MS-102 study plan

Your step-by-step plan

1. Map the blueprint and book a date

   Day 1

   Read the official Microsoft skills outline and the four domains with their weights. Book a provisional date now, because a fixed date turns open-ended study into a plan and is the strongest predictor of actually sitting. Note that tenant administration and Defender XDR are the two heaviest domains, more than half the exam between them.

2. Build the least-privilege role map

   Week 1

   Before drilling any domain, build the role-to-task table the whole exam rests on: Domain Name Administrator for domains, Service Support Administrator for service health, Authentication Policy Administrator for SSPR, Helpdesk Administrator for password resets, the Secure Score read-and-write roles. Use the recall prompts in this guide: cover the answer, pick the narrowest role from the task, then reveal. If you reach for Global Administrator, you do not own it yet.

3. Go deep on tenant administration (Domain 1)

   Weeks 1 to 2

   This is the largest domain, so it gets the most time. Drill admin-centre selection, user and licence management, the distribution-list and Service health behaviours, and the full add-and-verify-a-domain DNS flow. Practise on scenario questions and read the worked explanation on every one, including the ones you got right, watching for the least-privilege word that picks the role.

4. Lock identity and hybrid sync (Domain 2)

   Weeks 2 to 3

   Separate Authentication Policy Administrator from Authentication Administrator, then drill the Connect Sync versus Cloud Sync split by named scenario, the Connect Health P1 or P2 licensing line, and documented side effects like SMS sign-in skipping cross-tenant sync. Configure SSPR and a Conditional Access policy in a test tenant if you can, because hands-on locks the blades in memory.

5. Cover Defender XDR (Domain 3)

   Weeks 3 to 4

   Anchor on the rule that the Defender portal surfaces only licensed and provisioned products, then learn each workload's go-to capability: alert tuning for benign noise, the Secure Score read-and-write roles, and small documented facts like Cloud App discovery refreshing four times a day. Drill scenario questions and name why a capability in another portal was the wrong destination.

6. Lock Purview compliance and drill weak domains (Domain 4)

   Weeks 4 to 5

   Burn in retention policy versus label, the records-declaration rule, the preservation locations by workload, and the multi-location DLP condition constraint. Then use your per-domain accuracy to attack the two domains dragging you down, not to re-read what you already know, and space the review across a few days.

7. Sit a timed mock and calibrate

   Weeks 5 to 6

   Take at least one full timed mock under exam conditions, including a case study, to rehearse pacing and the flag-and-return habit. Treat the score as a per-domain readiness signal, not a single number, and review every missed question, naming the role or documented behaviour you misread, before you book or sit.

Frequently asked questions