MS-102 retires on November 30, 2026, so the study plan should be focused, current, and practical. Follow the April 28, 2026 Microsoft study guide, not older weightings or a future replacement credential. A useful sequence is tenant administration first, then hybrid identity and secure access, Defender XDR, Purview, and finally cross-workload scenarios. The current MS-102 study-guide weights are 25–30%, 25–30%, 30–35%, and 10–15%.
Phase one: build a tenant-management baseline
Review tenant creation, custom domains, org profile/security settings, Service Health, network connectivity, software updates, adoption/usage, and Microsoft 365 Backup. Use a test tenant or Microsoft training environment where available.
A Microsoft 365 admin center walkthrough should become familiar enough that you know which admin boundary owns each tenant-level task without memorizing menu locations.
Phase two: practice users, groups, licenses, and roles
Create users, guest users, Microsoft 365 Groups, contacts, and shared mailboxes. Apply group-based licensing and practice bulk management through PowerShell concepts.
Then compare Microsoft 365 roles, Entra roles, Defender/Purview role groups, administrative units, and PIM. Make least privilege your default study lens.
Phase three: add identity synchronization
Study IdFix, Entra Connect Sync, Entra Cloud Sync, Connect Health, and synchronization troubleshooting. Build a diagram that shows the authoritative source, synchronization engine, Entra tenant, and downstream user authentication.
Introduce one invalid attribute, duplicate account, or sync-health problem and identify the evidence before changing sign-in policies.
Phase four: master authentication and secure access
Review authentication methods, SSPR, Password Protection, Identity Protection, Conditional Access, and MFA. Build policies for ordinary users, administrators, guests, and high-risk access.
A Conditional Access lab should include a break-glass/emergency access consideration so a policy mistake does not lock every administrator out.
Phase five: make Defender XDR the largest security block
Spend proportionate time on Security Exposure Management, Secure Score, incidents, alerts, reports, advanced hunting, and Defender Threat Intelligence. Practice investigating one incident rather than reading every product page independently.
The goal is to understand how signals from different Microsoft 365 security products combine into a case.
Phase six: work through Defender for Office 365
Review anti-phishing/threat policies, Safe Links/Safe Attachments concepts, alert policies, investigation/remediation, attack simulations, training campaigns, and restricted entities. Use harmless test scenarios and vendor training data rather than real phishing.
Trace one message from delivery to detection, user report, investigation, remediation, and any related identity action.
Phase seven: add Endpoint and Cloud Apps protection
Study onboarding and settings for Defender for Endpoint, Vulnerability Management, and device-related incidents. Then review the Microsoft 365 connector, activity logs, Cloud App Discovery, and policy alerts in Defender for Cloud Apps.
Compare what each product knows: endpoint process/device context versus SaaS/cloud-application behavior.
Phase eight: finish the technical scope with Purview
Build sensitive information types, sensitivity labels, retention labels/policies, and DLP scenarios. Include Exchange, SharePoint, OneDrive, Teams, Power BI, Microsoft 365 Copilot, and Endpoint DLP conceptually.
A Teams security and compliance scenario is useful because collaboration data can be governed by both identity/security and Purview controls.
Phase nine: practice cross-workload incidents
Use scenarios such as a guest user sharing sensitive data, a phished employee with risky sign-in, a compromised endpoint accessing SaaS data, or a DLP alert tied to collaboration activity. Decide which portal/control plane owns each part of the response.
This is closer to the “integrating hub” role than studying one workload administrator at a time.
Finish with retirement-aware exam readiness
Schedule early enough that November 30 is not your only option after weeks of preparation. Keep the April 28 scope frozen, review the detailed study guide line by line, and remove topics that belong only to successor credentials.
Keep one reference company throughout preparation: a hybrid organization with on-premises AD DS, two verified domains, remote users, guests, Microsoft 365 Groups, endpoints, Teams/SharePoint collaboration, and sensitive customer data. Reusing one environment makes tenant, identity, security, and compliance relationships much easier to remember.
During tenant study, add a domain and plan DNS records conceptually, then map users and licenses to that domain. Review the organization profile, privacy/security settings, Service Health notifications, and adoption reports. Tenant administration should feel like operating a service, not creating objects once.
Add a Microsoft 365 Backup tabletop even if the tenant lacks the license. Define what data is business-critical, what recovery scenario backup addresses, and how this differs from retention. This keeps the current objective visible without requiring expensive production configuration.
During license study, create one group-based licensing case where a service-plan dependency fails. Diagnose whether the problem is insufficient licenses, group membership, usage location, or service plan. Licensing problems often masquerade as workload problems.
During roles study, make a matrix of common administration tasks and the narrowest role or role group that can perform them. Add administrative-unit scoping and PIM activation for high-impact Entra roles. This is one of the best ways to internalize least-privilege delegation.
During sync study, deliberately separate four questions: Does the object exist on-premises? Did it sync? Is the cloud identity correct? Can it authenticate? This prevents jumping into sign-in policy when the object never synchronized properly.
Add a password-reset scenario where SSPR is configured but the user cannot complete the process. Check registration, authentication methods, policy scope, and hybrid writeback requirements where applicable. SSPR is a workflow with dependencies, not just a portal toggle.
During Conditional Access study, begin in report-only mode and review sign-in results. Create policies by persona—standard user, admin, guest, risky user—and document exclusions. A policy that is secure but locks out emergency administration is an operationally incomplete design.
During XDR study, choose one incident and follow the entity graph rather than opening every Defender portal. Note user, device, mailbox, IP, cloud app, and alert timeline. Correlation is the reason the security domain is bigger than a collection of product-specific objectives.
Add an advanced-hunting session with three focused questions: Which users saw the malicious URL? Which devices contacted the indicator? Which sign-ins followed the message? Keep the queries simple enough that the security reasoning remains more important than KQL syntax.
During Defender for Office 365 study, compare preventive policy with response. Anti-phishing or Safe Links-style controls reduce exposure, while investigation and remediation remove messages or contain affected users after detection. Both stages belong to the exam.
During Endpoint study, compare an active incident with a vulnerability recommendation. In one case you may isolate or investigate malicious activity; in the other you may patch or change configuration. The distinction helps prevent overreaction in scenario questions.
During Cloud Apps study, identify one sanctioned and one unsanctioned SaaS application. Use activity or discovery evidence to decide whether policy should alert, restrict, or simply monitor. Governance should be proportional to actual application risk and business need.
During Purview study, create one sensitive information type and use it in both a sensitivity-label/DLP scenario. Then add a retention requirement for the same document. This demonstrates why one piece of content can be subject to multiple policies for different reasons.
Add one Copilot data scenario. A user asks Copilot about a confidential project and receives content from an overshared SharePoint site. The root cause may be permissions and information governance, not Copilot itself. This is a current cross-workload example worth practicing.
Use the final week for retirement-specific prioritization. Do not start broad new topic areas that are outside the April 28 guide. Review weak objectives, complete mixed scenarios, schedule the exam with margin, and keep successor-credential material in a separate note so it does not distort the live MS-102 scope.
Before the exam, recreate the four study-guide weights and one practical task for each from memory. If you can explain how tenant management, Entra, Defender XDR, and Purview cooperate in one incident, you have reached the integrating-hub perspective Microsoft expects.
Add one external-user lifecycle scenario after user/group study. Invite a guest, place the guest in a group, apply a narrow resource permission, then remove access when the collaboration ends. This ties identity creation, group membership, Conditional Access, and sharing governance into one repeatable process.
Add one service-health incident where Microsoft reports degradation. Compare what the administrator should communicate and monitor with what would happen if the problem were local tenant configuration. Learning when not to change configuration is an important operational skill.
During Defender XDR study, create a response checklist that begins with incident scope, affected identities/devices/messages/apps, containment options, evidence preservation, and validation. This keeps investigations consistent and makes it easier to spot which product-specific action should follow.
During Purview study, include one false-positive DLP case. Tune the rule or exception based on business context rather than disabling DLP completely. This prepares you for scenarios where a control is valuable but its initial implementation is too disruptive.
Add one PowerShell-focused review for bulk user or license administration. The exam does not require becoming a scripting specialist, but current administrators should recognize when automation is safer and more consistent than hundreds of manual edits—and when a script needs testing before tenant-wide execution.
Before final practice, build a one-page “which portal/control?” table: Microsoft 365 admin center for tenant/services, Entra for identity/access, Defender XDR and product portals for threats, Purview for data governance. This simple classification can save time in cross-workload scenario questions.
The MS-102 administration material should help with breadth, but final preparation should be driven by the live guide and the retirement date. Within the Microsoft certification path, timing is now part of the exam strategy.