MS-102 study plan

Map the Microsoft Defender XDR workload surface (Defender for Office 365, Endpoint, Identity, Cloud Apps) and write down which portal blade and license tier each capability belongs to

Configure anti-phishing, anti-spam, anti-malware, and anti-impersonation policies in Defender for Office 365, then compare them against the Standard and Strict preset security policies

Deploy Safe Links and Safe Attachments policies and predict, for five written email scenarios, whether the message is blocked, quarantined, or delivered

Launch an Attack Simulation Training payload and interpret the resulting simulation report metrics

Onboard at least two lab devices to Defender for Endpoint and verify sensor health and device inventory state

Configure attack surface reduction rules and device groups, then explain how device group scoping changes incident visibility

Write and run five advanced hunting KQL queries covering sign-in, email, and device tables, and save them as custom detections

Triage an XDR incident end to end: review the alert story, run automated investigation, and submit remediation actions in the Action Center

Connect a cloud app in Defender for Cloud Apps and create one access policy and one session policy

Assign built-in Microsoft 365 admin roles to a minimum-privilege scenario set and justify each assignment in one sentence

Create users individually and by bulk CSV import, then verify the result set against the source file

Create Microsoft 365 groups and security groups and apply group-based licensing, including a group with a licensing error to diagnose

Add a custom domain, publish the required DNS records, and confirm domain validation status

Review Service Health and the Message Center and translate three posted items into an action, a no-action, or a user-communication decision

Plan and execute a Microsoft 365 Apps deployment using the deployment tool, including update channel, architecture, and app exclusion choices

Configure Microsoft 365 Apps update behavior and apply a cloud policy for a specific app setting

Interpret usage and adoption reports to answer three stated business questions about app activation and mailbox activity

Configure a Defender for Office 365 policy that depends on a tenant-level setting from Domain 1 to demonstrate cross-domain dependency

Enable self-service password reset, configure authentication methods registration, and test the reset flow as an end user

Configure password protection with a custom banned password list and validate a rejected password attempt

Build Conditional Access policies for MFA enforcement, legacy authentication block, and named-location exceptions, then evaluate them with the What If tool

Configure Microsoft Entra ID Protection sign-in and user risk policies and assign risk levels to given sign-in scenarios

Compare passwordless options (Authenticator, FIDO2, Windows Hello for Business) and select the right one for three stated personas

Compare password hash synchronization, pass-through authentication, and federation, and choose an approach for two stated organizational constraints

Walk through Entra Connect installation prerequisites and identify the objects and attributes that sync by default

Configure external collaboration settings and run a B2B invitation through redemption

Create an access review and an access package and describe which scenario each one solves

Diagnose two written sign-in failure scenarios using Entra sign-in logs and sign-in error codes

Create sensitivity labels with encryption and content marking, then publish them through a label policy

Build a DLP policy with at least two rule conditions and test it against a sample document

Configure retention labels and a retention policy and distinguish which one applies to which content location

Run an eDiscovery search and a content search, and describe how the audit log supports the investigation

Re-run the three Entra Conditional Access What If evaluations from week 5 to confirm retention

Take two full-length timed practice exams and record per-domain accuracy on each attempt

Re-study only the two lowest-scoring domains, targeting the specific objectives flagged in the score reports

Rebuild from memory the highest-risk configurations: preset security policies, Conditional Access baseline, and sensitivity label flow

Produce a one-page cheat sheet of decision rules, licensing boundaries, and portal locations that you keep getting wrong

Verify readiness by re-answering every question missed across the whole plan without notes