TL;DR:

This was one of the hardest certification exams I’ve taken, especially because a lot of it focused on Defender, Entra, and other Microsoft 365 security tools that I don’t use regularly in my university IT role. I had 65 questions on this exam. Even though most my study resources were CBT Nuggets, MeasureUp, Microsoft Learn practice assessment, and AI tools, I still felt incomplete. Luckily the hands-on practice in an E5 developer tenant helped fill in some gaps. During the exam, I moved quickly, flagged a lot of questions, and relied heavily on the built-in Microsoft Learn access during review to look up nuanced topics. I ended up passing with a 763...not a pretty score, but a pass is a pass. My biggest advice: don’t rely on brain dumps, study the official documentation, because this exam tests very specific, detail-heavy concepts.

Long-form:

So, let me start up by saying, this is one of the toughest certification exams that I have been through. From the first ten questions, it was all Defender related, and it was really a “what the fuck is this shit moment.” That said, I passed today with a 763. Is it the prettiest score? Not by a long shot. But the certificate says passed, and that is all that matters. I am going to try to just spill out everything I can remember from the exam. You can view my MD-102 take here.

For context, my organization just started using Intune in the past couple of years. I was given access about a year ago. Speaking of given access, I am not a global administrator. I work in a university, so we use a distributed IT model. That means, I handle my unit (using administrative units), and that is it. I do not have access to compliance policies, conditional access, PIM, multi factor settings, etc. We are a Google org, so we d do not use Teams, SharePoint, or OneDrive (or Microsoft 365 Backup for that matter). We also do not use Defender XDR (after learning it, I wish we did), nor do we use Purview. However, we are hybrid, and we use PTA. Sadly, I was not part of Entra tenant setup, so I had zero experience with that. Thankfully, I work closely with our GA, and was able to build a picture for some things.

To help me with the exam, a friend of mine from another organization had an E5 Developer tenant and let me play around with it. I believe that really helped me paint the bigger picture. I was able to build conditional access controls, set up passwordless login, and see how PIM works. They also bought the Defender XDR add-on which included Defender for Endpoint and Purview. To see labels and retention policies (policy tips, watermark, etc) was very cool. On the Defender side, being able to see incidents (using the fake PowerShell command) was cool as well. However, I really could not grasp a secure score or vulnerability exposure as it's tough to get real-world alerts.

For studying, I used the video series from CBT Nuggets. In the past, I always enjoy CBT Nuggets. However. while it was some useful information there, it felt incomplete. I gathered the transcripts, and ChatGPT and Claude both discovered that it was missing information from some major exam domains. The trainer also said that they were going to go over concepts but never returned to it. As always, I always try to use some exam preparation tool. This time it was MeasureUp. In the past, MeasureUp really came in clutch. While the practice exams felt authentic, a lot of chatter online said that it did not come close to the actual exam. I must agree with them. While it allowed me to understand some concepts better (I.e. ZAP, anti-spam policies), it was no where close to the exam. I felt that it gives like 20% of the real deal. I then looked at the Microsoft Learn practice assessment. And that was an eye opener. However, even for that, it felt incomplete and kind of rush as an afterthought. I tried using ChatGPT, Claude and Gemini (NotebookLM specifically), but it could only help me with information I got from CBT, MeasureUp and the practice assessment. Maybe if I set up a MCP server that pulls directly from MS Learn, maybe that will help me in the future.

As far as the exam itself, I felt like it was very unfamiliar information. As I stated before, the first 10 questions were straight Defender questions, and I had no clue what they meant. Luckily, MS Learn can be used, but more on that later. Since I only had 1 hour and 40 minutes, and 65 questions, my strategy was to blast through the exam and try to answer questions in 30 seconds. If I did not know the answer, then simply mark it for review, and move on. When I got to questions 59, I had five scenario-based questions where I could not review and had to answer them on the spot. You cannot even go back. I am assume you could find the answer in another question based on the same scenario. Most of these were easy, except one. As far as my questions that I marked, I had 39 of them with 40 minutes left. As you can tell, I really was not confident in myself. However, it was open book. Last time when I took my MD-102 exam, I tried to slide the MS Learn window, and my exam crash 3 times. This time, I kept the slider in the middle. Even though I was on a 24” monitor, it was not too bad, and I can search and look at the question at the same time. As I mentioned, my study material was not as top notched as I hoped. Some of the questions that threw me for a loop were: where to find ZAP reports (I know what ZAP was), can you add multiple groups within groups whether it's security of M365, setting up GPS-based conditional access policies when passwordless is configured, finding Standard settings for Defender for Cloud Apps, exact data match versus trainable classifiers, and what minimal number of Enterpriseregistration you need for multiple domains. The way that MS Learn works is that it starts at learn.microsoft.com every time you open it. Sometimes your search query brings up AI which has the references you need, and sometimes it brings up nonsense (Microsoft Fabric was popular today). You really need to know what you are searching for. However, during my review, I was able to find the exact answer for a lot of my questions and change the answers. I feel like without that, I would have failed. When my review as over, I had two minutes left. But once I hit submit, I saw “PASSED”, I was so relieved.

So, if you are studying for this exam, it is possible to do it without experience. I do not recommend brain dumps because you cannot be certain what questions will be asked. Not to mention, you really are not retaining information. But I will say, review the documentation. This exam picks the most nuance topic, and quizzes you on it.

Well, I think that’s enough for now. I am done with certifications for a while, and now that I have my Expert badge, I feel accomplished. Unless my organization grants me access to something else (I doubt it), I do not see a need to get more. If you have any questions, I will do my best to answer them and hopefully I can help the next person.