I85PREP
⌘ K
MS-102 study materials
MS-102 study resources

MS-102 practice questions

One question at a time. Build your MS-102 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deploy and manage a Microsoft 365 tenant

A newly created Microsoft 365 tenant has no custom domain configured. Which DNS suffix does Microsoft assign to the tenant's initial domain?

  1. office.com
  2. onmicrosoft.com Correct answer.
  3. microsoftonline.com
  4. sharepoint.com

Explanation

Every new tenant receives an initial domain in the form contoso.onmicrosoft.com. That domain cannot be removed and remains available for sign-in even after custom domains are verified.

Question 2Deploy and manage a Microsoft 365 tenant

Which built-in Microsoft 365 role grants unrestricted access to every administrative setting and can be held by multiple users in the same tenant?

  1. Global Reader
  2. Billing Administrator
  3. Service Support Administrator
  4. Global Administrator Correct answer.

Explanation

Global Administrator is the highest-privilege built-in role and can perform every administrative task in every Microsoft 365 service. Because of that breadth, Microsoft recommends keeping the number of permanent Global Administrators small.

Question 3Deploy and manage a Microsoft 365 tenant

Which policy controls the number of days before a cloud-only user's password must be changed in Microsoft 365?

  1. Conditional Access policy
  2. Password expiration policy Correct answer.
  3. Sign-in frequency policy
  4. Self-service password reset policy

Explanation

The password expiration policy under Settings > Org settings > Security & privacy sets a value between 14 and 730 days, or configures passwords to never expire. It applies to cloud-only accounts whose passwords are managed by Microsoft 365.

Question 4Deploy and manage a Microsoft 365 tenant

Which DNS record type is used most commonly to prove ownership of a custom domain when you add it to Microsoft 365?

  1. MX record
  2. CNAME record
  3. SRV record
  4. TXT record Correct answer.

Explanation

Microsoft supplies a unique value that you publish as a TXT record in the domain's public DNS zone, and the service queries that record to confirm ownership. MX can occasionally be used for verification, but TXT is the standard choice.

Question 5Deploy and manage a Microsoft 365 tenant

Which object gives its members a shared mailbox, a shared calendar, and a SharePoint site from a single creation step?

  1. Mail-enabled security group
  2. Microsoft 365 group Correct answer.
  3. Security group
  4. Distribution list

Explanation

A Microsoft 365 group provisions a shared mailbox, calendar, SharePoint site, and other connected resources for its members. Other group types provide only mail distribution or permission scoping.

Question 6Deploy and manage a Microsoft 365 tenant

Which area of the Microsoft 365 admin center announces upcoming service changes and new features that may require administrator action?

  1. Usage reports
  2. Message center Correct answer.
  3. Service health
  4. Adoption score

Explanation

Message center posts are the official announcements of upcoming changes, and each post lists a timeline, affected services, and any action required. Service health reports current incidents and advisories instead of planned feature changes.

Question 7Deploy and manage a Microsoft 365 tenant

After you delete a user account in the Microsoft 365 admin center, how long is it available to restore?

  1. 7 days
  2. 60 days
  3. 14 days
  4. 30 days Correct answer.

Explanation

Deleted cloud user accounts move to the deleted users list and can be restored for 30 days, after which they are permanently removed. Restoring a user also requires reassigning any licenses that were removed during deletion.

Question 8Deploy and manage a Microsoft 365 tenant

Which capability lets users unlock their account or set a new password by proving their identity with a registered method instead of contacting the help desk?

  1. Password writeback
  2. Password hash synchronization
  3. Seamless single sign-on
  4. Self-service password reset Correct answer.

Explanation

Self-service password reset lets users confirm their identity with registered verification methods and then set a new password themselves. The other features relate to keeping on-premises and cloud credentials aligned.

Question 9Deploy and manage a Microsoft 365 tenant

You have verified a custom domain and want all newly created users to receive addresses in that domain. What should you do?

  1. Set it as the default domain Correct answer.
  2. Re-run the domain verification wizard
  3. Add an autodiscover CNAME record
  4. Assign the domain to every user

Explanation

New accounts receive the tenant's default domain unless an administrator types a different one. Setting the verified custom domain as the default in Settings > Domains changes the value pre-populated for new accounts, while existing accounts keep their current addresses.

Question 10Deploy and manage a Microsoft 365 tenant

Contoso wants only a small pilot group to receive new Microsoft 365 features before the rest of the organization. Which configuration should you use?

  1. Targeted release for selected users Correct answer.
  2. Standard release for the entire organization
  3. Targeted release for the entire organization
  4. Standard release for selected users

Explanation

Targeted release can be enabled for everyone or for a chosen set of users, and choosing selected users lets a pilot group validate features first. Standard release users receive the change only after targeted release has validated it.

Question 11Deploy and manage a Microsoft 365 tenant

You plan to create many accounts with the bulk add users wizard. Which column in the CSV template holds the sign-in name for each user?

  1. Display name
  2. Office phone
  3. Job title
  4. User name Correct answer.

Explanation

The User name column must contain the complete sign-in address, including the domain, and each value must be unique in the tenant. The other columns populate optional directory attributes.

Question 12Deploy and manage a Microsoft 365 tenant

A licensing error states that a usage location is missing for a user. Which action resolves the error?

  1. Reset the user's password
  2. Assign an additional license
  3. Set the usage location Correct answer.
  4. Enable the user for Teams

Explanation

Licenses are tied to a country or region for tax and service-availability reasons, so a usage location must be present on the account before a license can be assigned. The value can be supplied when the account is created or added later in the user's properties.

Question 13Deploy and manage a Microsoft 365 tenant

A technician must be able to reset passwords for non-administrator users and open support requests, but must not change tenant-wide settings. Which role should you assign?

  1. SharePoint Administrator
  2. Billing Administrator
  3. Global Administrator
  4. Helpdesk Administrator Correct answer.

Explanation

Helpdesk Administrator can reset passwords for non-administrator accounts, manage service requests, and monitor service health without tenant-wide configuration rights. This satisfies the requirement with the least privilege.

Question 14Deploy and manage a Microsoft 365 tenant

Which built-in role lets an auditor review settings and reports in every admin center while preventing any changes?

  1. Global Administrator
  2. Service Support Administrator
  3. Reports Reader
  4. Global Reader Correct answer.

Explanation

Global Reader provides read-only access to administrative data and settings across Microsoft 365 services. It is intended for reviewers who need visibility without write access.

Question 15Deploy and manage a Microsoft 365 tenant

Which prerequisite must be satisfied before a custom domain can be removed from a tenant?

  1. DNS records are deleted at the registrar
  2. The domain has been verified for at least 30 days
  3. The tenant has two custom domains
  4. All addresses in the domain are removed Correct answer.

Explanation

A domain cannot be deleted while any user, group, or mailbox still uses it, and it must not be the tenant's default domain. Once no object references the domain, it can be removed and later verified in another tenant.

Question 16Deploy and manage a Microsoft 365 tenant

Your organization wants to prevent users from buying their own Power BI or Visio licenses. Which action blocks this?

  1. Remove the Power BI service from every licensed user
  2. Change the tenant release preference to Standard release
  3. Block sign-in for all users with a conditional access policy
  4. Disable self-service purchase in the admin center Correct answer.

Explanation

Self-service purchase settings in the Microsoft 365 admin center control whether users can buy individual licenses for products such as Power BI, Power Apps, Visio, and Project. Turning the setting off forces all purchases to go through administrators.

Question 17Deploy and manage a Microsoft 365 tenant

You want administrators to receive email when Microsoft reports a service incident affecting Exchange Online. Which feature should you configure?

  1. Message center email preferences
  2. Alert policies in the Security portal
  3. Service health notifications Correct answer.
  4. Usage report subscriptions

Explanation

Service health lets you subscribe to email notifications for incidents and advisories and choose the services and recipients involved. Message center preferences cover announcements of upcoming changes rather than live incidents.

Question 18Deploy and manage a Microsoft 365 tenant

Which Microsoft 365 admin center area holds the organization's name, address, phone number, and technical contact details?

  1. The Domains section of the admin center
  2. The Billing section of the admin center
  3. The Organization profile section Correct answer.
  4. The Service health section of the admin center

Explanation

Organization profile stores the company name, address, phone, technical contact, and preferred language that Microsoft uses for communications and that can appear in user-facing pages. The other areas hold unrelated settings.

Question 19Deploy and manage a Microsoft 365 tenant

A user leaves the company, and their mailbox must stay available to a colleague while the license is freed for reuse. What should you do?

  1. Delete the account and reassign the license to a colleague
  2. Remove the Exchange Online license from the account
  3. Convert the mailbox to a shared mailbox Correct answer.
  4. Export the mailbox content to a PST file for the colleague

Explanation

A shared mailbox lets a delegate open the mailbox while the account no longer consumes a license, as long as the mailbox stays under the shared mailbox size limit. Removing the license without converting first causes the mailbox data to be deleted after the retention period.

Question 20Deploy and manage a Microsoft 365 tenant

Which license is required for groups that use dynamic membership rules in Microsoft Entra ID?

  1. Microsoft Entra ID P1 Correct answer.
  2. Microsoft 365 Business Standard
  3. Microsoft 365 Business Basic
  4. Exchange Online Plan 1

Explanation

Dynamic membership rules require Microsoft Entra ID P1 or higher for every member of the group. Without that license, only assigned membership is available.

Question 21Deploy and manage a Microsoft 365 tenant

Which Microsoft 365 feature scores an organization on how it uses Microsoft 365 across people and technology experiences?

  1. Message center
  2. Adoption score Correct answer.
  3. Usage reports
  4. Service health

Explanation

Adoption score in the Microsoft 365 admin center measures how the organization is adopting Microsoft 365 through people and technology experience insights. Usage reports show per-workload activity but do not produce an overall adoption score.

Question 22Deploy and manage a Microsoft 365 tenant

Which built-in role gives users read-only access to Message center communications while limiting access to other administrative data?

  1. Reports Reader
  2. Message Center Reader Correct answer.
  3. Global Reader
  4. Service Support Administrator

Explanation

Message Center Reader allows users to read message center posts and receive the related email notifications without broader administrative access. It suits people who track upcoming changes on behalf of the team.

Question 23Deploy and manage a Microsoft 365 tenant

Which setting controls whether external guests can be added to Microsoft 365 groups across the whole tenant?

  1. The tenant's password expiration policy
  2. Guest access for Microsoft 365 Groups Correct answer.
  3. The tenant's release preference settings
  4. The organization's default domain settings

Explanation

Guest access for Microsoft 365 Groups, found under Settings > Org settings > Services, allows or blocks adding guests to groups tenant-wide. Individual groups can then be restricted further by their owners.

Question 24Deploy and manage a Microsoft 365 tenant

A domain has two MX records: one with preference 10 pointing to Exchange Online and one with preference 20 pointing to a third-party filter. Which record is contacted first by sending servers?

  1. Neither record; mail is rejected
  2. Both are used equally
  3. The record with preference 20
  4. The record with preference 10 Correct answer.

Explanation

MX preference values are evaluated in ascending order, so the lowest number is attempted first and higher numbers act as failover targets. Mail is therefore delivered to the host named in the preference 10 record while it is reachable.

Question 25Deploy and manage a Microsoft 365 tenant

You must move a verified custom domain from one Microsoft 365 tenant to another. What must you do?

  1. Remove the domain from the old tenant first Correct answer.
  2. Contact support to migrate the domain automatically
  3. Add the domain to the new tenant while it remains in the old tenant
  4. Change the domain's nameservers to the new tenant

Explanation

A domain can be associated with only one tenant at a time, so it must be deleted from the current tenant after all users, groups, and services stop using it. It can then be added and verified in the destination tenant.

Question 26Deploy and manage a Microsoft 365 tenant

A new tenant uses contoso.onmicrosoft.com. After contoso.com is verified and set as the default domain, what happens to contoso.onmicrosoft.com?

  1. It is renamed to match the verified custom domain.
  2. It remains present and can still be used for sign-in addresses. Correct answer.
  3. It is removed automatically when the default domain changes.
  4. It becomes read-only for administrators but not for users.

Explanation

The initial onmicrosoft.com domain is permanent for the tenant and cannot be removed. Changing the default domain only affects the domain suggested for new user principal names; existing sign-in addresses on the initial domain remain valid.

Question 27Deploy and manage a Microsoft 365 tenant

When you add a custom domain in the Microsoft 365 admin center, which DNS record type does Microsoft typically ask you to create with a unique value to confirm ownership?

  1. TXT record Correct answer.
  2. MX record
  3. SRV record
  4. CNAME record

Explanation

Domain ownership is usually verified with a TXT record containing a unique value generated by Microsoft. The value proves control of the DNS zone because only the domain owner can publish it.

Question 28Deploy and manage a Microsoft 365 tenant

A user must manage subscriptions and payment methods but must not be able to reset passwords or modify licenses. Which built-in Microsoft Entra role should be assigned?

  1. Billing Administrator Correct answer.
  2. Helpdesk Administrator
  3. User Administrator
  4. Global Administrator

Explanation

Billing Administrator can manage purchases, subscriptions, and payment information without user administration rights. Global, User, and Helpdesk administrators have user or tenant management permissions that exceed the requirement.

Question 29Deploy and manage a Microsoft 365 tenant

What is the main effect of enabling Security defaults in a tenant that does not use Conditional Access?

  1. It disables self-service password reset for all administrator accounts.
  2. It requires MFA registration and blocks legacy authentication. Correct answer.
  3. It applies only to guest users and controls external sharing settings.
  4. It forces every user in the tenant to change passwords every 30 days.

Explanation

Security defaults provide a baseline that requires users to register for multifactor authentication and blocks legacy authentication protocols. They are intended for tenants that are not using Conditional Access.

Question 30Deploy and manage a Microsoft 365 tenant

Which cmdlet opens an interactive connection to Microsoft Graph PowerShell?

  1. Connect-MsolService
  2. Connect-MgGraph Correct answer.
  3. Connect-AzAccount
  4. Connect-ExchangeOnline

Explanation

Connect-MgGraph authenticates the current session to Microsoft Graph and selects the required scopes. The other cmdlets connect to Exchange Online, the legacy MSOnline service, or Azure Resource Manager.

Question 31Deploy and manage a Microsoft 365 tenant

Which license is the minimum required for users to be targeted by Microsoft Entra Conditional Access policies?

  1. Microsoft 365 Business Basic
  2. Microsoft Entra ID Free
  3. Microsoft Entra ID P1 Correct answer.
  4. Microsoft Entra ID P2

Explanation

Conditional Access is included in Microsoft Entra ID P1 and higher. P2 includes P1 capabilities, but P1 is the minimum SKU that provides the feature.

Question 32Deploy and manage a Microsoft 365 tenant

You remove a Microsoft 365 E3 license from a user but do not delete the account. What happens to the user's mailbox data?

  1. The mailbox is deleted immediately and cannot be recovered by an administrator.
  2. The mailbox remains fully active for the user but becomes read-only for everyone.
  3. The mailbox is converted automatically to a shared mailbox without a license.
  4. The mailbox becomes inactive and data is retained for 30 days by default. Correct answer.

Explanation

When a license is removed, the mailbox enters an inactive state and its data is retained for 30 days by default. Reassigning a license during that period restores access; otherwise the data is permanently removed.

Question 33Deploy and manage a Microsoft 365 tenant

Where do you customize the sign-in page logo and background that users see when signing in to Microsoft 365?

  1. Microsoft 365 admin center > Org settings > Organization profile
  2. Microsoft Entra admin center > Company branding Correct answer.
  3. Exchange admin center > Organization > Sharing
  4. SharePoint admin center > Branding

Explanation

Company branding in the Microsoft Entra admin center controls the visual elements of the Microsoft sign-in experience. Organization profile settings in the Microsoft 365 admin center hold contact details, not sign-in page branding.

Question 34Deploy and manage a Microsoft 365 tenant

You add a domain and create the required DNS records, but its status in the Microsoft 365 admin center remains Pending. What does this status indicate?

  1. Microsoft has not yet verified the required DNS records. Correct answer.
  2. The domain is ready to route email for the tenant.
  3. The domain is blocked because it exists in another tenant.
  4. The domain is verified but has no assigned users.

Explanation

Pending means Microsoft has not successfully validated the DNS records needed to prove ownership or configure services. After the records propagate, verification can complete and the domain status changes.

Question 35Deploy and manage a Microsoft 365 tenant

Which built-in role should be assigned to an administrator who only needs to create and manage Microsoft 365 groups and their membership?

  1. Global Administrator
  2. User Administrator
  3. SharePoint Administrator
  4. Groups Administrator Correct answer.

Explanation

Groups Administrator can create and manage groups and their membership without broader tenant control. The other roles either manage users, the whole tenant, or SharePoint specifically.

Question 36Deploy and manage a Microsoft 365 tenant

You want to stop users from downloading the Microsoft 365 Apps installer from the Microsoft 365 portal while keeping their licenses. Which setting do you change?

  1. Reports > Usage > Microsoft 365 Apps > configure installer download restrictions.
  2. Org settings > Services > Microsoft 365 installation > clear the download option. Correct answer.
  3. Settings > Domains > change the default domain used for new user accounts.
  4. Billing > Licenses > remove the Office app license from every affected user.

Explanation

The Microsoft 365 installation setting controls whether users can install Office apps on their own from the portal. Clearing the download option blocks self-service installation without removing the users' licenses.

Question 37Deploy and manage a Microsoft 365 tenant

Which built-in role can manage custom domain names for a tenant without granting general user administration?

  1. Domain Name Administrator Correct answer.
  2. License Administrator
  3. User Administrator
  4. Global Administrator

Explanation

Domain Name Administrator is scoped to reading and managing domain names and related settings. It does not grant the broader user, license, or tenant permissions of the other roles.

Question 38Deploy and manage a Microsoft 365 tenant

Which DNS record lets Outlook clients automatically locate Exchange Online mailbox settings for a custom domain?

  1. An MX record that points to the Exchange Online mail gateway
  2. An SRV record that identifies the autodiscover service port
  3. A TXT record that contains the domain's SPF policy
  4. A CNAME record for autodiscover Correct answer.

Explanation

Outlook uses the autodiscover hostname to find mailbox configuration; for Exchange Online this is configured with a CNAME to autodiscover.outlook.com. MX records route mail, TXT records publish policies, and SRV records locate other services.

Question 39Deploy and manage a Microsoft 365 tenant

To enable DKIM signing for a custom domain in Exchange Online, which DNS records does Microsoft ask you to publish?

  1. One SRV record that points to the DKIM signing service for the domain
  2. One TXT record that contains the complete DKIM public key for the domain
  3. Two CNAME records for selector1 and selector2 Correct answer.
  4. Two MX records with different priority values for DKIM signing

Explanation

Exchange Online DKIM uses two selectors, selector1 and selector2, each published as a CNAME that points to Microsoft's DKIM keys. Publishing both allows key rotation without interrupting signing.

Question 40Deploy and manage a Microsoft 365 tenant

Which Microsoft 365 feature enforces a prefix or suffix and a list of blocked words for newly created groups?

  1. Conditional Access policy
  2. Naming policy Correct answer.
  3. Guest access policy
  4. Expiration policy

Explanation

A group naming policy applies a consistent prefix or suffix and can block specific words in group names. It helps users recognize group purpose and prevents inappropriate names.

Question 41Deploy and manage a Microsoft 365 tenant

Which group setting automatically removes groups that have not been renewed within a specified period?

  1. Naming policy
  2. Membership policy
  3. Sharing policy
  4. Expiration policy Correct answer.

Explanation

The expiration policy sets a lifetime for groups and deletes groups that owners do not renew. It reduces clutter from inactive groups.

Question 42Deploy and manage a Microsoft 365 tenant

Which PowerShell module is used to manage Exchange Online recipients and mailboxes?

  1. ExchangeOnlineManagement Correct answer.
  2. AzureAD
  3. Microsoft.Graph
  4. Microsoft.Online.SharePoint.PowerShell

Explanation

The ExchangeOnlineManagement module provides the Exchange Online PowerShell cmdlets for recipients, mailboxes, and transport settings. Microsoft Graph and SharePoint modules serve different workloads.

Question 43Deploy and manage a Microsoft 365 tenant

Which Microsoft Graph PowerShell cmdlet assigns a license to a user?

  1. New-MgUser
  2. Set-MgUserLicense Correct answer.
  3. Update-MgUser
  4. Set-MgUser

Explanation

Set-MgUserLicense adds or removes license assignments for a specified user. New-MgUser creates the account, while Update-MgUser and Set-MgUser modify user properties rather than license details.

Question 44Deploy and manage a Microsoft 365 tenant

You want only members of a specific security group to be able to create Microsoft 365 groups. Which setting do you configure?

  1. The group expiration policy that controls how long groups remain active
  2. The group naming policy that controls prefixes and blocked words
  3. The group creation policy in Microsoft Entra ID Correct answer.
  4. The external guest access setting that controls invitations to groups

Explanation

The group creation policy can be restricted to a selected security group, so only its members can create groups. This setting is configured in Microsoft Entra ID group settings.

Question 45Deploy and manage a Microsoft 365 tenant

Which Microsoft 365 admin center area shows active user counts for services such as Exchange Online, SharePoint, and Teams?

  1. Users > Active users
  2. Settings > Org settings
  3. Reports > Usage Correct answer.
  4. Health > Service health

Explanation

The Usage reports in the Microsoft 365 admin center provide activity and adoption metrics across workloads. Service health shows incidents, Active users lists accounts, and Org settings configures tenant options.

Question 46Deploy and manage a Microsoft 365 tenant

Which condition must be met before a Microsoft 365 tenant can be deleted?

  1. Security defaults must be enabled for every administrator account in the tenant.
  2. Every user account must keep an active license assigned until the tenant is removed.
  3. All subscriptions are cancelled or expired, and all users except the deleting account are removed. Correct answer.
  4. At least one verified custom domain must remain assigned to the tenant until deletion completes.

Explanation

Tenant deletion requires no active subscriptions and removal of users, groups, and other objects that block deletion, while the account performing the deletion remains. Custom domains must also be removed, and licensing or security defaults are not prerequisites.

Question 47Deploy and manage a Microsoft 365 tenant

Which Microsoft Entra Connect sign-in option validates passwords against on-premises AD DS without requiring AD FS and without storing password hashes in Microsoft Entra ID?

  1. Password hash synchronization
  2. Seamless single sign-on
  3. Pass-through authentication Correct answer.
  4. Federation with AD FS

Explanation

Pass-through authentication uses a lightweight on-premises agent to validate credentials directly against AD DS, so password hashes are not synchronized to Entra ID. Federation also validates on-premises but requires AD FS.

Question 48Deploy and manage a Microsoft 365 tenant

Which license is required for self-service password reset with on-premises password writeback?

  1. Microsoft 365 Business Basic
  2. Exchange Online Plan 2
  3. Microsoft Entra ID P1 Correct answer.
  4. Microsoft Entra ID Free

Explanation

Password writeback is a Microsoft Entra ID P1 feature that lets cloud password changes flow back to on-premises AD DS. Free and Business Basic do not include the writeback capability.

Question 49Deploy and manage a Microsoft 365 tenant

Which feature lets you scope an administrator's permissions to a subset of users, groups, or devices?

  1. Administrative units Correct answer.
  2. Dynamic groups
  3. Role assignments
  4. Security groups

Explanation

Administrative units are containers that restrict role assignments to objects inside the unit. They allow delegated administration without granting tenant-wide control.

Question 50Deploy and manage a Microsoft 365 tenant

What is the default retention period for Microsoft 365 audit log records in a tenant with standard auditing enabled?

  1. 90 days
  2. 30 days
  3. 365 days
  4. 180 days Correct answer.

Explanation

Standard Microsoft Purview Audit retains audit records for 180 days by default. Longer retention requires add-on capabilities or configured retention policies.