MS-102 · Domain 3 of 4

MS-102 Domain 3: Manage security and threats by using Microsoft Defender XDR

Running Microsoft 365 threat protection from the Defender portal: Exposure Management and Secure Score, incidents and hunting, email and collaboration policies, endpoint onboarding and vulnerabilities, and cloud app control.

Exam weight
30–35%
Official functional groups
4
Estimated questions estimate
~17
Suggested study time estimate
18–24 hrs

About 13 min read Reviewed October 2026

Overview

Domain 3 is the largest MS-102 skill area and spans four products surfaced in the Microsoft Defender portal. Microsoft lists four functional groups with 17 bullet objectives. The first covers Microsoft Security Exposure Management and Secure Score, incidents and alerts with advanced hunting, Defender XDR reports, and Microsoft Defender Threat Intelligence. The second covers Defender for Office 365 threat policies, alert policies, investigation of email and collaboration threats, attack simulation training, and restricted entities.

The third covers onboarding devices to Defender for Endpoint, configuring endpoint settings, and acting on findings in Defender Vulnerability Management. The fourth covers Defender for Cloud Apps: the Microsoft 365 app connector, policies and alerts, the activity log, and Cloud App Discovery with its follow-up actions. The administrator view matters here: you configure and respond, rather than perform deep forensic analysis.

How it's tested

Security questions describe an attack, a weak posture score, a user blocked from sending mail, or shadow IT discovered on the network. You pick the Defender component, policy type, onboarding method or response action, and sometimes interpret a KQL query or a Secure Score status.

  • Which Defender product

    A threat or requirement is described and you map it to Defender for Office 365, Endpoint, Cloud Apps, or the unified Defender XDR portal.

  • Policy selection

    Phishing impersonation, malicious links or risky attachments lead to anti-phishing, Safe Links or Safe Attachments policy settings, often using preset security policies.

  • Respond and remediate

    An incident, restricted user, vulnerable application or unsanctioned app requires the correct next action in the right portal page.

Reasoning it through

A finance user cannot send any email after their account sent thousands of spam messages. Resetting the password and requiring MFA stops the attacker, but sending stays blocked because Defender for Office 365 added the user to restricted entities. The administrator must remove the user from the Restricted entities page after securing the account. Changing anti-spam inbound policies does not affect this outbound restriction.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

3.1 Review and respond to security reports and alerts generated by Microsoft Defender XDRExposure Management, Secure Score, incidents, advanced hunting, reports and Threat Intelligence.
What it means
This group covers responding to threats with Microsoft Security Exposure Management including Microsoft Secure Score, handling Defender XDR incidents and alerts including advanced hunting, acting on issues in Defender XDR reports, and reviewing threats identified by Microsoft Defender Threat Intelligence.
What to understand
Secure Score measures posture through recommended actions, each worth points; actions can be resolved, planned, or marked as risk accepted or resolved through a third party. Exposure Management adds initiatives and attack surface views across products. An incident groups related alerts from email, identity, endpoint and cloud apps, and automated investigation and response can remediate common cases. Incidents are assigned, classified as true or false positive, and resolved. Advanced hunting uses KQL over tables such as EmailEvents, DeviceProcessEvents and IdentityLogonEvents with about 30 days of raw data, and a query can become a custom detection rule. Defender Threat Intelligence and threat analytics give context on actors and campaigns.
How it shows up
Expect a Secure Score status choice, incident triage steps, reading a simple KQL query, or locating a report.
Common confusion
Treating alerts and incidents as the same thing; incidents correlate many alerts and are where response normally starts.
3.2 Implement and manage email and collaboration protection by using Microsoft Defender for Office 365Threat policies, alert policies, investigation, attack simulation and restricted entities.
What it means
This group covers implementing threat policies and rules in Defender for Office 365, configuring alert policies, investigating and responding to email and collaboration threats, running attack simulation training campaigns, and managing restricted entities such as blocked users.
What to understand
Threat policies include anti-phishing with impersonation and mailbox intelligence, anti-spam, anti-malware with the common attachments filter, Safe Links for URLs in mail, Teams and Office apps, and Safe Attachments, which detonates files in a sandbox and can use Dynamic Delivery. Standard and Strict preset security policies apply Microsoft's recommended settings, and the Tenant Allow/Block List handles specific senders, URLs and files. Alert policies raise alerts for activities like forwarding rules or malware campaigns. Threat Explorer or real-time detections support investigation, and zero-hour auto purge removes delivered messages later found malicious. Attack simulation training needs Defender for Office 365 Plan 2. Users who exceed outbound limits land on the Restricted entities page.
How it shows up
Expect a policy choice for a threat, a preset policy question, investigating a campaign, or unblocking a sender.
Common confusion
Using a transport rule or allow list to fix a problem that a Safe Links, Safe Attachments or anti-phishing setting should handle.
3.3 Implement and manage endpoint protection by using Microsoft Defender for EndpointDevice onboarding, endpoint settings and Defender Vulnerability Management.
What it means
This group covers onboarding devices to Defender for Endpoint, configuring endpoint settings, and reviewing and responding to vulnerabilities shown in the Microsoft Defender Vulnerability Management dashboard.
What to understand
Onboarding methods include Intune, Group Policy, Configuration Manager, a local script for small pilots, and VDI scripts for non-persistent machines; servers and non-Windows platforms have their own packages. Settings in the Defender portal include advanced features such as tamper protection and automated investigation, device groups with automation levels, and role-based access to device groups. Attack surface reduction rules and antivirus settings are usually delivered through Intune endpoint security policies. Defender Vulnerability Management shows an exposure score, security recommendations, software inventory and weaknesses; a recommendation can create an Intune remediation request or receive an exception.
How it shows up
Expect the right onboarding method for a fleet size or tool, tamper protection settings, or a vulnerability response action.
Common confusion
Thinking a remediation request patches the device directly; it creates a task for the endpoint team in Intune.
3.4 Implement and manage Microsoft Defender for Cloud AppsApp connector, policies and alerts, activity log and Cloud App Discovery.
What it means
This group covers configuring the app connector for Microsoft 365, configuring Defender for Cloud Apps policies including alerting, interpreting the activity log, configuring Cloud App Discovery, and responding to issues found by Cloud App Discovery.
What to understand
The Microsoft 365 app connector uses APIs to bring activities and files into Defender for Cloud Apps. Policy types include activity policies, anomaly detection policies, file policies, and session or access policies that rely on Conditional Access app control. Policies can alert and apply governance actions such as suspending a user. The activity log is filtered by user, app, IP address or activity type to investigate events. Cloud App Discovery analyses traffic from firewall logs through a log collector, snapshot uploads, or Defender for Endpoint integration, and rates apps with risk scores in the cloud app catalog. Marking an app unsanctioned can block it on Defender for Endpoint devices.
How it shows up
Expect a policy type choice, the discovery data source, or how to block a risky discovered app.
Common confusion
Expecting the app connector to discover shadow IT; discovery uses network traffic data, not API connectors.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Secure Score recommended action

    A posture improvement with a point value.

    Remember
    Statuses include risk accepted and resolved through third party.
    Tested as
    Posture questions.
    Trap
    Ignoring third-party status when another tool covers the control.

  • Incident

    Correlated group of alerts across Defender products.

    Remember
    Assign, classify and resolve at incident level.
    Tested as
    Triage questions.
    Trap
    Working alert by alert.

  • Advanced hunting

    KQL search across Defender data.

    Remember
    Queries can become custom detection rules.
    Tested as
    Investigation and detection.
    Trap
    Using it for long-term archive data.

  • Preset security policies

    Standard and Strict bundles of recommended protection.

    Remember
    Applied by assigning users, groups or domains.
    Tested as
    Quick secure configuration.
    Trap
    Rebuilding every policy by hand.

  • Safe Attachments

    Sandbox detonation of attachments.

    Remember
    Dynamic Delivery shows the body while the file is scanned.
    Tested as
    Malicious file scenarios.
    Trap
    Confusing it with anti-malware.

  • Safe Links

    Time-of-click URL checking.

    Remember
    Covers email, Teams and Office apps.
    Tested as
    Malicious URL scenarios.
    Trap
    Expecting it to scan attachments.

  • Zero-hour auto purge

    Retroactive removal of delivered malicious mail.

    Remember
    Acts after verdicts change.
    Tested as
    Post-delivery remediation.
    Trap
    Assuming delivered mail cannot be fixed.

  • Restricted entities

    Users blocked from sending after outbound spam limits.

    Remember
    Release from the Restricted entities page after securing the account.
    Tested as
    Compromised sender scenarios.
    Trap
    Changing inbound anti-spam settings.

  • Attack simulation training

    Phishing simulations with assigned training.

    Remember
    Requires Defender for Office 365 Plan 2.
    Tested as
    User awareness questions.
    Trap
    Assuming Plan 1 includes it.

  • Tamper protection

    Prevents changes to Defender security settings.

    Remember
    Enabled tenant-wide or by policy.
    Tested as
    Endpoint hardening.
    Trap
    Thinking local admins can still disable it.

  • Defender Vulnerability Management

    Exposure score, recommendations and software inventory.

    Remember
    Remediation requests go to Intune.
    Tested as
    Vulnerability response.
    Trap
    Expecting automatic patching.

  • Cloud App Discovery

    Shadow IT analysis from traffic data.

    Remember
    Sources: log collector, snapshots, Defender for Endpoint.
    Tested as
    Unknown app usage scenarios.
    Trap
    Using the API connector for discovery.

  • Unsanctioned app

    App marked as not approved.

    Remember
    Can be blocked through Defender for Endpoint integration.
    Tested as
    Blocking risky SaaS apps.
    Trap
    Expecting the tag alone to block traffic everywhere.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Defender for Office 365 policies

ConceptMeaningKey differenceCommon trap
Anti-phishing Impersonation, spoof and mailbox intelligence protection Targets deceptive senders Choosing it for malicious attachments
Safe Attachments Detonates files before delivery Catches unknown malware Expecting URL protection
Safe Links Rewrites and checks URLs at click time Protects after delivery Assuming it stops impersonation
Anti-spam outbound Limits and notifications for outgoing mail Can restrict compromised senders Editing inbound policy instead

Defender components

ConceptMeaningKey differenceCommon trap
Defender for Office 365 Email and collaboration protection Mail, Teams, SharePoint and OneDrive threats Using it for device isolation
Defender for Endpoint Device protection, detection and response Onboarded endpoints and vulnerabilities Expecting it to scan mailboxes
Defender for Cloud Apps SaaS visibility and control Connectors, discovery and session control Confusing discovery with app connectors
Defender XDR portal Unified incidents, hunting and reports Correlates signals across products Treating it as a separate product license

Cloud Apps data sources

ConceptMeaningKey differenceCommon trap
App connector API connection to a sanctioned app like Microsoft 365 Activities and files inside known apps Expecting shadow IT results
Log collector Ingests firewall or proxy logs continuously Network-wide discovery Forgetting it needs an appliance or container
Defender for Endpoint integration Discovery from onboarded devices Works off the corporate network Assuming unmanaged devices are covered

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Anti-malware for zero-day files

    What candidates pick
    Tighten the anti-malware policy to catch unknown attachments.
    Why it looks right
    Malware sounds like the right category.
    Why it's wrong
    Signature-based anti-malware misses new files; Safe Attachments detonation catches unknown threats.

    Clue to watch for The attachment is new or not yet known.

  2. Inbound spam policy for blocked sender

    What candidates pick
    Edit the anti-spam inbound policy to let the user send again.
    Why it looks right
    It is the spam policy most people know.
    Why it's wrong
    Outbound restrictions are lifted on the Restricted entities page, after securing the account.

    Clue to watch for An internal user cannot send any mail.

  3. Alerts instead of incidents

    What candidates pick
    Close each alert one by one.
    Why it looks right
    Alerts arrive first in the queue.
    Why it's wrong
    Defender XDR groups related alerts into incidents, which carry the full attack story and response actions.

    Clue to watch for Several alerts share the same user or device.

  4. Secure Score ignored control

    What candidates pick
    Mark the action as risk accepted when a third-party tool covers it.
    Why it looks right
    The control is not applied in Microsoft 365.
    Why it's wrong
    Resolved through third party records that the control is met elsewhere and awards points.

    Clue to watch for Another vendor already provides the protection.

  5. Local script at scale

    What candidates pick
    Onboard 3,000 devices with the local script.
    Why it looks right
    It is the simplest package.
    Why it's wrong
    The local script suits small pilots; Intune, Group Policy or Configuration Manager scale to fleets.

    Clue to watch for The device count is large or devices are managed.

  6. App connector for shadow IT

    What candidates pick
    Connect Microsoft 365 to find unknown SaaS apps.
    Why it looks right
    Connectors provide visibility.
    Why it's wrong
    Shadow IT discovery needs traffic data from logs or Defender for Endpoint.

    Clue to watch for The question asks which apps employees use.

Answer framework

Work through these steps when a Defender scenario offers several products or actions.

  1. Identify the attack surface: email and collaboration, devices, identities or SaaS apps, and map it to the owning Defender component.
  2. Start from the Defender XDR incident, review correlated alerts and affected assets, and decide containment before closing anything.
  3. For mail threats, prefer preset or tuned anti-phishing, Safe Links and Safe Attachments policies over allow lists and transport rules.
  4. For devices, choose an onboarding method that fits fleet size and tooling, protect settings with tamper protection, and act on vulnerability recommendations.
  5. For SaaS, connect Microsoft 365 by API, discover shadow IT from traffic data, then sanction, unsanction or monitor with policies.

Practice question

Security staff discover that employees upload files to several unapproved file-sharing websites. All company laptops are onboarded to Microsoft Defender for Endpoint. The administrator must find these apps and prevent their use with the least additional infrastructure. What should be done?

Want more like this? The MS-102 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the most study time because of its weight and breadth. Use an E5 trial so Defender for Office 365 Plan 2, Defender for Endpoint and Defender for Cloud Apps are all available. Start in the Defender portal: review Secure Score, change a few action statuses, and open the Exposure Management overview.

For email, apply the Standard preset policy to a pilot group, then inspect what it configures. Send yourself test messages, run an attack simulation, and practise finding a message in Explorer or real-time detections. Read the Restricted entities page and the outbound spam settings.

Onboard a Windows VM with the local script, enable tamper protection, and browse the vulnerability recommendations it produces. In Defender for Cloud Apps, connect Microsoft 365, create an activity policy for mass downloads, and turn on Defender for Endpoint integration so discovered apps appear. Finish by writing simple KQL queries against EmailEvents and DeviceProcessEvents. Group your notes by product so you can map any scenario to its owner.

FAQ

How much of MS-102 is Domain 3, Manage security and threats by using Microsoft Defender XDR?

Microsoft weights Manage security and threats by using Microsoft Defender XDR at 30–35% of MS-102, the largest share of any skill area, across four functional groups.

Do I need to write KQL for MS-102?

You should read and adjust simple advanced hunting queries, recognize common tables and operators, and know a query can become a custom detection. Deep KQL authoring is more of an SC-200 skill.

Which features need Defender for Office 365 Plan 2?

Plan 2 adds Threat Explorer, automated investigation and response, and attack simulation training on top of Plan 1 protections such as Safe Links and Safe Attachments.

What is the difference between Secure Score and Exposure Management?

Secure Score measures posture through recommended actions. Exposure Management builds on it with initiatives, attack surface views and broader exposure insights across Defender products.

How are devices onboarded to Defender for Endpoint at scale?

Use Intune, Group Policy or Configuration Manager for managed fleets. The local script is meant for testing on a handful of devices.

Can Defender for Cloud Apps block an app?

Marking a discovered app unsanctioned can block it on devices onboarded to Defender for Endpoint, and session policies can control activity in real time through Conditional Access app control.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered Secure Score, incidents, hunting, Defender for Office 365, Defender for Endpoint and Defender for Cloud Apps. See if you can pick the right response under time pressure.

Take the MS-102 practice test Check your MS-102 readiness

Keep going