MS-102: Microsoft 365 Tenant Security and Administration

MS-102, Microsoft 365 Administrator, examines how an administrator coordinates the tenant-wide environment across identity, security, and compliance services. The role spans users and groups, Microsoft Entra access controls, Microsoft Defender XDR, Microsoft Purview, and operational governance. It is not merely a general overview of Microsoft 365 apps. Microsoft currently lists November 30, 2026 as the scheduled retirement date for MS-102; as of October 10, the exam remains in its final availability period. Candidates should confirm current registration dates and future credential pathways on Microsoft Learn, and should not confuse a scheduled retirement with a retirement that has already happened.

Establish tenant governance before workload settings

Tenant governance determines how identity, subscriptions, domains, roles, and shared services are administered. Administrators need to understand the difference between a global tenant setting and a configuration belonging to Exchange, Teams, SharePoint, or another workload. Changing a domain, licensing assignment, or role can affect several dependent services. A safe operating model documents role ownership, break-glass access, subscription inventory, service health, and change approval. Administrators should avoid granting broad global permissions as a convenient substitute for investigating the appropriate role and scope.

The tenant often has a mixture of cloud-only and hybrid identities. Directory synchronization, verified domains, and organization-specific identity requirements influence user creation and lifecycle procedures. Administrators must understand when a user account becomes available for licensing and workload access, and how removal or suspension affects mailbox, files, Teams membership, and security monitoring. A joiner, mover, and leaver process is more than a human resources event; it is a sequence of access and data decisions that should be tested against real business policy.

Design Microsoft Entra access with least privilege

Identity is a common control plane for Microsoft 365. Users, groups, administrative roles, and authentication methods determine who can reach applications and who can change policies. Multi-factor authentication and Conditional Access strengthen access decisions, but their effectiveness depends on trusted signals and good exception design. A policy might require additional authentication from an unfamiliar location or block a risky sign-in, yet the organization must ensure it does not lock out administrators from performing emergency recovery. Dedicated emergency accounts require monitoring and protection instead of becoming unnoticed backdoors.

Privileged roles should be assigned only to people who need the capabilities and for as long as needed. Access reviews, role activation mechanisms where licensed and supported, and strong authentication can reduce standing privilege. External users need defined sponsorship, expiry, and sharing rules. A team should distinguish users who can manage a service from those who can simply use it. The relationship with Microsoft Entra identity security is important because compromises involving privileged identity can spread across applications. However, stronger identity controls do not remove the need for application-specific access governance.

Coordinate security signals through Defender XDR

Microsoft Defender XDR brings signals from several security capabilities into an investigation and response experience. An administrator must understand what licenses, onboarding, permissions, and integrations are needed for relevant alerts to exist. A missing alert does not necessarily prove that an endpoint or mailbox is safe; it may mean a signal source was not configured or reporting correctly. Security dashboards should be interpreted through coverage, context, and evidence. The administrative task includes preserving reliable telemetry and arranging incident ownership, not personally performing every deep forensic investigation.

Threats can cross email, device, identity, and cloud-application boundaries. A malicious attachment may lead to an endpoint compromise and suspicious identity activity. Investigation requires correlating events rather than treating each alert as unrelated. Defender for Endpoint deployment, Defender for Office 365 protections, and identity detection capabilities can contribute to this picture where enabled. Administrators should know how to navigate incidents, interpret severity, escalate appropriately, and coordinate approved containment actions. Broad automated actions can disrupt business operations, so response permissions and escalation playbooks need deliberate design.

Use Purview for information governance and compliance

Microsoft Purview capabilities address information protection, retention, data loss prevention, audit evidence, and related governance needs. A sensitivity label expresses how content should be handled; a retention policy expresses preservation or disposal requirements. Those functions are not equivalent. A document marked confidential may still be retained or deleted according to a separate policy. DLP controls can reduce unapproved sharing, but they depend on locations, classification, policy conditions, exceptions, and the specific behavior of supported workloads. Compliance requires business and legal input, not just selecting a strict-looking default.

A good administrator works through actual scenarios. A user needs to share a document with an approved external partner; what labels, sharing permissions, and DLP rules apply? A departing employee leaves sensitive records in Teams and OneDrive; what retention obligations and ownership transfer processes are relevant? A security investigator requests audit records; which events were captured and for how long? These questions should be resolved with policy owners before deployment. The Microsoft 365 administration perspective is valuable because identity, security, collaboration, and compliance have to be considered as a connected tenant service.

Operate users, groups, and workload dependencies

User and group management is a routine administrative function with unusually broad consequences. Dynamic group rules and group-based licensing can simplify assignments, yet unexpected membership changes may grant or remove several workload entitlements at once. A reliable process tracks group ownership, guest access, license availability, and approval of privileged or sensitive memberships. Administrators should plan how to handle users with multiple roles, shared mailboxes, service identities, and accounts disabled during extended leave. The goal is a consistent lifecycle that can be audited without requiring manual intervention for every common event.

Workload administrators may own Exchange Online, SharePoint, Teams, and endpoint policies, but tenant-level changes still require coordination. For example, a new Conditional Access rule can interrupt collaboration even if no Teams setting changed. A DLP policy may affect file-sharing patterns across SharePoint and Teams. A compromised endpoint can lead to action in identity and messaging services. When responsibilities are split among teams, the MS-102 administrator must know where a configuration belongs and who has authority to approve or remediate it. Escalation should be organized around the affected control plane, not the interface in which the symptom first appeared.

Monitor service health and incident readiness

Operational administration includes change communications, service health, configuration review, audit records, and incident procedures. Microsoft 365 is continuously updated, so teams should distinguish a service incident from a local policy error or integration problem. Monitoring should cover whether key protection services remain active and whether security or compliance exceptions are increasing. A successful tenant strategy does not depend on an administrator noticing problems manually during occasional portal visits. Meaningful alerts need ownership, severity definitions, and tested communication channels.

Recovery planning needs to address account lockout, compromised privileged access, failed synchronization, accidental policy deployment, and loss of a critical external service. Teams should preserve appropriate break-glass arrangements and rehearse their use under controlled conditions. If a new Conditional Access policy unexpectedly blocks an entire department, administrators must know how to identify the responsible policy and restore access without disabling every identity protection. A recovery method that undermines security permanently is not a successful recovery. Documented evidence of the incident and correction helps improve the next change.

Prepare for MS-102 using cross-service scenarios

An effective practice case starts with a new employee: identity is provisioned, groups and licenses are applied, appropriate device and sign-in conditions are enforced, collaboration becomes available, and audit expectations are met. A second case involves a suspected compromised account: the team investigates the sign-in, reviews Defender incidents, contains access if warranted, and evaluates whether sensitive content was shared. These cases force candidates to connect services whose individual settings may be familiar. They also make it easier to distinguish administrator responsibilities from the work of specialized security analysts and compliance officers.

Because MS-102 is scheduled to retire on November 30, preparation decisions are time-sensitive. Someone already close to sitting the exam may evaluate their remaining testing opportunity against Microsoft's current registration rules. Someone starting a longer certification journey should review the active catalog and newer administration-focused credentials. The historical skills do not become irrelevant on retirement: identity lifecycle, Defender signal coverage, Purview governance, and workload coordination continue to matter in production. What changes is whether the old exam code can still be used to earn the associated certification. That distinction should remain explicit in any advice to candidates.

An important additional scenario is an acquisition in which two organizations retain separate Microsoft 365 tenants temporarily. Their users may need shared collaboration while identity, domains, licensing, retention policies, and privileged roles remain independently governed. Administrators should avoid assuming that enabling cross-tenant collaboration is equivalent to merging directories. They must document which tenant owns each record, how guest identities and access reviews work, and what audit evidence each organization can obtain. A move to a single tenant, if approved, introduces its own migration and business-continuity risks. Identity planning, application access, and document retention decisions should be addressed before users are given a new sign-in experience.

A second case concerns a large number of suspicious sign-ins following a credential compromise. The organization needs to identify affected accounts, check relevant identity and Defender evidence, prioritize privileged users, and coordinate containment with application owners. Resetting a password alone may not address every active session or compromised device, while disabling hundreds of accounts without validation may interrupt essential operations. The administrator must follow approved response procedures, preserve evidence as appropriate, and verify that access has been restored safely after remediation. This is a practical demonstration of why identity, security telemetry, and tenant administration cannot be planned as isolated disciplines.

The retirement period adds an operational consideration for certification teams. A training plan intended to run into December should not depend on taking MS-102 after its announced November retirement. The candidate should confirm the official scheduling details, distinguish study-guide availability from exam availability, and assess skills against current administration roles. This is particularly important when a team funds training based on an internal career framework: the expected evidence of competence should remain meaningful after the exam code changes.