These are original illustrative Microsoft 365 administration practice scenarios, not actual MS-102 exam questions or a guaranteed representation of its delivery format. They focus on diagnosing administrative boundaries and justifying decisions. On October 27, 2026, MS-102 remains scheduled to retire November 30, so candidates should study the English objectives effective April 28 rather than beta-era outlines.
Scenario 1: Recover an employee who lost an MFA device
A privileged employee reports a lost phone used for Microsoft Entra multifactor authentication. The company requires strong authentication for privileged access and must restore legitimate sign-in without disabling that policy. What should a helpdesk administrator check before changing the account?
First verify the caller’s identity through an approved recovery process, assess the applicable sign-in policy, and use the supported authentication-method recovery or temporary access procedure where authorized. Simply switching off MFA weakens the intended security boundary. Resetting an unrelated password does not necessarily restore access to a missing authentication method.
A complete explanation also accounts for administrators who lack sufficient role scope, whether a Temporary Access Pass can be used under tenant policy, how old methods are removed, and how re-registration is confirmed. The choice depends on current Microsoft features and the organization’s verified recovery process, not a memorized ‘reset MFA’ button.
Scenario 2: Intune policy applies inconsistently
A device configuration profile reaches some enrolled users but not others. A candidate is offered four possible solutions: turn off all compliance rules, give every account Global Administrator, check device enrollment and eligible licensing, or reset the entire tenant. Which is the defensible first investigation?
Check assignment scope, device enrollment state, platform applicability, policy conflicts, required licensing and available deployment logs. The correct licensing requirements depend on the chosen Intune capabilities and service plans; do not infer them from a product family name alone. Excessive tenant privileges are not a substitute for a managed device state.
The test distinguishes an administrative configuration problem from an entitlement problem. If the target device lacks the profile because a group assignment excludes it, buying additional licenses alone cannot correct scope. If an included user lacks a required entitlement, changing the assignment will not necessarily allow the feature to work.
Scenario 3: License the right people, not every mailbox
A business has employees who require desktop productivity applications, field staff who use cloud services only, and a shared mailbox used by several people. The administrator has to review whether every mailbox needs the same subscription. How should the requirement be approached?
Start from the actual services and users. Compare appropriate Microsoft 365 product entitlements against device, desktop-app, mailbox and security requirements. A shared mailbox may not need its own separate license under documented conditions, but licensing can become required when storage, archive, compliance or other product limits apply.
Do not treat a fixed example allocation as universally cost-optimal. Count actual human users, inspect required applications, check mailbox licensing exceptions, and document why each chosen plan is sufficient. The decision changes when a field worker needs desktop apps or a shared mailbox crosses a feature threshold.
Scenario 4: A user can sign in but cannot use an assigned service
An employee has a Microsoft Entra account but cannot open a licensed Microsoft 365 application. The service desk sees no widespread outage. What checks can separate licensing, authentication and application-side assignment?
Use the admin center to confirm relevant service-plan assignment and provisioning state, then inspect sign-in information and application access. A newly created user can exist without a productivity license, yet that identity does not automatically inherit the paid app’s entitlement. Conditional Access can also block an otherwise licensed account.
A good explanation states which observation would falsify each hypothesis. A valid license with a policy block points away from procurement; a normal sign-in with missing app entitlement points to assignment. This discipline prevents broad tenant changes made only because an administrator recognizes a related product name.
Scenario 5: Defender XDR raises a cross-workload alert
A suspected phishing event involves email delivery, endpoint activity and an identity risk signal. Should the administrator address only the suspicious message, disable all user accounts, or correlate the relevant Defender XDR incident evidence before deciding containment?
Investigate the correlated evidence and assess scope. The response may require supported Defender for Office 365, Defender for Endpoint or identity controls, but action must be proportionate. A message-only response can miss a compromised endpoint; indiscriminate account deletion can interrupt legitimate business and destroy evidence.
The administrator should identify alert ownership, permitted actions and post-incident review. Microsoft Defender XDR is not merely a report screen; its value depends on meaningful incident interpretation and coordination with the teams authorized to remediate the underlying weakness.
Scenario 6: Retention and data loss prevention conflict with a workflow
A department must share sensitive files with an approved external partner while preventing routine disclosure outside the project. A proposed DLP policy blocks all sharing, including the agreed business workflow. What architecture and administration decision is needed?
Define information classification and allowed recipients, then design proportionate Microsoft Purview controls with approved exceptions, notifications, auditing and retention requirements. Turning off every DLP rule undermines the protection objective. Blocking all collaboration without an exception path fails the documented business requirement.
This is related to Microsoft 365 administration skills: the role requires coordination between identity, workload, Defender and Purview specialists. An adequate answer identifies not only a setting but the business owner, policy boundary and proof that intended access is both possible and constrained.
Scenario 7: Distinguish a Microsoft service incident from local failure
Users in several offices report that one Microsoft 365 application suddenly fails. The organization has recently changed proxy settings, but the Microsoft 365 admin center also lists a service advisory. Which evidence should an administrator collect before making widespread network changes?
Correlate the published service-health incident with affected workloads, regions, timestamps and user populations. Compare users who are affected and unaffected, then validate network reachability and authentication traces. A service advisory is evidence of a possible shared cause, not proof that every local error comes from Microsoft. Reverting every proxy setting would be premature.
The lesson is to select the next discriminating observation. If clients on multiple unrelated networks experience the same acknowledged service degradation, focus on service impact and approved communication. If one location fails while others succeed, test local connectivity, DNS and policy differences. Keep evidence of the decision and verify resolution.
Scenario 8: Assign a limited administrative role
A service-desk team must reset ordinary user passwords and review common access complaints without modifying tenant-wide security policies. A proposal gives every service-desk worker Global Administrator because it appears to avoid permission errors. Why is that a poor design?
Global Administrator creates far more authority than the task needs. Choose appropriate Microsoft Entra and Microsoft 365 roles under current product documentation, assess administrative-unit scope where applicable and test which identities a delegated operator may modify. Some administrator accounts require stronger protection and cannot be reset by an ordinary password role.
The outcome to verify is that helpdesk operations succeed within their intended scope while tenant-wide policy and sensitive privileged accounts remain protected. If a task fails, inspect effective role assignments and scope before escalating rights. Privilege should be expanded for a documented requirement and narrowed again when the exception closes.
Scenario 9: Investigate a Conditional Access policy conflict
A licensed employee has a valid account and successfully completes an MFA challenge, but access to a sensitive application remains blocked from an unmanaged device. A candidate suggests disabling the MFA requirement because the sign-in was unsuccessful. What important distinction has been missed?
Multiple Conditional Access policies can impose requirements on the same sign-in. Satisfying MFA does not override another applicable policy that requires device compliance or blocks the sign-in. Review assignments, exclusions, device context, sign-in logs and the exact policy result before editing any protection.
Correct troubleshooting preserves the organization’s intended access boundary. If unmanaged devices are prohibited by policy, the proper outcome may be to use an approved managed device rather than weaken the rule. If the block was unintended, the administrator should test a scoped change and confirm that unaffected applications and emergency access still behave properly.
The distinction between support action and security approval appears throughout these examples. An administrator should not grant Global Administrator or disable a protection policy just to make a test user’s problem disappear. A correct response identifies the appropriate owner, the narrowest change that solves the observed problem, and the evidence that it worked. In sensitive environments, even a successful technical configuration may need change review, a documented exception and a rollback plan before deployment.
How to evaluate scenario readiness
Review every explanation for the decisive observation. A lost authenticator is not the same issue as a wrong password. A missing license differs from an unsupported profile target. A shared mailbox has licensing conditions rather than a blanket rule. A Defender incident and a Purview policy require different evidence and owners.
The MS-102 current blueprint provides the authoritative version context for these original exercises, while MS-102 hands-on practice can support applied troubleshooting. Do not mistake the number of examples here for the number of questions in the real examination.
A useful practice question changes how you reason about Microsoft 365 administration. If you can identify the first discriminating check and justify a secure least-disruptive response, the exercise has taught a transferable skill.