MS-101 Microsoft 365 Mobility and Security Exam updated on November 24, 2021

The content of this exam was updated on November 24, 2021. Please download the skills measured document below to see what changed.

Exam MS-101: Microsoft 365 Mobility and Security
Languages: English, Japanese
Retirement date: none

This exam measures your ability to accomplish the following technical tasks: implement modern device services; implement Microsoft 365 security and threat management; and manage Microsoft 365 governance and compliance.

Skills measured
The content of this exam was updated on November 24, 2021. Please download the exam skills outline below to see what changed.
Implement modern device services (40-45%)
Implement Microsoft 365 security and threat management (20-25%)
Manage Microsoft 365 governance and compliance (35-40%)

Audience Profile
Candidates for this exam are Microsoft 365 Enterprise Administrators who take part in evaluating, planning, migrating, deploying, and managing Microsoft 365 services. They perform Microsoft 365 tenant management tasks for an enterprise, including its identities, security, compliance, and supporting technologies.

Candidates have a working knowledge of Microsoft 365 workloads and should have been an administrator for at least Exchange, SharePoint, Teams, Windows 10 deployment. Candidates also have a working knowledge of networking, server administration, and IT fundamentals such as DNS, Active Directory, and PowerShell.

Skills Measured
NOTE: The bullets that follow each of the skills measured are intended to illustrate how we are assessing that skill. This list is NOT definitive or exhaustive.
NOTE: Most questions cover features that are General Availability (GA). The exam may contain questions on Preview features if those features are commonly used.

Implement modern device services (40-45%)

Plan device management
 plan device monitoring
 plan Microsoft Endpoint Manager implementation and integration with Azure AD
 plan co-management between Endpoint Configuration Manager and Intune
 plan for configuration profiles

Manage device compliance
 plan for device compliance
 plan for attack surface reduction
 configure security baselines
 configure device compliance policy
 plan and configure conditional access policies

Plan for apps
 create and configure Microsoft Store for Business
 plan app deployment
 plan for mobile application management (MAM)

Plan Windows 10 deployment
 plan for Windows as a Service (WaaS)
 plan for managing Windows quality and feature updates
 plan Windows 10 Enterprise deployment methods
 analyze upgrade readiness for Windows 10 by using services such as Desktop Analytics
 evaluate and deploy additional Windows 10 Enterprise security features

Enroll devices
 plan for device join or device registration to Azure Active Directory (Azure AD)
 plan for manual and automated device enrollment into Intune
 enable device enrollment into Intune

Implement Microsoft 365 security and threat management (20-25%)

Manage security reports and alerts
 evaluate and manage Microsoft Office 365 tenant security by using Secure Score
 manage incident investigation
 review and manage Microsoft 365 security alerts

Plan and implement threat protection with Microsoft 365 Defender
 plan Microsoft Defender for Endpoint
 design Microsoft Defender for Office 365 policies
 implement Microsoft Defender for Identity

Plan Microsoft Cloud App Security
 plan information protection by using Cloud App Security
 plan policies to manage access to cloud apps
 plan for application connectors
 configure Cloud App Security policies
 review and respond to Cloud App Security alerts
 monitor for unauthorized cloud applications

Manage Microsoft 365 governance and compliance (35-40%)

Plan for compliance requirements
 plan compliance solutions
 assess compliance
 plan for and implement privileged access management
 plan for legislative and regional or industry requirements and drive implementation

Manage information governance
 plan data classification
 plan for classification labeling
 plan for restoring deleted content
 implement records management
 design data retention labels and policies in Microsoft 365

Implement Information protection
 plan an information protection solution
 plan and implement sensitivity labels and policies
 monitor label alerts and analytics
 deploy Azure Information Protection unified labels clients
 configure Information Rights Management (IRM) for workloads
 plan for Windows information Protection (WIP) implementation

Plan and implement data loss prevention (DLP)
 plan for DLP
 configure DLP policies
 monitor DLP

Manage search and investigation
 plan and configure auditing
 plan and configure eDiscovery
 implement and manage insider risk management
 design a Content Search solution

QUESTION 1
Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might have
more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are deploying Microsoft Endpoint Manager.
You successfully enroll Windows 10 devices in Endpoint Manager.
When you try to enroll an iOS device in Endpoint Manager, you get an error.
You need to ensure that you can enroll the iOS device in Endpoint Manager.
Solution: You add your user account as a device enrollment manager.
Does this meet the goal?

A. Yes
B. No

Answer: B

QUESTION 2
Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might have
more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are deploying Microsoft Endpoint Manager.
You successfully enroll Windows 10 devices in Endpoint Manager.
When you try to enroll an iOS device in Endpoint Manager, you get an error.
You need to ensure that you can enroll the iOS device in Endpoint Manager.
Solution: You configure the Apple MDM Push certificate.
Does this meet the goal?

A. Yes
B. No

Answer: A

QUESTION 3
Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might have
more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are deploying Microsoft Endpoint Manager.
You successfully enroll Windows 10 devices in Endpoint Manager.
When you try to enroll an iOS device in Endpoint Manager, you get an error.
You need to ensure that you can enroll the iOS device in Endpoint Manager.
Solution: You create an Apple Configurator enrollment profile.
Does this meet the goal?

A. Yes
B. No

Answer: B

QUESTION 4
Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might have
more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
Your network contains an Active Directory domain named contoso.com that is synced to Microsoft Azure
Active Directory (Azure AD).
You manage Windows 10 devices by using Microsoft System Center Configuration Manager (Current Branch).
You configure pilot co-management.
You add a new device named Device1 to the domain. You install the Configuration Manager client on Device1.
You need to ensure that you can manage Device1 by using Microsoft Intune and Configuration Manager.
Solution: You create a device configuration profile from the Device Management admin center.
Does this meet the goal?

A. Yes
B. No

Answer: B