10 MS-102 Practice Questions That Mirror the Real Exam
Here is a set of 8-10 multiple-choice questions designed to match the difficulty and domain coverage of the MS-102 (Microsoft 365 Administrator) exam.
Welcome to your MS-102 practice quiz. These questions cover key areas from the official exam blueprint, including identity management, security administration, compliance, and tenant configuration. Pay close attention to the scenario details, as they often point to the single most correct answer.
Q1. Your organization uses Microsoft Entra ID (Azure AD). You need to ensure that only users assigned the "Global Administrator" role can register new applications in the tenant. What should you configure?
A. An authentication method policy
B. A user risk policy in Identity Protection
C. A user consent setting for applications
D. An application registration policy
Answer: D
Explanation: Application registration policies control who can register applications. By default, all users can register, but you can restrict this to specific administrators via the "User settings" in the App registrations blade (which is governed by the policy). Authentication methods and risk policies relate to sign-in security, not app registration permissions.
Q2. You have a Microsoft 365 tenant. You need to enforce Multi-Factor Authentication (MFA) for all users, but you want to exclude break-glass accounts. Which Conditional Access policy configuration should you use?
A. Assign the policy to "All users" and add the break-glass accounts to the policy's "Exclude" list.
B. Assign the policy to "All users" and add the break-glass accounts to the policy's "Include" list.
C. Create a separate policy for the break-glass accounts that blocks access.
D. Configure a security default that excludes the break-glass accounts.
Answer: A
Explanation: In Conditional Access, you assign the policy to a target group (e.g., All users) and then use the "Exclude" tab to remove specific users, such as break-glass accounts. Including them would force MFA, and security defaults do not support exclusions for specific accounts.
Q3. Your company has a hybrid identity environment. You are planning to use Microsoft Entra Connect Sync. A user's userPrincipalName (UPN) is user@contoso.com, but their primary SMTP address is user@adatum.com. Which attribute will be authoritative for the Microsoft Entra ID UPN?
A. The mail attribute
B. The userPrincipalName attribute
C. The proxyAddresses attribute
D. The sAMAccountName attribute
Answer: B
Explanation: The userPrincipalName attribute in the on-premises Active Directory is synchronized to Microsoft Entra ID to become the cloud UPN. The mail and proxyAddresses attributes are used for email routing. If the UPN does not match a verified domain, it is replaced with the initial .onmicrosoft.com domain.
Q4. You need to ensure that guest users in your tenant can only see the profiles of other guest users and not the full directory of internal employees. What is the most efficient way to achieve this?
A. Set the "Guest user access" restriction to "Guest users have limited access to properties and memberships of directory objects."
B. Configure a Conditional Access policy that blocks guest users from reading the directory.
C. Create a dynamic group containing only guest users and apply a sensitivity label to it.
D. Change the "Members can invite" setting to "No".
Answer: A
Explanation: The "Guest user access restrictions" setting in Microsoft Entra ID (under External Identities > External collaboration settings) controls this. The "Limited access" option prevents guests from enumerating the full directory, limiting them to view only their own profile and properties of users they interact with. Conditional Access policies do not block directory reads in this manner.
Q5. Your organization has a compliance requirement to retain all documents shared externally for 7 years. You need to implement a solution that automatically applies this policy to documents shared via SharePoint Online and OneDrive. What should you use?
A. A retention policy in Microsoft Purview
B. A sensitivity label with a retention label attached
C. A Data Loss Prevention (DLP) policy
D. A communication compliance policy
Answer: B
Explanation: To apply retention based on content properties (like "shared externally"), you must use auto-labeling with a sensitivity label that has a retention label configured. Retention policies apply to all content in a location, not based on a condition like sharing status. DLP policies prevent data loss; they don't retain data.
Q6. You have a Microsoft 365 E5 subscription. You need to identify users who are sending emails that contain confidential financial data to external recipients. Which solution should you use to detect and report this activity?
A. Microsoft Defender for Cloud Apps
B. Information barriers
C. Data Loss Prevention (DLP) policies
D. Mail flow rules in Exchange Online
Answer: C
Explanation: DLP policies are specifically designed to detect sensitive data types (like financial information) and monitor or block the transmission of that data. While mail flow rules can handle some of this, DLP provides a unified policy engine across Exchange, SharePoint, and OneDrive with detailed reporting in the Microsoft Purview portal. Defender for Cloud Apps focuses on cloud app usage, not email content specifically.
Q7. You are configuring a new policy in Microsoft Defender for Office 365. You need to protect users from malicious links that are embedded in email messages, but you do not want to rewrite the URLs in the email body. Which setting should you configure?
A. Safe Attachments policy
B. Safe Links policy with the "Do not track user clicks" option
C. Safe Links policy with the "Do not rewrite URLs" option
D. Anti-phishing policy
Answer: C
Explanation: Safe Links policies have a setting called "Do not rewrite URLs" which, when enabled, prevents the URL from being wrapped in a Microsoft-specific link. Instead, the URL is checked at click time via a different method. Safe Attachments is for file scanning, and anti-phishing policies handle impersonation and spoofing.
Q8. Your company is using Microsoft 365 and has users in multiple geographic regions. You need to ensure that the Content Search feature in Microsoft Purview searches all data locations, including the new region you recently added. What must you configure?
A. A new eDiscovery (Premium) case
B. Multi-Geo configuration in SharePoint Online
C. Data location policies in Microsoft Purview
D. A compliance boundary
Answer: B
Explanation: To search content across different geographic locations, you must have Multi-Geo enabled. Content Search can then search across all satellite locations. Compliance boundaries are used to control which eDiscovery managers can search specific locations, but they don't add new locations. Multi-Geo is the feature that provisions new data residency regions.
Q9. You are an administrator for a Microsoft 365 tenant. You need to delegate password reset permissions to a group of Helpdesk users. They must be able to reset passwords but not manage user licenses. What is the least privilege role you should assign?
A. Global Administrator
B. User Administrator
C. Helpdesk Administrator
D. Authentication Administrator
Answer: C
Explanation: The Helpdesk Administrator role can reset passwords and manage service requests. The User Administrator can also reset passwords but has broader user management capabilities (like managing licenses). Authentication Administrator can reset passwords only for non-privileged users and is more focused on authentication methods. Helpdesk Administrator provides the least privilege for the specific task of password resets.
Q10. You have a security requirement that all user sign-ins must be logged and audited for a minimum of 1 year. Your current license includes default retention of 30 days for sign-in logs. What should you do to meet the requirement?
A. Export the logs to a Log Analytics workspace with a 365-day retention period.
B. Enable diagnostic settings in Microsoft Entra ID to stream logs to Azure Monitor.
C. Increase the retention period of the sign-in logs in the Microsoft Entra admin center.
D. Use the Microsoft Purview Audit log retention settings.
Answer: B
Explanation: To retain sign-in logs for over 30 days, you must route them to Azure Monitor (Log Analytics) via Diagnostic settings. You can then configure the workspace retention to 365 days. You cannot directly increase the retention period in the Entra admin center (it's a fixed 30 days for the default tier), and the Purview audit log is for user/admin activity, not sign-in events.
This quiz covers the core decision points you will face in the MS-102 exam, focusing on the why behind each configuration. Remember to study the official Microsoft documentation for each of these areas, especially the nuances of Conditional Access and Microsoft Purview, as these are heavily weighted in the exam.
If you are still mapping out your review timeline, the free MS-102 study plan can turn the time you have into a week-by-week schedule weighted to the exam topics.
Give your preparation its final stress test with Microsoft 365 Administrator (MS-102) practice papers before the real exam.
For a short check of weaker areas, the free MS-102 readiness check offers a set of practice questions with explanations for every answer.