MS-101, Microsoft 365 Mobility and Security, is a retired Microsoft certification exam. It was paired with MS-100 in the former Microsoft 365 enterprise administrator pathway. Both retired on September 30, 2023, when Microsoft replaced the two-exam sequence with MS-102. That later MS-102 exam is scheduled to retire on November 30, 2026. This page therefore explains what MS-101 historically assessed and how its administrative concepts apply today; it is not a current MS-101 registration or exam-preparation offer.
The enduring work sits at the intersection of managed devices, identities, security operations and information governance. An employee’s laptop can be fully updated but unable to open a protected document; a user can authenticate successfully and still be denied a resource by conditional access; a file can be technically shareable but restricted by a sensitivity policy. An administrator who understands these interacting boundaries can investigate a failure without weakening organization-wide protection or disrupting unrelated services.
Technology names and management interfaces have changed since the original exam. Microsoft Azure Active Directory is now Microsoft Entra ID; Microsoft Intune manages device and application policies; Microsoft Defender XDR correlates security alerts; and Microsoft Purview helps enforce information-protection and compliance controls. The versioned MS-101 syllabus remains historical evidence of the role’s breadth. Current production changes must follow supported Microsoft Learn documentation, organizational approvals and a tested recovery process.
The former certification pathway and its three responsibility areas
MS-101 complemented MS-100, which emphasized tenant, identity and service administration. MS-101 focused more on device services, security-threat management and governance or compliance. These categories were connected rather than independent silos. Requiring a compliant device only works when enrollment, policy evaluation and identity access rules all produce a coherent result. Likewise, a security investigation may require endpoint, mailbox and sign-in evidence, while the response must respect retention and privacy obligations.
The intended audience was an administrator experienced with Microsoft 365 services, not someone who had only memorized portal menus. Candidates needed to reason about deployment plans, policy scope, consequences of change and how to confirm operational outcomes. Some exam-era descriptions listed domain percentage weights or the exact location of a setting, but those figures and interfaces should not be carried into a modern study plan without checking their historical source. A retired examination blueprint is not a reliable statement about current product capabilities or certification requirements.
When considering credentials in November 2026, use the live Microsoft certification catalog and specific role requirements. MS-102 was the replacement introduced in 2023, yet its announced November retirement makes it a time-limited option rather than a durable recommendation. Current identity, endpoint and security specializations may overlap with MS-101 subject matter, but none is automatically an exact one-to-one substitute for an old two-exam expert pathway.
Device enrollment, management and compliance in Intune
A managed device has multiple independent properties: its identity registration, ownership, enrollment state, installed applications, configuration policies, security posture and reported compliance. A laptop appearing in a management portal does not prove that it meets every required setting. Microsoft Intune compliance policies define conditions such as supported operating-system versions or security configuration requirements. The resulting compliance status can inform decisions elsewhere, including Microsoft Entra Conditional Access.
A practical planning exercise starts with several device classes: organization-owned Windows laptops, employee-owned mobile phones and dedicated shared devices. Identify which users and devices are in scope, what data the organization permits them to access, and which enrollment or app-protection approach suits their roles. The policies should respect privacy and supported platform capabilities. A rule appropriate for fully managed corporate laptops may not be suitable for a personal device whose owner has not agreed to broad management.
The device lifecycle extends beyond enrollment. Administrators need a response for lost or replaced devices, stale enrollments, failed updates and devices that no longer satisfy compliance requirements. An offboarding plan should distinguish removing a work profile, retiring a managed device and fully wiping a device, because the consequences can be substantially different. Do not execute destructive commands just to demonstrate knowledge. In a lab, use a disposable device or supported simulator and record the intended scope and recovery route first.
Compliance reporting also needs interpretation. A device may report noncompliance because a policy has not yet evaluated, a required setting is absent or the device has stopped communicating. The troubleshooting order should inspect the specific failing rule, policy assignment and last check-in before changing the global compliance standard. Disabling a rule to make one test user succeed may increase exposure for every other affected device.
Conditional Access connects identity and device state
Microsoft Entra Conditional Access evaluates signals such as user identity, target resource, device state and other contextual factors to decide whether access controls must be met. When configured to require a compliant device, it can use Intune’s compliance result to enforce access to protected services. This is a separate function from the compliance policy itself: one mechanism evaluates the device against defined requirements, while the other determines whether access should be granted, challenged or blocked under a targeted rule.
A safe policy deployment begins with limited scope and evidence of impact. Microsoft recommends report-only evaluation when introducing substantial Conditional Access changes, and emergency-access accounts should be excluded as appropriate to avoid accidentally locking out the organization. A simulated test can establish what should happen for a compliant managed device, a noncompliant device and an intentionally restricted account. Record the policy result and sign-in evidence, not merely whether the user saw an error.
A more detailed discussion of Conditional Access policy design helps explain why exclusions, authentication requirements and device rules have to be reasoned about together. That topic is relevant to today’s Microsoft 365 security operations, but studying it does not make a retired MS-101 exam bookable. The practical lesson is to identify which rule enforced a decision and to avoid broad changes when a narrowly scoped exception or corrected device setting is more appropriate.
When a user reports that Outlook or SharePoint access suddenly stopped, do not immediately disable multi-factor authentication or change a tenant-wide policy. Verify which account and resource are involved, inspect recent policy changes and sign-in logs, and check device compliance when applicable. A credential challenge, a device condition and a workload permission are different constraints. Explaining which one failed is the difference between evidence-based administration and a risky workaround.
Threat protection and security operations with Defender
Historical MS-101 included Microsoft 365 security capabilities that have evolved into today’s integrated Defender experiences. Endpoint protection, email security, identity signals and cloud-app events can contribute to investigations. Microsoft Defender XDR correlates alerts into incidents and offers relationships between affected assets and activity. Correlation is helpful, but an incident grouping is not definitive proof of attacker intent. Analysts must still evaluate what happened, which evidence is trustworthy and whether the proposed response is proportionate.
A beginner practice case can use synthetic events: a burst of failed sign-ins, one successful authentication and a device alert shortly afterward. An administrator should determine whether the events concern the same user and device, how timestamps align, what additional service telemetry exists and whether benign explanations remain possible. The initial report should separate observation from hypothesis. For example, “multiple failed sign-ins occurred” is a fact; “the attacker gained account access” requires additional supporting evidence.
Microsoft Defender for Endpoint is one specialized source of device telemetry and protection. Its operational role includes endpoint risk and investigation workflows; a related Defender for Endpoint security discussion can add depth to the service boundary. An organization should understand which endpoint actions are available under its license and assigned roles. Isolation, remediation and other disruptive response actions require appropriate authorization and assessment of business impact.
A security incident can affect service continuity as much as confidentiality. A temporary isolation policy might be sensible for an active compromise but disruptive for a device supporting a critical operation. Teams need escalation criteria, alternate service procedures, evidence preservation and named decision owners. Recording actions in sequence, including who approved containment and how recovery was validated, is more valuable than claiming every alert needs the same immediate response.
Information protection, retention and compliance responsibilities
Microsoft Purview provides a set of information-governance and compliance capabilities that can include sensitivity labels, retention policies, data loss prevention and auditing. These controls are not interchangeable. A sensitivity label describes and can help enforce how information is protected, a retention policy controls lifecycle requirements, and DLP policies may detect or restrict specified forms of data movement. Choosing one because a document “needs protection” is not sufficient; the administrator must identify the organization’s actual obligation and the behavior to enforce.
Consider a department preparing a confidential supplier agreement. The business wants the file accessible to authorized employees, protected against unintended external sharing and retained according to policy. Those requirements involve identity, resource permissions, labeling, sharing settings and document retention. A rule can appear secure yet prevent collaboration if its scope is broader than necessary. A test should check both the permitted internal workflow and a prohibited external-sharing attempt using synthetic content.
An information protection approach in Microsoft Purview can help frame sensitivity and labeling decisions, while the exact enforcement behavior depends on current product capabilities, configuration and licensing. An administrator should also distinguish compliance reporting from legal conclusions. A dashboard status alone does not establish that an organization’s regulatory obligations have all been satisfied, and a third-party tutorial does not replace counsel or an approved retention schedule.
Governance has an audit dimension as well. Administrative changes, access events and policy outcomes should be reviewed according to authorized procedures and kept only for the required purpose and period. A seemingly useful investigation can become a privacy problem if it collects unrelated employee records or exposes confidential content in a training portfolio. Synthetic files, approved test identities and minimized evidence are appropriate for learning. Production investigations require organizational consent, security responsibilities and retention limits.
Plan changes across hybrid and cloud environments
Enterprise mobility and security policies seldom operate in an entirely isolated cloud. A tenant may rely on existing Active Directory services, network gateways, VPN configuration, device provisioning tools and legacy business applications. A new Conditional Access requirement can affect an application that does not support the expected authentication flow, while a device compliance change can affect a remote worker who has not received the latest enrollment configuration. Testing must consider these dependencies rather than assume a setting works because it is supported by one Microsoft service.
A safe rollout plan identifies affected users, applications and device classes; policy prerequisites; exceptions; monitoring; the decision owner; and rollback conditions. Pilot deployment provides evidence about effects that an abstract design cannot predict. A phased approach is not a guarantee of zero disruption, but it offers a chance to detect unexpected denials before a policy is extended broadly. Report-only analysis should be compared with actual user workflows and the organization’s risk requirements.
During a migration, old and new management mechanisms may coexist temporarily. The project should document which system owns device configuration and how conflicting settings are resolved. If devices unexpectedly become noncompliant, investigate assignment and configuration drift before making a large-scale change. One of the most useful administrator skills is distinguishing a legitimate new control that a device has not yet satisfied from a policy that was scoped incorrectly.
Use historical MS-101 knowledge as a safe skills lab
An MS-101 reader in 2026 should not prepare for that exam as though it remains active. Instead, build an authorized lab around a synthetic employee account and a disposable device. Define a compliance requirement, test access to an approved application, introduce one controlled noncompliance condition and inspect the resulting policy evaluation. Restore the original device configuration and confirm that authorized access returns. Record both the allowed action and an intentional denial, because passing only the happy-path test can conceal overprivileged access.
Extend the lab with a fictional Defender incident and a confidential document protected under an approved labeling policy. For the incident, create an evidence chronology, describe an escalation decision and state what remains unverified. For the document, test permitted internal access and a blocked external-sharing attempt without using real client data. Explain which team owns each decision and how a failed policy could be reversed. This brings together the device, security and governance concerns that made MS-101 a broad enterprise administration subject.
Finally, choose current learning and certification requirements from Microsoft Learn according to the intended role—identity administrator, endpoint administrator, security operations analyst or information protection specialist. Such paths overlap with historical MS-101 themes, but are not official automatic substitutes for that exam. The enduring skill is the ability to enforce appropriate access, investigate credible evidence, respect data obligations and recover safely when a change affects people who depend on Microsoft 365 services.