MS-102 Deploy and manage a Microsoft 365 tenant — 10 Questions

Question 1

A company wants to allow users to log in to Microsoft 365 using their existing on-premises Active Directory credentials and ensure that password changes are reflected immediately in the cloud. Which authentication method should be implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pass-through Authentication (PTA). Both Pass-through Authentication (PTA) and Federation with AD FS authenticate users directly against on-premises Active Directory, so password changes are immediately effective for Microsoft 365 sign-in. Password Hash Synchronization (PHS) has a synchronization delay, and Microsoft Entra ID Seamless SSO is not an authentication method by itself. The requirement does not distinguish between PTA and federation, so both B and C satisfy the stated requirement.

Answer

Password Hash Synchronization (PHS)

Answer

Azure AD Seamless SSO

Question 2

An organization wants to authenticate users using their on-premises Active Directory without synchronizing passwords to Microsoft Entra ID. Which identity model should they choose?

Accepted Answer

Federated identity. Federated identity allows users to authenticate against on-premises Active Directory using protocols such as WS-Federation, SAML 2.0, or AD FS, without synchronizing password hashes to Microsoft Entra ID. This model relies on a trust relationship between the on-premises identity provider and Entra ID, ensuring passwords never leave the local environment.

Answer

Synchronized identity

Answer

Cloud-only identity

Answer

Microsoft-managed identity

Question 3

An administrator is managing a Microsoft 365 tenant and needs to delegate the ability to reset user passwords to a group of helpdesk staff. The helpdesk staff should not have any other administrative privileges. Which built-in role should the administrator assign?

Accepted Answer

Password Administrator. The Password Administrator role is the correct choice because it grants the specific ability to reset passwords for non-administrator users and manage service requests, without providing broader administrative privileges like managing users, groups, or licensing. This aligns with the principle of least privilege, ensuring helpdesk staff can perform password resets without accessing other sensitive areas of the tenant.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 4

An administrator needs to delegate the ability to manage user licenses and assign roles to a junior admin, but without granting them access to the Microsoft 365 admin center's other settings. Which role should the junior admin be assigned?

Accepted Answer

License Administrator. The License Administrator role is the correct choice because it specifically grants the ability to assign and remove licenses for users, as well as manage their location, without providing access to other Microsoft 365 admin center settings like user creation, role assignment, or security features. This role is designed for delegated license management while maintaining least privilege.

Answer

User Administrator

Answer

Global Administrator

Answer

Helpdesk Administrator

Question 5

A new helpdesk administrator needs to be able to reset user passwords and manage user account properties, but should not be able to manage licenses or assign administrative roles. Which built-in role should be assigned?

Accepted Answer

User Administrator. The User Administrator role in Microsoft Entra ID is the correct choice because it includes permissions to reset passwords, manage user account properties (such as display name, job title, and department), and manage user licenses, while explicitly excluding the ability to assign administrative roles. The Helpdesk Administrator role can reset passwords but cannot manage user account properties or licenses, and the License Administrator role can only manage licenses, not user properties. The Global Administrator role has full access, which exceeds the required permissions. Therefore, User Administrator is the appropriate role.

Answer

Global Administrator

Answer

License Administrator

Answer

Helpdesk Administrator

Question 6

An administrator needs to delegate the ability to manage user licenses, assign admin roles, and reset passwords to a group of users, but these users should not be able to modify tenant-level settings or billing. Which built-in role should be assigned?

Accepted Answer

User Administrator. The User Administrator role is the correct choice because it grants the necessary permissions to manage user licenses, assign admin roles (except for a few high-privilege roles like Global Administrator), and reset passwords, while explicitly excluding access to tenant-level settings and billing. This role is designed for delegated user management without granting broader administrative control.

Answer

Global Administrator

Answer

Helpdesk Administrator

Answer

License Administrator

Question 7

An administrator needs to delegate the ability to view service health and manage service requests to a helpdesk team, without granting permissions to reset passwords, manage users, or access billing. Which built-in Microsoft 365 admin role should be assigned?

Accepted Answer

Service Support Administrator. The Service Support Administrator role is the correct built-in role because it grants the specific permissions needed to view service health and manage service requests in the Microsoft 365 admin center, while explicitly excluding permissions to reset passwords, manage users, or access billing. This role is designed for helpdesk teams that need to handle service incidents without broader administrative access.

Answer

Helpdesk Administrator

Answer

Service Administrator

Answer

Security Reader

Question 8

An administrator needs to delegate the ability to view sign-in logs, audit logs, and security recommendations to a junior admin without granting any other administrative permissions. The junior admin should not be able to reset passwords or modify settings. Which built-in Microsoft Entra role should the administrator assign?

Accepted Answer

Security Reader. The Security Reader role in Microsoft Entra ID grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permissions to modify settings or reset passwords. The Reports Reader role exists but only covers sign-in and audit logs, not security recommendations, making Security Reader the correct choice.

Answer

Global Reader

Answer

Reports Reader

Answer

Security Administrator

Question 9

An administrator wants to customize the Microsoft 365 sign-in page to display the company logo and custom sign-in text. Where in the Microsoft 365 admin center should the administrator go to configure this?

Accepted Answer

Microsoft Entra admin center > User settings > Company branding. Company branding for the Microsoft 365 sign-in page, including logo and sign-in text, is configured in the Microsoft Entra admin center (User settings > Company branding), not in the Microsoft 365 admin center. The question must be rephrased to not restrict to the M365 admin center, or no correct option exists.

Answer

Settings > Org settings > Organization profile

Answer

Security & Compliance center > Data classification

Answer

Exchange admin center > Mail flow > Accepted domains

Question 10

A company wants to migrate from on-premises Exchange to Exchange Online. They need to synchronize user mailboxes. Which tool should they use?

Accepted Answer

C: Exchange Online Hybrid Configuration Wizard. The Exchange Online Hybrid Configuration Wizard (HCW) is the correct tool for migrating on-premises Exchange mailboxes to Exchange Online because it configures the hybrid deployment settings, including the necessary connectors, federation trust, and OAuth authentication, enabling mailbox moves via the New-MigrationBatch cmdlet or the EAC. It orchestrates the synchronization of mailbox data between the on-premises environment and Exchange Online, leveraging the MRS (Mailbox Replication Service) proxy for secure, seamless migration.

Answer

A: Microsoft 365 admin center

Answer

B: Exchange Admin Center

Answer

D: Azure AD Connect