Microsoft certification practice
Practise Microsoft 365 Endpoint Administrator MD-102 practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Microsoft certification exams often test whether you can choose the right Azure, Microsoft 365, identity, security or monitoring action for a realistic administrative scenario. Courseiva helps you practise with structured questions and explanations.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 7 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Microsoft 365 Endpoint Administrator MD-102 exam.
Exam cost
$165 USD / ~£130
Duration
100 minutes
Question count
40–60 questions
Passing score
700 / 1000
Validity
1 year (renewable online)
Delivered by
Pearson VUE
Online proctored
Yes — available
Retake policy
100% free — no account required
Everything on Courseiva for MD-102 is free — no subscription, no trial, no email wall.
Courseiva provides free Microsoft 365 Endpoint Administrator MD-102 (MD-102) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with Microsoft.
24 hours before second attempt; 14 days for third and subsequent attempts
Question formats
The MD-102 exam certifies skills in deploying, configuring, securing, managing, and monitoring devices and applications in an enterprise environment. Candidates demonstrate proficiency with Microsoft Intune, Microsoft Entra ID (Azure AD), Windows Autopilot, Microsoft Deployment Toolkit, and Microsoft 365 Apps management. The certification replaced the retired MS-101 and MS-100 exams and is aimed at IT professionals who manage the endpoint lifecycle in Microsoft 365 environments. Strong knowledge of Windows client administration is expected.
Official prerequisite
None formally required
Recommended experience
1+ year of experience managing Windows endpoints with Intune or Group Policy; MS-900 or AZ-900 helpful
IT professionals with hands-on experience managing Windows 10/11 devices in enterprise environments using Microsoft 365 tools
Should you skip this exam?
Skip if you have no hands-on Windows administration experience — start with CompTIA A+ or MS-900
Courseiva study tip
Focus on Intune device configuration profiles, compliance policies, Windows Autopilot, and co-management with Configuration Manager — these are heavily tested
UK salary range
£35,000 – £60,000
US salary range
$70,000 – $110,000
Job roles that cite MD-102
What certification to take next
The exam costs $165 USD (approximately £130 GBP).
You need 700 out of 1000 points to pass.
MD-102 is rated Moderate. Candidates with real-world Intune and Windows endpoint experience typically find it manageable with 60–90 hours of preparation.
Between 40 and 60 questions, including multiple choice, case studies, and drag-and-drop formats.
It tests deploying and managing Windows devices and Microsoft 365 apps using Microsoft Intune, Entra ID, Windows Autopilot, compliance policies, and endpoint security configurations.
One year. You can renew it free through an online renewal assessment on Microsoft Learn before it expires.
IT administrators and support engineers who manage Windows endpoints and Microsoft 365 apps in enterprise environments using Intune and related tools.
See how MD-102 stacks up against related certifications.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All MD-102 Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
IPv6 questions usually test address types (link-local, global unicast, ULA), autoconfiguration (SLAAC), Neighbor Discovery Protocol and the differences from IPv4.
IPv6 address types and their scopes (link-local, global unicast, multicast, ULA).
SLAAC vs DHCPv6 vs stateful assignment.
Neighbor Discovery Protocol replacing ARP.
IPv6 routing differences and dual-stack coexistence.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise MD-102 questions linked to Prepare infrastructure for devices.
Practise MD-102 questions linked to Manage and maintain devices.
Practise MD-102 questions linked to Manage applications.
Practise MD-102 questions linked to Protect devices.
Practise MD-102 questions linked to Deploy Windows client.
Practise MD-102 questions linked to Manage identity and compliance.
Practise MD-102 questions linked to Manage, maintain, and protect devices.
Practise MD-102 questions linked to MD-102 fundamentals.
Practise MD-102 questions linked to MD-102 scenario.
Practise MD-102 questions linked to MD-102 troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 64 tests. See all 64 MD-102 practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise MD-102 questions in this domain →
Practise MD-102 questions in this domain →
Practise MD-102 questions in this domain →
Practise MD-102 questions in this domain →
Practise MD-102 questions in this domain →
Practise MD-102 questions in this domain →
Practise MD-102 questions in this domain →
Term reference
These terms appear frequently in MD-102 questions. Understanding them precisely reduces guessing and improves scores.
Safe Links
Safe Links is a Microsoft Defender for Office 365 feature that scans URLs in emails and documents in real time to protect users from malicious websites.
Security pillar
The Security pillar is a set of best practices for designing and operating cloud systems that protect data, systems, and assets through confidentiality, integrity, and availability controls.
Mobile GPU
A mobile GPU is a specialized graphics processor designed for use in mobile devices such as smartphones, tablets, and laptops, handling rendering and display tasks while balancing performance with power efficiency.
Digitizer
A digitizer is the part of a touchscreen that converts your finger or stylus touches into digital signals the device can understand.
Risk acceptance
Risk acceptance is a risk management strategy where an organization acknowledges a potential risk but decides to tolerate it without taking active measures to reduce or eliminate it.
AWS WAF
AWS WAF is a cloud-based web application firewall that helps protect your web applications from common web exploits like SQL injection and cross-site scripting by allowing you to define customizable rules.
Security strategy
A security strategy is a high-level plan that outlines how an organization protects its information assets, aligns security with business goals, and manages risk over time.
Windows Update for Business
Windows Update for Business is a set of policies and settings that IT administrators use to manage and control how Windows devices receive updates from Microsoft, allowing for staged rollouts and deferrals while ensuring security patches are applied.
Free study guide
The Courseiva MD-102 study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Trap 1: The laptops have insufficient RAM (4 GB) to run the deployment.
4 GB RAM is sufficient for Windows 10 deployment.
Trap 2: The deployment share is not accessible over the network.
Network issues would produce different errors.
Trap 3: The custom image is missing critical drivers.
Missing drivers cause different errors, not 0x80070070.
The laptops have insufficient RAM (4 GB) to run the deployment.
Why wrong: 4 GB RAM is sufficient for Windows 10 deployment.
The deployment share is not accessible over the network.
Why wrong: Network issues would produce different errors.
The custom image is missing critical drivers.
Why wrong: Missing drivers cause different errors, not 0x80070070.
The custom image is too large for the 60 GB SSD.
Error 0x80070070 means 'Not enough disk space'. The image likely exceeds available space.
Trap 1: Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as'…
Self-deploying mode doesn't require user sign-in.
Trap 2: Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to…
Hybrid join requires on-premises AD and a different flow.
Trap 3: Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to…
White Glove is for pre-provisioning, not user-driven OOBE.
Set 'Deployment mode' to 'Self-Deploying' and 'Join to Azure AD as' to 'Azure AD joined'.
Why wrong: Self-deploying mode doesn't require user sign-in.
Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Hybrid Azure AD joined'.
Why wrong: Hybrid join requires on-premises AD and a different flow.
Set 'Deployment mode' to 'White Glove' and 'Join to Azure AD as' to 'Azure AD joined'.
Why wrong: White Glove is for pre-provisioning, not user-driven OOBE.
Set 'Deployment mode' to 'User-Driven' and 'Join to Azure AD as' to 'Azure AD joined'.
This requires user sign-in and enrolls device in Intune.
Refer to the exhibit.
```
$session = New-CsOnlineSession -Verbose
Import-PSSession $session
Set-CsTenantFederationConfiguration -Identity Global -AllowFederatedUsers $true
Set-CsTenantFederationConfiguration -Identity Global -AllowPublicUsers $false
Set-CsTenantFederationConfiguration -Identity Global -BlockedDomains @{Add="suspicious.com"}
Set-CsTenantFederationConfiguration -Identity Global -AllowedDomains @{Add="trusted.com"}
Remove-CsOnlineSession $session
```Trap 1: The AllowedDomains list does not include a wildcard ' * ' to allow…
If only trusted.com is allowed, users should be able to communicate with that domain. The problem states they cannot, so this is not the cause.
Trap 2: The script sets AllowPublicUsers to $false, which blocks all…
AllowPublicUsers controls public Skype users, not federated domains.
Trap 3: The script sets AllowFederatedUsers to $true, which disables…
Setting AllowFederatedUsers to $true enables federation, not disables it.
The AllowedDomains list does not include a wildcard ' * ' to allow all domains, so only trusted.com is allowed.
Why wrong: If only trusted.com is allowed, users should be able to communicate with that domain. The problem states they cannot, so this is not the cause.
The script sets AllowPublicUsers to $false, which blocks all external communication including federated users.
Why wrong: AllowPublicUsers controls public Skype users, not federated domains.
The script sets AllowFederatedUsers to $true, which disables federated user communication.
Why wrong: Setting AllowFederatedUsers to $true enables federation, not disables it.
The script did not run in a Teams PowerShell session that supports the Set-CsTenantFederationConfiguration cmdlet.
The New-CsOnlineSession and Import-PSSession sequence is correct, but if the module is not properly loaded or the session is not created with the right endpoint, the cmdlets may not be available, causing the script to have no effect.
Drag a concept onto its matching description — or click a concept then click the description.
Intune
Intune (if Windows Update for Business selected)
Intune
Configuration Manager or Intune
Configuration Manager or Intune
Drag a concept onto its matching description — or click a concept then click the description.
Prevent sensitive data from being shared inappropriately
Classify and protect documents and emails with labels
Manage retention and disposal of records
Search and export content for legal investigations
Log and investigate user and admin activities
Trap 1: Configure Windows Hello for Business.
Windows Hello is Windows-only.
Trap 2: Enable BitLocker encryption.
BitLocker is Windows-only.
Trap 3: Deploy .app applications.
Intune supports .pkg or .dmg, not .app directly.
Configure Windows Hello for Business.
Why wrong: Windows Hello is Windows-only.
Apply device compliance policies.
Intune supports compliance policies for macOS.
Enable BitLocker encryption.
Why wrong: BitLocker is Windows-only.
Deploy software update policies.
Intune can manage macOS software updates.
Deploy .app applications.
Why wrong: Intune supports .pkg or .dmg, not .app directly.
Official booking and top-rated study resources for the MD-102.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.