Microsoft MS-102: Practice Microsoft 365 Administration

Microsoft MS-102 remains current on October 6, 2026 but retires November 30, 2026 at 11:59 PM Central Standard Time. Practical preparation should stay tied to the current April 28 blueprint and durable administration skills: tenant operations, Entra identity and access, Defender XDR security, and Purview compliance.

The exercises below are for candidates realistically sitting the exam before retirement. They do not imply that MS-102 remains available afterward, and they do not assume a one-to-one successor exam.

Operate the tenant and identity lifecycle

Close the MS-102 practical set with one operational day containing a planned tenant change, an identity problem, a Defender incident, a Purview exception, and a service-health event. Prioritize the work, preserve evidence, assign ownership, and document what can wait. That integrated exercise is closer to real administration than disconnected labs.

Use a shared change log for the exercises: starting state, administrative action, expected result, observed evidence, side effects, rollback decision, and next owner. This exposes risky habits such as broad role use, untracked tenant changes, or treating a security alert as a configuration problem before investigation.

Use one change log across the exercises so actions remain traceable. Record starting state, administrative action, expected result, observed evidence, side effects, rollback decision, and next owner. That habit turns a lab into an operational record instead of a screenshot collection.

Exercise 1: operate a tenant change

Choose a tenant-level change such as a domain, organization setting, service configuration, license model, or administrative delegation. Define the owner, prerequisites, affected workloads, change window, validation evidence, rollback or recovery path, and stakeholder communication.

Treat the tenant-change exercise as production work by documenting impact, approval, validation, rollback, and communication before the configuration is changed.

Exercise 2: trace hybrid identity

Hybrid identity exercises should follow one user from the on-premises source through synchronization, authentication, Microsoft 365 access, and monitoring. MS-102 identity and access helps separate source-state, synchronization, sign-in, Conditional Access, and application-authorization failures instead of treating them as one problem.

For hybrid identity, keep source state, synchronization, authentication, Conditional Access, and application authorization as separate checkpoints. A successful sync proves only one of them.

Hybrid identity exercises should include recovery, not only normal synchronization. Model what happens when synchronization is delayed, a source attribute is wrong, a user cannot authenticate, or Conditional Access denies access after a successful sign-in. For each failure, identify the log or state that narrows the problem and the team that should own the next action. That prevents “hybrid identity” from becoming a single undifferentiated topic in your notes.

Exercise 3: review tenant lifecycle controls

MS-102 tenant configuration and lifecycle should be practiced as operations: users, groups, licensing, roles, service health, updates, adoption, backup, and tenant settings need owners, change records, exceptions, and follow-up rather than one-time configuration.

Tenant reviews should expose stale ownership, failed changes, service-health effects, and follow-up actions instead of becoming a checklist of green dashboards.

For tenant operations, include one exercise where the technically correct configuration is not the immediate action. A Microsoft service-health incident may make a workload unavailable even though tenant settings are correct. Practice confirming scope, checking service status, communicating impact, and avoiding speculative changes while the platform is degraded. This is an important administrator judgment because unnecessary remediation during a vendor incident can create additional problems after the service itself recovers.

Include at least one case where the correct response is communication rather than configuration. A Microsoft service incident can make a workload unavailable while tenant settings remain correct. Confirm service health, scope, business impact, and workaround before making speculative changes.

Investigate security and information protection

Defender XDR practice should force you to distinguish exposure management from incident response. A security recommendation may reduce future risk, while an active incident may require investigation and containment now. Create one scenario where the same vulnerable device appears in both contexts. Decide which evidence belongs to posture management, which belongs to the incident timeline, and how remediation should be coordinated so the urgent response does not erase useful evidence.

Exercise 4: investigate Defender XDR evidence

A Defender XDR lab should produce an incident narrative, not a list of alerts. Defender XDR investigation workflows connect identity, endpoint, and email evidence so the administrator can understand scope, confidence, and which actions belong to security operations.

Defender XDR exercises should end with an incident narrative: what happened, which entities are affected, how confident the evidence is, and which response is proportionate.

Exercise 5: improve exposure and security posture

Review Secure Score, exposure findings, endpoint or identity weaknesses, and security recommendations, then choose remediation priorities. Rank actions by exploitability, business impact, affected assets, dependency, and implementation risk instead of score improvement alone.

Security-posture work should prioritize by business risk and exploitability. Improving a score is secondary to reducing exposure that matters.

Exercise 6: protect information with Purview

Information-protection exercises should begin with a real handling requirement. Microsoft Purview information protection should make classification, labels, DLP, retention, user impact, exceptions, and investigative evidence visible in the same scenario.

Purview exercises should capture policy intent, enforcement surface, user effect, exceptions, evidence, and investigative ownership in a single operating record.

Purview work should be tied to actual information handling. Pick a sensitive business document and follow it through classification, labeling, sharing, DLP, retention, and investigation. Record what the user experiences, what administrators can override, what evidence is retained, and which team owns policy versus investigation. This creates a much stronger understanding than memorizing where labels or policies are configured in the compliance portal.

Troubleshoot and automate administration

Because MS-102 is retiring, finish each lab by marking which parts are exam-specific and which are durable administration skills. The April 28 objective wording and November 30 availability have a deadline. Tenant governance, hybrid identity, service health, Defender XDR coordination, information protection, PowerShell, and Microsoft Graph remain useful beyond that date. Separating those layers protects the value of the practical work even if Microsoft later reorganizes the credential path.

Exercise 7: troubleshoot a cross-workload problem

Create a scenario where a user cannot access a Microsoft 365 workload after an identity or policy change. Trace tenant state, synchronization, authentication, Conditional Access, application assignment, service health, and workload-specific authorization in order.

Cross-workload troubleshooting is successful when the first incorrect state is identified and the next team receives enough evidence to continue without repeating the investigation.

One valuable cross-workload lab is to simulate a new administrator joining the tenant while a security incident is already active. Decide which role or privileged-access process gives the administrator enough authority to help without granting permanent broad access. Then add an identity problem, a Defender incident, and a Purview question that require collaboration with specialists. Record which evidence each team needs and what the Microsoft 365 administrator coordinates. This exercise reinforces the integrating nature of the current role and makes privilege, incident response, and tenant operations interact in one realistic situation.

Exercise 8: automate a recurring admin task

Choose one repetitive task involving users, groups, licenses, reporting, or health checks and design a PowerShell or Microsoft Graph workflow with safe inputs and auditability. Define permission scope, error handling, logging, rollback or rerun behavior, and who reviews failures.

Automation review should cover permission scope, input safety, partial failure, logging, rerun behavior, and accountability for unexpected changes.

Finish with a retirement-aware capstone

Use retirement-aware prioritization for the final lab cycle. If an exercise does not map to the current April 28 objectives or to a durable Microsoft 365 administration skill, remove it. Spend the remaining time on scenarios that cross domains, because those are more likely to reveal whether knowledge is usable. Keep the official retirement date beside the plan so final preparation stays bounded by the exam that is actually available rather than expanding into unrelated Microsoft 365 content.

The capstone should separate exam-specific objective wording from operating practices that remain useful after November 30. Keep the tenant, identity, security, compliance, and automation evidence; date the retirement-specific scheduling notes so they can be removed later without rewriting the lab.

Exercise 9: perform a retirement-aware final review

The final review should compare hands-on evidence with the April 28, 2026 MS-102 blueprint and the November 30 retirement date. Microsoft 365 Certified: Administrator Expert is current credential context, but the labs should preserve tenant, identity, security, compliance, and automation skills that remain useful after the exam closes.

Because MS-102 is retiring, distinguish current exam coverage from durable Microsoft 365 administration so the lab record remains useful after November 30.

Because MS-102 is retiring, practical preparation should be selective. Build exercises around the current blueprint and areas where hands-on evidence is weak rather than reproducing every Microsoft 365 feature. A tenant change, hybrid identity failure, Defender incident, and Purview policy can cover multiple objectives when ownership and evidence are documented carefully.

Before the final MS-102 review, make sure every practical exercise ends with evidence you could hand to another administrator: a sign-in result, incident timeline, policy evaluation, audit event, service-health note, or change record. That habit keeps the labs grounded in operations instead of becoming a collection of screenshots.

Keep those evidence artifacts concise enough that another administrator can use them during an incident without reconstructing the entire lab.