MD-102 Exam Prep: Six-Week Study Plan and Hands-On Lab Checklist · CloudEngineerHub
Intune11 min read6 views
MD-102 Exam Prep: Six-Week Study Plan and Hands-On Lab Checklist
A week-by-week MD-102 (Endpoint Administrator) plan with a hands-on lab checklist you can run in a trial tenant — Autopilot, Win32 apps, BitLocker, WUfB rings, MDE, and Graph PowerShell.
C
CloudEngineerHub Team
Published: August 21, 2026· Last Updated: September 24, 2026·11 min read
MD-102 Exam Prep: Six-Week Study Plan and Hands-On Lab Checklist
The MD-102 (Endpoint Administrator) exam is a hands-on test of real Intune skills — Autopilot, policies, apps, updates, and security. Reading alone rarely gets you to the 700 passing score; a tenant you can break will. Here is the plan I would hand any engineer with six weeks and a few evening hours, plus the lab checklist that turns theory into muscle memory.
Visual Walkthrough
The study cadence behind every AZ-104/MD-102 pass on this site.
TimelineSix-Week Certification Loop5/5
weeks 1–2
1
Weeks 1–2 · Foundations
Learn paths + concept mapping; notes as flashcards.
weeks 3–4
2
Weeks 3–4 · Labs
Hands-on in a test tenant; break and fix deliberately.
week 5
3
Week 5 · Practice tests
Timed mocks; review EVERY wrong answer to source docs.
week 6
4
Week 6 · Weak domains
Score report → targeted revision of weakest domains.
exam
5
Exam day
Rest, ID check, time-boxed flags, review marked questions.
Six-Week Certification Loop. 1. Weeks 1–2 · Foundations: Learn paths + concept mapping; notes as flashcards. — 2. Weeks 3–4 · Labs: Hands-on in a test tenant; break and fix deliberately. — 3. Week 5 · Practice tests: Timed mocks; review EVERY wrong answer to source docs. — 4. Week 6 · Weak domains: Score report → targeted revision of weakest domains. — 5. Exam day: Rest, ID check, time-boxed flags, review marked questions.
C
CloudEngineerHub Team
Author
The CloudEngineerHub editorial team — Microsoft endpoint management and cloud engineers writing hands-on guides on Intune, Azure, Entra ID, Autopilot, Defender and PowerShell. Every article is reviewed against current Microsoft documentation.
A scratch tenant: a 30-day Intune trial (or a Visual Studio–linked Microsoft 365 developer tenant) plus a Windows 11 evaluation VM in Hyper-V.
Baseline knowledge: Windows administration, basic Microsoft Entra ID concepts, and comfort with PowerShell.
The official skills outline: Microsoft refreshes the measured skills periodically — always start from the current version on the MD-102 exam page.
One hour a day, six days a week — the plan below assumes roughly 35-40 total hours plus lab time.
The Six-Week Plan
Week 1 — Devices in: manual enrollment, Windows Autopilot traditional vs device preparation, ESP behavior, and enrollment troubleshooting.
Week 2 — Policies: configuration profiles, settings catalog, compliance policies, and how they interlock with Conditional Access and security baselines.
Week 3 — Apps and updates: Win32 packaging with detection rules and dependencies, Microsoft Store apps, Office deployment, and Windows Update for Business rings with deferrals.
Week 4 — Security: BitLocker with key escrow, Defender for Endpoint onboarding, Attack Surface Reduction rules, Endpoint Privilege Management, and Windows 365 Cloud PC basics.
Week 5 — Operations: Intune reports, device queries, proactive remediations, co-management and ConfigMgr coexistence, and the remote actions toolbox.
Week 6 — Exam mode: two timed mock exams, reviewing every wrong answer against the official skills outline. Momentum matters more than perfection.
Pace each week the same way: read the domain, build the lab, then explain the concept out loud without notes — the exam rewards scenario reasoning, not feature trivia.
The Lab Checklist (Do, Don't Just Read)
Build on your scratch tenant and Windows 11 evaluation VM:
Enroll the VM manually, then re-do it via Autopilot: capture the hardware hash, upload it, and watch the user-driven ESP complete.
Package a Win32 app with the Content Prep Tool, assign it as required, and read the IME logs under C:\ProgramData\Microsoft\IntuneManagementExtension\Logs until the install succeeds.
Create a compliance policy with a device filter, then a Conditional Access policy in report-only mode and review the impact before enforcing.
Enable silent BitLocker encryption and recover a key from the console.
Deploy WUfB update rings with deferrals; then pause and expedite an update.
Onboard the VM to Defender for Endpoint and confirm health with Get-MpComputerStatus.
Break things on purpose: remove a compliance-critical setting and trace how the device reports non-compliant, then how Conditional Access responds.
Track your tenant as you go with Graph PowerShell — one small script after each practice session builds both familiarity and a study record:
PowerShell
1
2
3
4
5
6
# Lab-tenant study tracker: device and compliance snapshot after each practice session
Connect-MgGraph -Scopes"DeviceManagementManagedDevices.Read.All"
Get-MgDeviceManagementManagedDevice -All |
Select-Object DeviceName, OperatingSystem, ComplianceState, LastSyncDateTime |
Export-Csv "$env:USERPROFILE\Documents\md102-lab-fleet.csv" -NoTypeInformation -Append# Expected output: a growing CSV — one row per lab device per session, your hands-on study log
Every cmdlet you use in the lab is also exam signal: Connect-MgGraph scopes, Get-MgDeviceManagementManagedDevice filters, and Graph-driven reporting show up in MD-102 scenario questions exactly the way they behave in a tenant.
How the Exam Thinks: Scenario Patterns to Master
MD-102 questions cluster around recognizable patterns. "Policy isn't applying" questions expect you to check assignment scopes, device filters, and policy conflicts in that order. "Least-privilege deployment" questions expect rings, filters, and report-only first. "Data protection" questions expect you to know what each remote action does to user data — Retire vs Wipe vs Fresh Start is a favorite. "App deployment fails" questions expect IME logs, detection rules, and dependencies. When two answers both seem right, choose the one that is scoped narrower or verifiable first — that instinct alone wins multiple questions.
Realistic Study Story: From 560 to 760 in Six Weeks
A service-desk engineer with two years of Windows support but zero Intune production exposure ran this exact plan: 45 minutes of reading on weekdays, one lab per week from the checklist, and the Graph tracker script after every session. Week 5 revealed the pattern — every wrong mock answer traced to either assignment scoping or the remote-actions matrix — so week 6 targeted those two domains specifically. First mock: 560. Second (week 6): 720. Exam day: 760. The lesson is not brilliance; it is that the lab checklist maps one-to-one onto the exam domains, and reviewing wrong answers against the skills outline converts study time into points.
Visual Walkthrough
Logistics discipline protects the knowledge you already have.
Exam Day — Minute by Minute. 1. T-60 · Tech check: Pearson/online proctor setup, ID, clean desk verified. — 2. T-10 · Breathing + strategy: Pace math: minutes per question committed to memory. — 3. Exam · flag & move: First pass answers only; flag doubts, keep momentum. — 4. Review pass: Only re-visit flagged items; trust first instincts. — 5. Score + next step: Pass → badge path; fail → domain report feeds round two.
Exam Logistics and FAQ Focus
Expect roughly 40-60 questions including scenario-based items, passing score 700 on a 1000-point scale. Book only after passing two consecutive timed mocks. The exam-focused questions below mirror how the test phrases its scenarios:
Which action removes corporate data but keeps the user's personal files on a BYOD device?
Retire. Wipe removes everything; Fresh Start targets OEM bloat; Autopilot Reset re-provisions shared devices.
A compliance policy targets a group but one device stays compliant incorrectly — what do you check first?
Device filters and assignment scope, then the device's group membership — scoping errors are the exam's favorite distractor.
Which tool packages a Win32 app for Intune?
The Microsoft Win32 Content Prep Tool (.intunewin), deployed via the IME with detection rules and optional dependencies.
What is the passing score, and how is it measured?
700 on a 1000-point scale; Microsoft does not publish per-domain weighting beyond the skills outline.
Where should you verify what the exam measures today?
The current MD-102 skills outline on the official exam page — it is versioned and changes.
Best Practices
Tenant-first studying: every concept gets a lab, or it is not learned.
Review wrong mock answers against the skills outline, not just the answer key.
Keep the Graph tracker running — the habit pays off in the exam and on the job.
Book only after two consecutive passing timed mocks; schedule fear wastes more candidates than difficulty does.
Study the docs' decision pages (profile types, remote actions, baseline behavior) — MD-102 tests judgment between adjacent options.
Conclusion
Six weeks, an hour a day, tenant-first: reading without labs does not survive MD-102, and labs without a plan do not survive your calendar. Run the checklist, master the scenario patterns, and book the exam when the mocks say you are ready. When you're ready to test yourself, start with the free MD-102 practice test at /mock, keep the automation helpers at /tools in your lab toolkit, and grab the full MD-102 learning packs in the /store for the final push. Good luck — see you on the other side of 700.
Comments
0No comments yet — be the first to share your thoughts.