Microsoft certification practice
Practise Microsoft 365 Administrator MS-102 practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Microsoft certification exams often test whether you can choose the right Azure, Microsoft 365, identity, security or monitoring action for a realistic administrative scenario. Courseiva helps you practise with structured questions and explanations.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 6 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Microsoft 365 Administrator MS-102 exam.
Exam cost
$165 USD / ~£135
Duration
120 minutes
Question count
40–60 questions
Passing score
700 / 1000
Validity
Annual renewal (free online assessment on Microsoft Learn)
Delivered by
Pearson VUE
Online proctored
Yes — available
Retake policy
100% free — no account required
Everything on Courseiva for MS-102 is free — no subscription, no trial, no email wall.
Courseiva provides free Microsoft 365 Administrator MS-102 (MS-102) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with Microsoft.
24 hours after first failure; 14 days after second
Question formats
Microsoft 365 Administrator Expert (MS-102) validates advanced skills in deploying and managing Microsoft 365 tenants, implementing Microsoft Entra identity, managing security with Defender XDR, and ensuring compliance with Microsoft Purview. It is an Expert-level certification aimed at senior M365 administrators.
Official prerequisite
None (Expert-level; prior M365 admin experience strongly recommended)
Recommended experience
MS-900 and 2 years of Microsoft 365 administration experience
2+ years administering Microsoft 365 tenants. Deep knowledge of Entra ID, Exchange Online, Teams, SharePoint, Defender XDR, and Purview.
Should you skip this exam?
MS-102 is Expert-level. If you are new to Microsoft 365, start with MS-900 (Fundamentals). If you are a device-focused admin, MD-102 (Endpoint Administrator) is a different track.
Courseiva study tip
Defender XDR (formerly Defender for Office 365 and Microsoft 365 Defender) is a major domain. Know the incident response workflow in the Defender portal and the configuration of anti-phishing, safe links, and safe attachments policies.
UK salary range
£55,000–£85,000
US salary range
$90,000–$130,000
Job roles that cite MS-102
$165 USD.
700 out of 1000.
MS-102 is a hard Expert-level exam. It has a wide scope covering tenant management, Entra ID, Defender XDR, and Purview compliance — all at a depth well beyond the fundamentals exams.
MS-102 requires annual renewal via a free online assessment on Microsoft Learn.
MS-900 is a foundational, non-technical certification. MS-102 is Expert-level and requires extensive hands-on Microsoft 365 administration experience. They are very different in scope and difficulty.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All MS-102 Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Microsoft 365 Administrator MS-102 questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise MS-102 questions linked to Deploy and manage a Microsoft 365 tenant.
Practise MS-102 questions linked to Implement and manage Microsoft Entra identity and access.
Practise MS-102 questions linked to Manage security and threats by using Microsoft Defender XDR.
Practise MS-102 questions linked to Manage compliance by using Microsoft Purview.
Practise MS-102 questions linked to Manage users, groups, licensing, and support.
Practise MS-102 questions linked to Implement and manage identity and access in Microsoft Entra ID.
Practise MS-102 questions linked to MS-102 fundamentals.
Practise MS-102 questions linked to MS-102 scenario.
Practise MS-102 questions linked to MS-102 troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 63 tests. See all 63 MS-102 practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise MS-102 questions in this domain →
Practise MS-102 questions in this domain →
Practise MS-102 questions in this domain →
Practise MS-102 questions in this domain →
Practise MS-102 questions in this domain →
Practise MS-102 questions in this domain →
Term reference
These terms appear frequently in MS-102 questions. Understanding them precisely reduces guessing and improves scores.
Safe Links
Safe Links is a Microsoft Defender for Office 365 feature that scans URLs in emails and documents in real time to protect users from malicious websites.
Security pillar
The Security pillar is a set of best practices for designing and operating cloud systems that protect data, systems, and assets through confidentiality, integrity, and availability controls.
Risk acceptance
Risk acceptance is a risk management strategy where an organization acknowledges a potential risk but decides to tolerate it without taking active measures to reduce or eliminate it.
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Administrative unit
An Administrative unit is a container in Microsoft Entra ID that allows you to delegate administrative permissions over a subset of users, groups, or devices, rather than the entire directory.
Security strategy
A security strategy is a high-level plan that outlines how an organization protects its information assets, aligns security with business goals, and manages risk over time.
Windows Update for Business
Windows Update for Business is a set of policies and settings that IT administrators use to manage and control how Windows devices receive updates from Microsoft, allowing for staged rollouts and deferrals while ensuring security patches are applied.
Security awareness
Security awareness is the ongoing practice of educating people within an organization about cybersecurity risks, safe behaviors, and their individual responsibilities to protect information assets.
Free study guide
The Courseiva MS-102 study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Trap 1: Create a dynamic group based on accountEnabled attribute and apply…
Incorrect. While possible, this is unnecessary and adds complexity; the sync already blocks sign-ins for disabled accounts.
Trap 2: Run a PowerShell script daily to disable matching accounts in…
Incorrect. Manual scripting is error-prone and not required because synchronization handles it automatically.
Trap 3: Enable cloud HR provisioning.
Incorrect. Cloud HR provisioning is used for HR-driven scenarios, not for synchronizing disabled status from on-premises AD.
Ensure Microsoft Entra Connect is configured to synchronize the disabled status; this happens automatically.
Correct. The sync of the accountEnabled attribute is automatic, and disabling the on-premises account will propagate to the cloud, blocking sign-in.
Create a dynamic group based on accountEnabled attribute and apply a Conditional Access policy to block access.
Why wrong: Incorrect. While possible, this is unnecessary and adds complexity; the sync already blocks sign-ins for disabled accounts.
Run a PowerShell script daily to disable matching accounts in Microsoft Entra ID.
Why wrong: Incorrect. Manual scripting is error-prone and not required because synchronization handles it automatically.
Enable cloud HR provisioning.
Why wrong: Incorrect. Cloud HR provisioning is used for HR-driven scenarios, not for synchronizing disabled status from on-premises AD.
Trap 1: Create a security group with explicit membership and assign…
Explicit membership groups require manual updates when users join or leave finance.
Trap 2: Assign licenses to users one by one in the Microsoft 365 admin…
This is manual and does not scale for a department of many users.
Trap 3: Use PowerShell to assign licenses based on user department…
PowerShell scripts require ongoing maintenance and are not the simplest approach.
Create a security group with explicit membership and assign licenses to the group.
Why wrong: Explicit membership groups require manual updates when users join or leave finance.
Create a dynamic Azure AD group based on department attribute and assign licenses using group-based licensing.
This automates license assignment and removal when users change departments.
Assign licenses to users one by one in the Microsoft 365 admin center.
Why wrong: This is manual and does not scale for a department of many users.
Use PowerShell to assign licenses based on user department attribute.
Why wrong: PowerShell scripts require ongoing maintenance and are not the simplest approach.
Trap 1: Create an SPF record for the domain.
SPF records are configured after the domain is verified and you start sending email, not as a first step.
Trap 2: Create a MX record pointing to Exchange Online.
MX records are created after the domain is verified and you want to route email to Exchange Online.
Trap 3: Assign Microsoft 365 licenses to users with @fabrikam.com addresses.
Licenses are assigned after the domain is verified and users are created with that domain.
Add the domain in the Microsoft 365 admin center.
Adding the domain initiates the verification process and is required before any other DNS or licensing steps.
Create an SPF record for the domain.
Why wrong: SPF records are configured after the domain is verified and you start sending email, not as a first step.
Create a MX record pointing to Exchange Online.
Why wrong: MX records are created after the domain is verified and you want to route email to Exchange Online.
Assign Microsoft 365 licenses to users with @fabrikam.com addresses.
Why wrong: Licenses are assigned after the domain is verified and users are created with that domain.
Trap 1: Identity Protection
Incorrect. Identity Protection handles risk detection and remediation, not privileged role management.
Trap 2: Conditional Access
Incorrect. Conditional Access controls sign-in conditions but does not provide JIT role activation with approval.
Trap 3: Access Reviews
Incorrect. Access Reviews are for periodic certification of existing access, not for on-demand activation.
Privileged Identity Management (PIM)
Correct. PIM enables just-in-time activation with approval and time-bound assignments.
Identity Protection
Why wrong: Incorrect. Identity Protection handles risk detection and remediation, not privileged role management.
Conditional Access
Why wrong: Incorrect. Conditional Access controls sign-in conditions but does not provide JIT role activation with approval.
Access Reviews
Why wrong: Incorrect. Access Reviews are for periodic certification of existing access, not for on-demand activation.
Trap 1: The domain was not verified with a TXT record.
The domain status shows 'Active', which means verification was completed. Verification requires a TXT record, but that only proves ownership; it does not affect email delivery.
Trap 2: The SPF record for the domain is missing or incorrectly configured.
SPF helps prevent spoofing but does not affect the ability to receive email. SPF is for outbound mail authentication.
Trap 3: The custom domain was not added to the user's primary email address.
User email addresses can be set to the custom domain after it is verified. However, this setting affects sending, not receiving. The root cause is DNS for inbound mail.
The domain was not verified with a TXT record.
Why wrong: The domain status shows 'Active', which means verification was completed. Verification requires a TXT record, but that only proves ownership; it does not affect email delivery.
The MX record for the domain is missing or points to an incorrect mail server.
The MX record directs email to the correct mail server. If it is missing or incorrectly configured, external email will not reach Exchange Online mailboxes.
The SPF record for the domain is missing or incorrectly configured.
Why wrong: SPF helps prevent spoofing but does not affect the ability to receive email. SPF is for outbound mail authentication.
The custom domain was not added to the user's primary email address.
Why wrong: User email addresses can be set to the custom domain after it is verified. However, this setting affects sending, not receiving. The root cause is DNS for inbound mail.
Trap 1: Install Azure AD Connect on a separate server
Azure AD Connect is already installed; no separate server is required for Seamless SSO.
Trap 2: Enable Passthrough Authentication
Passthrough Authentication is a different authentication method, not required for Seamless SSO.
Trap 3: Set the service connection point in Active Directory
Service connection points are used for Azure AD Connect configuration, not for Seamless SSO.
Create a computer account named AZUREADSSOACC in each AD forest
This account is used by Azure AD Connect to sign users in silently.
Install Azure AD Connect on a separate server
Why wrong: Azure AD Connect is already installed; no separate server is required for Seamless SSO.
Enable Passthrough Authentication
Why wrong: Passthrough Authentication is a different authentication method, not required for Seamless SSO.
Set the service connection point in Active Directory
Why wrong: Service connection points are used for Azure AD Connect configuration, not for Seamless SSO.
Official booking and top-rated study resources for the MS-102.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.