MS-102: Microsoft 365 Administrator Practice Exam

What the MS-102 exam covers

• Deploy and manage a Microsoft 365 tenant214 questions
• Implement and manage Microsoft Entra identity and access188 questions
• Manage security and threats by using Microsoft Defender XDR241 questions
• Manage compliance by using Microsoft Purview109 questions

Free MS-102 practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 752-question bank.

1. Question 1Deploy and manage a Microsoft 365 tenant

   You are the Microsoft 365 administrator for Contoso Ltd. A user reports that Outlook on the web is intermittently unavailable. Where should you first check for information about current service issues affecting your tenant?

   • AService health dashboard in the Microsoft 365 admin centerCorrect
   • BMicrosoft Defender portal for threat and malware alerts
   • CMicrosoft Purview portal for data governance
   • DMicrosoft Entra ID sign-in and audit logs for authentication event history
   ✓ Correct answer: A

   The Service health dashboard is the primary resource for monitoring current service incidents and issues affecting your Microsoft 365 tenant. This dashboard displays real-time status information about all Microsoft 365 services, including Outlook on the web, and shows any ongoing incidents, advisories, or maintenance that might explain service interruptions. Administrators can subscribe to notifications for services they want to monitor and track the impact of incidents on their tenant.

   Why the other options are wrong

   • BMicrosoft Defender portal is incorrect because it focuses on security threats and malware detection, not service availability or infrastructure incidents.
   • CMicrosoft Purview portal is incorrect because it addresses compliance and data governance features, not current service health or availability issues.
   • DMicrosoft Entra ID sign-in and audit logs is incorrect because these logs track authentication events for users, not service infrastructure problems or platform-wide outages.
2. Question 2Deploy and manage a Microsoft 365 tenant

   You need to create a Microsoft 365 backup strategy that protects Exchange Online, SharePoint Online, and OneDrive data. Which Microsoft solution provides this capability?

   • AAzure Backup with a Recovery Services vault backup policy
   • BExchange Online journaling to an external archive
   • CMicrosoft 365 Backup (native backup solution)Correct
   • DThe SharePoint Online site collection recycle bin
   ✓ Correct answer: C

   Microsoft 365 Backup is the first-party, native backup service that protects Exchange Online, SharePoint Online, and OneDrive content with fast restore from immutable copies kept within the Microsoft 365 trust boundary. It is purpose-built for these workloads and offers rapid, large-scale recovery from accidental deletion or ransomware, unlike generic infrastructure backup. Because it operates inside the service, it avoids egress and re-ingestion of large datasets. This is the Microsoft solution that directly delivers backup and restore across all three core workloads.

   Why the other options are wrong

   • AA Recovery Services vault protects Azure virtual machines, Azure Files shares, SQL and SAP workloads in Azure, and on-premises servers through the agent. Exchange Online, SharePoint Online, and OneDrive are not supported Azure Backup workloads.
   • BJournaling captures a copy of each message to an archive for compliance recordkeeping. It has no restore path back into the mailbox and covers only mail, leaving SharePoint and OneDrive unprotected.
   • DThe site collection recycle bin holds deleted items for a limited window before they age out, it covers only SharePoint content, and it does nothing for Exchange Online or OneDrive.
3. Question 3Implement and manage Microsoft Entra identity and access

   Microsoft Entra Connect supports synchronizing users from multiple on-premises Active Directory forests to a single Microsoft Entra ID tenant.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   This statement is true. Microsoft Entra Connect (and Entra Connect Sync) supports multi-forest topologies, letting an organization synchronize identities from several on-premises Active Directory forests into a single Entra ID tenant. A single sync server connects to each forest, and administrators choose how objects that exist across forests are matched and joined, for example using mail attributes, ObjectSID/msExchMasterAccountSID, or a specified attribute so a person represented in multiple forests becomes one cloud identity. This is a common pattern after mergers or in organizations with resource/account forest designs. The key constraint is the reverse: many forests can sync to one tenant, but a given AD object should be synchronized to only one Entra ID tenant.

   Why the other options are wrong

   • BFalse is incorrect because the statement is true. Microsoft Entra Connect (and Entra Connect Sync) supports multi-forest topologies, letting an organization synchronize identities from several on-premises Active Directory forests into a single Entra ID tenant.
4. Question 4Implement and manage Microsoft Entra identity and access

   An organization uses Microsoft Entra ID and wants to implement Conditional Access policies that require compliant devices for accessing Microsoft 365 apps. Users have both corporate-managed and personal devices. What must be in place before device compliance can be evaluated?

   • AAn Azure ExpressRoute private circuit must be configured for the tenant
   • BEvery device in the organization must be running Windows 11 or newer
   • CEvery user must first be assigned a Microsoft 365 F1 frontline license
   • DDevices must be enrolled in Microsoft Intune with compliance policies definedCorrect
   ✓ Correct answer: D

   Conditional Access policies can evaluate device compliance as a condition for granting access. However, device compliance information is only available if devices are enrolled in Microsoft Intune and have compliance policies configured. Intune evaluates whether devices meet security requirements such as password policies, encryption, and security patch levels. Without Intune enrollment and compliance policies, Conditional Access cannot make compliance-based access decisions.

   Why the other options are wrong

   • AExpressRoute provides private network connectivity and is not required to evaluate device compliance.
   • BWindows 11 is not a prerequisite. Intune compliance policies target Windows 10 and later as well as iOS, iPadOS, Android and macOS, so every device in the organization can be evaluated whatever version it runs.
   • CAny Intune-eligible license works; a specific F1 license is not required for compliance evaluation.
5. Question 5Manage security and threats by using Microsoft Defender XDR

   You are implementing Microsoft Defender for Cloud Apps. You need to create a policy that detects when users share files externally from sanctioned cloud storage applications. Which policy type should you create?

   • AFile policy with external sharing filterCorrect
   • BAccess policy with IP filter
   • CAnomaly detection policy with travel alert
   • DActivity policy with login detection
   ✓ Correct answer: A

   Microsoft Defender for Cloud Apps file policies are designed to detect files shared externally from cloud applications. You can create file policies that trigger on specific conditions like files with external sharing enabled, shared with external domains, or shared publicly. The policy evaluates file metadata and sharing permissions in real-time, generating alerts when files containing sensitive data or from specific folders are shared externally, allowing you to investigate and remediate exposure.

   Why the other options are wrong

   • BAccess policy with IP filter is incorrect because access policies control who can authenticate to apps based on IP addresses, user attributes, or device health, not file sharing behavior.
   • CAnomaly detection policy with travel alert is incorrect because these policies detect unusual user activity patterns like impossible travel, not file sharing actions.
   • DActivity policy with login detection is incorrect because activity policies are triggered by user actions like password changes or administrative activities, not file operations.
6. Question 6Manage compliance by using Microsoft Purview

   You are configuring endpoint DLP in Microsoft Purview. You need to prevent users from copying sensitive data to USB drives on managed Windows devices. What must be configured?

   • AAn Intune device configuration policy that blocks all USB removable storage
   • BA Windows Defender Firewall policy that disables the device's USB storage ports
   • CA Microsoft Entra Conditional Access policy using a device property filter
   • DEndpoint DLP policy with 'Copy to USB removable media' restriction and device onboardingCorrect
   ✓ Correct answer: D

   Endpoint DLP in Microsoft Purview extends data protection to managed devices by monitoring and controlling file activities on Windows and macOS systems. To prevent users from copying sensitive data to USB drives, administrators must create an endpoint DLP policy that includes a specific restriction preventing copying data to removable media devices. This policy must be deployed to managed devices that are enrolled in endpoint DLP through Microsoft Defender for Endpoint's device onboarding process. When a user attempts to copy sensitive data (detected by configured sensitive information types) to a USB drive, the endpoint DLP agent blocks the operation and logs the activity for audit purposes.

   Why the other options are wrong

   • AAn Intune device configuration policy can block removable storage outright, but that stops all USB use rather than restricting only sensitive content, and it cannot inspect a file for sensitive information types.
   • BThe firewall filters network traffic and cannot control file copies to USB removable media.
   • CConditional Access governs resource sign-in, not local data-copy actions to USB drives.
7. Question 7Deploy and manage a Microsoft 365 tenant

   In the Microsoft 365 admin center, the Version management tab of Microsoft 365 installation options can roll Windows devices back to the previous Monthly Enterprise Channel build of Office.

   • TrueTrueCorrect
   • FalseFalse
   ✓ Correct answer: True

   This is true. Microsoft 365 installation options is reached from Settings > Org settings > Services in the Microsoft 365 admin center. On the Installation options tab the administrator chooses how often users get Office feature updates, which sets the update channel for both new and existing installations. The Version management tab, which offers 'Roll back to a previous version' and 'Skip this version', is displayed only if Monthly Enterprise Channel was selected for feature updates, because those are the only builds with a predictable monthly version to roll back to. Version management also applies only to Office on Windows, and it has no effect on devices already managed by Group Policy, Cloud Policy, Configuration Manager, or Intune. Because the tab's availability really is conditional on Monthly Enterprise Channel, the statement is correct.

   Why the other options are wrong

   • FalseFalse is wrong here. Recovering from a bad build does not require redeploying Office with the Office Deployment Tool or a management tool: the Version management tab offers 'Roll back to a previous version' directly, with 'Skip this version' to stay there. The tab is shown only to tenants on Monthly Enterprise Channel and applies only to Office on Windows.
8. Question 8Deploy and manage a Microsoft 365 tenant

   After configuring a custom domain, external recipients on some providers intermittently reject your mail with SPF soft-fail, even though you published an SPF record. Investigation shows your record is 'v=spf1 include:spf.protection.outlook.com include:_spf.vendor1.com include:_spf.vendor2.com include:_spf.vendor3.com include:_spf.vendor4.com include:_spf.vendor5.com ~all' and contains many nested includes. What is the MOST likely root cause and correct remediation?

   • ASPF mechanisms are case-sensitive, so every include statement in the TXT record must be rewritten in uppercase before receivers will evaluate the record
   • BThe record exceeds the 10 DNS-lookup limit for SPF, causing a permerror; consolidate includes or use SPF flattening to stay within 10 lookupsCorrect
   • CChange the ~all soft-fail qualifier to a +all qualifier so that every sending host is treated as authorized and no receiving server returns a soft-fail
   • DPublish the identical SPF string as an additional MX record beside the TXT record so receiving servers read it during the MX lookup
   ✓ Correct answer: B

   The SPF specification limits evaluation to 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect). When nested includes push the total over 10, conformant receivers return a permerror, and many treat the message as not passing SPF, producing intermittent rejections. The fix is to reduce the number of include mechanisms - remove unused vendors, consolidate, or apply SPF flattening - so the record resolves within 10 lookups. Microsoft 365's spf.protection.outlook.com itself consumes lookups, so vendor sprawl easily breaches the limit.

   Why the other options are wrong

   • ASPF mechanism names and domain labels are evaluated case-insensitively, so rewriting include:_spf.vendor1.com in uppercase changes nothing about how the record is processed.
   • CA +all qualifier tells every receiver that any host on the internet may send as your domain, which removes the protection SPF exists to give and leaves the lookup count untouched.
   • DSPF is published only as a TXT record at the domain apex. MX records advertise inbound mail servers and their content is a hostname and preference, so an SPF string cannot live there and would not reduce the lookup count anyway.
9. Question 9Manage security and threats by using Microsoft Defender XDR

   Your CISO asks for a single number that represents how well your Microsoft 365 identity, apps, and device configurations follow Microsoft's security recommendations, with prioritized improvement actions to raise it. Which feature in the Microsoft Defender portal provides this?

   • AMicrosoft Secure ScoreCorrect
   • BMicrosoft Defender Threat Intelligence, which delivers curated reports on threat actors, their tooling, and indicators of compromise
   • CThe incidents queue
   • DAttack simulation training
   ✓ Correct answer: A

   Microsoft Secure Score gives a measurement of an organization's security posture as a percentage and points, with prioritized improvement actions across identity, apps, and devices. Completing recommended actions increases the score and reduces risk, and history and comparison views let you track progress over time.

   Why the other options are wrong

   • BMicrosoft Defender Threat Intelligence provides intelligence on threat actors, tools, and indicators; it does not score your configuration posture.
   • CThe incidents queue aggregates active alerts and attacks; it is a response surface, not a posture score.
   • DAttack simulation training runs benign phishing simulations to measure user awareness, not configuration posture.
10. Question 10Implement and manage Microsoft Entra identity and access

    Your organization employs people only in the United States and Canada, and you want to block sign-ins originating from all other countries. Which Conditional Access configuration accomplishes this most directly?

    • ACreate a named location for the allowed countries, then block access for all locations excluding that named locationCorrect
    • BEnable a Microsoft Entra ID Protection sign-in risk policy that blocks access whenever sign-in risk is medium or high
    • CConfigure a per-user MFA trusted IP range
    • DAdd the countries to the SSPR trusted methods
    ✓ Correct answer: A

    Create a named location including the United States and Canada, then build a policy with the location condition set to include All locations and exclude the allowed-countries named location, with grant set to Block. Sign-ins from any other country are blocked.

    Why the other options are wrong

    • BSign-in risk is based on risk signals, not geography, so it does not reliably block by country.
    • CTrusted IPs for per-user MFA only affect MFA prompting, not blocking by country.
    • DSSPR methods have nothing to do with blocking sign-ins by location.

Who this MS-102 practice exam is for

This practice set is for anyone preparing for the MS-102: Microsoft 365 Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this MS-102 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real MS-102 exam.

Related Microsoft resources

• MS-102 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• MS-700 practice examRelated
• MS-721 practice examRelated
• PL-300 practice examRelated

MS-102 practice exam FAQ