Microsoft 365 Administrator (MS-102) Exam — Questions and Answers

Question 1: A company wants to set a minimum password length of 12 characters for all cloud-only Microsoft 365 user accounts. Where is this configured?

Azure AD Password Protection settings
Microsoft Intune compliance policy
Exchange Online password policies
Microsoft 365 admin center > Settings > Security & privacy > Password policy (Correct answer)

Correct answer: Microsoft 365 admin center > Settings > Security & privacy > Password policy

Password policy settings in the Microsoft 365 admin center Security & privacy section control minimum length and expiration for cloud-only accounts.

Question 2: An administrator wants to customize the look and feel of the Microsoft 365 navigation bar for all users by adding the company logo and changing the color scheme to match corporate branding. Which setting should be configured?

Azure AD > Company branding
Microsoft 365 admin center > Reports > Usage
Microsoft 365 admin center > Settings > Org settings > Custom themes (Correct answer)
Microsoft 365 admin center > Settings > Domains

Correct answer: Microsoft 365 admin center > Settings > Org settings > Custom themes

Within the Microsoft 365 admin center, the 'Custom themes' option under 'Org settings' and the 'Organization profile' tab allows an administrator to set a default theme that includes a custom logo, navigation bar color, and other visual elements for all users in the organization.

Question 3: An admin needs to prevent external sharing of files labeled 'Confidential' in SharePoint. Which combination of features achieves this?

MFA + Conditional Access
Information Barriers + Communication Compliance
Sensitivity label with encryption + DLP policy (Correct answer)
Retention policy + eDiscovery hold

Correct answer: Sensitivity label with encryption + DLP policy

Sensitivity labels with encryption restrict who can access labeled files, while DLP policies can block external sharing of labeled content.

Question 4: When classifying a resolved incident, which classification should be chosen if the alert was triggered by a legitimate, expected admin script?

True positive – multistage attack
Unknown classification only
Informational, expected activity (Correct answer)
True positive – malicious user activity

Correct answer: Informational, expected activity

Benign but expected activity such as an approved admin script is classified as Informational, expected activity.

Question 5: A security admin wants to automatically investigate and remediate alerts without manual intervention in Microsoft 365 Defender. Which capability supports this?

Automated Investigation and Remediation (AIR) (Correct answer)
Threat Analytics
Advanced Hunting
Attack Surface Reduction

Correct answer: Automated Investigation and Remediation (AIR)

AIR in Microsoft 365 Defender automatically investigates alerts and takes remediation actions based on configured settings.

Question 6: An administrator needs to review all content searches and eDiscovery cases in Microsoft Purview. Which role group must they be a member of?

Global Reader
Security Operator
eDiscovery Manager (Correct answer)
Compliance Administrator

Correct answer: eDiscovery Manager

The eDiscovery Manager role group allows members to create and manage eDiscovery cases and run content searches in Microsoft Purview.

Question 7: A Conditional Access policy requires MFA for all cloud apps, but an administrator needs to exempt the Microsoft Intune Enrollment app. What is the correct configuration?

Add the Intune Enrollment app to the trusted locations list
Configure a separate policy with block access for Intune Enrollment
Exclude Microsoft Intune Enrollment from the cloud apps assignment (Correct answer)
Set the device platform condition to exclude Windows

Correct answer: Exclude Microsoft Intune Enrollment from the cloud apps assignment

Excluding Microsoft Intune Enrollment from the cloud apps assignment prevents the MFA requirement from applying during the device enrollment process.

Question 8: An organization wants to ensure only compliant devices can access Exchange Online. Which Intune feature, combined with Conditional Access, enforces this requirement?

Device configuration profiles
Endpoint security policies
Device compliance policies (Correct answer)
App protection policies

Correct answer: Device compliance policies

Device compliance policies define the security rules a device must meet, and when paired with Conditional Access, Intune marks non-compliant devices as blocked from accessing Exchange Online.

Question 9: A retain-only policy keeps content for 3 years with no delete action. A user deletes an email after 1 year. What happens at the end of year 3?

The email returns to the user's Inbox
The email is moved to an archive mailbox permanently
Nothing, because retain-only policies never remove content
The email is permanently deleted from Recoverable Items (Correct answer)

Correct answer: The email is permanently deleted from Recoverable Items

Items the user deleted are held in Recoverable Items and are purged once the retention period ends.

Question 10: An admin wants a retention policy to automatically cover every new employee whose Department attribute equals Finance. What should be used?

A static policy listing each Finance user
A sensitivity label policy scoped to Finance
An adaptive scope using the User scope type with a Department query (Correct answer)
A dynamic distribution group assigned as a static location

Correct answer: An adaptive scope using the User scope type with a Department query

Adaptive scopes use attribute-based queries, so new users who match are included automatically.

Question 11: An organization needs to automatically apply a 'Confidential' sensitivity label to all documents stored in a specific SharePoint Online site. This label must encrypt the content and restrict access. What is the most direct method to configure this requirement in the Microsoft Purview compliance portal?

Publish the 'Confidential' sensitivity label to all users and rely on them to apply it manually.
Create an auto-labeling policy that targets the specific SharePoint site location and applies the 'Confidential' label. (Correct answer)
Configure a default sensitivity label directly on the document library settings within the SharePoint site.
Create a Data Loss Prevention (DLP) policy that applies to the SharePoint site and triggers on any content.

Correct answer: Create an auto-labeling policy that targets the specific SharePoint site location and applies the 'Confidential' label.

An auto-labeling policy is the correct tool to automatically find and apply a sensitivity label to content at rest in specific locations like a SharePoint site. [18] While a default label can be set on a library, an auto-labeling policy is more scalable and can be managed centrally for multiple sites or conditions. [3, 20] DLP policies are designed to prevent data exfiltration, not primarily for applying encryption labels to all content at rest. Manual application is not an automatic solution.

Question 12: A tenant has multiple subscriptions. An admin needs to assign Microsoft 365 E5 licenses only to users in the Finance department. What is the best approach?

Use a security group with group-based licensing and add Finance users to it (Correct answer)
Assign licenses manually per user in the admin center
Create a Conditional Access policy targeting Finance users
Use a retention policy scoped to the Finance department

Correct answer: Use a security group with group-based licensing and add Finance users to it

Group-based licensing scoped to a Finance security group ensures only Finance department members receive E5 licenses automatically.

Question 13: An incident contains two alerts that clearly belong to a different, unrelated attack. What can an analyst do from the incident page?

Export them as a custom detection
Delete the alerts permanently
Move the alerts to another or a new incident (Correct answer)
Convert them to a Secure Score action

Correct answer: Move the alerts to another or a new incident

Analysts can link alerts to a different existing incident or a new one when correlation grouped them incorrectly.

Question 14: What is Microsoft 365’s default security feature for protecting emails?

Microsoft Defender for Office 365 (Correct answer)
Password protection.
Email encryption.
Multi-factor authentication.

Correct answer: Microsoft Defender for Office 365

Microsoft Defender for Office 365 (formerly Office 365 Advanced Threat Protection) is a cloud-based email filtering service that protects organizations from advanced threats like phishing, spoofing, business email compromise, and malware. It provides robust protection for email, links, and collaboration tools like SharePoint and Teams, going beyond basic spam filtering. This service is Microsoft 365's primary defense against sophisticated email-borne attacks.

Question 15: How can administrators manage Microsoft 365 licenses?

By using the Microsoft 365 admin center (Correct answer)
By accessing Microsoft Azure cloud services.
By managing on-premises hardware.
By creating custom applications.

Correct answer: By using the Microsoft 365 admin center

The Microsoft 365 admin center is the central web-based portal for managing all aspects of an organization's Microsoft 365 subscription. This includes purchasing, assigning, and revoking licenses for users, as well as managing user accounts, domains, and service settings. It provides a comprehensive interface for administrators to control their Microsoft 365 environment and ensure users have appropriate access to services.

Question 16: When configuring Azure AD Connect Health, which role is required to view the health data in the Azure portal?

Reports Reader
Global Reader (Correct answer)
Security Administrator
Security Reader

Correct answer: Global Reader

The Global Reader role has sufficient permissions to view Azure AD Connect Health monitoring data in the portal.

Question 17: Identity Protection detects that a user's credentials appear in a leaked credentials dataset. Which risk type is raised?

Device risk
User risk (Correct answer)
Application risk
Sign-in risk

Correct answer: User risk

Leaked credentials is a user risk detection because it indicates the account itself may be compromised.

Question 18: An administrator is creating a custom Sensitive Information Type (SIT) to detect a unique internal project code with the format 'PROJ-' followed by exactly six digits (e.g., PROJ-123456). Which of the following should be used as the primary element to define this specific pattern?

A document fingerprint
A regular expression (Correct answer)
A keyword dictionary
A trainable classifier

Correct answer: A regular expression

A regular expression (regex) is the ideal primary element for defining a specific, repeatable pattern like 'PROJ-' followed by six digits. A regex such as `PROJ-\d{6}` would accurately match this format. A keyword dictionary is impractical for a large number of unique codes, a document fingerprint detects entire forms, and a trainable classifier is for less-structured data.

Question 19: How many Global Administrators does Microsoft recommend having in a tenant?

Fewer than 5, but more than 1 (Correct answer)
As many as there are IT staff
At least 20 for redundancy
Exactly 1

Correct answer: Fewer than 5, but more than 1

Microsoft recommends fewer than five Global Administrators (with at least two for resilience) to reduce attack surface.

Question 20: Defender for Identity detects a Kerberoasting attempt. What does the attacker target?

Exchange mailbox permissions
Entra ID refresh tokens
Service principal names and service ticket hashes (Correct answer)
Local SAM database files

Correct answer: Service principal names and service ticket hashes

Kerberoasting requests service tickets for SPN accounts to crack their passwords offline.

Question 21: You are preparing to deploy a new Conditional Access policy that will require all administrators to sign in from a compliant device. Before enforcing the policy, you need to evaluate its potential impact on all administrator sign-ins over a one-week period without blocking anyone. What is the recommended state for the policy during this evaluation phase?

Off
Report-only (Correct answer)
Disabled
On

Correct answer: Report-only

Report-only mode is a policy state specifically designed for testing and evaluation. When a policy is in Report-only mode, it evaluates sign-ins against its conditions and logs the outcome (Success, Failure, etc.) as if it were enforced, but it does not actually block or prompt the user. This allows administrators to assess the impact safely.

Question 22: An admin needs to ensure sensitive data leaving Microsoft 365 via email is blocked automatically. Which solution should they configure?

Microsoft Defender for Endpoint
Data Loss Prevention (DLP) policy (Correct answer)
Microsoft Secure Score
Azure AD Conditional Access

Correct answer: Data Loss Prevention (DLP) policy

DLP policies in Microsoft 365 detect and prevent the sharing of sensitive information through email and other channels.

Question 23: A company wants to enforce Conditional Access only for users accessing SharePoint Online from unmanaged devices. Which cloud app should be selected in the policy?

Office 365
Microsoft Teams
Microsoft Azure Management
Office 365 SharePoint Online (Correct answer)

Correct answer: Office 365 SharePoint Online

Selecting 'Office 365 SharePoint Online' as the cloud app scopes the policy specifically to SharePoint Online access.

Question 24: A Microsoft 365 administrator wants to configure a retention policy that keeps Exchange emails for 7 years but allows users to delete emails sooner. Which retention behavior should be selected?

Retain only
Retain and then delete (Correct answer)
Retain and allow deletion during retention
Delete only

Correct answer: Retain and then delete

The 'Retain and then delete' setting keeps content for the retention period and deletes it afterward, but users can still delete items before the period ends.

Question 25: Your organization uses Microsoft Entra Connect with Password Hash Synchronization. You have placed the primary sync server into staging mode to perform maintenance. Which of the following statements is true regarding the server in staging mode?

The server stops synchronizing password changes from the on-premises AD. (Correct answer)
The server automatically takes over if the new primary server fails.
The server will continue to export all object changes to Microsoft Entra ID.
The server's SQL database is deleted to save space.

Correct answer: The server stops synchronizing password changes from the on-premises AD.

When a Microsoft Entra Connect server is put into staging mode, it ceases to perform exports. This includes stopping the synchronization of password changes and password writeback, even if those features were selected during installation. It continues to import and synchronize data to its own database but does not write to Microsoft Entra ID or on-premises AD.

Question 26: A company acquires another organization and needs to merge their Microsoft 365 tenants. What is the recommended Microsoft approach for tenant-to-tenant migration?

Export PST files and reimport to the target tenant
Perform a cross-tenant migration using Microsoft 365 cross-tenant migration tools (Correct answer)
Use Azure AD Connect to sync both tenants simultaneously
Create a federated trust between the two tenants

Correct answer: Perform a cross-tenant migration using Microsoft 365 cross-tenant migration tools

Microsoft provides cross-tenant migration tools and guidance for moving mailboxes, Teams data, and SharePoint content between tenants during mergers.

Question 27: Which role in the Microsoft Defender portal allows a user to view Defender for Identity alerts and security data but not change settings?

Global Administrator
Security Administrator
Security Reader (Correct answer)
Compliance Administrator

Correct answer: Security Reader

Security Reader grants read-only access to security data and alerts.

Question 28: Which Secure Score status indicates you plan to implement the action and it is not yet complete?

Third party
Planned
Completed
To address (Correct answer)

Correct answer: To address

To address is the default status for recommendations that have not yet been implemented.

Question 29: An admin wants to export a report of all Microsoft 365 licenses assigned to users, including which licenses are unused. What is the most efficient method?

Check Azure Cost Management for license utilization
Download the licensing report from Microsoft 365 admin center > Billing > Licenses (Correct answer)
Run Get-MsolAccountSku in PowerShell
Use Microsoft Graph API to query license assignments

Correct answer: Download the licensing report from Microsoft 365 admin center > Billing > Licenses

The Billing > Licenses section in the Microsoft 365 admin center provides a clear view of assigned versus available licenses for each subscription.

Question 30: A tenant administrator needs to review all changes made to tenant settings over the last 30 days. Where should they look?

Microsoft Secure Score
Service Health dashboard
Azure AD Audit Logs (Correct answer)
Microsoft 365 Message Center

Correct answer: Azure AD Audit Logs

Azure AD Audit Logs record all administrative activities including tenant configuration changes with timestamps and actor details.

Question 31: Which Defender XDR capability gives you analyst reports on emerging threats and shows whether your organization is exposed to them?

Attack simulation training
Threat analytics (Correct answer)
Compliance Manager
Secure Score history

Correct answer: Threat analytics

Threat analytics provides expert-written reports on active threat actors and campaigns. It shows impacted assets, exposure, and recommended mitigations for your environment.

Question 32: An organization needs to ensure that only compliant devices can access Microsoft 365 resources. Which feature enforces device compliance as an access condition?

Intune App Protection Policy
Conditional Access with device compliance requirement (Correct answer)
Azure AD MFA registration policy
Microsoft Defender for Endpoint

Correct answer: Conditional Access with device compliance requirement

Conditional Access policies can require that devices meet Intune compliance requirements before granting access to Microsoft 365 resources.

Question 33: A Conditional Access policy targets 'All guest and external users'. Which user type is included by this assignment?

Service accounts in the tenant
B2B collaboration guest users invited to the tenant (Correct answer)
Users synchronized from on-premises AD
Members of federated domains in the same tenant

Correct answer: B2B collaboration guest users invited to the tenant

'All guest and external users' targets B2B collaboration users who have been invited to and have accounts in the Azure AD tenant.

Question 34: What tool is commonly used to migrate emails to Microsoft 365?

Exchange Online Migration Tool (Correct answer)
Microsoft 365 Admin Center.
PowerShell.
Azure Migrate.

Correct answer: Exchange Online Migration Tool

The Exchange Online Migration Tool is specifically designed to facilitate the transfer of email data from various source systems to Microsoft 365's Exchange Online. This integrated tool streamlines the migration process, ensuring data integrity and minimizing disruption during the transition to the cloud-based email service. While PowerShell can be used for advanced tasks, the dedicated migration tool is the primary, user-friendly option for this specific task.

Question 35: A Conditional Access policy has multiple grant controls configured: 'Require MFA' and 'Require compliant device' with 'Require one of the selected controls' logic. What does this mean?

Users only need to satisfy either MFA or compliant device, not both (Correct answer)
Users must satisfy MFA first, then compliant device
Users must satisfy both MFA and compliant device requirements
The policy will apply only when both conditions are unmet

Correct answer: Users only need to satisfy either MFA or compliant device, not both

'Require one of the selected controls' (OR logic) means satisfying any single grant control is sufficient to gain access.

Question 36: What does the Secure Score metric 'Comparison' help an admin see?

Current service health
Which users have the weakest passwords
Which licenses are unused
How their score compares with organizations of similar size (Correct answer)

Correct answer: How their score compares with organizations of similar size

Comparison shows your score against similar-size organizations and your own history trend.

Question 37: You need to search the unified audit log. Which role must the user hold in Exchange Online to have access to the audit log search?

View-Only Audit Logs or Audit Logs (Correct answer)
Mail Recipients
Distribution Groups
Transport Rules

Correct answer: View-Only Audit Logs or Audit Logs

To search the audit log, a user needs the View-Only Audit Logs or Audit Logs role in Exchange Online. By default these roles are assigned to the Compliance Management and Organization Management role groups.

Question 38: When multiple retention settings conflict, which is the correct order of retention principles?

Policy wins over label, then newest wins
Retention wins over deletion, then longest retention, then explicit over implicit, then shortest deletion (Correct answer)
Shortest deletion wins first, then longest retention
Explicit wins first, then retention wins over deletion

Correct answer: Retention wins over deletion, then longest retention, then explicit over implicit, then shortest deletion

Purview applies retention over deletion, longest retention, explicit over implicit, and finally shortest deletion.

Question 39: What is the purpose of conditional access in Microsoft 365?

To provide backup storage.
To configure office applications.
To monitor emails.
To enforce security policies and access control (Correct answer)

Correct answer: To enforce security policies and access control

Conditional Access in Microsoft 365 (powered by Azure Active Directory) allows administrators to enforce specific security policies based on various conditions, such as user location, device compliance, or application being accessed. It ensures that users can only access resources when they meet certain criteria, thereby strengthening access control and protecting sensitive data. This is a key component of a Zero Trust security strategy.

Question 40: Which Defender for Cloud Apps policy type scans files in connected SaaS apps for sensitive content and can apply a sensitivity label?

Activity policy
File policy (Correct answer)
Access policy
Cloud discovery policy

Correct answer: File policy

File policies inspect files in connected apps and support governance actions such as applying sensitivity labels.

Question 41: A Microsoft 365 administrator needs to configure the tenant so that Microsoft support engineers cannot access tenant data without explicit admin approval. Which feature enables this?

Customer Lockbox (Correct answer)
Information barriers
Customer Key
Privileged Identity Management

Correct answer: Customer Lockbox

Customer Lockbox requires an admin to explicitly approve before Microsoft support can access tenant data, providing an additional control layer.

Question 42: A company wants to minimize email delivery delays for recipients while still ensuring attachments are scanned for zero-day threats. Which action in a Safe Attachments policy achieves this by delivering the email body immediately with a placeholder for the attachment while it is being scanned?

Monitor
Dynamic Delivery (Correct answer)
Block
Replace

Correct answer: Dynamic Delivery

The Dynamic Delivery action is designed to avoid message delays. It delivers the email to the recipient immediately but replaces any attachments with a placeholder. The attachment is scanned in a sandbox environment, and if it's deemed safe, it is reattached to the email in the user's mailbox. If it's malicious, it is quarantined.

Question 43: What does Microsoft Secure Score represent?

A license usage percentage
A measurement of an organization's security posture based on completed improvement actions (Correct answer)
The number of alerts closed per month
The count of blocked phishing emails

Correct answer: A measurement of an organization's security posture based on completed improvement actions

Secure Score is a percentage showing how many recommended improvement actions have been achieved.

Question 44: How long does Microsoft Defender XDR retain incident data in the portal by default?

Indefinitely
180 days (Correct answer)
7 days
24 hours

Correct answer: 180 days

Incident and alert data is retained for 180 days in the Defender portal.

Question 45: What does a Defender for Identity 'honeytoken' account help detect?

Any authentication or activity attempt on a decoy sensitive account (Correct answer)
Licensing overuse
Expired certificates
Unmanaged mobile devices

Correct answer: Any authentication or activity attempt on a decoy sensitive account

Honeytoken accounts are decoys; any activity involving them triggers an alert.

Question 46: How can an organization start an event-based retention event automatically from HR data, such as an employee termination date?

By editing the label description
By using a Microsoft Purview HR connector (Correct answer)
By creating an Exchange transport rule
By enabling the Unified Audit Log

Correct answer: By using a Microsoft Purview HR connector

HR connectors import data such as termination dates that can trigger retention events.

Question 47: A SOC analyst wants to stop reviewing alerts that come from a known, approved penetration test. Which feature suppresses these alerts in Defender XDR?

Advanced hunting function
Attack surface reduction rule
Alert tuning (suppression rule) (Correct answer)
Secure Score improvement action

Correct answer: Alert tuning (suppression rule)

Alert tuning lets you create rules that hide or resolve alerts matching defined conditions, such as a known pen-test.

Question 48: Which Defender XDR capability automatically merges alerts from Defender for Endpoint, Office 365 and Identity into a single incident?

Information barriers
Conditional Access
Incident correlation (Correct answer)
Mail flow rules

Correct answer: Incident correlation

Defender XDR correlation links alerts across workloads into one incident so analysts see the full attack chain.

Question 49: Where can an admin review pending and completed automated and manual remediation actions across Defender workloads?

Entra sign-in logs
Action center (Actions & submissions) (Correct answer)
SharePoint admin center
Microsoft 365 admin center billing

Correct answer: Action center (Actions & submissions)

The Action center centralizes pending and completed remediation actions across endpoints, email and identities.

Question 50: An organization wants to allow access to Microsoft 365 apps only from devices running Windows 10 or Windows 11. Which Conditional Access condition should be configured?

Device platform condition targeting 'Windows' (Correct answer)
Device state condition targeting 'Hybrid Azure AD joined'
Named locations targeting the corporate network
Client apps condition targeting 'Browser'

Correct answer: Device platform condition targeting 'Windows'

The device platform condition allows targeting of specific operating systems, including Windows, to restrict access accordingly.

Microsoft 365 Administrator (MS-102) Exam

The MS-102 exam validates expertise in deploying, configuring, and managing Microsoft 365 tenants, including identity and access, security with Microsoft Defender XDR, and compliance with Microsoft Purview.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Test dates, test delivery, passing score, score release, renewal, score validity, retake fee, retake policy, exam format, time limit · verified Nov 2026