Nothing here is narrative — every section below is a table built for a five-minute scan. For the reasoning behind any of these facts, the MS-102 study guide covers it; this page is just the reference.
The domain weights, terminology, and reference links here come straight from Microsoft's official MS-102 exam page. We re-check them against our audited 500-question MS-102 practice bank so nothing drifts out of date.
Exam retirement notice
Microsoft's official MS-102 exam page states this exam — and the Microsoft 365 Certified: Administrator Expert certification it grants — retires in October 2026 at 11:59 PM Central Standard Time. After that date the exam can no longer be earned or renewed. If your timeline runs past October, confirm the exact cutoff and any successor path on Microsoft's official exam page before you schedule.
MS-102 Quick Facts
| Exam code | MS-102 |
| Credential | Microsoft 365 Certified: Administrator Expert |
| Level | Expert |
| Retirement | October 2026, 11:59 PM CST — cannot be earned or renewed after |
| Questions | 40–60 |
| Duration | 100 minutes exam time (120-minute seat time) |
| Passing score | 700 / 1000 |
| Price | $165 USD (typical Associate/Expert exam price) |
| Prerequisites | No prerequisite to sit MS-102 itself, but the full Expert certification also requires at least one of: Endpoint Administrator Associate, Teams Administrator Associate, Identity and Access Administrator Associate, or Information Security Administrator Associate |
| Skills measured as of | April 28, 2026 (per Microsoft's official study guide, checked August 4, 2026) |
Source: Microsoft's official MS-102 exam page and Administrator Expert certification page, checked August 4, 2026.
Domain Weight & Key Task Map
| Domain | Weight | Key tasks to know cold |
|---|---|---|
| Deploy and manage a Microsoft 365 tenant | 25–30% | Tenant/domain setup, org settings, Service Health, group-based licensing, roles & PIM, administrative units |
| Implement and manage Entra identity and access | 25–30% | Directory sync (Entra Connect Sync / Cloud Sync), authentication methods, SSPR, Identity Protection, Conditional Access, MFA |
| Manage security and threats via Defender XDR | 30–35% | Secure Score, incident/alert response, Defender for Office 365, Defender for Endpoint, Defender for Cloud Apps |
| Manage compliance via Microsoft Purview | 10–15% | Sensitivity & retention labels, DLP policies across workloads (including Copilot), eDiscovery tiers |
Weightings per Microsoft's MS-102 study guide, "Skills measured as of April 28, 2026."
Halfway through the sheet
Test What You Just Reviewed
40 free MS-102 practice questions, no credit card required.
Start Free Practice →Tenant & Licensing Quick Reference
License assignment methods
| Method | Best for |
|---|---|
| Direct assignment | Small headcounts or one-off exceptions — manual, doesn't scale |
| Group-based licensing | Users get and lose licenses automatically as group membership changes — the exam's default answer for "automatic" scenarios |
| PowerShell bulk assignment | One-time bulk operations or CSV-driven imports outside normal group flow |
Roles & delegation
- Microsoft Entra roles: govern identity and directory-wide administration.
- Administrative units: scope a role (e.g., Helpdesk Administrator) to a subset of users, groups, or devices instead of the whole tenant.
- Privileged Identity Management (PIM): makes a role assignment time-bound and just-in-time instead of standing/permanent — the usual answer for "minimize standing privileged access."
Entra ID Sign-In Method Reference
| Password hash sync (PHS) | Pass-through auth (PTA) | Federation (AD FS) | |
|---|---|---|---|
| Where auth happens | In the cloud | Cloud, validated against on-prem AD via agent | On-premises |
| Extra on-prem servers | None beyond Entra Connect | 1+ authentication agent servers | 2+ AD FS servers, 2+ WAP proxy servers |
| TLS certificate needed | No | No | Yes |
| Survives on-prem outage | Yes — cloud validates independently | No — needs live on-prem path | No — needs live on-prem path |
Microsoft's own recommendation: enable PHS alongside PTA or Federation as a backup — organizations with PHS already on recovered from on-prem outages in hours; those without it took weeks. Source: Choose the right Entra hybrid authentication method.
Defender XDR Quick-Pick Table
| Product | Protects | Key feature to remember |
|---|---|---|
| Defender for Office 365 | Email & collaboration | Safe Links = time-of-click URL rescan; Safe Attachments = sandbox detonation before delivery |
| Defender for Endpoint | Devices | Onboarding, endpoint settings, Vulnerability Management dashboard |
| Defender for Cloud Apps | SaaS/cloud app usage | App connectors, Cloud App Discovery, activity policies and alerts |
| Microsoft Secure Score | Overall posture | A single measurement plus prioritized improvement actions — not a product you configure per se |
All four surface through Microsoft Defender XDR's unified incident and alert view, including advanced hunting and Defender Threat Intelligence.
Purview Compliance Reference
Sensitivity labels vs. retention labels
| Sensitivity labels | Retention labels | |
|---|---|---|
| Controls | Classification and protection (encryption, watermarks, access restrictions) | How long content is kept and what happens after |
| Can both apply to the same item? | Yes — they answer different questions and stack | |
eDiscovery tiers
| Tier | Adds on top of the previous tier |
|---|---|
| Content Search | Keyword search, export results, role-based permissions — the baseline |
| eDiscovery (Standard) | Case management, assigning eDiscovery managers, legal hold on content locations |
| eDiscovery (Premium) | Custodian management, legal hold notifications, review sets, analytics, predictive coding |
PowerShell & Portal Quick Reference
| Task | Cmdlet |
|---|---|
| Connect to the tenant | Connect-MgGraph -Scopes ... |
| Check a group's assigned licenses | Get-MgGroup -Property AssignedLicenses |
| Find unlicensed users | Get-MgUser -Filter 'assignedLicenses/$count eq 0' |
| Reprocess a user's group-based licenses | Invoke-MgLicenseUser |
| View tenant SKUs and consumption | Get-MgSubscribedSku |
| View a specific user's license detail | Get-EntraUserLicenseDetail -UserId ... |
| Assign or remove a user's license | Set-EntraUserLicense |
Microsoft Graph PowerShell (Mg prefix) is the general-purpose SDK; Microsoft Entra PowerShell (Entra prefix) builds on it with more human-readable identity cmdlets — both replace the retired AzureAD and MSOnline modules. MS-102 objectives explicitly call out bulk user management via "Microsoft Graph PowerShell and Microsoft Entra PowerShell."
MS-102 Exam-Day Traps
- • PHS doesn't auto-failover from PTA. If PTA agents go down, Entra Connect must be manually switched to PHS — there is no automatic fallback, even if PHS is enabled alongside PTA.
- • Service Health is in the M365 admin center, not Azure. Azure Service Health tracks Azure resources; Microsoft 365 workload incidents (Teams, Exchange, etc.) live in the Microsoft 365 admin center's Service Health dashboard.
- • Group-based licensing needs an Entra ID P1 license per dynamic-group member if the group uses dynamic membership rules — a detail that trips up cost-focused scenario questions.
- • Safe Links protects at time-of-click, not delivery. A URL that was clean when the email arrived can still be blocked later if it turns malicious — Safe Attachments, by contrast, only inspects at delivery.
- • eDiscovery Standard gives you legal hold; only Premium gives you custodian notifications. Placing a hold on a content location works in Standard — communicating with the people (custodians) behind that content requires Premium.
- • Sensitivity and retention labels are not mutually exclusive. A scenario asking to both classify content AND control its lifecycle needs both label types applied together, not a choice between them.
- • This exam retires October 2026. If a scenario or dated study plan runs past that, verify current status on Microsoft's exam page before committing to a study timeline.
Acronym Quick List
PHS — Password Hash Synchronization
PTA — Pass-Through Authentication
AD FS — Active Directory Federation Services
SSPR — Self-Service Password Reset
PIM — Privileged Identity Management
MFA — Multi-Factor Authentication
DLP — Data Loss Prevention
XDR — Extended Detection and Response
SSO — Single Sign-On
WAP — Web Application Proxy
PIM — Privileged Identity Management
IdFix — Directory synchronization error-remediation tool
Drill what tripped you up
MSCertQuiz sells full MS-102 practice-exam access — this cheat sheet was written by the same team that maintains that question bank, drawn from the sign-in method comparisons, Defender product distinctions, and Purview tier questions candidates ask about most. Start with free questions to see the format before you buy.
MS-102 FAQ Quick Answers
When does the MS-102 exam retire?
Microsoft's official exam page states MS-102 and the Microsoft 365 Certified: Administrator Expert certification retire in October 2026 at 11:59 PM Central Standard Time. After that date, the exam can no longer be scheduled, earned, or renewed.
What is the difference between Password Hash Sync and Pass-Through Authentication?
Password Hash Sync validates credentials entirely in the cloud using a synchronized hash, so it survives an on-premises outage. Pass-Through Authentication validates the password against on-premises Active Directory in real time via an agent, so it requires a live connection to on-premises infrastructure.
Does eDiscovery Standard include custodian management?
No. Custodian management, legal hold notifications, review sets, and predictive coding are all Premium-only features. eDiscovery Standard covers case management and placing content locations on legal hold, building on Content Search's baseline of search and export.
What is the MS-102 exam duration and passing score?
100 minutes of exam time (120-minute total seat time including instructions and breaks), with 40–60 questions and a passing score of 700 out of 1000, per Microsoft's official exam page. The exam costs $165 USD in most regions.
Which Defender product handles time-of-click URL protection?
Defender for Office 365's Safe Links feature. It rescans a URL at the moment a user clicks it, not just when the email arrives, catching links that were clean at delivery but turned malicious afterward.
Do I need a prerequisite certification to sit the MS-102 exam?
No prerequisite is required to take the MS-102 exam itself. However, to earn the full Microsoft 365 Certified: Administrator Expert certification, you also need at least one active associate-level certification — Endpoint Administrator, Teams Administrator, Identity and Access Administrator, or Information Security Administrator.
Can sensitivity labels and retention labels apply to the same document?
Yes. Sensitivity labels control classification and protection like encryption and access restrictions, while retention labels control how long content is kept. They answer different questions and are commonly applied to the same content together.
Continue Your MS-102 Prep
MS-102 Exam Topics Study Guide
Full domain breakdown, 8-week study plan, and exam-day tips.
MS-102 Practice Exam Questions
100+ scenario questions with detailed explanations.
MS-102 Certification Path
Prerequisites, cost breakdown, and career benefits.
All Microsoft Certifications
Browse every certification MSCertQuiz covers by track.