How to pass Microsoft 365 Certified: Endpoint Administrator Associate (MD-102)

How this exam thinks

What each domain tests and how to study it

The MD-102 blueprint is split across 5 domains. Weights are the official share of the exam; see the official exam guide for the authoritative breakdown.

1. Prepare Infrastructure for Devices

   23% of exam

   What you must be able to do. Choose the right identity join type and enrolment path for a given platform and ownership model, then scope who can administer what and prove device health before access is granted.

   In one sentenceEverything that happens before a device is managed: how it gets an identity in Microsoft Entra ID, how it enrols into Intune on its platform, and how administration, compliance and access are scoped around it.

   Recall check: answer these from memory first

   • State the practical difference between a Microsoft Entra registered device and a Microsoft Entra joined device, and name a scenario that calls for each.
   • Name the integration required for corporate enrolment of iOS devices, and the one required for zero-touch Android enrolment.
   • Say what a scope tag controls and what an Intune role controls, in one sentence each.
   • Describe what an enrolment restriction can test and when it is evaluated.

   What it tests. Device identity in Microsoft Entra ID and the difference between registering, joining and hybrid joining, plus dynamic device group rules that target the resulting objects. Enrolment for every platform Intune supports: automatic enrolment for Windows, personal enrolment for macOS, iOS and iPadOS, the Android enrolment profiles for fully managed, dedicated and work profile devices, corporate enrolment through Apple Business Manager, and Android enrolment through Samsung Knox Mobile Enrollment or Google Zero Touch. It also covers enrolment restrictions and enrolment failure troubleshooting, built-in and custom Intune roles with their assignments, scope tags and scoped administration, multi-admin approval, compliance policies, Conditional Access policies that require a compliant device, Windows Hello for Business, Windows LAPS and management of local group membership.

   How to study it. Start with a table you build yourself: one row per platform and ownership model, one column each for the enrolment method, the prerequisite integration and the restriction that would block it. Most questions in this domain resolve to a cell in that table. Then separate the three scoping mechanisms in your head, because the exam mixes them deliberately: a role decides what an administrator can do, a scope tag decides which objects an administrator can see, and the group an assignment targets decides which devices are affected. Finish on the compliance and Conditional Access pairing, and be able to say what happens in the gap between a device falling out of compliance and access being blocked.

   Easy to confuse

   • Microsoft Entra registered versus Microsoft Entra joined. Registration adds a device identity while the device keeps its own primary sign-in, which fits personal devices; joining makes the device sign in with the organisational account and is for corporate-owned Windows devices. If the scenario says the user keeps signing in with a personal or local account, registration is the answer.
   • Compliance policy versus device configuration profile. A configuration profile sets a setting on the device; a compliance policy evaluates the device and reports a compliant or non-compliant state that Conditional Access can act on. A requirement to block access needs the compliance policy and a Conditional Access policy, not a stricter configuration profile.
   • Enrolment restriction versus compliance policy. An enrolment restriction is evaluated once, at enrolment, and tests platform, ownership and operating system version only. A compliance policy is evaluated continuously afterwards and can test far more. A requirement about devices already enrolled is never solved by an enrolment restriction.
   • Custom Intune role versus scope tag. They answer different halves of least privilege. The role limits the permitted actions, the scope tag limits the visible objects. A requirement to let a regional team manage only its own devices needs both, and an answer offering only one of them is incomplete.

   Worked example from the MD-102 bank

   lock_openFree samplePrepare Infrastructure for Deviceshard

   An Intune role assignment is created from the Help Desk Operator built-in role. The assignment lists the group HelpdeskAdmins as its members, a group named PerthDevices as its scope (groups), and the Default scope tag. What does the scope (groups) part of that assignment determine?

   • AWhich users and devices the assigned administrators are permitted to apply those permissions to.check_circle Correct
   • BWhich administrator accounts receive the permissions that the Help Desk Operator role carries.
   • CWhich Intune objects, such as configuration profiles and apps, the assigned administrators can see.
   • DWhich remote device actions, such as restart and sync, the assigned administrators are able to run.

   An Intune role assignment separates who holds the role, which users and devices it reaches, and which objects the admin can see. An Intune role assignment is made of three independent parts: members, who hold the role; permissions, drawn from the role definition, which decide the actions; and scope (groups), which decides the users and devices those actions may target. Scope tags are a fourth, separate control that governs which Intune objects the administrator can view.

   Why A is correct: Correct. The scope (groups) of a role assignment is the population of users and devices the assignment reaches, so the helpdesk can act only on members of PerthDevices.

   Why B is wrong: Tempting because members and scope both name Microsoft Entra ID groups, so the two fields look interchangeable. The administrators who receive the permissions are the members of the assignment, which here is HelpdeskAdmins, not the scope.

   Why C is wrong: Tempting because visibility really is restricted in Intune role-based access control, but that job belongs to scope tags. An administrator sees an object when a scope tag on the object matches a scope tag on the assignment.

   Why D is wrong: Tempting because the helpdesk experience is built from remote actions, but the set of allowed actions comes from the permissions in the role definition. The scope decides the targets of those actions, not the actions themselves.

2. Manage and Maintain Devices

   28% of exam

   What you must be able to do. Deploy Windows clients with the right Autopilot path, configure devices on every platform through targeted profiles, add the Intune Suite capabilities where a requirement calls for them, and drive the estate day to day with remote actions.

   In one sentenceThe largest domain and the operational heart of the exam: provisioning Windows clients, shaping devices with configuration profiles and filters, and acting on them remotely once they are running.

   Recall check: answer these from memory first

   • Given a shared kiosk device that nobody signs in to during setup, name the Autopilot deployment mode and say why.
   • State what retire removes and what wipe removes, and say which one leaves personal data intact.
   • Explain when an assignment filter is the right targeting tool and when a group is.
   • Name the Intune Suite capability that issues and monitors certificates without an on-premises certificate authority.

   What it tests. Windows deployment through Windows Autopilot, including the choice between an Autopilot deployment profile and a device preparation policy, the deployment modes of user-driven, pre-provisioning and self-deploying, device name templates and the Enrollment Status Page. It covers Windows 11 upgrades through Intune, provisioning and configuring Windows 365 Cloud PCs, and Windows Backup for Organizations. On configuration it covers profiles for Windows including imported ADMX files and Group Policy analytics, profiles for Android, iOS, iPadOS and macOS, profiles for specialty devices such as Teams Rooms, HoloLens 2 and Zebra, and targeting through assignment filters and enrolment time grouping. It adds the Intune Suite capabilities: Endpoint Privilege Management, the Enterprise App Catalog, Remote Help, Microsoft Cloud PKI, Microsoft Tunnel for Mobile Application Management and Advanced Analytics. Finally it covers remote actions: sync, restart, retire and wipe, bulk remote actions, updating Microsoft Defender Antivirus security intelligence, rotating BitLocker recovery keys and local administrator passwords, running a device query with KQL and collecting diagnostics.

   How to study it. This is the heaviest domain, so give it the most time and study it in three passes. First the Autopilot decision tree, until you can pick a mode from a scenario in one read: who is present at first boot, whether the device is shared, and whether the provisioning work should happen before the user ever sees it. Second, profile targeting, where the reliable question is whether the requirement describes a property of the device evaluated at assignment time, which is a filter, or a group the device belongs to, which is membership. Third, the remote actions, learning each one by what survives it: what remains on the device, what company data is removed and whether the device stays enrolled. The retire and wipe distinction alone is worth the study time.

   Easy to confuse

   • Retire versus wipe. Retire removes company data and management and leaves the user's personal data on the device; wipe returns the device to factory state and takes everything with it. A bring-your-own device scenario that must not destroy personal photographs is always retire.
   • Autopilot deployment profile versus device preparation policy. The deployment profile is the established path keyed to hardware identity registered in advance; device preparation is the newer approach that provisions from a policy targeted at users without pre-registering the hardware. A scenario stressing that hardware hashes cannot be collected in advance points at device preparation.
   • Pre-provisioning versus self-deploying mode. Pre-provisioning does the heavy work on a technician's bench and then hands a partly configured device to a user who completes it with their own credentials; self-deploying completes with no user credentials at all and suits shared or kiosk devices. The tell is whether a user signs in at the end.
   • Assignment filter versus dynamic device group. A filter is evaluated per assignment against device properties at the moment the policy applies, so one group can be narrowed different ways for different policies. A dynamic group is membership, recalculated on its own schedule, and every assignment to it sees the same set. Requirements that vary the target per policy call for filters.

   Worked example from the MD-102 bank

   lock_openFree sampleManage and Maintain Deviceshard

   An organisation is comparing classic Windows Autopilot deployment profiles with Windows Autopilot device preparation policies before it rebuilds its provisioning process. Which statement correctly describes how each approach identifies the device that is about to be provisioned?

   • ABoth approaches require the device hardware identity to be imported into the tenant list of Autopilot devices first, and both then deliver their settings to that device during the out-of-box experience.
   • BA device preparation policy is assigned to a device group whose membership comes from imported hardware identities, while a classic deployment profile is assigned to the user who signs in during the out-of-box experience.
   • CA device preparation policy identifies the device by its domain join configuration, so the device has to be joined to Active Directory before the policy applies and no registration in the tenant is required.
   • DA classic deployment profile is delivered to a device that was registered as an Autopilot device in the tenant beforehand, while a device preparation policy is assigned to a user group and depends on Intune adding the provisioned device to a device group that it owns.check_circle Correct

   A classic Autopilot profile finds a pre-registered device identity, while a device preparation policy is user assigned and populates its device group during provisioning. The two approaches differ at the point where device and policy meet. A deployment profile is matched to a hardware identity that already exists in the tenant, so registration is a prerequisite and an unregistered machine simply runs a normal out-of-box experience. A device preparation policy is assigned to a user group, so the policy is resolved from the account signing in, and Intune adds the machine to the device security group it owns during provisioning, which removes the registration prerequisite entirely.

   Why A is wrong: It is tempting because hardware identity import is the step most administrators associate with Autopilot, and it is genuinely mandatory for a classic deployment profile. It is wrong because a device preparation policy provisions a device that was never imported, which is the main reason the newer approach exists.

   Why B is wrong: It is tempting because a device preparation policy does involve a device group, so that group looks like the targeting object. It is wrong because the assignment is made to a user group and the device group is populated by Intune during provisioning, and a classic deployment profile targets registered devices rather than users.

   Why C is wrong: It is tempting because hybrid scenarios do rely on a domain join configuration to complete provisioning. It is wrong because device preparation provisions a Microsoft Entra joined device and does not identify it through an on-premises domain join at all.

   Why D is correct: Correct. The classic flow matches a device to a profile using the device identity already held in the tenant, so an unregistered device receives nothing. Device preparation inverts that: the signed-in user carries the policy, and Intune places the device into the security group it owns as part of provisioning.

3. Protect Devices

   18% of exam

   What you must be able to do. Configure the endpoint security stack in Intune for the requirement in front of you, and run an update strategy that is predictable across Windows, Android, iOS, iPadOS and macOS.

   In one sentenceTwo halves that the exam treats as one: the endpoint security policies that harden a device, and the update mechanisms that keep it current on its own platform.

   Recall check: answer these from memory first

   • State the difference between a feature update and a quality update, and name the policy type that controls each.
   • Say what happens when a security baseline and an endpoint security policy configure the same setting differently.
   • Explain what Hotpatch changes about the restart behaviour of a Windows quality update.
   • Name the mechanism that lets a user recover their own BitLocker key without contacting the service desk.

   What it tests. Endpoint security through Intune: antivirus policies, disk encryption policies including BitLocker recovery key management, user self-service recovery and encryption compliance monitoring, firewall policies, attack surface reduction policies, security baselines, integration with Microsoft Defender for Endpoint including endpoint detection and response policies and device onboarding, and App Control for Business policies. On updates it covers planning updates with Intune, update rings and feature and quality updates for Windows, Windows Autopatch and Hotpatch policies, update policies for iOS, iPadOS and macOS through the settings catalog, Android updates through configuration profiles or firmware over the air deployments, Delivery Optimization, and monitoring update rollout.

   How to study it. Split your revision the way the domain splits. For security, learn each policy type by the requirement it uniquely satisfies, and learn where a security baseline sits relative to the individual policies, because the exam likes a scenario where a baseline and a policy set the same setting differently. Practise the conflict question until the resolution rule is automatic. For updates, build a small comparison of what each platform actually permits an administrator to force, because the platforms genuinely differ: what Intune can compel on a corporate-owned Android device is not what it can compel on a personally owned handset, and answers that assume Windows behaviour on a mobile platform are a standard distractor family. Finish on deferral, deadline and grace period, which decide a surprising number of update questions.

   Easy to confuse

   • Security baseline versus individual endpoint security policy. A baseline is a large recommended set of settings applied as one object; an endpoint security policy configures a focused area. Both write the same underlying settings, so applying both to one device is how conflicts arise, and the exam tests whether you know that the more restrictive or conflicting value leaves the setting in a conflict state rather than silently merging.
   • App Control for Business versus attack surface reduction rules. App Control for Business decides which code is allowed to run at all, based on publisher, path or hash. Attack surface reduction rules block specific risky behaviours by applications that are already permitted to run, such as Office spawning a child process. A requirement to allow only approved applications is App Control; a requirement to stop a named behaviour is a reduction rule.
   • Update ring deferral versus deadline. A deferral delays when an update is offered to the device; a deadline forces installation and restart once the update has been offered and the grace period has elapsed. A requirement that updates must be installed by a certain point is a deadline, not a shorter deferral.
   • Windows Autopatch versus update rings you manage yourself. Autopatch takes over the sequencing and progressive rollout of updates on the organisation's behalf; self-managed rings leave the rollout schedule and the ring membership as your design. Scenarios that ask to reduce ongoing administrative effort on update sequencing point at Autopatch.

   Worked example from the MD-102 bank

   lock_openFree sampleProtect Deviceshard

   A Windows 11 device is enrolled in Microsoft Intune and is already onboarded to Microsoft Defender for Endpoint. A third-party antivirus product is then installed on it and registers itself with Windows as the active antivirus solution. Which statement correctly describes the resulting state of Microsoft Defender Antivirus on that device?

   • AIt moves into passive mode, so real-time protection is handed to the third-party product while the built-in engine keeps receiving security intelligence updates, can still run on-demand scans, and reports what it sees to Defender for Endpoint.check_circle Correct
   • BIt is switched off entirely by the third-party installation and stops scanning, so nothing Microsoft Defender Antivirus does can be observed until the third-party product is uninstalled from the device.
   • CIt remains the active antivirus solution alongside the third-party product, so two real-time engines inspect the same file operations and the device is protected by both engines at once.
   • DIt is uninstalled from the device by Windows as soon as another antivirus product registers, and it can be brought back solely by rebuilding the device or by repairing the operating system image.

   Recognise that a third-party antivirus places Microsoft Defender Antivirus into passive mode on a Windows client onboarded to Microsoft Defender for Endpoint, not into a disabled state. The mode Microsoft Defender Antivirus falls into when another product registers as the active antivirus depends on whether the device is onboarded to Microsoft Defender for Endpoint. Onboarding keeps the built-in engine loaded in passive mode, so it continues to update, remains available for on-demand scanning and keeps feeding signal to the service, while the third-party product owns real-time protection. Without onboarding the built-in engine would instead be disabled, which is why the onboarding state, and not the presence of the third-party product alone, decides the answer.

   Why A is correct: Correct. On a Windows client that is onboarded to Microsoft Defender for Endpoint, installing a third-party antivirus places Microsoft Defender Antivirus in passive mode rather than disabling it, which preserves updates, on-demand scanning and reporting while the third-party product owns real-time protection.

   Why B is wrong: This is tempting because it describes what happens on a Windows client that has not been onboarded to Microsoft Defender for Endpoint, where the built-in engine does step aside completely. It is wrong here because onboarding changes that outcome, leaving the engine running in a reduced role rather than switched off.

   Why C is wrong: This is tempting because layered protection sounds safer and administrators often assume both engines simply coexist. It is wrong because Windows recognises a single registered real-time antivirus solution, and running two real-time engines against the same file operations is not the supported design.

   Why D is wrong: This is tempting because third-party security products often insist that competing agents be removed before installation. It is wrong because Microsoft Defender Antivirus is a built-in platform component that is not uninstalled when another product registers; its mode changes instead.

4. Manage and Secure Applications

   18% of exam

   What you must be able to do. Get an application onto the right devices in the right way, and protect the organisational data inside it whether or not the device is enrolled.

   In one sentenceApplication delivery through Intune on every platform, and the app protection and app configuration policies that govern data once the application is running.

   Recall check: answer these from memory first

   • State what an app protection policy controls and what an app configuration policy controls, in one sentence each.
   • Name the requirement that makes app protection without enrolment the only workable answer.
   • Explain the difference between a required and an available assignment for an application.
   • Say what a detection rule is for and name the most common reason an installation reports failure when the software is present.

   What it tests. Preparing and deploying applications with Intune: Win32 applications, line-of-business applications and Microsoft Store applications, Quiet Time policies for Android and iOS applications, deploying Microsoft 365 Apps through Intune, configuring policies for Office applications through Intune or the Microsoft 365 Apps admin center, deploying Microsoft 365 Apps as part of a Windows Autopilot deployment including the Office Deployment Tool, deploying from platform stores through the Apple Volume Purchase Program and managed Google Play, and monitoring deployment status and troubleshooting installation failures. It also covers app protection policies for managed and unmanaged devices, Conditional Access policies that require an approved application or app protection policy, and app configuration policies for managed apps and for managed devices.

   How to study it. Learn the Win32 application anatomy properly, because it carries the troubleshooting questions: the packaged installer, the install and uninstall commands, the detection rule, the requirement rule, and the relationships of dependency and supersedence. Most installation failure scenarios in this domain resolve to a detection rule that does not match what the installer actually leaves behind. Then hold the two policy families apart deliberately: an app protection policy governs what a user can do with organisational data inside a managed application, and an app configuration policy sets the application's own settings. The exam's favourite scenario is a personally owned device that must not be enrolled, which rules out everything except the app protection layer.

   Easy to confuse

   • App protection policy versus app configuration policy. Protection governs organisational data inside the application, controlling actions such as copy, paste, save-as and backup; configuration delivers settings to the application itself, such as a server address or a default account. A data leak requirement is protection, a setup requirement is configuration.
   • Managed devices versus managed apps for app configuration. The managed devices variant is delivered through enrolment and can rely on the device management channel; the managed apps variant reaches applications on devices that are not enrolled. If the scenario refuses enrolment, only the managed apps variant is available.
   • Dependency versus supersedence. A dependency is another application that must be present before this one installs; supersedence replaces or upgrades an earlier application, optionally uninstalling it. A requirement to move users from an old version to a new one is supersedence, not a dependency.
   • Required versus available assignment. Required installs the application without the user asking; available places it in the Company Portal for the user to install on demand. A scenario that says the application must appear on the device without user action rules out available.

   Worked example from the MD-102 bank

   lock_openFree sampleManage and Secure Applicationsmedium

   An administrator prepares a desktop application that ships as a setup executable with several supporting files, ready for deployment to Windows 11 devices with Microsoft Intune, and runs the Microsoft Win32 Content Prep Tool against the source folder. What does that tool produce, and what does it leave the administrator to define?

   • AIt converts the source installer into an MSIX package so that the Windows servicing stack installs and removes the application, leaving the administrator to choose an assignment group and nothing further about the install itself.
   • BIt inspects the source installer and writes the detection rules automatically from the product code that it finds, leaving the administrator to supply an install command but no rule that proves the application is present on the device.
   • CIt uploads the packaged payload straight into the tenant and creates the application record there, leaving the administrator to assign groups without ever attaching a package file to an app in the Microsoft Intune admin center.
   • DIt wraps the installer and its supporting files into an encrypted .intunewin package that the Intune Management Extension decrypts on the device, leaving the administrator to declare the install command, the uninstall command and the detection rules in Intune.check_circle Correct

   The Win32 Content Prep Tool only builds an encrypted .intunewin package; install behaviour and detection are authored on the app record in Intune. The content prep tool takes a source folder and a named setup file and emits a single encrypted .intunewin container. The Intune Management Extension downloads that container to the device, decrypts it, extracts it to a temporary location and runs whatever install command the app record carries. Because the package is opaque, Intune learns nothing about the application from it, so the install command, the uninstall command, the requirement rules and the detection rules all have to be stated separately when the app is created.

   Why A is wrong: Tempting because MSIX is a genuine modern packaging format for Windows applications and Intune can deploy MSIX line-of-business packages. Conversion to MSIX is the job of the MSIX Packaging Tool; the content prep tool changes the container, not the installer technology inside it.

   Why B is wrong: Tempting because detection based on an MSI product code is a real option on a Win32 app, so it feels as though the packaging step could fill it in. The tool performs no inspection of that kind, and an app saved with no detection rule cannot report an installed state.

   Why C is wrong: Tempting because the tool is run with tenant deployment in mind and the output file is useless anywhere else. The tool is an offline packager with no connection to the tenant, and the .intunewin file it writes has to be uploaded by hand when the app is added.

   Why D is correct: Correct. The tool only builds and encrypts the content package. Everything that describes how the payload behaves, meaning the command line that installs it, the command line that removes it and the rule that proves it is present, is authored on the app record in Intune.

5. Optimize Endpoint Operations by Using Automation, Monitoring, and Reporting

   13% of exam

   What you must be able to do. Replace repetitive administration with automation, and answer questions about the estate from Intune reporting and Endpoint Analytics rather than from anecdote.

   In one sentenceThe skill area added in the July 2026 refresh: automating Intune with PowerShell and Microsoft Graph, working with the agentic tooling now surfacing in Intune, and monitoring device health, reliability and tenant service state.

   Recall check: answer these from memory first

   • Describe the two halves of a remediation and say what decides whether the second one runs.
   • Name the place you would look to answer a complaint that devices are slow to start, and the place you would look to find out whether a service problem is Microsoft's.
   • Say what a custom compliance script adds that a built-in compliance setting cannot.
   • State the difference between a report exported from the console and the same data retrieved through Microsoft Graph.

   What it tests. Automating Intune management tasks with PowerShell and Microsoft Graph, extending device compliance with PowerShell through custom compliance scripts, and working with Security Copilot agents in Intune to investigate identified threats, analyse device performance and respond to agent recommendations. On the monitoring side it covers reporting and data visibility in Intune including customised reports and filters, workbooks and dashboards and exporting reporting data, Endpoint Analytics including proactive remediations, device health scores and application startup performance, configuring and managing remediation scripts with their detection and remediation halves and their schedules, analysing endpoint reliability and user experience scores, monitoring tenant health and Intune service communications through the service health dashboard and the message center, and configuring alert rules for compliance drift, enrolment failures and configuration conflicts.

   How to study it. The smallest domain by weight, and the one most candidates under-prepare because it is new. Two things pay for the study time. First, Remediations: know that a remediation is a pair of scripts, a detection script whose exit behaviour decides whether the remediation script runs, and that this is the mechanism for fixing a condition rather than merely reporting it, which is what makes it the answer whenever a scenario asks to detect and correct without user involvement. Second, know where each answer about the estate comes from: compliance reporting for policy state, Endpoint Analytics for startup performance and reliability, the service health dashboard and message center for problems that are Microsoft's rather than yours. On the agentic material, learn what the agents are for at the level the study guide states and no further, and treat any option asserting a specific automatic action by an agent with suspicion.

   Easy to confuse

   • Remediation script versus configuration profile. A configuration profile sets a setting and keeps it set through the management channel; a remediation detects an arbitrary condition and runs code to correct it on a schedule. If the condition cannot be expressed as a setting, or the fix is a sequence of actions, it is a remediation.
   • Custom compliance script versus a remediation. A custom compliance script extends what compliance can evaluate and returns a state that Conditional Access can act on; it reports and does not fix. A remediation fixes and does not feed compliance. A requirement to block access on a condition needs the compliance route.
   • Endpoint Analytics scores versus compliance status. Endpoint Analytics measures experience, such as startup time, reliability and application performance, and never gates access. Compliance measures policy conformance and does gate access through Conditional Access. A poor analytics score is not a compliance failure.
   • Service health dashboard versus the message center. The service health dashboard reports incidents happening now that affect the service; the message center announces upcoming changes and required actions. A question about preparing for a change that has not landed yet is the message center.

   Worked example from the MD-102 bank

   lock_openFree sampleOptimize Endpoint Operations by Using Automation, Monitoring, and Reportingmedium

   Windows 11 devices enrolled in Microsoft Intune run an in-house agent that records its build number in a registry value. No built-in Intune compliance setting reads that value, and the security team requires that a device carrying a build below the approved minimum is reported as non-compliant and that the person using it is shown an explanation in the Company Portal. Select TWO items you must author and add to Intune to extend compliance in that way.

   • AA PowerShell discovery script, uploaded to the compliance scripts area of Intune, that reads the registry value on the device and writes the result it finds to its output.check_circle Correct
   • BAn Endpoint Analytics remediation script pair, made up of a detection script and a remediation script, assigned to the same group of Windows devices that runs the in-house agent.
   • CA JSON file of detection rules, attached to the custom compliance setting of a Windows compliance policy, that states the comparison to make and the message to show the user.check_circle Correct
   • DA Win32 app detection rule that reads the same registry value, added to the Intune app that installs the in-house agent on each of the Windows devices in scope.
   • EA device configuration profile that writes the approved minimum build number into the registry of each Windows device before the compliance policy is next evaluated.

   Extending Intune device compliance to a value no built-in setting reads takes both a PowerShell discovery script and a JSON detection rules file. A custom compliance setting is deliberately split in two. The uploaded PowerShell discovery script executes on the enrolled device through the Intune management extension and reports the values it reads, while the JSON detection rules file attached to the Windows compliance policy declares how each reported value is compared and what the user is told when the comparison fails. Neither half produces a compliance verdict on its own.

   Why A is correct: A custom compliance setting has no way to read an arbitrary registry value on its own, so the discovery script is the component that runs on the device and reports the value back for evaluation.

   Why B is wrong: Remediations do run a detection script on the device and are a reasonable place to look, but their results are reported as remediation output and do not contribute to the compliance state a compliance policy publishes.

   Why C is correct: The JSON file is what turns a value the script reported into a compliant or non-compliant verdict, and it carries the remediation strings that the Company Portal presents to the user.

   Why D is wrong: A Win32 detection rule can certainly read a registry value, but it decides whether Intune considers that app installed, so it reports an app installation state rather than a device compliance state.

   Why E is wrong: This is the common confusion between configuring a device and evaluating it, and writing the approved value onto the device would destroy the evidence the compliance check is supposed to read.

A study plan that works

1. Read the current study guide and map your gaps

   Day 1

   Work through the published list of skills measured and mark every bullet as confident, shaky or new. The July 2026 refresh added a whole skill area on automation, monitoring and reporting and changed several groups, so material and courses written before it are incomplete by construction. Your marked list, not a generic syllabus, is the plan for the weeks that follow.

2. Get a tenant you can break

   Week 1

   Nothing in this exam sticks from reading alone. Set up a trial tenant with Intune, enrol at least one Windows device and one mobile device, and do the loop end to end: enrol, assign a configuration profile, assign a compliance policy, watch it report, then retire the device. Doing that once teaches more than a week of video.

3. Work the two heaviest domains first

   Weeks 2 to 3

   Managing and maintaining devices carries the most weight, and preparing infrastructure is close behind, so give them the front of your schedule while your attention is freshest. Build the platform-by-enrolment-method table yourself, walk the Autopilot decision tree until it is automatic, and get the retire and wipe distinction to the point where you never hesitate.

4. Take protection and applications together

   Weeks 4 to 5

   Endpoint security, updates and application delivery share the same distractor style, where two real mechanisms both nearly satisfy the requirement. Study them as pairs: baseline against individual policy, App Control against attack surface reduction, deferral against deadline, app protection against app configuration. Practise saying the discriminator aloud in one sentence.

5. Close the automation and reporting gap

   Week 6

   Spend focused time on the newest skill area rather than leaving it to the last night. Write and run a real remediation with its detection and remediation scripts, pull one report through Microsoft Graph, open Endpoint Analytics on your test device and read the scores, and learn what the Intune agents are described as doing without extrapolating beyond that.

6. Drill scenario questions and review every option

   Weeks 7 to 8

   Move to timed practice on questions you have not seen, and review the options you eliminated as carefully as the one you chose. When you get an item wrong, write down which layer you confused: identity, configuration, compliance, access or application. A pattern in those notes is worth more than a percentage score.

7. Sit a full timed mock and fix what it exposes

   Final week

   One full-length timed run under exam conditions, with no pausing to look things up, then a day spent only on what it exposed. Book when a mock on unseen questions clears every domain comfortably and your pacing leaves time to review the flagged items.

Know when you're ready

Exam-day tips

• Read the final sentence of the stem first. The constraint lives there, and it is what separates the one correct mechanism from three plausible ones.
• Check the platform and the ownership model in every scenario before comparing options. Answers that assume Windows behaviour on Android or iOS, or corporate behaviour on a personally owned device, are a standard distractor family.
• When a question says to choose two, treat it as two independent decisions and verify each against the requirement separately. Picking one strong option and one that merely sounds related is the most common way a multi-select item is lost.
• Prefer the least-privilege answer whenever the scenario mentions delegation or an administrator who should see or do less. A built-in role that grants more than the task needs is usually the distractor next to a custom role or a scope tag.
• Ask which layer the requirement names: setting state, reporting state, gating access or governing data inside an application. Most pairs of plausible options sit on adjacent layers and separate instantly once you name the layer.
• Treat retired product and console names in an option as a prompt to slow down. Azure AD, the Endpoint Manager admin center and Windows Defender Application Control all have current names, and an option resting on the old behaviour is often the wrong one.
• Flag and move on rather than fighting a long scenario. The questions are not weighted by how hard they feel, and time spent stuck is time taken from items you would have answered correctly.

Frequently asked questions

Related certifications

Other Cloud certifications with a study guide.

• Google Cloud Professional Data Engineer (PDE) study guideGoogle Cloud
• Microsoft Azure Administrator (AZ-104) study guideMicrosoft
• Microsoft Azure Data Fundamentals (DP-900) study guideMicrosoft
• Microsoft Power Platform Fundamentals (PL-900) study guideMicrosoft
• Microsoft 365 Administrator (MS-102) study guideMicrosoft
• Microsoft Power BI Data Analyst (PL-300) study guideMicrosoft
• Designing Microsoft Azure Infrastructure Solutions (AZ-305) study guideMicrosoft
• Designing and Implementing Microsoft DevOps Solutions (AZ-400) study guideMicrosoft
• Microsoft Azure Fundamentals (AZ-900) study guideMicrosoft
• AWS Certified Solutions Architect - Associate (SAA-C03) study guideAmazon Web Services
• AWS Certified CloudOps Engineer - Associate (SOA-C03) study guideAmazon Web Services
• AWS Certified Developer - Associate (DVA-C02) study guideAmazon Web Services
• AWS Certified Cloud Practitioner (CLF-C02) study guideAmazon Web Services
• AWS Certified Solutions Architect - Professional (SAP-C02) study guideAmazon Web Services
• Databricks Certified Data Engineer Associate study guideDatabricks
• AWS Certified DevOps Engineer - Professional (DOP-C02) study guideAmazon Web Services
• SnowPro Core Certification (COF-C03) study guideSnowflake
• Microsoft Fabric Analytics Engineer Associate (DP-600) study guideMicrosoft
• GitHub Actions (GH-200) study guideGitHub
• Microsoft Fabric Data Engineer (DP-700) study guideMicrosoft
• Tableau Certified Data Analyst (Analytics-DA-201) study guideTableau
• Kubernetes and Cloud Native Associate (KCNA) study guideCloud Native Computing Foundation
• Google Cloud Associate Cloud Engineer (GCP-ACE) study guideGoogle Cloud
• HashiCorp Certified: Terraform Associate (TF-Associate-004) study guideHashiCorp