MD-102 Exam Changes 2026: The July 24 Outline Adds a Security Copilot Automation Domain

The MD-102 exam changes on July 24, 2026: the Endpoint Administrator exam grows from four domains to five. The new fifth domain, optimize endpoint operations by using automation, monitoring, and reporting, carries 10 to 15 percent of the marks and is built around Security Copilot agents in Intune, PowerShell and Microsoft Graph automation, and Endpoint Analytics. On top of that, Microsoft's official change log grades four existing objective groups as Major changes, and two domain weights move. If you sit the exam before July 24, 2026, the old outline still applies; from that date, the new one is live.

Here is exactly what changed, verified against the official study guide on Microsoft Learn (last updated June 24, 2026), and what to do about it depending on when you are booked.

The changes at a glance

The new domain is the headline: agents are now on the paper

Three of the new domain's objectives involve Security Copilot agents in Intune: investigating threats the agents identify, analyzing device performance with them, and reviewing and responding to their recommendations to make management decisions. Microsoft also rewrote the audience profile: an endpoint administrator now manages devices "by using Microsoft Intune and agentic tools and workflows." That is a real shift in what Microsoft thinks this job is, and the exam is the enforcement mechanism.

The rest of the domain is more familiar operations work that simply never had its own domain before: automating Intune tasks with PowerShell and Microsoft Graph, Endpoint Analytics device health scores and proactive remediation scripts, custom reporting with workbooks and dashboards, and alert rules for compliance drift and enrollment failures.

Booked before July 24? Booked after? Here is the play

Testing before July 24, 2026: nothing changes for you. The previous four-domain outline applies to your sitting. Do not burn prep time on the new automation domain; spend it on the biggest existing domain, manage and maintain devices, and take the free official practice assessment on Microsoft Learn a few days out.

Testing on or after July 24, 2026: study the new outline from the start. The new domain is only 10 to 15 percent, but it is unfamiliar 10 to 15 percent, and the Major-graded rewrites inside the old domains matter more than most candidates expect. Autopilot questions can now hinge on choosing between deployment profiles and device preparation policies, a distinction older courses never mention. Remote actions now include running device queries with KQL. Endpoint security now expects App Control for Business, not just antivirus policies.

Managing a team of admins through this? The change list above is dense enough that forwarding the raw study guide rarely works. It goes down easier if you turn the new study guide into a briefing deck and walk the team through the deltas in fifteen minutes.

Should you rush to test before July 24?

With the change date days away, some candidates are tempted to sprint and sit the old exam. The math only works if you are already near ready. Booking early makes sense when you have been studying the old outline for weeks, your practice scores clear the bar comfortably, and a seat is actually available at your test center or for online proctoring before the cutoff. It does not make sense to compress three weeks of prep into five days to dodge one 10 to 15 percent domain; a rushed fail costs you the exam fee and leaves you studying the new outline anyway for the retake.

There is also a shelf-life argument for just embracing the new version. Microsoft associate certifications renew every 12 months with a free online assessment that tracks the current outline. Certify on the old outline this week and next summer's renewal will test you on the automation domain regardless. Certifying on the new outline means what you studied stays aligned with what you maintain.

A concrete study plan for the new domain

The fifth domain has two objective groups, and both are drillable in a sandbox tenant:

• Automate management tasks: automate Intune operations with PowerShell and Microsoft Graph, extend device compliance with PowerShell, and work with Security Copilot agents in Intune: investigate the threats they flag, analyze device performance with them, and act on their recommendations.
• Monitor and optimize health: Endpoint Analytics device health scores and app startup performance, proactive remediation scripts on a schedule, custom reports with workbooks and dashboards, tenant health and service communications, and alert rules for compliance drift, enrollment failures and configuration conflicts.

Two focused evenings cover it: one on the Graph and PowerShell automation surface, one inside Endpoint Analytics and the alerting setup. Then generate a batch of questions restricted to those topics and drill until the vocabulary is automatic.

How to tell if your study material is stale

A quick test that works for any MD-102 course, book or question bank: search it for these terms. If none appear, it was written for the old outline.

• Security Copilot agents
• Device preparation policies
• Endpoint Analytics proactive remediations
• Hotpatch
• KQL device query
• App Control for Business

Stale prep is the most common way working admins fail refreshed exams: they walk in knowing the previous version cold. The fix is cheap. Upload the current study guide or your own updated notes to the MD-102 practice test generator and drill questions weighted to the five real domains, new one included, until the unfamiliar terms stop being unfamiliar.

Where this fits in the bigger 2026 picture

Microsoft has been revising and retiring exams all year: PL-900 retires this month, AZ-204 at the end of July, and the GitHub certification family was rewritten in January. MD-102's July revision is part of the same pattern, folding AI-assisted operations into role-based exams rather than quarantining it in separate AI certifications. For endpoint admins there is a strategic upside: MD-102 remains one of only three associate certifications that qualify you for the Microsoft 365 Administrator Expert badge alongside the MS-102 exam, so the refreshed cert keeps its leverage. Whether that trade is worth your study hours is a fair question, and we answered it in is the MD-102 worth it.

The short version: the exam got broader and more operational, the new domain is small but nobody has muscle memory for it yet, and candidates who update their prep now have a real edge over everyone studying from 2025 material.