Skip to content

MS-900 - Exam-Style Scenarios

10 scenarios covering the major exam domains.

Scenario 1

A small business (50 employees) wants Microsoft 365 with desktop apps, Intune for device management, and threat protection. What's the right SKU?

Best answer: Microsoft 365 Business Premium - includes desktop apps, Exchange/Teams/SharePoint/OneDrive, Intune for device management, Defender for Business, and Entra ID P1.

Scenario 2

An enterprise wants the full Defender XDR stack, Microsoft Sentinel, Power BI Pro, and Phone System with Audio Conferencing.

Best answer: Microsoft 365 E5. E3 + E5 add-on works too but E5 is the bundled price-per-user solution.

Scenario 3

The CISO wants automatic blocking of phishing email attachments before delivery to user mailboxes.

Best answer: Defender for Office 365 Plan 1 or Plan 2 (Safe Attachments). Plan 2 adds Threat Explorer and Attack Simulator.

Scenario 4

A regulated company needs to track which audit reports prove Microsoft's SOC 2 compliance.

Best answer: Service Trust Portal at servicetrust.microsoft.com - download SOC ½/3, ISO 27001, FedRAMP, HIPAA BAA, and other audit reports.

Scenario 5

HR wants to detect harassment patterns in Teams chat and Outlook email.

Best answer: Microsoft Purview Communication Compliance - flags policy violations (harassment, IP leakage, sensitive content) for designated reviewers.

Scenario 6

Frontline retail workers (300 of them) need Teams and basic intranet access; cost is critical.

Best answer: Microsoft 365 F1 (or F3 for slightly more features). Frontline SKUs are optimized for shift workers at lower cost.

Scenario 7

A 500-seat enterprise wants free deployment guidance for migrating to M365.

Best answer: FastTrack - free Microsoft-led deployment, migration, and adoption help for eligible customers (typically 150+ seats).

Scenario 8

You need to enforce MFA only when sign-in is from an unfamiliar location.

Best answer: Conditional Access policy in Microsoft Entra ID, with location condition (named locations or sign-in risk).

Scenario 9

Microsoft 365 service is having issues - where do you check first?

Best answer: Service Health Dashboard in Microsoft 365 admin center. Real-time view of incidents affecting your tenant.

Scenario 10

An employee is leaving the company. The CISO wants to detect if they're exfiltrating sensitive data.

Best answer: Microsoft Purview Insider Risk Management with the "Departing employee data theft" template. Detects mass downloads, USB transfers, suspicious email forwarding, etc., with privacy-respecting investigation workflow.

Scoring guide

  • 8-10: Schedule the exam.
  • 6-7: Re-read the relevant notes for missed topics.
  • <6: More study time on weak domain.

MS-900 is foundational - tests awareness of M365 services, security, compliance, and licensing concepts. No technical labs. Most candidates pass with 20-30 hours of study.