Microsoft 365 Administrator Expert Practice Test (MS-102)

A file policy is designed to inspect files at rest in Microsoft 365, evaluate attributes such as sensitivity label and sharing level, and apply governance actions. By adding a condition that the file's label equals "Highly Confidential" and that sharing level is "Anyone with the link", the policy can trigger an alert and enforce a governance action. The "Put in quarantine" action moves the offending file to a secure admin-controlled location, ensuring immediate protection. Activity policies can only alert on events; they cannot quarantine files. Session policies provide real-time session controls but cannot retroactively quarantine a stored file. Anomaly detection policies are pre-defined heuristics that cannot target specific labels or guarantee quarantine.

Files uploaded to a Teams channel are stored in the underlying SharePoint site, but the act of sharing the file occurs in Microsoft Teams. To block the file before guests can access it and to restrict the stored copy, the DLP policy must target both Microsoft Teams (to evaluate the share action and block it in real time) and SharePoint Online (to continue to restrict access to the underlying file). OneDrive for Business is not required because channel files are not stored there.

The most direct way to create continuous, in-portal alerting from an advanced hunting query is to save it as a custom detection rule. Custom detections let you set a schedule (for example, hourly) and define the alert title, severity, and impacted entities. Each time the scheduled query returns results, Microsoft 365 Defender raises an alert that is automatically correlated into the relevant incident timeline. Bookmarks only save individual query results for later review and do not generate alerts. Exporting the query to Microsoft Sentinel would require additional configuration in a different product and is outside the scope of creating an alert entirely inside Microsoft 365 Defender. Safe Links policies protect against malicious URLs and have no effect on PowerShell telemetry.

Only an auto-apply retention label can detect specific keywords and automatically assign a label without user action. A retention label lets you set a disposition action of permanent deletion after a specified period and can start the retention period from the item's last modified date, ensuring it resets on every edit. A standard retention policy cannot filter by keyword, a manually applied label would rely on users, and a sensitivity label controls protection settings rather than lifecycle management. Therefore, creating and publishing an auto-apply retention label that searches for the word "Confidential" and deletes content seven years after last modification is the correct solution.

To prove that you own a custom domain, Microsoft 365 looks for a unique verification record in public DNS. The recommended and least disruptive method is to create a TXT record that contains the verification token provided in the Microsoft 365 admin center. Because TXT records are used only for informational purposes, adding one does not affect MX routing or any other service.

Creating or modifying an MX record would immediately direct inbound email to Microsoft 365, interrupting the current on-premises mail flow. CNAME and SRV records are required later for service configuration but do not satisfy ownership verification. Therefore, adding the prescribed TXT record is the appropriate step.

The Microsoft 365 admin center lets you add verified custom DNS domains at any time and designate one of them as the default domain for new user accounts and groups. By contrast, you cannot change the country/region that was chosen during tenant creation, and the default *.onmicrosoft.com domain assigned at sign-up is fixed and cannot be renamed. Moving data residency from one Microsoft 365 geography or datacenter region to another is only possible through specialized Microsoft programs and requires submitting a request to Microsoft or working with support. Therefore, the only task that can be completed entirely through self-service in the admin center is adding a custom domain and setting it as the default.

Duplicate errors appear when two or more directory objects share a value that must be unique in Microsoft Entra ID-for example, the same userPrincipalName, mail, or proxyAddresses entry. During synchronization, Microsoft Entra ID places the conflicting attribute value in quarantine, leaving the object without that value. Because the missing attribute can prevent users from signing in or receiving mail, duplicates should be remediated before the first sync. Blank, Format, and MailMatch errors usually allow the object and its attributes to synchronize, so they can be addressed later (though Microsoft still recommends fixing them as soon as possible).

In a User risk policy, the remedial action "Require password change" prompts the affected user to perform a secure password reset (protected by MFA) before access is granted. This allows the user to continue the sign-in flow after successful password change, rather than blocking the sign-in completely. The "Block access" option would stop the sign-in with no opportunity for remediation, while "Require multifactor authentication" and settings such as sign-in frequency are not available remediation actions in a User risk policy.

Dynamic group rules can reference the assignedPlans collection, which lists every service plan enabled for the user. A rule that checks for the specific Microsoft Teams service plan GUID and verifies that the plan's capabilityStatus is Enabled will include only users who actively have Teams. Adding a condition that the userType is not Guest prevents guest accounts from being added. The correct rule therefore combines the two conditions with -and. Rules that reference non-existent properties such as user.license, that look for capabilityStatus Disabled, or that use -all rather than -any will fail to capture the required set of users.

Only users who hold either the Global admin or Service support admin role can create or edit Service health email notification rules. The Service support admin role is the least-privileged of the two because it is limited to viewing service-related information and opening support requests, whereas Global admin grants full tenant-wide control. Roles such as Helpdesk admin or Message center reader can view some information but cannot configure notification rules.

The alert policy Activity determines which event in Microsoft 365 generates the alert. The event that records ZAP removing a malicious message after delivery is "Malware detected after delivery in email". This activity is logged whenever ZAP re-scans a previously delivered message, identifies malware, and moves the message to quarantine. Selecting other activities would monitor different events: phishing ZAP actions, initial malware detection at time-of-delivery, or user-reported messages, none of which satisfy the requirement to alert only when ZAP removes malware post-delivery.

SSPR must be able to write the new password back to the on-premises AD DS. This capability is disabled unless the Password writeback optional feature is selected in the Microsoft Entra Connect configuration. Enabling this feature registers the connector with the Microsoft Entra service bus and allows password change requests that originate in the cloud to be applied to AD DS. Assigning Entra roles, changing the authentication method, or installing health agents does not activate password writeback, so none of those actions resolves the error.

When an improvement action is set to Risk accepted - will not fix, Defender Exposure Management (formerly Threat & Vulnerability Management) excludes the recommendation from both Secure Score and Exposure Score calculations during the exception period. The recommendation and its related CVEs are still retained in the portal, but they are visible only when you filter for exceptions. Device exposure and pending improvement actions lists refresh within minutes to reflect the revised scores. No quarantine, enforcement, or automatic remediation is triggered; only the scoring and visibility change. Choosing to postpone or approve remediation would instead keep the item in scope and affect score differently.

Mail contacts meet every requirement. They are mail-enabled objects that appear in the global address list and can be added to distribution lists, yet they have no credentials in Microsoft Entra ID, so the external suppliers cannot sign in or consume Microsoft 365 services. Guest users and mail-enabled users create sign-in identities, while shared mailboxes require internal licensing and are intended for team access, not individual external contacts.

Installing a second Microsoft Entra Connect Sync server in staging mode allows the new server to run all import and synchronization steps without exporting any data. After the initial sync cycle is completed, disabling staging mode on the new server starts exports, while enabling staging mode (or decommissioning) on the original server prevents duplicate exports. Simply stopping the scheduler, pausing run profiles, or switching to Microsoft Entra Cloud Sync does not provide the same seamless cut-over with full configuration fidelity and minimal risk.

The prevent accidental deletes feature in Microsoft Entra Connect Sync blocks an export when the number of deletions exceeds the configured threshold (500 by default). To allow the deletions to proceed, you must temporarily disable this protection and then re-enable it afterward. The cmdlet Disable-ADSyncExportDeletionThreshold turns off the deletion threshold so the current export can run. The other options do not change the deletion-threshold setting: Set-ADSyncScheduler -SyncCycleEnabled $false only pauses the scheduler, Set-ADSyncScheduler -OverrideDeletionThreshold $true is not a valid parameter combination, and Invoke-ADSyncRunProfile merely starts a run profile but the export would still be blocked.

To meet the requirement you must build an Endpoint DLP rule that targets only the Devices location. Within the rule's advanced settings, you select the activity Copy to removable storage and set the action to Block with override while also requiring users to enter a business justification. Because the activity Copy to network share is not selected, the rule never triggers when files are moved to corporate shares, ensuring the policy applies only to USB exfiltration. Choosing SharePoint, Exchange, or a pure Block action without override would fail either to scope the location correctly or to give users the required ability to proceed with justification.

The Helpdesk Administrator role permits password resets for non-administrator accounts but not for privileged roles. When the role is scoped to an administrative unit, holders can act only on objects in that unit. Assigning Helpdesk Administrator scoped to SalesAU therefore provides the exact capability required-password resets for sales users only-with no broader privileges.

Password Administrator can also reset passwords for several administrator roles, which exceeds the requirement. Authentication Administrator can update multifactor and passwordless settings in addition to performing password resets, providing unnecessary permissions. User Administrator grants broad user management capabilities (create, update, delete users) that are not needed in this scenario.

The initial *.onmicrosoft.com domain assigned to a tenant cannot be renamed or deleted. Instead, you add the new vanity domain, complete DNS verification, and then make that domain the default. When a domain is set as the default, the Microsoft 365 admin center automatically assigns it to the UPN and primary SMTP address of every new user that is created, while existing proxy addresses on other verified domains continue to function for mail flow. Deleting the original domain, renaming the *.onmicrosoft.com domain, or creating a new tenant would either be impossible or require a full migration effort and therefore do not satisfy the stated constraints.

IdFix looks at the Action column in the CSV you re-import to decide what to do with each directory object.

• EDIT - apply the value you place in the Update column.
• REMOVE - delete the attribute value so that it is blank.
• IGNORE - leave the object unchanged and suppress the warning on subsequent scans.

Because the duplicate proxyAddresses are valid and should not be modified, you should specify IGNORE.