touch.
What to understand
Windows automatic enrollment is configured in the MDM user scope and triggers when a user joins or registers the device. Apple enrollment needs an Apple MDM push certificate, and corporate Apple devices use Automated Device Enrollment tokens from Apple Business Manager to become supervised. Android Enterprise offers fully managed, dedicated, corporate-owned with work profile and personally owned work profile modes. Platform and device limit restrictions often explain blocked enrollments.
How it shows up
Expect a platform, an ownership model and a desired user experience, then choose the enrollment profile or diagnose why enrollment was blocked.
Common confusion
Mixing up dedicated and fully managed Android devices; dedicated is for single-purpose or kiosk use without a user affinity, fully managed is one user's corporate phone.
1.3 Implement identity and complianceIntune and Windows 365 RBAC, scope tags, multi-admin approval, compliance, Conditional Access, Windows Hello for Business, Windows LAPS and local groups.
What it means
This group covers delegating administration with built-in and custom Intune and Windows 365 roles, limiting visibility with scope tags, requiring a second approver for sensitive changes, defining compliance for each platform, enforcing compliance through Conditional Access, deploying Windows Hello for Business, managing Windows LAPS and controlling membership of local groups such as Administrators.
What to understand
An Intune role assignment has three parts: the role, the admin group that receives it, and the scope groups it can act on, while scope tags filter which objects those admins see. Multi-admin approval uses access policies so a second admin must approve changes to protected areas such as apps or scripts. Compliance policies mark devices compliant or not, and Conditional Access consumes that state. Windows LAPS needs the Entra tenant setting enabled plus an Intune account protection policy.
How it shows up
Scenarios ask you to delegate safely, block noncompliant devices from cloud apps, or rotate and retrieve local admin passwords with the fewest steps.
Common confusion
Believing a compliance policy blocks access by itself; it only reports state, and Conditional Access is what grants or blocks the sign-in.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Microsoft Entra registered

    A personal device with a work account added, keeping its own sign-in identity.

    Remember
    Typical for BYOD; the user keeps control of the device.
    Tested as
    Join type selection questions.
    Trap
    Choosing it for corporate Windows laptops that need full device management.

  • Microsoft Entra joined

    An organization-owned Windows device whose sign-in identity is the work account.

    Remember
    Default target for Autopilot and cloud-native Windows.
    Tested as
    Join type and Autopilot prerequisites.
    Trap
    Assuming it requires on-premises Active Directory.

  • Dynamic device groups

    Microsoft Entra groups whose membership comes from device attribute rules.

    Remember
    Requires Entra ID P1; rules can match ZTDId for Autopilot devices.
    Tested as
    Targeting and group design questions.
    Trap
    Using an assigned group when the scenario wants automatic membership.

  • Enrollment restrictions

    Platform and device limit rules that decide which devices can enroll.

    Remember
    Restrictions are prioritized; the default applies when none match.
    Tested as
    Enrollment troubleshooting.
    Trap
    Blaming licensing when a device limit restriction blocked the user.

  • Apple MDM push certificate

    The certificate Intune needs before any Apple device can enroll.

    Remember
    It expires yearly and must be renewed with the same Apple ID.
    Tested as
    Apple enrollment prerequisites.
    Trap
    Creating a new certificate with a different Apple ID, which forces re-enrollment.

  • Automated Device Enrollment

    Apple's corporate enrollment through Apple Business Manager using a token in Intune.

    Remember
    Produces supervised devices with no user setup steps.
    Tested as
    Corporate iOS, iPadOS and macOS scenarios.
    Trap
    Picking Company Portal enrollment for supervised corporate devices.

  • Android Enterprise modes

    Fully managed, dedicated, corporate-owned work profile and personally owned work profile.

    Remember
    Ownership and user affinity decide the mode.
    Tested as
    Android enrollment profile questions.
    Trap
    Using a personally owned work profile for company-bought phones.

  • Scope tags

    Labels that limit which Intune objects an admin can see and manage.

    Remember
    They work together with role assignment scope groups.
    Tested as
    Delegated administration scenarios.
    Trap
    Thinking a role alone restricts visibility to one region.

  • Multi-admin approval

    Access policies that require a second administrator to approve protected changes.

    Remember
    Applies to areas such as apps, scripts and role changes.
    Tested as
    Change control and insider risk questions.
    Trap
    Confusing it with Privileged Identity Management activation.

  • Compliance plus Conditional Access

    Compliance policies evaluate devices; Conditional Access requires a compliant device to grant access.

    Remember
    Set the tenant default for devices with no compliance policy.
    Tested as
    Access control scenarios.
    Trap
    Expecting the compliance policy itself to block sign-in.

  • Windows LAPS

    Automatically managed local administrator passwords backed up to Entra ID or Active Directory.

    Remember
    Enable LAPS in Entra device settings, then assign an Intune LAPS policy.
    Tested as
    Local admin security questions.
    Trap
    Deploying the legacy LAPS client to cloud-joined devices.

  • Local user group membership policy

    An Intune account protection policy that adds, replaces or removes local group members.

    Remember
    Replace overwrites existing members; update only adds or removes.
    Tested as
    Local Administrators control questions.
    Trap
    Using replace and accidentally removing required accounts.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Device identity options

ConceptMeaningKey differenceCommon trap
Microsoft Entra registered Work account added to a personal device Device keeps personal sign-in Using it for corporate laptops
Microsoft Entra joined Device signs in with work accounts only Cloud-only, no domain controller needed Assuming line of sight to AD is required
Microsoft Entra hybrid joined Device in on-premises AD and Entra ID Needs Entra Connect or cloud sync and AD Choosing it for a cloud-only tenant

Android Enterprise enrollment modes

ConceptMeaningKey differenceCommon trap
Fully managed Corporate phone for one user Whole device is managed Confusing it with dedicated
Dedicated Single-purpose or shared kiosk device No user affinity Expecting per-user email setup
Corporate-owned work profile Company device that allows personal use Separate personal and work spaces Treating it as BYOD
Personally owned work profile Employee's own phone with a work container Company manages only the work profile Using it for bought devices

Intune RBAC building blocks

ConceptMeaningKey differenceCommon trap
Role Set of allowed actions Defines what can be done Assuming it limits which devices
Members Admin group receiving the role Defines who acts Assigning to device groups
Scope groups Users or devices the admins can manage Defines targets of actions Confusing with scope tags
Scope tags Labels on objects for visibility Defines what admins see Forgetting to tag policies

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Registration for corporate devices

    What candidates pick
    Microsoft Entra registration for company-owned Windows PCs.
    Why it looks right
    Registration sounds lighter and quicker to roll out.
    Why it's wrong
    Registered devices keep a personal sign-in and are not the target of Autopilot or full device policies; corporate Windows devices should be Entra joined.

    Clue to watch for The scenario says the organization owns the devices and users sign in with work accounts.

  2. Company Portal for supervised iPads

    What candidates pick
    User enrollment through Company Portal for bulk corporate iPads.
    Why it looks right
    Company Portal is the familiar enrollment app.
    Why it's wrong
    Only Automated Device Enrollment through Apple Business Manager supervises devices and removes user setup steps.

    Clue to watch for Words such as supervised, zero touch or purchased through Apple.

  3. Role without scope

    What candidates pick
    Assign the Help Desk Operator role and stop there.
    Why it looks right
    The role name matches the job.
    Why it's wrong
    Without scope groups and scope tags, the admins can act on and see every device in the tenant.

    Clue to watch for A requirement that admins manage only one region or business unit.

  4. Compliance alone blocks access

    What candidates pick
    Create a stricter compliance policy to stop risky devices reaching email.
    Why it looks right
    Compliance sounds like enforcement.
    Why it's wrong
    Compliance only sets device state; a Conditional Access policy requiring a compliant device is what blocks access.

    Clue to watch for The requirement mentions blocking access to Microsoft 365 or Exchange Online.

  5. Legacy LAPS on cloud devices

    What candidates pick
    Deploy the legacy LAPS MSI and a Group Policy to Entra joined devices.
    Why it looks right
    Legacy LAPS is well known from on-premises environments.
    Why it's wrong
    Windows LAPS is built into supported Windows versions and is configured through Intune with backup to Entra ID.

    Clue to watch for Devices are cloud-joined and managed by Intune.

  6. Dedicated mode for a personal-use phone

    What candidates pick
    Android dedicated enrollment for company phones employees also use personally.
    Why it looks right
    Dedicated sounds like dedicated corporate ownership.
    Why it's wrong
    Dedicated has no user affinity; corporate-owned with work profile allows personal use on company devices.

    Clue to watch for The scenario allows personal apps on company-bought Android devices.

Answer framework

Use these steps when a Domain 1 scenario asks how a device should join, enroll or be governed.

  1. Establish ownership first: corporate-owned or personal, because it decides between join and registration and between corporate and personal enrollment channels.
  2. Identify the platform and any purchase channel such as Apple Business Manager, Knox Mobile Enrollment or zero-touch, which signals a corporate enrollment profile.
  3. Check prerequisites the scenario may hide: MDM user scope, the Apple push certificate, licensing for dynamic groups, and enrollment restrictions or device limits.
  4. For delegation, assemble role, member group, scope groups and scope tags, and add multi-admin approval when changes need a second approver.
  5. For trust and access, write the compliance policy, then require compliance in Conditional Access, and harden sign-in with Windows Hello for Business and Windows LAPS.

Practice question

A retailer buys 300 Android phones for store staff. Each phone is assigned to one employee, who may also install personal apps from Google Play. IT must manage work data and the device itself. Which Android Enterprise enrollment option should you configure in Intune?

Want more like this? The MD-102 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Begin with identity, because Intune targeting and Conditional Access both depend on it. Join one Windows test device to Microsoft Entra ID and register another, then compare what each looks like in the Entra and Intune portals. Create a dynamic device group and confirm membership updates.

Next, work through enrollment one platform at a time in a trial tenant. Configure the MDM user scope, set enrollment restrictions and a device limit, upload an Apple MDM push certificate, and create each Android Enterprise profile so the differences become concrete. Read the Apple Business Manager, Knox and zero-touch setup pages even if you lack hardware.

Finish with governance: build a custom role, assign it with scope tags, turn on multi-admin approval, write a compliance policy, and require compliance in Conditional Access. Deploy Windows LAPS and retrieve a password from the portal. Then test yourself with scenario questions that mix ownership and platform details.

FAQ

How much of MD-102 is Domain 1, Prepare infrastructure for devices?

Microsoft weights Prepare infrastructure for devices at 20–25% of the exam, across three functional groups with 18 listed skills.

Is MD-102 retiring or being replaced?

Not as of 31 October 2026. The exam is active, and Microsoft updated the English version on 27 October 2026 with minor changes to several functional groups.

When should I use hybrid join instead of Microsoft Entra join?

Use hybrid join only when devices must remain in on-premises Active Directory, for example because of Group Policy or legacy authentication dependencies. New cloud-managed Windows devices are usually Entra joined.

What do I need before Apple devices can enroll in Intune?

An Apple MDM push certificate uploaded to Intune. Corporate devices also need an Automated Device Enrollment token from Apple Business Manager and an enrollment profile.

What is the difference between scope groups and scope tags?

Scope groups define which users or devices an admin can act on. Scope tags control which Intune objects, such as policies and apps, the admin can see.

Does a compliance policy block noncompliant devices?

No. It marks devices compliant or noncompliant and can notify or lock them. A Conditional Access policy that requires a compliant device does the blocking.

What is required for Windows LAPS with Intune?

Enable Microsoft Entra LAPS in the tenant device settings, then assign an Intune account protection LAPS policy that sets the backup directory and password rules.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered join types, Intune enrollment for each platform, RBAC with scope tags, compliance and Windows LAPS. Check whether you can pick the right enrollment path under time pressure.

Take the MD-102 practice test Check your MD-102 readiness

Keep going