Microsoft MS-102 Practice Exam Questions & Answers

7 Free Questions Last reviewed October 27, 2026 Prepared & Reviewed by the ValidExamDumps Editorial Team

585 Practice Questions (Our Bank)
120 minutes Exam Duration
700 out of 1000 Passing Score
Exam Facts

Microsoft MS-102 Exam Details

Key details for this exam, checked against the published exam outline

Exam Code
MS-102
Full Name
Microsoft 365 Administrator
Issuing Body
Microsoft
Question Format (Our Bank)
Multiple Choice, Hotspot, Drag & Drop, Order List, Case Studies
Delivery
Pearson VUE or PSI at a testing center or online proctored
Eligibility
Functional experience with all Microsoft 365 workloads and Microsoft Entra ID. must have a qualifying Microsoft 365 Certified: Associate level certification such as Endpoint Administrator Associate, Messaging Administrator Associate, Teams Administrator A
Validity
Does not expire, but certification validity is 1 year from date earned
Full Question Set
585 questions Get All Questions
Practice Questions

Free MS-102 Practice Questions

Each question shows the correct answer and an explanation of why it is right

VA
ValidExamDumps Editorial Team Every question and its answer is checked by our MS-102 exam preparation team, who also write the explanation shown with each one. How we research and review these pages

Question 1 Domain 3 Manage security and threats by using Microsoft Defender XDR

You have a Microsoft 365 subscription.

Your company has a customer ID associated to each customer. The customer IDs contain 10 numbers

followed by 10 characters. The following is a sample customer ID: 12-456-7890-abc-de-fghij.

You plan to create a data loss prevention (DLP) policy that will detect messages containing customer IDs.

D18912E1457D5D1DDCBD40AB3BF70D5D

What should you create to ensure that the DLP policy can detect the customer IDs?

Correct Answer A
Explanation

https://docs.microsoft.com/en-us/microsoft-365/compliance/custom-sensitive-info-types?view=o365-worldwide

Question 2 Domain 1 Deploy and manage a Microsoft 365 tenant

You have a Microsoft 365 E5 subscription that contains the groups shown in the following exhibit.

Question 2 exhibit

To which groups can you assign Microsoft 365 E5 licenses?

Correct Answer C
Explanation

You can assign Microsoft 365 E5 licenses to Microsoft 365 groups and mail-enabled security groups.

Explanation:

  • Microsoft 365 groups (formerly Office 365 groups) can be assigned licenses directly, and all members of the group automatically receive the license
  • Mail-enabled security groups can also be assigned licenses for bulk licensing purposes
  • Distribution lists (non-mail-enabled security groups) cannot be assigned licenses, as they are for email distribution only and do not support license assignments
  • Regular security groups (on-premises) cannot be assigned cloud licenses directly

Using group-based licensing simplifies bulk license assignment and management, automatically assigning licenses to users when they join the group and removing licenses when they leave.

Question 3 Domain 4 Manage compliance by using Microsoft Purview

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint site named site1. You need to ensure that site1 meets the following requirements:

* Retains all data for 10 years

* Prevents the sharing of data outside the organization

Which two items should you create and apply to site1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Correct Answer C, E
Explanation

To meet both requirements, you need to create and apply two items:

  • Retention Policy with 10-year retention: This policy will retain all data in site1 for 10 years, meeting the retention requirement. Create a retention policy with a 10-year retention period and apply it to the specific SharePoint site (site1).
  • Sensitivity Label with external sharing restrictions: Apply a sensitivity label configured to prevent external sharing. This label should have settings that block users from sharing files with external users, meeting the data protection requirement.

Together, these two items ensure that site1 retains data for 10 years while preventing external data sharing. The retention policy handles the time-based requirement, while the sensitivity label enforces the organizational boundary for data sharing.

Get the complete MS-102 question set $20$40

Get Full Access

Question 4 Domain 2 Implement and manage Microsoft Entra identity and access

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a computer that runs Windows 10.

You need to verify which version of Windows 10 is installed.

Solution: From Device Manager, you view the computer properties.

Does this meet the goal?

Correct Answer B
Explanation

https://support.microsoft.com/en-us/windows/which-version-of-windows-operating-system-am-i-running-628bec99-476a-2c13-5296-9dd081cdd808

Question 5 Domain 3 Manage security and threats by using Microsoft Defender XDR

You have a Microsoft 365 subscription.

All uses are assigned Microsoft 365 Apps for enterprise licenses.

You need to ensure that reports display the names of users that have activated Microsoft 365 apps and on how many devices. What should you modify in the Microsoft 365 admin center?

Correct Answer C
Explanation Defender for Endpoint uses two methods to block malicious websites. Web content filtering policies create allow and block lists that prevent users from accessing specific URLs like the malicious site. Custom network indicators let you define indicators of compromise including domain names that trigger automatic blocking. Together these methods provide multiple layers of control. Other options like firewall rules or Azure Firewall are infrastructure-level controls outside Defender for Endpoint's direct blocking capabilities.

Question 6 Domain 4 Manage compliance by using Microsoft Purview

You have a Microsoft 365 E5 subscription.

You plan to create a data loss prevention (DLP) policy that will be applied to all available locations.

Which conditions can you use in the DLP rules of the policy?

Correct Answer C
Explanation

Apply retention labels to content automatically if it matches specific conditions, that includes cloud attachments that are shared in email or Teams, or when the content contains:

Specific types of sensitive information.

Specific keywords that match a query you create.

Pattern matches for a trainable classifier.

Note: Retention policies can be applied to the following locations:

Exchange mailboxes

SharePoint classic and communication sites

OneDrive accounts

Microsoft 365 Group mailboxes & sites

Skype for Business

Exchange public folders

Teams channel messages (standard channels and shared channels)

Teams chats

Teams private channel messages

Yammer community messages

Yammer user messages


https://learn.microsoft.com/en-us/microsoft-365/compliance/retention

https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-exchange-conditions-and-actions

Question 7 Domain 1 Deploy and manage a Microsoft 365 tenant

You need to ensure that User1 can enroll the devices to meet the technical requirements. What should you do?

Correct Answer C
Explanation

https://docs.microsoft.com/en-us/sccm/mdm/deploy-use/enroll-devices-with-device-enrollment-manager

Study Guide

What the Microsoft MS-102 Exam Covers

Exam domains verified against the Official Microsoft MS-102 exam guide, last checked October 2026.

Domain 1 Deploy and manage a Microsoft 365 tenant

25% - 30%

Understand how to configure your Microsoft 365 tenant, including organizational profile, subscription options, and component services. Set up and manage user accounts, licenses, security groups, and administrative roles to establish foundational governance.

Sample questions from this domain above Q2Q7

Domain 2 Implement and manage Microsoft Entra identity and access

25% - 30%

Plan and execute identity synchronization using Azure Active Directory Connect and Connect Cloud Sync. Implement authentication mechanisms including multifactor authentication and self-service password reset, plus conditional access policies for secure access control.

Sample question from this domain above Q4

Domain 3 Manage security and threats by using Microsoft Defender XDR

30% - 35%

Monitor and respond to security alerts and incidents within the Microsoft 365 Defender portal. Deploy and configure Microsoft Defender for Office 365 for email and collaboration protection, Microsoft Defender for Endpoint for device security, and Microsoft Defender for Cloud Apps for cloud application monitoring.

Sample questions from this domain above Q1Q5

Domain 4 Manage compliance by using Microsoft Purview

10% - 15%

Implement information protection through sensitivity labels and encryption. Configure data lifecycle management and retention policies. Deploy and manage data loss prevention (DLP) rules to identify and protect sensitive information across the organization.

Sample questions from this domain above Q3Q6

FAQ

MS-102 Exam FAQ

Common questions about the exam itself

What experience do I need before taking MS-102?
MS-102 is not an entry-level exam. You need functional experience with all Microsoft 365 workloads and Microsoft Entra ID, plus you must hold at least one qualifying associate-level certification such as Endpoint Administrator Associate, Messaging Administrator Associate, Teams Administrator Associate, or Identity and Access Administrator before earning the Expert credential.
How does MS-102 relate to the Microsoft 365 Administrator Expert certification?
MS-102 is the required capstone exam for the Microsoft 365 Certified: Administrator Expert credential. Passing MS-102 alone does not award the certification - you must also hold one of the prerequisite associate certifications, and both components must be active within a one-year window.
What makes MS-102 harder than other Microsoft 365 exams?
MS-102 consolidates three older exams (MS-100, MS-101, and elements of MS-500) into one broad assessment that expects you to manage multiple security and compliance tools simultaneously. The security and threats domain alone accounts for 35-40% of the exam and requires deep knowledge of Microsoft Defender for Office 365, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps working together.
Is the Microsoft Entra identity domain the hardest part of MS-102?
Many candidates find the security and threats section (35-40% of the exam) more challenging than identity, because it spans multiple Microsoft Defender products and requires understanding how to respond to incidents, not just configure tools. The identity domain (25-30%) is large but more structured and predictable than the incident response aspects of security.
How long should I prepare for MS-102?
Realistic preparation typically takes 2-3 months if you have solid hands-on experience with Microsoft 365 administration already. If you are still building practical experience with the workloads and security tools, allow 3-6 months to gain confidence in all four objective domains.
How does the MS-102 exam day work?
You have a fixed amount of time (typically around 2 hours, though the exact duration varies by region) to answer approximately 60 questions in an online proctored or test-centre environment. The test is closed-book with no access to external resources, and a live proctor monitors you either remotely or in person to ensure integrity.
Can I retake MS-102 if I fail?
Yes, you can retake MS-102, but there is typically a 24-hour waiting period between the first attempt and the second, and a 10-day waiting period before a third attempt. Each retake requires a separate exam fee and registration with the test provider.
How long does the MS-102 certification stay valid?
The MS-102 exam result itself does not expire, but the Microsoft 365 Certified: Administrator Expert certification earned by combining MS-102 with a prerequisite associate certification remains valid for 1 year from the date it is issued. After that you can renew it for free by passing a related exam or completing a renewal assessment.
Which job roles does MS-102 prepare you for?
MS-102 is designed for IT administrators, system engineers, and technology professionals who manage Microsoft 365 tenants across organizations of all sizes. It suits people whose role as a Microsoft 365 administrator requires them to coordinate security, compliance, identity, and tenant management across the entire platform.
Is MS-102 being retired?
Yes, MS-102 will retire on November 30, 2026. If you plan to take this exam, you must complete it before that date. After retirement you will not be able to earn the credential through this exam path, though existing certifications will remain valid.

Other Microsoft Exams

Free practice questions for more Microsoft certification exams

AB-900 Practice Questions Microsoft 365 Copilot and Agent Administration Fundamentals MD-102 Practice Questions Managing and Securing Microsoft 365 Endpoints by using Intune MS-721 Practice Questions Collaboration Communications Systems Engineer AB-100 Practice Questions Agentic AI Business Solutions Architect AB-210 Practice Questions Accelerating Sales Pipelines with AI in Dynamics 365 AB-250 Practice Questions Transforming Contact Center Experiences with AI in Dynamics 365 AB-410 Practice Questions Building Intelligent Applications AB-620 Practice Questions Designing and Building Integrated AI Agent Solutions in Copilot Studio

All Microsoft exams