How difficult is the MD-102 exam?

Verdict first: MD-102 is a moderate-to-demanding administrator exam whose difficulty is judgement, not trivia. It does not ask you to memorise the Intune portal — it presents an organisation's stated requirements and asks which configuration mechanism actually delivers them. Administrators who manage endpoints through Intune every day generally find it fair. Helpdesk technicians who fix devices one ticket at a time — capable, experienced people — are the group that struggles most, because the exam tests policy architecture they may never have been asked to design.

The pass mark is 700 on Microsoft's 1,000-point scaled model (confirm the current exam details on the official MD-102 page). What raises the temperature is the case-study format: the exam includes case-study scenarios — a company profile with requirements, followed by a block of questions — and once you leave a case-study section you cannot return to it. Some of your earliest decisions are therefore made under the most pressure, with no warm-up lap and no second look. Candidates also ask whether the format includes live labs or performance-based tasks, and it is worth settling that question before you plan your practice.

The real difficulty drivers

Mechanism selection inside Intune. The signature MD-102 question describes a desired device posture — these applications protected, those devices restricted, this data contained — and offers four plausible mechanisms. Configuration profiles, compliance policies, app protection policies, and Conditional Access all act on the same device, and the credited answer is the one whose mechanism actually produces the stated outcome. Knowing what each feature is narrows you to two options; knowing precisely what each one does gets you to the answer.

Breadth across the endpoint estate. Deployment and provisioning (including Windows Autopilot), identity through Microsoft Entra ID, application deployment and protection, update management through rings and policies, and configuration across Windows with working awareness of the other platforms Intune manages. It is a single exam covering work that used to be divided among several job specialisations, and nobody's day job touches all of it equally.

Case-study economics. The case studies front-load reading: a dense organisational scenario has to be mined for the handful of facts each question actually turns on, and the no-return rule means a misread requirement costs marks you cannot recover later in the sitting. Candidates who have never practised under that rule lose points to process rather than knowledge — the most frustrating way to fail an exam you mostly knew.

The compliance chain. Device compliance status feeding Conditional Access decisions is the exam's favourite multi-step idea: a compliance policy marks a device non-compliant, a grant control reacts, an application or resource behaves accordingly. Questions chain two or three of those links together and ask where the chain breaks — or which link you would change to produce a specified result. Single-feature revision does not prepare you for chained reasoning.

Identity is not a side topic

Candidates consistently underestimate how much of MD-102 runs through Microsoft Entra ID. Device identity choices — Entra joined versus hybrid joined versus merely registered — determine which management and access scenarios are even possible, and the exam builds questions on exactly those boundaries: a requirement that sounds like an Intune problem turns out to be decided by how the device was joined. The same applies to enrolment paths and user-versus-device affinity. Treat identity as a first-class domain in your preparation, not as background knowledge the "real" topics sit on top of, because the question writers treat it that way — it is the hinge that several of the hardest scenario questions swing on.

Calibrated against its neighbours

MD-102 is the consolidation of the retired MD-100 and MD-101 exams — Windows client administration and endpoint management respectively — so it is broader than either predecessor alone, and candidates who sat just one of the old pair routinely underestimate the half they skipped. Against AZ-104, the comparison is depth versus breadth: AZ-104 ranges across the entire Azure infrastructure estate and is generally treated as the heavier overall lift, while MD-102 stays inside the endpoint world but goes considerably deeper there than AZ-104 ever does. If your career is endpoints, do not mistake MD-102 for an easier AZ-104 — it is a different specialisation, examined at proper depth.

Who finds it hard — and who doesn't

• Helpdesk and desktop-support technicians: strong on symptoms, light on architecture. The jump this exam demands is from "fix this device" to "design the policy set that prevents the ticket."
• SCCM veterans: the concepts map across well, but years of Configuration Manager instinct must be re-expressed in cloud-first terms — and co-management questions reward those who genuinely understand both worlds rather than defending one of them.
• Intune administrators: the best-matched group. Their risk is subtler: portal familiarity substituting for careful requirement-reading in the case studies.
• Generalist system administrators: usually comfortable on Windows depth, but stretched by app protection policies and the compliance-to-Conditional-Access chain.

Preparation that moves the needle

This is a tenant exam, so prepare in a tenant: stand up a Microsoft 365 trial or developer environment, enrol real or virtual test devices, and build the actual artefacts — an Autopilot profile, configuration and compliance policies, an application deployment, an update ring — then change a requirement and rebuild to meet it. Policy architecture is learned by constructing it, and every hour spent in the tenant converts directly into case-study speed. Deliberately practise the case-study format itself: read the requirements twice, answer in order, and never leave a case-study question blank, because there is no coming back to fill it in. As a planning heuristic only: practising Intune administrators often prepare over a few weeks of evenings, while helpdesk candidates making the architecture jump should budget a few months of tenant-first study. Timed, domain-scored practice tests — including the free practice tests on Study4Pass — are the right final check: by then the question is no longer whether you know Intune, but whether you can read a requirement and pick the right mechanism, again and again, at exam pace. Two smaller topics round out the picture: the technology that lets a cell phone be used as a hands-free device, and the MD-102 roadmap and its expected retirement.