Microsoft 365 Administrator Expert Practice Test (MS-102)

A Microsoft Entra ID (Azure AD) group naming policy lets you automatically add a prefix or suffix to every Microsoft 365 group name by using user attributes such as Department, and it lets you define a custom blocked-words list. The policy is enforced across all workloads that use Microsoft 365 groups, so no additional configuration is required in Teams, Exchange, or SharePoint. Expiration policies, Teams messaging policies, and Exchange transport rules do not prepend attribute-based text to group names, nor can they consistently block specific words during group creation.

Guided hunting opens the Advanced hunting interface pre-populated with investigation queries scoped to entities in the incident. Results returned by any of these queries support the same entity-level response actions that are available in standard Advanced hunting. For device entities, selecting the relevant rows and choosing Isolate device from the Take action menu immediately contains the endpoints by blocking all inbound and outbound network traffic except those connections required for Defender communication. The other options either do not exist in the Guided hunting results pane (running Live Response session directly, moving devices to an Intune group) or cannot initiate containment (adding a device tag is only a labeling operation).

The Conditional Access grant control "Require authentication strength" lets administrators specify an authentication strength such as "Phishing-resistant MFA." That strength accepts only phishing-resistant methods-currently FIDO2 security keys, certificate-based authentication, and Windows Hello for Business-so SMS, voice, or app-based OTPs will not satisfy the policy. Selecting the generic "Require multi-factor authentication" would permit any MFA method, and device-based controls or a full block would not meet the scenario requirements.

The requirement has two distinct elements:

1. Detect only highly accurate SSN matches, so the sensitive information type must be configured with the High confidence level.
2. Block delivery only when the recipient is outside the organization. The pre-built rule condition "Recipient is located outside your organization" combined with "Sender is located inside your organization" confines the block to external traffic and leaves internal messages untouched. Therefore the rule that detects U.S. SSNs at High confidence, scopes the sender to inside the tenant and at least one recipient to outside, and sets the action to Block (with Policy Tip or notification as desired) is the only configuration that fully satisfies both accuracy and scoping requirements. The other options either use Low confidence (increasing false positives), scope the sender/recipient in the wrong direction, or fail to block the message, so they do not meet the stated objectives.

When the same product license is assigned to a user through multiple groups, Microsoft Entra ID resolves any differences by taking the union of the individual assignments. A service plan is enabled if it is enabled in at least one of the assignments. Therefore, the user consumes only one Microsoft 365 E3 license and ends up with Exchange Online (and all other service plans) enabled. No additional licenses are consumed, and the assignment does not enter a conflict state because the union rule eliminates the discrepancy.

The initial step in adding a new custom domain is to prove ownership. In the Add Domain wizard you choose the option to add your own DNS records, then create the TXT record that Microsoft 365 supplies. TXT-based verification does not alter any MX or other service-specific records, so existing mail flow remains unaffected. Allowing Microsoft 365 to update DNS could immediately change the MX record, disrupting mail. An accepted domain in Exchange Online cannot be created until the domain is verified, and configuring a mail flow connector is unnecessary for domain verification.

The Security Reader role group in Microsoft Defender XDR provides read-only access to incidents, alerts, and reports without allowing the user to change status or take response actions. In the Microsoft Purview compliance portal, the View-Only Audit Logs role group allows users to run and view audit log searches but prevents them from configuring auditing or performing eDiscovery tasks. Assigning these two role groups meets the read-only requirement across both workloads, whereas the other listed role groups grant additional capabilities (such as changing incident status, configuring policies, or performing eDiscovery) that exceed the requirement.

The rollout cadence for Microsoft 365 service updates is controlled from the Organization profile section of the Microsoft 365 admin center. By setting Release preferences to "Targeted release for selected users," you can specify a group of pilot users who will receive new features earlier than everyone else. Customer Lockbox only governs data-access requests, Intune update rings apply to Windows and not Microsoft 365 services, and enabling Preview features in Message center gives administrators early visibility to change information but does not alter when end users receive the features.

When you select the Devices missing critical security updates tile, the portal opens the Device inventory filtered to the affected endpoints. From the Device inventory you can choose Take action > Create remediation activity, which opens Threat & Vulnerability Management and lets you request remediation for the missing updates. If the tenant is integrated with Intune or Configuration Manager, the remediation task can automatically deploy the needed patches. Exporting to CSV or Advanced Hunting only gathers information and does not trigger remediation. Isolating devices is a containment step that prevents, rather than installs, updates.

In Microsoft Entra ID, external collaboration settings let you control who can send B2B collaboration invitations. Changing the guest invite setting to "Admins and users in the Guest Inviter role" prevents ordinary employees from inviting guests but still allows global administrators. After selecting that option, you add the selected project managers to the built-in Guest Inviter role so they can continue to send invitations. The other options either do not restrict invitation capability to the required subset or rely on features (conditional access, entitlement management) that do not directly control who can issue invitations.

The Microsoft Graph PowerShell SDK is the supported module for user licensing. Import-Csv delivers each UPN to the pipeline, and ForEach-Object invokes Set-MgUserLicense, adding the required SkuId while passing an empty array to -RemoveLicenses. The other options either call deprecated AzureAD/MSOnline cmdlets or misuse Update-MgUser, which cannot assign licenses directly.

The attributeValueMustBeUnique error indicates that one or more objects about to be exported contain a mail-related value (mail or proxyAddresses) that is already in use by a different object in the Microsoft Entra directory. Azure AD Connect blocks the export until the duplicate values are removed. IdFix is the Microsoft-provided utility designed to scan on-premises Active Directory, identify such duplicate or invalid attribute values, and assist with their remediation. After running IdFix and correcting the duplicates, the next synchronization cycle will export the affected objects successfully.

Excluding the mail attribute or creating custom sync rules does not address the underlying duplicate data and can create additional issues. Switching to staging mode and rebuilding the server is unnecessary overhead when the problem is data quality. Forcing a full synchronization without fixing the duplicates will simply reproduce the same export errors.

Microsoft Entra ID Protection includes a built-in sign-in risk policy, but that policy applies only one access control (allow, require MFA, or block) to all risk levels at or above a single threshold. It therefore cannot assign different actions to High and Medium risk separately. Conditional Access, however, lets you create multiple policies, each filtered for a specific sign-in risk level, and apply a different grant control per policy. Creating one Conditional Access policy that targets High sign-in risk and blocks access, and a second policy that targets Medium sign-in risk and requires MFA, satisfies the stated requirements. Enabling the user-risk policy, security defaults, or adding a single sign-in risk policy would not provide the necessary per-level controls.

Selecting "Trigger automated investigation" in Threat Explorer immediately launches an AIR playbook against the chosen message. The playbook analyzes the email, any correlated artifacts (such as URLs, sender infrastructure, and attachments), and automatically takes remediation steps-including purging or quarantining related messages-subject to admin approval settings. Other options either require additional configuration (creating a transport rule), only block future messages without touching already-delivered mail (adding a domain to blocked senders), or simply submit the sample to Microsoft without initiating tenant-level remediation (submitting for analysis). Therefore, starting an automated investigation best meets both removal and prevention requirements with minimal effort.

A Temporary Access Pass (TAP) is designed to bootstrap user sign-in when no other strong credential is available. In a TAP authentication method policy you can enforce One-time use so the pass stops working after the first successful sign-in, and you can set the Default lifetime to any value between 10 minutes and 24 hours. None of the other authentication methods let you define both a single-use limitation and an explicit 10-minute validity period, so they cannot satisfy the scenario.

Tamper Protection prevents local administrators, scripts, registry edits, and even Group Policy from changing Microsoft Defender Antivirus settings. However, configuration changes delivered through Microsoft Intune or other supported enterprise management channels remain allowed. Turning on Tamper Protection through an Endpoint security Antivirus policy therefore stops users from disabling real-time protection yet still lets Intune manage Defender Antivirus moving forward. The other choices enable different security features (controlled folder access, device restrictions, or firewall rules) that do not prevent the described tampering scenario.

Integrating Microsoft Defender for Endpoint with Microsoft Defender for Cloud Apps creates a native, client-based enforcement channel. When the integration is enabled and the option to automatically block unsanctioned apps (also known as Enforce network restrictions) is turned on, any app that you tag as Unsanctioned in Defender for Cloud Apps is blocked directly on devices that are managed by Defender for Endpoint. The block relies on the MDE network protection capability and therefore requires no extra infrastructure or browser plug-ins. Conditional Access App Control or session policies can control sanctioned apps in real time but do not selectively block only managed devices without using reverse proxy redirection. Deploying a log collector only imports discovery data and does not provide enforcement.

Microsoft Entra Password Protection for on-premises AD requires both the DC agent and the proxy service. The proxy service, installed on at least one domain-joined server, authenticates to Microsoft Entra ID, retrieves the global and custom banned-password lists, and makes them available to the DC agents. Features such as password hash synchronization or writeback do not deliver the banned-password lists, and LDAP traffic to Microsoft Entra ID is not used for this purpose.

Enabling Password Hash Synchronization (PHS) while retaining Pass-through Authentication keeps PTA as the active sign-in method as long as the agents are healthy, so users experience no change in normal operation. Because user password hashes are continuously synchronized to Microsoft Entra ID, an administrator can quickly switch the tenant's sign-in method to PHS using Microsoft Entra Connect or PowerShell if every PTA agent or the corporate network becomes unreachable. Deploying extra PTA agents does not help when the network itself is down. AD FS introduces additional infrastructure and does not provide an easier fallback path. Seamless SSO does not include an independent setting for cloud-only fallback.

In the Microsoft 365 admin center, release cadence is controlled in Settings > Org settings > Organization profile > Release preferences. Choosing "Targeted release for selected users" enables early access to features only for the users you specify, while the remainder of the tenant stays on the Standard release track. Switching the entire organization to Targeted release would affect everyone. Enabling targeted experiences in the Message center or assigning additional licenses does not control feature rollout timing.