MS-102 study plan for Microsoft 365 administrators in 2026

By Yaïr Knijn, Microsoft Certified Trainer — Updated 10 May 2026

MS-102 is the practical Microsoft 365 administrator exam for teams that own tenants, identities, security operations, and compliance workflows. The 2026 blueprint puts the heaviest weight on Defender XDR and Entra identity, so a useful plan starts there instead of treating the exam as a generic M365 overview.

Primary source checked on 2026-05-10: Exam MS-102: Microsoft 365 Administrator. Use the Microsoft page as the final source of truth before booking an exam or committing a remediation plan.

Who this is for

  • Microsoft 365 admins moving from helpdesk or endpoint work into tenant ownership.
  • IT teams that need one administrator to connect Entra, Defender, Purview, and tenant governance.
  • Consultants preparing to run M365 readiness or hardening workshops for customers.

What to work on first

  • Map your tenant work to the four MS-102 domains: tenant management, Entra identity and access, Defender XDR, and Purview compliance.
  • Build labs around real admin decisions: break-glass accounts, admin roles, Conditional Access, alert triage, retention, and audit evidence.
  • Use practice assessment results as a routing tool, not as proof of readiness. Weak Defender or Purview scores usually mean the tenant concepts are not connected yet.

Team training angle

For a team, MS-102 works best as a 3 to 5 day sequence: day one on tenant and role governance, day two on Entra and access controls, day three on Defender XDR, and day four on Purview evidence. Add a fifth day only when the team needs lab time in its own tenant.

One-week action plan

  • Day 1: inventory your tenant, admin roles, licensing, and identity sync assumptions.
  • Day 2: review Conditional Access, privileged roles, access reviews, and authentication methods.
  • Day 3: walk Defender XDR incidents from alert to remediation.
  • Day 4: map Purview retention, DLP, audit, and compliance score actions.
  • Day 5: run a mock change review and write the remediation backlog.

Where Cloud Evolvers fits

Cloud Evolvers can run MS-102 as an exam prep course or as an operational Microsoft 365 administrator workshop where the output is a tenant backlog, not just a certificate plan.

Need a first Microsoft cloud compliance backlog? Run the free readiness scanner.

Run the readiness scanner

Frequently asked questions

Is MS-102 only for exam candidates?

No. The MS-102 domains are also a useful operating model for Microsoft 365 administrators who own tenant security and compliance.

What should I study first for MS-102?

Start with Entra identity and Defender XDR, then connect those decisions to tenant governance and Purview compliance.