MS-102 Deploy and manage a Microsoft 365 tenant — 25 Questions

Question 1

An administrator is onboarding a new custom domain for email in a Microsoft 365 tenant. Which step should be performed first?

Accepted Answer

Add the domain in the Microsoft 365 admin center. Before you can use a custom domain for email or any other service in Microsoft 365, you must first add the domain to the tenant in the Microsoft 365 admin center. This creates the domain object in Azure Active Directory and initiates the verification process. Only after the domain is added can you proceed to verify ownership and configure DNS records.

Answer

Verify domain ownership by adding a TXT record

Answer

Configure DNS records for Microsoft services

Answer

Set the domain as the primary email domain

Question 2

A company wants to prevent their Microsoft 365 tenant from allowing external users to be invited by default. Only specific administrators should be able to invite guests. Which setting should be changed?

Accepted Answer

External Identities – External collaboration settings. The correct setting is under External Identities – External collaboration settings, specifically the 'Guest invite settings' option. By default, this is set to 'Anyone in the organization can invite guest users including guests and non-admins'. Changing it to 'Only users assigned to specific admin roles can invite guest users' restricts guest invitations to designated administrators, meeting the requirement to prevent default external user invitations.

Answer

Conditional Access policy to block external users

Answer

Tenant restrictions

Answer

B2B direct connect

Question 3

A company wants to allow users to log in to Microsoft 365 using their existing on-premises Active Directory credentials and ensure that password changes are reflected immediately in the cloud. Which authentication method should be implemented?

Accepted Answer

Pass-through Authentication (PTA). Both Pass-through Authentication (PTA) and Federation with AD FS authenticate users directly against on-premises Active Directory, so password changes are immediately effective for Microsoft 365 sign-in. Password Hash Synchronization (PHS) has a synchronization delay, and Azure AD Seamless SSO is not an authentication method by itself. The requirement does not distinguish between PTA and federation, so both B and C satisfy the stated requirement.

Answer

Password Hash Synchronization (PHS)

Answer

Azure AD Seamless SSO

Question 4

A newly hired administrator needs to manage user accounts, licenses, and reset passwords. Which portal should they access?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center (admin.microsoft.com) is the primary portal for day-to-day user administration tasks such as creating and managing user accounts, assigning licenses, and resetting passwords. It provides a unified interface for these common identity and license management operations within a Microsoft 365 tenant.

Answer

Microsoft Entra admin center

Answer

Microsoft 365 Defender

Answer

Azure Active Directory admin center

Question 5

An organization wants to authenticate users using their on-premises Active Directory without synchronizing passwords to Microsoft Entra ID. Which identity model should they choose?

Accepted Answer

Federated identity. Federated identity allows users to authenticate against on-premises Active Directory using protocols such as WS-Federation, SAML 2.0, or AD FS, without synchronizing password hashes to Microsoft Entra ID. This model relies on a trust relationship between the on-premises identity provider and Entra ID, ensuring passwords never leave the local environment.

Answer

Synchronized identity

Answer

Cloud-only identity

Answer

Microsoft-managed identity

Question 6

An administrator has created a new user account in Microsoft Entra ID. To ensure the user has a mailbox in Exchange Online, what is the next step?

Accepted Answer

Assign an Exchange Online license to the user. In Microsoft 365, a user must be assigned an Exchange Online license (part of an E3, E5, or standalone plan) before a mailbox is automatically provisioned in Exchange Online. Without a license, the user object exists in Entra ID but has no mailbox; the license assignment triggers the mailbox creation process within 24 hours.

Answer

Create an Exchange mailbox manually

Answer

Run the Microsoft 365 Setup wizard

Answer

Configure DNS records for the domain

Question 7

An organization has registered the domain contoso.com and added it to their Microsoft 365 tenant. What is the next step to use this domain for user email addresses?

Accepted Answer

Add a DNS TXT record provided by Microsoft to the domain registrar. After adding a custom domain to Microsoft 365, the domain's ownership must be verified by adding a specific DNS TXT record provided by Microsoft at the domain registrar. This verification proves you control the domain and is a prerequisite before you can assign user email addresses or configure other DNS records like MX. Without this step, Microsoft 365 will not trust the domain for email routing.

Answer

Create user accounts with the new domain

Answer

Configure Exchange Online connectors

Answer

Set up MX records for email routing

Question 8

An administrator needs to delegate the ability to manage user licenses and assign roles to a junior admin, but without granting them access to the Microsoft 365 admin center's other settings. Which role should the junior admin be assigned?

Accepted Answer

License Administrator. The License Administrator role is the correct choice because it specifically grants the ability to assign and remove licenses for users, as well as manage their location, without providing access to other Microsoft 365 admin center settings like user creation, role assignment, or security features. This role is designed for delegated license management while maintaining least privilege.

Answer

User Administrator

Answer

Global Administrator

Answer

Helpdesk Administrator

Question 9

A company has purchased Microsoft 365 Business Premium and added a custom domain 'contoso.com' to the tenant. They want all new users to have email addresses like user@contoso.com instead of the default onmicrosoft.com domain. What should the administrator do in the Microsoft 365 admin center?

Accepted Answer

Set the custom domain as the default domain in the Domains settings.. Setting the custom domain as the default domain in the Domains settings ensures that any new user created in the Microsoft 365 admin center automatically receives an email address ending with @contoso.com instead of the default @<tenant>.onmicrosoft.com. This is the correct administrative action because the default domain setting controls the domain suffix applied to new user principal names (UPNs) and email addresses during user creation.

Answer

Add a DNS TXT record for the custom domain.

Answer

Change the primary domain in the tenant's organization profile.

Answer

Update the MX record for the custom domain to point to Exchange Online.

Question 10

An organization has just signed up for Microsoft 365 E3 with the initial domain 'contoso.onmicrosoft.com'. They need to create the first user accounts. What will be the default email address format for these new users if no custom domain is added yet?

Accepted Answer

user@contoso.onmicrosoft.com. When a new Microsoft 365 tenant is created with the initial domain 'contoso.onmicrosoft.com' and no custom domain has been added, the default email address format for new users is user@contoso.onmicrosoft.com. This is because the onmicrosoft.com domain is the default tenant domain provisioned by Azure AD, and all user principal names (UPNs) and email addresses are automatically assigned this suffix until a custom domain is verified and set as the primary domain.

Answer

user@contoso.com

Answer

user@microsoft.com

Answer

user@contoso.microsoft.com

Question 11

A company has just purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. They want to verify domain ownership. Which DNS record type must they add to their DNS provider?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification string provided by the Microsoft 365 admin center. The TXT record is the standard DNS record type used for domain validation because it can store arbitrary text data without affecting email routing or other services. Microsoft 365 checks for this specific TXT record to confirm you control the domain.

Answer

MX record

Answer

CNAME record

Answer

SPF record

Question 12

A company wants to display a custom help desk phone number and email on the Microsoft 365 sign-in page so that users can contact support easily. Which area of the Microsoft 365 admin center should the administrator use to configure this?

Accepted Answer

Settings > Org settings > Organization profile. The custom help desk contact information (phone number and email) for the Microsoft 365 sign-in page is configured under Settings > Org settings > Organization profile, specifically in the 'Custom branding' section. This setting allows administrators to add custom support contact details that appear on the sign-in page, enhancing user self-service and support accessibility.

Answer

Settings > Org settings > Security & privacy

Answer

Billing > Licenses

Answer

Health > Service Health

Question 13

An administrator needs to delegate the ability to view service health and manage service requests to a helpdesk team, without granting permissions to reset passwords, manage users, or access billing. Which built-in Microsoft 365 admin role should be assigned?

Accepted Answer

Service Support Administrator. The Service Support Administrator role is the correct built-in role because it grants the specific permissions needed to view service health and manage service requests in the Microsoft 365 admin center, while explicitly excluding permissions to reset passwords, manage users, or access billing. This role is designed for helpdesk teams that need to handle service incidents without broader administrative access.

Answer

Helpdesk Administrator

Answer

Service Administrator

Answer

Security Reader

Question 14

An administrator needs to delegate the ability to view sign-in logs, audit logs, and security recommendations to a junior admin without granting any other administrative permissions. The junior admin should not be able to reset passwords or modify settings. Which built-in Microsoft Entra role should the administrator assign?

Accepted Answer

Security Reader. The Security Reader role in Microsoft Entra ID grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permissions to modify settings or reset passwords. The Reports Reader role exists but only covers sign-in and audit logs, not security recommendations, making Security Reader the correct choice.

Answer

Global Reader

Answer

Reports Reader

Answer

Security Administrator

Question 15

An administrator wants to customize the Microsoft 365 sign-in page to display the company logo and custom sign-in text. Where in the Microsoft 365 admin center should the administrator go to configure this?

Accepted Answer

Microsoft Entra admin center > User settings > Company branding. Company branding for the Microsoft 365 sign-in page, including logo and sign-in text, is configured in the Microsoft Entra admin center (User settings > Company branding), not in the Microsoft 365 admin center. The question must be rephrased to not restrict to the M365 admin center, or no correct option exists.

Answer

Settings > Org settings > Organization profile

Answer

Security & Compliance center > Data classification

Answer

Exchange admin center > Mail flow > Accepted domains

Question 16

A company wants to ensure that all new users created in Microsoft 365 are automatically assigned a specific set of licenses based on their department. The company has 200 users across Sales, Marketing, and IT departments. Each department uses different Microsoft 365 license plans. Which approach should the administrator use?

Accepted Answer

C: Use Azure AD Dynamic Groups to automatically add users to groups based on department, and then assign licenses to those groups.. Azure AD Dynamic Groups can automatically add users to groups based on their department attribute (e.g., using a rule like `user.department -eq "Sales"`), and group-based licensing can then assign the appropriate Microsoft 365 license plan to each dynamic group. This ensures that any new user created with the correct department attribute is automatically added to the corresponding group and receives the license without manual intervention or scheduled scripts.

Answer

A: Create a PowerShell script that runs on a schedule to assign licenses based on department attribute.

Answer

B: Use group-based licensing and assign each department's users to a security group with the appropriate license.

Answer

D: Manually assign licenses to each user after creation.

Question 17

A company wants to migrate from on-premises Exchange to Exchange Online. They need to synchronize user mailboxes. Which tool should they use?

Accepted Answer

C: Exchange Online Hybrid Configuration Wizard. The Exchange Online Hybrid Configuration Wizard (HCW) is the correct tool for migrating on-premises Exchange mailboxes to Exchange Online because it configures the hybrid deployment settings, including the necessary connectors, federation trust, and OAuth authentication, enabling mailbox moves via the New-MigrationBatch cmdlet or the EAC. It orchestrates the synchronization of mailbox data between the on-premises environment and Exchange Online, leveraging the MRS (Mailbox Replication Service) proxy for secure, seamless migration.

Answer

A: Microsoft 365 admin center

Answer

B: Exchange Admin Center

Answer

D: Azure AD Connect

Question 18

An administrator adds the custom domain 'contoso.com' to a new Microsoft 365 tenant and needs to verify domain ownership. Which type of DNS record must be added to the public DNS zone to complete verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record with a specific verification string provided by the Microsoft 365 admin center to the public DNS zone. The TXT record is used because it can store arbitrary text data, which the Microsoft 365 domain verification service queries to confirm that you control the domain. This is the standard method defined in RFC 1035 for domain ownership verification.

Answer

MX record

Answer

CNAME record

Answer

record

Question 19

An administrator needs to open a Microsoft 365 support request because all users are experiencing intermittent service outages for Exchange Online. Before contacting support, which two pieces of information should the administrator have ready to ensure efficient troubleshooting? (Choose two.)

Accepted Answer

Tenant ID (or Microsoft 365 tenant domain name). The Tenant ID (or Microsoft 365 tenant domain name) is required by Microsoft Support to uniquely identify your tenant in their systems, enabling them to pull up your service configuration, subscription details, and relevant health data. This identifier is essential for routing the support request to the correct engineering team and for correlating the issue with backend telemetry.

Answer

Number of affected users

Answer

Network bandwidth graph from the past 24 hours

Question 20

An administrator wants to prevent users from inviting guest users from the domain 'contoso.com' to the tenant. The administrator needs to block all invitations for that specific domain while allowing invitations from all other external domains. Which setting in Microsoft Entra ID should be configured?

Accepted Answer

External collaboration settings. External collaboration settings in Microsoft Entra ID (formerly Azure AD) allow administrators to configure domain-based restrictions for B2B collaboration invitations. By adding 'contoso.com' to the 'Deny list' under 'Cross-tenant access settings' or specifically within the 'External collaboration settings' blade, invitations to that domain are blocked while all other external domains remain allowed. This setting directly controls the guest invitation behavior at the domain level.

Answer

Cross-tenant access settings

Answer

User settings

Answer

Domain federation