AB-650 Administering Microsoft 365 and AI Services Questions and Answers

Microsoft SharePoint Restricted Access Control enables administrators to restrict access to a SharePoint site and its content to members of designated Microsoft Entra security groups or Microsoft 365 groups.

Option B is correct because Restricted Access Control adds an additional authorization requirement without replacing the site ' s existing SharePoint permissions.

When Group1 is configured as the restricted access control group for Site1, users must satisfy two conditions before accessing its documents: they must belong to Group1 and possess appropriate existing SharePoint permissions.

Users outside Group1 are denied access even when they previously received direct permissions or sharing links.

This protection also applies to Microsoft 365 Copilot and organization-wide search experiences. Microsoft Copilot respects the effective SharePoint authorization boundaries, preventing unauthorized users from accessing restricted content through Copilot responses.

Option A is incorrect because Microsoft 365 Archive is intended for inactive content storage rather than enforcing group-based authorization.

Option C is incorrect because Restricted SharePoint Search controls content discoverability, not the underlying ability to open files.

Option D is incorrect because Restricted Content Discovery limits search and Copilot discovery without enforcing the required group-based access restrictions.

Restricted Access Control therefore satisfies the complete requirement while preserving the existing permission structure.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-access-control

Microsoft Entra pass-through authentication (PTA) enables users to authenticate to Microsoft 365 using their existing on-premises Active Directory credentials while ensuring that password validation occurs against the on-premises Active Directory environment.

With pass-through authentication, Microsoft Entra ID receives the cloud sign-in request and communicates with a pass-through authentication agent installed on an on-premises, domain-joined Windows Server.

The agent validates the submitted credentials against Active Directory Domain Services and returns the authentication result to Microsoft Entra ID.

This approach allows organizations to maintain password validation against their existing domain controllers while providing users with access to Microsoft 365 cloud services.

Option B is incorrect because Microsoft Entra seamless single sign-on reduces authentication prompts for domain-joined users but does not independently determine where password validation occurs.

Option C is incorrect because certificate-based authentication uses X.509 certificates rather than authenticating users through their existing domain passwords.

Option D is incorrect because password hash synchronization enables Microsoft Entra ID to validate passwords in the cloud using synchronized password hashes. It does not satisfy the requirement that password authentication occur against the on-premises domain.

Pass-through authentication therefore meets both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta

Microsoft Defender for Office 365 evaluates custom outbound anti-spam policies according to policy priority, inclusion conditions, and exclusions.

Microsoft documents two important evaluation rules:

Different inclusion condition types, such as Users and Groups, use AND logic.

Exclusions override inclusions, and the first applicable policy takes precedence.

Statement 1: No.

User1 belongs to Group1 but is not the explicitly specified user (User3) in AntiSpam1. User1 is specified in AntiSpam2 but does not belong to Group2. Therefore, neither custom policy applies. The limits cannot be combined to produce 150.

Statement 2: No.

User2 belongs to both Group1 and Group2. However, AntiSpam1 specifies User3 and Group1 as combined inclusion conditions, and additionally excludes Group2. AntiSpam2 specifies User1 and Group2 as combined inclusion conditions. User2 does not satisfy either policy ' s complete requirements.

Statement 3: No.

User3 is explicitly included in AntiSpam1 but does not belong to Group1. User3 also belongs to the excluded Group2. AntiSpam2 explicitly excludes User3. Consequently, neither custom policy imposes the stated 100-recipient daily limit on User3.

All three users fall back to the default outbound anti-spam policy.

Technical clarification: Microsoft defines the daily message limit in outbound anti-spam policies as a maximum number of recipients per day, not necessarily the number of email messages.

Microsoft Reference: Microsoft Learn — Configure outbound spam policies, recipient conditions, and policy precedence .

Microsoft Purview Data Security Posture Management (DSPM) provides centralized visibility into sensitive information and its use across Microsoft 365 workloads, including interactions with Microsoft 365 Copilot.

DSPM includes reporting and investigation capabilities that help administrators understand how users interact with organizational information through AI applications.

The AI activity exploration capabilities provide information about Copilot interactions, including associated users, referenced files, sensitivity labels, and potentially sensitive information.

Because the financial files are classified with the Confidential sensitivity label, administrators can investigate activity involving labeled content and determine which users referenced sensitive organizational files during Copilot interactions.

DSPM minimizes administrative effort by providing predefined dashboards, reports, and integrated investigation workflows instead of requiring administrators to construct individual audit searches.

Option A is incorrect because Microsoft Entra audit logs primarily record identity and directory administrative activities, rather than providing detailed Copilot file-reference investigations.

Option C is incorrect because Content explorer identifies and examines classified organizational content. It is not the primary solution for correlating Copilot interactions with users and referenced files.

Option D is incorrect because Data Lifecycle Management manages retention and deletion requirements rather than providing dedicated AI interaction monitoring.

Therefore, Data Security Posture Management is the appropriate solution.

Microsoft References:

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

https://learn.microsoft.com/en-us/purview/ai-m365-copilot

Agent1: Publish the agent for Group1.; Agent2: Reject the submission.

Microsoft 365 Agent Registry provides an administrative approval workflow for agents submitted for organizational deployment. Requests marked Pending review require an administrator to evaluate the agent before publication.

Agent1: Publish the agent for Group1. Agent1 has passed the pilot approval process and must be deployed to a specific security group. Publishing the agent through the Microsoft 365 admin center enables administrators to select Group1 as the intended audience and complete the agent ' s security and permission review.

Because the requirement specifies that the agent must appear automatically, administrators must also select the appropriate preinstallation option during publication. Publishing alone makes an agent available for installation; preinstallation ensures that users do not need to install it manually.

Agent2: Reject the submission. Agent2 connects to an unapproved external data source, introducing a potential data governance and security risk. Rejecting its submission prevents the agent from becoming available to organizational users.

Granting admin consent would not resolve the unauthorized data-source risk, while updating the agent in the store is inappropriate for a newly submitted agent awaiting approval.

Therefore, publishing Agent1 for Group1 with preinstallation and rejecting Agent2 meets the stated requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-requests

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-actions

Microsoft Defender for Office 365 outbound anti-spam policies allow administrators to configure hourly external and internal recipient limits, along with an overall daily recipient limit.

The exhibit specifies three restrictions: an external limit of 10 per hour, an internal limit of 20 per hour, and a combined daily limit of 1,000.

The maximum combined hourly allowance is calculated as follows:

10 + 20 = 30

Across 24 hours, the theoretical maximum is:

30 × 24 = 720

Therefore, Option B (720) is the intended answer because the combined hourly restrictions impose a tighter limit than the configured daily maximum of 1,000.

Option A represents the maximum combined allowance for one hour rather than 24 hours.

Option C incorrectly considers only the daily limit without applying the hourly restrictions.

Option D incorrectly adds the daily limit to the hourly allowances, even though the restrictions operate together.

Technical distinction: Microsoft ' s current documentation specifies these limits in terms of recipients rather than individual email messages. The calculation of 720 messages assumes one recipient per message, with both hourly allowances fully utilized. Messages addressed to multiple recipients consume more of the recipient allowance, so the exact number of messages can be lower.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-configure

https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-sending-limits-troubleshoot

Microsoft 365 Copilot requires supported Microsoft 365 applications to provide integrated AI functionality in desktop Word, Excel, PowerPoint, and other Office applications.

The sales department already has Microsoft 365 E3 and Microsoft 365 Copilot licenses. Consequently, the primary issue is not the licensing configuration but the installed Office application version.

Option B is correct because deploying Microsoft 365 Apps provides the continuously updated desktop applications that support Copilot integration. Administrators must ensure that users are signed in with appropriately licensed Microsoft Entra accounts and that the applications receive supported feature updates.

Option A is incorrect because Office LTSC Professional Plus 2024 is a perpetual-license product that does not receive the continuously delivered Copilot capabilities provided through Microsoft 365 Apps.

Option C is incorrect because Microsoft 365 E5 is not required when users already have qualifying Microsoft 365 E3 licenses and Copilot licenses.

Option D is incorrect because Microsoft Graph connectors integrate external information sources with Microsoft 365 search and Copilot grounding. They do not enable Copilot inside unsupported desktop applications.

Option E is incorrect because participation in the Frontier program is not required to activate standard licensed Copilot functionality.

Therefore, Microsoft 365 Apps must be deployed to the devices.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-copilot-requirements

https://support.microsoft.com/en-us/office/lifecycle/office-2024-and-office-ltsc-2024-faq

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access to privileged roles through eligible assignments and configurable role activation requirements.

Statement 1: Yes.

User1 has an eligible Global Administrator assignment. The PIM configuration specifies Require justification on activation: Yes. Therefore, User1 must submit a business justification when activating the role. The user must also satisfy the configured multifactor authentication requirement.

Statement 2: No.

User2 has an assigned (active) Global Administrator role rather than an eligible assignment. Active assignments provide permissions without requiring role activation. Consequently, the configured MFA-on-activation requirement does not apply to User2 in the manner described. Separate Conditional Access policies may still require MFA during sign-in.

Statement 3: No.

User3 has an eligible Global Administrator assignment. The activation maximum duration is eight hours, meaning each activation can remain active for no longer than eight hours.

However, this does not terminate the underlying eligibility. The eligible assignment is configured to expire after 15 days.

After an eight-hour activation expires, User3 can activate the role again, provided the eligible assignment remains valid and the activation requirements are satisfied.

The distinction between activation duration and eligibility duration is fundamental to Microsoft Entra PIM.

Microsoft References:

Microsoft Learn — Configure PIM role settings .

Microsoft Learn — Activate Microsoft Entra roles in PIM .

Microsoft Learn — Assign eligible and active roles .

Microsoft 365 Agent Registry provides centralized visibility into agents available within an organization. Administrators can filter the inventory using properties such as publisher type, deployment channel, platform, and status.

Option D is correct because the requirements identify two independent filtering conditions: external publisher ownership and availability within Microsoft Teams.

The Publisher type: Third party filter identifies agents developed and distributed by external organizations rather than Microsoft or the organization ' s internal developers.

The Channel: Teams filter identifies agents deployed to Microsoft Teams, where authorized users can discover and interact with them.

Applying both filters restricts the resulting inventory to third-party agents associated with the Teams channel.

Administrators can export the filtered agent list from the Microsoft 365 admin center for auditing. The export includes relevant metadata such as the agent name, channel, publisher, publisher type, platform, and status.

Option A is incorrect because Microsoft 365 apps is not the same deployment channel as Teams.

Option B is incorrect because Your users identifies internally created or shared agents rather than third-party publishers.

Option C is incorrect because Your org identifies agents published by the organization.

Therefore, Teams and Third party are the required filter values.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry

Group1: The Microsoft 365 Copilot usage report; Group2: The Microsoft 365 Copilot Chat usage report

Microsoft 365 provides separate reporting capabilities for licensed Copilot functionality and the broadly available Copilot Chat experience.

First selection: Microsoft 365 Copilot usage report.

Group1 contains users assigned Microsoft 365 Copilot licenses who interact with Copilot across Microsoft 365 applications and agents.

The Microsoft 365 Copilot usage report provides adoption and engagement information about these licensed experiences.

It includes enabled users, active users, usage by application, user activity information, and supported prompt-count metrics.

Administrators can use this report to evaluate whether licensed employees are actively using Copilot capabilities.

Second selection: Microsoft 365 Copilot Chat usage report.

Group2 users do not have Microsoft 365 Copilot licenses but use the Copilot Chat experience available through Microsoft 365.

The Copilot Chat usage report tracks conversational AI adoption, including active users, total prompts submitted, average prompts per user, and individual activity trends.

This makes it the appropriate report for measuring engagement among users who rely on Copilot Chat without the paid Copilot license.

The Microsoft 365 apps usage report measures general application usage, while the Copilot readiness report focuses on eligibility and deployment preparation.

Therefore, the licensed group requires the Copilot usage report, while the unlicensed group requires the Copilot Chat usage report.

Reporting clarification: Microsoft ' s current report documentation describes standard 7-, 28-, 90-, and 180-day periods. The video specifies 30 days, but the latest reporting interface may use a 28-day period instead.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-copilot-usage

Track the number of unique Site1 pages visited by users: From the Microsoft 365 admin center, review the SharePoint site usage reports.; Monitor the Site1 collection storage quotas: From the SharePoint admin center, review the Active sites page.

Microsoft 365 provides both analytical usage reporting and administrative site-management capabilities for SharePoint Online. These functions serve different monitoring requirements.

First selection: SharePoint site usage reports.

The Microsoft 365 admin center includes SharePoint site usage reports that provide information about site activity, storage consumption, and user engagement.

The report contains a metric named Pages visited, representing the number of unique pages visited on a SharePoint site during the reporting period. This differs from Page views, which represents the total number of page views, including repeated visits.

Administrators can access this information through Reports, Usage, and SharePoint site usage.

Second selection: Active sites page.

The SharePoint admin center provides the Active sites page for managing and monitoring individual SharePoint sites.

Administrators can select Site1 and inspect information such as allocated storage, current storage consumption, and site details. When manual storage limits are configured, administrators can also review or change the site ' s storage allocation.

The Microsoft 365 usage report is designed primarily for analytical reporting, while the SharePoint Active sites page provides administrative oversight of site collections and their storage configurations.

Therefore, the two selected administrative locations satisfy the requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/sharepoint-site-usage-ww

https://learn.microsoft.com/en-us/sharepoint/manage-sites-in-new-admin-center

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .