Cheat sheet
Microsoft MS-102 Cheat Sheet
Microsoft 365 Tenant
- 25-30% of exam
- Tenant Setup Users + Groups Roles + PIM Health + Adoption Tenant Picker
Entra Identity + Access
- 25-30% of exam
- Identity Sync Authentication Conditional Access Identity Protection Access Picker
Defender XDR Security
- 30-35% of exam
- Defender XDR Office Protection Endpoint Protection Cloud Apps Security Picker
Purview Compliance
- 10-15% of exam
- Information Protection Retention DLP Explorers Compliance Picker
Quick Facts
- Exam MS-102
- Credential M365 Administrator Expert
- Pass 700/1000
- Time 100 min
- Level Expert
- Vendor Pearson VUE
- Blueprint Apr 28 2026
- Skill Administer tenant
Domain Weights TE
- Tenant 25 | Entra 25 | Defender 30
- Tenant: 25-30 Entra: 25-30 Defender: 30-35 Purview: 10-15
Health vs Message Center TE
Service Health
- Incidents
- Advisories
- Current impact
Message center
- Planned changes
- Feature rollouts
- Retirements
- Outage vs roadmap
Tenant Picker TE
- Prove domain → TXT record
- Route mail → MX record
- Pilot features → Targeted release
- Track incidents → Service Health
- Track changes → Message center
- Automate users → Graph PowerShell
- Scope admins → Admin units
- Elevate roles → PIM
Tenant Setup TE
- Tenant M365 boundary
- Initial domain onmicrosoft.com kept
- Custom domain Verified DNS name
- TXT record Ownership proof
- MX record Mail routing
- Org profile Tenant details
- Targeted release Pilot features
- Network insights Connectivity checks
Users + Groups TE
- User Account object
- Guest External user
- Contact Address object
- Shared mailbox Delegated mailbox
- M365 group Collaboration group
- Security group Access assignment
- Dynamic group Rule membership
- Group licensing Automatic licenses
Roles + PIM TE
- Global Admin Full tenant control
- User Admin User lifecycle
- Security Admin Security configuration
- Compliance Admin Purview administration
- Role group Workload permissions
- Admin unit Scoped delegation
- PIM Just-in-time roles
- Eligible role Activation required
Health + Adoption TE
- Service Health Incidents/advisories
- Message center Planned changes
- Usage reports Workload activity
- Adoption Score Usage signals
- Software updates Apps update status
- M365 Backup Backup/restore
- Admin center Common tasks
- Graph PowerShell Bulk automation
Sync Order ID
- Fix, sync, monitor, troubleshoot
- IdFix first Connect or Cloud Connect Health Fix errors
Connect Sync vs Cloud Sync ID
Connect Sync
- Full engine
- Custom rules
- Complex hybrid
Cloud Sync
- Light agent
- Cloud managed
- Simple forests
- Complex vs lightweight
Access Picker ID
- Clean AD → IdFix
- Complex sync → Connect Sync
- Light sync → Cloud Sync
- Monitor sync → Connect Health
- Reset passwords → SSPR
- Bootstrap login → TAP
- Risk-based access → Conditional Access
- Risk detections → Identity Protection
Identity Sync ID
- IdFix Pre-sync cleanup
- Connect Sync Full sync engine
- Cloud Sync Lightweight agent
- Connect Health Sync monitoring
- PHS Password hash sync
- PTA Pass-through auth
- Federation AD FS sign-in
- Filtering Scope control
CA Flow ID
- If assignments meet conditions, enforce controls
- Users/apps Risk/location Grant/session Report-only first
Defaults vs Conditional Access ID
Security Defaults
- Basic baseline
- Few choices
- No exclusions
Conditional Access
- Granular rules
- Named exclusions
- Risk/device conditions
- Simple vs controlled
Authentication ID
- MFA Extra factor
- SSPR Password reset
- Auth methods Allowed factors
- Authenticator Push/passkey
- FIDO2 Phishing-resistant key
- WHfB Device-bound credential
- TAP Temporary bootstrap
- Password Protection Bad-password blocking
Secure Access ID
- Conditional Access If/then policy
- Assignments Users/apps scope
- Conditions Risk/device/location
- Grant controls Block/allow requirements
- Session controls Runtime limits
- Report-only Test impact
- What If Policy simulation
- Identity Protection Risk detection
XDR Flow SE
- Score, alert, incident, hunt, respond
- Secure Score Alerts Incidents Advanced hunting
Incident vs Alert SE
Incident
- Grouped alerts
- Investigation container
- Timeline view
Alert
- Single signal
- Detection event
- Evidence source
- Case vs signal
Security Picker SE
- Improve posture → Secure Score
- Group alerts → Incidents
- Query signals → Advanced hunting
- Protect email → Defender O365
- Find campaign → Threat Explorer
- Train phishing → Attack simulation
- Protect devices → Defender Endpoint
- Find shadow IT → Cloud Discovery
Defender XDR SE
- Incident Grouped alerts
- Alert Detected signal
- Secure Score Posture metric
- Exposure Mgmt Attack-path view
- Advanced hunting KQL investigation
- Custom detection Scheduled hunt
- Threat intel Adversary context
- Action center Response queue
Defender vs Purview SE
Defender XDR
- Threat protection
- Incidents/alerts
- Hunting
Purview
- Compliance controls
- Labels/retention
- DLP
- Threats vs compliance
Office Protection SE
- EOP Baseline mail filtering
- Safe Links URL detonation
- Safe Attachments File detonation
- Anti-phishing Impersonation defense
- Preset policies Standard/Strict baselines
- Threat Explorer Email investigation
- Attack simulation Phishing training
- Restricted entities Blocked senders
Endpoint + Cloud SE
- MDE onboarding Device enrollment
- Endpoint settings Security controls
- TVM Vulnerability dashboard
- ASR rules Attack surface reduction
- Cloud Apps SaaS protection
- App connector SaaS integration
- Activity log App events
- Cloud Discovery Shadow IT
Purview Flow CO
- Detect, label, retain, prevent, review
- SIT Sensitivity Retention DLP
Sensitivity vs Retention CO
Sensitivity label
- Classify/protect
- Encryption
- Content marking
Retention label
- Retain/delete
- Records
- Disposition
- Protect vs preserve
Compliance Picker CO
- Detect SSNs → SIT
- Classify files → Sensitivity label
- Publish labels → Label policy
- Retain locations → Retention policy
- Retain items → Retention label
- Block sharing → DLP policy
- Block USB → Endpoint DLP
- Audit activity → Activity explorer
Information Protection CO
- SIT Sensitive pattern
- Keyword list Term matching
- Regex Pattern matching
- Sensitivity label Classify/protect
- Label policy Publish labels
- Auto-labeling Automatic classification
- Content explorer Sensitive content
- Activity explorer Label/DLP events
Content vs Activity Explorer CO
Content explorer
- Where data lives
- Sensitive items
- Content inventory
Activity explorer
- What happened
- Label events
- DLP events
- Where vs what
Retention + DLP CO
- Retention policy Location-wide retention
- Retention label Item-level retention
- Label policy Publish retention
- Disposition End review
- DLP policy Data movement control
- Endpoint DLP Device actions
- Policy tip User warning
- DLP alert Policy match
Common Traps
Current weights
- Study guide controls ≠ Exam page may lag
Health vs change
- Health is outages ≠ Message center changes
Domain verify vs mail
- TXT proves ownership ≠ MX routes mail
Authentication vs authorization
- Entra signs in ≠ Roles allow actions
Security defaults vs CA
- Defaults are broad ≠ CA is granular
Alert vs incident
- Alert is signal ≠ Incident groups alerts
Threat vs compliance
- Defender stops attacks ≠ Purview governs data
Endpoint DLP prerequisite
- DLP defines policy ≠ MDE onboards device
Last Minute
- 1. Weights: 25-30/25-30/30-35/10-15
- 2. TXT verifies; MX routes
- 3. Health = incidents; Message = changes
- 4. Groups license; roles authorize
- 5. PIM = just-in-time admin
- 6. IdFix before sync
- 7. Connect Sync = complex hybrid
- 8. Cloud Sync = lightweight agent
- 9. CA = if/then access
- 10. Defender = threats; Purview = data
- 11. Content = where; Activity = what
- 12. Endpoint DLP needs MDE
Microsoft 365 Administrator Expert (MS-102)
- Practice Questions 300 questions Study Guide 57 topics Cheat Sheet 96 facts Flashcards 50 cards Videos 3 videos Blogs 3 blogs Free CE Podcast