🔒 Guided

Pre-launch preview. Authorised access only.

Incorrect code

Guided by A Guide to Cloud
Explore AB-900 AI-901
Guided MS-102 Domain 2
Domain 2 — Module 1 of 7 14%
9 of 28 overall

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response

MS-102 Study Guide

Domain 1: Deploy and Manage a Microsoft 365 Tenant

  • Establish and Configure Your M365 Tenant
  • Monitor Tenant Health and Network Readiness
  • Adoption Tracking and Microsoft 365 Backup
  • Manage Users, Contacts and External Identities
  • Groups, Shared Mailboxes and Licensing at Scale
  • Automate with PowerShell: Bulk User Operations
  • Roles, Role Groups and Workload Permissions
  • Delegate with Administrative Units and PIM

Domain 2: Implement and Manage Microsoft Entra Identity and Access

  • Prepare for Identity Synchronization
  • Implement Connect Sync and Cloud Sync
  • Monitor and Troubleshoot Identity Sync
  • Authentication Methods and Self-Service Password Reset
  • Password Protection and Authentication Troubleshooting
  • Entra Identity Protection and Risk Policies
  • Conditional Access and MFA Enforcement

Domain 3: Manage Security and Threats by Using Microsoft Defender XDR

  • Defender XDR: Security Posture and Threat Intelligence
  • Investigate Incidents with Advanced Hunting
  • Defender for Office 365: Threat Policies
  • Email Threats, Attack Simulation and Restricted Entities
  • Defender for Endpoint: Onboard and Protect
  • Vulnerability Management
  • Defender for Cloud Apps: Connect and Govern
  • Cloud App Discovery and Activity Monitoring

Domain 4: Manage Compliance by Using Microsoft Purview

  • Sensitive Information Types and Data Classification
  • Retention Labels and Data Lifecycle
  • Sensitivity Labels and Monitoring
  • DLP Policies Across M365 Workloads
  • Endpoint DLP and Alert Response
Domain 2: Implement and Manage Microsoft Entra Identity and Access Premium ⏱ ~15 min read

Prepare for Identity Synchronization

Plan your hybrid identity strategy, clean up Active Directory with IdFix, and prepare your on-premises environment for directory synchronization.

Why hybrid identity still matters

☕ Simple explanation

Most organisations don’t start cloud-only. They have years of Active Directory history — and that history needs to come along for the ride.

Think of identity synchronization like moving house. Before you load the truck, you sort your belongings: throw out the junk (stale accounts), fix what’s broken (invalid characters), and label everything clearly (UPN alignment). That’s what preparation looks like — and doing it badly means unpacking chaos at the new house.

This module covers what to do BEFORE you turn on sync. The cleanup and planning that prevents 90% of sync issues.

Identity synchronization replicates user, group, and contact objects from on-premises Active Directory Domain Services (AD DS) to Microsoft Entra ID. This enables:

  • Single identity — users sign in to both on-prem and cloud resources with one account
  • Seamless SSO — automatic sign-in to M365 from domain-joined devices
  • Hybrid management — manage users in AD, attributes sync to Entra

Preparation involves auditing the on-premises directory, fixing data quality issues, planning the UPN strategy, verifying network and firewall requirements, and choosing between Microsoft Entra Connect Sync and Cloud Sync — the topic of the next module.

The preparation checklist

Marcus is preparing Oakwood Financial’s 10-year-old Active Directory for synchronization. Here’s his systematic approach:

Step 1: Audit the directory

CheckWhat to Look ForWhy It Matters
Stale accountsDisabled users, accounts with no logon for 90+ daysSyncing stale accounts wastes Entra licences and creates security risk
Duplicate attributesMultiple users with the same proxyAddress or UPNSync will fail or create conflicts
Invalid charactersSpecial characters in display names, email addressesEntra has stricter character rules than AD
Orphaned objectsGroups with no members, empty OUsUnnecessary clutter in the cloud directory
UPN suffixesAre UPNs routable (e.g., @oakwood.com.au) or non-routable (e.g., @oakwood.local)?Non-routable UPNs can’t be used for M365 sign-in

Step 2: Run IdFix

IdFix is a free Microsoft tool that scans your on-premises AD and identifies objects that will cause synchronization errors.

What IdFix catches:

Error TypeExampleImpact If Not Fixed
CharacterDisplay name contains control charactersObject won’t sync
FormatEmail address missing @domain.comMail attribute won’t sync
DuplicateTwo users with same proxyAddressSync conflict — one object skipped
TopLevelDomainUPN uses .local suffixUser can’t sign in to M365
BlankMissing required attributesObject may sync with incomplete data

How to use IdFix:

  1. Download from https://microsoft.github.io/idfix/
  2. Run on a domain-joined computer with AD read access
  3. Review the results — each error has a suggested action (Edit, Remove, Complete)
  4. Apply fixes — either directly in IdFix (which can write changes to AD) or manually in ADUC/PowerShell for more control
  5. Re-run IdFix until zero errors
💡 Exam tip: IdFix is read-only by default

IdFix can suggest and apply fixes, but best practice is to review suggestions manually and make changes in Active Directory Users and Computers (ADUC) or PowerShell. The exam may ask: “Marcus runs IdFix and it reports 50 errors. What should he do?” The answer is review each error, fix in AD, then re-run IdFix — NOT blindly accept all suggestions.

Step 3: Plan the UPN strategy

The User Principal Name (UPN) in AD becomes the sign-in identity in M365. If your AD uses non-routable UPN suffixes (like .local), you must fix this before sync.

Current UPNProblemSolution
marcus@oakwood.local.local is not a public domainAdd oakwood.com.au as an alternate UPN suffix in AD, update user UPNs
marcus@oakwood.com.auAlready routable and verified in M365No change needed
m.chen@oakwood.com.auRoutable but doesn’t match desired email formatUpdate UPN or configure email alias separately

Adding an alternate UPN suffix:

  1. Open Active Directory Domains and Trusts
  2. Right-click the top node > Properties
  3. Add the verified M365 domain as an alternate UPN suffix
  4. Update each user’s UPN to use the new suffix

Step 4: Verify network requirements

The sync server (for Connect Sync) needs:

RequirementDetail
Outbound HTTPS (443)To Microsoft Entra endpoints
No inbound portsSync is always outbound-initiated
Internet accessDirect or via proxy (no SSL inspection on M365 traffic)
AD connectivityRead access to all OUs being synced
DNS resolutionMust resolve both internal AD domains and public M365 endpoints

Step 5: Plan OU filtering

You don’t have to sync the entire directory. Marcus decides:

  • Sync: Users OU, Groups OU, Contacts OU
  • Exclude: Service accounts OU, Test accounts OU, Legacy systems OU

OU-based filtering is configured during sync tool setup and is the most common filtering method.

ℹ️ Deep dive: Other filtering methods

Beyond OU-based filtering, both sync tools support:

  • Domain-based filtering — sync specific AD domains (useful in multi-domain forests)
  • Attribute-based filtering — sync only objects matching certain attributes (e.g., department = “Active”)
  • Group-based filtering — sync only members of a specific group (Connect Sync only, limited to 50,000 objects)

The exam may present scenarios where you need to choose the right filtering method. OU-based is the default and most commonly tested answer.

Key concepts to remember

Question

What does IdFix do and when should you run it?

Click or press Enter to reveal answer

Answer

IdFix scans on-premises Active Directory for objects that will cause synchronization errors (invalid characters, duplicate attributes, formatting issues, non-routable UPNs). Run it BEFORE enabling directory sync, review all errors, fix them in AD, and re-run until clean.

Click to flip back
Question

Why can't a UPN suffix of .local be used for Microsoft 365 sign-in?

Click or press Enter to reveal answer

Answer

The .local suffix is non-routable — it's not a valid public DNS domain. Microsoft 365 requires UPNs to match a verified custom domain (e.g., @company.com). Fix: add the verified domain as an alternate UPN suffix in AD Domains and Trusts, then update user UPNs.

Click to flip back
Question

What is the most common filtering method for directory synchronization?

Click or press Enter to reveal answer

Answer

OU-based filtering — you select which Organizational Units to sync and which to exclude. This is configured during sync tool setup. Other options include domain-based, attribute-based, and group-based filtering.

Click to flip back

Knowledge check

Knowledge Check

Marcus runs IdFix on Oakwood Financial's Active Directory and finds 200 errors, including duplicate proxyAddresses and users with .local UPN suffixes. What should Marcus do FIRST?
Knowledge Check

Dev is consulting for a client whose AD uses `user@company.local` as the UPN suffix. The client has verified `company.com` in Microsoft 365. What must Dev do before enabling sync?

🎬 Video coming soon

Next up: Implement Connect Sync and Cloud Sync — choosing and deploying the right synchronization engine.

← Previous

Delegate with Administrative Units and PIM

Next →

Implement Connect Sync and Cloud Sync

Guided

I learn, I simplify, I share.

A Guide to Cloud YouTube Feedback

© 2026 Sutheesh. All rights reserved.

Guided is an independent study resource and is not affiliated with, endorsed by, or officially connected to Microsoft. Microsoft, Azure, and related trademarks are property of Microsoft Corporation. Always verify information against Microsoft Learn.