MS-102 · Domain 2 of 4

MS-102 Domain 2: Implement and manage Microsoft Entra identity and access

Connecting on-premises Active Directory to Microsoft Entra ID, choosing and troubleshooting authentication methods and password reset, and enforcing risk-based access and MFA with Conditional Access.

Exam weight
25–30%
Official functional groups
3
Estimated questions estimate
~14
Suggested study time estimate
14–18 hrs

About 12 min read Reviewed October 2026

Overview

Domain 2 moves from tenant objects to how people prove who they are. Microsoft splits it into three functional groups with 13 bullet objectives. The synchronization group starts with preparing Active Directory using IdFix, then implementing Microsoft Entra Connect Sync or Microsoft Entra Cloud Sync, watching sync health with Microsoft Entra Connect Health, and troubleshooting errors in either engine.

The authentication group covers the authentication methods policy, self-service password reset, Microsoft Entra Password Protection for cloud and on-premises passwords, and investigating failed sign-ins. The secure access group covers planning and running Microsoft Entra ID Protection, planning and implementing Conditional Access policies, and requiring multifactor authentication through those policies rather than through per-user MFA.

How it's tested

Identity questions usually start with an on-premises forest, a set of users who struggle to sign in, or a security requirement such as blocking risky sign-ins. You choose the preparation tool, sync engine, authentication method, password feature or Conditional Access configuration, and sometimes the log that explains a failure.

  • Pre-sync cleanup

    Users fail to sync because of duplicate proxy addresses or invalid UPN characters, and IdFix or a routable UPN suffix is the fix.

  • Sync engine fit

    Disconnected forests, lightweight agents, or advanced features such as device writeback decide between Cloud Sync and Connect Sync.

  • Policy design

    A requirement to force MFA outside trusted locations or block high-risk sign-ins becomes a Conditional Access policy with the right conditions and grant controls.

Reasoning it through

Users report that MFA prompts appear even inside the head office. The policy requires MFA for all locations. Adding the office's public IP ranges as a trusted named location and excluding it from the MFA policy fixes the prompts. Turning off the policy, or enabling security defaults, would either remove protection or conflict with Conditional Access, so neither meets the requirement to keep MFA for remote access.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

2.1 Implement and manage identity synchronization with Microsoft Entra tenantIdFix preparation, Connect Sync or Cloud Sync, Connect Health and sync troubleshooting.
What it means
This group covers preparing directories for synchronization with tools such as IdFix, implementing directory synchronization with Microsoft Entra Connect Sync or Microsoft Entra Cloud Sync, monitoring sync with Microsoft Entra Connect Health, and troubleshooting problems in both engines.
What to understand
IdFix scans Active Directory for duplicate or malformed proxyAddresses, userPrincipalName values and other attributes that would cause sync errors. Users with a non-routable UPN suffix such as .local should get a routable suffix that matches a verified domain. Connect Sync runs on a Windows server, supports OU and attribute filtering, staging mode for a standby server, device and Exchange hybrid writeback, and a default 30-minute cycle you can trigger with Start-ADSyncSyncCycle. Cloud Sync uses lightweight provisioning agents configured from the cloud and handles disconnected forests well. Connect Health uses agents to alert on sync and AD FS issues and needs Entra ID P1. Troubleshooting relies on sync error reports, duplicate attribute resiliency, and soft or hard matching through the source anchor.
How it shows up
Expect a cleanup tool question, an engine choice from constraints, how to force a delta sync, or why an object did not match.
Common confusion
Thinking IdFix fixes cloud objects; it edits on-premises Active Directory attributes before synchronization.
2.2 Implement and manage authenticationAuthentication methods, SSPR, Password Protection and sign-in troubleshooting.
What it means
This group covers implementing and managing authentication methods, configuring self-service password reset, deploying Microsoft Entra Password Protection, and investigating and resolving authentication issues.
What to understand
The authentication methods policy controls which methods users can register and use, such as Microsoft Authenticator, passkeys (FIDO2), Windows Hello for Business, certificate-based authentication, Temporary Access Pass, SMS and voice. Legacy per-user MFA and SSPR method settings are migrated into this single policy. SSPR is enabled for none, selected or all users, with a number of methods required and a registration prompt; password writeback through Connect Sync or Cloud Sync lets cloud resets update Active Directory. Password Protection blocks weak passwords using a global banned list plus a custom list, and its on-premises proxy and DC agents can run in audit or enforce mode. Sign-in logs show error codes, the Conditional Access result and the authentication details for each attempt.
How it shows up
Expect method selection for onboarding or phishing-resistant sign-in, SSPR writeback prerequisites, and log-based troubleshooting.
Common confusion
Expecting a cloud password reset to change the on-premises password without password writeback enabled.
2.3 Implement and manage secure accessIdentity Protection planning, risk policies, Conditional Access and MFA enforcement.
What it means
This group covers planning for identity protection, implementing Microsoft Entra ID Protection, planning and implementing Conditional Access policies, and enforcing multifactor authentication through Conditional Access.
What to understand
ID Protection calculates user risk, such as leaked credentials, and sign-in risk, such as anonymous IP addresses or atypical travel, and needs Entra ID P2. Microsoft recommends configuring risk responses as Conditional Access policies that use the risk conditions, for example requiring a secure password change for high user risk. A Conditional Access policy has assignments (users, target resources and conditions such as location, device platform or client app) and access controls (block, or grant with MFA, authentication strength or compliant device, plus session controls). Security defaults must be turned off before Conditional Access is used, emergency access accounts should be excluded, and report-only mode plus the What If tool test impact safely.
How it shows up
Expect policy design from a requirement, the effect of conflicting policies, the role of named locations, and risk-based remediation.
Common confusion
Believing the most permissive policy wins; when several policies apply, all their grant requirements must be met and block overrides everything.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • IdFix

    Tool that finds and fixes directory attribute problems before sync.

    Remember
    Targets duplicates and invalid characters in on-premises AD.
    Tested as
    Sync preparation questions.
    Trap
    Running it after errors appear in the cloud only.

  • Routable UPN suffix

    A UPN domain that matches a verified Microsoft 365 domain.

    Remember
    Add it in AD before sync so users sign in with their email-style name.
    Tested as
    Sign-in name mismatches.
    Trap
    Leaving users on a .local suffix.

  • Staging mode

    Connect Sync server that imports and syncs but does not export.

    Remember
    Used for standby servers and safe configuration testing.
    Tested as
    High availability questions.
    Trap
    Running two active Connect Sync servers.

  • Entra Cloud Sync

    Agent-based sync configured from the cloud.

    Remember
    Good fit for disconnected forests and light infrastructure.
    Tested as
    Engine choice scenarios.
    Trap
    Assuming it supports every Connect Sync feature.

  • Connect Health

    Agent-based monitoring for sync and federation services.

    Remember
    Requires Microsoft Entra ID P1.
    Tested as
    Monitoring sync failures.
    Trap
    Confusing it with the sync engine.

  • Temporary Access Pass

    Time-limited passcode for registering or recovering methods.

    Remember
    Supports passwordless onboarding.
    Tested as
    New hire and lost device scenarios.
    Trap
    Treating it as a permanent method.

  • Password writeback

    Sends cloud password changes back to Active Directory.

    Remember
    Needs a sync engine and supports SSPR for hybrid users.
    Tested as
    Hybrid SSPR questions.
    Trap
    Forgetting to enable it in the sync configuration.

  • Custom banned password list

    Organization-specific terms blocked in passwords.

    Remember
    Up to 1,000 terms combined with the global list.
    Tested as
    Weak password prevention.
    Trap
    Expecting it to work on-premises without the DC agent.

  • User risk vs sign-in risk

    Account compromise likelihood vs a single suspicious sign-in.

    Remember
    User risk often triggers password change; sign-in risk triggers MFA.
    Tested as
    Risk policy design.
    Trap
    Swapping the remediation actions.

  • Report-only mode

    Conditional Access evaluation without enforcement.

    Remember
    Results appear in sign-in logs.
    Tested as
    Safe rollout questions.
    Trap
    Enabling a new policy straight away.

  • Named location

    Trusted IP ranges or countries used in Conditional Access.

    Remember
    Lets policies treat office networks differently.
    Tested as
    Location-based MFA requirements.
    Trap
    Relying on device platform instead.

  • Authentication strength

    Grant control that demands specific methods.

    Remember
    Can require phishing-resistant MFA.
    Tested as
    Admin protection scenarios.
    Trap
    Assuming any MFA prompt meets the requirement.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Sync engines

ConceptMeaningKey differenceCommon trap
Microsoft Entra Connect Sync Server-installed sync engine Richest features including writeback and staging mode Choosing it when only light agents are allowed
Microsoft Entra Cloud Sync Cloud-managed provisioning agents Simpler, supports disconnected forests Assuming device writeback is available
Microsoft Entra Connect Health Monitoring agents and portal Watches sync, does not synchronize Selecting it as the sync tool

Password protection features

ConceptMeaningKey differenceCommon trap
SSPR Users reset their own passwords Needs registered methods and writeback for hybrid users Expecting it to block weak passwords
Password Protection Blocks banned or weak passwords Cloud by default, DC agent for on-premises Thinking it resets passwords
Smart lockout Locks out repeated failed attempts Distinguishes familiar from unfamiliar locations Confusing it with AD account lockout policy

Access control options

ConceptMeaningKey differenceCommon trap
Security defaults Baseline MFA settings for all users No customization or exclusions Running them alongside Conditional Access
Per-user MFA Legacy MFA state on each account Hard to manage and not condition aware Choosing it for location-based rules
Conditional Access Policy engine with conditions and controls Needs Entra ID P1; risk conditions need P2 Leaving no emergency access exclusion

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Connect Health as sync engine

    What candidates pick
    Install Connect Health to synchronize users.
    Why it looks right
    The product name includes Connect.
    Why it's wrong
    Connect Health only monitors; synchronization needs Connect Sync or Cloud Sync.

    Clue to watch for The task is to make users appear in the cloud.

  2. Per-user MFA for conditions

    What candidates pick
    Enable per-user MFA for remote staff.
    Why it looks right
    It is a quick switch per account.
    Why it's wrong
    Per-user MFA cannot consider location or risk; Conditional Access with a named location can.

    Clue to watch for The requirement mentions office networks or locations.

  3. Sign-in risk for leaked credentials

    What candidates pick
    Create a sign-in risk policy for leaked credentials.
    Why it looks right
    Both are ID Protection risks.
    Why it's wrong
    Leaked credentials raise user risk, so a user risk condition requiring a secure password change applies.

    Clue to watch for The detection is about the account rather than one sign-in.

  4. Cloud Sync for device writeback

    What candidates pick
    Pick Cloud Sync because it is newer.
    Why it looks right
    Microsoft recommends it where possible.
    Why it's wrong
    Features like device writeback and some advanced rules still require Connect Sync.

    Clue to watch for The scenario lists a writeback or advanced sync need.

  5. Least restrictive policy wins

    What candidates pick
    Assume an allow policy overrides a block policy.
    Why it looks right
    Firewalls often use first match.
    Why it's wrong
    Conditional Access applies every matching policy, and any block takes effect.

    Clue to watch for Two policies target the same users.

  6. Writeback assumed

    What candidates pick
    Enable SSPR and expect on-premises passwords to change.
    Why it looks right
    SSPR works for cloud users immediately.
    Why it's wrong
    Hybrid users need password writeback configured in the sync engine.

    Clue to watch for Users are synchronized from Active Directory.

Answer framework

Use these steps for synchronization, sign-in and access policy scenarios in Domain 2.

  1. Check where identities come from: cloud-only or synced, which forests, and whether UPN suffixes and attributes are clean for synchronization.
  2. Match the sync engine to the constraints, using Cloud Sync for light agents and Connect Sync for writeback, staging or complex rules.
  3. Pick authentication methods in the methods policy, favoring passkeys or Authenticator, and use Temporary Access Pass for onboarding and recovery.
  4. Add SSPR with password writeback for hybrid users and Password Protection with custom banned terms and on-premises agents where needed.
  5. Build Conditional Access with clear assignments and grant controls, add risk conditions, exclude emergency accounts, and test in report-only mode.

Practice question

Users synchronized from on-premises Active Directory can reset their passwords with self-service password reset, but the new password does not work on domain-joined computers. Cloud-only users have no problem. What should the administrator do?

Want more like this? The MS-102 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Hybrid identity is easiest to learn with a small lab: one Windows Server VM running Active Directory Domain Services, joined to your trial tenant. Create a few users with a .local suffix and a duplicate proxy address, run IdFix, then add a routable suffix. Install Cloud Sync first, observe the results, and try Connect Sync in staging mode on a second VM if you can.

In the Entra admin center, open the authentication methods policy and enable Authenticator, passkeys and Temporary Access Pass for a pilot group. Turn on SSPR with writeback, reset a synced user's password, and confirm it on the domain controller. Add a custom banned password list and test it.

For access, disable security defaults in the lab and create three Conditional Access policies in report-only mode: MFA for admins, MFA outside a named location, and password change for high user risk. Review the sign-in logs and What If results, then enable one policy. Keep a written table of which license each feature needs, because P1 versus P2 distinctions appear in answer options.

FAQ

How much of MS-102 is Domain 2, Implement and manage Microsoft Entra identity and access?

Microsoft weights Implement and manage Microsoft Entra identity and access at 25–30% of MS-102, split into identity synchronization, authentication, and secure access.

Should I study Connect Sync or Cloud Sync?

Both. The objectives name each engine, and questions expect you to choose between them and troubleshoot either one, so know their feature differences.

Does MS-102 cover AD FS deeply?

No. The listed objectives focus on synchronization, authentication methods and Conditional Access. Federation can appear in context, but AD FS administration is not a named objective.

Which licenses are needed for Conditional Access and risk policies?

Conditional Access needs Microsoft Entra ID P1. Risk-based conditions from ID Protection need Microsoft Entra ID P2.

Why exclude an emergency access account from Conditional Access?

So that a misconfigured policy or MFA outage cannot lock every administrator out of the tenant. Monitor those accounts closely instead.

Where do I find why a sign-in failed?

Open the Microsoft Entra sign-in logs. Each entry shows the error code, the authentication details, and which Conditional Access policies applied and with what result.

What is the difference between SSPR and Password Protection?

SSPR lets users reset their own password after verifying their identity. Password Protection stops people choosing weak or banned passwords when they set one.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered IdFix, both sync engines, authentication methods, SSPR, Password Protection and Conditional Access. Test whether you can choose the right control quickly.

Take the MS-102 practice test Check your MS-102 readiness

Keep going