MS-102 · Domain 1 of 4

MS-102 Domain 1: Deploy and manage a Microsoft 365 tenant

Standing up and running the Microsoft 365 tenant itself: domains, org settings, service health, network insights, app updates, usage reports, Microsoft 365 Backup, users, groups, licenses and delegated admin roles.

Exam weight
25–30%
Official functional groups
3
Estimated questions estimate
~14
Suggested study time estimate
12–16 hrs

About 14 min read Reviewed October 2026

Overview

Domain 1 is the day-to-day tenant work of a Microsoft 365 administrator. Microsoft lists three functional groups with 17 bullet objectives. The tenant group runs from creating the tenant and verifying custom domains through org settings such as Security & privacy and Organization profile, Service Health notifications, Network connectivity insights, Microsoft 365 Apps update settings, adoption and usage reporting, and Microsoft 365 Backup.

The users and groups group covers cloud and external users, mail contacts, Microsoft 365 Groups, shared mailboxes, license management with group-based licensing, and bulk changes through Microsoft Graph PowerShell or the Microsoft Entra PowerShell module. The roles group covers Microsoft 365 and Entra admin roles, workload permissions in Defender XDR and Purview, administrative units, and Privileged Identity Management. Exam status: Microsoft has announced that MS-102 and the Microsoft 365 Certified: Administrator Expert credential retire on November 30, 2026.

How it's tested

Tenant questions describe a growing organization with new domains, departments, partners or admins, then ask which setting, PowerShell approach, license model or role assignment satisfies the business request. Many items hinge on where a setting lives: the Microsoft 365 admin center, the Microsoft Entra admin center, or a workload portal.

  • Domain and DNS setup

    A company adds a vanity domain and you pick the verification record, the records needed for mail flow, or why sign-in still shows the onmicrosoft.com suffix.

  • License at scale

    Hundreds of new hires need licenses, and the answer is group-based licensing with a usage location set, not per-user assignment.

  • Least privilege admin

    A regional team needs limited admin rights, and you choose a narrow role, an administrative unit scope, or an eligible assignment in PIM.

Reasoning it through

A school wants new staff licensed automatically and some service plans, such as Viva Engage, switched off. Assigning licenses user by user works but does not scale. A dynamic security group based on the department attribute, with group-based licensing that disables the unwanted plans, handles joiners and leavers automatically. If a user then shows a license error, check usage location and conflicting service plans before anything else.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

1.1 Implement and manage a Microsoft 365 tenantTenant creation, domains, org settings, health, network insights, updates, usage and Backup.
What it means
This group covers creating a tenant, adding and verifying custom domains, configuring org settings including Security & privacy and Organization profile, monitoring Service Health with notifications, configuring Network connectivity insights, managing Microsoft 365 Apps software updates from the admin center, monitoring adoption and usage, and setting up Microsoft 365 Backup.
What to understand
Every tenant starts with an onmicrosoft.com domain that cannot be removed. A custom domain is verified with a TXT record, then you add MX, CNAME (autodiscover) and SPF TXT records for Exchange Online. Security & privacy settings include password expiration and the privacy statement link, while Organization profile holds release preferences (standard or targeted release), themes and custom tiles. Service Health shows incidents and advisories, and email notifications can be sent for chosen services. Network connectivity insights needs office location data and reports egress and latency problems per site. Microsoft 365 Apps update channels include Current, Monthly Enterprise and Semi-Annual Enterprise. Usage reports and Adoption Score show activity, and a privacy setting can hide user names. Microsoft 365 Backup protects Exchange Online, SharePoint and OneDrive through pay-as-you-go billing tied to an Azure subscription.
How it shows up
Expect DNS record choices, where to find a setting, how to hide names in reports, which release preference suits a pilot group, and Backup prerequisites.
Common confusion
Confusing Microsoft 365 Backup, which restores to points in time, with retention policies, which preserve content for compliance.
1.2 Manage users and groupsUsers, external users, contacts, groups, shared mailboxes, licenses and bulk management.
What it means
This group covers creating and managing users in Microsoft Entra ID including external users, creating mail contacts in the Microsoft 365 admin center, managing groups including Microsoft 365 Groups, managing shared mailboxes, monitoring licenses including group-based licensing, and bulk user work with Microsoft Graph PowerShell and Microsoft Entra PowerShell.
What to understand
A user can sign in; a mail contact cannot and simply represents an external address in the global address list. External users are B2B guests with a user type of Guest. Group types matter: Microsoft 365 Groups add a shared mailbox, calendar, SharePoint site and optional Team; security groups grant access; distribution lists and mail-enabled security groups deliver mail. A shared mailbox needs no license up to 50 GB without an archive, and people reach it through delegated Full Access or Send As permissions. Group-based licensing assigns licenses to members and reports errors such as missing usage location, insufficient seats or conflicting plans. The MSOnline and AzureAD modules are retired, so bulk scripts use Connect-MgGraph with cmdlets like New-MgUser, or the Microsoft Entra module with New-EntraUser.
How it shows up
Expect a group type choice for a collaboration need, a shared mailbox licensing question, a license error to diagnose, or the PowerShell module to use.
Common confusion
Licensing a shared mailbox that is under 50 GB and has no archive, or creating a user when only a mail contact was needed.
1.3 Manage roles and role groupsAdmin roles, workload permissions, administrative units and PIM.
What it means
This group covers implementing roles in Microsoft 365 and Microsoft Entra ID, managing permissions for Microsoft Defender XDR, Microsoft Purview and other workloads with roles or role groups, delegating with administrative units, and managing Microsoft Entra roles in Privileged Identity Management.
What to understand
Most admin roles shown in the Microsoft 365 admin center are Microsoft Entra roles, such as User Administrator, License Administrator, Helpdesk Administrator, Exchange Administrator and Global Reader. Workloads add their own layer: Purview uses role groups like Compliance Administrator, eDiscovery Manager and Information Protection, Exchange uses its own role groups, and Defender XDR can use unified role-based access control with custom roles. Administrative units scope roles to a subset of users, groups or devices. PIM makes a role eligible instead of permanently active, so an admin activates it for a set period with MFA, justification or approval, and PIM requires Microsoft Entra ID P2 or Entra ID Governance licensing.
How it shows up
Expect least-privilege role picks, a Purview or Defender permission that a directory role does not cover, and PIM settings such as approval or activation duration.
Common confusion
Assuming Global Administrator is the right answer whenever a workload permission is missing; a workload role group usually fits better.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Custom domain verification

    Proving ownership of a domain before using it for users and mail.

    Remember
    Verification uses a TXT record; mail needs MX, autodiscover CNAME and SPF.
    Tested as
    DNS setup questions.
    Trap
    Expecting the MX record to verify the domain in all cases.

  • Release preferences

    Org setting deciding when users see new Microsoft 365 features.

    Remember
    Targeted release can apply to everyone or selected users.
    Tested as
    Pilot and change control scenarios.
    Trap
    Thinking it controls Microsoft 365 Apps update channels.

  • Service Health

    Admin center view of incidents and advisories per service.

    Remember
    Email notifications can be configured for specific services.
    Tested as
    Outage communication questions.
    Trap
    Looking in Message center for live incidents.

  • Network connectivity insights

    Per-location network performance and egress findings.

    Remember
    Needs office locations or location data to report.
    Tested as
    Remote office performance questions.
    Trap
    Expecting results without any location information.

  • Microsoft 365 Backup

    Backup and point-in-time restore for Exchange Online, SharePoint and OneDrive.

    Remember
    Billed pay-as-you-go through an Azure subscription.
    Tested as
    Ransomware recovery scenarios.
    Trap
    Treating retention policies as a restore tool.

  • Adoption Score

    Organization-level insight into how people use Microsoft 365.

    Remember
    Report privacy settings can anonymize user details.
    Tested as
    Usage and adoption monitoring.
    Trap
    Assuming it scores individual users publicly.

  • Shared mailbox

    Mailbox many users access without its own sign-in.

    Remember
    No license needed up to 50 GB without archive.
    Tested as
    Licensing and access questions.
    Trap
    Granting a license by default.

  • Group-based licensing

    Licenses assigned through group membership.

    Remember
    Usage location must be set; plans can be disabled per group.
    Tested as
    Scaling license management.
    Trap
    Ignoring conflicting service plan errors.

  • Microsoft Graph PowerShell

    Current PowerShell SDK for Microsoft 365 and Entra objects.

    Remember
    Connect-MgGraph with the scopes the task needs.
    Tested as
    Bulk user management.
    Trap
    Using retired MSOnline cmdlets.

  • Administrative unit

    A scope boundary for delegated directory roles.

    Remember
    Assign a role scoped to the unit for regional admins.
    Tested as
    Delegation questions.
    Trap
    Using a group as the role scope.

  • Privileged Identity Management

    Just-in-time activation for privileged roles.

    Remember
    Eligible assignments, time-bound activation, approval and MFA.
    Tested as
    Reducing standing admin access.
    Trap
    Thinking it works without P2 or ID Governance licensing.

  • Purview role groups

    Permission sets for compliance features in Microsoft Purview.

    Remember
    eDiscovery Manager and Compliance Administrator are separate role groups.
    Tested as
    Compliance delegation.
    Trap
    Assigning a directory role when a role group was required.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Group and recipient types

ConceptMeaningKey differenceCommon trap
Microsoft 365 Group Membership plus shared mailbox, calendar, site and optional Team Built for collaboration Using it only to grant app access
Security group Grants access to resources and can license users No mailbox unless mail-enabled Expecting it to receive email
Distribution list Email delivery to a set of recipients Cannot be used to assign permissions Choosing it for SharePoint access
Shared mailbox Mailbox accessed through delegated permissions No sign-in or license under 50 GB Licensing it unnecessarily
Mail contact External address listed in the address book Cannot sign in or own resources Creating a user instead

Role assignment options

ConceptMeaningKey differenceCommon trap
Active assignment Role permissions available at all times Standing privilege Using it for occasional tasks
Eligible assignment in PIM Role must be activated before use Time-bound with MFA or approval Forgetting the P2 or ID Governance requirement
Administrative unit scope Role limited to members of a unit Narrows which objects an admin can change Assigning the role at tenant scope instead
Workload role group Permissions inside Purview, Exchange or Defender Does not grant directory-wide rights Picking Global Administrator for one feature

Update and release controls

ConceptMeaningKey differenceCommon trap
Release preferences Timing of new Microsoft 365 service features Standard or targeted release Confusing with Office app channels
Microsoft 365 Apps update channel Cadence of desktop app feature updates Current, Monthly Enterprise or Semi-Annual Enterprise Thinking release preferences change it
Message center Announcements of upcoming changes Planning information, not live incidents Checking it during an outage

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Shared mailbox license

    What candidates pick
    Assign an Exchange Online license to every shared mailbox.
    Why it looks right
    Mailboxes usually need licenses.
    Why it's wrong
    Shared mailboxes under 50 GB without an archive or litigation hold need no license.

    Clue to watch for The mailbox is small and only accessed by delegates.

  2. Wrong verification record

    What candidates pick
    Add the MX record first to verify the domain.
    Why it looks right
    MX is the best-known mail record.
    Why it's wrong
    Microsoft verifies ownership with the TXT value it provides; mail records come after verification.

    Clue to watch for The question asks how to prove ownership.

  3. Release vs update channel

    What candidates pick
    Change release preferences to slow Word and Excel feature updates.
    Why it looks right
    Both settings sound like update timing.
    Why it's wrong
    Release preferences affect service features; desktop app cadence is set by the Microsoft 365 Apps update channel.

    Clue to watch for The scenario names desktop apps or channels.

  4. Global Administrator for eDiscovery

    What candidates pick
    Make the legal reviewer a Global Administrator.
    Why it looks right
    It grants access to everything.
    Why it's wrong
    eDiscovery rights come from Purview role groups such as eDiscovery Manager, which keeps privilege narrow.

    Clue to watch for A compliance or legal team needs one capability.

  5. Permanent admin roles

    What candidates pick
    Assign User Administrator permanently to on-call staff.
    Why it looks right
    It is simple to set up.
    Why it's wrong
    Occasional admin work fits eligible PIM assignments with time-limited activation.

    Clue to watch for The task mentions occasional use or reducing standing access.

  6. License error ignored

    What candidates pick
    Re-add the user to the licensing group.
    Why it looks right
    Membership looks like the cause.
    Why it's wrong
    Group licensing errors usually come from missing usage location, too few licenses or conflicting service plans.

    Clue to watch for The user is a member but shows no license.

Answer framework

Use this sequence when a tenant administration scenario lists several possible fixes.

  1. Name the object involved: tenant setting, domain, user, contact, group, shared mailbox, license or admin role, and where it is managed.
  2. For domains and org settings, confirm the exact record or setting and whether it lives in the Microsoft 365 or Entra admin center.
  3. For users and groups, choose the recipient or group type that fits collaboration, mail or access needs, and check licensing rules for it.
  4. For scale, prefer group-based licensing and Microsoft Graph or Entra PowerShell over manual changes, and check usage location first.
  5. For admin rights, choose the narrowest Entra role or workload role group, scope it with an administrative unit, and make it eligible in PIM.

Practice question

A company's legal team must search mailboxes and place content on hold for an investigation. The security officer wants the team to have only the permissions this work needs. Which assignment should the Microsoft 365 administrator make?

Want more like this? The MS-102 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Sign up for a Microsoft 365 E5 trial or a developer tenant and treat it as your lab. Add a domain you own, follow the DNS wizard, and note each record it asks for. Walk through every page under Settings and Org settings, change release preferences, configure Service Health notifications, and open the usage reports with names concealed.

Next, build realistic users. Import a CSV of staff, then repeat the job with Connect-MgGraph and New-MgUser so you know the syntax. Create each group type and a shared mailbox, set up group-based licensing on a dynamic group, and cause an error by leaving out usage location.

Finish with roles. Assign Helpdesk Administrator scoped to an administrative unit, make a test admin eligible for User Administrator in PIM, and activate it. Then open Purview and Defender XDR permissions to see how role groups differ from directory roles. Because the exam retires on November 30, 2026, book a date with time for a retake, and drill scenario questions on least privilege until the right role comes to mind quickly.

FAQ

How much of MS-102 is Domain 1, Deploy and manage a Microsoft 365 tenant?

Microsoft weights Deploy and manage a Microsoft 365 tenant at 25–30% of the exam, across three functional groups: the tenant itself, users and groups, and roles and role groups.

Is MS-102 retiring?

Yes. Microsoft's study guide and certification page state that MS-102 and the Microsoft 365 Certified: Administrator Expert credential retire on November 30, 2026, and the credential cannot be earned or renewed after that date.

What replaces MS-102?

Microsoft's notice does not name a direct replacement. Community posts point to AB-650, Administering Microsoft 365 and AI Services, as the related new exam, so check Microsoft Learn before deciding.

Do I still need to know MSOnline PowerShell?

No. Microsoft retired the MSOnline and AzureAD modules, and the objectives name Microsoft Graph PowerShell and Microsoft Entra PowerShell for bulk user management.

Does a shared mailbox need a license?

Not while it stays under 50 GB and has no archive or litigation hold. Users reach it through Full Access, Send As or Send on Behalf permissions.

Is Microsoft 365 Backup the same as retention?

No. Backup restores Exchange Online, SharePoint and OneDrive content to earlier points in time, while retention keeps content for compliance and governs deletion.

Which license does PIM need?

Privileged Identity Management requires Microsoft Entra ID P2 or Microsoft Entra ID Governance for the users who benefit from it.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered domains, org settings, Backup, users, groups, licenses and admin roles. See whether you can pick the least-privilege option under timed conditions.

Take the MS-102 practice test Check your MS-102 readiness

Keep going