Microsoft Certification
60 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Microsoft 365 Administrator (MS-102) certification validates professional expertise in Microsoft technologies. This study guide covers all 60 practice questions from our MS-102 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You need to configure mailbox auditing for a user in your organization. Which PowerShell cmdlet should you use to enable mailbox audit logging?
Set-Mailbox with the -AuditEnabled parameter is the correct cmdlet to enable mailbox auditing for a user. The other options either don't exist as standalone cmdlets or serve different purposes.
Your organization uses Azure AD Connect to synchronize on-premises Active Directory with Azure AD. A user's password is changed in the on-premises AD. How long does it typically take for this change to synchronize to Azure AD?
Azure AD Connect typically synchronizes password changes within 2-30 minutes, depending on the sync cycle interval (which is usually set to 30 minutes by default).
You are implementing a Conditional Access policy that requires multi-factor authentication (MFA) for all users accessing Microsoft Teams from outside the corporate network. Which condition should you configure?
To require MFA for users accessing from outside the corporate network, you should configure the Locations condition to exclude your trusted corporate locations, ensuring MFA is required for external access.
A user reports that they cannot access their shared mailbox. You verify that the user has the appropriate permissions. What should you check first?
Users must accept a shared mailbox invitation before it appears in their Outlook client. Even with appropriate permissions, the mailbox won't be accessible until the invitation is accepted.
You need to prevent users from forwarding emails externally while still allowing them to use Outlook. Which type of DLP policy rule should you implement?
Mail flow rules (transport rules) in Exchange Online can be configured to block external forwarding by detecting and rejecting forwarded messages sent to external recipients, making this the most effective control.
Your organization has deployed Microsoft Defender for Office 365. A user receives a phishing email that passes initial security checks. What feature should be enabled to allow users to report suspicious emails easily?
The Report Message add-in allows users to report suspicious emails directly to Microsoft, which helps train security filters and provides immediate feedback about potential threats.
You are configuring Teams for your organization and need to ensure that users cannot record team meetings without explicit consent from the meeting organizer. Where should you configure this setting?
Meeting recording policies are configured in the Teams admin center under Meetings settings, where administrators can control whether participants can record and set organizer consent requirements.
You need to implement sensitivity labels in your Microsoft 365 tenant that automatically encrypt documents containing credit card numbers. What is the first step you must complete?
Before creating sensitivity labels with encryption, you must ensure that the MIP unified labeling platform is enabled in your tenant, as this is the foundation for sensitivity labeling functionality.
An external partner needs temporary access to a SharePoint site. You want to ensure they can access the site but cannot share it with others. What should you configure?
You can invite external users to a SharePoint site and assign specific permission levels such as 'Site Visitor' which allows viewing but prevents sharing, giving you granular control over external access.
Your organization's CEO receives a suspicious email claiming to be from IT, requesting password confirmation. This is most likely a threat. Which Microsoft 365 service should have prevented this?
Microsoft Defender for Office 365 includes anti-phishing capabilities that detect impersonation of internal users and executives, helping prevent this type of spear-phishing attack.
You are planning to decommission an on-premises Exchange server. Which step must you complete before removing the server to ensure mailbox data is preserved?
All mailboxes must be migrated to Exchange Online before decommissioning on-premises Exchange, ensuring continuity of service and data preservation through the proper migration batch process.
You need to audit who accessed sensitive documents in a SharePoint library. Which feature should you enable and monitor?
The Microsoft Purview compliance portal provides detailed audit logs that track document access, modifications, and deletions with timestamps and user information, making it the proper tool for compliance auditing.
Your organization wants to implement Zero Trust security principles. Which approach best aligns with Zero Trust for Microsoft 365?
Zero Trust means verifying every user and device regardless of network location, requiring MFA, checking device compliance, and granting only the minimum necessary permissions—not assuming internal users are automatically trusted.
A department manager needs to create a private team in Teams that only invited members can access. Which setting should the manager configure?
Private teams restrict membership to invited members only and don't appear in the discovery or browsable teams list, providing the necessary access control for sensitive group collaboration.
You are implementing mobile device management (MDM) using Microsoft Intune. A user's personal device fails to meet the organization's security requirements. What is the most appropriate action?
Intune compliance policies block non-compliant devices from accessing resources while notifying users of required security fixes, balancing security with user communication and remediation opportunities.
You need to ensure that all OneDrive files containing financial data are encrypted at rest. What should you implement?
OneDrive automatically encrypts files at rest using service-side encryption. For additional control over financial data, you can apply sensitivity labels that enforce encryption based on content classification.
Your organization uses Azure AD B2B for partner collaboration. You want to ensure that external partners cannot access company data after a contract ends. What should you implement?
Azure AD access reviews with expiration policies automatically trigger reviews and can remove guest access when contracts expire, ensuring timely access removal without manual oversight.
A user reports that they cannot see recent shared files in their OneDrive 'Shared' view. What is the most likely cause?
The Shared view in OneDrive may not display files if sharing permissions have changed or the original shared items were deleted. The Shared view reflects current sharing status, not historical sharing.
You are configuring retention policies for Teams chat data. Which statement is correct about Teams message retention?
Retention policies in the compliance portal can be configured for Teams to either preserve messages indefinitely (litigation hold) or automatically delete them after a specified duration.
Your organization needs to prevent users from downloading files from SharePoint on unmanaged devices. Which solution should you implement?
Conditional Access policies can restrict SharePoint access based on device management status, allowing organizations to block unmanaged devices while permitting corporate-managed devices.
You are troubleshooting why a user cannot accept a Teams meeting invitation. The user can send and receive other emails normally. What should you check first?
Teams meeting invitations require the Teams client to be properly installed and current. An outdated or improperly configured Teams client is often the first cause of meeting invitation acceptance issues.
Your organization wants to implement a Data Loss Prevention (DLP) policy that prevents users from sharing customer lists containing personal information. Which action should the DLP policy take?
DLP policies should block high-risk actions (like external sharing of sensitive data) and provide policy tips to users so they understand compliance requirements and can take corrective action.
You need to ensure that a group of contractors cannot modify any documents in a specific SharePoint site, but can view them. What should you do?
Creating a custom permission level with only read capabilities and assigning it to the contractor group ensures they can view content while being unable to modify or delete any documents.
Your organization is experiencing directory synchronization delays between on-premises AD and Azure AD. What is the first troubleshooting step you should take?
The first step should be to force a sync cycle and check the Azure AD Connect Synchronization Service Manager for errors, filtered objects, or pending sync operations that explain the delay.
A sensitive document containing trade secrets must be shared with a partner organization for a limited time. Which Microsoft 365 feature best supports this requirement?
Sensitivity labels with encryption combined with guest access and expiration dates provide comprehensive protection: encryption secures content, guest access controls who sees it, and expiration dates ensure automatic access removal.
You are auditing password policy compliance in your Microsoft 365 tenant. Where should you check the current password expiration policy settings?
Cloud-based password policies for Azure AD are configured in Azure AD Properties, where administrators can set password expiration and complexity requirements for cloud-only accounts.
You need to assign Microsoft 365 licenses to 500 users. Which method provides the most efficient bulk licensing approach?
Group-based licensing allows you to assign licenses to all members of an Azure AD group automatically, making it the most efficient method for bulk licensing.
What is the primary purpose of multi-factor authentication (MFA) in Microsoft 365?
MFA enhances security by requiring users to provide two or more forms of verification before accessing Microsoft 365 resources.
You are configuring conditional access policies for your organization. Which scenario would benefit most from a location-based conditional access rule?
Location-based conditional access rules can block or require additional verification for sign-in attempts from unexpected or high-risk geographic locations.
Your organization uses hybrid Azure AD join for devices. What are the key prerequisites for this configuration?
Hybrid Azure AD join requires an on-premises AD environment synchronized with Azure AD through Azure AD Connect, plus network connectivity between on-premises and cloud.
You need to prevent users from exporting data from Microsoft 365 services. Which data loss prevention (DLP) feature should you implement?
DLP policies allow you to detect and prevent sensitive data exporting by creating rules that block specific activities in Microsoft 365 workloads.
What is the primary difference between user-assigned and system-assigned managed identities in Azure?
System-assigned managed identities are created and tied to a single Azure resource, while user-assigned managed identities are standalone and can be assigned to multiple resources.
Your organization has implemented Azure AD Connect. Which scenario would require you to reconfigure or reinstall Azure AD Connect?
Changing the synchronization method from password hash sync to pass-through authentication requires reconfiguring Azure AD Connect with different authentication settings.
You are configuring retention policies for Microsoft Teams. Which content type is retained according to the configured retention policy settings?
Microsoft Teams retention policies can be applied to chat messages, channel messages, and meeting recordings to enforce organizational compliance requirements.
Which PowerShell module is required to manage Azure AD users and groups in Microsoft 365?
The Azure AD PowerShell module (or the newer Microsoft Graph PowerShell SDK) is used to manage Azure AD resources including users, groups, and organizational settings.
You need to ensure that all users in your organization use strong passwords. Which Azure AD feature enforces password complexity requirements?
Azure AD Password Protection enforces custom banned password lists and complexity requirements across your organization to prevent weak passwords.
What is the maximum number of users that can be added to a single Microsoft 365 group?
Microsoft 365 groups have no hard limit on the number of members; they are only limited by Azure AD's overall scalability and storage capacity.
You are implementing app protection policies for Outlook mobile. Which setting prevents users from saving attachments to personal cloud storage?
App protection policies can restrict attachment handling to prevent users from saving files to personal cloud storage services, keeping data within managed applications.
What is the primary purpose of the Microsoft Secure Score tool in the Microsoft 365 admin center?
Microsoft Secure Score provides a measurement of your organization's security posture and recommends actions to improve protection across Microsoft 365 services.
You need to configure Exchange Online to prevent external users from seeing the global address list (GAL). Which setting should you modify?
Address Book policies in Exchange Online allow administrators to restrict which users can see specific address lists, including hiding the GAL from external users.
Your organization wants to implement Privileged Identity Management (PIM) for Azure AD administrative roles. What is a key benefit of this approach?
Azure AD PIM enables just-in-time (JIT) privileged access with temporary role activation, approval requirements, and audit trails for improved security.
Which SharePoint Online feature allows you to create a modern team site with a connected Microsoft 365 group?
Modern SharePoint team sites automatically create and connect to a Microsoft 365 group, enabling integrated collaboration across Teams, Outlook, and SharePoint.
You are configuring a mail flow rule to encrypt messages with specific keywords. Which Exchange Online feature should you use?
Office 365 Message Encryption can be applied through transport rules to automatically encrypt messages containing sensitive keywords or sent to specific recipients.
What is the purpose of Azure AD Connect Health in a hybrid Microsoft 365 environment?
Azure AD Connect Health provides monitoring, alerting, and reporting on the health of your Azure AD Connect synchronization and on-premises AD infrastructure.
You need to audit user activities in Microsoft 365. Which audit log would show when a user accessed a shared file in SharePoint Online?
The unified audit log in the Microsoft 365 compliance center records activities across all Microsoft 365 services, including file access in SharePoint Online.
Your organization requires that sensitive emails be encrypted by default. Which approach best achieves this requirement?
Sensitivity labels combined with mail flow rules provide the most comprehensive solution for automatically encrypting sensitive emails across your organization.
What is a key difference between Azure AD roles and Exchange Online administrative roles?
Azure AD roles control access to Microsoft 365 tenant-wide settings, while Exchange Online roles manage Exchange-specific permissions like mailbox management and transport rules.
You are configuring Teams for your organization. Which governance feature allows you to control who can create teams?
Microsoft 365 group creation policies and Teams-specific team creation settings in Azure AD allow administrators to restrict who can create new teams.
Which Microsoft 365 feature provides zero-trust security by verifying every access request to resources?
Azure AD conditional access policies implement zero-trust principles by evaluating every access attempt based on conditions like device, location, and user risk.
Your organization wants to implement eDiscovery for legal holds. Where should you create the legal hold in Microsoft 365?
Legal holds are created and managed in the Microsoft 365 compliance center within eDiscovery cases to preserve content across Exchange, SharePoint, Teams, and OneDrive.
You need to configure Microsoft 365 to automatically apply sensitivity labels to emails containing credit card numbers. Which service should you use?
Microsoft Purview Information Protection provides auto-labeling policies that can automatically apply sensitivity labels based on content patterns like credit card numbers. This is the modern, recommended approach for automatic classification.
Your organization uses hybrid Exchange. A user reports they cannot see shared mailbox folders in Outlook on the web after being granted delegate access. What is the most likely cause?
In hybrid environments, shared mailbox permissions must be synchronized between on-premises Active Directory and Azure AD. If synchronization fails, the user may not see the folders in Outlook on the web despite having permissions assigned.
You are implementing conditional access policies for your organization. You want to require multi-factor authentication (MFA) for all users accessing Microsoft 365 from outside the corporate network. Which assignment setting should you configure?
Named locations allow you to define trusted IP ranges for your corporate network. In conditional access, you can then use the 'Location' condition to require MFA when access comes from locations NOT in your named location list.
A user in your organization accidentally deleted 50 emails from their mailbox 30 days ago. You want to recover these emails. What is the maximum retention period for deleted items in Exchange Online by default?
Exchange Online retains deleted items in the Recoverable Items folder for 14 days by default, but administrators can increase this up to a maximum of 30 days. After this period, items are permanently deleted unless litigation hold or retention policies are in place.
You need to ensure that all Teams meetings automatically record to the cloud and are retained according to your organization's compliance requirements. Which setting should you configure at the organization level?
Teams meeting policies control whether recordings are enabled and automatic, while separate retention policies through Microsoft Purview (formerly Compliance Center) control how long recordings are retained and when they're deleted.
Your organization has set up a multi-tenant Microsoft 365 environment where each business unit operates independently. Users from Tenant A should not be able to access any resources in Tenant B. Which feature prevents cross-tenant access by default?
Microsoft 365 implements native tenant isolation by design. Tenants are completely isolated from each other by default, and users from one tenant cannot access resources in another tenant without explicit cross-tenant access policies being configured.
You are configuring external sharing settings in SharePoint Online. You need to allow file sharing with external partners but want to prevent them from resharing files with others. Which sharing link option should you use?
Specific people links require authentication and allow granular control over permissions. You can restrict external users to view-only access and disable the reshare option in SharePoint sharing settings to prevent further distribution.
Your organization is concerned about data exfiltration through USB devices. You want to enforce that all USB storage devices must be encrypted and that unencrypted devices cannot be used. Which Microsoft 365 tool should you implement?
Microsoft Defender for Endpoint can enforce USB device restrictions and encryption requirements at the endpoint level, preventing unencrypted USB devices from being used on managed devices through attack surface reduction rules.
You are troubleshooting Teams calling issues and need to verify network connectivity and quality. Which diagnostics tool can administrators use to check call quality and connection details for Teams meetings and calls?
The Call Quality Dashboard (CQD) is the dedicated tool for Teams administrators to monitor, investigate, and troubleshoot call quality issues, providing detailed metrics on network performance, audio, video, and connection quality.
You have implemented email encryption using Microsoft Purview Message Encryption with custom branding. An external recipient receives an encrypted message but cannot open it after clicking the 'Read Message' button. What is the most likely cause?
Purview Message Encryption requires recipients to authenticate, either with a Microsoft account or through a one-time passcode. If authentication fails in the OME portal, the recipient cannot access the encrypted content.
You've reviewed all 60 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free