Exam MS-100: Microsoft 365 Identity and Services Practice Test
Exam MS-100: Microsoft 365 Identity and Services practice focuses on identity administration and the services that connect users to Microsoft 365 resources. The available questions touch on Microsoft 365 groups, application access, Microsoft Graph permissions, sign-in records, license assignment, and custom-domain verification—tasks that require interpreting administrative settings and matching them to business needs.
Exam overview
About the Exam MS-100: Microsoft 365 Identity and Services Exam
Identity work in these scenarios includes choosing workload identities for applications that authenticate without a user and distinguishing delegated Microsoft Graph permissions from application access patterns. Group administration involves selecting rule-based membership when users should be included according to directory attributes. License tasks require checking whether an individual service is enabled within an assigned plan and considering approaches that keep departmental assignments consistent. Other scenarios test navigation of sign-in log details to identify the application involved in an access attempt, and use of mail-delivery records to investigate whether a message reached a user. Domain setup questions connect DNS verification with proving control of a domain before it is used for sign-in. Together, these topics exercise configuration choices and troubleshooting across identity, access, licensing, and Microsoft 365 service administration.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A company uses Microsoft 365 groups for team collaboration. Which group feature is designed to provide a shared mailbox, calendar, and collaboration space for members?
Show answer
Correct answer: AA Microsoft 365 group provides a shared membership model and can connect members to collaboration resources such as a group mailbox, calendar, and SharePoint site. Security groups are primarily used to assign permissions, while distribution groups distribute email.
An organization wants employees to open Microsoft 365 resources from a company portal using one consistent entry point. Which feature is designed to list and launch assigned applications?
Show answer
Correct answer: BThe My Apps portal gives users a central place to view and launch applications assigned to them. The other options serve application configuration, service-status, or email-routing purposes.
An administrator needs an application to access a protected resource without a user interactively signing in. Which identity approach is generally intended for this workload scenario?
Show answer
Correct answer: AWorkloads can use an application identity represented in a tenant, commonly through a service principal, to request access to resources according to assigned permissions. Distribution groups, aliases, and calendars are not workload authentication identities.
A team is creating an application that needs to request access to Microsoft Graph on behalf of signed-in users. Which type of permission is appropriate for this delegated access pattern?
Show answer
Correct answer: ADelegated permissions represent access an application exercises on behalf of a signed-in user, typically constrained by both the granted permission and that user's own access. Application permissions are intended for app-only access without a signed-in user.
A Microsoft 365 administrator needs to help investigate whether a user received a particular email message. Which service area is most relevant for searching message delivery records?
Show answer
Correct answer: AExchange message trace provides information about the processing and delivery status of email messages. Reports for meetings, SharePoint recycle bins, and the app gallery address different administrative needs.
An administrator is preparing to use a security group to automatically include users whose department attribute matches a defined value. What group membership approach supports rule-based evaluation?
Show answer
Correct answer: AA dynamic user group evaluates a membership rule against directory attributes, such as department, to include or remove users automatically as attributes change. The other choices do not provide rule-based directory group membership.
A user is assigned a Microsoft 365 license but cannot use one particular service included in the plan. What should an administrator check first in the user's license settings?
Show answer
Correct answer: AA product license can include multiple service plans, and an administrator may enable or disable individual plans for a user. Group membership in a distribution list, a profile photo, or the number of administrators does not determine whether that service plan is enabled.
How to use this practice test
The free practice session presents up to 20 randomly selected questions from the 50-question MS-100 bank. Answer each scenario by identifying the relevant identity or service setting, then use the results shown after the session to spot areas for targeted review.
Preparation tips
- For application-access scenarios, distinguish a workload identity used without interactive user sign-in from delegated access performed on behalf of a signed-in user.
- Compare Microsoft Graph delegated permissions with application permissions, and identify whether the scenario involves a user context or an app-only workload.
- Practice tracing license issues from the assigned plan to the individual service toggle that may be disabled.
- Use sign-in log details to connect an access attempt with its target cloud application; distinguish these records from message-delivery investigation data.
- Review how directory attributes can drive dynamic security-group membership and how DNS records verify a custom domain.