MS-102 Microsoft 365 Certified Administrator Expert Sample Questions

Ace the MS-102 exam with these expertly curated Microsoft 365 Certified Administrator Expert sample questions. These scenario-based practice questions cover Microsoft 365 tenant management, identity and access management, security compliance, and workload deployment. Whether you're preparing for the MS-102 certification or assessing your knowledge, this content offers a comprehensive prep experience. Perfect for IT administrators and Microsoft 365 professionals, these MS-102 questions simulate real exam conditions and help you close knowledge gaps while building the confidence to succeed in 2026.

MS-102 Microsoft 365 Certified Administrator Expert Sample Questions List :

1. After acquiring a Microsoft 365 Enterprise subscription, you are tasked with migrating your company‘s Microsoft Exchange Server 2016 mailboxes and groups to Exchange Online. You have started a new migration batch. You, subsequently, receive complaints from on-premises Exchange Server users about slow performance. Your analysis shows that the issue has resulted from the migration. You want to make sure that the effect the mailbox migration has on users is decreased. Solution: You create a label policy. Does the solution meet the goal?

1. No

2. Yes

2. Your company has a Microsoft 365 subscription. You have been tasked with making sure that managed iOS devices are prevented from copying and pasting company data from Microsoft Word documents to other apps. Solution: You create an app protection policy. Does the solution meet the goal?

1. Yes

2. No

3.  Your company’s on-premises network is consisted of several servers. It also owns an Azure AD tenant. The Azure AD Connect Health agent was initially installed on all the servers, but was removed a few weeks later from the servers that were going to be migrated to the cloud. One of theses servers will not be migrated to the cloud after all. What can you do to be, again, able to monitor the health of this server?

1. Change the Azure AD Connect Health services Startup type to Automatic to the server

2. Run the Connect-AzureAD cmdlet from within Azure Cloud shell

3. Reinstall the Azure AD connect health agent to the server

4. You have a Microsoft 365 E5 subscription. You need to implement identity protection. The solution must meet the following requirements:Identify when a user‘s credentials are compromised and shared on the dark web. Provide users that have compromised credentials with the ability to self-remediate. What should you do? 1.To identify when users have compromised credentials, configure: 2.To enable self-remediation, select:

1. A user risk policy

2. Require password change

3. A user risk policy

4. Generate a temporary password

5. A sign-in risk policyRequire multi-factor authentication

6. A registration policy

7. Generate a temporary password

8. Require password change

5. You have a Microsoft 365 tenant. All users are assigned the Enterprise Mobility + Security license. You need to ensure that when users join their device to Microsoft Azure Active Directory (Azure AD), the device is enrolled in Microsoft Intune automatically. What should you configure?

1. Device enrollment managers from the Intune admin center

2. MDM User scope from the Azure Active Directory admin center

3. MAM User scope from the Azure Active Directory admin center

4. Enrollment restrictions from the Intune admin center

6.  Your company has 3,000 users. All the users are assigned Microsoft 365 E3 licenses. Some users are assigned licenses for all Microsoft 365 services. Other users are assigned licenses for only certain Microsoft 365 services. You need to determine whether a user named User1 is licensed for Exchange Online only. Solution: You launch the Azure portal, and then review the Licenses blade. Does this meet the goal?

1. Yes

2. No

7. You have a Microsoft 365 subscription. You need to investigate user activity in Microsoft 365, including from where users signed in, which applications were used, and increases in activity during the past month. The solution must minimize administrative effort. Which admin center should you use?

1. Security & Compliance

2. Azure ATP

3. Cloud App Security

8.  You have a Microsoft 365 subscription. From the Security & Compliance admin center, you create a role group named US eDiscovery Managers by copying the eDiscovery Manager role group. You need to ensure that the users in the new role group can only perform content searches of mailbox content for users in the United States. Solution: From Windows PowerShell, you run the  New-ComplianceSecurityFilter cmdlet with the appropriate parameters. Does this meet the goal?

1. No

2. Yes

 9. Your network contains an Active Directory domain. You have an Azure Active Directory (Azure AD) tenant that has Security defaults enabled. Azure AD Connect is configured for directory synchronization. Password hash synchronization and pass-through authentication are disabled. You need to enable Azure AD Identity Protection to detect leaked credentials. What should you do first?

1. From the Azure Active Directory admin center, disable Security defaults.

2. From Azure AD Connect, enable pass-through authentication.

3. From Azure AD Connect, enable password hash synchronization.

4. From the Azure Active Directory admin center, configure verifiable credentials.

10. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint policy is modified in the future. Solution: From the SharePoint site, you create an alert. Does this meet the goal?

1. No

2. Yes

11.  Your network contains an on-premises Active Directory domain. The domain contains 2,000 computers that run Windows 10. You purchase a Microsoft 365 subscription. You implement password hash synchronization and Azure Active Directory (Azure AD) Seamless Single Sign-On (Seamless SSO). You need to ensure that users can use Seamless SSO from the Windows 10 computers. What should you do?

1. Join the computers to Azure AD.

2. Modify the Intranet zone settings by using Group Policy

3. Deploy an Azure AD Connect staging server.

4. Create a conditional access policy in Azure AD.

12. Your company has an Azure AD tenant with name mycompnay.onmicrosoft.com. You want to create an account for an external user with a Microsoft outlook.com account. This user will have access to a lot of your Microsoft 365 subscription resources. The external user account should be added to mycompany.onmicrosoft.com and be able to authenticate using the outlook .com email. What is the proper course of action?

1. Open the Azure Cloud shell and run the command New-AzureADUser cmdlet specifying the outlook.com email as UserPrincipalName

2. In the Azure portal, add a guest user, specifying the outlook.com as the new guest user’s email address

3. In the Azure portal, add outlook.com as a custom domain name and then create a user using the outlook.com email as username

4. Add a contact using the outlook.com email, in the Microsoft 365 Admin center

13. You have a Microsoft 365 E5 subscription that contains a group named Group1. You need to ensure that all the members of Group1 are notified when Microsoft 365 outages occur. The solution must minimize administrative effort. What should you do?

1. From the Microsoft 365 admin center, configure a Message center email notification.

2. From the Microsoft 365 admin center, configure a Service health email notification.

3. From the Microsoft 365 Defender portal, create an alert policy and configure an email notification.

4. From the Exchange admin center, create an alert policy and configure an email notification.

14. Your company has a Microsoft 365 Enterprise subscription. You have created a password policy with the Lockout threshold attribute set to 2 and the Lockout duration set to 30 seconds. If the users get locked out, how long should it pass until they can try to sign in again?

1. 15 seconds

2. 30 seconds

3. 60 seconds

15. Which Microsoft 365 user role can view all Security & Compliance reports? (Use the principle of least privilege).

1. Security Administrator

2. Security Reader

3. Supervisory Review

4. Records Management

16. You have an Azure Active Directory (Azure AD) tenant that contains a user named User1. Your company purchases a Microsoft 365 subscription. You need to ensure that User1 is assigned the required role to create file policies and manage alerts in the Cloud App Security admin center. Solution: From the Azure Active Directory admin center, you assign the Compliance administrator role to User1. Does this meet the goal?

1. Yes

2. No

17. You have created an XML file for the deployment of Microsoft 365 Apps for Enterprise in all the computers of your company. You used the value SemiAnnualPreview in the Update channel attribute. When will the new feature be released?

1. Twice a year, on the second Tuesday in January and July

2. Twice a year, on the second Tuesday in March and September

3. Every month, on the second Tuesday of the month

4. SemiAnnualPreview channel.

 18. Your company has a Microsoft 365 E5 subscription. Users in the research department work with sensitive data. You need to prevent the research department users from accessing potentially unsafe websites by using hyperlinks embedded in email messages and documents. Users in other departments must not be restricted. What should you do from the Security & Compliance admin center?

1. Create a new safe links policy

2. Modify the default safe links policy

3. Create a data loss prevention (DLP) policy that has a Content contains condition

4. Create a data loss prevention (DLP) policy that has a Content is shared condition

19. Your network contains an on-premises Active Directory domain. The domain contains domain controllers that run Windows Server 2019. The functional level of the forest and the domain is Windows Server 2012 R2. The domain contains 100 computers that run Windows 10 and a member server named Server1 that runs Windows Server 2012 R2. You plan to use Server1 to manage the domain and to configure Windows 10 Group Policy settings. You install the Group Policy Management Console (GPMC) on Server1. You need to configure the Windows Update for Business Group Policy settings on Server1. Solution: You copy the Group Policy Administrative Templates from a Windows 10 computer to Server1. Does this meet the goal?

1. Yes

2. No

20. You have a Microsoft 365 subscription that uses Microsoft OneDrive. You need to prevent users from syncing .exe and .mp3 files from their local device to OneDrive. What should you do?

1. From the SharePoint admin center, configure the Sync settings.

2. From the Microsoft 365 admin center, configure directory synchronization.

3. From the SharePoint admin center, configure the Site storage limits settings.

4. From the Microsoft 365 Apps admin center, create a policy.

21. Your company has an on-premises Microsoft Exchange Server 2016 organization and a Microsoft 365 Enterprise subscription. You plan to migrate mailboxes and groups to Exchange Online. You start a new migration batch. Users report slow performance when they use the on-premises Exchange Server organization. You discover that the migration is causing the slow performance. You need to reduce the impact of the mailbox migration on the end-users. What should you do?

1. Create a mail flow rule.

2. Modify the migration endpoint settings.

3. Create a throttling policy.

4. Configure back pressure.

22. Your company plans to deploy several Microsoft Office 365 services. You need to design an authentication strategy for the planned deployment. The solution must meet the following requirements: Users must be able to authenticate during business hours only. Authentication requests must be processed successfully if a single server fails. When the password for an on-premises user account expires, the new password must be enforced the next time the user signs in. Users who connect to Office 365 services from domain-joined devices that are connected to the internal network must be signed in automatically. Solution: You design an authentication strategy that contains a pass-through authentication model. You install an Authentication Agent on three servers and configure seamless SSO. Does this meet the goal?

1. Yes

2. No

23. Your network contains an on-premises Active Directory domain. The domain contains domain controllers that run Windows Server 2019. The functional level of the forest and the domain is Windows Server 2012 R2. The domain contains 100 computers that run Windows 10 and a member server named Server1 that runs Windows Server 2012 R2. You plan to use Server1 to manage the domain and to configure Windows 10 Group Policy settings. You install the Group Policy Management Console (GPMC) on Server1. You need to configure the Windows Update for Business Group Policy settings on Server1. Solution: You upgrade Server1 to Windows Server 2019. Does this meet the goal?

1. Yes

2. No

24. Where can you find all Microsoft 365 DLP reports?

1. Security & Compliance Center > Reports > Dashboard

2. Security & Compliance Center > left navigation > Data loss prevention > Policy > Edit Policy

3. Security & Compliance Center > left navigation > Data loss prevention

25. You have recently created a retention policy. You want to make sure that users are unable to disable the policy. Your solution should also prevent the users from minimizing the retention period. Which of the following actions should you take?

1. You should run the Set-RetentionCompliancePolicy cmdlet with the -Restrictive Retention parameter set to False.

2. You should run the Set-RetentionCompliancePolicy cmdlet with the -Restrictive Retention parameter set to False.

3. You should run the Set-RetentionCompliancePolicy cmdlet with the -Restrictive Retention parameter set to True.

4. You should run the Set-HoldCompliancePolicy cmdlet with the -Restrictive Retention parameter set to True.

26. You have a Microsoft 365 tenant that uses Microsoft Exchange Online.You have two partner companies that have domains named adatum.com and litwareinc.com. You need to meet the following requirements:Connections to the email server of adatum.com must use TLS and require that the remote server has a digital certificate. Email messages sent to litwareinc.com that contain the word ′confidential′ must be encrypted.What should you use for each domain? 1. Adatum.com 2.  Litwareinc.com

1. Remote domainsURL trace

2. Organization SharingJournal trace

3. Accepted domainsMessage trace

4. ConnectorsRules

27. Your network contains an Active Directory forest named contoso.local. You purchase a Microsoft 365 subscription. You plan to move to Microsoft 365 and to implement a hybrid deployment solution for the next 12 months. You need to prepare for the planned move to Microsoft 365. What is the best action to perform before you implement directory synchronization?

1. Create an external forest trust.

2. Rename the Active Directory forest.

3. Purchase a custom domain name.

4. Purchase a third-party X.509 certificate.

28. You have a Microsoft 365 subscription and an on-premises Active Directory domain named contoso.com. All client computers run Windows 10 Enterprise and are joined to the domain. You need to enable Microsoft Defender Credential Guard on all the computers. What should you do?

1. From a domain controller, create a Group Policy object (GPO) that enabled the Turn On Virtualization Based Security setting.

2. From a domain controller, create a Group Policy object (GPO) that enables the Restrict delegation of credentials to remote servers setting.

3. From the Security & Compliance admin center, create a device security policy.

4. From the Security & Compliance admin center, configure the DKIM signatures for the domain.

29. Your company has an on-premises Microsoft SharePoint Server 2016, but want to migrate some of its functionality to SharePoint Online. To that end you created a Microsoft 365 tenant. What feature of the SharePoint Hybrid Configuration Wizard should you use to make sure that when the employees search for a file by using keywords, the response should contain both on-premises and online results?

1. Cloud hybrid search

2. Hybrid Sites Features

3. Hybrid self-service site creation

4. Hybrid OneDrive

30. You have a Microsoft 365 subscription. You need to prevent users from accessing your Microsoft SharePoint Online sites unless the users are connected to your on-premises network. Solution: From the Device Management admin center, you create a trusted location and a compliance policy Does this meet the goal?

1. Yes

2. No

31. Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Company users store documents using Dropbox Business, which they access Dropbox Business via the MyApps portal. You want to make sure that Microsoft 365 identity is used to authenticate user access to Dropbox Business. Also, in the event that information is downloaded to an untrusted device, the information needs to be protected. Which of the following actions should you take via the Azure Active Directory admin center?

1. You should configure the device settings.

2. You should configure device configuration policy.

3. You should configure application proxy settings.

4. You should configure an app protection policy.

32. Your company has a Microsoft 365 subscription. As part of a threat management strategy, you want to make sure that the possible effect of impersonation and spoofing attacks in email messages is reduced for users. Which of the following is a policy that you should create from the Security & Compliance admin center?

1. An Anti-phishing policy.

2. A retention policy

3. A DLP policy.

4. An Anti-spam policy.

33. Your company has an on-premises Active Directory. Your company has just subscribed in Microsoft 365 with an Azure AD tenant and you need to implement directory synchronization. As the IT administrator you need to find a solution that will allow users to authenticate in Microsoft 365 services even if t the AD is unavailable. Furthermore, the passwords the users have cannot be less than 10 characters. What can you do?

1. Implement Password Hash Synchronization and modify password settings from the default domain policy in the Active Directory

2. Implement Pass-through Authentication and configure password protection in the Azure AD tenant

3. Implement Password Hash Synchronization and configure password protection in the Azure AD tenant

34. Your company has an Active Directory domain as well as a Microsoft Azure Active Directory (Azure AD) tenant. After configuring directory synchronization for all users in the organization, you configure a number of new user accounts to be created automatically. You want to run a command to make sure that the new user accounts synchronize to Azure AD in the shortest time required. Which of the following is the command that you should use?

1. New-ADSyncRule

2. Start-ADSyncSyncCycle

3. Set-ADSyncSchema

4. Set-ADSyncSchedulerConnectorOverride

35. Your network contains an Active Directory domain named contoso.com. The domain contains five domain controllers. You purchase Microsoft 365 and plan to implement several Microsoft 365 services. You need to identify an authentication strategy for the planned Microsoft 365 deployment. The solution must meet the following requirements:Ensure that users can access Microsoft 365 by using their on-premises credentials. Use the existing server infrastructure only. Store all user passwords on-premises only. Be highly available. Which authentication strategy should you identify?

1. Pass-through authentication and seamless SSO with password hash synchronization

2. Federation

3. Pass-through authentication and seamless SSO

4. Password hash synchronization and seamless SSO

36. You want to assign roles to the users of your company’s Microsoft Azure AD. Which role has the ability to invite a guest user?

1. Security Administrator

2. All users

3. User administrator

4. Privileged role administrator

5. Billing Administrator

37. You have a Microsoft 365 subscription. You create a new Conditional Access policy named CAPolicy1. You need to be able to review how CAPolicy1 has affected users after 90 days. What should you do?

1. Deploy the Conditional Access insights and reporting workbook.

2. From the Azure Active Directory admin center, review the sign-in logs for each user.

3. From the Microsoft 365 admin center, view the Email activity report.

4. Run the Get-AzureADAuditSignInLogs cmdlet.

38. Your company has offices in several cities and 100,000 users. The network contains an Active Directory domain named contoso.com. You purchase Microsoft 365 and plan to deploy several Microsoft 365 services. You are evaluating the implementation of pass-through authentication and seamless SSO. Azure AD Connect will NOT be in staging mode. You need to identify the redundancy limits for the planned implementation. What should you identify? 1.Maximum number of servers on which you can run Azure AD Connect: 2.Maximum number of servers on which you can run standalone Authentication Agents:.

1. 61

2. 111

3. 42

4. 26

39. You have a computer that runs Windows 10. You need to verify which version of Windows 10 is installed. Solution: From the Settings app, you select Update & Security to view the update history. Does this meet the goal?

1. Yes

2. No

40. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint sharing policy is modified in the future. Solution: From the SharePoint admin center, you modify the sharing settings. Does this meet the goal?

1. No

2. Yes

41. Your company has a Microsoft 365 subscription that uses an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant is configured to use Azure AD Identity Protection. You plan to use an application named App1 that creates reports of Azure AD Identity Protection usage. You register App1 in the tenant. You need to ensure that App1 can read the risk event information of contoso.com. To which API should you delegate permissions?

1. Office 365 Management

2. Microsoft Graph

3. Windows Azure Active Directory

4. Windows Azure Service Management API

42. Your company has a Microsoft 365 tenant that includes a line-of-business application, named LOB1. Users make use of the My Apps portal to access LOB1. You have recently created a conditional access policy for LOB1, due to security being penetrated. In the event that impossible travel is detected for a LOB1 user, you need to receive an email notification. You have to make sure that alerts are only created for LOB1. Which of the following actions should you take?

1. You should create a create an app discovery policy.

2. You should create an app protection policy.

3. You should create a Cloud Discovery anomaly detection policy.

4. You should create a data loss prevention (DLP) policy.

43. You have a Microsoft 365 subscription. You need to prevent users from accessing your Microsoft SharePoint Online sites unless the users are connected to your on-premises network. Solution: From the Microsoft 365 admin center, you configure the Organization profile settings. Does this meet the goal?

1. No

2. Yes

44. You have a Microsoft 365 subscription. You have a user named User1. You need to ensure that User1 can place a hold on all mailbox content. What permission should you assign to User1?

1. The User management administrator role from the Microsoft 365 admin center

2. The eDiscovery Manager role from the Security & Compliance admin center

3. The Compliance Management role from the Exchange admin center

4. The Information Protection administrator role from the Azure Active Directory admin center

45. You have a Microsoft 365 subscription. You configure a data loss prevention (DLP) policy. You discover that users are incorrectly marking content as false positive and bypassing the DLP policy. You need to prevent the users from bypassing the DLP policy. What should you configure?

1. Incident reports

2. Actions

3. Exceptions

4. User overrides

46. You have a Microsoft 365 Enterprise subscription. You have a conditional access policy to force multi-factor authentication when accessing Microsoft SharePoint from a mobile device. You need to view which users authenticated by using multi-factor authentication. What should you do?

1. From the Azure Active Directory admin center, view the audit logs.

2. From the Microsoft 365 admin center, view the Security & Compliance reports.

3. From the Microsoft 365 admin center, view the Usage reports.

4. From the Azure Active Directory admin center, view the user sign-ins.

47. Your company has a Microsoft 365 subscription, with a data loss prevention (DLP) policy configured. You have been informed that You discover that users are erroneously flagging content as false positive and circumventing the DLP policy. You want to make sure that the DLP policy is not circumvented. Solution: You configure an alert policy. Does the solution meet the goal?

1. No

2. Yes

48. Your company has an on-premises AD and an Azure AD tenant. You have already implemented directory synchronization for all the employees of the company. You need to synchronize 50 new user accounts to Azure AD as quickly as possible. Which is the proper command to run?

1. Start-ADSyncSyncCycle -PolicyType Delta

2. Start-ADSyncSyncCycle -PolicyType Full

3. Sett-ADSyncscheduler -PolicyType Delta

4. Set-ADSyncSyncCycle -PolicyType Delta

49. You have a Microsoft 365 subscription. You discover that some external users accessed content on a Microsoft SharePoint site. You modify the SharePoint sharing policy to prevent sharing outside your organization. You need to be notified if the SharePoint policy is modified in the future. Solution: From the SharePoint admin center, you modify the sharing settings. Does this meet the goal?

1. Yes

2. No

50. You need to consider the underlined segment to establish whether it is accurate. Your company has recently acquired a new sales application. You navigate to the Discovered apps page in Cloud Discovery via Microsoft Cloud App Security to check the application‘s score. You then notice that a number of the applications have a low score as a result of omitted domain registration and consumer popularity data. You want to make sure that the score is not affected by the omitted data. You have to configure app tags via the Cloud Discover settingsSelect ′No adjustment required′ if the  segment is accurate. If the segment is inaccurate, select the accurate option. What should you configure from the?

1. A label

2. App Connector flow

3. No adjustment required

4. A custom key

FAQs

1. What is the Microsoft 365 Certified Administrator Expert MS-102 certification?

The MS-102 certification validates your ability to manage and secure Microsoft 365 enterprise environments, including identities, compliance, and modern workplace services.

2. How do I become a Microsoft 365 Certified Administrator Expert certified professional?

You must pass the MS-102: Microsoft 365 Administrator exam, which measures your skills in deploying, managing, and troubleshooting Microsoft 365 services.

3. What are the prerequisites for the MS-102 certification exam?

To earn this certification, you should first complete one of the Microsoft 365 Associate-level certifications such as MS-100, MS-101, or similar foundational credentials.

4. How much does the Microsoft 365 Certified Administrator Expert MS-102 exam cost?

The exam costs around $165 USD, though pricing varies based on country or currency.

5. How many questions are in the MS-102 exam, and what is the exam duration?

The exam typically has 40–60 multiple-choice questions and a 120-minute duration.\

6. What topics are covered in the Microsoft 365 Certified Administrator Expert MS-102 certification exam?

The exam covers identity management, security, compliance, collaboration, and device management within Microsoft 365.

7. How difficult is the Microsoft 365 Certified Administrator Expert MS-102 exam?

It’s considered intermediate to advanced, requiring strong experience in managing Microsoft 365 environments and related services.

8. How long does it take to prepare for the MS-102 certification exam?

Most candidates prepare in 6–8 weeks, depending on their hands-on experience with Microsoft 365 administration.

9. What jobs can I get after earning the Microsoft 365 Certified Administrator Expert MS-102 certification?

You can work as a Microsoft 365 Administrator, Systems Engineer, IT Support Specialist, or Cloud Administrator.

10. What is the average salary of a Microsoft 365 Certified Administrator Expert certified professional?

Certified professionals earn between $100,000–$130,000 per year, based on experience and organization.