MS-102 Practice Questions (2026): 10 Free Microsoft 365 Administrator Questions with Answers
Ten exam-style questions across all four MS-102 domains — each with the correct answer and a plain-English explanation on click. Score yourself at the end to see if you are exam-ready.
The MS-102: Microsoft 365 Administrator exam is the tenant-wide gate for the Microsoft 365 Certified: Administrator Expert badge. It rewards administrators who have actually run a Microsoft 365 tenant — domains and DNS, Microsoft Entra users, groups and roles, Conditional Access, Microsoft Defender XDR, and Microsoft Purview — not people who only memorised feature names.
Below are 10 free MS-102 practice questions written in the same style as the real exam, spread across all four domains of the 2026 blueprint and weighted toward the heaviest ones. Read each one, pick your answer, then hit Show answer & explanation. Keep score — there is a readiness check at the bottom.
10 MS-102 practice questions
You add the custom domain contoso.com to your Microsoft 365 tenant. Before the domain can be used, Microsoft must confirm you own it. Which DNS record proves ownership?
- An MX record pointing mail to Exchange Online
- The TXT (or MX) verification record with the unique value Microsoft supplies
- A CNAME record for autodiscover
- An SPF record authorizing Microsoft to send mail
Show answer & explanation
To verify a domain, Microsoft gives you a unique TXT (or MX) record to add at your DNS host; it then queries DNS for that value to confirm you control the zone. The routing MX (A), autodiscover CNAME (C), and SPF (D) records are only added after verification to enable mail flow and services — none of them prove ownership.
Every user placed in the "Sales" security group must automatically receive a Microsoft 365 E5 license and lose it when removed from the group, with no manual assignment. What should you configure?
- A dynamic distribution group with a mail-flow rule
- Group-based licensing on the Sales group
- A nightly PowerShell task that runs a license cmdlet
- A Conditional Access policy that grants the license
Show answer & explanation
Group-based licensing assigns a license to a group; members inherit it in near real time and it is removed automatically when they leave the group. A scheduled script (C) works but is not the built-in, self-healing mechanism. Distribution groups (A) handle mail, not licensing. Conditional Access (D) governs sign-in access, not license assignment.
A help-desk technician must reset passwords for non-administrator users and require them to re-register their MFA methods, but must have no other admin rights. Which single built-in Microsoft Entra role is the least-privilege fit?
- Global Administrator
- Authentication Administrator
- User Administrator
- Security Administrator
Show answer & explanation
The Authentication Administrator role can reset passwords and manage or force re-registration of authentication methods (including MFA) for non-admin users — exactly the task and nothing more. Global Administrator (A) grants everything. User Administrator (C) can create and delete users and manage far more than passwords. Security Administrator (D) manages security features, not user credential resets.
You must synchronize users from several disconnected on-premises Active Directory forests into one Microsoft Entra tenant using a lightweight, cloud-managed agent, with no server running a full sync engine or SQL database. Which tool fits?
- Microsoft Entra Connect Sync
- Microsoft Entra Cloud Sync
- Active Directory Federation Services (AD FS)
- Microsoft Identity Manager (MIM)
Show answer & explanation
Entra Cloud Sync uses lightweight agents configured from the cloud and natively supports multiple disconnected forests, with no local SQL or heavy sync server. Connect Sync (A) is the heavier on-premises engine that installs a database and does more provisioning work. AD FS (C) handles federated authentication, not directory sync. MIM (D) is legacy identity management, not the recommended Microsoft 365 sync path.
You must force multifactor authentication for all users who hold privileged directory roles whenever they sign in to the Microsoft admin portals, without affecting standard users. What is the correct design?
- Enable security defaults for the whole tenant
- A Conditional Access policy scoped to directory roles, targeting the Microsoft admin portals, that requires MFA
- Enable per-user (legacy) MFA on every account
- A sign-in risk policy set to block
Show answer & explanation
Conditional Access can scope its assignment to specific directory roles and to the Microsoft Admin Portals app, then grant with "require multifactor authentication" — precise and role-based. Security defaults (A) apply MFA to everyone with no granularity. Per-user MFA (C) hits all users and cannot be scoped by role or app. A risk policy that blocks (D) denies access rather than prompting for MFA.
Users keep setting weak passwords such as "Contoso2026!" that still satisfy complexity rules. You must reject these banned patterns on your on-premises Active Directory, not just in the cloud. What do you deploy?
- Self-service password reset (SSPR)
- Microsoft Entra Password Protection with the DC agent and a custom banned-password list
- A Conditional Access sign-in frequency policy
- Smart lockout only
Show answer & explanation
Entra Password Protection extends Microsoft's global and your custom banned-password lists to on-premises AD by installing the Password Protection proxy plus a domain controller agent, so weak passwords are rejected right at the DC. SSPR (A) lets users reset their own passwords but does not ban weak ones. Sign-in frequency (C) controls re-authentication timing. Smart lockout (D) throttles brute-force attempts but does not evaluate password strength.
You want unknown email attachments detonated in an isolated sandbox before they reach the mailbox, to catch zero-day malware. Which Microsoft Defender for Office 365 feature do you enable?
- Safe Attachments
- Safe Links
- The anti-spam policy
- Zero-hour auto purge (ZAP) only
Show answer & explanation
Safe Attachments opens attachments in a detonation sandbox to detect zero-day malware before the message is delivered. Safe Links (B) rewrites and time-of-click checks URLs, not attachments. The anti-spam policy (C) scores bulk and spam mail. ZAP (D) retroactively removes malicious mail already delivered — it does not pre-detonate attachments.
Security wants to measure how many employees click a fake phishing link and then automatically assign remedial training to those who fail, using native Microsoft 365 tooling. Which feature do you use?
- Attack simulation training in Microsoft Defender for Office 365
- Microsoft Defender Vulnerability Management
- Conditional Access report-only mode
- Microsoft Secure Score recommendations
Show answer & explanation
Attack simulation training launches benign phishing campaigns, tracks who clicks or enters credentials, and can auto-assign targeted training to those who fall for it. Vulnerability Management (B) scans devices for CVEs. Report-only Conditional Access (C) previews policy impact on sign-ins. Secure Score (D) recommends posture improvements but does not run phishing simulations.
Analysts need to run one KQL query across email, identity, endpoint, and cloud-app signals to hunt a token-theft pattern, and view all correlated alerts as a single incident. Where do they work?
- Advanced hunting and Incidents in the Microsoft Defender portal (Defender XDR)
- Microsoft Purview Audit (Premium) search
- Azure Monitor Log Analytics only
- The Microsoft 365 admin center service health page
Show answer & explanation
Microsoft Defender XDR correlates alerts from Defender for Office 365, Identity, Endpoint, and Cloud Apps into unified incidents, and advanced hunting lets you query all those tables with one KQL query in the Defender portal. Purview Audit (B) searches activity logs but does not correlate XDR alerts or expose the hunting schema. Log Analytics (C) is Sentinel/Azure telemetry, not the built-in XDR experience. Service health (D) reports outages, not threats.
You must stop users from sharing files that contain credit-card numbers externally through SharePoint Online, OneDrive, and Teams, and warn them with a policy tip. What do you configure?
- A retention label policy
- A Microsoft Purview DLP policy using the Credit Card Number sensitive info type
- A sensitivity label set to "Confidential"
- An eDiscovery (Premium) hold
Show answer & explanation
A Purview Data Loss Prevention (DLP) policy scoped to SharePoint, OneDrive, and Teams and matching the built-in Credit Card Number sensitive information type can block or restrict external sharing and show the user a policy tip. Retention labels (A) govern how long content is kept or deleted, not sharing. Sensitivity labels (C) classify and can encrypt but do not by themselves block a share based on detected content. An eDiscovery hold (D) preserves content for investigations.
What these questions cover
The 10 questions are weighted to mirror the real MS-102 blueprint, so your score here is a rough proxy for the live exam. These are the four domains and their 2026 exam weights:
Score yourself
Count how many of the 10 you got right before revealing the answer. Then read the band you land in honestly — the goal is a real pass, not a good feeling.
Want the full MS-102 question bank?
These 10 are a taster. The ExamCert MS-102 app runs hundreds of exam-style questions with explanations, timed mocks, and weak-domain tracking — the real exam interface, on your phone.
MS-102 exam FAQ
How many questions are on the MS-102 exam?
Typically 40 to 60 questions in about 120 minutes, mixing multiple choice, multi-select, drag-and-drop, hotspot, and one or more case studies. Case studies lock once you leave them, so read each scenario fully before answering.
What score do I need to pass MS-102?
A scaled 700 out of 1000. Because scoring is scaled, 700 is not the same as 70% correct — harder and case-study items carry more weight.
Is MS-102 still current in 2026?
Yes. MS-102 is the active Microsoft 365 Administrator exam and a requirement for the Microsoft 365 Certified: Administrator Expert certification. The April 2026 blueprint rebalanced the domains so Microsoft Defender XDR is now the heaviest area (30–35%), followed by tenant management and Entra identity — make sure your prep leans into Defender XDR.
Are these MS-102 practice questions enough to pass?
They are essential but not sufficient. MS-102 is hands-on and tenant-wide — practice in a Microsoft 365 developer or trial tenant, configure the admin centers yourself, and use practice questions to find and close weak domains.
ExamCert Team — we build exam-style practice banks and prep apps for 90+ IT certifications. Questions here are original, written to match the MS-102 objectives; they are not real exam items.
Related: MS-102 exam guide · MD-102 Endpoint Administrator guide · Free practice tests