AB-650 Administering Microsoft 365 and AI Services Questions and Answers

Use: The Microsoft 365 Apps admin center; To configure: Policy Management

Microsoft 365 administrators can control whether Microsoft Copilot uses public web information to generate responses through Microsoft 365 Cloud Policy.

First selection: The Microsoft 365 Apps admin center.

The Microsoft 365 Apps admin center provides access to Cloud Policy, which centrally manages settings for Microsoft 365 applications and supported Copilot experiences.

Administrators can access these settings through config.office.com.

Second selection: Policy Management.

Within the Microsoft 365 Apps admin center, administrators navigate to Customization and Policy Management. They can create or update a policy configuration containing the Allow web search in Copilot setting.

Microsoft documents a configuration that disables web search in Copilot Work mode while preserving web functionality in Copilot Web mode and Copilot Chat.

This distinguishes work-grounded AI interactions from the general web-based experience.

If administrators disable web search entirely, the restriction applies more broadly and does not satisfy the requirement to target only the work-grounded experience.

The Microsoft Purview portal governs information protection, compliance, and data security. It is not the primary interface for this Cloud Policy setting.

Therefore, the Microsoft 365 Apps admin center and Policy Management are the correct selections.

Technical note: Microsoft distinguishes Work mode from Copilot Chat in its current documentation. The relevant setting is Disabled in Microsoft Copilot Work mode; Enabled in Microsoft Copilot Web mode and Microsoft Copilot Chat. This is the documented configuration corresponding most closely to the question ' s intended work-only restriction.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/manage-public-web-access

Microsoft 365 Copilot requires supported Microsoft 365 applications to provide integrated AI functionality in desktop Word, Excel, PowerPoint, and other Office applications.

The sales department already has Microsoft 365 E3 and Microsoft 365 Copilot licenses. Consequently, the primary issue is not the licensing configuration but the installed Office application version.

Option B is correct because deploying Microsoft 365 Apps provides the continuously updated desktop applications that support Copilot integration. Administrators must ensure that users are signed in with appropriately licensed Microsoft Entra accounts and that the applications receive supported feature updates.

Option A is incorrect because Office LTSC Professional Plus 2024 is a perpetual-license product that does not receive the continuously delivered Copilot capabilities provided through Microsoft 365 Apps.

Option C is incorrect because Microsoft 365 E5 is not required when users already have qualifying Microsoft 365 E3 licenses and Copilot licenses.

Option D is incorrect because Microsoft Graph connectors integrate external information sources with Microsoft 365 search and Copilot grounding. They do not enable Copilot inside unsupported desktop applications.

Option E is incorrect because participation in the Frontier program is not required to activate standard licensed Copilot functionality.

Therefore, Microsoft 365 Apps must be deployed to the devices.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-copilot-requirements

https://support.microsoft.com/en-us/office/lifecycle/office-2024-and-office-ltsc-2024-faq

Microsoft Exchange Online supports converting an existing user mailbox to a shared mailbox while retaining its historical email content. This is appropriate when the original user no longer needs direct access but other employees must continue using the mailbox.

Option C is correct because converting Mailbox1 into a shared mailbox preserves the existing email messages and enables delegated access for other users.

The mailbox contains 42 GB of data, which is below the standard 50 GB unlicensed shared mailbox limit. Therefore, an additional mailbox license is not required solely because of its current size, provided no separately licensed features are necessary.

Option B is correct because Full Access permission allows Group1 members to open the mailbox and manage existing items. Send As permission enables them to send messages that appear to originate directly from Mailbox1.

Option E is incorrect because Send on Behalf permission displays the individual delegate ' s identity, whereas the requirement specifies that messages must appear to come from Mailbox1.

Option D is incorrect because Litigation Hold is designed for preservation and compliance purposes, not for providing collaborative mailbox access.

Option A is unnecessary for a standard shared mailbox of this size.

Therefore, converting the mailbox and granting Full Access and Send As permissions satisfies all three requirements.

Microsoft References:

https://learn.microsoft.com/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/create-shared-mailboxes

Microsoft Defender for Office 365 evaluates custom outbound anti-spam policies according to policy priority, inclusion conditions, and exclusions.

Microsoft documents two important evaluation rules:

Different inclusion condition types, such as Users and Groups, use AND logic.

Exclusions override inclusions, and the first applicable policy takes precedence.

Statement 1: No.

User1 belongs to Group1 but is not the explicitly specified user (User3) in AntiSpam1. User1 is specified in AntiSpam2 but does not belong to Group2. Therefore, neither custom policy applies. The limits cannot be combined to produce 150.

Statement 2: No.

User2 belongs to both Group1 and Group2. However, AntiSpam1 specifies User3 and Group1 as combined inclusion conditions, and additionally excludes Group2. AntiSpam2 specifies User1 and Group2 as combined inclusion conditions. User2 does not satisfy either policy ' s complete requirements.

Statement 3: No.

User3 is explicitly included in AntiSpam1 but does not belong to Group1. User3 also belongs to the excluded Group2. AntiSpam2 explicitly excludes User3. Consequently, neither custom policy imposes the stated 100-recipient daily limit on User3.

All three users fall back to the default outbound anti-spam policy.

Technical clarification: Microsoft defines the daily message limit in outbound anti-spam policies as a maximum number of recipients per day, not necessarily the number of email messages.

Microsoft Reference: Microsoft Learn — Configure outbound spam policies, recipient conditions, and policy precedence .

Microsoft Agent 365 provides centralized governance of tools and Model Context Protocol (MCP) servers that AI agents use to access external services and organizational data.

Option D is correct because the Microsoft 365 admin center ' s Tools management interface enables administrators to block an individual MCP server without disabling the agent or unrelated MCP servers.

In this scenario, MCP2 is currently marked Available but has not completed its security review. Allowing agents to invoke MCP2 could expose procurement information before appropriate security controls have been validated.

Administrators can navigate to the Microsoft 365 admin center, select Agents → Tools → Registry, locate MCP2, and select Block.

Blocking MCP2 changes its availability and prevents agents from using the tools exposed by that server. MCP1 remains available because it is a separate MCP server, and Agent1 itself is not disabled.

Option A is incorrect because agent management rules do not provide the direct server-specific blocking action requested.

Option B is incorrect because the Agent Registry manages agents, whereas the Tools Registry provides MCP server controls.

Option C is incorrect because policy templates are not the direct mechanism for blocking an individual MCP server.

Therefore, blocking MCP2 from Tools satisfies the requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-plugins-skills-mcp-servers

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-tools-overview

Microsoft Purview auto-labeling policies automatically apply sensitivity labels to supported SharePoint and OneDrive documents when configured sensitive information conditions are satisfied.

AutoLabel1 requires the IP Address sensitive information type at High confidence, with a minimum instance count of two.

Statement 1: No.

File1.docx contains only one IP address. Although .docx is supported for automatic sensitivity labeling, the file does not meet the minimum requirement of two matching instances. Therefore, Sensitivity1 is not applied.

Statement 2: No.

File2.txt contains two IP addresses, satisfying the numerical threshold. However, SharePoint auto-labeling policies do not support .txt files. Microsoft documents supported file formats as modern Word, Excel, PowerPoint, and eligible PDF documents. Consequently, Sensitivity1 is not applied to File2.txt.

Statement 3: Yes.

File3.xlsx contains five IP addresses, exceeding the minimum instance count of two. The .xlsx format is supported by SharePoint auto-labeling policies. Assuming at least two IP addresses are detected at the configured High confidence level, the file satisfies the rule and receives Sensitivity1 once the policy processes it.

Thus, file format support and sensitive information matching must both be considered when evaluating auto-labeling behavior.

Microsoft Defender for Office 365 Plan 2 provides Automated Investigation and Response (AIR) capabilities to investigate malicious email messages and recommend or execute remediation actions.

Option D is correct because Microsoft explicitly identifies Soft delete as the only available remediation action when configuring automatic remediation for AIR message clusters.

By default, AIR remediation actions require approval from the Security Operations (SecOps) team. However, administrators can enable automatic remediation for selected message cluster types, allowing malicious messages to be remediated without manual approval.

Administrators can configure this feature in the Microsoft Defender portal by navigating to Settings → Email & collaboration → MDO automation settings.

The Message clusters section supports three categories:

Similar files

Similar URLs

Multiple similar attributes

Under Remediation action, administrators select Soft delete. AIR then automatically removes qualifying malicious messages from user mailboxes without requiring SecOps approval.

Soft deletion moves messages into the Recoverable Items structure, allowing recovery according to applicable mailbox retention settings.

Option A moves messages to Deleted Items, while Option B moves them to Junk Email. Neither is supported as the configurable automatic AIR remediation action.

Option C permanently removes messages and is not supported for this automatic remediation configuration.

Microsoft also specifies that clusters containing more than 10,000 messages require manual review rather than automatic remediation.

Therefore, Soft delete is the only correct option.

Microsoft Entra ID supports the ForceDelete operation for removing custom domains that still have references to directory objects. This operation automatically updates supported references, reducing the need for manual administrative changes.

Option C is correct because the domain meets the main ForceDelete prerequisites: it uses managed authentication, is not the default domain, and has fewer than 1,000 references.

However, Microsoft explicitly requires administrators to update or remove domain references from Exchange-managed objects, including mail-enabled security groups and distribution lists, before executing ForceDelete.

After these references are removed, ForceDelete can automatically update eligible user principal names, email addresses, proxy addresses, group addresses, and application identifier URIs to the tenant ' s initial onmicrosoft.com domain.

Option A is incorrect because manually updating all 750 references creates unnecessary administrative effort.

Option B is incorrect because ForceDelete cannot automatically remove all Exchange-managed dependencies. The mail-enabled security group references must be corrected first.

Option D is incorrect because a default domain cannot be deleted while it remains designated as the default.

Therefore, clearing the Exchange-managed references and using ForceDelete is the most efficient supported approach.

Microsoft References:

Microsoft Learn — Manage custom domain names and ForceDelete .

Microsoft Graph — domain: forceDelete .

Microsoft Entra ID provides a group naming policy that enables organizations to enforce consistent naming conventions for Microsoft 365 groups.

First selection: The Microsoft Entra admin center.

Administrators configure the naming policy by navigating to the Microsoft Entra admin center and selecting Microsoft Entra ID → Groups → Naming policy.

The policy supports two principal capabilities: prefix-suffix naming conventions and custom blocked words.

Prefix-suffix rules automatically add predefined text or supported user attributes, such as Department or Company, to group names. Blocked-word policies prevent users from creating Microsoft 365 groups with prohibited terminology.

Second selection: Microsoft 365 only.

The Microsoft Entra group naming policy applies specifically to Microsoft 365 groups, including groups created through Microsoft Teams, Outlook, SharePoint, and other supported Microsoft 365 applications.

It does not apply to ordinary security groups, mail-enabled security groups, or Exchange distribution groups.

Exchange distribution groups can have separate naming policies configured through Exchange administration, but these are distinct from the Microsoft Entra Microsoft 365 group naming policy.

Microsoft 365 E5 includes the licensing required for this functionality.

An additional consideration is that certain privileged administrator roles are exempt from enforcement, and existing Microsoft 365 groups are not automatically renamed when the policy is introduced.

Therefore, the correct selections are the Microsoft Entra admin center and Microsoft 365 groups only.

Converting an existing Exchange Online user mailbox into a shared mailbox allows multiple employees to manage correspondence while preserving its existing messages, calendar information, and mailbox content.

Option B is correct because it satisfies the storage, access, and sender identity requirements.

The critical consideration is the mailbox size. Mailbox1 contains 72 GB of data, exceeding the 50 GB storage limit for an unlicensed shared mailbox. Microsoft requires an appropriate license, such as Exchange Online Plan 2, to increase a shared mailbox ' s primary mailbox capacity to 100 GB.

Consequently, the mailbox must retain suitable licensing after conversion.

Full Access permissions allow support users to open Mailbox1 and manage its existing content. Send As permissions enable users to send replies that appear to originate directly from support@contoso.com, without displaying the individual delegate ' s identity.

Option A is incorrect because removing the license would leave the 72 GB mailbox above the unlicensed shared mailbox storage limit.

Option C is incorrect because Send on Behalf displays the delegate ' s identity and also proposes removing the required license.

Option D does not preserve the existing mailbox as a shared mailbox with the specified delegation permissions.

The appropriate configuration is therefore to convert Mailbox1, grant Full Access and Send As, and retain the necessary license.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox

https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes

Microsoft SharePoint Restricted Access Control enables administrators to restrict access to a SharePoint site and its content to members of designated Microsoft Entra security groups or Microsoft 365 groups.

Option B is correct because Restricted Access Control adds an additional authorization requirement without replacing the site ' s existing SharePoint permissions.

When Group1 is configured as the restricted access control group for Site1, users must satisfy two conditions before accessing its documents: they must belong to Group1 and possess appropriate existing SharePoint permissions.

Users outside Group1 are denied access even when they previously received direct permissions or sharing links.

This protection also applies to Microsoft 365 Copilot and organization-wide search experiences. Microsoft Copilot respects the effective SharePoint authorization boundaries, preventing unauthorized users from accessing restricted content through Copilot responses.

Option A is incorrect because Microsoft 365 Archive is intended for inactive content storage rather than enforcing group-based authorization.

Option C is incorrect because Restricted SharePoint Search controls content discoverability, not the underlying ability to open files.

Option D is incorrect because Restricted Content Discovery limits search and Copilot discovery without enforcing the required group-based access restrictions.

Restricted Access Control therefore satisfies the complete requirement while preserving the existing permission structure.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-access-control

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.