MD-102: Manage and Secure Microsoft 365 Endpoints by Using Intune

Learning Path 1:  Prepare infrastructure for devices using Microsoft Intune and Microsoft Entra ID

In this learning path, you'll learn how to build the identity and enrollment infrastructure that supports cloud-based endpoint management with Microsoft Intune and Microsoft Entra ID. You'll start by exploring Intune's role in modern endpoint management and the available management models, then configure Microsoft Entra ID to support policy targeting through users, groups, roles, and device registration settings. You'll go deeper into device identity and authentication, learning how join types and trust models affect device management and Conditional Access. From there, you'll plan and implement enrollment for Windows, iOS/iPadOS, macOS, and Android devices, configure enrollment restrictions, and troubleshoot common failures. The learning path concludes with Windows Autopilot, where you'll register devices, configure deployment profiles, pre-provision hardware, and monitor and troubleshoot deployments.

Modules:

• Understand endpoint management strategies and Microsoft Intune
• Configure Microsoft Entra ID for device and policy management
• Administer device identity and authentication using Microsoft Entra ID
• Plan and implement device enrollment using Microsoft Intune
• Deploy Windows devices using Windows Autopilot

Lab:

• Foundation — identity, enrollment, and Autopilot

Learning Path 2: Manage and maintain devices using Microsoft Intune

In this learning path, you'll learn how to configure and manage devices after enrollment using Microsoft Intune. You'll start by creating and assigning device configuration profiles and compliance policies, using groups and filters for precise targeting, and migrating on-premises Group Policy settings to the cloud. You'll then explore Windows update management - configuring update rings, feature update policies, Hotpatch, and Windows Autopatch to keep devices current and secure. Next, you'll learn how to monitor device and policy health using Endpoint Analytics, Proactive Remediations, and Intune reporting to maintain visibility and drive corrective action at scale. The learning path concludes with a structured approach to troubleshooting, covering enrollment and compliance failures, policy conflicts, diagnostic tools, the Intune Troubleshooting blade, and automated issue resolution using remediation scripts.

Modules:

• Configure device profiles and policy management using Microsoft Intune
• Monitor and maintain devices using Microsoft Intune
• Manage Windows updates and lifecycle using Microsoft Intune
• Troubleshoot device and policy issues using Microsoft Intune

Lab:

• Manage and maintain devices

Learning Path 3: Manage applications using Microsoft Intune

In this learning path, you'll learn how to deliver and govern applications across managed endpoints using Microsoft Intune. You'll start by deploying line-of-business, store, web, and Microsoft 365 apps to users and devices, then implement app protection policies (APP) and app configuration policies to safeguard corporate data on mobile and BYOD devices. You'll explore the full application lifecycle - assignment, updates, supersedence, retirement, and uninstall - and learn how to monitor install success, troubleshoot delivery failures, and tune performance at scale. The learning path concludes with the Enterprise App Catalog, where you'll learn how to publish, configure, and update prepackaged Win32 applications with minimal repackaging effort.

Modules:

• Deploy and manage applications using Microsoft Intune
• Implement application protection and security using Microsoft Intune
• Manage application lifecycle and user experience using Microsoft Intune
• Monitor and optimize application performance using Microsoft Intune
• Manage Enterprise App Catalog applications

Lab:

• Manage applications

Learning Path 4: Protect devices using Microsoft Intune

In this learning path, you'll learn how to apply layered protection to managed endpoints using Microsoft Intune and the broader Microsoft Defender stack. You'll start by integrating Microsoft Defender for Endpoint with Intune, then implement device encryption (BitLocker, FileVault, and personal data encryption) to safeguard data at rest. You'll explore advanced threat protection scenarios, including attack surface reduction rules, endpoint detection and response, and risk-based Conditional Access. From there, you'll author and enforce compliance policies, drive remediation through Conditional Access, and monitor compliance posture at scale. The learning path concludes with two specialized scenarios - delivering secure mobile access using Microsoft Tunnel, and issuing and managing device certificates using Microsoft Cloud PKI.

Modules:

• Implement endpoint security with Microsoft Defender and Microsoft Intune
• Implement device encryption and security policies using Microsoft Intune
• Implement advanced threat protection using Microsoft Intune and Microsoft Defender
• Enforce compliance and remediate security issues by using Microsoft Intune
• Secure mobile access using Microsoft Tunnel
• Implement Microsoft Cloud PKI

Lab:

• Protect devices

Learning Path 5: Automate and optimize endpoint management using Microsoft Intune

In this learning path, you'll learn how to scale, automate, and optimize day-to-day endpoint management using Microsoft Intune, PowerShell, Microsoft Graph, and Copilot. You'll start by automating repetitive Intune tasks - device queries, bulk configuration changes, reporting, and policy provisioning - using the Microsoft Graph PowerShell SDK and Graph Explorer. You'll then explore how AI and Microsoft Copilot in Intune help administrators surface recommendations, draft policies, investigate device issues, and accelerate troubleshooting. The learning path concludes with end-to-end endpoint performance management using Endpoint Analytics, Proactive Remediations, and performance baselines to identify and resolve slow boot, slow sign-in, application reliability, and battery health issues at scale.

Modules:

• Automate endpoint management using PowerShell and Microsoft Graph
• Optimize device management using AI and Copilot tools
• Monitor and optimize endpoint performance using Microsoft Intune

Lab:

• No lab

Learning Path 6: Support operational excellence and readiness using Microsoft Intune

In this learning path, you'll learn how to run Microsoft Intune as an operationally healthy service that other teams can depend on. You'll start by implementing reporting and data visibility - choosing the right operational, organizational, historical, and specialist reports, exporting data through the Reports API, and surfacing insights in Power BI dashboards. You'll then design and apply role-based access control (RBAC), including built-in and custom roles, scope tags, and admin delegation patterns that align with least-privilege principles. The learning path concludes with tenant health practices - service health monitoring, audit logs, license and tenant lifecycle hygiene, and the routines that keep an Intune tenant production-ready.

Modules:

• Implement reporting and data visibility using Microsoft Intune
• Apply RBAC and admin delegation in Microsoft Intune
• Maintain tenant health and support readiness

Lab:

• Automate and operate

Learning Path 7: Extend endpoint capabilities using Microsoft Intune Suite

In this learning path, you'll learn how to extend Microsoft Intune with the premium capabilities delivered through Microsoft Intune Suite. You'll start with an overview of the Intune Suite portfolio - what's included, how it's licensed, and which scenarios each component is designed to address. You'll then implement Remote Help to deliver secure, audited remote assistance to managed devices, and use Advanced Endpoint Analytics to surface deeper device and application signals - anomaly detection, scoped analytics, and richer performance reporting. The learning path concludes with Endpoint Privilege Management (EPM), where you'll evaluate policies that let standard users run approved actions with elevated privileges - reducing local-admin sprawl without breaking productivity.

Modules:

• Explore Microsoft Intune Suite capabilities
• Implement Remote Help scenarios using Microsoft Intune
• Analyze advanced device signals with Microsoft Intune Suite
• Evaluate Endpoint Privilege Management with Microsoft Intune

Lab:

• Lab is combined with Learning Path 8 lab

Learning Path 8: Deliver cloud-hosted desktops using Azure Virtual Desktop and Windows 365

In this learning path, you'll learn how to deliver cloud-hosted Windows desktops to users using Windows 365 and Azure Virtual Desktop, and how to manage those desktops alongside physical endpoints with Microsoft Intune. You'll start by exploring Windows 365 Cloud PC editions, licensing, provisioning, and end-user experience, then configure and manage Cloud PCs directly from the Intune admin center - including image management, network configuration, user assignment, and ongoing health monitoring. You'll explore Azure Virtual Desktop architecture, host pools, application groups, FSLogix profiles, and session-host management, and compare Azure Virtual Desktop with Windows 365 to pick the right cloud-desktop platform per workload. The learning path concludes with integrating Azure Virtual Desktop session hosts with Microsoft Intune for unified policy, app, and security management across all your Windows endpoints - physical and virtual.

Modules:

• Explore Windows 365 for cloud PC deployments
• Configure and manage Windows 365 with Microsoft Intune
• Explore Azure Virtual Desktop
• Integrate Azure Virtual Desktop with Microsoft Intune

Lab:

• Extend capabilities

As a candidate for this course and the associated exam, you have subject matter expertise managing devices and client applications in a Microsoft 365 tenant by using Microsoft Intune.  As an endpoint administrator, you collaborate with architects, Microsoft 365 administrators, security administrators, and other workload administrators to plan and implement a modern workplace strategy that meets the business needs of an organization. You’re responsible for:

• Implementing solutions for efficient deployment and management of endpoints on various operating systems, platforms, and device types.
• Implementing and managing endpoints at scale by using Microsoft Intune, Microsoft Intune Suite, Windows Autopilot, Microsoft Copilot for Security, Microsoft Defender for Endpoint, Microsoft Entra ID, Azure Virtual Desktop, and Windows 365.
• Implementing identity, security, access, policies, updates, and apps for endpoint.

Before attending this course, students must have:

• Strong technical skills installing, maintaining, and troubleshooting the Windows 10 OS or later
• Strong understanding of computer networking, client security, and application concepts
• Experience using Active Directory Domain Services
• Experience with Microsoft Entra ID and Microsoft 365 technologies, including Intune
• Strong skills and experience in deploying, configuring, and maintaining Windows client and non-Windows devices