MS-102: Microsoft 365 Administrator Exam Resource Guide (April 2026 Update)

Recently the MS-102 study guide recently received a minor update, making some minor naming corrections and clarifications. In other words, nothing that should change your focus if you are already preparing for the exam.

Deploy and manage a Microsoft 365 tenant (25–30%)

Implement and manage a Microsoft 365 tenant

• Create a tenant
  • Plan your setup
  • Try or buy Microsoft 365
• Implement and manage domains
  • Add domain
  • Can I pilot Microsoft 365 with just a few email addresses from my custom domain?
  • Domains FAQ
  • DNS basics
  • Can I add custom subdomains or multiple domains to Microsoft 365?
  • How do I change the default domain in Microsoft 365?
• Configure org settings, including Security & privacy and Organizational profile
  • Customize your organization theme
  • Customize Sign-in page
  • Change your organization’s address, technical contact, and more
  • About the Microsoft 365 admin center
• Monitor the health of Microsoft 365 services by using Service Health, including configuration of notifications
  • Service Health and Continuity
  • Service health
• Configure and review Network connectivity insights
  • Network Connectivity in Microsoft 365 Admin center
  • Microsoft 365 Network Insights
• Configure and monitor software updates by using the Microsoft 365 admin center
  • Software updates in the Microsoft 365 admin center
• Monitor Microsoft 365 adoption and usage
  • Activity reports and analytics
• Configure and manage Microsoft 365 Backup
  • Set up Microsoft 365 Backup

Manage users and groups

• Create and manage users in Microsoft Entra, including external users
  • Add or delete a new user
  • Reset a user’s password
  • Add guest users to your directory in the Azure portal
  • Add a guest user with PowerShell
• Create and manage contacts in the Microsoft 365 admin center
  • Manage mail contacts
• Create and manage groups, including Microsoft 365 groups and manage shared mailboxes
  • Overview of Microsoft 365 Groups for administrators
  • Groups and access management
  • Create a shared mailbox
  • Configure shared mailbox settings
• Manage and monitor Microsoft 365 licenses, including group-based licensing
  • Manage user accounts and licenses
  • Group-based licensing
• Perform bulk user management, including Microsoft Graph PowerShell and Microsoft Entra PowerShell
  • Connect to all Microsoft 365 services in a single Windows PowerShell window
  • Overview

Manage roles and role groups

• Implement and manage roles in Microsoft 365 and Microsoft Entra ID
  • View and assign roles
  • Assign admin roles
  • Assign users to admin roles
  • Create and assign a custom role in Microsoft Entra ID
• Manage permissions for Microsoft Defender XDR, Microsoft Purview and other Microsoft 365 workloads using roles or role groups
  • Roles and role groups in Microsoft Defender for Office 365 and Microsoft Purview
• Manage delegation by using administrative units
  • Administrative units
• Manage Microsoft Entra ID roles in Microsoft Entra Privileged Identity Management (PIM)
  • Deploy PIM
  • Assign Microsoft Entra roles in PIM
  • What is Privileged Identity Management?

Implement and manage Microsoft Entra identity and access (25–30%)

Implement and manage identity synchronization with Microsoft Entra tenant

• Prepare for identity synchronization by using IdFix
  • Install and run the IdFix tool
• Implement and manage directory synchronization by using Microsoft Entra Connect Sync or Microsoft Entra Cloud Sync
  • Microsoft Entra Connect Sync: Understand and customize synchronization
  • Cloud sync configuration
  • Set up directory synchronization for Microsoft 365
• Monitor synchronization by using Microsoft Entra Connect Health
  • Microsoft Entra Connect Health operations
• Troubleshoot synchronization, including Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync
  • Object sync using the troubleshooting task
  • Object isn’t synchronized
    
    

Implement and manage authentication

• Implement and manage authentication methods
  • Authentication methods
  • Windows Hello for Business Deployment Overview
  • Microsoft Entra multifactor authentication overview
• Implement and manage self-service password reset (SSPR)
  • Self-service password reset deep dive
  • Deploy self-service password reset
• Implement and manage Microsoft Entra Password Protection
  • Password protection in Microsoft Entra ID
  • Prevent attacks using smart lockout
• Investigate and resolve authentication issues
  • Sign-in logs
  • What is Microsoft Entra monitoring and health?

Implement and manage secure access

• Plan for identity protection
  • What is Identity Protection?
• Implement and manage Microsoft Entra Identity Protection
  • Configure the user risk policy
  • Configure the sign-in risk policy
  • Simulate risk events
• Plan Conditional Access policies
  • Common ways to use conditional access
• Implement and manage Conditional Access policies
  • Create and assign conditional access policy
  • Create a device compliance policy
  • Monitor conditional access
• Implement and manage multifactor authentication (MFA) by using Conditional Access policies
  • Require MFA for all users

Manage security and threats by using Microsoft Defender XDR (30–35%)

Review and respond to security reports and alerts generated by Microsoft Defender XDR

• Review and respond to threats by using Microsoft Security Exposure Management, including the Microsoft Secure Score
  • Secure score and security controls
  • What is Microsoft Security Exposure Management?
• Review and respond to incidents and alerts generated by Microsoft Defender XDR, including advanced hunting
  • Investigate alerts in Microsoft Defender XDR
  • Manage incidents
• Review and respond to issues identified in Microsoft Defender XDR reports
  • Incident response in the Microsoft Defender portal
• Review and respond to threats identified by Microsoft Defender Threat intelligence
  • Threat analytics in Microsoft Defender XDR
  • Understand the analyst report

Implement and manage email and collaboration protection by using Microsoft Defender for Office 365

• Implement threat policies and rules in Microsoft Defender for Office 365
  • Set up anti-phishing and Microsoft Defender for Office 365 anti-phishing policies
  • Set up Microsoft Defender for Office 365 Safe Attachments policies
  • Set up Microsoft Defender for Office 365 Safe Links policies
• Configure alert policies in Microsoft Defender for Office 365
  • Alert policies in the Microsoft Defender portal
• Investigate and respond to email and collaboration threats by using Microsoft Defender for Office 365
  • View and read your Microsoft Defender for Office 365 reports
• Manage attack simulations, including training campaigns
  • Attack Simulator in Microsoft Defender for Office 365
• Manage restricted entities, including blocked users
  • Remove blocked users

Implement and manage endpoint protection by using Microsoft Defender for Endpoint

• Onboard devices to Microsoft Defender for Endpoint
  • Set up Microsoft Defender for Endpoint deployment
  • Onboard devices to the service
• Configure endpoint settings
  • Configure capabilities of the service
  • Configure conditional access
  • Enable Microsoft Defender for Cloud Apps in Microsoft Defender for Endpoint
• Review and respond to vulnerabilities identified in the Microsoft Defender Vulnerability Management dashboard
  • Endpoint detection and response overview
  • Investigate devices

Implement, and manage Microsoft Defender for Cloud Apps

• Configure the app connector for Microsoft 365
  • How Defender for Cloud Apps helps protect your Microsoft 365 environment
• Configure Microsoft Defender for Cloud Apps policies, including triggering alerts
  • Create snapshot Cloud Discovery reports
  • Investigate risky users
  • Detect suspicious user activity with UEBA
  • Investigate risky OAuth apps
  • Manage alerts
  • Investigate cloud app risks and suspicious activity
• Interpret activity log
  • Activities
  • Activity filters and queries
• Configure Cloud App Discovery
  • Discover and manage shadow IT in your network
  • Working with discovered apps – Microsoft Defender for Cloud Apps
  • Protect and govern your apps
• Review and respond to issues identified in Cloud App Discovery
  • Investigation and response

Manage compliance by using Microsoft Purview (10–15%)

Implement Microsoft Purview information protection and data lifecycle management

• Implement and manage sensitive information types by using keywords, keyword lists, or regular expressions
  • Learn about sensitive information types
  • Customize a built-in sensitive information type
  • Create custom sensitive information types with Exact Data Match based classification
• Implement retention labels, retention label policies, and retention policies
  • Retention policies and labels
• Implement sensitivity labels and sensitivity label policies
  • Learn about sensitivity labels
  • Create and publish sensitivity labels
  • Enable sensitivity labels for Office files in SharePoint and OneDrive
  • Retention policies and labels
• Monitor label usage by using Content explorer, Activity explorer, and label reports
  • Labeling actions reported in Activity explorer
  • Get started with content explorer
  • Classification insights about your data in Microsoft Purview

Implement Microsoft Purview data loss prevention (DLP)

• Configure DLP policies for Microsoft 365 workloads, including Exchange Online, SharePoint Online, OneDrive, Teams, Power BI, and Microsoft 365 Copilot
  • Learn about data loss prevention
• Configure Endpoint DLP
  • Create a DLP policy from a template
  • Create, test, and tune a DLP policy
• Review and respond to DLP alerts, events, and reports
  • View the DLP reports
  • What the DLP functions look for