MS-102 cheat sheet

Creating a Microsoft 365 or Microsoft Entra subscription provisions a dedicated tenant with an initial name.onmicrosoft.com domain and one account holding the Global Administrator role.

A custom domain is verified with a TXT or MX record at the public DNS host, and a given domain name can be verified in only one tenant at a time.

Group-based licensing requires Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, E3, and E5 but not in Business Basic or Business Standard.

A usage location must be set on each user before licenses can be assigned directly or inherited through group-based licensing.

Microsoft 365 admin center activity reports expose data for the last 7, 30, 90, or 180 days; the Microsoft Graph usage reports API can be scheduled for longer trend capture.

In-place tenant relocation between geographies is not supported; moving requires a new tenant, domain re-verification, DNS changes, and full content migration.

Service health shows active incidents and advisories for the tenant, while Message center tracks upcoming feature changes, rollout timing, and admin action deadlines.

Delegated partner access uses granular delegated admin privileges (GDAP) configured in Partner Center, which replaced the older delegated administration model.

Administrative roles are split between Microsoft 365 admin center roles and Microsoft Entra roles; least privilege means assigning User Administrator or License Administrator instead of Global Administrator for routine tasks.

Microsoft Entra ID Free covers user and group management, cloud-only self-service password reset, security defaults, and basic reports; P1 adds Conditional Access, group-based licensing, SSPR writeback, and hybrid join; P2 adds Privileged Identity Management, Identity Protection, and access reviews.

Conditional Access evaluates signals including user or group, IP location, device platform and state, client app, and sign-in risk; every applicable policy must be satisfied before access is granted.

Report-only mode records in the sign-in log what a policy would have done without enforcing it, which is the supported way to validate scope before switching a policy to On.

Security defaults require MFA registration for all users and block legacy authentication; enabling a Conditional Access policy turns security defaults off because the two are mutually exclusive baseline controls.

Legacy authentication protocols cannot satisfy MFA, so blocking them uses a Conditional Access policy with the client apps condition set to Exchange ActiveSync and other legacy clients.

Self-service password reset with on-premises writeback requires Microsoft Entra ID P1 plus a hybrid agent (Azure AD Connect or Cloud Sync) with password writeback enabled.

Privileged Identity Management assignments are either active (role held continuously) or eligible (activated on demand with justification, approval, MFA, and a time limit); PIM requires Microsoft Entra ID P2 or Governance.

Hybrid identity authentication options are password hash synchronization, pass-through authentication with an on-premises agent, or federation with AD FS; password hash sync survives on-premises outages because validation happens in the cloud.

Smart lockout defaults to 10 failed sign-in attempts followed by a 60-second lockout; custom banned password lists and the on-premises password protection agent require Microsoft Entra ID P1.

Microsoft Defender XDR correlates alerts from Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Defender Vulnerability Management into incidents in the Microsoft Defender portal.

Advanced hunting runs KQL against tables such as DeviceEvents, DeviceProcessEvents, EmailEvents, IdentityLogonEvents, and CloudAppEvents; interactive event data is retained for 30 days.

Defender for Office 365 Plan 1 provides Safe Attachments, Safe Links, anti-phishing policies, and real-time detections; Plan 2 adds automated investigation and response, attack simulation training, Threat Explorer, and threat trackers.

Anti-phishing policies contain spoof intelligence, impersonation protection for users and domains, mailbox intelligence, and safety tips; spoof intelligence decisions are managed in the Tenant Allow/Block List.

Safe Attachments actions are Off, Monitor, Block, Replace, and Dynamic Delivery, while Safe Links rewriting and detonation occur at time of click for email, Teams, and supported Office apps.

Quarantine policies define whether recipients can view, request release of, or block their own quarantined messages; admin-only quarantine is configured by removing user access in the policy.

Attack surface reduction rules run in Audit, Block, or Warn mode, and Defender for Endpoint onboarding packages can be delivered through Intune, Configuration Manager, Group Policy, or a local script.

Microsoft Defender for Identity uses sensors on Active Directory domain controllers and AD FS servers and is licensed through Microsoft 365 E5, EMS E5, or a standalone per-user subscription.

Defender for Cloud Apps uses app connectors to import SaaS activity, and Conditional Access app control session policies can block downloads, uploads, or copy actions for risky sessions in real time.

Microsoft Purview spans data loss prevention, sensitivity labels, retention and records management, eDiscovery, Insider Risk Management, Communication compliance, Audit, and Priva privacy management.

Sensitivity labels can apply encryption, content marking such as headers, footers, and watermarks, and auto-labeling; a label policy publishes labels to users while auto-labeling policies apply labels to content at rest or in transit.

DLP policy locations are Exchange, SharePoint, OneDrive, Teams chat and channel messages, Endpoint devices, and on-premises repositories scanned through Defender for Cloud Apps.

A DLP rule pairs conditions (sensitive information types, sensitivity or retention labels, document properties) with actions (block, encrypt, restrict access, audit, block with override) plus policy tips and alerting.

Retention wins over deletion, and when multiple retention settings apply to the same content the setting with the longest retention period takes precedence.

Disposition review requires a retention label with review enabled; designated reviewers must approve permanent deletion or extend retention before items are removed.

eDiscovery (Standard) provides content search, case holds, and export; eDiscovery (Premium) adds custodians, review sets, threaded conversations, near-duplicate detection, themes, and analytics.

Microsoft Purview Audit retains events for 180 days by default and up to one year with Microsoft 365 E5 or the Audit add-on; a separate add-on extends retention to ten years.

Insider Risk Management policies use templates such as data theft by departing users, data leaks, and security policy violations, combined with indicators, thresholds, and anonymization settings.