Deploy and manage a Microsoft 365 tenant — MS-102 Practice Quiz

Question 1

Your organization recently acquired a new business unit that owns the domain contoso-retail.com, registered with a third-party registrar. As the Microsoft 365 administrator, you need to add this domain to your existing tenant so users can receive email at the new domain. After you click 'Add domain' in the Microsoft 365 admin center and enter contoso-retail.com, what must you do next to prove that your organization owns the domain?

Accepted Answer

Add the TXT (or MX) verification record provided by Microsoft to the domain's DNS zone at the registrar, then select Verify.

Answer

Transfer the domain registration to Microsoft so it can automatically confirm ownership.

Answer

Upload a signed ownership certificate for the domain to the Microsoft 365 admin center.

Answer

Create a user account with the contoso-retail.com suffix and sign in to confirm ownership.

Question 2

Contoso has a large Microsoft 365 tenant. The IT director wants regional help desk staff in the Berlin office to reset passwords and manage only the user accounts belonging to the Berlin region, without granting them the ability to manage users in any other region. All Berlin users share a common department attribute value. What should you implement to meet this requirement with the least administrative effort?

Accepted Answer

Create an administrative unit with dynamic membership based on the department attribute, then assign the Helpdesk Administrator role scoped to that administrative unit.

Answer

Assign the Berlin help desk staff the Password Administrator role at the tenant level.

Answer

Create a Microsoft 365 group containing all Berlin users and grant the help desk staff the Owner role on that group.

Answer

Make the Berlin help desk staff eligible for the Global Administrator role in Privileged Identity Management.

Question 3

You are the Microsoft 365 administrator for Contoso. HR provides a CSV file containing 350 new employees with their display names, user principal names, department, and job titles. You need to create all 350 accounts in Microsoft Entra ID efficiently while ensuring each account is enabled and requires a password change at first sign-in. Which approach should you use?

Accepted Answer

Import the CSV with Import-Csv and pipe the records to New-MgUser in Microsoft Graph PowerShell, setting a PasswordProfile with ForceChangePasswordNextSignIn.

Answer

Use the Microsoft 365 admin center to add each user individually and manually set the password reset requirement.

Answer

Use the Exchange Online PowerShell New-Mailbox cmdlet in a foreach loop over the CSV rows.

Answer

Upload the CSV directly to the Microsoft Entra admin center's dynamic membership rule builder.

Question 4

Your organization's security team requires that administrators who leave their sessions idle in the Microsoft 365 admin center and other web apps are automatically signed out after 3 hours to reduce the risk of unattended sessions on shared workstations. You need to enforce this behavior tenant-wide with the least administrative effort. What should you configure?

Accepted Answer

Idle session timeout in the Microsoft 365 admin center under Org settings > Security & privacy

Answer

A Conditional Access policy with a sign-in frequency control set to 3 hours

Answer

The password expiration policy in the Microsoft 365 admin center org settings

Answer

A device compliance policy in Microsoft Intune requiring session locking

Question 5

Your organization's legal team requires that every employee sees a link to the company's internal privacy statement whenever they view their account settings or profile in Microsoft 365. As the Global Administrator, where in the Microsoft 365 admin center do you configure the URL for this privacy statement so it appears in users' account and profile experiences?

Accepted Answer

Settings > Org settings > Security & privacy > Privacy profile

Answer

Settings > Org settings > Organization profile > Release preferences

Answer

Settings > Org settings > Services > Microsoft Forms

Answer

Users > Active users > Multi-factor authentication settings

Question 6

An employee at Contoso is leaving the company. Their manager needs continued access to the departing employee's emails and wants to keep the mailbox available for reference without consuming an Exchange Online license. As the Microsoft 365 administrator, what should you do?

Accepted Answer

Convert the user mailbox to a shared mailbox and grant the manager Full Access permission, then remove the license.

Answer

Delete the user account and rely on the 30-day soft-delete retention to recover mail later.

Answer

Create a Microsoft 365 Group, add the manager as owner, and forward all future mail to the group.

Answer

Add the manager as a delegate on the mailbox and keep the departing employee's license assigned indefinitely.

Question 7

Contoso's marketing team requests a collaboration space that includes a shared mailbox, a shared calendar, and a SharePoint site for files. They also require that partners at an outside agency can email the group directly using its address. As the Microsoft 365 administrator, which single action best meets all these requirements with the least administrative effort?

Accepted Answer

Create a Microsoft 365 Group and enable the option to allow external senders to send email to the group.

Answer

Create a mail-enabled security group and add the external partners as guest members.

Answer

Create a shared mailbox and grant the external partners Send As permissions.

Answer

Create a distribution list and configure a mail flow rule to accept external mail.

Question 8

Contoso wants all employees in the Sales department to automatically receive membership in a Microsoft 365 group that is used for group-based licensing. As people transfer into or out of Sales, their group membership—and therefore their license assignment—must update without any manual intervention. The Sales department value is stored in each user's Entra ID profile Department attribute. Which approach should you configure to meet these requirements?

Accepted Answer

Create a security group with dynamic user membership using the rule (user.department -eq "Sales") and assign the licenses to that group

Answer

Create a Microsoft 365 group with assigned membership and use a scheduled PowerShell script to add and remove members nightly

Answer

Create an administrative unit named Sales and assign licenses at the administrative unit level

Answer

Create a distribution group with dynamic membership and assign the licenses to that group

Question 9

Contoso is starting a joint project with a partner firm, Fabrikam. A project manager needs to give three Fabrikam employees access to a Microsoft 365 Group's SharePoint site and Teams channel. The Fabrikam employees will authenticate using their own fabrikam.com credentials. As the Microsoft 365 administrator, what is the most appropriate way to provision these accounts?

Accepted Answer

Invite each Fabrikam employee as a guest (B2B) user in Microsoft Entra ID and add them to the Microsoft 365 Group.

Answer

Create three new member (cloud) accounts in the contoso.onmicrosoft.com domain and share the temporary passwords with Fabrikam.

Answer

Create mail contacts for the three Fabrikam employees and add the contacts to the Microsoft 365 Group.

Answer

Add the fabrikam.com domain as an accepted domain in the Contoso tenant so their existing accounts appear automatically.

Question 10

Your organization assigns Microsoft 365 E5 licenses through a dynamic security group named 'All-Staff'. A user, Priya, is a member of both 'All-Staff' and a second group 'Contractors' that assigns Microsoft 365 E3. Priya reports that some of her E5 service plans are showing as errors in the Microsoft 365 admin center under her license assignment. What is the most likely cause and the recommended way to resolve it?

Accepted Answer

Two group-based license assignments contain conflicting or duplicate service plans; resolve it by disabling the overlapping service plans on one of the groups or removing Priya from one group.

Answer

There are not enough available E5 licenses in the tenant; purchase additional E5 licenses to clear the error.

Answer

Priya has a directly assigned license that overrides the group license; remove the group-based assignment to fix the conflict.

Answer

The dynamic group membership rule is misconfigured; convert 'All-Staff' to an assigned (static) group to resolve the service plan error.

Question 11

As the Microsoft 365 administrator for Contoso, leadership asks you to provide a report showing which productivity services (Teams, Exchange, SharePoint, OneDrive) employees are actively using, along with adoption trends over the past several months, so they can plan targeted training. You want to surface this data in Power BI with per-user and per-department breakdowns while ensuring the reports comply with a company policy requiring individual user names to be concealed in analytics. Which combination should you use?

Accepted Answer

Enable the Microsoft 365 usage analytics Power BI template app in the admin center and turn on the setting to display de-identified (anonymized) user, group, and site names in reports

Answer

Use the Reports > Usage dashboard in the Microsoft 365 admin center only, exporting each CSV manually every month

Answer

Enable Microsoft 365 usage analytics in Power BI but leave concealed user details disabled so department managers can identify users

Answer

Deploy Microsoft Purview activity explorer and build custom reports from audit log data

Question 12

Users at Contoso report intermittent delays sending email through Exchange Online. As the Microsoft 365 administrator, you open the Microsoft 365 admin center and go to Health > Service health. You see an active entry for Exchange Online classified as 'Advisory' rather than 'Incident'. Management asks you what this classification indicates so they can decide how to communicate with staff. What should you tell them?

Accepted Answer

An advisory indicates a problem that may affect some users but where the service remains largely usable, often with a workaround, whereas an incident means a critical service outage or degradation.

Answer

An advisory means Microsoft has confirmed a full service outage and is actively restoring the service for all tenants.

Answer

An advisory is a notification that a planned maintenance window will occur and no users are currently affected.

Answer

An advisory indicates the issue was reported only by your tenant and has not yet been acknowledged by Microsoft.

Question 13

You manage a Microsoft 365 tenant for an organization with several branch offices. Users at one branch report slow performance when accessing SharePoint Online and Teams. You want to use the Microsoft 365 admin center to view network performance metrics and location-based recommendations for that office. When you open the Network connectivity page, no data is displayed for any location. What must you do first so that connectivity insights and per-location scores are generated?

Accepted Answer

Enable the 'Allow the collection of network user location data' setting in org settings so office locations can be assigned to telemetry

Answer

Assign each affected user the Global Reader role so their client telemetry is uploaded

Answer

Install the Microsoft 365 Apps update channel on all branch devices to activate network probing

Answer

Create a service request with Microsoft Support to have connectivity data provisioned for the tenant

Question 14

Your organization wants to reduce the number of administrators who hold permanent Global Administrator rights. The security team requires that admins activate elevated access only when needed, justify the activation, and have the access automatically expire after a set period. You have Microsoft Entra ID P2 licenses. What should you configure to meet these requirements?

Accepted Answer

Assign the Global Administrator role as an eligible assignment in Privileged Identity Management (PIM) with activation requiring justification and a time limit

Answer

Create an administrative unit and scope the Global Administrator role to it for each admin

Answer

Assign the Global Administrator role as a permanent active assignment and enable a Conditional Access policy requiring MFA

Answer

Add the admins to a role-assignable Microsoft 365 group that is permanently assigned the Global Administrator role

Question 15

Your organization has enabled Microsoft 365 Backup for Exchange Online. A user accidentally deleted a large volume of email from their mailbox 45 days ago, and the deleted items are already past the standard retention and recoverable items retention periods. The user needs the mailbox restored to its state from before the deletion. As the Microsoft 365 administrator, what should you do to recover the mailbox using Microsoft 365 Backup?

Accepted Answer

Use the Microsoft 365 Backup restore experience in the Microsoft 365 admin center to restore the protected mailbox to a selected point in time.

Answer

Recover the messages from the Deleted Items folder using the Recover deleted items feature in Outlook.

Answer

Create an eDiscovery (Premium) case and export the mailbox content, then re-import it using the Exchange import service.

Answer

Place the mailbox on Litigation Hold and use a content search to restore the deleted messages.

Question 16

Contoso has a shared mailbox named support@contoso.com used by the help desk team. The mailbox has grown to 48 GB and is approaching its storage limit. The team also wants to enable in-place archiving for the mailbox to retain older support tickets. As the Microsoft 365 administrator, what must you do to support both the increased storage and the archive feature?

Accepted Answer

Assign a Microsoft 365 or Exchange Online (Plan 2) license to the shared mailbox

Answer

Convert the shared mailbox to a user mailbox and increase the quota with a PowerShell command

Answer

Enable auto-expanding archiving at the tenant level, which raises all shared mailbox quotas to 100 GB automatically

Answer

No license is required; shared mailboxes always include 100 GB of storage and archiving by default

Question 17

You are the Microsoft 365 administrator for Contoso. You added the custom domain contoso.com to your tenant in the Microsoft 365 admin center, but the domain shows a status of 'Setup in progress' and users cannot receive external email at their contoso.com addresses. You confirmed the TXT verification record was added and the domain was successfully verified. Which action should you take next to enable inbound mail flow to Exchange Online for this domain?

Accepted Answer

Add the MX record provided by Microsoft 365 to the DNS zone for contoso.com at your DNS hosting provider.

Answer

Add an SPF (TXT) record for contoso.com so that inbound mail is accepted.

Answer

Assign each user an Exchange Online license before mail can be delivered.

Answer

Set contoso.com as the default domain in the organization profile settings.

More MS-102 practice