Microsoft MD-102: Securing and Managing Endpoints with Intune

MD-102 is the Microsoft exam for administrators who enroll, configure, secure and maintain endpoint devices through Microsoft Intune and related services. The published study guide describes preparing device infrastructure, managing and maintaining devices, protecting endpoints, managing applications and optimizing operations. An English skills update is scheduled for October 27, 2026, so candidates testing on or after that date should use the updated outline. The exam combines technical configuration with operational judgment: a compliant-looking device is not necessarily healthy, and an installed security policy is not necessarily enforcing the intended protection.

A distributed company may have corporate Windows laptops, personal smartphones, contractor devices and cloud PCs. Different enrollment and compliance models are appropriate for each. Successful endpoint management balances security, user productivity, recoverability and privacy. An overly broad wipe policy can destroy personal data; weak ownership controls can expose corporate resources. MD-102 preparation should explain how those outcomes arise and how to prevent them.

Establish device identities and enrollment models

Before deploying settings, define who owns devices and how users authenticate. Microsoft Entra join, registration and hybrid join have different relationships to organizational identity. Intune enrollment methods also vary by platform and ownership model. Windows Autopilot can provision managed machines, while other workflows are appropriate for mobile or existing devices. Select the method based on lifecycle needs and the actual capabilities supported by the device type.

Enrollment does not equal trust. A device may appear in the management inventory but lack a required security baseline, encryption or current updates. Evaluate device compliance separately from identity and network access. Conditional Access can require a compliant device for particular resources, but administrators must test emergency recovery paths so a faulty policy does not lock the entire organization out. Intune compliance and Conditional Access illustrates the distinction between managing a device and deciding whether it may access an application.

A good rollout test includes new devices, existing devices, remote employees and lost devices. Verify how assignment groups are evaluated and how conflicts are reported. A laptop receiving two settings policies with contradictory configurations may never reach the intended state. Avoid adding an overriding broad policy until the conflicting scope and settings are understood; otherwise the estate becomes harder to support with each emergency workaround.

Deploy policies and applications predictably

Configuration profiles can set Windows and mobile device behavior, but device model, OS version and enrollment context influence results. Prefer a baseline with documented exceptions over dozens of overlapping profiles. Record why a policy exists and who owns changes. If an application stops working after a security setting is deployed, investigate the actual effective settings and platform logs rather than disabling all protections.

Application management spans deployment, updates, uninstall rules, app configuration and protection policies. A company can require an accounting application on corporate laptops while allowing personal devices to access data only through a managed mobile app. Application protection and full device management are not interchangeable; their benefits and privacy implications differ. Test both managed and unmanaged app paths, including copy/paste restrictions and saving organizational content to personal storage.

Windows Autopilot deployment profiles and device preparation approaches have different stages and requirements. The Autopilot deployment choices become especially important during migrations because a device may still have old enrollment artifacts or assignments. When a new laptop stalls during provisioning, inspect profile assignment, identity synchronization, enrollment restrictions and network dependencies before performing repeated resets.

Protect endpoints without interrupting legitimate access

Intune policies can configure antivirus, firewall, encryption, attack-surface reduction and application controls. Security baselines are starting points, not proof that every organization's risk is addressed. Protect BitLocker recovery keys and establish a tested process for authorized recovery. A change to device encryption policy may be successful for new devices but leave older machines in inconsistent states; monitoring needs to find that gap.

Microsoft Defender for Endpoint integration can expose alerts and device risk signals, while Intune applies management and compliance actions. Those products serve complementary roles. A machine generating suspicious behavior may need investigation and containment even while its compliance report appears green. Conversely, an application incompatibility triggered by a legitimate update should be diagnosed before a security control is removed. Document a process that connects security operations and endpoint support.

Local administrator management is also critical. Windows LAPS helps rotate local administrator credentials and reduce reuse risk, but permission to retrieve those credentials must be restricted and auditable. A help-desk technician may need a temporary recovery capability, not permanent standing access to every organization's local admin secret. Review what access logs and approvals can prove during an incident. Least privilege applies to support operations as much as to ordinary employees.

Manage Windows updates and device reliability

Update rings, quality updates, feature updates and application deployment schedules have different risk profiles. An organization may stage updates across pilot, broad and critical-device groups, with rollback procedures for compatibility failures. Updating all devices on the same morning can create a support crisis if a business-critical driver fails. Evaluate rollout health, restart behavior and version distribution before moving a deployment to the next group.

Windows Autopatch and other managed update capabilities reduce repetitive operations but still require governance. Define exclusion criteria, maintenance windows and evidence for approval. Modern endpoint management should measure the user impact of updates: a device that has a patch installed but restarts during a customer presentation is not an operational success. Monitor installation failures and user experience rather than only compliance percentages.

Cloud PC environments introduce another device model. Windows 365 provisioning through Intune requires attention to identity, licensing, networking, image choice and user assignment. Troubleshoot connection issues and application behavior separately from physical device problems. A Cloud PC may be healthy while the local device's network or authentication state blocks access.

Use diagnostics and automation with appropriate limits

Endpoint Analytics, device diagnostics, event logs and troubleshooting views help administrators identify failed deployments, slow startup and unreliable applications. Collect evidence from the affected device and its assignment context rather than applying a generic reset. A sudden rise in reboot loops after a driver change should trigger evaluation of the update rollout before hundreds of users repeat the same incident. Use representative metrics and affected-device groupings to determine scope.

PowerShell, Microsoft Graph and remediation scripts enable repetitive management tasks to scale. Automation should first detect the actual problem, act narrowly and report whether the correction succeeded. A script that resets a service every morning without checking why it fails hides the root cause. Graph and PowerShell automation in Intune is most useful when it includes scoped permissions, audit logging, testing and rollback.

Remote actions such as retire, wipe, restart or key rotation can have serious consequences. Establish who may initiate each action, how users are notified and which scenarios permit emergency overrides. Retiring a personal device and fully wiping a corporate-owned device are different operations. The endpoint administrator should confirm ownership and the expected data impact before performing destructive actions.

One demanding endpoint scenario is a contractor whose company-owned laptop fails during international travel. The device may be unable to contact the expected enrollment service, while the user's MFA method depends on the same failed laptop. The administrator should investigate connectivity, identity, device state and conditional-access policy in a deliberate sequence. Granting a permanent broad exception may restore access quickly but leave a weak route into corporate resources. Use a time-bound, approved recovery path and remove it after the root cause is corrected.

Device retirement also requires information-handling precision. A personal phone may contain both corporate app data and family photographs. When a contractor leaves, a selective corporate-data removal is a different action from a device wipe. Verify enrollment and ownership classification before initiating the action, confirm what will be deleted and document approval. Endpoint automation should never make a destructive decision solely from a user name appearing on a departure list.

A useful monthly review compares device compliance with operational health. Machines can appear compliant while experiencing failed business application updates, slow startup or repeated VPN disconnects. Correlate Endpoint Analytics, help-desk reports and security alerts to identify systemic issues. Improvement might require a driver update, a better configuration assignment or application packaging changes. Managing the estate responsibly means reducing both security risk and recurring user disruption.

A final troubleshooting case combines compliance and application delivery. A device can be marked noncompliant because a monitoring signal is stale even though its user reports that encryption and antivirus are active. Investigate check-in status, policy targeting, device health and enrollment before overriding the rule. If an urgent access exception is authorized, scope it narrowly, record the reason and schedule removal. The goal is to restore legitimate work without teaching the organization to bypass inconvenient controls.

Practice MD-102 with failure and recovery scenarios

Set up a controlled Intune lab with distinct device types and user personas. Enroll a Windows machine, deploy configuration and security policies, assign an application and test conditional access. Introduce a conflicting setting, an expired credential or an app installation failure; inspect reports before fixing it. Stage a quality update and document how failed devices are identified and recovered. Use a synthetic lost-device case to rehearse the authorized response.

Review the Microsoft MD-102 study guide before booking, particularly the October 27, 2026 revision. A competent candidate can connect identity, enrollment, policy, applications and monitoring into one lifecycle. The goal is secure, supportable endpoints that remain productive after users change roles, devices are replaced, and software updates alter the operating environment.