MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your company is deploying Microsoft 365 for a new subsidiary with 500 users. You need to configure the initial tenant with a custom domain (contoso.com) and verify ownership. What is the first step you must perform?
⚠ Common exam trap
It's easy for candidates to confuse the order of operations, thinking they can set the domain as default or create users first, but Microsoft 365 strictly requires domain ownership verification before any domain-based configuration can proceed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a TXT record provided by Microsoft 365 to the contoso.com DNS zone.
To verify ownership of a custom domain in Microsoft 365, you must prove you control the domain's DNS zone. Microsoft provides a unique TXT record value that you add to the public DNS zone of contoso.com. Once the TXT record propagates, Microsoft queries it and confirms ownership, allowing you to proceed with domain configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delegate the contoso.com zone to Microsoft 365 DNS servers.
Why it's wrong here
Do not delegate the contoso.com zone to Microsoft 365 DNS servers. Microsoft 365 does not act as a public DNS authoritative server for arbitrary customer domains; delegation would require changing NS records at the registrar to Microsoft nameservers, which is unsupported and would disrupt existing mail, web, and other services. Domain verification only requires adding a single TXT record to prove ownership—it does not require handing over control of the entire DNS zone. DNS delegation is an optional, separate step used only if you want Microsoft 365 to manage your public DNS records, and it is irrelevant to the verification process.
- ✗
Create user accounts with the custom domain before verification.
Why it's wrong here
You cannot create user accounts with contoso.com before verifying the domain. Microsoft 365 will not allow you to assign an unverified custom domain as a user's UPN or email domain because it has no way to prove you own it, and the initial directory is scoped to the initial onmicrosoft.com domain. Attempting to use an unverified domain will result in errors or rejected provisioning because the domain is not yet marked as accepted and verified in the tenant. Verification must be completed first, after which the domain becomes available for user accounts, mailboxes, and other services.
- ✓
Add a TXT record provided by Microsoft 365 to the contoso.com DNS zone.
Why this is correct
Adding the TXT record provided by the Microsoft 365 domain setup wizard is the correct verification method. The wizard generates a unique TXT record value that you must publish in the public DNS zone of contoso.com; Microsoft 365 then queries the DNS to confirm the record exists and matches, proving your control over the domain. This TXT record is a one-time verification token and is separate from any SPF or DKIM TXT records. Once Microsoft 365 detects the record, the domain status changes to 'Verified' and you can proceed with configuring services and creating users.
- ✗
Set contoso.com as the default domain in the Microsoft 365 admin center.
Why it's wrong here
Setting contoso.com as the default domain in the Microsoft 365 admin center is not a valid verification method; it is an administrative action that can only be performed after the domain is already verified. The default domain setting simply defines which domain suffix is used when creating new user accounts and assigning UPNs, and it cannot be applied to an unverified domain because the admin center will block it. This action has no effect on proving ownership and is completely unrelated to domain verification. Therefore, this option is incorrect because verification must precede any such configuration.
Visual reference
Go deeper
Related to this question
Learn chapter
Custom Domain Management in Microsoft 365
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Custom domain
A custom domain is a personalized internet address (like contoso.com) that you can use with cloud services instead of the default domain provided by the service provider.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.