ExamFinch.com My Study

Cheat sheet

Azure MD-102 Cheat Sheet

Practice this exam

Prepare Infrastructure

  • 25-30% of exam
  • Device Identity Enrollment Compliance Conditional Access Identity Picker

Manage Devices

  • 30-35% of exam
  • Autopilot Configuration Intune Suite Remote Actions Deployment Picker

Manage Applications

  • 15-20% of exam
  • App Types Microsoft 365 Apps App Protection App Configuration App Picker

Protect Devices

  • 15-20% of exam
  • Endpoint Security Defender Updates Baselines Security Picker

Quick Facts

  • Exam MD-102
  • Credential Endpoint Administrator Associate
  • Time 100 min
  • Pass 700 scaled
  • Provider Pearson VUE
  • Platform Microsoft Intune
  • Renewal Annual
  • Blueprint Apr 28 2026

ICE Access PR

  • Identify, check, enforce access.
  • Identity Compliance Enforcement

Joined vs Registered PR

Joined

  • Corporate ownership
  • Work sign-in
  • Full management

Registered

  • Personal ownership
  • Workplace access
  • Light identity
  • Own vs access

Identity Picker PR

  • Cloud corporate Windows → Entra joined
  • Personal work access → Entra registered
  • Legacy AD needed → Hybrid joined
  • Need Intune enrollment → MDM scope
  • Require healthy device → Compliance policy
  • Block resource access → Conditional Access

Device Identity PR

  • Entra joined Cloud corporate Windows
  • Entra registered BYOD workplace identity
  • Hybrid joined AD plus Entra
  • Workgroup No cloud identity
  • Dynamic device Attribute membership
  • Security group Management targeting
  • MDM scope Auto enrollment gate
  • Primary user User device affinity

Compliance vs Conditional Access PR

Compliance

  • Evaluate device
  • Reports health
  • Marks status

Conditional Access

  • Enforces access
  • Grant controls
  • Blocks resources
  • Measure vs enforce

Enrollment PR

  • Automatic enrollment Windows MDM join
  • Device limit Per-user cap
  • Platform restriction Block platform ownership
  • Enrollment profile Platform setup
  • Android fully managed Corporate user device
  • Android dedicated Kiosk shared device
  • Work profile BYOD Android container
  • Apple bulk Automated enrollment

Identity + Compliance PR

  • Compliance policy Health evaluation
  • Grace period Delayed noncompliance
  • CA policy Access enforcement
  • Require compliant Grant control
  • WHfB Passwordless sign-in
  • Windows LAPS Local admin rotation
  • Intune RBAC Admin permissions
  • Local groups Windows membership

UPS Autopilot MA

  • User, pre-stage, self-deploy.
  • User-driven Pre-provisioned Self-deploying

Autopilot vs Provisioning Package MA

Autopilot

  • Cloud OOBE
  • Profile assigned
  • Internet required

Package

  • Offline capable
  • Technician applies
  • Staged settings
  • Cloud vs staged

Deployment Picker MA

  • User receives laptop → User-driven Autopilot
  • Kiosk no user → Self-deploying Autopilot
  • Technician stages apps → Pre-provisioned Autopilot
  • Limited internet setup → Provisioning package
  • Persistent contractor desktop → Windows 365
  • Shared cloud sessions → Azure Virtual Desktop

Autopilot MA

  • User-driven User receives device
  • Self-deploying Kiosk no user
  • Pre-provisioned Technician stages first
  • Existing devices Convert during deploy
  • Hardware hash Manual device import
  • ESP Block until ready
  • Name template Automated device names
  • Provisioning package Offline staged setup

User-Driven vs Self-Deploying MA

User-driven

  • User signs in
  • Primary user
  • Personal laptop

Self-deploying

  • No user affinity
  • Kiosk devices
  • Shared endpoints
  • Person vs kiosk

Configuration MA

  • Settings catalog Granular settings
  • Templates Scenario profiles
  • ADMX import Custom Windows settings
  • Filters Assignment narrowing
  • Windows multi-session AVD session hosts
  • Configuration profile Device settings
  • Policy set Grouped assignments
  • Assignment status Deployment evidence

Intune Suite MA

  • EPM Privilege elevation
  • Enterprise App Catalog Packaged apps
  • Advanced Analytics Endpoint insights
  • Remote Help Assisted support
  • Cloud PKI Cloud certificates
  • Tunnel MAM App-level VPN
  • Device query KQL inventory
  • Bulk action Many devices

Remote Actions MA

  • Sync Force check-in
  • Restart Reboot device
  • Retire Remove corporate data
  • Wipe Factory reset
  • Fresh Start Clean Windows
  • Autopilot Reset Keep Entra identity
  • Rotate key BitLocker recovery change
  • Update intelligence Defender signatures

Cloud Desktops MA

  • Windows 365 Managed Cloud PC
  • AVD Azure VDI platform
  • Cloud PC policy Provisioning rules
  • Multi-session Shared Windows host
  • Resize Change Cloud PC
  • Reprovision Recreate Cloud PC
  • Restore Rollback Cloud PC
  • Region Cloud PC location

MAM Boundary AP

  • Manage app data, not device.
  • Managed apps DLP Selective wipe

App Protection vs Compliance AP

App protection

  • App data
  • No enrollment possible
  • Selective wipe

Compliance

  • Device health
  • Enrollment required
  • Access signal
  • App vs device

App Picker AP

  • Force app install → Required assignment
  • Let users install → Available assignment
  • Protect BYOD data → App protection
  • Configure app settings → App configuration
  • Package Windows installer → Win32 app
  • Deploy Office suite → Microsoft 365 Apps

App Types AP

  • Win32 app IntuneWin package
  • LOB app Custom installer
  • Store app Platform marketplace
  • Web link URL shortcut
  • Required Forced install
  • Available Company Portal
  • Uninstall Remove app
  • Detection rule Install proof

Microsoft 365 Apps AP

  • ODT XML deployment tool
  • OCT Config designer
  • Apps admin center Office servicing
  • Office policy App settings
  • Autopilot apps Install during ESP
  • Update channel Office cadence
  • Shared activation Multi-user Office
  • Assignment intent Install behavior

App Protection AP

  • MAM App management
  • MAM-WE Without enrollment
  • Managed app Policy-capable app
  • DLP Data movement rules
  • Selective wipe Remove corporate data
  • Conditional launch App health gate
  • App PIN Managed access
  • Managed browser Protected web access

App Configuration AP

  • Managed devices MDM app config
  • Managed apps MAM app config
  • IntuneMAMUPN iOS user hint
  • IntuneMAMOID iOS object hint
  • IntuneMAMDeviceID iOS device hint
  • Configuration designer Key-value UI
  • App filter MAM targeting
  • Policy delivery App sign-in dependent

SAFE Protection PR

  • Secure, assess, fix, enforce.
  • Security policy Defender risk Remediation CA

Configuration vs Endpoint Security PR

Configuration

  • General settings
  • Platform profiles
  • ADMX import

Endpoint security

  • Security workload
  • Firewall encryption
  • ASR antivirus
  • Settings vs protection

Security Picker PR

  • Need recommended defaults → Security baseline
  • Configure BitLocker → Disk encryption
  • Block attack techniques → ASR policy
  • Use threat risk → Defender connector
  • Set patch cadence → Update rings
  • Pin Windows release → Feature updates

Endpoint Security PR

  • Antivirus Malware protection
  • Disk encryption BitLocker policy
  • Firewall Network protection
  • ASR Attack reduction
  • EDR Endpoint detection
  • Account protection Identity hardening
  • Security baseline Recommended settings
  • Security task Defender remediation

Update Rings vs Feature Updates PR

Update rings

  • Deferrals
  • Deadlines
  • Restart behavior

Feature updates

  • Target release
  • Version hold
  • Windows level
  • Timing vs version

Defender PR

  • Connector Intune MDE link
  • Onboarding Enroll into Defender
  • Device risk Threat signal
  • Risk compliance Access condition
  • Security intelligence AV definitions
  • Tamper protection Security setting lock
  • Endpoint detection EDR telemetry
  • Remediation task Fix request

Updates PR

  • Update rings Cadence restart rules
  • Feature updates Target Windows release
  • Quality updates Monthly patches
  • Expedited updates Urgent security patches
  • Driver updates Hardware drivers
  • Delivery Optimization Bandwidth sharing
  • Apple updates iOS macOS policy
  • FOTA Android firmware updates

Common Traps

Registration Is Not Join

  • Entra registered ≠ Entra joined

Compliance Is Not Enforcement

  • Compliance policy ≠ Conditional Access policy

BYOD Data Is App

  • App protection ≠ Full enrollment

Kiosk Avoids User Affinity

  • Self-deploying mode ≠ User-driven mode

Retire Is Not Wipe

  • Corporate data removal ≠ Factory reset

Rings Are Not Versions

  • Update timing ≠ Feature target

Assignment Is Not Success

  • Assigned policy ≠ Device applied

Last Minute

  • 1. Prepare plus Manage dominate weight
  • 2. Entra join before Intune policy
  • 3. Compliance evaluates, CA enforces
  • 4. Filters narrow assignments dynamically
  • 5. Autopilot needs device registration
  • 6. ESP blocks until required setup
  • 7. MAM protects unenrolled BYOD apps
  • 8. Required installs; Available offers
  • 9. Baselines are recommended defaults
  • 10. Defender risk can drive compliance
  • 11. Rings schedule; feature pins version
  • 12. Retire removes company data

Microsoft 365 Endpoint Administrator (MD-102)

  • Practice Questions 312 questions Study Guide 24 topics Cheat Sheet 120 facts Flashcards 50 cards Videos 2 videos Blogs 2 blogs Free CE Podcast