MS-102 study guide · 2026

The 4 MS-102 domains, explained

4 domains and 12 official functional groups. Manage security and threats by using Microsoft Defender XDR carries the most weight at 30–35%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 3 See all domains
Questions
Not published
Time
100–120 minutes (not stated on the MS-102 pages)
Passing score
700 / 1000
Outline
MS-102 study guide, skills measured as of April 28, 2026 (current; exam retires November 30, 2026)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 25–30%
  2. 2 25–30%
  3. 3 30–35%
  4. 4 10–15%
  1. 1 Deploy and manage a Microsoft 365 tenant
  2. 2 Implement and manage Microsoft Entra identity and access
  3. 3 Manage security and threats by using Microsoft Defender XDR
  4. 4 Manage compliance by using Microsoft Purview

All 4 domains

12 official functional groups 52–69 hrs suggested study

  1. Domain 01 25–30%

    Deploy and manage a Microsoft 365 tenant

    Standing up and running the Microsoft 365 tenant itself: domains, org settings, service health, network insights, app updates, usage reports, Microsoft 365 Backup, users, groups, licenses and delegated admin roles.

    Inside this domain

    • Implement and manage a Microsoft 365 tenant
    • Manage users and groups
    • Manage roles and role groups

    Watch for Shared mailbox license

    Functional groups
    3
    Questions est.
    ~14
    Study time est.
    12–16 hrs
  2. Domain 02 25–30%

    Implement and manage Microsoft Entra identity and access

    Connecting on-premises Active Directory to Microsoft Entra ID, choosing and troubleshooting authentication methods and password reset, and enforcing risk-based access and MFA with Conditional Access.

    Inside this domain

    • Implement and manage identity synchronization with Microsoft Entra tenant
    • Implement and manage authentication
    • Implement and manage secure access

    Watch for Connect Health as sync engine

    Functional groups
    3
    Questions est.
    ~14
    Study time est.
    14–18 hrs
  3. Domain 03 30–35%

    Manage security and threats by using Microsoft Defender XDR

    Running Microsoft 365 threat protection from the Defender portal: Exposure Management and Secure Score, incidents and hunting, email and collaboration policies, endpoint onboarding and vulnerabilities, and cloud app control.

    Inside this domain

    • Review and respond to security reports and alerts generated by Microsoft Defender XDR
    • Implement and manage email and collaboration protection by using Microsoft Defender for Office 365
    • Implement and manage endpoint protection by using Microsoft Defender for Endpoint
    • Implement and manage Microsoft Defender for Cloud Apps

    Watch for Anti-malware for zero-day files

    Functional groups
    4
    Questions est.
    ~17
    Study time est.
    18–24 hrs
  4. Domain 04 10–15%

    Manage compliance by using Microsoft Purview

    Protecting and governing Microsoft 365 data with Microsoft Purview: custom sensitive information types, retention, sensitivity labels, label monitoring, and data loss prevention across workloads, Copilot and devices.

    Inside this domain

    • Implement Microsoft Purview information protection and data lifecycle management
    • Implement Microsoft Purview data loss prevention (DLP)

    Watch for Newest policy wins

    Functional groups
    2
    Questions est.
    ~6
    Study time est.
    8–11 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 52–69 hrs of study.

  1. 3 Manage security and threats by using Microsoft Defender XDR 30–35% · 18–24 hrs
  2. 1 Deploy and manage a Microsoft 365 tenant 25–30% · 12–16 hrs
  3. 2 Implement and manage Microsoft Entra identity and access 25–30% · 14–18 hrs
  4. 4 Manage compliance by using Microsoft Purview 10–15% · 8–11 hrs

Try one

Practice questionDomain 3: Manage security and threats by using Microsoft Defender XDR

Security staff discover that employees upload files to several unapproved file-sharing websites. All company laptops are onboarded to Microsoft Defender for Endpoint. The administrator must find these apps and prevent their use with the least additional infrastructure. What should be done?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Shared mailbox license

    Clue The mailbox is small and only accessed by delegates.

  • Domain 2

    Connect Health as sync engine

    Clue The task is to make users appear in the cloud.

  • Domain 3

    Anti-malware for zero-day files

    Clue The attachment is new or not yet known.

  • Domain 4

    Newest policy wins

    Clue Two retention settings conflict.

Other Cloud Computing certifications

Study guides for exams that overlap with MS-102.

Practise what you read

MS-102 domains: common questions

How many domains are in the MS-102 exam?

MS-102 has 4 domains with 12 official functional groups between them: Deploy and manage a Microsoft 365 tenant, Implement and manage Microsoft Entra identity and access, Manage security and threats by using Microsoft Defender XDR and Manage compliance by using Microsoft Purview.

Which MS-102 domain carries the most weight?

Manage security and threats by using Microsoft Defender XDR is the heaviest at 30–35%, followed by Deploy and manage a Microsoft 365 tenant (25–30%). The lightest is Manage compliance by using Microsoft Purview (10–15%). Weights come from Microsoft's official outline.

What is the MS-102 exam format?

Questions: Not published. Time allowed: 100–120 minutes (not stated on the MS-102 pages). Passing score: 700 / 1000.

How long should I study for MS-102?

Our planning estimate is 52–69 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Manage security and threats by using Microsoft Defender XDR, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows MS-102 study guide, skills measured as of April 28, 2026 (current; exam retires November 30, 2026), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (MS-102 study guide, skills measured as of April 28, 2026 (current; exam retires November 30, 2026)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.