MD-102 · Domain 3 of 5

MD-102 Domain 3: Protect devices

Harden and patch managed devices: antivirus, disk encryption, firewall, attack surface reduction, security baselines, Defender for Endpoint and App Control for Business, plus Windows, Apple and Android update management with Autopatch, Hotpatch and Delivery Optimization.

Exam weight
15–20%
Official functional groups
2
Estimated questions estimate
7–10
Suggested study time estimate
14–18 hrs

About 11 min read Reviewed October 2026

Overview

Protect devices has two functional groups and 15 listed skills. Configuring endpoint security covers Intune antivirus, disk encryption and firewall policies, attack surface reduction with Zero Trust principles, security baselines, the Intune connection to Microsoft Defender for Endpoint including EDR policies and incident triage, onboarding devices to Defender, and App Control for Business policies.

Managing device updates covers planning, Windows update rings with feature and quality update policies, Windows Autopatch and Hotpatch, Settings Catalog update policies for Apple devices, Android updates through configuration profiles or firmware-over-the-air, Delivery Optimization, and monitoring update status. Most items ask which policy type you would use and what happens when two policies overlap, so learn the endpoint security node and the update policy types side by side.

How it's tested

Expect scenarios that state a security or patching requirement and ask for the Intune policy type, setting or sequence that meets it. Distractors often name a real control from the wrong node, a configuration profile where an endpoint security policy is expected, or an update setting that delays when the requirement demands urgency.

  • Name the policy node

    A control such as BitLocker, firewall rules or ASR rules is requested, and you choose the matching endpoint security policy type rather than a generic profile.

  • Fix an update cadence

    A deferral, deadline or emergency patch requirement is given, and you pick update rings, feature update policy, expedited quality updates or Autopatch.

  • Connect Defender signals

    Threat level on a device must affect access, so you link Defender for Endpoint and use machine risk in compliance.

Reasoning it through

A zero-day fix must reach all Windows devices within two days, but update rings defer quality updates by seven days. Changing the ring would also affect future updates, so it is not ideal. An expedited quality update policy installs the specified security update quickly regardless of deferrals, which meets the deadline while leaving the normal ring cadence in place for later releases.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

3.1 Configure endpoint securityAntivirus, disk encryption, firewall, ASR, security baselines, Defender for Endpoint, onboarding and App Control for Business.
What it means
This group covers the Intune endpoint security workload: Microsoft Defender Antivirus policies, BitLocker and FileVault encryption including recovery key management and self-service recovery, Windows Firewall policies and rules, attack surface reduction rules applied with Zero Trust thinking, Microsoft security baselines, Intune integration with Defender for Endpoint for EDR, investigation and triage, onboarding devices, and App Control for Business.
What to understand
Endpoint security policies are focused profiles for one control, while security baselines bundle Microsoft-recommended settings and can conflict with them if both set the same value. BitLocker policies can encrypt silently on Entra joined devices with TPM and escrow keys to Entra ID, where users can self-recover through the Company Portal or My Account. ASR rules should start in audit mode. The Defender connector lets Intune onboard devices through EDR policies and use machine risk in compliance. App Control can trust the Intune managed installer.
How it shows up
Questions ask which endpoint security policy meets a control, how to avoid conflicts, or how to make Defender risk block access.
Common confusion
Assuming security baselines and endpoint security policies never overlap; conflicting values for the same setting cause errors on devices.
3.2 Manage device updatesUpdate rings, feature and quality updates, Autopatch, Hotpatch, Apple and Android updates, Delivery Optimization and monitoring.
What it means
This group covers keeping operating systems current across platforms: planning update strategy, configuring Windows update rings, pinning feature update versions, expediting quality updates, using Windows Autopatch and Hotpatch, enforcing iOS, iPadOS and macOS updates through Settings Catalog policies, managing Android system updates or Samsung firmware-over-the-air, tuning Delivery Optimization and reporting on update compliance.
What to understand
Update rings control deferrals, deadlines, grace periods and pause for Windows Update for Business. Feature update policies hold devices at a chosen Windows version until you move them. Expedited quality updates bypass deferrals for urgent fixes. Autopatch automates ring management with groups and deployment rings. Hotpatch applies most monthly security updates without a restart, with periodic baseline months that still need one. Apple update policies set a target OS version and enforcement date. Delivery Optimization reduces internet bandwidth through peer sharing.
How it shows up
Expect cadence and urgency scenarios, platform-specific patch requirements, and bandwidth concerns at branch offices.
Common confusion
Thinking update ring deferral alone controls which Windows 11 version devices land on; a feature update policy pins the version.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Endpoint security policies

    Focused Intune policies for one security control, such as antivirus or firewall.

    Remember
    Located in the Endpoint security node.
    Tested as
    Policy type selection.
    Trap
    Using a generic configuration profile when an endpoint security policy is expected.

  • Security baselines

    Microsoft-recommended groups of settings deployed as a versioned profile.

    Remember
    Updating to a new version is a deliberate action.
    Tested as
    Hardening and conflict questions.
    Trap
    Ignoring conflicts with other policies setting the same value.

  • BitLocker recovery key escrow

    Recovery keys stored in Microsoft Entra ID for encrypted devices.

    Remember
    Enables self-service recovery and key rotation.
    Tested as
    Encryption and recovery scenarios.
    Trap
    Encrypting before key backup is required by policy.

  • Attack surface reduction rules

    Rules that block risky behaviours such as Office creating child processes.

    Remember
    Start in audit mode, then enforce with exclusions.
    Tested as
    Zero Trust hardening questions.
    Trap
    Enforcing immediately and breaking business apps.

  • Defender for Endpoint connector

    Service connection between Intune and Defender for Endpoint.

    Remember
    Enables onboarding through EDR policy and device risk in compliance.
    Tested as
    Integration questions.
    Trap
    Deploying onboarding scripts manually when the connector handles it.

  • Machine risk score in compliance

    A compliance setting requiring devices at or under a Defender risk level.

    Remember
    Pairs with Conditional Access to block risky devices.
    Tested as
    Threat-based access control.
    Trap
    Expecting Defender alone to block cloud access.

  • App Control for Business

    Windows application control policies deployed through Intune.

    Remember
    Can trust the Intune Management Extension as managed installer.
    Tested as
    Allowlisting scenarios.
    Trap
    Confusing it with ASR rules.

  • Update rings

    Windows Update for Business deferrals, deadlines and pause settings.

    Remember
    Quality deferral up to 30 days; feature deferral up to 365.
    Tested as
    Patch cadence questions.
    Trap
    Using rings to choose a Windows version.

  • Feature update policy

    Keeps devices on a selected Windows version until changed.

    Remember
    Used to control Windows 11 upgrades.
    Tested as
    Version control scenarios.
    Trap
    Assuming rings pin versions.

  • Expedited quality updates

    Pushes a specific security update quickly despite deferrals.

    Remember
    For urgent fixes without changing rings.
    Tested as
    Zero-day response questions.
    Trap
    Pausing or editing rings instead.

  • Hotpatch

    Security updates that take effect without a restart on eligible Windows devices.

    Remember
    Baseline months still require a restart.
    Tested as
    Uptime-sensitive patching questions.
    Trap
    Assuming every update becomes restart-free.

  • Delivery Optimization

    Peer-to-peer content sharing for updates and apps.

    Remember
    Download mode controls peer scope, such as LAN or group.
    Tested as
    Bandwidth questions.
    Trap
    Using bypass mode when bandwidth reduction is the goal.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Windows update controls

ConceptMeaningKey differenceCommon trap
Update rings Deferrals, deadlines, pause Controls timing of updates Expecting version pinning
Feature update policy Target Windows version Controls which version Forgetting it when upgrading to Windows 11
Expedited quality update Urgent security update rollout Overrides deferral for one update Editing rings for an emergency
Windows Autopatch Automated ring and release management Microsoft-orchestrated rollout Assuming no admin control remains

Hardening tools

ConceptMeaningKey differenceCommon trap
Security baseline Bundle of recommended settings Broad starting point Overlapping with endpoint policies
ASR rules Block risky behaviours Behaviour-focused Skipping audit mode
App Control for Business Allow only trusted code Allowlisting focused Treating it as antivirus

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Configuration profile for BitLocker

    What candidates pick
    A general device restrictions profile to enable BitLocker.
    Why it looks right
    Older guidance used templates for encryption.
    Why it's wrong
    The disk encryption policy in endpoint security is the focused, expected place for BitLocker and recovery settings.

    Clue to watch for The question names encryption, recovery keys or encryption reports.

  2. Pause the ring for a zero-day

    What candidates pick
    Pause or shorten update ring deferrals to rush a fix.
    Why it looks right
    Rings are where deferrals are set.
    Why it's wrong
    Expedited quality updates deliver the specific fix quickly without permanently changing ring behaviour.

    Clue to watch for One urgent security update and a short deadline.

  3. Defender blocks cloud apps

    What candidates pick
    Rely on Defender for Endpoint alone to block risky devices from SharePoint.
    Why it looks right
    Defender detects the threat.
    Why it's wrong
    Blocking access needs machine risk in an Intune compliance policy plus a Conditional Access compliance requirement.

    Clue to watch for Access must be blocked when the device risk rises.

  4. Hotpatch means no restarts

    What candidates pick
    Promise users that Hotpatch removes every restart.
    Why it looks right
    The feature is sold as restart-free.
    Why it's wrong
    Baseline months and some non-security updates still require restarts, so plan maintenance windows.

    Clue to watch for The scenario asks about all monthly updates across a year.

  5. ASR straight to block

    What candidates pick
    Enable all ASR rules in block mode on day one.
    Why it looks right
    Block mode gives maximum protection.
    Why it's wrong
    Auditing first reveals legitimate apps that rules would break, so exclusions can be added before enforcing.

    Clue to watch for A requirement to avoid disrupting users.

  6. Rings for Apple devices

    What candidates pick
    Use Windows update rings to patch iPads.
    Why it looks right
    Rings are the familiar update tool.
    Why it's wrong
    Apple updates use Settings Catalog software update policies with target versions and enforcement dates.

    Clue to watch for The devices run iOS, iPadOS or macOS.

Answer framework

Use these steps for Domain 3 security and patching scenarios.

  1. Identify whether the requirement is a security control, a threat response or an update, because they live in different Intune nodes.
  2. For controls, choose the specific endpoint security policy type, and check for overlap with any security baseline already assigned.
  3. For threats, confirm the Defender for Endpoint connector and onboarding, then use machine risk in compliance with Conditional Access to restrict access.
  4. For Windows updates, decide whether timing, version or urgency is the issue, and pick rings, feature update policy, expedited updates, Autopatch or Hotpatch.
  5. For Apple, Android and bandwidth needs, use Settings Catalog update policies, FOTA or system update profiles, and Delivery Optimization download modes.

Practice question

An organization wants Windows devices that show a high Microsoft Defender for Endpoint risk level to lose access to Exchange Online until the threat is resolved. The Defender connector is enabled and devices are onboarded. What should you configure next?

Want more like this? The MD-102 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split your time roughly evenly between endpoint security and updates. In a lab tenant, open the Endpoint security node and create one policy of each type: antivirus, disk encryption, firewall, attack surface reduction and App Control. Assign a security baseline to the same test device and look at the conflict report so you see how overlaps surface.

If you can get a Defender for Endpoint trial, enable the connector, onboard a device through an EDR policy and add machine risk to a compliance policy. Walk through an incident in the Defender portal to understand triage at a high level.

For updates, build a pilot and broad update ring, a feature update policy and an expedited quality update, then compare their reports. Read the Autopatch and Hotpatch prerequisites carefully, and review the Apple and Android update options in the settings catalog. Close with practice questions that mix urgency, platform and version requirements.

FAQ

How much of MD-102 is Domain 3, Protect devices?

Protect devices is weighted 15–20% of MD-102, with two functional groups covering 15 listed skills on endpoint security and updates.

What is the difference between a security baseline and an endpoint security policy?

A baseline applies a large set of Microsoft-recommended settings at once. An endpoint security policy targets one control in detail. Both can set the same values, so conflicts must be managed.

How does Defender for Endpoint affect device access?

Through Intune. With the connector enabled, a compliance policy can require a maximum device risk level, and Conditional Access blocks devices marked noncompliant.

What is Hotpatch?

Hotpatch installs many monthly Windows security updates without restarting eligible devices. Periodic baseline updates still need a restart, and Intune configures it through Windows quality update policies.

How do I control which Windows 11 version devices get?

Use a feature update policy to set the target version. Update rings handle timing, deferrals and deadlines but do not pin a version.

Are Apple and Android updates in scope?

Yes. The outline includes Settings Catalog update policies for iOS, iPadOS and macOS, and Android updates through configuration profiles or firmware-over-the-air deployments.

What should I know about Delivery Optimization?

Know the download modes, such as LAN and group, and how peer sharing lowers internet bandwidth for updates and apps at busy sites.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered endpoint security policies, Defender for Endpoint integration and update management across platforms. See whether you can pick the right control and update policy quickly.

Take the MD-102 practice test Check your MD-102 readiness

Keep going