What MS-102 actually tests

MS-102 is the administrator exam for people who run a Microsoft 365 tenant end to end. It is not a pure identity exam, not a pure security exam, and not a messaging exam. Microsoft expects you to understand how users, devices, apps, collaboration, security, and compliance fit together in one tenant.

You should expect questions that mix services. A scenario might start with Entra ID, then move into conditional access, then ask what happens in Exchange Online or SharePoint Online, and finish with a compliance requirement. That cross-service thinking is the core of this exam.

At a high level, the exam focuses on:

Tenant and Microsoft 365 app deployment/management
Identity and access in Microsoft Entra ID
Security and threat protection using Microsoft Defender and related controls
Compliance and retention using Microsoft Purview

This exam is best suited to you if you already do some combination of these tasks:

Manage Microsoft 365 tenants, subscriptions, and roles
Administer users, groups, licenses, and domains
Support Exchange Online, Teams, SharePoint Online, and OneDrive
Configure Microsoft 365 Apps deployment and servicing
Implement conditional access, MFA, self-service password reset, and identity synchronization
Work with retention labels, DLP, eDiscovery, insider risk, or audit

Expect standard Microsoft exam item types:

Multiple choice
Multiple select
Drag and drop / sequencing
Case studies
Yes/no scenario questions

You may also see questions where several answers look technically possible, but only one is the most appropriate Microsoft 365 admin action with the least overhead. That is a pattern in this exam.

One more point: this exam has 416 practice questions on Truekia, which is enough volume to expose weak spots. Use that volume to identify patterns, not to memorize answers.

Tenant foundation: subscriptions, apps, and service administration

This part of the exam is often underestimated because candidates assume it is basic admin work. It is not. Microsoft likes to test how tenant decisions affect user experience, supportability, and security.

Focus your study on these areas.

Know the tenant plumbing

You need to be comfortable with:

Microsoft 365 tenant setup and configuration
Custom domains and DNS implications
Subscriptions and licensing
Admin roles in Microsoft 365 and Entra ID
Service health and message center usage
Microsoft 365 admin center navigation and when to use workload-specific portals

Be able to distinguish between:

Global Administrator vs more limited roles such as Exchange Administrator, SharePoint Administrator, Teams Administrator, User Administrator, Billing Administrator, Compliance Administrator, and Security Administrator
Directory roles in Entra ID vs workload roles in Microsoft 365
Assigning a broad role directly vs using a least privilege approach

Microsoft 365 Apps is part of the exam

Many people over-focus on cloud identity and ignore Microsoft 365 Apps for enterprise. That is a mistake.

Study:

Deployment methods for Microsoft 365 Apps
Office Deployment Tool (ODT) basics
Update channels and servicing strategy
App installation options and architecture considerations
Managing apps through Intune and cloud-based deployment approaches
Activation concepts such as shared computer activation

Know when you would use:

Microsoft 365 Apps admin center
Office Customization Tool
Intune app deployment
Group Policy for legacy or hybrid estates

You do not need to be an ODT specialist, but you should understand the common XML concepts and what they control.

<Configuration>
  <Add OfficeClientEdition="64" Channel="MonthlyEnterprise">
    <Product ID="O365ProPlusRetail">
      <Language ID="en-us" />
    </Product>
  </Add>
  <Display Level="None" AcceptEULA="TRUE" />
</Configuration>

If you see XML like this, you should recognize:

OfficeClientEdition controls 32-bit vs 64-bit
Channel controls update cadence
Product ID selects the app package
Display Level affects silent deployment

Workload administration you should not skip

MS-102 is not a deep specialist exam in Exchange, SharePoint, or Teams, but you absolutely need administrator-level familiarity.

Study the basics of:

Exchange Online recipients and mail flow concepts
SharePoint Online site administration and external sharing settings
OneDrive policies and storage basics
Teams settings, policies, and admin controls

You should know how to make decisions like:

Which admin center to use for a change
Which policy scope makes sense
What feature depends on licensing or a service being enabled

What is usually straightforward here

These are usually easier marks if you put in the time:

Role identification
License assignment basics
Domain setup concepts
Admin center responsibilities
Service health and support workflows

What tends to trip people up

Confusing Microsoft 365 roles with Entra ID roles
Forgetting licensing prerequisites for a feature
Mixing up app deployment options and update channels
Assuming Teams/SharePoint/Exchange questions are out of scope

Identity and access: the heart of the exam

If one section deserves the most time, it is this one. Microsoft 365 administration starts with identity, and MS-102 reflects that.

Entra ID topics you must know cold

Study these until they are second nature:

Users, groups, and administrative units
Group types: Microsoft 365 groups, security groups, mail-enabled groups, dynamic groups
Authentication methods
Multi-factor authentication
Self-service password reset (SSPR)
Conditional Access
Password protection and smart lockout
Identity synchronization with Entra Connect / Entra Connect Sync concepts
Hybrid identity options
Guest users and external identities
Privileged Identity Management (PIM) concepts if referenced through role governance scenarios

Synchronization and hybrid identity

You need a practical understanding of:

Cloud-only identities
Synchronized identities from on-premises Active Directory
Pass-through authentication (PTA)
Password hash synchronization (PHS)
Federation at a conceptual level

Microsoft often asks which option is simplest, most resilient, or best aligned with a requirement. In many scenarios, PHS is the preferred low-complexity answer unless the requirement explicitly calls for something else.

Know the tradeoffs:

PHS: simpler, resilient, widely recommended
PTA: validates passwords against on-premises AD without federation
Federation: more complexity, usually justified only by specific requirements

Conditional Access is not optional knowledge

Be able to read a policy scenario and identify:

Assignments: users, groups, roles, workload identities
Cloud apps or actions
Conditions: location, device platform, risk, client apps, sign-in risk, user risk
Access controls: require MFA, require compliant device, require hybrid joined device, block access
Session controls

Common traps:

Policies apply only when all configured conditions match
Multiple policies can affect one sign-in
Security defaults and Conditional Access can overlap conceptually, but they are not the same operational model
Named locations and trusted locations matter in scenarios

Authentication methods and password policies

Study the newer Microsoft approach, not just the old MFA checkbox mentality.

Know:

Authentication methods policy
Microsoft Authenticator
FIDO2 security keys
Temporary Access Pass
SMS/voice limitations and legacy positioning
Passwordless concepts
SSPR registration and writeback concepts in hybrid environments

External access and guest collaboration

This exam expects you to understand how Microsoft 365 supports collaboration beyond your tenant.

Focus on:

B2B guest users in Entra ID
SharePoint and OneDrive external sharing policies
Teams external access vs guest access
How guest identities affect permissions and governance

A good study order for identity

Learn user, group, and role administration.
Move to identity synchronization and hybrid models.
Study authentication methods, MFA, and SSPR.
Spend serious time on Conditional Access.
Finish with guest access and external collaboration controls.

If you can explain why a given scenario calls for PHS vs PTA, security defaults vs Conditional Access, or dynamic groups vs assigned groups, you are in the right place.

Security operations in Microsoft 365: defend identities, devices, and data

MS-102 does not require the same depth as a dedicated security exam, but it absolutely expects you to know the security stack that a Microsoft 365 administrator touches regularly.

Microsoft Defender products you should recognize

You need working familiarity with:

Microsoft Defender XDR
Microsoft Defender for Office 365
Microsoft Defender for Endpoint integration points
Microsoft Defender for Identity at a conceptual level
Microsoft Secure Score
Security recommendations and alerting concepts

Be able to connect the service to the problem:

Phishing, malicious links, attachments -> Defender for Office 365
Endpoint posture and device risk -> Defender for Endpoint
Identity-related suspicious activity -> Defender for Identity
Cross-domain incident correlation -> Defender XDR

Defender for Office 365 is especially testable

Know the difference between:

Safe Links
Safe Attachments
Anti-phishing policies
Anti-spam and anti-malware policies
Quarantine concepts
Preset security policies
Attack simulation training at a high level

Microsoft likes policy questions here. You should know what control best addresses a requirement such as:

Rewriting URLs for time-of-click protection
Sandboxing attachments before delivery
Protecting against impersonation
Tightening mail filtering without building every setting manually

Device and app protection crossover

MS-102 often brushes against Intune and device compliance rather than testing full Intune engineering depth.

Study:

Device compliance policies
Relationship between compliant devices and Conditional Access
Basic app protection concepts for managed apps
Enrollment concepts and platform support at a high level

The key is understanding the flow:

A device is evaluated for compliance.
Conditional Access can require a compliant device.
Access to Microsoft 365 resources is granted or blocked accordingly.

Security reporting and posture

Know how administrators track and improve posture:

Secure Score
Alerts and incidents in Defender portals
Basic investigation workflows
Recommendations and their impact

What is hard in this domain

The hard part is not memorizing product names. It is knowing which Microsoft security feature solves which business requirement. If you cannot quickly map a scenario to the right Defender or Conditional Access control, this section will feel slippery.

Best way to study it

Build a simple matrix for yourself:

Requirement	Service/Feature
Block risky sign-ins	Conditional Access + risk conditions
Require MFA for admins	Conditional Access or security defaults depending scenario
Scan links at click time	Safe Links
Detonate suspicious attachments	Safe Attachments
Restrict access to compliant devices	Intune compliance + Conditional Access
Improve tenant posture	Secure Score

That exercise helps more than passively reading docs.

Purview and governance: where many candidates lose easy marks

Compliance is the section people postpone because it feels broad and policy-heavy. On MS-102, that is a mistake. You do not need to become a legal discovery expert, but you do need a clear map of Microsoft Purview capabilities.

Core Purview areas to study

Prioritize these:

Retention policies and retention labels
Data Loss Prevention (DLP)
Sensitivity labels and information protection concepts
eDiscovery concepts
Audit logging and search
Insider Risk Management at a high level
Communication Compliance at a high level
Records management basics

Retention is heavily misunderstood

Make sure you can answer these questions:

When would you use a retention policy versus a retention label?
What is the difference between retain, delete, and retain then delete?
Which workloads can a policy target?
How do labels get applied: manually, automatically, by default?

A practical way to think about it:

Retention policies are broad and location-based
Retention labels are more granular and content-aware

If a scenario needs organization-wide retention across Exchange mailboxes and SharePoint sites, a retention policy is often the natural answer. If it needs file-level classification with different retention outcomes, retention labels are usually more appropriate.

DLP and sensitivity labels

These are common sources of confusion because they overlap in real life.

Know the distinction:

Sensitivity labels classify and protect content, often through encryption and markings
DLP detects sensitive information and can block, warn, or audit sharing and movement

You should understand common DLP locations:

Exchange Online
SharePoint Online
OneDrive
Teams
Endpoint DLP conceptually if referenced

Study examples of sensitive info types, policy tips, and enforcement actions.

eDiscovery and audit

You are unlikely to get deep legal workflows, but you should know:

Difference between standard admin activity and audit records
Why audit is important in investigations
Basic eDiscovery case concepts
Search, hold, and export at a conceptual level

Insider risk and communication compliance

These are usually lighter-touch on MS-102, but you should at least know what they do:

Insider Risk Management identifies risky user behavior patterns
Communication Compliance helps detect policy violations in communications

Do not over-study these at the expense of retention, labels, DLP, and audit.

The exam pattern here

Microsoft often gives a requirement in business language:

Keep content for seven years
Prevent credit card data from being shared externally
Apply encryption to confidential documents
Search for content related to an investigation

Your job is to map that requirement to the right Purview feature quickly.

A realistic prep plan based on your background

This is not a six-month exam for most working admins, but it is also not a weekend cram. The right timeline depends on how much real Microsoft 365 administration you already do.

If you already administer Microsoft 365 daily: 3 to 4 weeks

This fits you if you regularly manage Entra ID, licenses, Exchange Online, Teams, SharePoint, and basic compliance.

Week 1

Review the official skills outline
Audit your gaps in Purview, Defender, and Microsoft 365 Apps
Take a baseline set of practice questions

Week 2

Deep study on identity and access
Lab Conditional Access, MFA, SSPR, guest access, and group management

Week 3

Deep study on security and compliance
Focus on Defender for Office 365, Secure Score, retention, labels, DLP, audit

Week 4

Mixed-domain review
Do timed practice sets
Revisit weak areas only

If you are a Windows/server or M365 support admin moving up: 6 to 8 weeks

This is the most common profile.

Weeks 1-2

Tenant basics, licensing, roles, domains, admin centers
Exchange/SharePoint/Teams admin fundamentals

Weeks 3-4

Entra ID identity models
Sync, PHS/PTA/federation concepts
MFA, SSPR, authentication methods, Conditional Access

Weeks 5-6

Defender stack, Intune compliance relationship, Secure Score
Purview retention, labels, DLP, audit, eDiscovery basics

Weeks 7-8

Practice questions every day
Build flashcards for licensing, role boundaries, and policy differences
Do at least two full mixed reviews under time pressure

If you are new to Microsoft 365 administration: 10 to 12 weeks

You need more hands-on time than reading time.

Use this order:

Tenant and workload basics
Entra ID administration
Hybrid identity and authentication
Conditional Access and security controls
Defender capabilities
Purview governance
Practice exams and scenario review

How much practice is enough?

With 416 practice questions available, a good target is:

First pass: answer all of them in study mode
Second pass: redo only missed or guessed questions
Final pass: random timed sets of 40-60 questions

Do not just track score. Track why you missed the question:

Did not know the feature
Confused similar services
Missed a licensing dependency
Misread the requirement

That last category matters more than people admit.

Resources worth your time for MS-102

Use a short, credible resource stack. Microsoft exams change enough that stale third-party material can waste your time.

Official Microsoft resources

Start here:

Microsoft Learn exam page for MS-102 — use it to confirm the current skills outline
Microsoft Learn learning paths for Microsoft 365 Administrator
Product documentation for:
- Microsoft Entra ID
- Microsoft 365 admin center
- Microsoft Defender XDR
- Microsoft Purview
- Exchange Online
- SharePoint Online
- Microsoft Teams admin
- Microsoft Intune

Specific docs worth bookmarking:

Conditional Access documentation
Authentication methods and passwordless documentation
Microsoft Entra Connect sync documentation
Defender for Office 365 documentation
Retention policies and retention labels documentation
DLP documentation for Microsoft Purview
Microsoft 365 Apps deployment documentation

Video courses that are usually reliable

Use one primary video course, not five.

Good options include:

John Savill on YouTube — especially strong for Entra ID, Azure/Microsoft identity, and security explanations
Microsoft Learn video modules where available
LinkedIn Learning or Pluralsight MS-102-aligned courses, but verify they match the current exam objectives before committing

Savill is especially useful when you need a clean explanation of hybrid identity, Conditional Access logic, or Microsoft security architecture.

Books

Books are less useful for this exam than docs and labs because Microsoft 365 changes quickly. If you use a book, use it as reinforcement, not your main source. Prioritize recently updated Microsoft 365 administration material from reputable publishers like Microsoft Press or Packt, but always cross-check against current Learn docs.

Hands-on lab options

This exam rewards lab time.

Best options:

A Microsoft 365 Developer Program tenant, if available for your use case
A trial tenant for Microsoft 365 and related admin workloads
Your employer's lab or sandbox environment
Microsoft Learn sandbox exercises where offered

What to actually lab:

Create users and groups
Assign licenses and roles
Configure MFA and SSPR
Build Conditional Access policies
Review sign-in logs and audit logs
Create a retention policy and a retention label
Explore DLP templates
Review Safe Links and Safe Attachments settings
Deploy or at least configure Microsoft 365 Apps settings

Practice question strategy

Use the Truekia 416-question bank in phases:

Phase 1: diagnostic, open notes
Phase 2: domain-based review
Phase 3: timed mixed sets

If a question exposes a gap, go back to the official doc for that feature the same day. That loop is what turns practice into retention.

Exam execution: how to avoid losing points on Microsoft-style questions

Microsoft exams are rarely defeated by raw memorization alone. You need to parse requirements carefully.

Read for constraints first

Before looking at answer choices, identify the hard requirement:

Lowest administrative effort?
Least privilege?
Cloud-only or hybrid?
Specific licensing tier?
Need to preserve user productivity?
Need to apply to one workload or all workloads?

A lot of wrong answers are technically possible but operationally poor.

Watch for these common traps

A feature exists, but the license in the scenario does not support it
The answer solves only Exchange when the requirement includes SharePoint and Teams
A setting applies to members, but the scenario is about guests
The answer uses a broad admin role when a narrower role is better
The answer uses manual work when a policy-based control is available

For case studies

Skim the company background once
Read the current issue and required outcome carefully
Note licensing, hybrid dependencies, and compliance requirements
Do not over-import assumptions from your own environment

Time management

If a question is taking too long because two answers look close, ask:

Which one is more aligned with Microsoft's recommended model?
Which one is more scalable and policy-driven?
Which one fits the exact service named in the requirement?

That usually breaks the tie.

Last 48 hours before the exam

Do not start new topics.

Review only:

Conditional Access logic
PHS vs PTA vs federation
Roles and least privilege
Defender for Office 365 controls
Retention policies vs labels
DLP vs sensitivity labels
Licensing dependencies you keep missing

Final blunt advice

If you are weak on Purview or Microsoft 365 Apps, fix that before exam day. Most candidates naturally study identity more than enough. They fail or underperform because they neglect the less glamorous objectives.

MS-102 rewards broad, connected admin knowledge. Study it that way.