Study guide
1.3 Study Strategy & Using This Guide
Microsoft 365 Administrator Expert MS-102
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 MS-102 Exam Facts & Blueprint 1.2 Registration, Retake & Renewal 1.3 Study Strategy & Using This Guide
2 Tenant Setup, Domains & Org Settings
2.1 Creating a Microsoft 365 Tenant 2.2 Implementing and Managing Domains 2.3 Configuring Org Settings: Security, Privacy & Profile
3 Service Health, Network & Software Updates
3.1 Monitoring Service Health & Notifications 3.2 Network Connectivity Insights 3.3 Configuring & Monitoring Software Updates
4 Adoption, Usage & Microsoft 365 Backup
4.1 Monitoring Adoption & Usage 4.2 Configuring & Managing Microsoft 365 Backup
5 Users, Contacts, Groups & Shared Mailboxes
5.1 Creating & Managing Users Including External Users 5.2 Creating & Managing Contacts 5.3 Managing Microsoft 365 Groups & Shared Mailboxes
6 Licensing & Bulk User Management
6.1 Managing & Monitoring Microsoft 365 Licenses 6.2 Bulk User Management with Graph & Entra PowerShell
7 Roles, Admin Units & Privileged Identity Management
7.1 Implementing & Managing Roles in M365 & Entra ID 7.2 Managing Permissions for Defender XDR, Purview & Workloads 7.3 Managing Delegation with Administrative Units 7.4 Managing Entra ID Roles in PIM
8 Identity Synchronization with Entra Connect
8.1 Preparing for Identity Synchronization & IdFix 8.2 Directory Sync with Entra Connect Sync & Cloud Sync 8.3 Monitoring Sync with Entra Connect Health 8.4 Troubleshooting Synchronization
9 Authentication, SSPR & Password Protection
9.1 Implementing & Managing Authentication Methods 9.2 Self-Service Password Reset (SSPR) 9.3 Microsoft Entra Password Protection 9.4 Investigating & Resolving Authentication Issues
10 Identity Protection, Conditional Access & MFA
10.1 Planning for Identity Protection 10.2 Implementing Entra Identity Protection 10.3 Planning & Implementing Conditional Access Policies 10.4 Managing MFA with Conditional Access
11 Defender XDR Posture, Incidents & Threat Intelligence
11.1 Security Exposure Management & Secure Score 11.2 Incidents, Alerts & Advanced Hunting 11.3 Reviewing Defender XDR Reports 11.4 Defender Threat Intelligence
12 Defender for Office 365: Policies, Alerts & Investigation
12.1 Threat Policies & Rules in Defender for Office 365 12.2 Configuring Alert Policies 12.3 Investigating & Responding to Email Threats
13 Attack Simulation & Restricted Entities
13.1 Managing Attack Simulations & Training 13.2 Managing Restricted Entities & Blocked Users
14 Defender for Endpoint
14.1 Onboarding Devices to Defender for Endpoint 14.2 Configuring Endpoint Settings 14.3 Defender Vulnerability Management Dashboard
15 Defender for Cloud Apps
15.1 Configuring the App Connector for Microsoft 365 15.2 Defender for Cloud Apps Policies & Alerts 15.3 Interpreting the Activity Log 15.4 Cloud App Discovery
16 Purview Information Protection & Data Lifecycle
16.1 Sensitive Information Types 16.2 Retention Labels & Policies 16.3 Sensitivity Labels & Policies 16.4 Monitoring Label Usage: Content & Activity Explorer
17 Purview Data Loss Prevention
17.1 DLP Policies for Microsoft 365 Workloads 17.2 Configuring Endpoint DLP 17.3 Reviewing & Responding to DLP Alerts, Events & Reports
18 Final Review & Exam Strategy
18.1 Exam-Day Strategy & Question Handling 18.2 Final Review Checklist & Next Steps
1.3 Study Strategy & Using This Guide
Key Takeaways Explain This Topic AI
This guide's chapter flow mirrors the four MS-102 blueprint domains, so work it in order unless you are targeting a known weak spot
Defender XDR is 30-35% of the exam, so invest the largest share of study time there; Purview is 10-15% and should not be over-studied at the expense of security
Build hands-on fluency in a Microsoft 365 trial or developer tenant, because expert-level questions assume you have performed the tasks, not just read about them
Use Microsoft Graph PowerShell and Microsoft Entra PowerShell — the legacy MSOnline and AzureAD modules are deprecated and will not be the right answer on current exam items
The MS-102 skills outline is dated as of April 28, 2026; always re-verify the current outline on Microsoft Learn before scheduling your attempt
Last updated: August 2026
How to Use This Guide
This study guide is organized so that the chapter flow mirrors the MS-102 blueprint domains . After this introduction, the chapters walk through tenant administration, Entra identity and access, Defender XDR security, and Purview compliance in the same order and with the same relative emphasis as the exam. The fastest path is to work the chapters in order.
There are two exceptions where you should break order:
If a Practice Assessment or a practice-question set has flagged a specific weak spot , jump to that chapter and shore it up first.
If you are short on calendar runway before the November 30, 2026 retirement , prioritize the highest-weight domain (Defender XDR at 30-35%) and the domain you know best from your associate certification, so you bank the easiest points early.
Each section in this guide ends with key takeaways (the quotable, must-remember points) and quiz blocks that test recall in the exam's own format. The quizzes are intentionally short — they are comprehension checks, not full mock exams. For a full-length, timed question bank, use the ExamFinch MS-102 practice page , which serves hundreds of MS-102-style questions with explanations.
A good rhythm for a section: read the text block, attempt the quiz without looking back at the text, review any miss, then write the key takeaways out in your own words. If you can restate a takeaway from memory the next day, it has stuck.
The Recommended Prep Approach
Expert-level Microsoft exams are not passable on reading alone. The candidates who pass reliably do three things:
Get hands-on in a real Microsoft 365 tenant. Sign up for a Microsoft 365 E5 trial (or a Microsoft 365 Developer Program tenant if you still have access). E5 is the right tier because it includes the Defender XDR and Purview features the exam tests; E3 does not, and you will not be able to follow along with the security and compliance sections on an E3 tenant.
Use Microsoft Learn's free learning paths. Microsoft publishes a learning path mapped to each measured skill on the MS-102 exam page. These are the canonical, Microsoft-authored modules and they are free. Use this study guide for the narrative and the prioritization, and use Microsoft Learn to drill into the official procedure steps and screenshots.
Build PowerShell fluency. The exam tests not just whether you know what a setting does, but how you would configure it at scale. That means cmdlets. Critically, the right answer on current exam items is written for Microsoft Graph PowerShell and Microsoft Entra PowerShell — the modern modules. The legacy MSOnline and AzureAD modules are deprecated. If a practice question in an older resource uses Msol -prefixed cmdlets, treat that as a historical artifact, not the answer you should learn.
Allocating Study Time Across the Four Domains
Use the domain weights as your time budget. If you have 100 hours of prep time, a rough allocation looks like this:
- Domain Weight Approx. hours (of 100)
- Deploy and manage a Microsoft 365 tenant 25-30% 25
- Implement and manage Entra identity and access 25-30% 25
- Manage security and threats with Defender XDR 30-35% 35
- Manage compliance with Purview 10-15% 15
This is a starting point, not a rule. Adjust based on your own Practice Assessment results — if you are scoring 90% on tenant and 50% on Defender XDR, shift hours toward Defender XDR regardless of the baseline.
Verify the Outline Before You Schedule
Microsoft periodically updates exam skills outlines. The MS-102 outline this guide is built from is dated as of April 28, 2026 . Before you schedule your attempt, open the official MS-102 Microsoft Learn exam page and confirm:
The four domains and their weights still match what is in this guide.
The measured skills under each domain have not been re-scoped.
The retirement date is still November 30, 2026.
If the outline has changed, the change is usually small and called out at the top of the skills list. Do not assume the outline is static across the whole study window.
Common Conceptual Traps
The exam rewards candidates who can distinguish products and mechanisms that sound similar. These four confusions cost the most points:
Trap 1: Entra Connect Sync vs. Entra Cloud Sync
Both synchronize on-premises AD objects into Entra ID, but they are different tools with different capabilities.
Entra Connect Sync is the classic on-premises sync engine, installed on a server in your directory, with a large filter and attribute customization surface.
Entra Cloud Sync is the newer, lighter, cloud-hosted sync that uses the Entra Cloud Sync provisioning agent. It is the path Microsoft recommends for new deployments that do not need the advanced features of Connect Sync.
The exam will ask which to choose for a given scenario. The decision hinge is almost always the specific advanced feature the scenario requires (e.g., custom attribute mapping, filtering on a complex rule) versus the simplicity of cloud sync.
Trap 2: Conditional Access vs. Identity Protection
Both live in Entra ID and both affect sign-in, but their scopes differ.
Conditional Access evaluates policies at sign-in time based on user, group, location, device, and risk signals, and enforces controls like MFA or blocking.
Identity Protection generates the user-risk and sign-in-risk signals that Conditional Access can consume, and can also act on its own with risk-based policies.
A question that asks "which feature detects impossible-travel sign-ins" is pointing at Identity Protection; a question that asks "which feature requires MFA for sign-ins from an untrusted location" is pointing at Conditional Access. Many scenarios combine the two — Identity Protection produces the risk, Conditional Access consumes it.
Trap 3: The Defender Suite — Which Product Does What
Defender XDR is a suite of products, and the exam expects you to know which member owns which surface.
Defender for Office 365 — email and collaboration threats (phishing, malware, malicious links/attachments).
Defender for Endpoint — endpoints and servers (EDR, attack surface reduction, automated investigation).
Defender for Identity — on-premises AD and Entra identity threats (lateral movement, credential theft).
Defender for Cloud Apps — SaaS app activity and data (CASB, shadow IT, session control).
The trap is to read a scenario about, say, a malicious SharePoint file and assume it belongs to Defender for Endpoint. It does not — SharePoint file threats are Defender for Office 365's surface. Match the threat to the product by surface, not by the word "defender."
Trap 4: Retention Labels vs. Sensitivity Labels
Both are Purview labels, but they answer different questions.
Retention labels answer how long content is kept and when it is disposed of — data lifecycle management.
Sensitivity labels answer how protected content is — encryption, marking, DLP triggers.
A question about deleting documents after seven years is retention; a question about encrypting a document marked "Confidential" and preventing it from leaving the tenant is sensitivity. They can be applied to the same document, but they are configured and governed separately.
A Four-Phase Study Plan
Phase Duration (rough) Focus
1. Baseline & tenant 1 week Take the free Microsoft Practice Assessment to find your baseline. Stand up an E5 trial tenant and walk the admin centers. Read this Introduction chapter.
2. Domain study 4-6 weeks Work this guide's domain chapters in order. For each chapter, pair the reading with the matching Microsoft Learn learning path and the ExamFinch practice question set for that domain. Do the lab steps in your trial tenant.
3. PowerShell & integration 1-2 weeks Drill Microsoft Graph PowerShell and Entra PowerShell cmdlets until you can write a one-liner for common tenant, identity, security, and compliance tasks. Revisit the cross-domain scenarios in this guide.
4. Mock & schedule 1 week Take a full-length timed practice exam on the ExamFinch MS-102 practice page. Review every miss, not just the score. Schedule the real exam at least six weeks before the November 30, 2026 retirement date.
The plan above assumes roughly 8-10 weeks of part-time study. If you are studying full-time, compress phases 2 and 3. If you have less than 8 weeks before retirement, start at phase 4's scheduling step immediately to lock in a slot, then work backward through the phases with the time you have left.
A Final Orientation
The Microsoft 365 Administrator Expert is, by design, the certification that rewards the administrator who has actually done the work across the tenant, identity, security, and compliance surfaces. There is no shortcut that replaces hands-on time in an E5 tenant and real PowerShell practice. Use this guide to learn the concepts and prioritize your time, use Microsoft Learn for the official procedures, use the ExamFinch practice page for volume question practice, and use your trial tenant to turn the concepts into muscle memory. Then schedule the exam, sit it before November 30, 2026, and renew the title for free each year.