The hard set (4 questions)
The hardest MS-102 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.
An administrator reviews the group-based licensing report and finds several users showing 'Errors and issues' for a license assigned through a security group. One specific error states the user cannot be assigned the license because of a conflicting service plan. What is the FIRST step the administrator should take to resolve this?
Correct answer: C. Open the Microsoft 365 admin center, navigate to Billing then Licenses, select the affected product, view the group's error details, identify the conflicting service plan, and resolve the dependency or conflict for the affected users.
When group-based licensing encounters a conflicting service plan error, the resolution path is: navigate to Billing, then Licenses in the Microsoft 365 admin center, select the affected product license, locate the group, view users in error state, and review the specific error type. A conflicting service plan error means two service plans from different licenses cannot be simultaneously enabled for the same user. The administrator must identify and resolve the conflict - for example by removing one conflicting service plan from the assignment - then reprocess the affected users.
Why the other options are wrong:
- A. Service plan conflicts are a configuration issue within the tenant that the administrator controls. Microsoft support cannot automatically reconcile these; the admin must identify and resolve conflicting plan assignments.
- B. The Exchange admin center does not control which service plans within a Microsoft 365 license are assigned to users. License and service plan management flows through the Microsoft 365 admin center.
- D. Deleting and recreating the group removes all licensing assignments temporarily and does not fix the underlying service plan conflict. It would also cause service interruptions for users who had valid licenses.
Memory hook: Billing, then Licenses, then the group - read the error, fix the conflict. The error is always on the USER object, not the group.
Microsoft Learn: Licensing groups resolve problems
A custom quarantine policy that grants Full access (including the release permission) is assigned to the high confidence phishing verdict in an anti-spam policy. A user opens a message that was quarantined as high confidence phishing and tries to release it. What happens?
Correct answer: A. The user can only request release; an admin must approve it, regardless of the Full access permission granted by the policy.
As part of secure by default, recipients can never release their own messages quarantined as high confidence phishing by anti-spam policies (also malware by anti-malware policies, or malware/phishing by Safe Attachments), regardless of how the quarantine policy is configured. If the policy allows releasing, users can only request release, which requires admin approval.
Why the other options are wrong:
- B. Because the policy grants the release permission, the user is offered Request release, not merely Preview.
- C. There is no release-then-rescan-then-requarantine loop; the self-release action is simply unavailable.
- D. The Full access release permission is overridden for high confidence phishing; self-release is never allowed for that verdict.
Memory hook: High confidence phishing / malware / Safe Attachments quarantine = request-only for users, forever. Secure by default trumps Full access.
Microsoft Learn: Quarantine policies
A user belongs to two Microsoft Entra groups. Group one is targeted by the Cloud Policy configuration 'Sales-Baseline' (priority 3), which sets an Office security setting to Disabled. Group two is targeted by 'Security-Strict' (priority 1), which sets the same setting to Enabled. A domain Group Policy Object on the user's Windows PC also configures the same setting with a third value. Which value applies when the user opens Excel?
Correct answer: A. The 'Security-Strict' value, because in a conflict the highest-priority Cloud Policy configuration wins - lower numbers are higher priority, with 0 the highest assignable - and Cloud Policy settings take precedence over Group Policy.
Two precedence rules from the Cloud Policy documentation resolve this. First, when a user is in multiple Microsoft Entra groups with conflicting policy settings, priority determines which setting applies: the highest priority wins, and 0 is the highest priority you can assign - so 'Security-Strict' at priority 1 beats 'Sales-Baseline' at priority 3. Priorities are managed with Reorder priority on the Policy configurations page. Second, policy settings implemented through Cloud Policy take precedence over settings implemented by Group Policy on Windows Server, and over preference or locally applied settings - so the GPO's value loses regardless. The user gets the 'Security-Strict' Enabled value.
Why the other options are wrong:
- B. Learn states the opposite: Cloud Policy settings take precedence over policy settings implemented by using Group Policy on Windows Server. The cloud-delivered value wins on this device.
- C. Priority ordering runs the other way - lower numbers outrank higher ones, with 0 as the highest assignable priority. Priority 1 defeats priority 3.
- D. Cloud Policy does not error out on conflicts; conflict resolution by priority is the designed behavior, and the winning configuration's setting is applied silently.
Memory hook: Cloud Policy conflicts: think golf - lowest priority number wins (0 is best) - and the cloud outranks the GPO.
Microsoft Learn: Overview cloud policy
An administrator assigns the User Administrator role to a scoped admin for an administrative unit (AU) that contains a security group. The group itself is added as a member of the AU. A new employee joins and is added to that group. Can the scoped admin reset that new employee's password?
Correct answer: B. No, because adding a group to an AU brings only the group object into scope, not the group's individual members. The user must also be added directly as an AU member.
A critical AU scoping rule: adding a group to an administrative unit places the GROUP OBJECT in scope, but NOT the group's individual members. A User Administrator scoped to the AU can manage the group's name and membership, but cannot reset passwords or manage user properties of individual group members unless those users are also added directly to the administrative unit as members.
Why the other options are wrong:
- A. The Groups Administrator role would allow managing group properties, but the core issue here is about user management scope, not group management. The absence of direct user membership in the AU is what blocks the action.
- C. User Administrator can reset passwords for users within their scope. The issue is scope, not role capability. User Administrator is explicitly listed as a role that can be scoped to administrative units.
- D. This is the most common misconception about administrative units. Group membership does NOT flow through to AU membership automatically. Users must be explicitly added to the AU for the scoped admin to manage them.
Memory hook: Group in AU = manage the box, not the contents. To manage the people inside, put the PEOPLE in the AU directly.
Microsoft Learn: Administrative units
