MD-102 study plan
MD-102 · Give each week a clear focus.
8 weeks · About 7 hours per week
Prepare infrastructure for devices
Compare Microsoft Entra ID join, Entra hybrid join, and Entra registration, then select the correct join type for five written device scenarios
Stand up a trial Microsoft Intune and Entra ID tenant and enroll one Windows 11 virtual machine through manual MDM enrollment
Configure automatic MDM enrollment by setting the Entra ID MDM user scope and a Group Policy or enrollment status page, then verify the device appears as managed
Assign Intune licenses, create two Entra groups, and apply a scope tag to a test policy to confirm targeting works
Your checkpoint
A one-page enrollment decision matrix covering all five scenarios plus a tenant inventory sheet listing the enrolled test device, its join type, both groups, and the scope tag applied
Prepare infrastructure for devices
Capture a device hardware hash with the Get-WindowsAutopilotInfo script, import it, and create a Windows Autopilot deployment profile with a defined Enrollment Status Page
Configure a Windows Update ring for quality updates and a separate feature update policy, and record the deferral, deadline, and active hours values
Configure Delivery Optimization bandwidth settings and document which download mode you chose and why
Describe the prerequisites for certificate delivery by comparing SCEP with the Intune certificate connector and NDES against PKCS imported certificates with the PFX connector
List the onboarding prerequisites for Apple Automated Device Enrollment (APNs certificate, Apple Business Manager) and Android Enterprise (managed Google Play binding)
Your checkpoint
An Autopilot deployment checklist containing the captured hardware hash record, every deployment profile setting, and the full table of update ring, feature update, and Delivery Optimization values
Manage and maintain devices
Build two configuration profiles, one from the settings catalog and one from a template, applying device restrictions and an endpoint protection baseline, then assign them to the test group
Create one dynamic user group and one dynamic device group using membership rules, and confirm each resolves the expected member count
Define an Intune role-based access control assignment for a helpdesk persona using a built-in role plus a scope tag
Execute the sync, restart, remote lock, and Fresh Start remote actions on the test device and record the observed behavior of each
Retire a test device and document the data that is removed versus retained
Your checkpoint
A policy register spreadsheet listing every profile created, each setting changed from default, its assignment target, and a remote-action cheat sheet with the observed outcome of all five actions
Manage and maintain devices & Protect devices
Create a compliance policy with a grace period, noncompliance actions, and settings that feed a conditional access rule, then prove a noncompliant device is blocked
Configure a BitLocker disk encryption policy that escrows recovery keys to Entra ID and verify the key appears in the device record
Deploy a Windows LAPS policy with password rotation and backup directory settings and confirm the password is retrievable by an authorized role
Configure a driver update policy or Windows Autopatch enrollment and explain when each option is the better fit
Remediate the blocked test device so conditional access grants access again and capture both states
Your checkpoint
A compliance-to-conditional-access flow diagram plus an exported settings list for the BitLocker and LAPS policies and a written record of the blocked-then-remediated access test
Protect devices
Connect Intune to Microsoft Defender for Endpoint and onboard the test Windows device, confirming it appears in the Defender device inventory
Configure attack surface reduction rules, Microsoft Defender Antivirus policy settings, and a firewall policy, then review the resulting per-setting conflict report
Apply the MDM security baseline and produce a side-by-side comparison of at least five settings you changed versus the baseline default
Configure Windows Hello for Business and an authentication method policy that enforces multifactor authentication for device enrollment
Create an app control or exploit protection policy and document at least three settings that could break line-of-business applications
Your checkpoint
A security configuration workbook containing the Defender onboarding proof, the ASR and antivirus policy values, a five-row baseline comparison table, and an authentication policy summary
Manage and secure applications
Package an installer with the IntuneWinAppUtil tool and deploy it as a Win32 app with a file-based detection rule and a requirement rule
Deploy Microsoft 365 Apps as an Intune app and set the update channel through a policy
Configure an app protection policy for unenrolled iOS or Android devices, including data transfer and conditional launch settings
Add an app configuration policy for a managed app and a dependency or supersedence relationship between two Win32 apps
Document the uninstall command and assignment behavior, including required, available, and uninstall group targeting, for each deployed app
Your checkpoint
An app catalog spreadsheet covering at least five apps, each with deployment type, install and uninstall commands, detection rule, requirement rule, and assignment intent
Optimize endpoint operations by using automation, monitoring, and reporting
Write and deploy a PowerShell platform script, then author one remediation script pair with separate detection and remediation logic and confirm it reports as remediated
Configure Endpoint analytics and interpret the startup performance and work-from-anywhere scores for the enrolled device
Query device compliance and app install status data with Microsoft Graph and export the results to a file
Configure diagnostic settings that route Intune or device logs to an Azure Monitor Log Analytics workspace, or document the supported alternative if the connector is unavailable in your tenant
Build a recurring report that lists noncompliant devices and their failing settings
Your checkpoint
Two working scripts with their detection logic documented, plus a two-page operations report containing the endpoint analytics scores, the exported Graph query results, and the noncompliant device list
Prepare infrastructure for devices & Manage and maintain devices & Protect devices & Manage and secure applications & Optimize endpoint operations by using automation, monitoring, and reporting
Complete a full-length timed practice exam and record the score broken out by all five domains
Rebuild a ranked list of your five weakest objectives and remediate each one with a hands-on tenant task
Recite the exact configuration path and required settings for your twenty most-missed tasks without consulting notes
Re-test every objective that scored below 80 percent and confirm the score improves
Your checkpoint
A practice exam scorecard showing the overall percentage, a per-domain breakdown, and a remediation log with one completed hands-on task per weak objective
Milestones
Week 2: Your test Windows device was enrolled manually, then re-provisioned or verified through an Autopilot deployment profile, and you can explain every setting in the update ring without notes
Week 4: A conditional access rule successfully blocked your noncompliant test device and granted access again after remediation, with the BitLocker recovery key visible in the device record
Week 6: The device is onboarded to Defender for Endpoint, at least five apps are deployed with working detection rules, and a timed 40-question practice set across domains 1 through 4 scores 80 percent or higher
Week 8: A full-length timed practice exam scores 85 percent or higher overall with no single domain below 80 percent, and every weak objective has a completed hands-on remediation task