Microsoft MS-102: Identity, Governance and Microsoft 365 Administration

The MS-102 Microsoft 365 Administrator examination is scheduled by Microsoft to retire on November 30, 2026. As of October 10 it remains a current but time-limited exam, not an already retired one. Microsoft's April 2026 study objectives span tenant deployment, identity and access, Defender security operations and Purview compliance management. Within Microsoft certifications, this is a cross-workload administrator role: a candidate needs to understand how several services work together rather than specialize solely in one application or device fleet.

A Microsoft 365 tenant can look orderly while hiding serious operational problems. Shared administrator credentials, unreviewed third-party applications, inconsistent retention policies and poorly controlled guest access may not produce obvious errors until an incident occurs. MS-102 rewards systematic administration of identity, licensing, services, security and governance. The administrator's task is to convert business needs into policies that remain understandable as departments, workloads and external partners change, with enough monitoring to spot when reality drifts away from the approved design. That requires owners for both exceptions and periodic access reviews, not simply an administrator who can edit every setting.

Treat tenant identity as a security architecture

Tenant setup includes domains, service configuration, licensing and administrative delegation. These decisions influence everything from user onboarding to incident recovery. A company merging with another organization may need to reconcile identities, mail routing and application ownership before consolidating services. Record which applications trust which identity provider, how users are matched across directories and how tenant administrators will handle conflicting account identifiers. Document which domain and account structures belong to which business unit, how licenses are assigned and where support responsibilities sit. Poorly planned initial identity design often produces years of exceptions that complicate security audits and frustrate staff working across subsidiaries.

Microsoft Entra identity governance provides the foundation, but users and groups require lifecycle governance. Accounts should be created, modified and retired through approved processes, with group membership based on defensible access needs. Dynamic membership can simplify administration while creating risk if attributes are inaccurate. An employee transferring departments should not automatically retain access to confidential former-team resources. Test joiner, mover and leaver scenarios across all connected workloads rather than confirming only that a directory entry changed. An account disabled in one place may still have lingering permissions elsewhere.

Conditional Access combines signals such as user, application, device and authentication method. It is powerful precisely because those signals interact. A rule demanding compliant devices may block new provisioning, and a geographic restriction may interfere with legitimate travelers. Roll out in report-only or controlled pilot stages as appropriate, preserve emergency access procedures and log why exclusions exist. The deeper concept of Entra Conditional Access helps explain why strong authentication is not a substitute for a coherent access policy across applications.

Administrative roles should enforce least privilege without making operations impossible. Global administrator rights are inappropriate for routine tasks that narrower roles can perform. Privileged Identity Management and reviews can limit standing access, but processes must consider emergencies, approval delays and audited elevation. If a single employee needs to change Exchange settings and troubleshoot Intune enrollment, separate role assignments may be preferable to permanent tenant-wide authority. Verify effective permissions through representative tasks, because names and intentions do not establish whether users can actually perform sensitive actions.

Operate services with measurable reliability

Tenant administration includes coordination across Exchange, SharePoint, Teams and device management. A change to external sharing can affect collaboration, while a domain configuration error may disrupt email flow. Use health dashboards and message-center announcements to distinguish a Microsoft service incident from a local policy regression. A user reporting 'Microsoft 365 is down' may be experiencing a single application, license or Conditional Access failure. Diagnosis should narrow the scope before widespread configuration changes are attempted in response to a vague complaint.

Licensing creates both financial and operational dependencies. Assigning a subscription enables or restricts features, and removing it without a migration plan may affect stored content or security capabilities. Monitor unused licenses alongside business-critical workloads that depend on advanced features. Automation can simplify license assignment, but must account for exceptions such as contractors, shared mailboxes and role changes. Cost optimization is not simply reclaiming every license after short inactivity; it requires understanding the downstream consequence of removing the entitlement.

Workload policies should be consistent without flattening their differences. Teams external access, SharePoint sharing and Exchange transport rules all influence collaboration boundaries, but each service implements distinct controls and user experiences. An administrator needs to identify which layer governs a particular action and when several policies combine. Test a guest collaboration request from invitation through file access and removal, then examine what is logged. A policy may be secure in isolation yet produce confusing user behavior when an independent workload applies a stricter restriction.

Endpoint management is a neighboring responsibility, not synonymous with tenant-level governance. The MD-102 endpoint examination studies device enrollment, policy assignment and application lifecycle in much greater depth. MS-102 candidates should still understand how compliance and device risk participate in access decisions, and how endpoint administrators escalate failures to identity teams. Cross-team runbooks should identify owners and evidence requirements. Without clear escalation, each department may alter a different policy until access is restored, weakening security without ever identifying the actual defect.

Connect Defender alerts to incident response

Defender XDR signals combine evidence from identities, endpoints, email and applications. An incident may begin with phishing, involve stolen credentials and culminate in unusual file access. The security analyst needs correlated evidence rather than isolated alert counts. Administrators should understand which products supply telemetry, how incidents are prioritized and who has authority to contain an affected account or device. Configuring alerts without a response workflow merely creates another queue of notifications that nobody trusts enough to act upon.

Threat investigation benefits from baselines and time context. An unfamiliar sign-in may be legitimate travel, while a familiar device can become compromised after a malicious attachment. Review identities, session activity, mailbox rules and endpoint events together before concluding that one log entry proves an attack. Establish procedures for preserving evidence and documenting decisions. The goal is not maximal alert sensitivity at any cost; overly noisy signals can cause staff to ignore the unusual event that genuinely deserves attention.

Defender for Endpoint policies protect devices through exposure reduction, threat detection and response actions. Security teams need coordination with Intune administrators for configuration and remediation, especially when a device is isolated or must be rebuilt. Test who can initiate a containment action and how the user gets back to productive work after investigation. Distinguish an endpoint security incident from a routine operating-system patch failure. Collapsing both into one help-desk workflow can delay threat response and create unnecessary disruption.

Permissions and audit trails govern security investigations themselves. Analysts may need access to sensitive alerts and user activity, but should not automatically receive broad tenant configuration rights. Review who can change protection settings, suppress incidents and export evidence. A false positive may justify tuning a detection, not disabling it across the organization indefinitely. Incident records should connect the original signal, investigative steps, containment choices and lessons learned so later reviewers understand what occurred and which control changes were justified.

Build Purview governance around data decisions

Information protection and Purview governance help classify and secure sensitive data across workloads. Sensitivity labels and encryption settings need a clear business purpose: protecting legitimate confidential information while enabling necessary collaboration. A label that prevents every external attachment may be appropriate for some documents and counterproductive for ordinary customer correspondence. Pilot with realistic document types and user roles. Governance succeeds when staff recognize what a policy protects and can request legitimate exceptions through a controlled path.

Data loss prevention rules examine content and context across supported services. Blocking all credit-card-like numbers may generate false positives in legitimate business documents, while a weak rule can miss sensitive exports. Review detection logic, notification language and the consequences of policy actions. Security teams should compare incidents with actual business processes and refine rules based on evidence. A DLP dashboard showing a high count is not proof that risk has fallen; it may reveal an overly broad policy or a genuine process failure that needs organizational correction.

Retention and eDiscovery requirements operate over legal and business timescales that may differ from ordinary storage preferences. A record might need to be preserved even after a user's mailbox is removed; other data may require timely deletion. Establish the authority for those decisions and understand holds, retention labels and policies as distinct tools. Test what happens during an employee departure or investigation. A tenant administrator should not promise immediate permanent deletion if a lawful preservation requirement prevents it, or indefinite retention if policy requires disposal.

A mature tenant has regular access reviews, policy owners and documented service changes. Revisit obsolete app permissions, risky exceptions, licensing assignments and retention requirements as the organization evolves. The Microsoft 365 tenant governance discussion supports that operational perspective. For exam preparation, use the April 2026 study objectives and plan around the November retirement deadline. The lasting professional skill is coherent cross-service administration: identity, devices, applications, security and compliance remain connected without requiring unaccountable global access.