MS-102 is the practical Microsoft 365 administrator exam for teams that own tenants, identities, security operations, and compliance workflows. The 2026 blueprint puts the heaviest weight on Defender XDR and Entra identity, so a useful plan starts there instead of treating the exam as a generic M365 overview.
Primary source checked on 2026-05-10: Exam MS-102: Microsoft 365 Administrator. Use the Microsoft page as the final source of truth before booking an exam or committing a remediation plan.
Who this is for
- Microsoft 365 admins moving from helpdesk or endpoint work into tenant ownership.
- IT teams that need one administrator to connect Entra, Defender, Purview, and tenant governance.
- Consultants preparing to run M365 readiness or hardening workshops for customers.
What to work on first
- Map your tenant work to the four MS-102 domains: tenant management, Entra identity and access, Defender XDR, and Purview compliance.
- Build labs around real admin decisions: break-glass accounts, admin roles, Conditional Access, alert triage, retention, and audit evidence.
- Use practice assessment results as a routing tool, not as proof of readiness. Weak Defender or Purview scores usually mean the tenant concepts are not connected yet.
Team training angle
For a team, MS-102 works best as a 3 to 5 day sequence: day one on tenant and role governance, day two on Entra and access controls, day three on Defender XDR, and day four on Purview evidence. Add a fifth day only when the team needs lab time in its own tenant.
One-week action plan
- Day 1: inventory your tenant, admin roles, licensing, and identity sync assumptions.
- Day 2: review Conditional Access, privileged roles, access reviews, and authentication methods.
- Day 3: walk Defender XDR incidents from alert to remediation.
- Day 4: map Purview retention, DLP, audit, and compliance score actions.
- Day 5: run a mock change review and write the remediation backlog.
Where Cloud Evolvers fits
Cloud Evolvers can run MS-102 as an exam prep course or as an operational Microsoft 365 administrator workshop where the output is a tenant backlog, not just a certificate plan.