MD-102 Exam Changes 2026: The July 24 Outline Adds a Security Copilot Automation Domain

The MD-102 exam changed on July 24, 2026: the Endpoint Administrator exam grew from four domains to five. The new fifth domain, optimize endpoint operations by using automation, monitoring, and reporting, carries 10 to 15 percent of the marks and is built around Security Copilot agents in Intune, PowerShell and Microsoft Graph automation, and Endpoint Analytics. On top of that, Microsoft's official change log grades four existing objective groups as Major changes, and two domain weights move. Microsoft's study guide now carries the heading "Skills measured as of July 24, 2026," and every sitting from that date onward uses the five-domain version.

Here is exactly what changed, verified against the official study guide on Microsoft Learn (last updated June 24, 2026), and what to do about it depending on when you are booked.

The changes at a glance

The new domain is the headline: agents are now on the paper

Three of the new domain's objectives involve Security Copilot agents in Intune: investigating threats the agents identify, analyzing device performance with them, and reviewing and responding to their recommendations to make management decisions. Microsoft also rewrote the audience profile: an endpoint administrator now manages devices "by using Microsoft Intune and agentic tools and workflows." That is a real shift in what Microsoft thinks this job is, and the exam is the enforcement mechanism.

The rest of the domain is more familiar operations work that simply never had its own domain before: automating Intune tasks with PowerShell and Microsoft Graph, Endpoint Analytics device health scores and proactive remediation scripts, custom reporting with workbooks and dashboards, and alert rules for compliance drift and enrollment failures.

Which outline applies to your sitting

If you sat MD-102 before July 24, 2026: the previous four-domain outline applied to you, and nothing about that result changes now. Your badge stands on its own terms.

If you are testing now: study the five-domain outline from the start. The new domain is only 10 to 15 percent, but it is unfamiliar 10 to 15 percent, and the Major-graded rewrites inside the old domains matter more than most candidates expect. Autopilot questions can now hinge on choosing between deployment profiles and device preparation policies, a distinction older courses never mention. Remote actions now include running device queries with KQL. Endpoint security now expects App Control for Business, not just antivirus policies.

Managing a team of admins through this? The change list above is dense enough that forwarding the raw study guide rarely works. It goes down easier if you turn the new study guide into a briefing deck and walk the team through the deltas in fifteen minutes.

What if you certified on the old four-domain outline?

Your certification is unaffected. Microsoft does not revoke or downgrade a badge when an exam outline changes, and nothing on your transcript says which version of the paper you sat. What changes is the renewal, and that is the part people forget to price in.

Microsoft associate certifications renew every 12 months through a free, unproctored, open-book assessment on Microsoft Learn, and that assessment tracks the current outline rather than the one you passed. So the automation and monitoring domain follows you regardless: certify on the four-domain version and your next renewal window will still quiz you on Security Copilot agents in Intune, Endpoint Analytics and proactive remediations. The practical move is to spend two evenings on the new domain now, while it is fresh in the documentation, instead of meeting it cold six or nine months from now with a renewal deadline attached.

If you are booked but have not sat yet, treat the five-domain outline as the only one that exists. Any course, book or question bank that stops at four domains is describing a paper you cannot take anymore.

A concrete study plan for the new domain

The fifth domain has two objective groups, and both are drillable in a sandbox tenant:

• Automate management tasks: automate Intune operations with PowerShell and Microsoft Graph, extend device compliance with PowerShell, and work with Security Copilot agents in Intune: investigate the threats they flag, analyze device performance with them, and act on their recommendations.
• Monitor and optimize health: Endpoint Analytics device health scores and app startup performance, proactive remediation scripts on a schedule, custom reports with workbooks and dashboards, tenant health and service communications, and alert rules for compliance drift, enrollment failures and configuration conflicts.

Two focused evenings cover it: one on the Graph and PowerShell automation surface, one inside Endpoint Analytics and the alerting setup. Then generate a batch of questions restricted to those topics and drill until the vocabulary is automatic.

How to tell if your study material is stale

A quick test that works for any MD-102 course, book or question bank: search it for these terms. If none appear, it was written for the old outline.

• Security Copilot agents
• Device preparation policies
• Endpoint Analytics proactive remediations
• Hotpatch
• KQL device query
• App Control for Business

Stale prep is the most common way working admins fail refreshed exams: they walk in knowing the previous version cold. The fix is cheap. Upload the current study guide or your own updated notes to the MD-102 practice test generator and drill questions weighted to the five real domains, new one included, until the unfamiliar terms stop being unfamiliar.

Where this fits in the bigger 2026 picture

Microsoft has been revising and retiring exams all year: PL-900 was rewritten this month, with its Power Pages domain deleted and a Copilot Studio agents domain added, AZ-204 at the end of July, and the GitHub certification family was rewritten in January. MD-102's July revision is part of the same pattern, folding AI-assisted operations into role-based exams rather than quarantining it in separate AI certifications. For endpoint admins there is a strategic upside: MD-102 remains one of only three associate certifications that qualify you for the Microsoft 365 Administrator Expert badge alongside the MS-102 exam, so the refreshed cert keeps its leverage. Whether that trade is worth your study hours is a fair question, and we answered it in is the MD-102 worth it.

The short version: the exam got broader and more operational, the new domain is small but nobody has muscle memory for it yet, and candidates who update their prep now have a real edge over everyone studying from 2025 material.