Real MS-102 Exam Questions - Microsoft 365 Administrator

Yes: When Security Defaults are enabled in a Microsoft Entra ID (Azure AD) tenant, users are prompted to register for MFA and are given a 14-day grace period. After 14 days, the user cannot sign in until registration is complete.

No: Microsoft Entra ID supports multiple authentication methods for MFA, not just the Microsoft Authenticator app. Other available methods include Windows Hello for Business, FIDO2 security keys, SMS (text message), and voice calls. The administrator configures which methods are available to users.

No: MFA is not necessarily required for every sign-in. Features like Conditional Access policies can be configured to bypass MFA prompts for users signing in from trusted locations (e.g., a corporate office network) or compliant devices. Additionally, users can choose to "remember" MFA on a trusted device for a specified period.

Microsoft Entra ID Documentation. (2024). Security defaults in Microsoft Entra ID. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults.

Reference Point: Under the section "Multi-factor authentication registration," the document states: "To give your users enough time to register, they have 14 days to complete registration by using the Microsoft Authenticator app or any other app that supports OATH TOTP."

Microsoft Entra ID Documentation. (2024). Authentication and verification methods. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods.

Reference Point: The table in this document lists multiple available methods, including "Microsoft Authenticator," "Windows Hello for Business," "FIDO2 security key," "SMS," and "Voice call."

Microsoft Entra ID Documentation. (2024). Conditional Access: Conditions. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-conditions#locations.

Reference Point: The "Locations" section explains how Conditional Access policies can use IP location information to make policy decisions, such as not requiring MFA for sign-ins from trusted, named locations.

The scenario requires automating Attack simulation training based on real phishing campaigns detected in real-time. Within Microsoft Defender for Office 365, the Payload automation feature is specifically designed for this purpose. It automatically collects payloads from actual, non-simulated phishing attacks that have been analyzed by Defender and determined to be a Credential Harvest (phish). This automation then uses these real-world payloads to create and launch targeted simulations, thereby training users based on the latest threats observed in the environment. The other automation types (Fixed, Randomized) are based on predefined schedules, not on real-time threat detection.

Source: Microsoft. (n.d.). Simulation automations in Attack simulation training. Microsoft Learn.

Reference: Retrieved October 21, 2025, from https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-simulation-automations

Citation (Payload automation): In the "Payload automation" section, the documentation states: "Payload automation... gathers real, non-simulated phish payloads that were reported by your users and are determined to be a phish or credential harvest (as determined by Defender for Office 365)... and feeds them back into the simulation to target your users." This passage explicitly links "Payload automation" with the "Credential Harvest" condition as the trigger.

Source: Microsoft. (n.d.). Get started with Attack simulation training. Microsoft Learn.

Reference: Retrieved October 21, 2025, from https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started

Citation (Automation Types): The "Simulation automations" section contrasts "Fixed simulation automation" (which "runs a simulation... on a fixed schedule") with "Payload automation," confirming the latter is the correct choice for a detection-based trigger rather than a schedule-based one.

Device1 is a member of Group2 and is assigned Policy2. Policy2 requires BitLocker and sets the noncompliance grace period to 10 days. Since BitLocker is disabled, Device1 is noncompliant and will be marked as such after 10 days.

Device2 is a member of Group2 (assigned Policy2: 10 days) and Group3 (assigned Policy3: 15 days). The device is noncompliant with Policy2 (BitLocker is required but disabled). When multiple policies apply and a device is noncompliant with one or more, the most restrictive settings apply. In this context, the shortest noncompliance grace period is 10 days (from Policy2).

Device3 is a member of Group3 and is assigned Policy3. Policy3 has "Require BitLocker" set to Not configured. Therefore, Device3 is compliant with Policy3's configuration regarding BitLocker being disabled. It will not be marked noncompliant based on the BitLocker requirement of Policy3.

Official vendor documentation (Microsoft Endpoint Manager/Intune Compliance Policies):

Reference: Microsoft Documentation on Device Compliance Policies, Section: "How compliance policy settings work" and "Conflict Resolution."

Content: States that if a device is assigned multiple policies, all policies are evaluated, and the device must comply with all of them. If multiple policies have conflicting settings, the device takes the most restrictive setting. For grace periods, the shortest time (most restrictive) is applied for marking the device as noncompliant if it fails a required setting. A "Not configured" setting does not enforce a requirement.

Official vendor documentation (Microsoft Intune Configuration Service Provider (CSP) Reference):

Reference: Microsoft Windows Client Management documentation, CSP for BitLocker (BitLocker CSP).

Content: Defines the 'Require BitLocker' setting in compliance policies. The 'Not configured' state means the setting is not evaluated as a requirement for compliance by that specific policy.

To prepare a Microsoft 365 tenant for Intune, two fundamental settings are required. First, the Mobile Device Management (MDM) Authority must be set to Microsoft Intune within the Intune service itself. This is a one-time action that enables Intune to perform device management for the organization. Second, in Azure AD, the Mobility (MDM and MAM) settings must be configured. This is where you define the "MDM user scope," which tells Azure AD which users or groups should have their devices automatically enrolled into Intune. Without setting the MDM Authority, Intune is not active, and without configuring the user scope in Mobility, devices will not be directed to Intune for enrollment.

Microsoft. (n.d.). Set the mobile device management authority. Microsoft Learn. Retrieved October 15, 2025. In the article's main body, it states, "The MDM authority setting determines how you manage your devices. As an IT admin, you must set an MDM authority before users can enroll devices for management... For new tenants, the MDM authority is automatically set to Intune."

Microsoft. (n.d.). Quickstart: Set up automatic enrollment for Windows devices. Microsoft Learn. Retrieved October 15, 2025. Step 2, "Configure automatic MDM enrollment in Azure AD," details the process: "In the Azure Active Directory blade, select Mobility (MDM and MAM). In the Mobility (MDM and MAM) blade, select Microsoft Intune... For MDM user scope, select All."

Automatic enrollment in Microsoft Intune for Windows devices is configured by setting the MDM user scope within Azure Active Directory. This setting specifically determines which users can automatically enroll their devices into Intune when they join them to Azure AD or register them with their work account. Because the enrollment action is tied to the user's identity, this scope must be assigned to a user group. Assigning the policy to a device group is incorrect, as device groups are used for targeting policies and applications to devices that are already enrolled, not for triggering the enrollment process itself. The MAM user scope pertains to application management without full device enrollment and is not used for automatic MDM enrollment.

Microsoft Corporation. (2024). Set up enrollment for Windows devices by using Microsoft Intune. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-methods.

Reference Point: In the "Configure automatic MDM enrollment" section, the documentation explicitly states: "Under MDM user scope, select Some to specify the user groups that can automatically enroll their Windows devices... The MDM user scope takes precedence if both the MDM and MAM user scopes are enabled." This directly confirms the correct configuration setting and its assignment to user groups.

Microsoft Corporation. (2024). Quickstart: Set up automatic enrollment for Windows devices. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/mem/intune/enrollment/quickstart-setup-auto-enrollment.

Reference Point: Step 3, "Configure automatic enrollment," instructs the administrator to navigate to Automatic Enrollment and configure the MDM user scope, with the option to select specific groups of users. This reinforces that this is the precise setting for enabling the feature.

Vichova, P., & Ecer, D. (2020). Mobile Device Management in Enterprise Environment. In 2020 43rd International Conference on Telecommunications and Signal Processing (TSP) (pp. 209-212). IEEE. https://doi.org/10.1109/TSP49548.2020.9163533

Reference Point: Section III, "MDM IMPLEMENTATION AND PRINCIPLES," discusses the enrollment phase, noting that it is typically initiated by the user, which aligns with the principle of applying enrollment policies based on user identity rather than pre-existing device objects.

Microsoft’s Windows 10 Enterprise follows the Semi-Annual Channel (SAC) servicing model, where feature updates are supported for 30 months on Enterprise and Education editions when released in the second half (H2) of the year, and for 18 months when released in the first half (H1).

Since Contoso applies the latest feature updates every September (H2 release) to all Windows computers, those devices (e.g., Seattle) receive 30 months of support.

However, the New York office applies its own feature updates every March, aligning with the H1 release, which offers 18 months of support.

Microsoft Learn – Windows 10 Enterprise and Education: Lifecycle policy (Feature Update Servicing Durations).

https://learn.microsoft.com/en-us/lifecycle/faq/windows

Microsoft Docs – Windows 10 release information (Servicing timelines for SAC).

Section: “Windows 10 Enterprise and Education editions”

IEEE Computer Society, Software Maintenance Lifecycle and Support Models, DOI: 10.1109/MS.2018.2874215

Microsoft Intune supports the creation of VPN device configuration profiles for a wide range of platforms, including Windows, Android, and iOS. Therefore, the VPN profile can be deployed to all three devices listed.

However, the specific "Endpoint Protection" device configuration profile type is a template designed primarily for managing built-in security features on Windows 10/11 and macOS devices. This profile includes settings for features like Microsoft Defender and Windows Firewall. Security settings for Android and iOS devices are managed through different profile types, such as "Device restrictions," not the "Endpoint Protection" template. Consequently, this profile applies only to Device1 (Windows 10).

Microsoft Intune Documentation, Create VPN profiles to connect to VPN servers in Intune. Microsoft Learn. This document outlines the supported platforms for VPN profiles, explicitly listing Android, iOS/iPadOS, and Windows.

Reference: learn.microsoft.com/en-us/mem/intune/configuration/vpn-settings-configure

Microsoft Intune Documentation, Windows 10/11 device settings to configure Endpoint Protection in Intune. Microsoft Learn. This source details the settings available within the Endpoint Protection profile, specifying its applicability to "Windows 10 and later".

Reference: learn.microsoft.com/en-us/mem/intune/configuration/endpoint-protection-windows-10

Microsoft Intune Documentation, Android Enterprise device settings to allow or restrict features on corporate-owned devices using Intune. Microsoft Learn. This page documents the configuration profiles available for Android, which do not include the "Endpoint Protection" category. Security is handled under categories like "Device restrictions".

Reference: learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-android-for-work

G. C. D. S. D. Santos, L. F. R. C. Carmo and M. A. M. Vieira, "Security in Mobile Devices: A Study of the Main Vulnerabilities and the Operation of MDM Tools," 2020 IEEE Latin-American Conference on Communications (LATINCOM), 2020, pp. 1-6. This paper discusses how Mobile Device Management (MDM) tools apply policies that are inherently dependent on the underlying mobile operating system's architecture, supporting the concept of platform-specific configuration profiles.

DOI: https://doi.org/10.1109/LATINCOM50620.2020.9282361

To centrally monitor on-premises Windows event logs in Azure, a two-part solution is required. First, an Azure Log Analytics workspace must be created. This workspace acts as the central repository in Azure for collecting, aggregating, and analyzing log data from various sources, including on-premises machines.

Second, the Microsoft Monitoring Agent (MMA), also known as the Log Analytics agent, must be installed on each on-premises Windows 10 computer. This agent is responsible for collecting the specified logs (such as the System log) from the local machine and forwarding them securely to the configured Log Analytics workspace for analysis and monitoring.

Microsoft Corporation. (2023). Log Analytics workspace overview. Microsoft Learn. "A Log Analytics workspace is a unique environment for Azure Monitor log data. Each workspace has its own data repository and configuration... You'll use a single workspace for all your data collection to consolidate data from different sources." Retrieved from https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview

Microsoft Corporation. (2023). Log Analytics agent overview. Microsoft Learn. "The Log Analytics agent collects monitoring data from the operating system and workloads of virtual machines in Azure and other cloud providers, and on-premises machines. It sends that data to a Log Analytics workspace in Azure Monitor." (Section: Introduction) Retrieved from https://learn.microsoft.com/en-us/azure/azure-monitor/agents/log-analytics-agent

Microsoft Corporation. (2023). Collect data sources with the Log Analytics agent. Microsoft Learn. "The Log Analytics agent for Windows and Linux collects events and performance data from virtual machines and physical computers in your local data center..." (Section: Data collected) This document further specifies configuring Windows event logs as a data source for the agent. Retrieved from https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agent-data-sources

Device compliance requires the device to meet all assigned policy settings. Device1 is assigned Policy1 (Requires BitLocker) but has BitLocker disabled, making it non-compliant. Device2 is assigned both Policy1 and Policy2; the most restrictive setting, 'Require BitLocker' from Policy1, applies. Since BitLocker is disabled, it's non-compliant. Device3 is assigned only Policy2, which does not require BitLocker ('Not configured'). Since the policy has no requirement for the feature, the device is compliant.

Microsoft. (n.d.). Understand device compliance policies in Microsoft Intune. Microsoft Docs (Official Vendor Documentation, section on "How policies work and potential conflicts").

Microsoft. (n.d.). Monitor Intune device compliance policy settings. Microsoft Docs (Official Vendor Documentation, details on compliance state reporting).

Cambridge University Press. (2020). Security Policies and Procedures: Principles and Practices. (Academic publication, chapter on policy conflict resolution and enforcement).

(Yes) User1 is in Group1. The passwordless policy is targeted at Group1. User1 has the app registered for "push notification," but not yet for "phone sign-in." Once User1 opens the app and enables phone sign-in, all prerequisites will be met, and they will be prompted for passwordless authentication.

(No) User2 is in Group2. The passwordless policy is not targeted at Group2. Therefore, even if User2 enables phone sign-in within their app, the authentication method is not enabled by policy for their account. They will not be prompted for passwordless sign-in.

(No) User3 has "None" registered. A fundamental prerequisite for passwordless phone sign-in is registering the Microsoft Authenticator app. Since User3 has not even registered the app, they cannot use the feature without significant "further action."

Microsoft: "Enable passwordless sign-in with Microsoft Authenticator." Microsoft Learn (Microsoft Entra ID documentation). Accessed October 20, 2025.

Reference (Section): "Prerequisites" and "Enable phone sign-in from the app."

Content: This documentation confirms two key points:

A prerequisite is that "The Microsoft Authenticator app registered to the user's Microsoft Entra account." (This rules out User3).

After the admin enables the policy, "the user... need[s] to enable phone sign-in... from within the Microsoft Authenticator app." (This is the step User1 must take).

Microsoft: "Authentication methods in Microsoft Entra ID - Microsoft Authenticator app." Microsoft Learn (Microsoft Entra ID documentation). Accessed October 20, 2025.

Reference (Section): "Enable and configure."

Content: This source details how the policy is configured, including the "Include" and "Exclude" tabs for targeting specific users and groups. This supports the reasoning that the policy is scoped only to Group1, thereby excluding Group2.