Much of a Microsoft tenant's security rests on what administrators configure, which makes the administrator exams a security curriculum whether or not they carry the word in their title. This guide covers the main Microsoft administrator certifications as Microsoft Learn describes them on 8 November 2026: MS-102 (retiring on 30 November 2026), its successor AB-650, MD-102 for endpoints and AZ-104 for Azure. It reads each outline for its identity, Defender, Intune compliance, Azure RBAC and governance content, gives a study plan, explains renewal, and shows how the exams lead into the security track of SC-300, SC-200 and SC-500. It is written for administrators who want security depth and for managers planning team training. The security exams themselves are covered in the Microsoft Security Certifications Guide; this page does not repeat them.
This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.
Key takeaways
- MS-102 is ending. Microsoft Learn states that MS-102 and the Microsoft 365 Certified: Administrator Expert certification retire on 30 November 2026 and cannot be earned or renewed after that; Microsoft's June 2026 credentials roundup names AB-650 as the replacement exam.
- AB-650 is mostly security. Its largest skill area, "Govern and secure Microsoft 365 tenants and workloads", is weighted 40 to 45 percent, and a further 35 to 40 percent covers managing and securing AI services, including agent identities.
- MD-102 changed on 27 October 2026. The refreshed outline still gives 15 to 20 percent to protecting devices and 15 to 20 percent to managing and securing applications, with Intune at its centre.
- AZ-104 is where Azure RBAC is learned. Its identities and governance area (20 to 25 percent) covers role assignments at scope, Azure Policy, resource locks and management groups, and networking covers NSGs, Bastion and private endpoints.
- The security next step has moved. AZ-500 retired on 31 August 2026; for Azure-focused administrators the security associate path now points to SC-500, alongside SC-300 for identity and SC-200 for operations.
Who the certification is for
| Exam | Certification (as named by Microsoft) | Typical role | Status on 8 Nov 2026 |
|---|---|---|---|
| MS-102 Microsoft 365 Administrator | Microsoft 365 Certified: Administrator Expert | Microsoft 365 tenant administrators | Retires 30 November 2026, 11:59 PM Central Standard Time |
| AB-650 Administering Microsoft 365 and AI Services | Microsoft 365 Certified: AI Services Administrator Associate (name as given in Microsoft's June 2026 roundup) | Microsoft 365 administrators responsible for Copilot and agents | Roundup lists beta July 2026 and general availability October 2026 |
| MD-102 Managing and Securing Microsoft 365 Endpoints by using Intune | Microsoft 365 Certified: Endpoint Administrator Associate | Endpoint and Intune administrators | Current; English outline updated 27 October 2026 |
| AZ-104 Microsoft Azure Administrator | Microsoft Certified: Azure Administrator Associate | Azure platform and cloud operations administrators | Current; outline as of 26 October 2023 on the study guide |
Decision guidance: pick by the estate you run, not by prestige. A Microsoft 365 administrator who has not yet sat MS-102 should plan for AB-650, since an MS-102 pass after 30 November 2026 no longer counts. An endpoint team on Intune should take MD-102. A cloud team running subscriptions should take AZ-104. In small organisations one administrator often covers all three estates; there, AB-650 or MS-102 plus MD-102 usually matches the job better than AZ-104 unless Azure workloads exist.
Exam format and domains
Every study guide checked gives a passing score of 700 or greater on a scaled score. The MD-102 and AZ-104 certification pages add that the exams are proctored, may include interactive components, last 100 minutes and can be retaken 24 hours after a first failed attempt, with longer waits for later retakes; the AZ-104 page names Pearson VUE for scheduling.
Skills measured, with the security content called out
| Exam | Skill areas and weights | Security content in the outline |
|---|---|---|
| MS-102 (as of 28 April 2026) | Deploy and manage a Microsoft 365 tenant 25-30%; Implement and manage Microsoft Entra identity and access 25-30%; Manage security and threats by using Microsoft Defender XDR 30-35%; Manage compliance by using Microsoft Purview 10-15% | Roles and role groups, secure access, security reports and alerts, endpoint protection with Defender for Endpoint, Purview DLP |
| AB-650 | Configure and manage Microsoft 365 tenants and workloads 20-25%; Govern and secure Microsoft 365 tenants and workloads 40-45%; Manage and secure AI services in Microsoft 365 35-40% | PIM, administrative units, authentication methods, Entra Password Protection, SSPR, Conditional Access with ID Protection and MFA, Defender for Office 365 threat policies and attack simulation, Purview DLP including Copilot, sensitivity and retention labels, DSPM for AI, Entra Agent ID, agent access packages and the agent registry |
| MD-102 (as of 27 October 2026) | Prepare infrastructure for devices 20-25%; Manage and maintain devices 25-30%; Protect devices 15-20%; Manage and secure applications 15-20%; Optimize endpoint operations by using automation, monitoring, and reporting 10-15% | Device protection and application security in Intune; the certification page also expects familiarity with Microsoft Defender XDR, Security Copilot and Intune agents |
| AZ-104 (as of 26 October 2023) | Manage Azure identities and governance 20-25%; Deploy and manage Azure compute resources 20-25%; Implement and manage storage 15-20%; Implement and manage virtual networking 15-20%; Monitor and maintain Azure resources 10-15% | Built-in roles and assignments at scope, Azure Policy, resource locks, management groups, NSGs and application security groups, Azure Bastion, service and private endpoints, storage firewalls, SAS tokens and access keys, storage and disk encryption, Azure Backup and Site Recovery |
The MS-102 change log shows only minor changes in its April 2026 refresh. Microsoft's study guides note that most questions cover generally available features, with preview features possible where commonly used, so study the current product, not old blog posts.
Prerequisites and experience
- MS-102: the exam has no formal prerequisite, but the Administrator Expert certification also requires one associate certification: Endpoint Administrator, Teams Administrator, Identity and Access Administrator or Information Security Administrator. With retirement on 30 November 2026, a candidate who has not yet passed both parts cannot complete it in time unless both are passed before that date.
- MD-102: Microsoft lists experience with Microsoft Entra ID and Microsoft 365 including Intune, strong skills deploying and maintaining Windows and non-Windows devices, and understanding of Security Copilot, Intune agents and Defender XDR. No years of experience are stated.
- AZ-104: no formal prerequisites. Microsoft recommends experience with operating systems, networking, servers and virtualisation, PowerShell, Azure CLI, the Azure portal, ARM templates or Bicep, and Microsoft Entra ID.
- Account hygiene: the AZ-104 page recommends registering with a personal Microsoft account, because records tied to a work or school account are lost when you leave that organisation.
Preparation plan
- Read the current study guide and its change log. Outlines move: MD-102 changed in October 2026 and AB-650 is new.
- Build a lab tenant with a developer or trial subscription and treat it as production: separate admin accounts, phishing-resistant MFA, PIM for roles, break-glass accounts excluded from Conditional Access by design.
- Study the security objectives first. For AB-650 and MS-102 that is Entra roles, PIM, Conditional Access and Defender; see the Conditional Access Guide and Privileged Identity Management (PIM) Guide. For MD-102 it is compliance policies, security baselines and app protection; see the Microsoft Intune Guide. For AZ-104 it is role assignments at scope and Azure Policy; see the Azure RBAC and Service Principals Guide and Azure Policy and Management Groups Guide.
- Do the hands-on tasks each objective names: assign a role at resource group scope, create an Intune compliance policy and a Conditional Access policy that requires it, configure a DLP policy, deploy Bastion and remove public IPs from a VM.
- Take the practice assessment. For AZ-104, Microsoft points to the Practice Assessment on AI Skills Navigator and says the legacy Learn practice assessment is no longer updated.
- Book with margin for MS-102: if you intend to sit it, the exam and any required associate must be passed before 30 November 2026.
Where identity fits
Each exam touches non-human identities that attackers target: app registrations and consent in Microsoft 365, enterprise device enrolment accounts in Intune, and service principals, managed identities, SAS tokens and storage account access keys in Azure. AB-650 goes further with Microsoft Entra Agent ID and agent access packages. Treat these objectives as more than exam facts; see the Microsoft Entra Agent ID Guide.
Cost, renewal and continuing education
| Item | What Microsoft states |
|---|---|
| Exam price | Set by the country or region where the exam is proctored; check the exam page for your location |
| Validity | Associate and expert certifications expire annually; fundamentals do not expire |
| Renewal method | Free online assessment on Microsoft Learn, unproctored and open book, shorter than the exam and focused on recent changes |
| Renewal window | A six-month eligibility window before expiry; unlimited attempts until the certification expires |
| Effect of renewal | Extends the certification one year from its expiry date |
| Retired certifications | MS-102's Administrator Expert cannot be renewed after 30 November 2026; AZ-500 renewals ended on 31 August 2026 |
Check your status at the Microsoft Learn certification profile. For how this compares with CPE-based schemes, see the Certification Renewal and CPE Requirements Guide.
Where it fits on the career path
| If you hold | Natural security next step | Why |
|---|---|---|
| MS-102 or AB-650 | SC-300 Identity and Access Administrator, or SC-200 Security Operations Analyst | Entra roles, Conditional Access and Defender XDR in the admin exam become the core of these |
| MD-102 | SC-200 | Defender for Endpoint response builds on Intune device protection |
| AZ-104 | SC-500 Implementing End-to-End Security Controls for Cloud and AI Workloads (Cloud and AI Security Engineer Associate) | Its skill areas cover identity and governance, storage, database and network security, compute and posture, extending AZ-104 directly |
| Previously planned AZ-500 | SC-500 | AZ-500 retired on 31 August 2026; Microsoft's page names no successor, but SC-500 covers the same Azure security ground |
Administrators moving into security roles should also read the Cloud Security Engineer Career Guide.
Common failure patterns
- Studying a retired outline: MS-102 dumps, old AZ-500 plans and pre-October MD-102 notes all describe exams that no longer exist in that form.
- Passing without a lab: candidates memorise role names but never assign one at the right scope, which is exactly the mistake that leaves Owner on a subscription.
- Using a global admin account to study: lab habits become production habits; separate admin identities from day one.
- Booking on a work account: certification history is lost when the job ends.
- Letting renewal lapse: missing the free assessment means sitting the full exam again, if it still exists.
Practitioner checklist
- Confirm the current status and outline of your exam on its Microsoft Learn study guide before you start.
- If you plan MS-102, pass it and the required associate before 30 November 2026, or move to AB-650.
- Register with a personal Microsoft account and link it to your Learn profile.
- Build a lab tenant with separate admin accounts, PIM and Conditional Access.
- Work through every security objective hands-on, not only in reading.
- Take the official practice assessment and close gaps before booking.
- Diarise the six-month renewal window and pass the free assessment early.
- Plan the security step after: SC-300, SC-200 or SC-500.
Standards and references
- Microsoft Learn: Study guide for Exam MS-102
- Microsoft Learn: Microsoft 365 Certified: Administrator Expert
- Microsoft Learn: Study guide for Exam AB-650
- Microsoft Tech Community: Microsoft Credentials Roundup June 2026
- Microsoft Learn: Study guide for Exam MD-102
- Microsoft Learn: Study guide for Exam AZ-104
- Microsoft Learn: Renew your Microsoft Certification
- Microsoft Learn: Study guide for Exam SC-500
Related NHI Mgmt Group resources: Microsoft Security Certifications Guide · Microsoft 365 Security Guide · Microsoft 365 admin centres and admin roles · Cybersecurity Careers Guide