Home Certifications Pricing FAQ Partners Blog

·EN·DE·FR·ES·PT

Microsoft · MS-102 · Expert

Microsoft 365 Administrator (MS-102) — Practice Questions and Mock Exam

The MS-102 certification validates expertise in deploying and managing Microsoft 365 tenant services, including identity synchronization, security and compliance, and Microsoft 365 workload management.

Practice for free Try a practice question first

Try a practice question first Practice for free

Start practicing MS-102 free Buy MS-102 access for $29.99

50Questions per Pass-IT mock exam

100minPass-IT mock exam time limit

Official MS-102 exam: 700 out of 1000 points to pass.

Checked against Microsoft · August 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a MS-102 sample question and read the explanation with its source. Right here, with no sign-up.

Implement and manage Microsoft Entra identity and access1 / 5

True or False: Microsoft Entra Conditional Access can evaluate device compliance status from Microsoft Intune as a condition for granting or blocking access.

AlexFull explanation from Alex

True. Microsoft Entra Conditional Access evaluates device compliance from Intune as a grant control. When 'Require device to be marked as compliant' is configured, Entra ID checks the device's Intune compliance status before granting access. Intune evaluates devices against compliance policies (encryption, OS version, antivirus) and reports status to Entra ID. Non-compliant or unregistered devices are blocked across Windows, iOS, Android, and macOS. Distractor: False is incorrect — this is a core Conditional Access + Intune integration. Ref: learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant

Sourcelearn.microsoft.com

Manage security and threats by using Microsoft Defender XDR2 / 5

You need to configure the Microsoft 365 Defender app connector for Microsoft 365 in Defender for Cloud Apps. What does this connector provide?

AlexFull explanation from Alex

The M365 app connector in Defender for Cloud Apps provides API-based visibility into Office 365 activities, files, and user accounts. It pulls audit logs from Exchange Online, SharePoint, OneDrive, and Teams via Microsoft Graph APIs for threat detection and policy enforcement. Distractors: Endpoint protection is Defender for Endpoint's role. Network traffic analysis uses network tools, not API connectors. Real-time session control requires Conditional Access App Control with a reverse proxy. App connectors operate at the API layer, polling activity data rather than intercepting traffic inline. Ref: learn.microsoft.com/en-us/defender-cloud-apps/protect-office-365

Sourcelearn.microsoft.com

Manage compliance by using Microsoft Purview3 / 5

You need to monitor how sensitivity labels are being used across your organization. Which Microsoft Purview tool shows the volume and distribution of labeled content across Exchange, SharePoint, and OneDrive?

AlexFull explanation from Alex

Content Explorer shows a current snapshot of items with sensitivity labels, retention labels, or sensitive information types across Exchange, SharePoint, and OneDrive (learn.microsoft.com/purview/data-classification-content-explorer). Admins can drill down to specific items and locations. Why others are wrong: Activity Explorer tracks actions performed on labeled content (label applied, changed, removed, files shared) rather than content inventory. The DLP alerts dashboard shows policy violations, not label distribution. Compliance Manager tracks regulatory compliance posture against frameworks, not labeled content. Requires Content Explorer List Viewer or Content Viewer roles. Exam tip: Content Explorer = what is labeled and where; Activity Explorer = what actions were taken on labeled content.

Sourcelearn.microsoft.com

Implement and manage Microsoft Entra identity and access4 / 5

You need to choose between Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync for identity synchronization. Your organization has a single Active Directory forest with 50,000 users and requires pass-through authentication. Which solution should you choose?

AlexFull explanation from Alex

Connect Sync is required because Cloud Sync does not support pass-through authentication (PTA). Microsoft's feature comparison confirms PTA Config: Connect Sync ✓, Cloud Sync ✗. Cloud Sync is lightweight and cloud-managed, ideal for disconnected forests but lacks PTA, device sync, ADFS integration, and advanced sync rules. Distractors: Cloud Sync cannot fulfill the PTA requirement. Manual Graph API provisioning doesn't support PTA. 'Either solution' is wrong since Cloud Sync explicitly lacks PTA. Ref: learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/connect-to-cloud-sync-decision-guide

Sourcelearn.microsoft.com

Deploy and manage a Microsoft 365 tenant5 / 5

Contoso protects all its SharePoint Online sites by using Microsoft 365 Backup. A ransomware attack encrypted the content of 400 sites. The sites must be returned to their state before the attack as quickly as possible, and users must keep working with the existing site URLs. Which restore option should you use?

AlexFull explanation from Alex

Microsoft 365 Backup restores OneDrive accounts and SharePoint sites either in place, to the same URL, or to a new URL. For full site restores, the fastest recovery comes from an in-place restore, and choosing one of the recommended express restore points shown in the restore workflow speeds it up further. Standard restore points work, but they can be significantly slower, especially for small restores. A new URL restore would also break the requirement that users keep their existing links. Granular file restores are meant for a single file or folder, not for 400 encrypted sites. Exam tip: for mass ransomware recovery, Microsoft's own guidance points to in-place restores from express restore points.

Sourcelearn.microsoft.com

Create a free account

How to prepare for MS-102 with Pass-IT.

Currently 416 practice questions for MS-102, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Conversation preview · MS-102

Device compliance and access

You
Can Conditional Access use a device’s Intune compliance status?
Alex · AI tutor
Yes. It can require a device to be marked compliant before granting access.
Read the Microsoft documentation ↗
You
Which service determines that compliance status?
Alex · AI tutor
Intune evaluates device compliance. Conditional Access uses that status in the access decision.
Read the Microsoft documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

MS-102 · Question excerpt

Device compliance and access

View the full question

True or False: Microsoft Entra Conditional Access can evaluate device compliance status from Microsoft Intune as a condition for granting or blocking access.

Understand the correct answer.

True

Intune device compliance can inform a Microsoft Entra Conditional Access decision.

Read the Microsoft documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your MS-102 mock exam

Questions: 50
Minutes: 100

Illustration of an exam session

Start
Answer questions
Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for MS-102.

Exam topics, relevant practice and sources you can check.

Tenant, users and administrative roles25–30% of the exam112 QuestionsPass-IT questions

Configure a Microsoft 365 tenant and manage its users, services and permissions.

Create tenants and domains, configure organization settings, monitor service health, connectivity, updates and adoption, and manage Microsoft 365 Backup.
Manage internal and external users, contacts, groups, shared mailboxes and licenses, and perform bulk administration with Graph and Entra PowerShell.
Assign Microsoft 365 and Entra roles, workload role groups, administrative units and privileged role access through PIM.

Official Microsoft objectives

Identity synchronization and secure access25–30% of the exam117 QuestionsPass-IT questions

Connect directory identities and manage how users authenticate and gain access.

Prepare directories for synchronization, configure Connect Sync or Cloud Sync, monitor with Connect Health and resolve synchronization problems.
Configure authentication methods, self-service password reset and Entra Password Protection, and investigate and resolve sign-in failures.
Plan and implement Identity Protection and Conditional Access, including multifactor authentication requirements.

Official Microsoft objectives

Threat protection with Defender30–35% of the exam125 QuestionsPass-IT questions

Configure Defender protection and investigate threats across Microsoft 365.

Review and respond to Secure Score and exposure findings, Defender XDR incidents, alerts and reports and threat intelligence, including advanced hunting.
Configure Defender for Office 365 threat and alert policies, investigate email and collaboration attacks, run training simulations and manage restricted entities.
Onboard devices to Defender for Endpoint, configure settings and review and address vulnerabilities.
Configure Defender for Cloud Apps connectors, policies and discovery, interpret activity logs and respond to discovered risks.

Official Microsoft objectives

Information protection and data loss prevention10–15% of the exam62 QuestionsPass-IT questions

Classify information, control retention and respond to data-loss risks with Purview.

Define sensitive information types, retention and sensitivity labels and policies, then monitor label use in explorers and reports.
Configure data loss prevention for Microsoft 365 services, Copilot and endpoints.
Review DLP alerts, events and reports and take appropriate response actions.

Official Microsoft objectives

Question formats you can practice

Multiple Choice: Select one answer.
Multiple Response: Select multiple applicable answers.
True / False: Decide whether statements are true or false.
Drag & Drop: Match items to the appropriate targets.
Ordering: Put steps in the correct order.
Dropdown: Choose the appropriate entry from a dropdown list.

These are Pass-IT practice formats. Check the Microsoft certification page for the official exam information.

How we review questions

Source check: The answer, answer options and explanation are checked against official documentation. We call this canonical validation.

Adversarial review: An additional AI reviewer specifically looks for factual errors, ambiguous answers and weaknesses in the explanation.

Learning objectives: We count specific exam topics with clearly linked exercises. Subheadings are not counted separately.

The figures refer to available questions in each MS-102 exam domain. The additional review count includes matching review logs for the current question version, even if errors were found. It is not an error-free rate.

The date shows the latest matching evidence or log entry in each domain. An import or transfer of an existing review result can update this entry. This does not mean the entire question pool has been reviewed again.

Review methods and criteria in detail

The ranges describe the weighting of exam topics. See Official Microsoft objectives for the current exam objectives.

Frequently asked questions

Your preparation

How much study time should I plan for MS-102?

For planning, Pass-IT estimates roughly 35–85 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam.

How long does my MS-102 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the MS-102 exam

Where can I take the MS-102 exam?

Pearson VUE online proctored or at authorized testing centers worldwide.

How long is the Microsoft 365 Administrator exam?

The MS-102 exam has 50 questions and a 100-minute time limit.

Is MS-102 being retired?

Yes. The exam stops being offered after 30 November 2026. A certification you have already earned stays valid for its normal term, but if you are planning a first attempt you have a fixed window rather than an open one.

How often do you renew MS-102?

Every year, through the free renewal assessment on Microsoft Learn, which opens six months before expiry. That renewal path is unaffected by the exam itself being withdrawn for new candidates.

What happens if you fail MS-102?

You can retake after 24 hours, then after 14 days for subsequent attempts, up to five per 12-month period. With the exam retiring at the end of November 2026, those waits eat into a closing window.

Your preparation for MS-102

$29.99one-time

12 months of access for MS-102 · No automatic renewal

Buy MS-102 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →