AB-650 Administering Microsoft 365 and AI Services Questions and Answers

Top navigation bar logo and website link: An organization theme in Microsoft 365; Default sign-in page background: Company branding in Microsoft Entra

Microsoft 365 provides different branding mechanisms for the application interface and the Microsoft Entra authentication experience. Each requirement must be configured through the appropriate administrative service.

First selection: An organization theme in Microsoft 365.

An organization theme controls the appearance of the Microsoft 365 top navigation bar. Administrators can configure the default organizational theme, upload a company logo, and specify the URL that opens when users select the logo.

These options are managed through the Microsoft 365 admin center under Organization profile and organization themes.

Second selection: Company branding in Microsoft Entra.

Microsoft Entra company branding controls the appearance of authentication pages. It supports customizing sign-in page background images, logos, headers, colors, and other visual elements.

Configuring the default company branding ensures the background image is available to users authenticating through the organization ' s branded sign-in experience.

An application-specific branding theme would not satisfy the requirement for a default experience across all users. Similarly, a Microsoft 365 group theme applies to selected Microsoft 365 groups rather than the organization ' s default interface.

Therefore, organization themes and Microsoft Entra company branding are the two appropriate selections.

Microsoft References:

https://learn.microsoft.com/en-GB/microsoft-365/admin/setup/customize-your-organization-theme

https://learn.microsoft.com/en-us/entra/fundamentals/how-to-customize-branding

Report: Explorer (Threat Explorer); View on the Email entity page: Timeline

Microsoft Defender for Office 365 provides Threat Explorer for investigating malicious and suspicious email messages. The Email entity page supplies detailed information about individual messages, including their delivery and post-delivery events.

First selection: Explorer (Threat Explorer).

Threat Explorer enables security analysts to search for email messages using properties such as subject, sender, recipient, detection technology, and delivery status.

The analyst can open Threat Explorer in the Microsoft Defender portal, select the relevant email view, and filter messages by the subject provided in the phishing report. Matching messages can then be examined individually.

Second selection: Timeline.

After identifying the suspicious message, the administrator can open its Email entity page and select the Timeline view.

The Timeline view displays the chronological history of message delivery and subsequent actions. It includes original delivery events, changes caused by Zero-hour Auto Purge (ZAP), quarantine actions, and other recorded message events.

This information enables the administrator to determine where the message was originally delivered and what actions occurred afterward.

Threat Explorer is therefore the correct investigation tool for locating messages by subject, while the Timeline view provides the required delivery and post-delivery history.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about

https://learn.microsoft.com/en-us/defender-office-365/mdo-email-entity-page

Review the: Microsoft 365 Copilot credits report; Notify the department by: Adding a budget and alert recipients to the billing policy

Microsoft 365 provides consumption reports and billing policy controls for organizations using pay-as-you-go Microsoft Copilot services.

First selection: Microsoft 365 Copilot credits report.

The Microsoft Copilot Credits report provides detailed information about consumption associated with metered Copilot Chat and agent interactions.

Administrators can access the report through the Microsoft 365 admin center under Reports, Usage, Microsoft Copilot, and Credits.

The report includes credits consumed by individual users, agents, billing policies, and user-agent combinations. These breakdowns help identify unusually high consumption and determine which activities are contributing to increased costs.

Second selection: Adding a budget and alert recipients to the billing policy.

Microsoft 365 pay-as-you-go billing policies support configurable budgets and spending notifications.

Administrators can specify a budget threshold and designate finance personnel as notification recipients. When consumption reaches the configured notification milestones, Microsoft sends email alerts to the designated recipients.

This provides proactive cost visibility without requiring finance personnel to manually inspect consumption reports.

A critical distinction is that billing policy budgets provide notifications rather than hard spending limits. Reaching the budget threshold does not necessarily stop additional consumption or billing.

Therefore, the Credits report provides the consumption breakdown, while the billing policy budget and notification recipients provide threshold-based alerts.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/message-consumption

https://learn.microsoft.com/en-us/microsoft-365/copilot/pay-as-you-go/setup

Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti-spam policies.

The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.

Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only. It cannot override the Standard preset security policy.

Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group ' s members. These users can then be evaluated by Policy1, provided its recipient conditions match.

Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.

Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.

Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.

Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.

Therefore, Group1 must be excluded from the Standard preset security policy.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies

https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined

Administrative unit members: The Branch1 users and Group1; Role to assign to Helpdesk1: User Administrator

Microsoft Entra administrative units enable organizations to delegate administrative permissions to specific subsets of directory objects, avoiding tenant-wide administrative assignments.

First selection: The Branch1 users and Group1.

The administrative unit must contain both the individual Branch1 user objects and the Group1 security group.

Including Branch1 users enables delegated administrators to manage those users within the administrative unit ' s scope. Including Group1 enables administrators to manage the group ' s properties and membership.

Microsoft specifically distinguishes between adding a security group and adding its members to an administrative unit. Adding Group1 does not automatically add its users. Therefore, selecting Group1 alone would not satisfy the password-reset requirement.

Second selection: User Administrator.

The User Administrator role provides permissions to manage supported user properties, reset passwords for eligible nonprivileged users, and manage group memberships.

When assigned at the administrative-unit scope, the role restricts its administrative operations to the applicable objects within that unit.

The Helpdesk Administrator role supports password-related helpdesk tasks but does not grant the broader group membership management capability required.

The Groups Administrator role focuses on group management without the necessary user password-reset capability.

Privileged Role Administrator provides excessive permissions for the scenario.

Therefore, the administrative unit must contain the Branch1 users and Group1, with Helpdesk1 assigned the scoped User Administrator role.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-members-add

Microsoft Entra ID Governance provides entitlement management through access packages, enabling organizations to automate access requests, approvals, assignments, and expiration.

Option A is correct because access packages support both required capabilities: self-service access requests with approval and automatic revocation when the approved assignment expires.

Administrators can create an access package containing the resources or groups that grant access to Agent1. They then configure an assignment policy that allows eligible contractors to request access.

On the policy ' s Requests settings, administrators can enable approval and designate the appropriate approvers. This ensures that contractors cannot receive access without authorization.

On the Lifecycle settings, administrators can configure access package assignments to expire after a specified number of days. Setting the duration to 30 days automatically ends the assignment at the end of the project.

Option B is incorrect because PIM primarily manages just-in-time privileged role and group access, rather than the complete self-service entitlement management process requested.

Option C is incorrect because Conditional Access evaluates access conditions but does not independently provide request approval and assignment expiration.

Option D is incorrect because recurring access reviews periodically assess existing access instead of providing the required initial request-and-approval workflow.

Therefore, an access package meets both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-approval-policy

https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-lifecycle-policy

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access through eligible role assignments. This capability allows administrators to grant temporary access to sensitive Microsoft Entra administrator roles without maintaining permanent privileged permissions.

When engineers are assigned as eligible for an administrator role, they do not immediately receive the role ' s active privileges. Instead, they must activate the role before performing privileged administrative tasks.

The activation process can require multifactor authentication, justification, approval, or other security controls, depending on the configured PIM role settings.

Administrators can define a maximum activation duration. Once the activation period expires, the active role assignment expires automatically, and the user must activate the role again before performing privileged operations.

Option A is incorrect because access packages manage access to resources but do not inherently implement just-in-time activation for Microsoft Entra administrator roles.

Option B is incorrect because administrative units restrict the scope of delegated administration without providing automatic role activation and expiration.

Option D is incorrect because active membership in a role-assignable group grants privileges without requiring activation.

Therefore, PIM eligible role assignments satisfy both requirements: explicit activation and automatic expiration.

Microsoft References:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

Microsoft 365 admin center provides centralized Agent settings to control both the categories of agents permitted within an organization and the users authorized to access them.

Option B, User access, is correct. This setting determines which users and groups can interact with organizational agents. Administrators should select the option for specific users or groups and assign Group1. This ensures that members of Group1 can use permitted agents while users outside the group are excluded from the pilot.

Option E, Allowed agent types, is correct. This setting controls which publisher categories are permitted. Administrators should allow agents developed by Microsoft and the organization while disabling agents from external publishers.

This configuration enables Group1 members to use Agent1 and approved Microsoft agents without allowing third-party agents.

Option A is incorrect because policy templates apply predefined governance and security configurations rather than defining the combination of user access and agent publisher categories.

Option C controls agent-sharing behavior rather than the overall ability to interact with agents.

Option D provides rules for agent management and lifecycle activities but does not replace the specific access and publisher controls required.

Microsoft ' s current documentation refers to Allowed agent types as Agent and plugin access. The underlying publisher restrictions remain consistent with the question.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-settings

Microsoft Defender for Office 365 Plan 2 provides Attack simulation training capabilities, including dedicated Training campaigns that assign educational modules without requiring another simulated phishing attack.

Option A is correct because creating a Training campaign targeting Group1 allows administrators to reassign the required training directly to the current members of the group. Using Group1 avoids manually identifying recipients and minimizes administrative effort when group membership changes.

Administrators can configure training assignment notifications and reminder notifications during campaign creation. To deliver reminders as frequently as supported, they can select the twice-weekly reminder option.

Option B is correct because the Training threshold setting controls how soon users can receive a training module that was previously assigned.

The default threshold is 90 days. Because the earlier simulation assigned the module recently, this setting could prevent reassignment during the new campaign.

Setting Training threshold to 0 removes the restriction and permits the same module to be reassigned immediately.

Option C is incorrect because a 60-day threshold would still prevent reassignment to users whose previous assignment occurred within that period.

Option D is incorrect because a tenant payload creates customized phishing simulation content, not training assignments.

Option E is unnecessary because simulation automation creates automated phishing simulations rather than directly assigning training.

Therefore, A and B are correct.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-training-campaigns

https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-settings

Microsoft 365 provides Message Center and Service Health notification mechanisms for communicating organizational service changes and operational issues.

First selection: Message Center Preferences. The Microsoft 365 Message Center publishes information about important product changes, feature releases, service updates, and administrative actions. Administrators can configure email preferences to receive notifications about major updates. This directly meets Group1 ' s requirement.

Second selection: Service Health alerts. Service Health supports email notifications for incidents and advisories affecting Microsoft 365 services. Administrators can configure notifications for selected services and designate recipient email addresses. This is the likely intended selection for Group2 if maintenance events means operational service disruptions or advisories.

Microsoft documentation qualification: Planned maintenance is treated differently. Microsoft ' s current documentation explicitly states that planned maintenance announcements appear in Message Center rather than the Service Health dashboard. Therefore, if Group2 requires notifications specifically about planned maintenance, Message Center is the appropriate source, and the proposed Service Health selection does not completely meet that requirement.

The distinction is important when implementing the configuration. Major product updates and planned maintenance communications belong to Message Center; active incidents and service advisories belong to Service Health.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/message-center

https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access to privileged administrator roles. It allows organizations to control when administrative privileges become active and enforce approval and authentication requirements.

First selection: Eligible assignment.

An eligible assignment requires engineers to explicitly activate the User Administrator role before receiving its administrative permissions.

Unlike an active assignment, which grants privileges immediately, an eligible assignment enables temporary privilege elevation only when required.

Permanent active and time-bound active assignments do not satisfy the mandatory activation requirement because their privileges are available throughout the assignment ' s active period.

Second selection: Require approval and multifactor authentication (MFA).

PIM role settings support requiring both MFA and designated approver authorization during role activation.

Administrators can configure these settings in Microsoft Entra admin center → ID Governance → Privileged Identity Management → Microsoft Entra roles → Roles → User Administrator → Role settings.

Enable the MFA requirement, select Require approval to activate, and designate the appropriate approver.

When an engineer requests activation, PIM evaluates the authentication requirements and routes the request for approval. The role becomes active only after the applicable requirements are satisfied and approval is granted.

Technical consideration: PIM can recognize MFA already completed during the current authentication session. Consequently, a fresh MFA prompt is not guaranteed for every activation.

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .