MS-102 and MD-102 are two of Microsoft’s most commonly confused certifications, partly because their exam codes look almost identical. MS-102 (Microsoft 365 Administrator) validates your ability to manage an entire Microsoft 365 tenant, covering identity with Microsoft Entra ID, security with Microsoft Defender XDR, and compliance with Microsoft Purview. MD-102 (Endpoint Administrator) validates your ability to manage the devices that connect to that tenant, covering Intune, Windows deployment, app protection, and device compliance. MS-102 administrators manage the cloud services; MD-102 administrators manage the devices that connect to them. Both cost $165, both are Associate-level certifications renewable annually for free, and together they form the two halves of Microsoft’s Enterprise Administrator Expert credential, which is exactly why so many IT professionals end up pursuing both rather than choosing one over the other.
This guide breaks down what each certification actually tests, who each is for, and how they combine into Microsoft’s top M365 administration credential.
MS-102 vs MD-102: Quick Comparison
| Factor | MS-102 | MD-102 |
| Full name | Microsoft 365 Administrator | Endpoint Administrator |
| Core focus | Tenant-wide administration: identity, security, compliance, services | Device-level administration: Intune, deployment, endpoint protection |
| Cost | $165 USD | $165 USD |
| Passing score | 700 out of 1000 | 700 out of 1000 |
| Replaced certification | N/A (established core M365 exam) | MD-100 and MD-101, retired September 30, 2023 |
| Key tools | Microsoft Entra ID, Defender XDR, Purview | Microsoft Intune, Windows Autopilot, Defender for Endpoint |
| Validity | 1 year, free renewal | 1 year, free renewal |
| Typical background | IT professionals managing M365 tenant settings, licensing, and security | Desktop support and systems administrators moving into modern device management |
| Combines with | MD-102, to unlock Enterprise Administrator Expert | MS-102, to unlock Enterprise Administrator Expert |
| Typical salary (US) | $90,000-$145,000+ | $70,000-$130,000+ |
What MS-102 Covers
MS-102 validates your ability to manage an entire Microsoft 365 tenant, including deploying and managing identity with Microsoft Entra ID, implementing security with Microsoft Defender, managing compliance with Microsoft Purview, and administering the overall tenant configuration.
MS-102 Core Domains
| Domain | What It Covers |
| Deploy and manage a Microsoft 365 tenant | Tenant configuration, domains, users, groups, licenses, organizational settings |
| Implement and manage identity and access in Microsoft Entra ID | Users, groups, Conditional Access, MFA, basic Privileged Identity Management |
| Manage security and threats using Microsoft Defender XDR | Defender for Endpoint, Office 365, Identity, Cloud Apps, incident response |
| Manage compliance using Microsoft Purview | Data loss prevention, sensitivity labels, retention policies, eDiscovery, audit |
MS-102 is the broader, more strategic exam of the two. It addresses enterprise administration of Microsoft 365 services at a more comprehensive and tenant-wide level, rather than focusing on any single device or endpoint. This makes it the natural credential for administrators responsible for the overall health, security, and compliance posture of an organization’s Microsoft 365 environment.
Who MS-102 Is For
IT professionals managing M365 tenant settings, licensing, and security at an organizational level. The exam is designed for candidates who are already experienced administrators with a strong working knowledge of core Microsoft 365 services, even though there are no official, mandatory prerequisites. If your responsibilities span identity governance, threat protection across the whole tenant, and compliance policy management, MS-102 directly validates that scope.
What MD-102 Covers
MD-102 focuses on the deployment, configuration, and management of endpoints within a modern workplace environment, replacing the older MD-100 and MD-101 exams with a single, unified credential reflecting how endpoint management actually works today: cloud-connected, policy-driven, and identity-aware.
MD-102 Core Domains
| Domain | What It Covers |
| Deploy Windows client | Windows Autopilot, deployment methods, device provisioning |
| Manage identity and compliance | Device compliance policies, conditional access integration at the device level |
| Manage, maintain, and protect devices | Intune configuration profiles, app protection policies, Defender for Endpoint |
| Manage applications | App deployment, app protection, app configuration across managed devices |
MD-102 is filled with Microsoft-specific vocabulary and concepts that even highly experienced systems administrators may not be familiar with. Microsoft wants to confirm that certified administrators know official best practices for Intune and modern endpoint management specifically, which is why the exam tends to be harder for candidates who have not spent real time inside the Intune admin console, regardless of how experienced they are with general IT administration.
Who MD-102 Is For
Desktop support professionals, systems administrators, and IT pros transitioning into modern device management, especially those whose organizations use Microsoft 365 and Intune to manage a fleet of Windows, mobile, and other connected devices. If your daily work involves enrolling devices, configuring compliance policies, deploying applications, or protecting endpoints, MD-102 directly validates that skill set.
MS-102 vs MD-102: The Practical Difference With an Example
Consider a scenario: an organization wants to roll out a new conditional access policy requiring all devices to be compliant before accessing company email.
MS-102 knowledge addresses: How do you configure the Conditional Access policy itself in Microsoft Entra ID? What sign-in risk conditions should trigger this policy? How does this policy interact with the organization’s broader identity governance and security posture across Defender XDR? How is this change communicated and audited at the tenant level through Purview?
MD-102 knowledge addresses: How do you define what makes a device “compliant” in Intune (encryption, OS version, security baseline)? How is the compliance policy actually deployed and enforced on enrolled devices? What happens to a non-compliant device that fails this check? How do you troubleshoot a device that should be compliant but is being blocked?
The two roles hand off directly to each other. MS-102 sets the policy at the identity and tenant level. MD-102 builds and enforces the device-side compliance state that policy depends on. Neither certification alone covers this complete scenario, which is exactly why so many organizations need both skill sets represented, whether across two specialists or in one person who holds both certifications.
MS-102 vs MD-102: Which Should You Take First?
| Your Situation | Recommended First Certification |
| You manage tenant-wide identity, security policy, or compliance | MS-102 |
| You manage devices, Intune, or endpoint deployment | MD-102 |
| You are a desktop support professional moving into modern administration | MD-102, since it builds on hands-on device management most directly |
| You are an IT generalist responsible for overall M365 health | MS-102, since it covers the broadest tenant-level scope |
| You want to specialize in security operations next | MD-102 first, then SC-200 (Security Operations Analyst), since endpoint protection feeds directly into SOC work |
| You want to specialize in identity next | MS-102 first, then SC-300 (Identity and Access Administrator), since both build on Entra ID |
| Your goal is the Enterprise Administrator Expert credential | Plan for both; neither alone unlocks the Expert-level credential |
There is no universally correct order. MS-102 and MD-102 validate genuinely different layers of Microsoft 365 administration (cloud services versus the devices connecting to them) that complement each other but do not depend on each other. The right starting point is whichever matches your current role’s immediate responsibilities.
MS-102 and MD-102 Together: The Enterprise Administrator Expert
This is the detail most comparisons of these two certifications miss entirely, and it is the strongest reason many professionals end up pursuing both rather than picking just one.
| Credential | Requirement |
| Microsoft 365 Certified: Administrator Expert | Requires MS-102, plus one qualifying Associate-level certification (which can be MD-102, or alternatives such as SC-300 or AZ-104 depending on Microsoft’s current requirements) |
MS-102 pairs especially well with MD-102 to unlock unified enterprise admin roles. Many enterprise admins eventually earn both because they cover complementary halves of modern Microsoft administration, and holding both, alongside meeting Microsoft’s combined requirement, positions you for the Expert-level credential that sits at the top of the Microsoft 365 administration certification stack. This Expert credential, and the combined skill set it represents, is what unlocks the highest-paying unified enterprise admin roles, often in the $110,000 to $140,000 range in the US, well above either certification’s typical standalone salary ceiling.
MS-102 vs MD-102: Salary Comparison
| Certification | Entry-Level (1-3 yrs) | Mid-Level (3-5 yrs) | Senior-Level |
| MS-102 | $70,000-$90,000 | $90,000-$115,000 | $115,000-$145,000+ |
| MD-102 | $55,000-$75,000 | $80,000-$100,000 | $105,000-$130,000+ |
| MS-102 plus MD-102 (unified roles) | N/A | N/A | $110,000-$140,000+ |
MD-102 also carries a meaningful standalone premium: a 15-22% salary increase is commonly cited alongside the certification’s $165 cost, reflecting strong ROI for IT professionals already working with Intune and endpoint management day to day.
MS-102 vs MD-102: Difficulty and Study Time
| Factor | MS-102 | MD-102 |
| Difficulty | Moderate, requires broad tenant-level knowledge across identity, security, and compliance | Moderate (commonly rated 6-7 out of 10), requires hands-on Intune experience, not just book knowledge |
| Typical prep time (with M365 experience) | 6-10 weeks of focused preparation | 4-8 weeks at 10-15 hours per week |
| Typical prep time (new to the platform) | 3-4 months to build foundational knowledge | Longer, with priority on hands-on labs over passive study |
| Common pitfall | Underestimating the breadth across four distinct domains (identity, security, compliance, and tenant administration) | Attempting to pass through memorization alone without real Intune console experience |
Both exams reward genuine hands-on experience over theoretical study. A free 90-day Microsoft 365 Developer Tenant is considered mandatory, not optional, preparation for both certifications, since neither exam can be reliably passed through reading alone.
FAQS
What is the difference between MS-102 and MD-102?
MS-102 (Microsoft 365 Administrator) focuses on tenant-wide administration: identity with Entra ID, security with Defender XDR, and compliance with Purview. MD-102 (Endpoint Administrator) focuses on device-level administration: Intune, Windows deployment, and endpoint protection. MS-102 manages the cloud services; MD-102 manages the devices that connect to them.
Should I take MS-102 or MD-102 first?
If your role centers on tenant-wide identity, security, or compliance management, start with MS-102. If your role centers on managing devices, Intune, or endpoint deployment, start with MD-102. Many enterprise administrators eventually pursue both, since they cover complementary halves of modern Microsoft 365 administration.
Do MS-102 and MD-102 lead to a higher-level certification?
Yes. Together, MS-102 and MD-102 (or MS-102 plus another qualifying Associate certification) lead toward the Microsoft 365 Certified: Administrator Expert credential, the top of the M365 administration certification stack. This combined credential unlocks unified enterprise admin roles often paying $110,000 to $140,000 or more.
How much do MS-102 and MD-102 cost?
Both cost $165 USD and require a passing score of 700 out of 1000.
Which is harder, MS-102 or MD-102?
Both are considered moderately difficult. MS-102’s difficulty comes from its breadth across four distinct domains spanning identity, security, and compliance. MD-102’s difficulty comes from its depth in Intune-specific, Microsoft-vocabulary-heavy content that even experienced systems administrators often have not encountered without hands-on Intune experience.
What replaced MD-102?
MD-102 itself is the replacement. Microsoft retired MD-100 (Windows 10 client administration) and MD-101 (Modern Desktop management) on September 30, 2023, consolidating both into the single MD-102 exam, which has been the only valid certifying exam for the Endpoint Administrator Associate credential since October 2023.
Which pays more, MS-102 or MD-102?
MS-102 roles typically command a slightly higher salary range ($90,000-$145,000+) compared to MD-102 roles ($70,000-$130,000+), reflecting MS-102’s broader tenant-level scope. However, professionals who hold both certifications and move into unified enterprise admin roles often earn more than either certification alone would suggest, in the $110,000-$140,000+ range.
What should I study alongside MS-102 or MD-102?
MS-102 pairs well with SC-300 (Identity and Access Administrator) for deeper identity specialization, or SC-200 (Security Operations Analyst) for security-focused roles. MD-102 pairs well with MS-102 itself, SC-200, or AZ-104 (Azure Administrator) for infrastructure-adjacent endpoint security roles.
Can I take MD-102 without IT experience?
There are no official mandatory prerequisites for either exam, but both are designed for candidates who already have relevant hands-on experience. MD-102 in particular tends to be difficult for people who have not spent real time working inside the Intune admin console, regardless of general IT experience.
Do MS-102 and MD-102 expire?
Yes. Both are Associate-level certifications valid for 1 year, renewable for free through a shorter online assessment on Microsoft Learn, which opens 6 months before expiry and focuses on what has changed in the platform since your last pass.
