MS-102 flashcards
MS-102 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Default onmicrosoft.com domain
- Every Microsoft 365 tenant is created with a routable name.onmicrosoft.com domain that is always present, cannot be removed, and is used for initial sign-in before a custom domain is verified.
- Group-based licensing requirement
- Assigning licenses to a security or Microsoft 365 group requires Microsoft Entra ID P1, which is included in Microsoft 365 E3 and E5 but not in Business Basic or Business Standard.
- Custom domain verification
- After adding a domain in the Microsoft 365 admin center, you create a TXT or MX record at the public DNS host to prove ownership; a domain can be verified in only one tenant.
- Cloud-only SSPR licensing
- Self-service password reset for cloud-only Microsoft Entra users is included at no cost. Password writeback to on-premises Active Directory requires Microsoft Entra ID P1 and a hybrid sync agent.
- Usage report lookback windows
- Activity reports in the Microsoft 365 admin center display data for the last 7, 30, 90, or 180 days depending on the report; the Microsoft Graph usage reports API can automate collection.
- Tenant relocation
- Microsoft does not support moving an existing tenant to another geography or datacenter region. Migrating requires creating a new tenant, reverifying domains, and moving all users and content.
- Global Administrator role
- The highest-privilege Microsoft Entra role, granting full control over every administrative setting and all tenant data. Organizations typically hold it in a small set of accounts activated through Privileged Identity Management.
- Service health versus Message Center
- Service health reports current and historical incidents and advisories affecting your tenant. Message center announces upcoming feature changes, rollout timing, and required admin actions with deadlines.
- Entra ID P1 features
- Microsoft Entra ID P1 includes Conditional Access, group-based licensing, self-service password reset with on-premises writeback, hybrid Microsoft Entra join, and Application Proxy. Privileged Identity Management and Identity Protection risk policies require P2.
- Entra ID P2 features
- Microsoft Entra ID P2 adds Privileged Identity Management, Identity Protection risk detections and risk-based policies, and access reviews to the P1 feature set. Microsoft Entra ID Governance extends these with lifecycle workflows.
- Conditional Access report-only mode
- Report-only mode evaluates a Conditional Access policy and records which sign-ins it would have blocked or challenged without enforcing any control, so admins can validate scope before enabling it.
- Security defaults
- A free baseline that requires all users to register for MFA, enforces MFA for administrators, and blocks legacy authentication. Enabling a Conditional Access policy turns security defaults off, since the two controls are mutually exclusive.
- Password hash synchronization
- A hybrid identity method that synchronizes a hash of the on-premises password hash to Microsoft Entra ID so authentication occurs in the cloud. It tolerates on-premises outages and requires a sync agent.
- PIM eligible assignment
- An eligible role assignment means the user does not hold the role continuously; they activate it for a defined duration with justification, approval, or MFA, and every activation is logged.
- Access reviews
- A Microsoft Entra feature that periodically asks reviewers to confirm whether users still need group membership, application access, or directory roles. It requires Microsoft Entra ID P2 or Entra ID Governance.
- B2B guest user
- An external user invited into a tenant who authenticates with their home identity and appears with a #EXT# suffix in the user principal name. Guests receive limited directory permissions by default.
- Temporary Access Pass
- A time-limited passcode configured in the authentication methods policy that lets a user register passwordless methods or recover access when they have no other credential. It can be single-use.
- Defender XDR components
- Microsoft Defender XDR correlates signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and Defender Vulnerability Management into unified incidents in the Microsoft Defender portal.
- Advanced hunting retention
- Advanced hunting queries raw event tables such as DeviceEvents, EmailEvents, IdentityLogonEvents, and CloudAppEvents using KQL. Interactive streaming data is retained for 30 days; longer retention requires export to a SIEM.
- Safe Links
- A Defender for Office 365 policy that rewrites and checks URLs in email, Teams, and supported Office apps at time of click, blocking malicious destinations. Policies apply per recipient domain in priority order.
- Safe Attachments
- A Defender for Office 365 feature that detonates email attachments in a sandbox before delivery. Policy actions include Off, Monitor, Block, Replace, and Dynamic Delivery, applied per recipient domain.
- Defender for Identity sensor
- A lightweight agent installed on Active Directory domain controllers and AD FS servers that sends authentication and directory traffic to Microsoft Defender for Identity to detect attacks such as pass-the-hash and reconnaissance.
- Attack surface reduction rules
- Defender for Endpoint rules that block behaviors commonly abused by malware, such as Office child processes or script-launched executables. Each rule runs in Audit, Block, or Warn mode.
- Automated investigation and response
- Defender XDR playbooks that investigate alerts automatically and recommend or perform remediation. Results appear in the Action center, where admins approve or reject pending actions and can undo completed ones.
- Defender for Cloud Apps session policy
- A Conditional Access app control policy that proxies sign-ins to a cloud app so downloads, uploads, or copy actions can be blocked in real time for risky sessions. The app must be onboarded first.
- Sensitive information types
- Microsoft Purview pattern definitions that detect data such as credit card or social security numbers using primary and supporting elements plus confidence levels. They can be custom, exact data match, or trainable classifiers.
- Retention policy versus retention label
- Retention policies apply automatically to a whole location such as all Exchange mailboxes. Retention labels are applied to individual items manually or by auto-apply rules and support disposition review and records.
- Disposition review
- A records management setting on a retention label where designated reviewers decide whether items at the end of their retention period are permanently deleted or retained for longer.
- eDiscovery Premium vs Standard
- eDiscovery (Standard) provides content search, case holds, and export. eDiscovery (Premium) adds custodians, review sets, threaded conversations, near-duplicate detection, themes, and analytics for larger investigations.
- Audit log retention
- Microsoft Purview Audit retains events for 180 days by default. Microsoft 365 E5 or the Audit add-on extends this to one year, and a separate add-on extends it to ten years.
- Insider Risk Management indicators
- Configurable signals such as file downloads, exfiltration to personal cloud storage, or unusual access that feed correlated risk scores. Policies use templates, thresholds, and anonymization; licensing requires E5 compliance or the add-on.
- Auto-apply retention labels
- A retention label policy that applies labels automatically to content matching keywords, sensitive information types, or trainable classifiers, optionally running in simulation so matches can be reviewed before enforcement.