MS-102 Tests Where Each Microsoft 365 Setting Lives and Who Should Hold It
MS-102 retires on 30 November 2026; after that the Microsoft 365 Administrator Expert certification cannot be earned or renewed. Before then, think tenant-wide: the right admin center, the narrowest role, the right Defender or Purview control.
Check Your Readiness →Most candidates understand Microsoft 365 Administrator (MS-102) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Stems describe a growing organisation, a sign-in failure, an attack or a data requirement, and the answer usually depends on where the setting lives: Microsoft 365 admin center, Entra admin center, Defender portal or Purview. 700/1000 to pass; question count and duration are not stated on the exam page.
Loosen the inbound anti-spam policy for that user
Outbound spam limits placed the user on the Restricted entities page. Secure the account first: reset the password, revoke sessions and remove malicious forwarding or inbox rules. Then release the user from Restricted entities.
Connect the Microsoft 365 app connector in Defender for Cloud Apps
App connectors only see activity inside known apps. Enable the Defender for Endpoint integration so Cloud App Discovery uses device traffic, then mark the sites as unsanctioned, which blocks them on onboarded devices with no log collector to deploy.
Run the local onboarding script on each device
The local script suits small pilots. Onboard through Intune, Group Policy or Configuration Manager to reach the fleet, then enable tamper protection so local admins cannot switch protection off, and route Vulnerability Management remediation requests to Intune.
Install a separate DLP agent on each laptop
Endpoint DLP uses the existing Defender for Endpoint onboarding. Create a DLP policy for the Devices location using the custom sensitive information type, set the USB copy action to block, and run it in simulation mode first.
A shared mailbox needs no licence while it stays under 50 GB without an archive or litigation hold. Users reach it through delegated permissions and it has no sign-in of its own. Licence only when size, archive or hold requires it.
Search and hold rights come from the Purview eDiscovery Manager role group, which is separate from Compliance Administrator. Workload role groups avoid tenant-wide privilege; occasional directory admin work belongs in eligible PIM assignments scoped by administrative units.
Hybrid users can reset in the cloud, but the new password fails on domain-joined PCs until password writeback is enabled in Connect Sync or Cloud Sync. Before first sync, run IdFix and add a routable UPN suffix matching a verified domain.
Signature-based anti-malware misses unknown files; Safe Attachments detonates them in a sandbox, and Dynamic Delivery shows the body meanwhile. Safe Links checks URLs at time of click, ZAP removes already-delivered mail, and attack simulation training needs Defender for Office 365 Plan 2.
Purview applies the principles of retention: retention beats deletion and the longest retention period wins. Use a retention policy for whole locations, a published or auto-applied retention label for specific items or records, never a sensitivity label for keep-or-delete periods.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
MS-102 closes on 30 November 2026. Check your Defender, Entra and Purview decisions before sitting it.