🔒 Guided

Pre-launch preview. Authorised access only.

Incorrect code

Guided by A Guide to Cloud
Explore AB-900 AI-901
Guided MS-102 Domain 1
Domain 1 — Module 4 of 8 50%
4 of 28 overall

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response
Domain 1: Deploy and Manage a Microsoft 365 Tenant Premium ⏱ ~15 min read

Manage Users, Contacts and External Identities

Create and manage users in Microsoft Entra ID, handle external guest access with B2B collaboration, and maintain contacts — all at enterprise scale.

Identity management at Expert level

☕ Simple explanation

At the Expert level, user management isn’t about clicking “New User.” It’s about designing identity flows that scale.

Think of it like running an airport. You have employees (internal users), visitors with appointments (B2B guests), and names in your contacts database who might never enter the building (mail contacts). Each type needs different access, different rules, and different lifecycle management.

This module covers how to manage all three — including the external identity decisions that most admins get wrong.

Microsoft Entra ID (the identity service behind Microsoft 365) supports three primary identity types relevant to MS-102:

  • Member users — full internal identities with licences, mailboxes, and full directory access
  • Guest users (B2B) — external identities invited for collaboration, with limited directory access and scoped permissions
  • Mail contacts — external addresses in the Global Address List (GAL) without Entra identities or licences

At enterprise scale, the challenge isn’t creating individual users — it’s designing policies for external access governance, lifecycle automation, and cross-boundary collaboration while maintaining security boundaries.

Internal user management

Creating users — the methods

MethodBest ForWhere
M365 admin centerIndividual users, quick addsadmin.microsoft.com > Users > Active users
Microsoft Entra admin centerUsers needing Entra-specific config (CA, Identity Protection)entra.microsoft.com > Users
Microsoft Graph PowerShellBulk creation, automationNew-MgUser cmdlet
Microsoft Entra PowerShellEntra-focused bulk operationsNew-EntraUser cmdlet
CSV importOne-time bulk loadsM365 admin center > Bulk upload
Directory syncHybrid environments (covered in Domain 2)Entra Connect Sync or Cloud Sync

Key user properties for the exam

PropertyPurposeExam Relevance
Usage locationRequired for licence assignmentMust be set before assigning any licence
User principal name (UPN)Primary sign-in identityuser@domain.com format
Mail nicknameEmail aliasCan differ from UPN
Account statusEnabled/disabledDisabled accounts retain data but block sign-in
ManagerReporting hierarchyUsed by Viva Insights, approval workflows
Job title / DepartmentOrg metadataUsed by dynamic groups, Conditional Access
💡 Exam tip: Usage location is mandatory for licensing

You cannot assign a Microsoft 365 licence to a user without setting their usage location first. This is one of the most commonly missed steps in both the real world and the exam. The usage location determines which services are available (some features are geo-restricted) and must match the user’s actual country.

For bulk operations, always set usage location in the CSV or PowerShell script before licence assignment.

External users: B2B collaboration

How B2B guest access works

When Priya invites a partner from a client organisation to collaborate on a project:

  1. Invitation sent — via the Entra portal, Teams, SharePoint, or Microsoft Graph API
  2. Guest accepts — authenticates with their home identity (work account, Microsoft account, or one-time passcode)
  3. Guest object created — a guest user object appears in GlobalReach’s Entra directory
  4. Limited access granted — the guest can access only resources they’ve been explicitly shared with

B2B access controls

Member Users vs Guest Users
FeatureMember UsersGuest Users
Directory accessFull — can browse all users, groupsLimited — can only see their own profile by default
Licence requirementYes — need M365 licenceUsually no — authenticate with home identity (some features need licence)
EmailMailbox in your tenantNo mailbox — uses home email
Teams accessFull — all teams they're members ofOnly teams/channels they're invited to
SharePoint accessBased on site permissionsBased on sharing permissions, external sharing settings
Conditional AccessFull policy scopeCan be targeted with CA policies (recommended)
LifecycleYou manage (or HR integration)Should use access reviews and entitlement management

Governing external access at scale

Priya manages B2B collaboration for 20,000 internal users inviting guests from dozens of partner organisations. Her governance model:

ControlConfigurationPurpose
External collaboration settingsEntra > External Identities > External collaboration settingsWho can invite guests (all members, specific roles, or admins only)
Cross-tenant access settingsEntra > External Identities > Cross-tenant accessPer-organisation trust settings (which orgs can collaborate, what they can access)
Guest user access restrictionsEntra > User settings > External collaborationWhat guests can see in your directory
Access reviewsEntra > Identity Governance > Access reviewsRegular reviews of who still needs guest access
ℹ️ Deep dive: Cross-tenant access settings

Cross-tenant access settings let you define granular policies per external organisation:

  • Inbound settings — control what external users can access in your tenant
  • Outbound settings — control what your users can access in external tenants
  • Trust settings — trust MFA and device compliance from the external org (avoids double-prompting)

For example, Priya trusts MFA claims from her top 5 partner organisations. When a guest from those orgs accesses GlobalReach resources, they don’t get prompted for MFA again if they’ve already authenticated at their home tenant. This improves UX without reducing security.

Mail contacts

Mail contacts are entries in the Global Address List (GAL) that represent external email addresses. They are not Entra user objects — they have no sign-in capability, no licence, and no mailbox.

When to use contacts vs guests

ScenarioUse ContactUse Guest
External person needs to receive email from your org✅ Add as mail contactOverkill
External person needs to collaborate in Teams/SharePoint❌ Can’t✅ Invite as guest
Vendor you email frequently but who doesn’t need access✅❌
Contractor working inside your org for 6 months❌✅ (or member user with external email)

Contacts are managed in the M365 admin center (Contacts section) or via Exchange Online PowerShell (New-MailContact).

Key concepts to remember

Question

What must be set on a user account before you can assign a Microsoft 365 licence?

Click or press Enter to reveal answer

Answer

Usage location. This is a required property that determines which M365 services are available to the user based on their country. Without it, licence assignment will fail.

Click to flip back
Question

What is the difference between a B2B guest user and a mail contact?

Click or press Enter to reveal answer

Answer

A B2B guest user is an Entra identity that can sign in and access resources (Teams, SharePoint, apps). A mail contact is just an email address in the Global Address List — no sign-in, no access, no licence. Use guests for collaboration; use contacts for external addresses your org emails frequently.

Click to flip back
Question

How can you trust MFA from an external organisation to avoid double-prompting guests?

Click or press Enter to reveal answer

Answer

Configure cross-tenant access settings in Microsoft Entra > External Identities > Cross-tenant access. Set inbound trust settings to trust MFA claims from the specific external organisation. The guest authenticates once at their home tenant and isn't prompted again.

Click to flip back
Question

Who can invite guest users by default in Microsoft Entra ID?

Click or press Enter to reveal answer

Answer

By default, all member users and non-admin guests can invite guests. This can be restricted in External collaboration settings to: only admins, admins and specific roles, all members including guests, or admins and guest inviters only.

Click to flip back

Knowledge check

Knowledge Check

Priya needs to allow partners from Contoso Ltd to collaborate in Teams without being prompted for MFA every time they access GlobalReach resources. Partners already complete MFA at Contoso. What should Priya configure?
Knowledge Check

Dev is onboarding 50 new users for a client. He creates the accounts via CSV import but licence assignment fails for all 50 users. What is the most likely cause?

🎬 Video coming soon

Next up: Groups, Shared Mailboxes and Licensing at Scale — the group types that power M365 collaboration, and how to manage licences without losing your mind.

← Previous

Adoption Tracking and Microsoft 365 Backup

Next →

Groups, Shared Mailboxes and Licensing at Scale

Guided

I learn, I simplify, I share.

A Guide to Cloud YouTube Feedback

© 2026 Sutheesh. All rights reserved.

Guided is an independent study resource and is not affiliated with, endorsed by, or officially connected to Microsoft. Microsoft, Azure, and related trademarks are property of Microsoft Corporation. Always verify information against Microsoft Learn.