The Microsoft MS-102 exam measures the work of a Microsoft 365 administrator across tenant configuration, Microsoft Entra identity, Defender XDR, and Purview. Microsoft says the exam and its related Microsoft 365 Administrator Expert certification will retire on November 30, 2026. Anyone preparing to sit the MS-102 exam must confirm an available appointment and use the April 28, 2026 skills outline. The administration skills themselves remain useful even after the exam closes.
A reliable administrator does more than memorize portal locations. They trace a failure to its actual cause, understand which permission or policy controls it, assess the risk of a change, and verify whether the user can work afterward. A good practice environment is a permitted test tenant with nonproduction identities, documented test cases and a reversible change plan. The following exercises emphasize evidence over hopeful clicking.
Verify tenant foundations before changing access
Begin with inventory. Confirm verified custom domains, licensing and group assignments, administrator roles, Microsoft 365 service health and the organization’s support contacts. If mail is delayed, distinguish an unverified domain, incorrect MX records, a routing connector, a transport rule and a service incident before editing DNS. Changing the wrong record can disrupt everyone who uses that domain.
For one onboarding example, create a fictitious employee profile in a test tenant. Record the authoritative identity source, the group’s license assignment, the expected workloads, the domain used for sign-in and the approved owner of each setting. Test the outcome with the least privileged role that can inspect the evidence. Treat service health and message trace as different sources: a green dashboard does not prove one user’s mail flow works.
Restore user access without weakening Conditional Access
For an employee who can sign in to one application but not another, inspect the sign-in log, application assignment, device state, Conditional Access evaluation, authentication method and the exact failure code. A sign-in blocked by device compliance is not necessarily an MFA failure. Report-only tests can show which rule would apply before administrators enforce a wider policy; access should not be restored by disabling safeguards across the whole tenant.
Keep emergency administrator access separately controlled, monitored and tested. Use privileged-role activation and time-limited permissions where available, and document who approves exceptions. When exploring Conditional Access policies, ask what a specific employee, contractor and emergency account should experience in a normal sign-in and a compromised-device scenario. Capture the observed result rather than assuming the intended rule took effect.
Trace hybrid identity changes to their source
Hybrid organizations may synchronize account attributes from Active Directory Domain Services to Microsoft Entra ID through supported synchronization services. Before editing a user’s name, group or account status, establish which directory is authoritative for that attribute, how changes are filtered and when the last successful synchronization occurred. A cloud-side edit can be overwritten when an on-premises value is authoritative.
Build a controlled failure case: a newly hired test user appears in the local directory but not in Microsoft 365. Check connector health, scope filtering, duplicate identifiers, provisioning or export errors, and synchronization timing. A repeatable incident note should name the failing stage and the verification step. Do not broadly disable synchronization or delete and recreate identities merely to clear a queue.
Troubleshoot endpoints and collaboration as separate dependencies
Intune enrollment, compliance reporting and application protection answer different questions. A device might enroll successfully but fail a compliance condition; an application might be protected even when the device is personally owned. For an endpoint blocked from a sensitive SharePoint library, compare the device’s measured state with the rule actually evaluated in Entra sign-in logs. Test remediation on a limited ring before expanding policy changes.
For Microsoft Teams, SharePoint, OneDrive and Exchange Online, distinguish service-specific policy from tenant-wide identity. A user with a valid license might still lack site permissions; a Teams guest’s access may depend on cross-tenant settings; an Exchange delivery failure needs message-trace evidence. Resist the habit of treating every collaboration error as a password or licensing problem.
Investigate security incidents from evidence rather than dashboards alone
Defender XDR consolidates signals from different security services, but an alert is a lead, not a final incident explanation. Identify the affected account or device, the timeline, correlated alerts, persistence or lateral movement indicators and the response action’s side effects. Before isolating an endpoint or revoking a session, confirm the operator’s authority, the risk to business operations and the evidence that must be preserved.
Practice writing a two-level incident report. The technician’s section lists alert identifiers, timestamps, affected assets and remediation verification. The manager’s section explains the decision, the remaining business exposure and who owns follow-up work. Escalation should preserve the facts needed for investigation rather than replacing them with a generic “incident resolved” note.
Apply Purview controls with a defensible data decision
Purview retention, sensitivity labels, audit and data loss prevention (DLP) address different data-governance needs. A sensitivity label can affect protection and user handling; DLP can detect or constrain certain sharing scenarios; retention and legal holds can preserve content beyond a user’s ordinary deletion request. Do not assume that one setting overrides every other policy or that clearing a document from the interface permanently removes regulated records.
Use a sample confidential file to map its owner, label, sharing permissions, retention requirement and audit evidence. Then simulate an external sharing attempt in an authorized test environment. Record whether the label, DLP policy, site configuration or identity rule produced the observed result. The useful skill is explaining the interaction, not simply finding a toggle in the portal.
Complete one cross-workload support exercise
Consider a contractor who receives an invitation to collaborate on a project but cannot open a confidential SharePoint document on a managed laptop. Start with the invitation and the user’s actual identity, then inspect cross-tenant access, app assignment, sign-in logs, device compliance, site permissions, the document’s label and any DLP event. Each check rules out a distinct failure domain; do not disable Conditional Access and DLP together to make the test pass.
Before changing any policy, write a hypothesis, smallest safe test, expected evidence and rollback condition. After a scoped fix, ask the contractor to repeat the workflow, check the audit trail and confirm that an unapproved second account remains blocked. That final negative test matters: restoring one user’s access is incomplete if the workaround quietly widens access for everyone.
Prepare for MS-102 responsibly in the retirement window
Map the practice exercises to the four official objective groups: tenant deployment and management; Microsoft Entra identity and access; Defender XDR security and threats; and Purview compliance. For an exam appointment before November 30, 2026, compare the April 28 skills guide with the version and language of the scheduled test, then focus revision on the decisions you cannot yet justify with evidence.
If there is not enough time for an eligible examination appointment, do not buy old MS-102 material as though it creates a new path to the retired credential. Keep the lab notes as a Microsoft 365 administration portfolio and consult Microsoft’s current certification catalog for an active route. A useful administrator can explain the safe change, its observed result and its recovery procedure whether or not a particular exam remains available.