MD-102: Deploying and Securing Microsoft 365 Endpoints with Intune

MD-102, Managing and Securing Microsoft 365 Endpoints by using Intune, is a current Microsoft certification exam for endpoint administrators. Its scope includes preparing device infrastructure, enrollment and lifecycle management, configuration and updates, security and compliance, application management, and operational monitoring. Microsoft has published an English-language objectives update effective October 27, 2026. Candidates testing before October 27 should use the then-effective skills outline; candidates testing on or after that date should confirm which revised objectives apply before scheduling.

Endpoint management succeeds when devices remain usable, trusted, supportable, and compliant across their working life. An administrator may need to provision a Windows laptop for a remote employee, manage a shared device in a warehouse, protect corporate information on a personal phone, and remediate a vulnerable application without interrupting essential work. Those situations require different enrollment, policy, and recovery choices. The objective is not to apply the maximum possible number of controls but to achieve verifiable protection with a manageable user experience.

Plan identity, registration, and enrollment boundaries

Device identity and user identity are related but distinct. Microsoft Entra registration, Entra join, and hybrid join solve different organizational needs. A device may be associated with a user for workplace access without being fully managed; another may be company-owned and subject to tightly controlled configuration. Before assigning policies, decide the required ownership model, operating system support, sign-in method, and management authority. An ambiguous model causes confusion about who can reset a device or remove business data.

Microsoft Intune enrollment methods should match that design. Windows Autopilot can automate out-of-box setup, while other platforms have their own enrollment programs and restrictions. Test what happens when the user has never signed into the device, when connectivity is poor, or when an existing device is transferred to another employee. A deployment method that works only after a technician signs in locally defeats the purpose of remote provisioning.

Groups and assignment filters determine which devices receive policies and applications. Dynamic group membership can simplify management but introduces timing and rule-evaluation considerations. Overlapping assignments can create conflicting settings, especially when devices move between departments. Define an assignment strategy that distinguishes corporate and personal ownership, sensitive teams, test rings, and exceptions. Validate the effective policy on a representative device rather than trusting the intent expressed in the portal.

Enrollment restrictions, device categories, and compliance requirements should be documented from the user perspective. A personally owned phone might be permitted to access managed work apps without full device enrollment, while a corporate workstation may require enrollment before business access. Explain clearly what the organization can manage, what it can remove, and which privacy boundaries apply. Poor communication can lead to workarounds that undermine otherwise reasonable security controls.

Configure Windows deployment, profiles, and updates safely

Windows deployment includes establishing a secure base state, configuring settings, applying required apps, and verifying a successful first sign-in. Autopilot profiles should be designed around device type and user experience, with appropriate role assignment during setup. Test device replacement, reinstallation, and reuse as separate scenarios. A successful first deployment is not proof that a laptop can be recovered after its drive fails or its user leaves the company.

Configuration profiles can set restrictions, network options, certificates, security features, and user experience. Use Settings Catalog or other supported profile types according to the requirement. Avoid duplicating the same setting in several profiles without clear ownership. If a device receives contradictory restrictions, the support team needs a way to inspect effective configuration, troubleshoot conflicts, and understand whether the result reflects assignment precedence or a failed policy application.

Update rings and feature-update policies balance security, compatibility, and business continuity. A pilot group should include the actual hardware and critical applications used by the organization, not only spare laptops from IT. Define deferral, restart, rollback, and expedited patch policies. An update that closes a severe vulnerability may still interrupt a medical, manufacturing, or customer-facing workflow if deployed without testing or communication. Plan emergency pathways for high-risk vulnerabilities rather than making every release an unreviewed exception.

Remote actions such as wipe, retire, sync, restart, and device reset require safeguards. A retire operation on a personally owned device is not the same as erasing a lost corporate device. Provide role restrictions and, for destructive actions, confirmation or approval appropriate to the environment. Track the request, actor, device identity, and result. If a command remains pending because a device is offline, the operator should not misinterpret its presence in a queue as successful completion.

Design compliance and Conditional Access together

Compliance policies answer whether a managed device meets defined conditions such as encryption, operating-system version, threat level, or other platform-supported signals. Conditional Access can use that compliance state in an access decision. These two systems must be tested as a pair. A device might be correctly marked noncompliant but continue to access sensitive resources through a route that lacks the expected policy; alternatively, a temporary state delay can block a legitimate employee who has already remediated a problem.

Start with risk-based access scenarios. A finance employee accessing sensitive records from an unknown browser may require different protections from a managed kiosk reaching one approved application. Define break-glass access and emergency support procedures. Roll out restrictions in report-only or staged modes where appropriate, evaluate sign-in logs, and establish a process for diagnosing blocked access. The principles behind Conditional Access design apply directly to these decisions, although MD-102 concentrates on endpoint administration rather than the whole identity program.

Security baselines, Microsoft Defender for Endpoint integration, disk encryption, attack-surface reduction, and firewall controls should be organized around a target state. A baseline is a starting point, not an excuse to ignore application requirements. Document deviations and their compensating controls. If a security setting prevents an essential legacy application from running, assess alternatives with the application owner and security team instead of turning off broad protections for the entire organization.

Endpoint security also depends on phishing-resistant authentication, local privilege control, and user behavior. Security and desktop teams should agree on which issues are device health problems, which are identity problems, and which are application incidents. The broader concepts in phishing-resistant MFA help explain why device compliance alone cannot guarantee that a session belongs to a trustworthy user.

Manage application deployment and data boundaries

Applications have installation, configuration, update, licensing, and removal lifecycles. Intune supports different application types and deployment approaches across platforms; the correct packaging choice depends on whether the application is managed, store-delivered, web-based, or tied to special prerequisites. A line-of-business installer that succeeds manually on a test laptop may fail at scale because it assumes interactive input or uses a local path that does not exist on deployed devices.

Define installation requirements, detection rules, dependencies, and supersedence. Detection should confirm that the required version and configuration exist, not merely that an installer once ran. Test failed installation, repair, rollback, and removal. A failed application deployment should identify the affected population and support path so staff can recover without repeatedly wiping devices.

Mobile application protection can safeguard organizational data even when the organization does not fully manage the personal device. Decide which data may move between managed and unmanaged applications, how authentication is enforced, and when work data can be selectively removed. A policy can be technically correct yet frustrate legitimate users if it blocks required file-sharing or accessibility functions. Pilot with representative roles and document reasonable exceptions.

Application inventories and version reporting are essential for vulnerability management. A device may be fully enrolled but still run an outdated browser extension or client application. Combine update policy with reporting and application ownership. Do not treat an Intune deployment success percentage as equivalent to a verified secure software state on every endpoint.

Observe health and investigate problems with evidence

Endpoint monitoring needs to connect management events to user impact. Enrollment failures, noncompliance spikes, update stalls, application-installation errors, and device-health trends should be monitored with useful thresholds. If a dashboard shows 95 percent compliance, investigate who the remaining five percent are, whether they include high-risk systems, and whether stale or decommissioned device records distort the denominator.

Troubleshooting should move from identity to assignment, service availability, device communication, local state, and application behavior. For example, a missing application might result from the wrong group, an unsupported platform, a dependency problem, or a failed installer. Repeatedly issuing a sync command without inspecting the evidence wastes time and can conceal the root cause. Use diagnostic logs, device status, reporting, and relevant support tools within privacy and retention rules.

Remote Help and related support capabilities can assist recovery but introduce privileged access. Define who may connect, whether user consent is necessary, what is logged, and how support sessions are reviewed. Endpoint telemetry must support problem resolution while avoiding unnecessary collection of employee information. Performance metrics should consider experience, not just administrative compliance.

Security incidents may require coordination with Microsoft Defender and identity teams. The Defender XDR incident-investigation discipline helps distinguish a device-management event from a coordinated attack. Endpoint administrators should preserve relevant evidence and use an agreed escalation path instead of responding to every alert through the same generic re-enrollment process.

Connect endpoints to Microsoft 365 administration

The companion MS-102 Microsoft 365 administration exam addresses tenant-wide identity, security, compliance, and service governance. MD-102 is focused on the device lifecycle and client application administration that contributes to that broader environment. A useful deployment exercise enrolls several device types, assigns appropriate policies, deploys an application, evaluates conditional access, and resolves a simulated compliance failure. The exercise should include a user's recovery after changing devices, not only a successful initial enrollment.

Microsoft's October 27 update creates a publication check for exam-domain wording, weights, and references to newer automation or agentic features. Until it takes effect, readers should not assume those future skill descriptions are the active examination requirements. The lasting MD-102 skill is to manage endpoints as a secure, observable lifecycle: identity, provisioning, configuration, protection, applications, support, and eventual retirement, with evidence available at every stage.