Microsoft 365 Certified: Administrator Expert (MS-102) Exam Guide
Validates knowledge of administering Microsoft 365 tenants, including users, identity, security and compliance.
MS-102 tests whether you can administer a Microsoft 365 tenant, Entra identity, Defender XDR security and Purview compliance. Most of the exam is security and identity. Build each setting in a trial tenant and practise long scenario questions.
1Understand the exam
Syllabus
Deploy and manage a Microsoft 365 tenant25–30%
Implement and manage a Microsoft 365 tenant
Manage users and groups
Manage roles and role groups
Example scenario: Regional IT staff should manage users only in their own country. How would you delegate this?
Implement and manage Microsoft Entra identity and access25–30%
Implement and manage identity synchronization with Microsoft Entra tenant
Implement and manage authentication
Implement and manage secure access
Example scenario: Users synced from on-premises AD cannot reset their passwords in the cloud. What would you check first?
Manage security and threats by using Microsoft Defender XDR30–35%
Review and respond to security reports and alerts generated by Microsoft Defender XDR
Implement and manage email and collaboration protection by using Microsoft Defender for Office 365
Implement and manage endpoint protection by using Microsoft Defender for Endpoint
Implement and manage Microsoft Defender for Cloud Apps
Example scenario: A user clicked a phishing link and the account is now sending spam. What would you do in Defender XDR and Defender for Office 365?
Manage compliance by using Microsoft Purview10–15%
Implement Microsoft Purview information protection and data lifecycle management
Implement Microsoft Purview data loss prevention (DLP)
Example scenario: Credit card numbers must not leave the company by email or Teams chat. Which Purview policy would you create?
English, Chinese (Simplified), German, Spanish, French, Japanese, Portuguese
Question types
Choose the best answer from the options, or the stated number of answers when a question asks for more than one.
CertUp example
Credit card numbers must not leave the company by email. What should you create?
A Microsoft Purview DLP policy for Exchange email
A retention policy
A Safe Attachments policy
A Conditional Access policy
Show answer
A. A DLP policy detects sensitive information such as card numbers and blocks the message.
Move items from a list into the correct places, such as matching items to targets or putting steps in order.
CertUp example
Drag each need to the Defender product that meets it.
Investigate and block a malicious email link
Isolate a compromised laptop
Find unsanctioned cloud apps that staff use
Show answer
Malicious email link → Defender for Office 365; isolate a laptop → Defender for Endpoint; unsanctioned cloud apps → Defender for Cloud Apps.
Choose the correct option for each part of an exhibit or statement list, often Yes or No for each statement.
CertUp example
For each statement, select Yes or No.
Microsoft Entra Connect Sync can synchronize on-premises Active Directory users to Microsoft Entra ID.
Password writeback lets synced users reset their password in the cloud and have it change on premises.
Security defaults can stay on while Conditional Access policies are in use.
Show answer
Yes, Yes, No. Security defaults must be turned off to use Conditional Access policies.
Read one scenario with its background, requirements and exhibits, then answer several questions about it.
CertUp example
Case study: A company has offices in three countries. Requirement: regional admins manage only users in their own country. Question 1 of 3: What should you use to scope their roles?
Administrative units
Dynamic distribution lists
Conditional Access policies
Security defaults
Show answer
A. An administrative unit limits a role assignment to a set of users, such as one country's.
Eligibility and booking
Required for the certification
One Microsoft 365 or Entra associate certification
Required
You must earn one of these four associate certifications as well as passing MS-102.
Endpoint Administrator Associate
MD-102
Teams Administrator Associate
MS-700
Identity and Access Administrator Associate
SC-300
Information Security Administrator Associate
SC-401
Experience across Microsoft 365 workloads
Recommended
Microsoft expects functional experience with all Microsoft 365 workloads and Entra ID, plus working knowledge of networking, AD DS, DNS and PowerShell.
You can pass MS-102 before or after the associate. Both must be complete by November 30, 2026, when Microsoft stops awarding this certification.
You can book MS-102 until it retires on November 30, 2026. Sign in to Microsoft Learn with a personal Microsoft account and schedule with Pearson VUE from the exam page.
This plan covers MS-102 only. Read the skills list and take the free practice assessment, then work through one course while you build each setting in a trial tenant.
Most candidates spend 60–90 hours. Plan for the low end if you already administer Microsoft 365 tenants daily; add time for Defender or Purview if you have not used them.
1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.4 h
3Learn the core conceptsWork through one main course or book, topic by topic.41 h
4Practice with mock examsTake timed practice tests and review every mistake.21 h
5Prepare for exam dayBook the exam and check the ID and delivery rules.4 h
3Learn the core concepts
Use one course for coverage and build the settings yourself. Give Defender XDR the most time, since it carries the largest weight.
Candidates and a Microsoft trainer in the retirement thread describe MS-102 as testing Defender, Purview and Entra far more than everyday Microsoft 365 administration.