1.1 MS-102 Exam Facts & Blueprint

What MS-102 Is

The exam's official title is Exam MS-102: Microsoft 365 Administrator, and it is the single exam required to earn the Microsoft 365 Certified: Administrator Expert certification. (Microsoft names the exam at the administrator level and the certification at the expert level — expect both spellings in official documentation.) It is an expert-level credential, which means Microsoft expects candidates to have already built real, functional experience across the Microsoft 365 stack rather than passing on book study alone.

The credential certifies a specific role: the integrating hub administrator who sits across all Microsoft 365 workloads. This is not the deepest specialist in any one product, but the administrator who can stand up a tenant, wire identity and access together, coordinate security posture across the Defender XDR suite, and enforce compliance with Purview — while coordinating with the architects and workload admins around them.

The Role You Are Certifying For

The Microsoft 365 Administrator Expert is the integrating administrator across the M365 platform. In a real organization this person works alongside, and coordinates with, several more specialized roles:

• Identity and Access Administrators (Entra ID, Conditional Access, Identity Protection)
• Security Administrators (Defender XDR, Sentinel, threat hunting)
• Compliance Administrators (Purview, information protection, retention)
• Endpoint Administrators (Intune, Entra-joined devices, Defender for Endpoint)
• Workload Administrators (Exchange, SharePoint, Teams)
• Solution Architects (who own the cross-workload design the Expert admin operationalizes)

The Expert admin's value is the cross-workload view: making sure Conditional Access, Defender for Office 365, sensitivity labels, and Intune device compliance all tell the same story rather than contradicting each other.

Audience Profile

Microsoft's study guide describes the intended candidate as someone with functional experience with all Microsoft 365 workloads and with Microsoft Entra ID (formerly Azure AD). That is the non-negotiable baseline — if you have only ever administered Exchange Online, you are not ready for this exam.

In addition, Microsoft expects working knowledge of:

• Networking — name resolution, DNS records that M365 services depend on, firewalls and reverse proxies, TLS, conditional access network locations
• Active Directory Domain Services (AD DS) — on-premises directory sync concepts, group policy vs. MDM, the relationship between on-prem AD and Entra ID
• DNS — MX, autodiscover, SPF, DKIM, and DMARC records that affect mail flow and authentication
• PowerShell — the Microsoft 365 admin shell, and increasingly Microsoft Graph PowerShell and Microsoft Entra PowerShell as the replacement for the deprecated MSOnline and AzureAD modules

If any of those four are weak, shore them up before sitting the exam. PowerShell fluency in particular is tested directly: you will be expected to know the right cmdlets and the right module for a given task.

The Four Domains and Their Weights

The MS-102 skills outline is organized into four domains. The weight percentages tell you exactly where to invest your study time.

Scope note: the April 28, 2026 outline is narrower than older MS-102 material you may find online. eDiscovery, insider risk management, records management, Microsoft Purview Audit, Defender for Identity, and Azure AD B2C are not measured objectives on the current exam. They appear in this guide only where they help you tell an in-scope feature apart from an out-of-scope one.

The headline takeaway: Defender XDR is the largest domain at 30-35%, so it deserves the largest share of your prep. Purview is the smallest at 10-15%, so do not over-invest there at the expense of security. Tenant and identity each carry a quarter to nearly a third of the exam, and they interlock — Conditional Access and Identity Protection sit at the seam between them.

Exam Logistics

A note on item count: Microsoft deliberately does not publish a fixed question count. The form length varies, and some items are unscored pretest questions. Do not try to compute a raw "number correct to pass" from the 700 scaled score — scaled scoring is not a percentage.

Retirement Date — Plan For It

A retirement warning sits on both the MS-102 exam page and the Microsoft 365 Certified: Administrator Expert certification page on Microsoft Learn, and Microsoft's Credentials roundup: June 2026 blog lists the retirement date in its retiring-certifications table. All three say the same thing: MS-102 and the certification it earns retire on November 30, 2026 (the exam-page banner adds "at 11:59 PM Central Standard Time"). Microsoft publishes the date as November 30, 2026 at 11:59 PM Central Standard Time; older sources that named only a month are superseded.

Two consequences matter for planning:

1. You cannot earn the certification after retirement. The certification page states you will no longer be able to earn or renew it past that date — so an existing Administrator Expert credential cannot be extended once the window closes (see section 1.2).
2. Microsoft names a successor. The roundup blog lists Microsoft 365 Certified: AI Services Administrator Associate (Exam AB-650) as the recommended new certification for people starting fresh.

If you are pursuing the Administrator Expert title, schedule your attempt well before November 30, 2026 so that a failed first attempt still leaves you a retake window before retirement. The retake policy is covered in detail in the next section.

How the Domains Fit Together

A useful mental model: the four domains describe a single, layered tenant rather than four disconnected topics.

1. Tenant is the foundation — the subscription, the admin roles, the health monitoring.
2. Identity is who gets in and under what conditions — Entra ID, Conditional Access, Identity Protection.
3. Security is what happens when something malicious gets through — Defender XDR detects, contains, and helps you respond.
4. Compliance is how you govern the data that lives inside the tenant — sensitive information types, retention, sensitivity labels, and DLP.

The exam will frequently test you at the intersections: a Conditional Access policy that depends on an Intune device-compliance signal (identity + endpoint), a sensitivity label that triggers a DLP policy enforced through Defender for Cloud Apps (compliance + security), or an Endpoint DLP rule that only works because the device was first onboarded to Defender for Endpoint (compliance + security + tenant). When you study, practice tracing a scenario across two or three domains at once.