Microsoft 365 Administrator Exam (MS-102) Exam Practice Questions & Study Guide 2026

Question 1

You have a Microsoft 365 E5 subscription that uses Microsoft intune.in the Microsoft Endpoint Manager admin center, you discover many stale and inactivedevices,You enable device clean-up rulesWhat can you configure as the minimum number of days before a device a removedautomatically?

A. 10  
B. 30  
C. 45  
D. 90  

Show Answer

Question 2

You have a Microsoft 365 subscription. You need to identify which administrative users performed eDiscovery searches during the past week. What should you do from the Security & Compliance admin center?

A. Perform a content search  
B. Create a supervision policy  
C. Create an eDiscovery case  
D. Perform an audit log search  

Show Answer

Question 3

You have a Microsoft 365 subscription.You configure a new Azure AD enterprise application named App1. App1 requires that auser be assigned the Reports Reader role.Which type of group should you use to assign the Reports Reader role and to accessApp1?

A. a Microsoft 365 group that has assigned membership  
B. a Microsoft 365 group that has dynamic user membership  
C. a security group that has assigned membership  
D. a security group that has dynamic user membership  

Show Answer

Question 4

Note: This question is part of a series of questions that present the same scenario.Each question in the series contains a unique solution that might meet the statedgoals. Some question sets might have more than one correct solution, while othersmight not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As aresult, these questions will not appear in the review screen.You have a Microsoft 365 E5 subscription.You create an account for a new security administrator named SecAdmin1.You need to ensure that SecAdmin1 can manage Microsoft Defender for Office 365settings and policies for Microsoft Teams, SharePoint, and OneDrive.Solution: From the Microsoft 365 admin center, you assign SecAdmin1 the ExchangeAdministrator role.Does this meet the goal?

A. Yes  
B. No  

Show Answer

Question 5

Your network contains an on-premises Active Directory domain named contoso.local. Thedomain contains five domain controllers.Your company purchases Microsoft 365 and creates an Azure AD tenant namedcontoso.onmicrosoft.com.You plan to install Azure AD Connect on a member server and implement pass-throughauthentication.You need to prepare the environment for the planned implementation of pass-throughauthentication.Which three actions should you perform? Each correct answer presents part of thesolution.NOTE: Each correct selection is worth one point.

A. From a domain controller install an Authentication Agent  
B. From the Microsoft Entra admin center, confiqure an authentication method.  
C. From Active Director,' Domains and Trusts add a UPN suffix  
D. Modify the email address attribute for each user account.  
E. From the Microsoft Entra admin center, add a custom domain name.  
F. Modify the User logon name for each user account.  

Show Answer

Question 6

You have a Microsoft 365 subscription that uses Security & Compliance retention policies.You implement a preservation lock on a retention policy that is assigned to all executiveusers.Which two actions can you perform on the retention policy? Each correct answer presentsa complete solution.NOTE: Each correct selection is worth one point?

A. Add locations to the policy  
B. Reduce the duration of policy  
C. Remove locations from the policy  
D. Extend the duration of the policy  
E. Disable the policy  

Show Answer

Question 7

You have a Microsoft 365 E5 subscription. From the Microsoft 365 Defender portal, you plan to export a detailed report ofcompromised users.What is the longest time range that can be included in the report? 

A. 1 day  
B. 7 days  
C. 30 days  
D. 90 days  
Answer: C 

Show Answer

Question 8

Note: This question is part of a series of questions that present the same scenario.Each question in the series contains a unique solution that might meet the statedgoals. Some question sets might have more than one correct solution, while othersmight not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As aresult, these questions will not appear in the review screen.You have a Microsoft 365 subscription.From the Microsoft 365 Defender, you create a role group named US eDiscoveryManagers by copying the eDiscovery Manager role group.You need to ensure that the users in the new role group can only perform content searches of mailbox content for users in the United States. Solution: From the Microsoft 365 Defender, you modify the roles of the US eDiscovery Managers role group. Does this meet the goal?

A. Yes  
B. No  

Show Answer

Question 9

You have a Microsoft 365 tenant that contains 1,000 Windows 10 devices. The devices areenrolled in Microsoft Intune.Company policy requires that the devices have the following configurations:Require complex passwords.Require the encryption of removable data storage devices.Have Microsoft Defender Antivirus real-time protection enabled.You need to configure the devices to meet the requirements.What should you use?

A. an app configuration policy  
B. a compliance policy  
C a security baseline profile  
D a conditional access policy  

Show Answer

Question 10

You have a Microsoft 365 E5 subscription that has Microsoft Defender for Endpointintegrated with Microsoft Endpoint Manager.Devices are onboarded by using Microsoft Defender for Endpoint.You plan to block devices based on the results of the machine risk score calculated byMicrosoft Defender for Endpoint.What should you create first?

A. a device configuration policy  
B. a device compliance policy  
C. a conditional access policy  
D. an endpoint detection and response policy  

Show Answer