MS-102 key terms

A dedicated, isolated instance of Microsoft cloud services that an organization owns, with its own domain names, user accounts, settings and billing. Each subscription is associated with exactly one tenant, identified by an initial onmicrosoft.com domain.

A DNS domain name that you add to your tenant and prove ownership of by publishing a TXT or MX record. Users can then sign in and receive mail with addresses on that domain instead of the default onmicrosoft.com name.

The web portal at admin.microsoft.com where administrators manage users, groups, licenses, domains, billing and service settings for the tenant, and where they open support requests and review health information.

A dashboard in the admin center that shows current and historical incidents and advisories affecting Microsoft 365 services in your tenant, so administrators can track outages and plan around planned maintenance.

A feed in the admin center that publishes announcements about upcoming changes, new features and retirements affecting Microsoft 365 services, with the option to receive a weekly digest by email.

Assigning product licenses to a security group or Microsoft 365 group rather than to individual users, so members automatically receive or lose licenses when they join or leave the group.

A setting for Microsoft 365 Apps that controls how often client devices receive feature updates, for example Current Channel, Monthly Enterprise Channel or Semi-Annual Enterprise Channel.

A group object that provides a shared mailbox, calendar, SharePoint site, Planner plan and Teams team for collaboration, and that can also serve as a licensing or policy target.

Microsoft's cloud directory and identity provider. It stores users, groups, devices and applications, and issues the tokens and sign-in policies used to access Microsoft 365 and thousands of integrated apps.

A synchronization tool installed on-premises that copies user and group objects from Active Directory Domain Services to Microsoft Entra ID so that one identity works for both on-premises and cloud resources.

A policy engine that evaluates signals such as user, device, location, app and risk at sign-in, then grants access, requires extra controls like multifactor authentication, or blocks access entirely.

Requiring two or more independent proofs of identity during sign-in, typically a password plus something like an authenticator app code, a phone approval or a FIDO2 security key.

Tenant-wide settings in Microsoft Entra ID that decide which authentication methods users may register and use, such as Microsoft Authenticator, FIDO2 keys, SMS or voice calls.

A feature that lets users reset or change their own password after proving identity with registered methods, reducing helpdesk calls; administrators choose who is enabled and whether on-premises passwords write back.

A service that detects risky sign-ins and risky users using signals and machine learning, generates risk detections, and can feed risk levels into Conditional Access or let administrators remediate accounts.

A service that provides eligible, time-bound, approval-based activation of privileged directory or resource roles, along with access reviews and audit history for those role assignments.

A recurring review in which specified reviewers confirm or remove users' access to a group, application or role, producing an audit trail that supports least-privilege governance.

A group whose membership is calculated automatically from a rule that evaluates user or device attributes, such as department equals Sales, so membership updates without manual administration.

A Microsoft Entra ID record of each authentication attempt, showing who signed in, the application, status, location, device, conditional access result and any risk, retained for a limited period.

A unified platform that correlates signals and alerts from Defender for Endpoint, Office 365, Identity, Cloud Apps and Vulnerability Management into incidents, with a shared portal for investigation and automated response.

The email and collaboration protection service that scans Exchange Online, Teams and SharePoint content for malware, phishing and malicious links using policies such as Safe Links, Safe Attachments and anti-phishing.

Built-in Standard and Strict protection templates that apply a coordinated set of Exchange Online Protection and Defender settings to selected users, instead of configuring each policy separately.

A policy that sets how inbound and intra-organization mail is checked for phishing, including spoof intelligence, mailbox intelligence and impersonation protection for users, domains and trusted senders.

A Defender for Office 365 feature that rewrites and checks URLs in email and Office documents at click time, blocking or warning users about links that lead to malicious sites.

A set of rules defining who can view, release or delete quarantined messages and whether quarantine notifications are sent, applied to messages held by anti-spam, anti-phishing or anti-malware filtering.

A Defender for Office 365 tool that sends simulated phishing messages to users, then assigns automatic or targeted training to those who fall for the lure and reports on behavior over time.

An endpoint protection platform that provides antivirus, attack surface reduction, endpoint detection and response, and vulnerability management for Windows, macOS, Linux and mobile devices onboarded to the tenant.

A capability that uses alerts to automatically investigate affected entities and, depending on configuration, apply remediation actions such as quarantining files or isolating devices, with admin approval options.

A query interface in Defender XDR that uses Kusto Query Language against up to 30 days of raw event data, letting analysts search proactively for threats across email, device, identity and app tables.

A cloud access security broker that discovers shadow IT, governs SaaS app usage with session and API policies, and detects anomalous behavior in connected cloud applications.

The web portal at purview.microsoft.com that hosts compliance solutions such as sensitivity labels, data loss prevention, retention, eDiscovery, insider risk and audit for the organization's data.

A classification tag applied to files, emails, sites or containers that can enforce encryption, content marking and access restrictions, and that travels with the content wherever it is stored or shared.

The publishing container that makes sensitivity labels available to chosen users or groups, and defines settings such as the default label, mandatory labeling and help links.

Rules that detect sensitive information such as credit card or health data in Exchange, SharePoint, OneDrive, Teams and endpoint devices, then block, encrypt, warn about or audit the activity.

A label applied to items or containers that specifies how long content is kept and what happens afterwards, such as deleting it or starting a disposition review.

A container-level policy scoped to locations such as mailboxes, sites or Teams chats that retains or deletes content matching its settings, without requiring users to apply a label.

The set of Purview tools for identifying, preserving, collecting, reviewing and exporting content that may be relevant to a legal case or investigation, using searches, holds and review sets.

A record of user and administrator activity across Microsoft 365 services, searchable in Purview, with retention from 180 days under standard licensing up to 10 years with add-on retention policies.

A Purview solution that uses policies and indicators, such as downloads of sensitive files or departing-employee activity, to surface potentially risky user behavior for review by a trained case team.

A tool that scores the tenant's compliance posture against assessments such as ISO 27001 or GDPR, listing recommended improvement actions and their effect on the score.