🔒 Guided

Pre-launch preview. Authorised access only.

Incorrect code

Guided by A Guide to Cloud
Explore AB-900 AI-901
Guided MS-102 Domain 1
Domain 1 — Module 1 of 8 13%
1 of 28 overall

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response
Domain 1: Deploy and Manage a Microsoft 365 Tenant Premium ⏱ ~15 min read

Establish and Configure Your M365 Tenant

Create a Microsoft 365 tenant, add custom domains, and configure organisation settings — the foundational decisions that shape everything else.

What does “establishing a tenant” actually mean?

☕ Simple explanation

A tenant is your organisation’s private corner of the Microsoft cloud.

Think of it like signing the lease on a new office building. The building (Azure infrastructure) already exists — you’re claiming a floor, putting your name on the door, adding your logo, setting the door codes, and deciding which rooms people can access. That lease agreement is your tenant — a dedicated, isolated instance of Microsoft 365 tied to your organisation’s identity.

The first three decisions — region, domain, and org settings — are permanent or expensive to change later. Get them right now.

A Microsoft 365 tenant is a dedicated instance of Microsoft Entra ID and Microsoft 365 services, provisioned when an organisation signs up for a Microsoft cloud subscription. Each tenant receives:

  • A unique tenant ID (GUID)
  • A default .onmicrosoft.com domain
  • An isolated directory in Microsoft Entra ID
  • Access to all subscribed M365 services (Exchange Online, SharePoint, Teams, Defender, Purview, etc.)

The tenant’s data residency region is selected at creation and determines where core data (mailboxes, SharePoint sites, OneDrive files) is stored at rest. While Microsoft 365 Multi-Geo allows spreading data across regions, the home region is permanent.

Key architectural decisions at tenant creation:

  • Region selection — affects data residency, compliance obligations, and latency
  • Default domain — the .onmicrosoft.com name is permanent and used for fallback routing
  • Licensing model — determines which services are available

Creating the tenant

When Marcus takes on the M365 Platform Lead role at Oakwood Financial, the tenant already exists — but it was set up hastily during a trial. Here’s what he needs to verify:

DecisionWhat to CheckWhy It Matters
Tenant regionSettings > Organization profile > Data locationDetermines data residency. Cannot be changed post-creation.
Default domainoakwoodfinancial.onmicrosoft.comPermanent. Used for admin accounts, fallback routing.
Tenant nameOrganisation name in profileAppears in emails, sharing invitations, and admin portals.
Release preferencesSettings > Org settings > Release preferencesStandard vs Targeted release. Targeted gives early access to features.
💡 Exam tip: Tenant region is permanent

The exam loves testing whether you know which decisions are reversible vs permanent. Tenant region (data residency) is set at creation and cannot be changed. The only way to move data to a different region is Multi-Geo (additional licensing) or tenant-to-tenant migration (painful and expensive). Domain names and org settings, by contrast, can be changed later.

Implementing and managing domains

Every M365 tenant gets a default *.onmicrosoft.com domain. For production use, you need custom domains.

The domain verification process

  1. Add the domain in the Microsoft 365 admin center (Settings > Domains)
  2. Verify ownership by adding a DNS record (TXT or MX) to your public DNS
  3. Configure DNS records for M365 services:
DNS RecordTypePurpose
MXMail exchangeRoutes email to Exchange Online
CNAME (autodiscover)AliasOutlook client auto-configuration
TXT (SPF)Sender verificationPrevents email spoofing
CNAME (DKIM)SignatureCryptographic email signing
TXT (DMARC)PolicyTells receivers how to handle failed SPF/DKIM
SRVService locatorSkype for Business/Teams federation (legacy)

Marcus’s domain challenge

Oakwood Financial has three domains: oakwoodfinancial.com (primary), oakwood.com.au (legacy), and oakwoodwealth.com (subsidiary). Marcus needs to:

  • Verify all three — each needs its own TXT record
  • Set one as default — oakwoodfinancial.com becomes the primary SMTP domain
  • Keep legacy domains — users with @oakwood.com.au addresses can still receive email
  • Plan for DKIM/DMARC on all domains — not just the primary
ℹ️ Deep dive: Why DMARC matters for the exam

DMARC (Domain-based Message Authentication, Reporting & Conformance) is increasingly tested on MS-102. Key points:

  • DMARC builds on SPF and DKIM — it tells receiving mail servers what to do when both fail
  • p=none — monitor only (start here)
  • p=quarantine — send to junk
  • p=reject — block the message entirely
  • Microsoft recommends starting with p=none and moving to p=reject after monitoring
  • DMARC reports are sent to the email address in the rua= tag

The exam may ask: “Marcus configures SPF and DKIM but email still gets spoofed. What should he add?” Answer: DMARC with at least p=quarantine.

Configuring organisation settings

The Microsoft 365 admin center (admin.microsoft.com) has two critical settings areas:

Organisation profile

SettingWhereWhat It Controls
Organisation informationSettings > Org settings > Organization profileName, address, phone, technical contact
Release preferencesSame sectionStandard or Targeted release track
Custom themesSame sectionBranding for the admin portal (logo, colours)
Help desk informationSame sectionCustom support contact shown to users

Security and privacy settings

SettingWhereWhat It Controls
Password expiration policySettings > Org settings > Security & privacyWhether passwords expire (Microsoft now recommends no expiry with MFA)
Self-service password resetConfigured in Entra (covered in Module 12)Whether users can reset their own passwords
Idle session timeoutSettings > Org settings > Security & privacyAuto sign-out after inactivity
Customer LockboxSecurity & privacyRequires approval before Microsoft support accesses your data
Privileged accessSecurity & privacyApproval workflow for high-impact admin tasks
Standard Release vs Targeted Release
FeatureStandard ReleaseTargeted Release
Who gets featuresAll users, after validationSelected users or entire org, before general availability
When features arriveAfter targeted release validationDays to weeks before standard
Best forProduction stabilityTesting new features, preparing change management
Risk levelLow — features are validatedMedium — occasional bugs in early access
Exam relevanceKnow it existsKnow how to configure and who to include

Priya’s global configuration challenge

At GlobalReach Corp, Priya configures release preferences differently:

  • Targeted Release for select users — her team of 5 admins get features early
  • Standard Release for everyone else — 20,000 users stay on stable builds
  • This lets her team document changes and prepare training before features reach all users
💡 Exam tip: Customer Lockbox

Customer Lockbox is a frequently tested concept. It requires your explicit approval before Microsoft support engineers can access your tenant data. Without it, Microsoft can access data during support cases with internal approval only. The exam may ask: “What must Elena enable to ensure MedGuard Health controls when Microsoft accesses patient data?” Answer: Customer Lockbox.

Key concepts to remember

Question

What happens if you don't add a DMARC record for your custom domain?

Click or press Enter to reveal answer

Answer

Receiving mail servers have no policy for handling emails that fail SPF and DKIM checks. Spoofed emails using your domain may still be delivered. Microsoft recommends DMARC with at least p=quarantine.

Click to flip back
Question

Can you change a tenant's data residency region after creation?

Click or press Enter to reveal answer

Answer

No. The home data residency region is permanent. To store data in additional regions, you need Microsoft 365 Multi-Geo licensing. Full tenant migration to a different region requires tenant-to-tenant migration.

Click to flip back
Question

What is Customer Lockbox?

Click or press Enter to reveal answer

Answer

A feature that requires your organisation's approval before Microsoft support engineers can access your tenant data. Without it, Microsoft uses internal approval. Available in E5 or as an add-on.

Click to flip back
Question

What DNS record type is used to verify domain ownership in Microsoft 365?

Click or press Enter to reveal answer

Answer

A TXT record (preferred) or MX record. The TXT record contains a unique verification string provided by the M365 admin center. It proves you control the domain's DNS.

Click to flip back

Knowledge check

Knowledge Check

Marcus is setting up Oakwood Financial's M365 tenant. The company has offices in Sydney and Melbourne. He needs email to flow through Exchange Online and wants to prevent domain spoofing. Which combination of DNS records must he configure for the custom domain oakwoodfinancial.com?
Knowledge Check

Priya wants to test new M365 features with her admin team before rolling them out to GlobalReach's 20,000 users. What should she configure?
Knowledge Check

Elena needs to ensure that Microsoft support engineers cannot access MedGuard Health's tenant data without explicit approval from her team. Which feature should she enable?

🎬 Video coming soon

Next up: Monitoring Tenant Health and Network Readiness — keeping 20,000 users online means knowing about problems before they call you.

Next →

Monitor Tenant Health and Network Readiness

Guided

I learn, I simplify, I share.

A Guide to Cloud YouTube Feedback

© 2026 Sutheesh. All rights reserved.

Guided is an independent study resource and is not affiliated with, endorsed by, or officially connected to Microsoft. Microsoft, Azure, and related trademarks are property of Microsoft Corporation. Always verify information against Microsoft Learn.