Microsoft MS-102: Microsoft 365 Administrator

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Manage security and threats by using Microsoft Defender

   An administrator wants to be alerted when a user receives a suspicious attachment that is later found to be malicious. Which capability supports this?

   1. AAlert policies in Microsoft Defender for Office 365
   2. BA screenshot of the inbox taken each morning by the SOC team
   3. CA printed log of every email received by the mailbox last month
   4. DA calendar reminder set for each month to review mail
   Show answer and explanationHide answer

   Correct answer: A

   Alert policies in Defender for Office 365 notify administrators of suspicious or malicious email activity. Printed logs, calendar reminders, and screenshots do not provide timely alerts.

2. Question 2Manage Exchange, Teams, and SharePoint workloads

   An organization wants to stop users from forwarding email outside the company automatically. Which control applies?

   1. ADeleting email from every mailbox in the tenant during scheduled cleanup
   2. BAsking users to forward carefully and to double-check each external recipient address before sending
   3. CAn outbound mail flow rule or transport policy that blocks automatic external forwarding
   4. DAllowing every forward to a personal address from Outlook on the web or mobile with no DLP inspection
   Show answer and explanationHide answer

   Correct answer: C

   Mail flow rules or transport policies can block automatic external forwarding. Allowing all forwarding, deleting email, and relying on user care do not enforce the restriction.

3. Question 3Manage compliance by using Microsoft Purview

   An organization must retain specific business records for seven years and then delete them. Which feature is used?

   1. AA sensitivity label that encrypts the records and hides them from search results in Teams
   2. BA printed copy of the records kept in a locked filing cabinet in the office basement
   3. CA retention label with a seven-year retention period and deletion action
   4. DDeleting records automatically after one year of inactivity
   Show answer and explanationHide answer

   Correct answer: C

   A retention label with a seven-year period and deletion action enforces the requirement. Sensitivity labels hide or protect content rather than retaining it, printed copies are unmanaged, and one-year deletion violates the requirement.

4. Question 4Manage Microsoft Entra identities

   A user must sign in to Microsoft 365 with the same credentials as on-premises Active Directory, and password changes must sync. Which feature supports this?

   1. AA separate password for each cloud application, unlinked from Active Directory
   2. BPrinted credentials for each user, stored in a locked cabinet at the help desk
   3. CDisabling synchronization between on-premises Active Directory and Microsoft Entra ID, so passwords differ
   4. DMicrosoft Entra Connect with password hash synchronization or pass-through authentication
   Show answer and explanationHide answer

   Correct answer: D

   Microsoft Entra Connect with password hash sync or pass-through authentication keeps credentials aligned. Separate passwords, printed credentials, and disabled synchronization do not meet the requirement.

5. Question 5Deploy and manage Microsoft Intune devices

   A company wants corporate laptops to be configured automatically on first use and joined to Microsoft Entra ID. Which service provides this?

   1. APrinting setup instructions
   2. BAsking users to configure their own laptops
   3. CWindows Autopilot
   4. DManual imaging with a USB drive
   Show answer and explanationHide answer

   Correct answer: C

   Windows Autopilot configures devices at first use and joins them to Microsoft Entra ID. Manual imaging, printed instructions, and self-configuration are slower and inconsistent.