MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Register a custom domain name (e.g., contoso.com) and verify ownership via DNS TXT record.

  Why this is correct

  Registering and verifying a custom domain like contoso.com via a DNS TXT record is one of the first tasks in a Microsoft 365 deployment. It proves you control the domain and allows users to have email addresses and user principal names (UPNs) that match your corporate identity, rather than the placeholder onmicrosoft.com domain. This verification is mandatory before you can configure services like Exchange Online for that domain.

• ✗

  Assign Microsoft 365 licenses to all user accounts before creating the accounts.

  Why it's wrong here

  Licenses cannot be assigned before user accounts exist because license assignment is an attribute of an existing user object in Azure AD. The correct sequence is to create the user accounts, then assign the appropriate Microsoft 365 licenses from the admin center or via PowerShell. Attempting to pre-assign licenses is not only impossible, but will fail because the target user does not yet exist. Also, licensing decisions should be based on user requirements, not made as a prerequisite step.

• ✗

  Configure the default tenant-level password expiration policy to 90 days using the Microsoft 365 admin center.

  Why it's wrong here

  The 90-day password expiration policy is already the default in Azure AD, so changing it to 90 days is unnecessary and has no effect. More importantly, Microsoft now recommends setting passwords to never expire, because expiring passwords often lead to predictable, weak passwords and provide no real protection against modern attacks like phishing and credential stuffing. For a new tenant, you should focus on enabling MFA and conditional access rather than adjusting legacy password expiration policies.

• ✓

  Create the initial global administrator account with a strong, unique password and enable multi-factor authentication.

  Why this is correct

  The initial global administrator account holds the highest level of privilege, so creating it with a strong, unique password and immediately enabling MFA is a critical security baseline for a new tenant. If this account is compromised, an attacker gains full control over the entire directory and any connected services. Use a dedicated, non-personal account and store the credentials securely, and consider creating additional emergency access accounts as well.

• ✗

  Set up a secondary domain as the default email domain to avoid conflicts with the initial onmicrosoft.com domain.

  Why it's wrong here

  The onmicrosoft.com domain is automatically created and remains as the initial login domain; adding a custom domain does not create any conflict. Setting a 'secondary' domain as the default email domain is only a naming convention for new users, not a way to avoid issues with onmicrosoft.com. In fact, you must first register and verify your primary custom domain before you can even add any secondary domains, so this step is misplaced in an initial deployment plan.

• ✓

  Configure tenant-wide service settings such as external sharing for SharePoint and OneDrive.

  Why this is correct

  Configuring tenant-wide service settings, such as external sharing for SharePoint and OneDrive, is an essential governance step during initial deployment. These settings control how users can share content with people outside the organization and help prevent data leakage. You should establish external sharing policies before users start using these services, because retroactively restricting sharing can be both disruptive and error-prone. Other settings like password expiration are less critical than this.

Go deeper

Related to this question