All Practice Exams

100+ Free MS-102 Practice Questions

Pass your Microsoft 365 Certified: Administrator Expert (MS-102) exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
Not published Pass Rate
100+ Questions
100% Free
1 / 100
Question 1
Score: 0/0

Which authentication option supports single sign-on without sending password hashes to the cloud, by validating credentials against on-prem AD via lightweight agents?

A
B
C
D
to track
2026 Statistics

Key Facts: MS-102 Exam

4

Skill Domains

Microsoft Learn MS-102 study guide

700

Passing Score (out of 1000)

Microsoft Learn

100 min

Exam Duration

Microsoft / Pearson VUE

$165

Exam Fee (USD)

Microsoft 2026

Apr 28, 2026

Last Skills Update

Microsoft Learn

Pearson VUE

Delivery Provider

Microsoft

MS-102 contains roughly 40-60 items delivered in 100 minutes via Pearson VUE, with a scaled passing score of 700/1000. The exam covers four domains: Deploy and manage a Microsoft 365 tenant (25-30%), Implement and manage Microsoft Entra identity and access (25-30%), Manage security and threats with Microsoft Defender XDR (30-35%), and Manage compliance with Microsoft Purview (10-15%). Earning Administrator Expert requires one associate-level prerequisite certification.

Sample MS-102 Practice Questions

Try these sample questions to test your MS-102 exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1You need to add the custom domain contoso.com to a new Microsoft 365 tenant. Which DNS record type does Microsoft 365 require you to publish to verify ownership of the domain?
A.TXT or MX
B.A record
C.SRV
D.CNAME only
Explanation: Microsoft 365 verifies domain ownership using either a TXT record (recommended) or an MX record published at the domain's authoritative DNS host. After verification, additional records (MX, CNAME for Autodiscover, TXT for SPF, SRV for Teams federation) are added for service-specific functionality.
2An administrator wants to receive proactive email notifications when a Microsoft 365 service is degraded or in advisory state. Where in the Microsoft 365 admin center is this configured?
A.Billing > Notifications
B.Service Health > Preferences
C.Org settings > Security & privacy
D.Reports > Usage
Explanation: Service Health notification preferences are configured in the Microsoft 365 admin center under Health > Service health > Preferences. You select which services to monitor and add up to two email addresses to receive incident and advisory notifications.
3You need to assign Microsoft 365 E5 licenses to all members of a security group automatically when they join the group. Which Microsoft Entra capability accomplishes this?
A.Group-based licensing
B.Privileged Identity Management
C.Administrative units
D.Self-service group management
Explanation: Group-based licensing in Microsoft Entra ID lets you assign one or more product licenses to a security group; members inherit the licenses automatically when added and lose them when removed. This requires a Microsoft Entra ID P1 or higher license.
4You must give a regional helpdesk team the ability to reset passwords only for users in the Sales department, without granting tenant-wide rights. Which feature should you use?
A.Privileged Identity Management eligible role
B.Conditional Access policy
C.Tenant-wide Helpdesk Administrator role
D.Administrative units with the Helpdesk Administrator role scoped to the Sales unit
Explanation: Microsoft Entra administrative units (AUs) restrict the scope of a role assignment to a subset of users, groups, or devices. Assigning the Helpdesk Administrator role over a Sales AU lets that team manage only Sales users.
5Which Microsoft Graph PowerShell command creates a new cloud-only user named Maria Lopez with userPrincipalName mlopez@contoso.com and a randomized password?
A.New-MsolUser -DisplayName 'Maria Lopez' -UserPrincipalName 'mlopez@contoso.com'
B.New-MgUser -DisplayName 'Maria Lopez' -UserPrincipalName 'mlopez@contoso.com' -AccountEnabled -PasswordProfile @{Password='Pa55w.rd!Temp'; ForceChangePasswordNextSignIn=$true} -MailNickname 'mlopez'
C.Add-AzureADUser -Name 'Maria Lopez' -UPN 'mlopez@contoso.com'
D.Set-MgUser -Create -DisplayName 'Maria Lopez'
Explanation: New-MgUser is the Microsoft Graph PowerShell cmdlet that creates a user. It requires DisplayName, UserPrincipalName, MailNickname, AccountEnabled, and a PasswordProfile object. Microsoft has deprecated the AzureAD and MSOnline PowerShell modules in favor of Microsoft Graph PowerShell.
6Your company plans to use Microsoft 365 Backup. Which workloads can it currently protect?
A.On-premises Exchange Server only
B.Exchange Online and Power BI
C.Exchange Online mailboxes, OneDrive accounts, and SharePoint sites
D.Microsoft Teams chats only
Explanation: Microsoft 365 Backup protects Exchange Online mailboxes, OneDrive for Business accounts, and SharePoint sites, with restore-to-original or alternate location options. It is a paid add-on built on Microsoft Syntex Backup.
7You want to audit Microsoft 365 adoption across Teams, OneDrive, and Exchange to identify low-usage departments. Which admin center area provides this data?
A.Reports > Usage in the Microsoft 365 admin center
B.Billing > Licenses
C.Microsoft Purview > Compliance Manager
D.Microsoft Defender XDR > Incidents
Explanation: The Microsoft 365 admin center Reports > Usage section surfaces active user, activity, and adoption metrics across Microsoft Teams, OneDrive, SharePoint, Exchange, Yammer, and Microsoft 365 Apps, with an Adoption Score for benchmarking.
8An administrator must convert the existing Microsoft 365 Group 'Marketing' into a shared mailbox while preserving the email address. Which approach is supported?
A.Run Convert-MsolUser -Type SharedMailbox
B.You cannot convert a Microsoft 365 Group into a shared mailbox; create a new shared mailbox and migrate content
C.Use the admin center Convert-to-Shared button on the group
D.Use Set-UnifiedGroup -ConvertToShared
Explanation: Microsoft does not support converting a Microsoft 365 Group into a shared mailbox in place. The supported pattern is to create a shared mailbox, copy required content (email, calendar), and decommission the group, swapping the SMTP address if needed.
9You need to invite an external partner from fabrikam.com to collaborate in a Microsoft Teams team in your contoso.com tenant. The partner must use their own credentials. What identity model is created in Entra ID?
A.A B2B guest user
B.A cloud-only member user
C.A synchronized user
D.A service principal
Explanation: Microsoft Entra B2B collaboration creates a guest user object in your tenant (UserType = Guest). The partner authenticates with their home tenant credentials and accepts an invitation to access shared resources.
10Which Microsoft Entra role grants the minimum permissions needed to read sign-in logs and audit logs without modifying configuration?
A.Global Reader
B.Reports Reader
C.Security Reader
D.Helpdesk Administrator
Explanation: The Reports Reader role provides read-only access to Microsoft Entra sign-in and audit logs and to usage reports, with no configuration rights. Global Reader is broader and includes much more.

About the MS-102 Exam

MS-102 is the single required exam for the Microsoft 365 Certified: Administrator Expert certification. It validates skills for tenant-level deployment and administration of Microsoft 365 across identity, security, and compliance, integrating workloads such as Microsoft Entra ID, Microsoft Defender XDR, and Microsoft Purview.

Questions

50 scored questions

Time Limit

100 minutes

Passing Score

700 / 1000

Exam Fee

$165 USD (Microsoft (Pearson VUE))

MS-102 Exam Content Outline

25-30%

Deploy and manage a Microsoft 365 tenant

Create and configure a tenant, manage custom domains, monitor Service Health and network connectivity insights, schedule software updates, configure Microsoft 365 Backup, manage users, contacts, groups, shared mailboxes, group-based licensing, bulk operations with Microsoft Graph PowerShell, role assignments, administrative units, and Microsoft Entra Privileged Identity Management (PIM).

25-30%

Implement and manage Microsoft Entra identity and access

Prepare for and run identity synchronization with Microsoft Entra Connect Sync or Cloud Sync, troubleshoot with IdFix and Connect Health, configure authentication methods, self-service password reset (SSPR), Microsoft Entra Password Protection, plan for and configure Microsoft Entra Identity Protection, and design Conditional Access policies including MFA enforcement.

30-35%

Manage security and threats by using Microsoft Defender XDR

Use Microsoft Security Exposure Management and Microsoft Secure Score, triage Defender XDR incidents with advanced hunting (KQL), configure Defender for Office 365 threat policies (Safe Attachments, Safe Links, anti-phishing), manage attack simulation training, onboard endpoints to Microsoft Defender for Endpoint and use Microsoft Defender Vulnerability Management, and configure Microsoft Defender for Cloud Apps connectors, policies, and Cloud App Discovery.

10-15%

Manage compliance by using Microsoft Purview

Configure sensitive information types (keywords, lists, regex), implement retention labels and policies, deploy sensitivity labels and label policies, monitor with Content explorer and Activity explorer, and configure data loss prevention (DLP) for Exchange, SharePoint, OneDrive, Teams, Power BI, Microsoft 365 Copilot, and endpoint devices.

How to Pass the MS-102 Exam

What You Need to Know

  • Passing score: 700 / 1000
  • Exam length: 50 questions
  • Time limit: 100 minutes
  • Exam fee: $165 USD

Keys to Passing

  • Complete 500+ practice questions
  • Score 80%+ consistently before scheduling
  • Focus on highest-weighted sections
  • Use our AI tutor for tough concepts

MS-102 Study Tips from Top Performers

1Spin up a free Microsoft 365 E5 trial tenant and practice every skill measured bullet hands-on rather than only reading documentation
2Memorize Conditional Access policy components (assignments, conditions, controls) and the difference between Identity Protection risk policies and CA policies
3Learn Microsoft Defender XDR portal navigation: incidents, advanced hunting (KQL), threat analytics, Secure Score, and Exposure Management
4Practice Microsoft Graph PowerShell cmdlets for bulk user, group, and license operations - Connect-MgGraph, Get-MgUser, New-MgGroup, Set-MgUserLicense
5Compare Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync feature parity and know when to choose each
6Distinguish retention labels (item-level, user-applied) from retention policies (location-level, automatic) and when to use each in Purview

Frequently Asked Questions

What is the MS-102 exam format?

MS-102 contains approximately 40-60 questions delivered over 100 minutes of seat time. Item types include multiple choice, multiple response, drag-and-drop, build-list, hot-area, and case-study scenarios. The exam is offered at Pearson VUE test centers and through OnVUE online proctoring.

What does the MS-102 exam cover?

MS-102 covers four domains: Deploy and manage a Microsoft 365 tenant (25-30%), Implement and manage Microsoft Entra identity and access (25-30%), Manage security and threats by using Microsoft Defender XDR (30-35%), and Manage compliance by using Microsoft Purview (10-15%). The English version was updated April 28, 2026.

How much does the MS-102 exam cost?

The MS-102 exam fee is $165 USD in the United States, with regional pricing in other countries. Microsoft periodically offers Exam Replay vouchers that bundle a first attempt with one retake at a discount.

What is the passing score for MS-102?

MS-102 requires a scaled score of 700 out of 1000 to pass. Microsoft uses scaled scoring rather than a fixed percentage, so 700 does not necessarily equal 70% correct. Score reports show performance per skill area but no raw item counts.

Do I need a prerequisite certification before taking MS-102?

MS-102 itself has no enforced prerequisite, but to earn the Microsoft 365 Certified: Administrator Expert credential you must also hold one associate-level certification: Endpoint Administrator Associate (MD-102), Messaging Administrator Associate, Teams Administrator Associate, Identity and Access Administrator Associate (SC-300), or Information Security Administrator Associate.

How should I study for MS-102?

Weight your study time to the official skills measured outline: about a third on Defender XDR, a quarter each on tenant management and Entra ID, and the remainder on Purview compliance. Get hands-on practice in a Microsoft 365 trial tenant, learn Microsoft Graph PowerShell, and complete the free Microsoft Learn Practice Assessment plus 100+ practice questions before exam day.