MS-102 Deploy and manage a Microsoft 365 tenant — Timed 50 Questions

Question 1

An administrator is onboarding a new custom domain for email in a Microsoft 365 tenant. Which step should be performed first?

Accepted Answer

Add the domain in the Microsoft 365 admin center. Before you can use a custom domain for email or any other service in Microsoft 365, you must first add the domain to the tenant in the Microsoft 365 admin center. This creates the domain object in Azure Active Directory and initiates the verification process. Only after the domain is added can you proceed to verify ownership and configure DNS records.

Answer

Verify domain ownership by adding a TXT record

Answer

Configure DNS records for Microsoft services

Answer

Set the domain as the primary email domain

Question 2

A company wants to prevent their Microsoft 365 tenant from allowing external users to be invited by default. Only specific administrators should be able to invite guests. Which setting should be changed?

Accepted Answer

External Identities – External collaboration settings. The correct setting is under External Identities – External collaboration settings, specifically the 'Guest invite settings' option. By default, this is set to 'Anyone in the organization can invite guest users including guests and non-admins'. Changing it to 'Only users assigned to specific admin roles can invite guest users' restricts guest invitations to designated administrators, meeting the requirement to prevent default external user invitations.

Answer

Conditional Access policy to block external users

Answer

Tenant restrictions

Answer

B2B direct connect

Question 3

A company is planning to migrate from on-premises Exchange to Exchange Online and needs to ensure that mail flow can coexist between the two environments during the transition. Which tool should the administrator use to configure this hybrid deployment?

Accepted Answer

Exchange Hybrid Configuration Wizard. The Exchange Hybrid Configuration Wizard (HCW) is the correct tool because it automates the configuration of coexistence features between on-premises Exchange and Exchange Online, including mail flow routing, free/busy sharing, and OAuth authentication. It generates the necessary connectors and settings to support a hybrid deployment, ensuring seamless mail flow during migration.

Answer

Azure AD Connect

Answer

Microsoft 365 Admin Center

Answer

Exchange Admin Center

Question 4

A company wants to allow users to log in to Microsoft 365 using their existing on-premises Active Directory credentials and ensure that password changes are reflected immediately in the cloud. Which authentication method should be implemented?

Accepted Answer

Federation with AD FS. Federation with AD FS is correct because it allows users to authenticate directly against on-premises Active Directory, and password changes made on-premises are immediately reflected in the cloud since authentication never passes the password hash to Azure AD. This meets the requirement for instant password change propagation without any synchronization delay.

Answer

Password Hash Synchronization (PHS)

Answer

Pass-through Authentication (PTA)

Answer

Azure AD Seamless SSO

Question 5

A newly hired administrator needs to manage user accounts, licenses, and reset passwords. Which portal should they access?

Accepted Answer

Microsoft 365 admin center. The Microsoft 365 admin center (admin.microsoft.com) is the primary portal for day-to-day user administration tasks such as creating and managing user accounts, assigning licenses, and resetting passwords. It provides a unified interface for these common identity and license management operations within a Microsoft 365 tenant.

Answer

Microsoft Entra admin center

Answer

Microsoft 365 Defender

Answer

Azure Active Directory admin center

Question 6

An organization wants to authenticate users using their on-premises Active Directory without synchronizing passwords to Microsoft Entra ID. Which identity model should they choose?

Accepted Answer

Federated identity. Federated identity allows users to authenticate against on-premises Active Directory using protocols such as WS-Federation, SAML 2.0, or AD FS, without synchronizing password hashes to Microsoft Entra ID. This model relies on a trust relationship between the on-premises identity provider and Entra ID, ensuring passwords never leave the local environment.

Answer

Synchronized identity

Answer

Cloud-only identity

Answer

Microsoft-managed identity

Question 7

An administrator has created a new user account in Microsoft Entra ID. To ensure the user has a mailbox in Exchange Online, what is the next step?

Accepted Answer

Assign an Exchange Online license to the user. In Microsoft 365, a user must be assigned an Exchange Online license (part of an E3, E5, or standalone plan) before a mailbox is automatically provisioned in Exchange Online. Without a license, the user object exists in Entra ID but has no mailbox; the license assignment triggers the mailbox creation process within 24 hours.

Answer

Create an Exchange mailbox manually

Answer

Run the Microsoft 365 Setup wizard

Answer

Configure DNS records for the domain

Question 8

An organization has registered the domain contoso.com and added it to their Microsoft 365 tenant. What is the next step to use this domain for user email addresses?

Accepted Answer

Add a DNS TXT record provided by Microsoft to the domain registrar. After adding a custom domain to Microsoft 365, the domain's ownership must be verified by adding a specific DNS TXT record provided by Microsoft at the domain registrar. This verification proves you control the domain and is a prerequisite before you can assign user email addresses or configure other DNS records like MX. Without this step, Microsoft 365 will not trust the domain for email routing.

Answer

Create user accounts with the new domain

Answer

Configure Exchange Online connectors

Answer

Set up MX records for email routing

Question 9

A company has recently signed up for Microsoft 365 Business Premium. They want to change the default domain from onmicrosoft.com to a custom domain they own. Which step must be completed first before the custom domain can be used for user email addresses?

Accepted Answer

Add the custom domain in the Microsoft 365 admin center. Before a custom domain can be used for user email addresses in Microsoft 365, the domain must first be added to the tenant in the Microsoft 365 admin center. This step creates a domain object in Azure AD that allows Microsoft to associate the domain with your tenant and prepare for ownership verification. Without adding the domain first, subsequent steps like DNS verification or user creation cannot proceed because the system has no record of the domain.

Answer

Verify domain ownership by adding a TXT record to the domain's DNS

Answer

Create user accounts with the new domain as their primary email

Answer

Configure email exchange records (MX)

Question 10

An administrator is managing a Microsoft 365 tenant and needs to delegate the ability to reset user passwords to a group of helpdesk staff. The helpdesk staff should not have any other administrative privileges. Which built-in role should the administrator assign?

Accepted Answer

Password Administrator. The Password Administrator role is the correct choice because it grants the specific ability to reset passwords for non-administrator users and manage service requests, without providing broader administrative privileges like managing users, groups, or licensing. This aligns with the principle of least privilege, ensuring helpdesk staff can perform password resets without accessing other sensitive areas of the tenant.

Answer

Global Administrator

Answer

User Administrator

Answer

Helpdesk Administrator

Question 11

An organization has just purchased Microsoft 365 subscriptions and wants to add their custom domain 'fabrikam.com' to the tenant. Which record must they add to their DNS provider to verify domain ownership?

Accepted Answer

TXT record. To verify domain ownership in Microsoft 365, you must add a TXT record provided by the Microsoft 365 admin center to your DNS hosting provider. This TXT record contains a unique verification string that Microsoft checks to confirm you control the domain. MX, CNAME, and SRV records are used for mail routing, service aliasing, and service location, respectively, but they do not serve the purpose of domain ownership verification.

Answer

MX record

Answer

CNAME record

Answer

SRV record

Question 12

An administrator needs to delegate the ability to manage user licenses and assign roles to a junior admin, but without granting them access to the Microsoft 365 admin center's other settings. Which role should the junior admin be assigned?

Accepted Answer

License Administrator. The License Administrator role is the correct choice because it specifically grants the ability to assign and remove licenses for users, as well as manage their location, without providing access to other Microsoft 365 admin center settings like user creation, role assignment, or security features. This role is designed for delegated license management while maintaining least privilege.

Answer

User Administrator

Answer

Global Administrator

Answer

Helpdesk Administrator

Question 13

A company plans to migrate their email from an on-premises Exchange server to Exchange Online. They want to ensure that during the migration, mail sent to users who have already been migrated is delivered to Exchange Online, while mail for non-migrated users is delivered to on-premises. Which type of domain configuration should they use?

Accepted Answer

Split domain. A split domain configuration is required when some mailboxes reside on-premises and others in Exchange Online during a migration. It uses MX records pointing to Exchange Online Protection (EOP) and internal mail flow connectors to route messages for migrated users to Exchange Online and non-migrated users to on-premises, ensuring each mailbox receives mail at its current location.

Answer

Coexistence domain

Answer

Shared domain

Answer

Forwarding domain

Question 14

A new helpdesk administrator needs to be able to reset user passwords and manage user account properties, but should not be able to manage licenses or assign administrative roles. Which built-in role should be assigned?

Accepted Answer

User Administrator. The User Administrator role in Microsoft Entra ID (formerly Azure AD) is the correct choice because it grants permissions to reset passwords and manage user account properties (such as display name, job title, and department) while explicitly excluding the ability to manage licenses or assign administrative roles. This role is designed for helpdesk staff who need to perform user management tasks without elevated privileges over licensing or role assignments.

Answer

Global Administrator

Answer

License Administrator

Answer

Helpdesk Administrator

Question 15

An organization has just purchased Microsoft 365 Business Standard licenses. The administrator adds a new user through the admin center. By default, does the new user receive a welcome email with sign-in instructions?

Accepted Answer

Yes, if the administrator does not clear the 'Send welcome email' checkbox during user creation.. When an administrator adds a new user through the Microsoft 365 admin center, the default behavior is to send a welcome email containing the user's sign-in name and temporary password. The administrator can opt out by clearing the 'Send welcome email in email' checkbox during the creation process. Therefore, the user receives the email unless the administrator explicitly deselects that option.

Answer

Yes, always, regardless of how the user is created.

Answer

No, the administrator must manually send the welcome email using a script.

Answer

No, welcome emails are only sent when using the 'Add multiple users' option.

Question 16

A company has purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. The company wants all new users to have 'fabrikam.com' as their default email domain instead of the onmicrosoft.com domain. How should the administrator achieve this?

Accepted Answer

In the admin center, go to Settings > Domains, select the custom domain, and click 'Set as default'.. Option B is correct because the Microsoft 365 admin center provides a dedicated setting under Settings > Domains to mark a custom domain as the default email domain. Once set as default, all new users will automatically receive a primary email address using that domain instead of the initial onmicrosoft.com domain, without requiring manual changes or additional configuration.

Answer

Update the MX record in the DNS to point to Microsoft 365 with the custom domain.

Answer

Use the Exchange admin center to set the default email address policy to use the custom domain.

Answer

For each new user, manually add an email alias with the custom domain and remove the onmicrosoft.com alias.

Question 17

An organization has just purchased Microsoft 365 Business Standard licenses and has added the custom domain 'contoso.com' to the tenant. The administrator wants all new user email addresses to use '@contoso.com' instead of the default '@contoso.onmicrosoft.com'. How can this be achieved?

Accepted Answer

Set the default domain in the Microsoft 365 admin center to contoso.com. Setting the default domain to 'contoso.com' in the Microsoft 365 admin center ensures that all newly created users automatically receive an email address with the custom domain as their primary SMTP address. This is the standard method because the default domain setting controls the domain appended to new user accounts during creation, eliminating the need for manual changes.

Answer

Change the primary SMTP address for each user manually after creation

Answer

Remove the onmicrosoft.com domain from the tenant

Answer

Edit the user creation PowerShell script to specify the domain

Question 18

An administrator needs to delegate the ability to manage user licenses, assign admin roles, and reset passwords to a group of users, but these users should not be able to modify tenant-level settings or billing. Which built-in role should be assigned?

Accepted Answer

User Administrator. The User Administrator role is the correct choice because it grants the necessary permissions to manage user licenses, assign admin roles (except for a few high-privilege roles like Global Administrator), and reset passwords, while explicitly excluding access to tenant-level settings and billing. This role is designed for delegated user management without granting broader administrative control.

Answer

Global Administrator

Answer

Helpdesk Administrator

Answer

License Administrator

Question 19

A company has purchased Microsoft 365 Business Premium and added a custom domain 'contoso.com' to the tenant. They want all new users to have email addresses like user@contoso.com instead of the default onmicrosoft.com domain. What should the administrator do in the Microsoft 365 admin center?

Accepted Answer

Set the custom domain as the default domain in the Domains settings.. Setting the custom domain as the default domain in the Domains settings ensures that any new user created in the Microsoft 365 admin center automatically receives an email address ending with @contoso.com instead of the default @<tenant>.onmicrosoft.com. This is the correct administrative action because the default domain setting controls the domain suffix applied to new user principal names (UPNs) and email addresses during user creation.

Answer

Add a DNS TXT record for the custom domain.

Answer

Change the primary domain in the tenant's organization profile.

Answer

Update the MX record for the custom domain to point to Exchange Online.

Question 20

An organization has just signed up for Microsoft 365 E3 with the initial domain 'contoso.onmicrosoft.com'. They need to create the first user accounts. What will be the default email address format for these new users if no custom domain is added yet?

Accepted Answer

user@contoso.onmicrosoft.com. When a new Microsoft 365 tenant is created with the initial domain 'contoso.onmicrosoft.com' and no custom domain has been added, the default email address format for new users is user@contoso.onmicrosoft.com. This is because the onmicrosoft.com domain is the default tenant domain provisioned by Azure AD, and all user principal names (UPNs) and email addresses are automatically assigned this suffix until a custom domain is verified and set as the primary domain.

Answer

user@contoso.com

Answer

user@microsoft.com

Answer

user@contoso.microsoft.com