MS-102 Deploy and manage a Microsoft 365 tenant — Timed 50 Questions

Question 1

A company wants to allow users to log in to Microsoft 365 using their existing on-premises Active Directory credentials and ensure that password changes are reflected immediately in the cloud. Which authentication method should be implemented?

50 minute time limit — choose an answer to begin.

Accepted Answer

Pass-through Authentication (PTA). Both Pass-through Authentication (PTA) and Federation with AD FS authenticate users directly against on-premises Active Directory, so password changes are immediately effective for Microsoft 365 sign-in. Password Hash Synchronization (PHS) has a synchronization delay, and Microsoft Entra ID Seamless SSO is not an authentication method by itself. The requirement does not distinguish between PTA and federation, so both B and C satisfy the stated requirement.

Answer

Password Hash Synchronization (PHS)

Answer

Azure AD Seamless SSO

Question 2

An organization wants to authenticate users using their on-premises Active Directory without synchronizing passwords to Microsoft Entra ID. Which identity model should they choose?

Accepted Answer

Federated identity. Federated identity allows users to authenticate against on-premises Active Directory using protocols such as WS-Federation, SAML 2.0, or AD FS, without synchronizing password hashes to Microsoft Entra ID. This model relies on a trust relationship between the on-premises identity provider and Entra ID, ensuring passwords never leave the local environment.

Answer

Synchronized identity

Answer

Cloud-only identity

Answer

Microsoft-managed identity

Question 3

An administrator is managing a Microsoft 365 tenant and needs to delegate the ability to reset user passwords to a group of helpdesk staff. The helpdesk staff should not have any other administrative privileges. Which built-in role should the administrator assign?

Accepted Answer

Password Administrator. The Password Administrator role is the correct choice because it grants the specific ability to reset passwords for non-administrator users and manage service requests, without providing broader administrative privileges like managing users, groups, or licensing. This aligns with the principle of least privilege, ensuring helpdesk staff can perform password resets without accessing other sensitive areas of the tenant.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 4

An administrator needs to delegate the ability to manage user licenses and assign roles to a junior admin, but without granting them access to the Microsoft 365 admin center's other settings. Which role should the junior admin be assigned?

Accepted Answer

License Administrator. The License Administrator role is the correct choice because it specifically grants the ability to assign and remove licenses for users, as well as manage their location, without providing access to other Microsoft 365 admin center settings like user creation, role assignment, or security features. This role is designed for delegated license management while maintaining least privilege.

Answer

User Administrator

Answer

Global Administrator

Answer

Helpdesk Administrator

Question 5

A new helpdesk administrator needs to be able to reset user passwords and manage user account properties, but should not be able to manage licenses or assign administrative roles. Which built-in role should be assigned?

Accepted Answer

User Administrator. The User Administrator role in Microsoft Entra ID is the correct choice because it includes permissions to reset passwords, manage user account properties (such as display name, job title, and department), and manage user licenses, while explicitly excluding the ability to assign administrative roles. The Helpdesk Administrator role can reset passwords but cannot manage user account properties or licenses, and the License Administrator role can only manage licenses, not user properties. The Global Administrator role has full access, which exceeds the required permissions. Therefore, User Administrator is the appropriate role.

Answer

Global Administrator

Answer

License Administrator

Answer

Helpdesk Administrator

Question 6

An administrator needs to delegate the ability to manage user licenses, assign admin roles, and reset passwords to a group of users, but these users should not be able to modify tenant-level settings or billing. Which built-in role should be assigned?

Accepted Answer

User Administrator. The User Administrator role is the correct choice because it grants the necessary permissions to manage user licenses, assign admin roles (except for a few high-privilege roles like Global Administrator), and reset passwords, while explicitly excluding access to tenant-level settings and billing. This role is designed for delegated user management without granting broader administrative control.

Answer

Global Administrator

Answer

Helpdesk Administrator

Answer

License Administrator

Question 7

An administrator needs to delegate the ability to view service health and manage service requests to a helpdesk team, without granting permissions to reset passwords, manage users, or access billing. Which built-in Microsoft 365 admin role should be assigned?

Accepted Answer

Service Support Administrator. The Service Support Administrator role is the correct built-in role because it grants the specific permissions needed to view service health and manage service requests in the Microsoft 365 admin center, while explicitly excluding permissions to reset passwords, manage users, or access billing. This role is designed for helpdesk teams that need to handle service incidents without broader administrative access.

Answer

Helpdesk Administrator

Answer

Service Administrator

Answer

Security Reader

Question 8

An administrator needs to delegate the ability to view sign-in logs, audit logs, and security recommendations to a junior admin without granting any other administrative permissions. The junior admin should not be able to reset passwords or modify settings. Which built-in Microsoft Entra role should the administrator assign?

Accepted Answer

Security Reader. The Security Reader role in Microsoft Entra ID grants read-only access to security-related data, including sign-in logs, audit logs, and security recommendations, without permissions to modify settings or reset passwords. The Reports Reader role exists but only covers sign-in and audit logs, not security recommendations, making Security Reader the correct choice.

Answer

Global Reader

Answer

Reports Reader

Answer

Security Administrator

Question 9

An administrator wants to customize the Microsoft 365 sign-in page to display the company logo and custom sign-in text. Where in the Microsoft 365 admin center should the administrator go to configure this?

Accepted Answer

Microsoft Entra admin center > User settings > Company branding. Company branding for the Microsoft 365 sign-in page, including logo and sign-in text, is configured in the Microsoft Entra admin center (User settings > Company branding), not in the Microsoft 365 admin center. The question must be rephrased to not restrict to the M365 admin center, or no correct option exists.

Answer

Settings > Org settings > Organization profile

Answer

Security & Compliance center > Data classification

Answer

Exchange admin center > Mail flow > Accepted domains

Question 10

A company wants to migrate from on-premises Exchange to Exchange Online. They need to synchronize user mailboxes. Which tool should they use?

Accepted Answer

C: Exchange Online Hybrid Configuration Wizard. The Exchange Online Hybrid Configuration Wizard (HCW) is the correct tool for migrating on-premises Exchange mailboxes to Exchange Online because it configures the hybrid deployment settings, including the necessary connectors, federation trust, and OAuth authentication, enabling mailbox moves via the New-MigrationBatch cmdlet or the EAC. It orchestrates the synchronization of mailbox data between the on-premises environment and Exchange Online, leveraging the MRS (Mailbox Replication Service) proxy for secure, seamless migration.

Answer

A: Microsoft 365 admin center

Answer

B: Exchange Admin Center

Answer

D: Azure AD Connect

Question 11

An administrator adds the custom domain 'contoso.com' to a new Microsoft 365 tenant and needs to verify domain ownership. Which type of DNS record must be added to the public DNS zone to complete verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record with a specific verification string provided by the Microsoft 365 admin center to the public DNS zone. The TXT record is used because it can store arbitrary text data, which the Microsoft 365 domain verification service queries to confirm that you control the domain. This is the standard method defined in RFC 1035 for domain ownership verification.

Answer

MX record

Answer

CNAME record

Answer

record

Question 12

A company has registered the custom domain 'contoso.com' and wants to host email for the subdomain 'sales.contoso.com' in Exchange Online. They have already verified the root domain. What additional step is required?

Accepted Answer

Add 'sales.contoso.com' as a custom domain and verify ownership by adding a DNS TXT record.. When a parent domain (e.g., contoso.com) is verified, all of its subdomains are automatically considered verified. Therefore, sales.contoso.com does not require another TXT record for verification. To host email on the subdomain, you must add sales.contoso.com as a custom domain in the Microsoft 365 admin center and configure the necessary DNS records (MX, SPF, etc.). The verification step is unnecessary because the parent domain is already verified.

Answer

No additional step; subdomains are automatically verified after the root domain is verified.

Answer

Create a subdomain in Exchange Online using the Exchange admin center.

Answer

Modify the SPF record for the root domain to include 'sales.contoso.com'.

Question 13

A company has just purchased Microsoft 365 E3 licenses. They want to configure the default mailbox storage limit for all new users. Which setting should they modify?

Accepted Answer

Microsoft 365 admin center -> Org settings -> Mailbox storage. The correct setting to configure the default mailbox storage limit for all new users in Microsoft 365 is found in the Microsoft 365 admin center under Org settings > Mailbox storage. This allows administrators to set a default storage limit that applies to all new mailboxes. Option C is incorrect because Set-OrganizationConfig -DefaultMailboxSize is not a valid parameter in Exchange Online; mailbox plans are used instead, but the simplest method is via the admin center.

Answer

Exchange admin center -> recipients -> mailboxes -> default mailbox quota

Answer

Microsoft 365 admin center -> Users -> Active users -> default storage limit

Answer

Exchange Online PowerShell: Set-OrganizationConfig -DefaultMailboxSize

Question 14

An administrator wants to add a custom domain 'fabrikam.com' to a new Microsoft 365 tenant. What is the first step the administrator should perform?

Accepted Answer

Add the domain in the Microsoft 365 admin center.. The first step to add a custom domain to a Microsoft 365 tenant is to add the domain in the Microsoft 365 admin center. This initiates the domain verification process, where Microsoft provides a TXT record that the administrator must add to the domain's DNS hosting provider to prove ownership. Without completing this verification step, no other domain-related configurations (such as SPF, MX records, or user licensing) can proceed.

Answer

Create an SPF record for the domain.

Answer

Create a MX record pointing to Exchange Online.

Answer

Assign Microsoft 365 licenses to users with @fabrikam.com addresses.

Question 15

A newly hired Microsoft 365 administrator needs to receive email notifications for all service health incidents. The administrator wants to ensure they have the necessary permissions to configure these notifications. Which role is the minimum role required to manage service health notifications in the Microsoft 365 admin center?

Accepted Answer

Service Administrator. The Service Administrator role is the minimum built-in role that grants permission to manage service health notifications in the Microsoft 365 admin center. This role allows the administrator to view and configure service health alerts and notifications without the broader privileges of the Global Administrator role, aligning with the principle of least privilege.

Answer

Global Administrator

Answer

User Administrator

Answer

Security Reader

Question 16

An administrator has added the custom domain 'fabrikam.com' to their Microsoft 365 tenant and is now ready to verify ownership. Which type of DNS record should the administrator create in the public DNS zone to complete the verification?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, the administrator must create a TXT record in the public DNS zone containing a specific verification string provided by the Microsoft 365 admin center. The TXT record is the standard DNS record type used for domain ownership verification because it can store arbitrary text data without affecting email routing or other services, and Microsoft 365 checks for this record to confirm the domain is under the administrator's control.

Answer

MX record

Answer

CNAME record

Answer

record

Question 17

An administrator is planning to migrate from on-premises Exchange to Exchange Online. The current on-premises environment is Exchange 2016. The company has a hybrid deployment with Azure AD Connect. They want to use the cutover migration method. What is a prerequisite for starting a cutover migration?

Accepted Answer

The on-premises Exchange server must be reachable from the Microsoft 365 migration service via a public endpoint. For a cutover migration from on-premises Exchange 2016 to Exchange Online, the Microsoft 365 migration service must be able to connect to the on-premises Exchange server via a public endpoint. This is because cutover migration uses IMAP or Exchange Web Services (EWS) over HTTPS, requiring the on-premises server to be accessible from the internet without a VPN or private connection. Without this public endpoint, the migration service cannot discover mailboxes or synchronize data.

Answer

The on-premises Exchange server must have the MRS Proxy service installed and running

Answer

TLS certificate must be bound to the on-premises Exchange server for migration authentication

Answer

The administrator executing the migration must have on-premises Exchange Organization Management role

Question 18

You are a Microsoft 365 Administrator for a multinational organization that is deploying a new Microsoft 365 tenant. The organization has strict compliance and security requirements. Which four of the following actions should you take to properly deploy and manage the tenant? Choose all that apply. (There are four correct answers.)

Accepted Answer

Configure password hash synchronization (PHS) from the on-premises Active Directory to Microsoft Entra ID to enable Hybrid Identity.. The correct actions are: 1) Enable Microsoft Defender for Office 365 with Safe Attachments and Safe Links to protect against advanced threats—a critical security baseline. 2) Set a usage location for each user before assigning licenses to comply with regional licensing and data residency requirements. 3) Configure password hash synchronization (PHS) for hybrid identity, which synchronizes password hashes to Microsoft Entra ID and enables features like Identity Protection and leaked credential detection. 4) Create custom RBAC roles to delegate administrative tasks with least privilege, avoiding the need to grant global admin rights. Disabling MFA is incorrect because MFA must be enabled from day one, especially for privileged roles, and the admin center should never be used to manage on-premises AD objects directly; on-premises changes must be made in on-premises AD and synchronized.

Answer

Disable multi-factor authentication (MFA) for all users during the initial deployment to simplify onboarding, and enable it after 30 days.

Answer

Use the Microsoft 365 admin center to directly edit and manage all user objects in the on-premises Active Directory to ensure synchronization consistency.

Question 19

Match each Microsoft 365 plan to its included services.

Accepted Answer

Microsoft 365 Business Basic: Includes Exchange Online, SharePoint, Teams, and web versions of Office apps.. Correct matches: Business Basic = web apps only, Business Standard = desktop apps added, Business Premium = security features added, E3 = enterprise compliance. Common mistakes: confusing Business Basic with Business Standard or attributing Intune to Business Standard.

Answer

Microsoft 365 Business Basic: Includes everything in Business Standard plus advanced security.

Answer

Microsoft 365 Business Standard: Includes Desktop Office apps and Intune.

Question 20

Your company recently deployed Microsoft 365 Copilot. Users report that Copilot occasionally generates responses based on sensitive internal documents that should not be shared broadly. What should you configure to restrict Copilot's access?

Accepted Answer

Apply sensitivity labels to the documents and configure label scopes to exclude Copilot.. Sensitivity labels can be configured with a label scope that excludes Copilot from accessing the labeled content. By applying a 'Confidential' sensitivity label with the 'Copilot' scope deselected, you instruct Microsoft 365 Copilot to ignore those documents during response generation, preventing it from surfacing sensitive internal information.

Answer

Create Data Loss Prevention (DLP) policies to block sharing.

Answer

Remove the sensitive documents from SharePoint Online.

Answer

Configure Microsoft Search to exclude the sensitive documents.