Microsoft 365 Certification Roadmap

Microsoft 365 certification planning changed significantly in 2026. MS-900 retired on March 31. AB-900 is now the current Microsoft 365 Copilot and Agent Administration Fundamentals exam. MD-102 remains the endpoint-administration anchor. MS-102 is still active as of October 26, 2026, but Microsoft has scheduled it to retire on November 30, 2026. Security responsibilities increasingly branch into SC-300 for identity and access, SC-401 for information security and Purview, and SC-200 for security operations. The result is a portfolio that makes more sense when organized by operational responsibility than by a simple “fundamentals, associate, expert” ladder.

A modern Microsoft 365 professional may be responsible for endpoint fleets, tenant configuration, identity, Copilot and agents, information protection, security operations, collaboration services, automation, or some combination. Those responsibilities share the same tenant but require different depth. The right roadmap begins by identifying which control surface you own.

This article maps five practical paths: Copilot and agent administration, endpoint administration, tenant administration, security specialization, and broader modern-work operations. It also explains how to plan around the approaching MS-102 retirement instead of building a long-term strategy on a route Microsoft is already closing.

AB-900: current fundamentals for Copilot and agent administration

AB-900 is the current Microsoft 365 Copilot and Agent Administration Fundamentals credential. It replaces MS-900 as the most relevant Microsoft 365 fundamentals direction, but it should not be treated as a simple rename. The center of gravity has shifted toward Copilot, agents, administration, and the organizational controls around AI-assisted work.

A useful AB-900 study plan should build a mental model of Microsoft 365 as a governed service environment. Understand tenants, identities, users, groups, licensing, administrative roles, service boundaries, data access, and the way Copilot and agents operate within organizational context. Learn why AI features depend on permissions, data quality, information governance, and security rather than existing as a separate layer.

For Copilot, the important question is not only what the assistant can do. It is what information the user is already authorized to access, how organizational data is grounded, what administrative settings apply, how agents are published and governed, and how security and compliance controls remain relevant. A poor permissions model can become more visible when AI makes information easier to discover.

AB-900 is useful for administrators, technical managers, support professionals, business technologists, and security or compliance staff who need a current Microsoft 365 AI-administration foundation. Experienced tenant administrators may use it as a gap review rather than as a mandatory exam.

MD-102: endpoint administration remains an operational anchor

MD-102 is the Endpoint Administrator path. Current skills effective July 24, 2026 span endpoint deployment, identity and access, policies, applications, security, and management using technologies such as Microsoft Intune, Windows Autopilot, Defender for Endpoint, Entra ID, PowerShell, Microsoft Graph, and Windows 365. The role increasingly intersects automation and agentic workflows, but its core responsibility remains device lifecycle and user productivity.

A capable endpoint administrator thinks beyond enrollment. The device lifecycle includes procurement or provisioning, identity registration or join, configuration, compliance, application delivery, updates, security, monitoring, support, ownership change, and retirement. Each stage creates operational and security questions.

Study by building a small device-management service, not by memorizing portal blades. Define personas: a corporate Windows laptop, a contractor device, a shared device, a remote executive, and perhaps a cloud PC. Decide enrollment, configuration, authentication, compliance, application, update, and security policies for each. Then test what happens when a device becomes noncompliant, a user changes role, an app deployment fails, or a policy conflicts.

Endpoint security is not the same as endpoint administration

MD-102 includes security responsibilities, but endpoint administration is not identical to security operations. An endpoint administrator configures security posture—Defender settings, compliance, attack-surface reduction, encryption, update policy, access requirements, and remediation. A security operations analyst using SC-200 investigates alerts, hunts threats, correlates evidence, and drives incident response.

The roles should share telemetry and feedback. If the SOC sees repeated attacks using a specific macro behavior, endpoint policy may need to change. If a compliance policy creates widespread false noncompliance, the endpoint team should investigate configuration and device health before security teams treat every event as compromise.

This relationship is a good example of Microsoft 365 specialization. The same endpoint can be a productivity asset, identity object, compliance subject, and security evidence source at the same time.

MS-102 is current but near retirement

MS-102, Microsoft 365 Administrator, remains active as of October 26, 2026, with current skills effective April 28, 2026. Its scope includes tenant management, Entra identity and access, Defender XDR, and Purview compliance. The current Microsoft 365 Administrator Expert path uses MS-102 plus a qualifying associate certification such as Endpoint Administrator, Teams Administrator, or Identity and Access Administrator.

However, Microsoft has scheduled MS-102 to retire on November 30, 2026. That changes the planning question. A candidate already prepared and able to sit the exam before retirement may still find it valuable. A learner beginning a long preparation cycle should not treat the route as a stable multi-year destination.

The durable learning remains useful: tenant configuration, identity, security, compliance, service health, administration, and cross-service governance. But career planning should separate those capabilities from the lifecycle of the current badge.

Tenant administration is a systems role

A Microsoft 365 administrator owns interactions among identity, services, licensing, security, compliance, endpoints, and business requirements. The role is not simply “manage the admin center.” Changes can have tenant-wide consequences.

For example, changing an identity policy may affect Teams, SharePoint, Exchange, third-party applications, device access, and automation. A retention configuration may interact with legal requirements, user deletion, and storage. A licensing decision may enable or disable security or compliance capabilities. A service outage may require understanding dependencies and communicating business impact.

Prepare for tenant administration with change scenarios. Design a new business unit onboarding. Merge two domains. Introduce stricter authentication. Roll out a new Microsoft 365 service. Offboard a department. Respond to a service-health incident. For each, identify affected identities, data, security controls, licenses, communication, rollback, and support.

Troubleshooting Microsoft 365 requires dependency thinking

A user reports that Teams will not open a file. That symptom can originate in Teams, SharePoint, OneDrive synchronization, identity, Conditional Access, licensing, device compliance, network filtering, service health, or a permissions change. Strong administrators do not jump directly to the product where the user saw the error. They trace the dependency chain.

Start with scope. Is the problem one user, one device, one site, one tenant, or a Microsoft service region? Check service health before making tenant-wide changes. Verify identity and authentication. Confirm licensing and application assignment. Test access to the underlying SharePoint resource directly. Review device and Conditional Access state. Look at recent configuration changes. Collect timestamps and correlation information where available.

This method is more durable than memorizing troubleshooting wizards. Microsoft 365 is a distributed service environment; the visible application is often only the final surface of a deeper dependency.

PowerShell and Microsoft Graph are force multipliers

Portal administration is useful for learning and occasional tasks, but repeatable Microsoft 365 operations eventually require automation. PowerShell and Microsoft Graph help administrators inventory configuration, apply changes consistently, collect evidence, and integrate workflows.

Automation should be designed with the same discipline as any privileged tool. Use least-privilege identities. Protect secrets. Test in limited scope. Add logging. Make bulk changes reversible or at least reviewable. Prefer idempotent scripts that can be rerun safely. Include dry-run or reporting modes when a command could affect many users.

A useful study exercise is to take a manual administrative task—such as reviewing group membership, finding stale guests, reporting device compliance, or checking license assignment—and automate the reporting first. Once the data is trustworthy, automate remediation selectively. This builds confidence without turning a script into an uncontrolled change engine.

Service health and change management are part of the job

Cloud administration includes incidents you did not cause. Microsoft service degradation, feature changes, deprecations, and message-center announcements can affect users even when tenant configuration is correct. Administrators need a process for monitoring service health, assessing organizational impact, communicating, and documenting temporary workarounds.

The same discipline applies to planned change. Before enabling a major policy or feature, identify affected groups, dependencies, pilot population, success measures, rollback criteria, and support communication. Broad tenant changes should not be made simply because a setting is recommended in a generic guide.

A strong administrator can distinguish Microsoft-side service failure from tenant-side configuration failure and can communicate uncertainty without creating panic.

SC-300: identity is one of the strongest Microsoft 365 specializations

SC-300 focuses on identity and access administration using Microsoft Entra. In Microsoft 365, identity determines who can access resources, under what conditions, with which privilege, and through which applications. That makes SC-300 highly relevant for administrators whose responsibilities extend beyond basic user creation.

The role includes identity lifecycle, authentication, authorization, Conditional Access, application access, privileged identity, and governance. A tenant with excellent endpoint management but weak identity controls remains vulnerable. Conversely, aggressive identity controls that are poorly designed can disrupt the entire organization.

Study identity with realistic exception handling. How will emergency access work? How are guests governed? How are service principals and managed applications controlled? How are administrators elevated? What happens when a user loses a device? How are risky sign-ins handled? How are access reviews tied to business ownership?

The Microsoft security roadmap provides a deeper map when identity is part of a broader security career.

A readiness matrix for identity administration

For SC-300-style identity work, assess lifecycle, authentication, authorization, Conditional Access, application access, privileged access, governance, and troubleshooting. Use realistic questions. Can you safely onboard and offboard a guest? Can you design admin access without creating lockout risk? Can you explain why an application has delegated versus application permission? Can you identify who granted consent? Can you troubleshoot a policy conflict? Can you recover when a strong authentication control blocks a legitimate emergency scenario?

Identity failures often have large blast radius. Readiness therefore includes change discipline, emergency access, monitoring, and evidence—not only correct configuration.

SC-401: information protection and Purview become a dedicated path

SC-401 centers on information security administration in Microsoft 365, including Purview information protection, DLP, retention, insider risk, and information-security alerts and activities. It is the right specialization for professionals whose main responsibility is controlling sensitive information rather than general tenant operation.

The role begins with data meaning. Which information is sensitive? Which regulations or business rules apply? Who should access it? How may it be shared? How long must it be retained? When should it be deleted? What user behaviors should trigger warning, blocking, or investigation?

Tools follow those decisions. Sensitivity labels, DLP, retention, and risk capabilities should implement policy without creating unnecessary friction. A mature design uses test modes, exceptions, user education, monitoring, and governance instead of deploying aggressive controls blindly.

Microsoft Learn currently exposes a future English SC-401 skills update dated October 28, 2026. If your exam is before that date, prepare against the objectives currently in force rather than studying a future blueprint as though it already applies.

A readiness matrix for information security administration

For SC-401-style work, assess classification, labels, DLP, retention, insider risk, alerts, data locations, policy testing, and stakeholder communication. The hardest problems are often policy problems. A technically valid DLP rule can be unusable if it blocks legitimate business. A retention decision can create legal or privacy issues if the business requirement is unclear.

Practice translating policy into technical behavior. Define the information type, actor, action, location, exception, user feedback, and escalation. Test in audit mode. Review false positives. Adjust. Then decide whether warn, justify, block, or escalate is appropriate.

SC-200: Microsoft 365 security operations is an investigation path

SC-200 is appropriate for professionals who consume Microsoft 365 and cloud security telemetry to investigate incidents, engineer detections, hunt threats, and operate Microsoft Sentinel and Defender XDR. The role overlaps with tenant and endpoint teams but has a different output: evidence and response decisions.

A strong Microsoft 365 SOC scenario may begin with a suspicious sign-in, phishing email, malicious attachment, endpoint alert, risky OAuth application, impossible travel pattern, or data-exfiltration signal. The analyst traces identity, device, email, application, and cloud evidence to determine scope and intent.

The Microsoft 365 administrator and endpoint administrator provide the controls and context the SOC depends on. The SOC provides feedback that improves those controls. Certification planning should reflect that relationship rather than treating security operations as an isolated product track.

A readiness matrix for Microsoft 365 security operations

For SC-200-style work, assess data sources, incident triage, investigation, hunting, detection engineering, automation, and response. Use tenant scenarios that cross products. Can you trace a phishing message from delivery to click to credential use to endpoint activity? Can you connect a risky sign-in to a suspicious OAuth app? Can you determine whether a DLP event is policy violation, user mistake, or compromise?

The best analysts understand enough tenant and endpoint administration to interpret evidence correctly. Cross-role literacy makes investigations faster and recommendations more actionable.

Copilot administration depends on identity and information governance

Copilot makes existing permission and information architecture more important because it can help users discover and synthesize content quickly. If a user already has access to overshared documents, AI can make that oversharing more consequential. The solution is not to treat Copilot as the origin of every exposure. It is to improve identity, sharing, classification, access, and lifecycle controls.

Before a broad Copilot rollout, evaluate group membership, SharePoint and Teams permissions, guest access, stale sites, sensitive data, retention, and search visibility. Decide which agents may be published, which data sources they can use, and who is responsible for their behavior. Establish a review process for agent actions and connectors.

This is where AB-900, SC-300, SC-401, and tenant-administration skills intersect. AI administration is an extension of the existing control plane.

Copilot adoption is an operating-model problem

A technically enabled Copilot tenant does not guarantee useful adoption. Teams need appropriate scenarios, training, expectations, and support. Users need to understand how to provide context, verify output, protect sensitive information, and recognize when AI is unsuitable.

Administrators and transformation leaders should define success metrics before rollout. Measures might include reduced time on specific tasks, faster document synthesis, improved meeting follow-up, lower support burden, or better content reuse. Raw prompt volume is not a meaningful business outcome.

Pilot with representative users. Capture failure modes. Improve information quality and permissions where necessary. Update training. Expand gradually. This produces a more defensible adoption path than enabling features tenant-wide and waiting for productivity to appear.

Modern work roles are cross-service by nature

Microsoft 365 work rarely stays inside one product. A user signs in through Entra, works on a managed endpoint, collaborates in Teams, stores data in SharePoint or OneDrive, receives email in Exchange, may use Copilot over that information, and generates security and compliance telemetry across the process.

The administrator needs enough cross-service understanding to diagnose user and policy issues. The endpoint specialist needs identity context. The identity specialist needs application and device context. The security analyst needs telemetry from all of them. The information-security specialist needs to understand where data flows and how access is granted.

This is why a good roadmap develops one primary role while maintaining awareness of adjacent control surfaces.

Collaboration administration needs ownership and lifecycle

Teams, SharePoint sites, Microsoft 365 groups, and OneDrive content can proliferate quickly. Technical creation is easy; lifecycle is harder. Every collaboration space should eventually answer who owns it, who has access, what data classification applies, how guests are governed, how long the content should live, and what happens when the owner leaves.

A mature tenant uses naming, creation policies, ownership reviews, expiration or lifecycle practices where appropriate, sensitivity and sharing controls, and clear support boundaries. The exact implementation depends on organizational needs, but the principle is stable: collaboration objects are business resources, not disposable chat rooms.

This is particularly important before Copilot adoption because AI can search and synthesize across accessible content. Better ownership and permissions improve both security and AI usefulness.

Licensing is an architecture constraint

Microsoft 365 features are often discussed as though every tenant has the same capability set. In reality, licensing affects security, compliance, endpoint, Copilot, and management options. Administrators must know which features are available to which users and what happens when licenses change.

Treat licensing as a design input. If a security policy depends on a premium capability, identify who needs it and how exceptions will be handled. If an endpoint workflow assumes Windows 365 or advanced management features, confirm entitlement. If an AI rollout requires specific licensing, include adoption and budget assumptions before promising functionality.

Certification preparation should avoid becoming a licensing memorization exercise, but it should teach candidates to check entitlement before designing controls that cannot be implemented for the target population.

A practical path for endpoint specialists

If device lifecycle is your main responsibility, MD-102 is the strongest anchor. Build deep Intune, Autopilot, device identity, policy, application deployment, updates, Defender integration, PowerShell, Graph, and Windows 365 skills.

Add SC-300 if identity and Conditional Access become a major part of the job. Add SC-200 awareness if you regularly support security investigations. Learn AB-900 concepts if Copilot and agents are becoming part of endpoint or user-experience administration.

Do not add MS-102 simply because it appears broader; evaluate whether the near-retirement credential is worth the timing and whether tenant-wide administration is actually your role.

A readiness matrix for endpoint administration

For MD-102-oriented preparation, assess yourself across deployment, configuration, application management, security, monitoring, automation, and troubleshooting. For each area, rate four levels: explain, configure, troubleshoot, and automate.

You may be able to explain Autopilot but not diagnose a failed enrollment. You may be able to configure a compliance policy but not understand why Conditional Access still allows or blocks a session. You may deploy applications manually but not produce a reliable detection rule or remediation. You may know Defender settings but not trace how endpoint alerts flow into security operations.

Focus study on the lowest practical level, not the lowest theoretical familiarity. Certification readiness improves when you can move from explanation to action and then to diagnosis.

A practical path for tenant administrators

Tenant administrators should develop broad competence across identity, service configuration, security, compliance, licensing, service health, and governance. If already prepared, MS-102 can still be relevant before its November 30 retirement. If not, use its objective areas as a capability checklist while tracking Microsoft’s current replacement direction.

Choose a specialization based on the most consequential part of the role. Identity-heavy administrators can pursue SC-300. Information-protection administrators can pursue SC-401. Security operations staff can pursue SC-200. Endpoint-heavy administrators can pursue MD-102.

The top-level Microsoft certification roadmap is useful if your long-term direction extends into Azure, security architecture, AI, or data.

A practical path for security-focused Microsoft 365 professionals

Security-focused learners should resist the urge to become “the Microsoft 365 security person” without defining the function. Choose identity, information protection, or operations as the primary depth area.

For identity, build SC-300-level capability and understand device and application signals. For information protection, build SC-401-level policy, DLP, labeling, retention, and risk knowledge. For operations, build SC-200-level investigation, detection, hunting, Sentinel, and Defender XDR skills.

Later, broaden across the other domains or move toward architecture. The sequence should follow actual blind spots and job responsibility.

A practical path for Copilot and agent administrators

Begin with AB-900 if the Microsoft 365 AI administration model is new. Then deepen the adjacent domain that determines whether your Copilot deployment will be safe and useful. In most organizations that means identity and access, information governance, tenant administration, or endpoint management.

Build at least one controlled agent. Give it a narrow purpose, limited data sources, and bounded actions. Define owner, audience, permissions, review, monitoring, and retirement. Test misleading input and access edge cases. This converts Copilot administration from a feature toggle into an operational discipline.

Build a tenant-lifecycle lab

Create a small test tenant or controlled lab environment where licensing permits. Define several personas: employee, manager, guest, endpoint administrator, security analyst, and global or privileged administrator. Configure groups, authentication, access policies, devices, applications, and collaboration spaces.

Onboard a user. Give them a device. Grant application access. Change their role. Add a guest. Test Conditional Access. Apply information-protection controls to selected content. Generate security events. Offboard the user. Review what remains and what should be removed.

This lifecycle exercise exposes the interactions that separate real administration from isolated feature study.

Scenario: an employee leaves but still has application access

An employee is disabled in the main identity system, yet a third-party SaaS application still accepts a long-lived session or independent account. The Microsoft 365 team assumed user disablement ended all access.

An SC-300 perspective asks how the application is integrated, how provisioning and deprovisioning work, what sessions or tokens remain, and which governance processes review access. A tenant-administration perspective asks whether offboarding workflows cover all services. A security-operations perspective asks what evidence shows continued activity and how it would be investigated.

This scenario teaches an important principle: identity lifecycle must include downstream systems and sessions, not only the user object.

Scenario: a device is compliant but the user session is risky

A managed laptop meets compliance policy, encryption, and update requirements. The user then signs in from an unusual location and risk signals indicate potential credential theft. Device compliance alone is not enough.

Conditional Access should combine user, device, application, location, authentication, and risk context where appropriate. The endpoint team maintains device trust; the identity team defines access logic; the SOC investigates suspicious behavior. This is a shared security system, not three independent certifications.

Scenario: Copilot reveals an overshared project archive

A user asks Copilot about a competitor and receives a summary containing confidential merger planning documents stored in a broadly accessible SharePoint site. Copilot did not bypass permissions; it made an existing oversharing problem easier to discover.

The remediation should address the information architecture and access model: site permissions, group membership, sharing, sensitivity, retention, ownership, and governance. Administrators should review whether the data belonged in that location and whether access should have been narrower. Training should explain that AI respects existing permissions but can amplify the consequences of poor permissions.

This is why Copilot readiness is inseparable from identity and information governance.

Prepare for the MS-102 retirement without panicking

If you are already ready for MS-102 and can schedule it comfortably before November 30, completing the exam may still support your current career plan. Do not rush an underprepared attempt simply because of the deadline. Certification value comes from credible skill, not beating a retirement clock.

If you are early in preparation, extract the durable capabilities from the MS-102 blueprint: tenant operations, identity, security, compliance, and cross-service administration. Build those skills while monitoring Microsoft’s credential catalog for the successor direction. The work does not become obsolete when the exam retires.

Employers also tend to lag credential transitions. Being able to explain that MS-102 is scheduled to retire on November 30, 2026, while demonstrating current tenant-administration capability is more useful than pretending the older path will remain static.

Modern work architecture should reduce administrative surprise

A well-run Microsoft 365 tenant makes expected behavior predictable. Users know how to request access. Devices receive consistent policy. Administrators use controlled privileged access. Collaboration spaces have owners. Sensitive information is classified and governed. Agents have defined scope. Changes are piloted. Security events produce usable evidence. Offboarding removes access across services.

The durable Microsoft 365 roadmap is role-first

AB-900 provides current fundamentals for Copilot and agent administration. MD-102 anchors endpoint administration. MS-102 remains a short-lived current tenant-administration route until November 30, 2026. SC-300 covers identity and access. SC-401 covers information security and Purview. SC-200 covers security operations.

Choose the path that matches the control surface you own. Build lifecycle labs that cross service boundaries. Treat Copilot as part of the existing identity, data, security, and governance system. And separate durable Microsoft 365 skills from the exam codes used to represent them at one moment in the portfolio.

Modern Work roles now connect endpoint, identity, tenant, Copilot, and integration skills

Microsoft 365 certification planning is increasingly about the operating model of the tenant rather than a collection of separate products. Microsoft 365 tenant administration ties together identity, licensing, administrative roles, service configuration, security boundaries, auditability, and change control. That broader tenant context helps explain why modern-work roles overlap even when their exams emphasize different products.

Endpoint work is one major branch. Intune device compliance and configuration shows how device state becomes a governance input rather than merely a management task, while Windows endpoint security with Defender connects hardening, attack-surface reduction, endpoint detection, policy, and operational response. These skills naturally intersect with MD-102 and with broader Microsoft security responsibilities.

Identity is the other shared control plane. Hybrid identity and synchronization becomes important when organizations still bridge on-premises directories and Microsoft Entra ID. Candidates should understand not only synchronization mechanics but also ownership, source of authority, sign-in design, failure handling, and the risk of carrying old identity assumptions into a cloud-first tenant.

Copilot administration adds a new governance layer. Microsoft 365 Copilot governance depends on existing identity, data permissions, information protection, service configuration, and monitoring. It is therefore not a separate AI island inside Microsoft 365. Administrators need to understand how oversharing, permission inheritance, agent access, and data exposure can surface through Copilot experiences.

Integration skills complete the picture. Microsoft Graph integration patterns show how applications and automation interact with users, groups, files, mail, calendars, devices, and other tenant resources through a governed API boundary. The strongest Modern Work path is therefore the one that builds a coherent mental model of tenant administration, identity, endpoints, collaboration services, Copilot, security, and programmatic integration rather than treating each certification as an isolated product test.

Certification paths are useful when they help build that operating model. AB-900, MD-102, SC-300, SC-401, SC-200, and the remaining MS-102 window each cover part of the system. The goal is not to own every badge. It is to understand your part deeply enough that the whole tenant becomes safer, more supportable, and easier for users to work in.