MD-102 · Hands-on practice

MD-102 Hands-on Labs — practise in a simulated Intune admin center

Learn it. Practise it. Make it stick.

95 practical tasks. Familiar administration workflows, gradual hints and explanations. Independent simulation — no real tenant, device or cloud resources.

Start your 5 free labs →Explore the course

First five tasks are free, repeatable and have no expiry. No credit card required.

MD-102 Hands-on Labs

€14.99

All labs for this course. 30 days from payment confirmation.

One-time payment · No automatic renewal.

Purchases are temporarily unavailable. Enjoy your five free tasks.

Best value

MD-102 Practice Exam + Hands-on Labs

€29.99

Save €3.99. Exam and all labs each get 60 days.

One-time payment · No automatic renewal.

Purchases are temporarily unavailable. Enjoy your five free tasks.

Your learning path

LAB 01 · FREE

Inspect a device and request a safe sync

All devices · 6–8 min

Open lab →

LAB 02 · FREE

Join a corporate Windows device and verify management separately

Access work or school · 12–16 min

Open lab →

LAB 03 · FREE

Register a personal device without changing its Windows sign-in

Access work or school · 12–16 min

Open lab →

LAB 04 · FREE

Enable automatic enrollment for a pilot

Automatic enrollment · 8–10 min

Open lab →

LAB 05 · FREE

Block personal Windows enrollment for the pilot

Device platform restrictions · 10–12 min

Open lab →

LAB 06 · LOCKED

Prepare a user-driven Autopilot deployment

Deployment profiles · 12–15 min

Included with full MD-102 lab access

LAB 07 · LOCKED

Choose and configure the right Windows provisioning path

Intune admin center · 22–28 min

Included with full MD-102 lab access

LAB 08 · LOCKED

Gate Autopilot readiness on required apps, not an empty blocking list

Enrollment Status Page · 20–25 min

Included with full MD-102 lab access

LAB 09 · LOCKED

Prepare privacy-preserving enrollment for personal iPhones

Enrollment types · 20–25 min

Included with full MD-102 lab access

LAB 10 · LOCKED

Diagnose Apple user-enrollment service discovery

Enrollment types · 18–22 min

Included with full MD-102 lab access

LAB 11 · LOCKED

Prepare assigned iPads with modern Apple automated enrollment

Enrollment program tokens · 20–25 min

Included with full MD-102 lab access

LAB 12 · LOCKED

Prepare a shared reception iPad without binding it to one employee

Enrollment program tokens · 20–25 min

Included with full MD-102 lab access

LAB 13 · LOCKED

Enroll corporate Macs through Apple Business Manager

Intune admin center · 18–22 min

Included with full MD-102 lab access

LAB 14 · LOCKED

Allow Android work-profile enrollment only for approved users

Android enrollment · 18–22 min

Included with full MD-102 lab access

LAB 15 · LOCKED

Create a corporate work-profile enrollment token and contain a leak

Android enrollment · 20–25 min

Included with full MD-102 lab access

LAB 16 · LOCKED

Link the right Android zero-touch account and verify its limits

Enrollment · 15–20 min

Included with full MD-102 lab access

LAB 17 · LOCKED

Prepare Knox enrollment and diagnose the Intune handoff

Enrollment · 20–25 min

Included with full MD-102 lab access

LAB 18 · LOCKED

Build and validate a dynamic corporate Windows group

Entra · 15–20 min

Included with full MD-102 lab access

LAB 19 · LOCKED

Delegate read-only pilot administration with scope tags

Roles · 20–25 min

Included with full MD-102 lab access

LAB 20 · LOCKED

Build scoped custom roles for Intune and Windows 365

Intune admin center · 20–25 min

Included with full MD-102 lab access

LAB 21 · LOCKED

Require a second administrator before a protected change

Multi Admin Approval · 20–25 min

Included with full MD-102 lab access

LAB 22 · LOCKED

Build a constrained two-tier Cloud PKI hierarchy

Cloud PKI · 20–25 min

Included with full MD-102 lab access

LAB 23 · LOCKED

Deploy the certificate trust chain and a device SCEP profile

Configuration · 25–30 min

Included with full MD-102 lab access

LAB 24 · LOCKED

Contain a lost device without reissuing its certificate

Cloud PKI · 15–20 min

Included with full MD-102 lab access

LAB 25 · LOCKED

Assess Windows device compliance

Compliance · 12–15 min

Included with full MD-102 lab access

LAB 26 · LOCKED

Create a multiplatform compliance baseline without flattening platform differences

Intune admin center · 22–28 min

Included with full MD-102 lab access

LAB 27 · LOCKED

Target corporate Windows devices with an assignment filter

Assignment filters · 18–22 min

Included with full MD-102 lab access

LAB 28 · LOCKED

Configure SmartScreen with Settings catalog

Configuration · 12–15 min

Included with full MD-102 lab access

LAB 29 · LOCKED

Migrate reviewed GPO settings without importing a conflict

Group Policy analytics · 20–25 min

Included with full MD-102 lab access

LAB 30 · LOCKED

Resolve an ADMX dependency before importing its settings

Configuration · 12–16 min

Included with full MD-102 lab access

LAB 31 · LOCKED

Deploy certificate-based Wi-Fi to the Mac pilot

macOS configuration · 20–25 min

Included with full MD-102 lab access

LAB 32 · LOCKED

Protect managed iPhone documents without blocking personal use

Configuration · 20–25 min

Included with full MD-102 lab access

LAB 33 · LOCKED

Build a two-app Android kiosk with its launcher dependency

Configuration · 25–30 min

Included with full MD-102 lab access

LAB 34 · LOCKED

Build and diagnose a scripted compliance rule

Compliance · 25–30 min

Included with full MD-102 lab access

LAB 35 · LOCKED

Target configuration profiles to specialty and frontline devices

Intune admin center · 22–28 min

Included with full MD-102 lab access

LAB 36 · LOCKED

Deploy Microsoft 365 Apps to pilot devices

Microsoft 365 Apps · 12–15 min

Included with full MD-102 lab access

LAB 37 · LOCKED

Move an Office pilot to Monthly Enterprise and verify reported channels

Monthly Enterprise · 20–25 min

Included with full MD-102 lab access

LAB 38 · LOCKED

Package a Win32 deployment with reliable detection

Windows apps · 15–18 min

Included with full MD-102 lab access

LAB 39 · LOCKED

Deliver LOB, Autopilot, and platform-store apps safely

Intune admin center · 24–30 min

Included with full MD-102 lab access

LAB 40 · LOCKED

Deploy Company Portal from the new Store integration to a clean pilot

All apps · 20–25 min

Included with full MD-102 lab access

LAB 41 · LOCKED

Protect Outlook data on personal iPhones

App protection policies · 12–15 min

Included with full MD-102 lab access

LAB 42 · LOCKED

Stage protected mobile-app access without blocking the organization

Entra · 20–25 min

Included with full MD-102 lab access

LAB 43 · LOCKED

Configure Outlook on enrolled and unenrolled mobile devices

App configuration · 20–25 min

Included with full MD-102 lab access

LAB 44 · LOCKED

Resolve conflicting Office cloud policies for a user pilot

Policies for Office apps · 20–25 min

Included with full MD-102 lab access

LAB 45 · LOCKED

Prepare a controlled Enterprise App Catalog update

All apps · 20–25 min

Included with full MD-102 lab access

LAB 46 · LOCKED

Protect a mobile pilot’s quiet hours without blocking access

Quiet time · 15–20 min

Included with full MD-102 lab access

LAB 47 · LOCKED

Connect an unenrolled Android pilot with Tunnel for MAM

App configuration · 25–30 min

Included with full MD-102 lab access

LAB 48 · LOCKED

Pilot hardware-backed Windows Hello without widening enrollment policy

Account protection · 18–22 min

Included with full MD-102 lab access

LAB 49 · LOCKED

Prepare silent BitLocker for standard users

Disk encryption · 12–15 min

Included with full MD-102 lab access

LAB 50 · LOCKED

Rotate an exposed recovery key and verify the outcome

All devices · 18–22 min

Included with full MD-102 lab access

LAB 51 · LOCKED

Enforce all three Windows Firewall profiles

Firewall · 10–12 min

Included with full MD-102 lab access

LAB 52 · LOCKED

Protect pilot local administrator accounts with LAPS

Account protection · 18–22 min

Included with full MD-102 lab access

LAB 53 · LOCKED

Update local administrators without removing emergency access

Account protection · 18–22 min

Included with full MD-102 lab access

LAB 54 · LOCKED

Review elevation requests without granting permanent administrator rights

Endpoint Privilege Management · 20–25 min

Included with full MD-102 lab access

LAB 55 · LOCKED

Protect the pilot with Defender Antivirus

Antivirus · 18–22 min

Included with full MD-102 lab access

LAB 56 · LOCKED

Recover a failed Defender intelligence update without disabling protection

All devices · 18–24 min

Included with full MD-102 lab access

LAB 57 · LOCKED

Resolve an antivirus policy conflict without weakening protection

Antivirus · 18–22 min

Included with full MD-102 lab access

LAB 58 · LOCKED

Move an ASR pilot from audit to a safe block policy

Attack surface reduction · 25–30 min

Included with full MD-102 lab access

LAB 59 · LOCKED

Onboard the pilot and verify Defender sensor health

Endpoint detection and response · 20–25 min

Included with full MD-102 lab access

LAB 60 · LOCKED

Pilot a security baseline and resolve a conflicting setting

Security baselines · 25–30 min

Included with full MD-102 lab access

LAB 61 · LOCKED

Pilot App Control without blocking existing business apps

App Control for Business · 25–30 min

Included with full MD-102 lab access

LAB 62 · LOCKED

Create a predictable pilot update ring

Update rings · 15–18 min

Included with full MD-102 lab access

LAB 63 · LOCKED

Target a controlled Windows feature update

Feature updates · 10–12 min

Included with full MD-102 lab access

LAB 64 · LOCKED

Expedite a security update without disrupting production

Windows updates · 15–18 min

Included with full MD-102 lab access

LAB 65 · LOCKED

Build a staged Autopatch group and diagnose membership overlap

Autopatch groups · 18–22 min

Included with full MD-102 lab access

LAB 66 · LOCKED

Pilot Hotpatch and investigate devices that still need a restart

Windows updates · 20–25 min

Included with full MD-102 lab access

LAB 67 · LOCKED

Pilot local update sharing and verify the download evidence

Configuration · 20–25 min

Included with full MD-102 lab access

LAB 68 · LOCKED

Diagnose a feature-update rollout without bypassing safeguards

Windows updates · 20–25 min

Included with full MD-102 lab access

LAB 69 · LOCKED

Stage targeted and latest-version Apple DDM policies for separate pilots

Configuration · 25–30 min

Included with full MD-102 lab access

LAB 70 · LOCKED

Verify Apple updates without confusing policy delivery with OS installation

Apple updates · 20–25 min

Included with full MD-102 lab access

LAB 71 · LOCKED

Schedule Android kiosk updates and test a short holiday freeze

Configuration · 20–25 min

Included with full MD-102 lab access

LAB 72 · LOCKED

Triage service health without disrupting managed devices

Tenant administration · 15–20 min

Included with full MD-102 lab access

LAB 73 · LOCKED

Sync a pilot device batch without disrupting production

All devices · 15–20 min

Included with full MD-102 lab access

LAB 74 · LOCKED

Use remote lifecycle actions and collect the right diagnostics

Intune admin center · 20–25 min

Included with full MD-102 lab access

LAB 75 · LOCKED

Explain a compliance report without mistaking one policy for device health

Compliance · 18–22 min

Included with full MD-102 lab access

LAB 76 · LOCKED

Repair a pilot setting with a safe detection and remediation package

Scripts and remediations · 20–25 min

Included with full MD-102 lab access

LAB 77 · LOCKED

Trace a slow sign-in without disabling security policies

Endpoint analytics · 18–22 min

Included with full MD-102 lab access

LAB 78 · LOCKED

Compare application failures fairly before recommending an update

Endpoint analytics · 15–20 min

Included with full MD-102 lab access

LAB 79 · LOCKED

Pilot compliant-device access in Entra

Conditional Access · 15–18 min

Included with full MD-102 lab access

LAB 80 · LOCKED

Investigate and repair a Win32 detection failure

Troubleshooting + support · 15–20 min

Included with full MD-102 lab access

LAB 81 · LOCKED

Rotate a compromised local admin password and verify the result

All devices · 12–16 min

Included with full MD-102 lab access

LAB 82 · LOCKED

Provide attended support with consent and view-only access

Remote Help · 18–22 min

Included with full MD-102 lab access

LAB 83 · LOCKED

Investigate a slow device with scoped KQL queries

Device query · 22–28 min

Included with full MD-102 lab access

LAB 84 · LOCKED

Investigate a crash anomaly before widening a rollout

Endpoint analytics · 20–25 min

Included with full MD-102 lab access

LAB 85 · LOCKED

Build a complete least-privilege device inventory

Graph Explorer · 20–25 min

Included with full MD-102 lab access

LAB 86 · LOCKED

Update one device note safely through Graph

Graph Explorer · 15–20 min

Included with full MD-102 lab access

LAB 87 · LOCKED

Automate a least-privilege Intune inventory with PowerShell and Graph

Intune admin center · 20–25 min

Included with full MD-102 lab access

LAB 88 · LOCKED

Validate vulnerability evidence before choosing a remediation

Agents · 15–20 min

Included with full MD-102 lab access

LAB 89 · LOCKED

Separate agent run health from endpoint security outcomes

Agents · 15–20 min

Included with full MD-102 lab access

LAB 90 · LOCKED

Verify remediation before attesting that it was applied

Agents · 15–20 min

Included with full MD-102 lab access

LAB 91 · LOCKED

Route endpoint operational alerts without creating notification noise

Intune admin center · 18–22 min

Included with full MD-102 lab access

LAB 92 · LOCKED

Provision a licensed Cloud PC pilot and diagnose a missing assignment

Provision Cloud PCs · 22–28 min

Included with full MD-102 lab access

LAB 93 · LOCKED

Enable scoped Cloud PC self-service recovery without local admin

Cloud PC settings · 14–18 min

Included with full MD-102 lab access

LAB 94 · LOCKED

Recover a Cloud PC from the right point and verify the result

All Cloud PCs · 18–22 min

Included with full MD-102 lab access

LAB 95 · LOCKED

Configure Cloud PC alerts without confusing notification with recovery

Cloud PC Alerts · 15–20 min

Included with full MD-102 lab access

MD-102 hands-on labs — questions

Does MD-102 have labs, and can I practise them without a tenant?
Yes. ExamIT Lab gives you 95 guided MD-102 labs in a simulated Intune admin center. Nothing is deployed to a real Microsoft tenant, subscription or device, so there is nothing to set up, nothing to pay Microsoft for, and nothing you can break.
Are the MD-102 labs free?
The first 5 labs in the learning order are free, repeatable and never expire — no credit card and no sign-up required to start. The full course of 95 labs is a one-time purchase with no subscription.
What does a MD-102 lab look like?
Each lab opens a realistic simulation of the Microsoft Intune admin center — enrollment, Autopilot, compliance, configuration, apps and endpoint security. You get a task brief, a guided or independent mode, progressive hints and a "Check configuration" button that grades the actual end state you left behind — not just the buttons you clicked.
Do the labs cover the current MD-102 exam outline?
The labs are mapped to the objectives in Microsoft's current MD-102 study guide, and we re-audit the mapping when Microsoft updates the skills measured. Combine them with the MD-102 practice test on ExamIT Lab for full coverage.
How is this different from a Microsoft Learn sandbox or a trial tenant?
A trial tenant gives you a blank environment and no feedback. These labs give you a pre-built scenario with fictional users, devices and policies, a clear goal, and automatic checking of your result — so you practise the exact administration workflows the MD-102 exam expects, in minutes, not hours of setup.

Access is per course. Sign in for account progress. After paid access expires, your saved progress is retained and the first five tasks remain free.