FREE MS-102 Exam Guide 2026: Pass Microsoft 365 Administrator (Entra, Defender XDR, Purview)

MS-102 Exam Guide 2026: The Only Walkthrough Built Around the Current Skills Measured Outline

If you are a Microsoft 365 administrator in 2026, the single certification that defines your career tier is Exam MS-102: Microsoft 365 Administrator. It is the sole exam standing between you and the Microsoft 365 Certified: Administrator Expert credential - a role-based cert that regulated industries, MSP partners, and enterprise tenants explicitly call out in job descriptions.

Most guides on the internet still reference MS-100 and MS-101, the two-exam predecessor pair Microsoft retired in 2023. If a study plan mentions "sit MS-100 first," it is out of date. This guide is written exclusively for the 2026 exam window: current skills-measured weights, the Entra ID + Defender XDR + Purview stack, the $165 USD Pearson VUE fee, the 700/1000 passing score, and the free Microsoft Learn renewal.

MS-102 At-a-Glance (2026)

Source: Microsoft Learn exam page (learn.microsoft.com/credentials/certifications/exams/ms-102), Microsoft MS-102 Study Guide, and Pearson VUE scheduling portal.

---

Start Your FREE MS-102 Prep Today

Start FREE MS-102 practice questions for the Microsoft 365 Administrator examPractice questions with detailed explanations

---

Why MS-102 (and Why It Replaced MS-100 + MS-101)

Before March 28, 2023, to earn the Microsoft 365 Certified: Enterprise Administrator Expert title you had to pass two exams:

• MS-100: Microsoft 365 Identity and Services - tenant planning, identity synchronization, federation, and workloads.
• MS-101: Microsoft 365 Mobility and Security - device management, threat protection, information governance, and compliance.

Both exams retired on September 30, 2023. Microsoft consolidated the content into a single exam - MS-102 - and renamed the credential simply Microsoft 365 Certified: Administrator Expert (dropping "Enterprise"). The new exam is narrower in scope than MS-100 + MS-101 combined, but tests each domain deeper and with heavier emphasis on Entra ID, Microsoft Defender XDR, and Microsoft Purview - the three pillars Microsoft has invested most aggressively in since 2023.

If you hold old MS-100 or MS-101 credentials, you can no longer renew them. The only path to the current Administrator Expert title is MS-102.

Who Should Sit MS-102

The Microsoft skills outline targets professionals who:

• Administer Microsoft 365 tenants end-to-end: tenant setup, domains, licensing, role-based access.
• Manage identity via Microsoft Entra ID (formerly Azure AD), Entra Connect Sync / Cloud Sync, and hybrid identity.
• Operate security controls across Microsoft Defender XDR (Defender for Office 365, Defender for Endpoint, Defender for Identity, Defender for Cloud Apps).
• Manage compliance via Microsoft Purview (DLP, Information Protection, eDiscovery, Insider Risk, Communication Compliance).
• Support cross-workload governance across Exchange Online, SharePoint Online, OneDrive, Teams, and Intune.

If your role is purely identity-focused, sit SC-300 (Identity & Access Administrator Associate) instead. If your role is purely security operations, sit SC-200 (Security Operations Analyst). MS-102 is the right choice when you own the tenant broadly, not just one workload.

---

Build MS-102 Mastery with FREE Practice Questions

Access FREE MS-102 practice questionsPractice questions with detailed explanations

---

MS-102 Skills Measured (2026 Domain Weights)

The official Microsoft Learn skills outline for MS-102 has been revised multiple times since launch - most recently in early 2026 - reflecting the rebrands (Azure AD -> Microsoft Entra ID, Microsoft 365 Defender -> Microsoft Defender XDR) and new GA features (Conditional Access for workload identities, Purview Insider Risk auto-labeling, Defender XDR unified portal). Always verify against the current PDF at aka.ms/MS-102-study-guide before test day.

Source: Microsoft MS-102 Study Guide, 2026 revision.

Domain 3 (Defender XDR) is the heaviest single domain. Do not under-study it.

Domain 1: Deploy and Manage a Microsoft 365 Tenant (25-30%)

This is the "core admin" domain - tenant hygiene, users, groups, licensing, and cross-workload oversight.

Plan and configure the tenant

• Initial tenant setup, tenant name, and primary domain.
• Add and verify custom domains (TXT / MX records), plan domain-based email routing.
• Configure organizational settings: release preferences (targeted release), password policies, self-service settings.
• Configure usage analytics (Microsoft 365 usage reports, Viva Insights organizational analytics).

Manage users, licenses, and mail-enabled objects

• Create, modify, bulk-import, and delete user accounts (admin center, PowerShell, Graph).
• Assign licenses directly vs via group-based licensing; understand license conflicts and dependencies.
• Manage guest users (B2B collaboration) and contact objects.
• Manage mailboxes, shared mailboxes, distribution groups, Microsoft 365 groups, and mail-enabled security groups.

Manage roles and role groups

• Use Microsoft 365 admin roles (Global Admin, Exchange Admin, Teams Admin, SharePoint Admin, User Admin, Security Admin, Compliance Admin, etc.).
• Apply Privileged Identity Management (PIM) just-in-time elevation for Entra ID roles.
• Limit Global Admin count to the recommended 2-4 break-glass accounts.

Monitor tenant health and service

• Service health dashboard, Message center advisories, Microsoft 365 health status API.
• Adoption Score trends and Viva Insights organizational reports (some signals now surfaced through Viva Insights).
• Tenant-wide reports (active users, email activity, OneDrive storage, Teams usage).

Domain 2: Implement and Manage Microsoft Entra Identity and Access (15-20%)

Entra ID is the backbone of every other domain. This section is short but dense.

Plan and implement identity synchronization

• Entra Connect Sync (traditional AD Connect Sync, on-prem server) - full tenant sync, filtering, password hash sync, pass-through authentication.
• Entra Cloud Sync (lightweight agent, cloud-managed) - multi-forest, preview features, and when to pick Cloud Sync vs Connect Sync.
• Hybrid configurations: federation with AD FS vs pass-through auth vs password hash sync + seamless SSO.
• Object filtering, attribute filtering, Entra Connect Health monitoring.

Manage authentication methods

• Authentication methods policy (migration from legacy MFA/SSPR policies).
• Methods: Microsoft Authenticator (push + number matching), FIDO2 security keys, Windows Hello for Business, passkeys, SMS, voice, OATH tokens, Temporary Access Pass (TAP).
• Passwordless rollout and phishing-resistant MFA enforcement.
• Combined registration experience (SSPR + MFA).

Conditional Access and identity protection

• Design Conditional Access policies: users/groups, cloud apps, conditions (sign-in risk, user risk, device platform, location, client apps), controls (grant/block, require MFA, compliant device, terms of use).
• Report-only mode vs enabled; What-If tool; sign-in logs.
• Identity Protection: user risk + sign-in risk policies; risky users / risky sign-ins remediation.
• Workload identity Conditional Access (service principals) - newer scope in 2026.

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR (30-35%)

The largest domain and the one that changed most in the 2026 outline. Microsoft unified "Microsoft 365 Defender" into Microsoft Defender XDR with a single portal at security.microsoft.com.

Microsoft Defender for Office 365

• Safe Attachments, Safe Links, anti-phishing, anti-spam, anti-malware policies.
• Preset security policies (Standard, Strict) vs custom.
• Configuration analyzer and secure score recommendations.
• Attack simulation training.
• Threat Explorer, Real-time detections, and incident investigation.

Microsoft Defender for Endpoint

• Onboarding workflows (Intune, Group Policy, local script, Configuration Manager).
• Attack Surface Reduction (ASR) rules, tamper protection, controlled folder access.
• Endpoint detection and response (EDR), live response, automated investigation and response (AIR).
• Vulnerability management, device groups, device tags.

Microsoft Defender for Identity

• Sensors on domain controllers and AD FS servers.
• Detect reconnaissance, credential theft (Pass-the-Hash, Pass-the-Ticket, Golden Ticket), lateral movement.
• Integrate with Defender XDR for hybrid identity signals.

Microsoft Defender for Cloud Apps (formerly Cloud App Security / MCAS)

• Connect SaaS apps, shadow IT discovery (Cloud Discovery), session policies via reverse proxy.
• App governance, OAuth app policies, Conditional Access App Control.

Defender XDR unified operations

• Incidents, alerts, advanced hunting (KQL across email, identity, endpoint, cloud).
• Microsoft Secure Score.
• Automated attack disruption.

Domain 4: Manage Compliance by Using Microsoft Purview (15-20%)

Purview is the rebrand that absorbed the old Microsoft 365 Compliance Center.

Data Loss Prevention (DLP)

• Policies across Exchange Online, SharePoint, OneDrive, Teams chat, Defender for Cloud Apps, on-prem (via Purview Information Protection scanner), and endpoint DLP (Windows/macOS).
• Sensitive info types (SITs), exact data match (EDM), trainable classifiers.
• Policy tips, incident reports, overrides.

Information Protection and sensitivity labels

• Create, publish, and auto-apply sensitivity labels.
• Encryption with Azure Rights Management, content marking, access restrictions.
• Label policies per group, mandatory labeling, default labels.
• Protect Teams, SharePoint sites, and M365 Groups with container labels.

Retention and records management

• Retention policies vs retention labels, adaptive scopes vs static scopes.
• Records management (declare, lock, review disposition).

eDiscovery

• eDiscovery (Standard) vs eDiscovery (Premium): case workflow, custodians, holds, collections, reviews, export.
• Content Search vs eDiscovery case search.

Insider Risk Management and Communication Compliance

• Policy templates: data theft by departing users, data leaks, general data leaks, offensive language.
• Alerts, cases, and investigation workflow.

---

Cost and Registration (2026)

Register via the MS-102 page on Microsoft Learn - the Schedule Exam button hands off to Pearson VUE. Pick test center or online-proctored (OnVUE). Confirm your Microsoft Learn profile name matches your government-issued ID exactly; mismatches cause same-day cancellations.

Renewal: FREE on Microsoft Learn After 1 Year

Like every Microsoft role-based certification, MS-102 is valid for one year from the date you pass. Renewal is FREE via Microsoft Learn - a browser-based, unproctored assessment opens in your Microsoft Learn profile 6 months before expiration. It is typically 25-35 questions focused on what has changed in Microsoft 365 since your initial pass (new Entra features, Defender XDR updates, Purview releases). You can retake the renewal unlimited times.

If a certification lapses, it cannot be renewed. You would need to re-sit the full MS-102 at $165. Set a calendar reminder 9 months after your pass date.

8-12 Week MS-102 Study Plan

Most candidates come from AZ-104, MS-100/MS-101 alumni work, or hands-on M365 admin roles. This plan assumes ~8-10 hours per week.

If you are an experienced M365 admin, compress to 6-8 weeks by skipping Weeks 1-2.

Recommended MS-102 Resources (FREE-First)

Hands-On Microsoft 365 Trial Tenant Strategy

MS-102 is not a memorize-the-facts exam. Case studies embed 2-4 pages of tenant context and multiple linked questions, and drag-and-drop + performance-based items reward real admin muscle memory. Without a live tenant you will run out of the 100 minutes.

Use the Microsoft 365 Developer Program (free, renewable) to provision a trial tenant with:

• 25 sample users with realistic Exchange/SharePoint/Teams content
• E5 license-equivalent capabilities (Defender XDR, Purview, Entra ID P2) for dev/test
• A refreshable sandbox you can reset between study sessions

If your employer has a Microsoft 365 E5 tenant, ask for a sandbox sub-tenant or a non-production OU. For Entra Connect Sync labs, spin up a small Hyper-V or Azure VM with AD DS.

Build at least these six scenarios end-to-end:

1. Custom domain verification + pilot user cutover from on-prem Exchange.
2. Entra Cloud Sync from an on-prem AD lab into a trial tenant.
3. Conditional Access: MFA for all users, block legacy auth, require compliant device for sensitive apps.
4. Defender for Endpoint onboarding via Intune, plus ASR rules + tamper protection.
5. DLP policy across Exchange/SharePoint/OneDrive/Teams with sensitive info types + policy tips.
6. eDiscovery Premium case: add custodian, place hold, run collection, review, export.

If you have built all six, you will recognize every scenario on the exam.

Test-Day Strategy: The Case-Study Format

MS-102 uses case studies, standalone items, and performance-based labs the same way other Microsoft Expert-tier exams do. The case-study format is where most first-time failures happen.

Before you sit:

• Confirm your Microsoft Learn profile name matches your government ID exactly.
• If online-proctored, run the Pearson VUE OnVUE system check 24 hours in advance.
• Clear your desk; the proctor will ask for a 360-degree room scan.

During the exam:

• Case studies appear as standalone timed sections (typically 2-3 cases). Once you submit a section you cannot return to it - but within a section you can flag, move back and forth, and review.
• Read the question first, then skim the case study for the specific detail. Do not read all 4 pages twice.
• Budget ~4-5 minutes per case-study item and ~1.5-2 minutes per standalone item.
• On any ambiguous item, pick the option that is most aligned with Microsoft's current recommended best practice (Conditional Access over legacy MFA, Entra Cloud Sync over Connect Sync for new small deployments, Defender XDR unified portal over standalone Defender for Office).
• Flag anything under 90% confidence; Microsoft gives you the full section time to revisit flagged items.

After the exam:

• Immediate pass/fail with scaled score (0-1000, pass = 700).
• A skills-measured breakdown is emailed within 1-3 business days.
• If you fail, wait 24 hours for retake #1, 14 days for retakes 2-5.

Common Pitfalls That Sink First-Time Scores

1. Confusing Conditional Access with Identity Protection. Conditional Access grants or blocks access based on signals; Identity Protection detects risky users / risky sign-ins. Conditional Access consumes the risk signals Identity Protection generates. The exam uses subtle wording to separate them - pay attention to whether the question is about detection (Identity Protection) or enforcement (Conditional Access).
2. Not knowing the Defender XDR vs Purview boundary. Defender XDR is threats (malware, phishing, identity attacks, endpoint compromise). Purview is compliance (DLP, labels, retention, eDiscovery, insider risk). Example: a DLP policy alerting on PII exfiltration is Purview, not Defender. An anti-phishing policy quarantining a message is Defender, not Purview. Never confuse the two portals.
3. Studying MS-100 / MS-101 content. Federation with AD FS, Skype for Business hybrid, legacy Intune UI - all out of scope. If a resource still teaches those, it is out of date.
4. Under-studying Entra Cloud Sync vs Connect Sync trade-offs. Every revision of the outline has pushed Cloud Sync harder. Know the feature parity gaps (device writeback, password writeback, complex filtering) and when each is the right answer.
5. Skipping PowerShell / Graph completely. The exam is not a scripting test, but drag-and-drop items can include cmdlet ordering (Connect-MgGraph, Get-MgUser, New-MgGroup). Know the Microsoft Graph PowerShell module basics.
6. Ignoring Preset security policies in Defender for Office. "Standard" and "Strict" presets are the recommended modern answer over hand-rolled custom policies in most scenarios - Microsoft rewards the preset option.
7. Forgetting that DLP endpoint extension requires onboarding. Endpoint DLP only works on devices onboarded to Defender for Endpoint. This trips up case-study questions about DLP coverage on unmanaged devices.
8. No timed full-length practice. 100 minutes with case studies + performance-based labs + standalone items is tight. Two timed mocks minimum before test day.

Career Value and Salary (Microsoft 365 Administrator, 2026)

Microsoft 365 admin roles remain one of the most durable cloud-ops career tracks. Every enterprise that runs Exchange Online, SharePoint, Teams, or Intune needs people who can administer the tenant, enforce security, and manage compliance. MS-102 is explicitly referenced in many MSP and regulated-industry job descriptions.

M365 Admin Career Ladder

The MS-102 + SC-300 pair is the single highest-ROI certification combination for M365 admins in 2026, unlocking both the Administrator Expert title and the Identity & Access Administrator Associate title.

Deep Dives on Three Topics Competitor Guides Skim

1. Entra Connect Sync vs Entra Cloud Sync

This is the most testable Domain 2 topic. Both tools sync on-prem Active Directory into Entra ID, but they differ meaningfully.

The exam frequently asks "which is the minimal solution to sync a new forest after an acquisition" - the answer is usually Cloud Sync.

2. Conditional Access Nuance (What Trips Candidates Up)

• Report-only mode is not the same as disabled. Report-only still evaluates the policy and logs the result, but never enforces - essential for pre-production testing.
• Grant controls use AND/OR: "Require MFA AND Require compliant device" is much stricter than "Require MFA OR Require compliant device."
• What-If tool is your friend for troubleshooting - use it to simulate specific user + app + condition combos.
• Excluded users (break-glass accounts) should always include at least two emergency Global Admin accounts with long passphrases stored in a vault.
• Workload identity Conditional Access (for service principals) is a newer premium feature; the exam tests when it applies.
• Legacy authentication (IMAP, POP, SMTP AUTH, older Office clients) must be blocked via a dedicated Conditional Access policy; Microsoft's Security Defaults block it by default for tenants that have them enabled.

3. Purview DLP + Information Protection Interaction

• Sensitivity labels classify and optionally encrypt content.
• DLP policies enforce actions (block, warn, audit) based on conditions including "content contains sensitive info type X" or "content has sensitivity label Y."
• The labeled-content approach scales better than sensitive-info-type matching alone because labels survive file format changes.
• Auto-labeling (service-side) applies labels at rest in SharePoint/OneDrive/Exchange without user action - a Purview E5 feature.
• Endpoint DLP requires devices onboarded to Defender for Endpoint and covers Windows 10/11 and macOS; Linux support is limited.

Case-study items often present a scenario where sensitive data leaks from a managed device to an unmanaged USB drive - the right answer combines endpoint DLP (to block the action) with a sensitivity label (to classify the content in the first place).

How MS-102 Fits into the Broader Microsoft Certification Path

MS-102 + SC-300 + SC-400 is the "Modern Work + Security" trio many enterprises expect.

---

Keep Training with FREE MS-102 Practice

Practice MS-102 scenario questionsPractice questions with detailed explanations

---

Frequently Missed 2026 Details (Competitor Guides Get These Wrong)

• MS-100 and MS-101 are gone. If a guide recommends taking them first "for background," it is out of date - they retired September 30, 2023.
• Azure AD is now Microsoft Entra ID. Old terminology (AAD Connect, AAD Conditional Access) still appears in community posts but the exam uses current Entra naming.
• Microsoft 365 Defender is now Microsoft Defender XDR with a unified portal at security.microsoft.com.
• Preset security policies (Standard, Strict) in Defender for Office are the recommended modern answer over custom policies in most scenarios.
• Entra Cloud Sync is preferred over Connect Sync for new, smaller, or multi-forest deployments when device writeback is not required.
• Passwordless + phishing-resistant MFA (FIDO2, Windows Hello for Business, passkeys, certificate-based authentication) is the direction every new Microsoft identity question pushes toward.
• Endpoint DLP requires Defender for Endpoint onboarding - DLP alone does not cover the device channel.
• Renewal is free and unproctored - and opens 6 months before expiration, not after.

Official Sources Used

• Microsoft Learn - Exam MS-102: Microsoft 365 Administrator (skills outline, 2026 revision)
• Microsoft Learn - MS-102 Study Guide (aka.ms/MS-102-study-guide)
• Microsoft 365 Certified: Administrator Expert credential page
• Microsoft Entra ID / Entra Connect Sync / Entra Cloud Sync documentation
• Microsoft Defender XDR documentation (security.microsoft.com)
• Microsoft Purview documentation (purview.microsoft.com)
• Pearson VUE Microsoft exam scheduling portal (fee and retake policy)
• Microsoft Learn credential renewal policy (6-month renewal window, free online assessment)
• Glassdoor / ZipRecruiter / Salary.com / Robert Half - 2026 salary references
• LinkedIn Talent Insights - M365 admin job demand signals

Certification details, fees, and skills measured may be revised by Microsoft. Always confirm current requirements directly on learn.microsoft.com before scheduling.