MS-102 Study Notes

Microsoft 365 Certified: Administrator Expert (MS-102)

Exam Overview

• Exam Code: MS-102
• Duration: 100 minutes
• Questions: 40-60 questions
• Passing Score: 700/1000
• Cost: $165 USD

Domain 1: Deploy and Manage a Microsoft 365 Tenant (25-30%)

Tenant Configuration

Microsoft 365 tenant management involves configuring the organizational settings that apply across all Microsoft 365 services:

• Organizational Profile: Set the tenant name, technical contact, privacy profile, and organizational news.
• Microsoft 365 Admin Center: Central hub for managing users, groups, licenses, billing, and service health.
• Custom Domains: Add and verify custom domains using TXT records or CNAME records with the DNS registrar.
• Message Center: Monitor upcoming service changes and Microsoft communications about tenant-wide changes.

User and License Management

• Bulk User Operations: Create users via CSV upload or PowerShell for large-scale provisioning.
• License Assignment: Assign Microsoft 365 E3/E5 licenses, enable/disable specific service plans per user.
• Guest Users: B2B collaboration; guest accounts can be invited from external organizations.
• Deleted Users: Soft-deleted for 30 days; can be restored within the window before permanent deletion.

Microsoft 365 Apps and Services

• Apps Admin Center: Manage Office deployment, update channels (Current, Monthly Enterprise, Semi-Annual).
• Service Health Dashboard: Monitor real-time service health and incident history.
• Microsoft 365 Groups: Unified container with shared mailbox, SharePoint site, Teams channel, and Planner.
• Microsoft Teams Administration: Configure meeting policies, messaging policies, app permission policies.

Domain 2: Implement and Manage Microsoft Entra Identity and Access (25-30%)

Microsoft Entra ID (formerly Azure AD)

• Entra ID Editions: Free (included), P1 (Conditional Access), P2 (PIM, Identity Protection).
• Hybrid Identity: Microsoft Entra Connect Sync synchronizes on-premises AD with Entra ID.
• Password Hash Sync (PHS): Authenticates users in the cloud; hash of hash stored in Entra ID.
• Pass-Through Authentication (PTA): On-premises validation; requires PTA agents on-premises.
• Federation (ADFS): Claims-based authentication; on-premises ADFS handles authentication.

Conditional Access

• Signals: User/group, IP location, device compliance, application, risk level.
• Grant Controls: Require MFA, compliant device, hybrid Azure AD join, approved app, app protection policy.
• Session Controls: Application-enforced restrictions, conditional access app control, sign-in frequency, persistent browser session.
• Named Locations: Define trusted IPs or countries; exclude from MFA requirements or use in risk policies.
• Report-Only Mode: Evaluate policy impact before enforcing; viewable in sign-in logs.

Privileged Identity Management (PIM)

• Eligible vs. Active: Eligible roles require activation; active roles are always assigned.
• Just-in-Time (JIT) Access: Time-bound role activation with MFA and justification.
• Access Reviews: Periodic review of role assignments, group memberships, and application access.
• Approval Workflow: Require designated approvers before role activation.

Identity Protection

• Risk Levels: Low, Medium, High based on ML-detected patterns (leaked credentials, anonymous IP, etc.).
• Sign-in Risk Policy: Automatically require MFA or block based on real-time sign-in risk.
• User Risk Policy: Block access or force password change when user account is considered at risk.
• MFA Registration Policy: Require all users to register for MFA as a baseline.

Multi-Factor Authentication

• Authentication Methods: Microsoft Authenticator, SMS, voice call, OATH hardware tokens, FIDO2 keys.
• Security Defaults: Pre-configured baseline policies; blocks legacy authentication, requires MFA for admins.
• Passwordless: Windows Hello for Business, FIDO2 security keys, Microsoft Authenticator phone sign-in.
• SSPR (Self-Service Password Reset): Enable users to reset their password using registered methods (email, phone, auth app, security questions).

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR (30-35%)

Microsoft Defender for Office 365

• Safe Links: Real-time URL detonation; rewrites links and checks at click time. Plan 1 and Plan 2.
• Safe Attachments: Opens attachments in isolated VM; actions: Monitor, Block, Replace, Dynamic Delivery.
• Anti-phishing Policies: Impersonation protection for specific users/domains; spoof intelligence; mailbox intelligence.
• Anti-spam Policies: Configure spam filter verdicts, bulk email thresholds (BCL), quarantine actions.
• Attack Simulation Training: Run simulated phishing campaigns; track click rates and remediate with training.

Microsoft Defender for Endpoint

• Onboarding Methods: Group Policy, Microsoft Intune, Configuration Manager, local script, VDI script.
• Threat & Vulnerability Management: Exposes security misconfigurations; provides remediation recommendations.
• Attack Surface Reduction (ASR) Rules: Block behaviors commonly used by malware (Office macros spawning processes, etc.).
• Automated Investigation & Response (AIR): Automatically investigates alerts and takes remediation actions.
• Microsoft Secure Score: Percentage-based score measuring organizational security posture with actionable improvements.

Microsoft Defender for Identity

• Sensors: Installed on domain controllers; monitors Kerberos, NTLM, DNS, LDAP traffic.
• Lateral Movement Paths: Visualizes how attackers could move from compromised accounts to sensitive accounts.
• Detected Threats: Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, Golden/Silver Ticket attacks.

Microsoft Defender for Cloud Apps (MCAS)

• Cloud Discovery: Analyzes traffic logs to identify shadow IT; uses risk scoring for 31,000+ apps.
• App Connectors: API-based integration with sanctioned apps (Microsoft 365, Salesforce, Box, etc.).
• Conditional Access App Control: Proxy-based inline protection; real-time session control and activity monitoring.
• Policies: Activity policies, anomaly detection policies, app discovery policies, file policies.

Microsoft Defender XDR

• Incidents: Correlated alerts across Defender products; unified investigation view.
• Advanced Hunting: KQL-based threat hunting across 30+ days of signal data.
• Threat Analytics: Microsoft-curated reports on active threat actors and campaigns.
• Action Center: Centralizes pending and completed remediation actions across Defender products.

Domain 4: Manage Compliance by Using Microsoft Purview (10-15%)

Microsoft Purview Compliance Portal

• Compliance Score: Risk-based score measuring compliance posture; includes improvement actions.
• Compliance Manager: Assess, implement, and track compliance controls for GDPR, ISO 27001, HIPAA, etc.
• Data Map: Automated data discovery across on-premises, multi-cloud, and SaaS sources.

Sensitivity Labels

• Label Scopes: Files & emails, Groups & sites, Meetings, Schematized data assets.
• Encryption: Rights Management Service (RMS) encryption; define usage rights per label.
• Auto-labeling: Client-side (recommended in apps) or service-side (applies automatically based on conditions).
• Label Policies: Publish labels to users/groups; set default label and mandatory labeling requirements.

Data Loss Prevention (DLP)

• Sensitive Information Types (SITs): Pre-built (credit card, SSN, passport) or custom using regex/keywords.
• DLP Policies: Define conditions, actions (restrict access, notify, block, encrypt), and scope (location).
• Locations: Exchange, SharePoint, OneDrive, Teams, Defender for Cloud Apps, Endpoint.
• Endpoint DLP: Extends DLP to Windows 10/11 devices; monitors copy, upload, print, USB actions.

Retention Policies and Labels

• Retention Policies: Blanket retain or delete rules applied to workloads (Exchange, SharePoint, Teams, etc.).
• Retention Labels: Applied item-by-item; can mark records and trigger disposition review.
• Adaptive Scopes: Dynamic policy scope using Entra ID attributes (department, location, etc.).
• Preservation Lock: Makes retention policy immutable; required for SEC 17a-4 / CFTC compliance.

eDiscovery

• Content Search: Basic search across Microsoft 365 locations; export results.
• eDiscovery (Standard): Legal hold + search; preserves content during litigation.
• eDiscovery (Premium): Custodian management, review sets, analytics (near-duplicates, email threading), predictive coding.

Audit and Communication Compliance

• Audit (Standard): 180-day retention; available to all Microsoft 365 organizations.
• Audit (Premium): Up to 1-year (or 10-year with add-on) retention; high-value security events; intelligent recovery insights.
• Communication Compliance: Monitor communications for policy violations (harassment, sensitive info, regulatory requirements).