AB-650 Exam Dumps - Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate Questions and Answers

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Report: Explorer (Threat Explorer); View on the Email entity page: Timeline

Microsoft Defender for Office 365 provides Threat Explorer for investigating malicious and suspicious email messages. The Email entity page supplies detailed information about individual messages, including their delivery and post-delivery events.

First selection: Explorer (Threat Explorer).

Threat Explorer enables security analysts to search for email messages using properties such as subject, sender, recipient, detection technology, and delivery status.

The analyst can open Threat Explorer in the Microsoft Defender portal, select the relevant email view, and filter messages by the subject provided in the phishing report. Matching messages can then be examined individually.

Second selection: Timeline.

After identifying the suspicious message, the administrator can open its Email entity page and select the Timeline view.

The Timeline view displays the chronological history of message delivery and subsequent actions. It includes original delivery events, changes caused by Zero-hour Auto Purge (ZAP), quarantine actions, and other recorded message events.

This information enables the administrator to determine where the message was originally delivered and what actions occurred afterward.

Threat Explorer is therefore the correct investigation tool for locating messages by subject, while the Timeline view provides the required delivery and post-delivery history.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about

https://learn.microsoft.com/en-us/defender-office-365/mdo-email-entity-page

To apply malware protection: Configure Safe Attachments for Microsoft SharePoint, OneDrive, and Teams.; To prevent local copies: Run the Set-SPOTenant cmdlet to prevent users from downloading infected files.

Microsoft Defender for Office 365 provides Safe Attachments protection for files stored in SharePoint Online, OneDrive for Business, and Microsoft Teams. The feature identifies malicious files and restricts their availability across Microsoft 365 collaboration workloads.

First selection: Configure Safe Attachments for Microsoft SharePoint, OneDrive, and Teams.

Administrators must enable Safe Attachments protection for the collaboration workloads through the Microsoft Defender portal. This configuration enables malware detection and protection for supported files stored in these services.

Second selection: Run the Set-SPOTenant cmdlet to prevent users from downloading infected files.

By default, users cannot open, move, copy, or share files identified as malicious, but downloading may still be permitted. To prevent users from retaining local copies, administrators must enable the tenant-level download restriction by using SharePoint Online PowerShell:

Set-SPOTenant -DisallowInfectedFileDownload $true

This setting prevents ordinary users from downloading files that have been detected as infected.

The two configurations work together: Safe Attachments provides malware detection and file protection, while the SharePoint tenant setting closes the download restriction gap.

The configuration can be verified by checking the DisallowInfectedFileDownload property using Get-SPOTenant.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/safe-attachments-for-spo-odfb-teams-configure

Microsoft SharePoint Restricted Content Discovery (RCD) provides a site-specific mechanism for limiting how SharePoint content appears in organization-wide Microsoft 365 search and Microsoft 365 Copilot experiences.

Option B is correct because the administrator can apply Restricted Content Discovery directly to Site1 without modifying the search behavior of the other 999 SharePoint sites.

When RCD is enabled for Site1, its content is generally excluded from organization-wide discovery experiences and Copilot responses. This reduces the risk of confidential documents appearing in broad search results.

Restricted Content Discovery does not modify existing SharePoint permissions or remove files from the Microsoft 365 search index.

Option A is incorrect because Restricted SharePoint Search uses a tenant-wide allowlist approach and can affect search results across many SharePoint sites. Microsoft also began blocking new enablement of that feature on July 31, 2026.

Option C is incorrect because Copilot connectors integrate external data sources rather than restrict the discovery of existing SharePoint content.

Option D is incorrect because Microsoft Search bookmarks promote selected resources rather than restrict document discoverability.

Implementation qualification: Microsoft documents exceptions for content users own or have recently interacted with. RCD is not an absolute security boundary. If all access must be prevented, SharePoint permissions or Restricted Access Control must also be considered.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery

https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search

Microsoft Entra Lifecycle Workflows supports automated identity lifecycle management, including workflows that govern Microsoft Entra agent identity sponsorships when employees change positions or leave an organization.

Option B is correct because the Lifecycle Workflows Administrator role grants the administrative permissions required to create, modify, and manage lifecycle workflows without granting broad entitlement management permissions.

Microsoft documents several agent sponsorship workflow tasks, including sending notifications to managers, notifying cosponsors, and transferring agent identity sponsorships to a manager.

These tasks are available within mover and leaver workflow templates. Admin1 can configure the appropriate workflow triggers, assign sponsorship-related tasks, and manage workflow execution.

The Lifecycle Workflows Administrator role is specifically scoped to lifecycle workflow management. It does not inherently grant administrative control over access packages, access reviews, or entitlement management catalogs.

Option A is incorrect because Global Administrator provides excessive privileges.

Option C is incorrect because AI Administrator is not the dedicated role for managing Microsoft Entra Lifecycle Workflows.

Option D is incorrect because Identity Governance Administrator provides broader identity governance permissions, conflicting with least privilege.

Option E is incorrect because Agent ID Administrator manages agent identity administration rather than providing the specific lifecycle workflow permissions required.

Therefore, Lifecycle Workflows Administrator is the appropriate role.

Microsoft References:

https://learn.microsoft.com/en-us/entra/id-governance/agent-sponsor-tasks

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

Microsoft Entra Password Protection helps prevent users from choosing weak or commonly used passwords by checking password changes against Microsoft ' s global banned-password list and an administrator-defined custom list.

Option A is correct because the Microsoft Entra Password Protection domain controller (DC) agent extends password validation to on-premises Active Directory Domain Services.

By default, configuring a custom banned-password list in Microsoft Entra ID protects cloud-based password changes but does not automatically extend the enforcement mechanism to domain controllers.

To implement on-premises protection, administrators must deploy the Password Protection DC agent to domain controllers and configure the supporting Microsoft Entra Password Protection proxy service. The proxy retrieves password protection policies from Microsoft Entra ID and makes them available to the DC agents.

Administrators must also enable password protection for Windows Server Active Directory and configure Enforced mode rather than Audit mode.

Option B is incorrect because the Microsoft Entra provisioning agent supports identity provisioning and synchronization scenarios.

Option C is incorrect because password writeback supports writing cloud-initiated password changes to on-premises Active Directory.

Option D is incorrect because password hash synchronization enables cloud authentication using synchronized password hashes; it does not enforce custom banned passwords during on-premises password changes.

Therefore, deploying the DC agent is the correct choice, with the additional deployment components and enforcement configuration required for operation.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-operations

Use: The Microsoft 365 Apps admin center; To configure: Policy Management

Microsoft 365 administrators can control whether Microsoft Copilot uses public web information to generate responses through Microsoft 365 Cloud Policy.

First selection: The Microsoft 365 Apps admin center.

The Microsoft 365 Apps admin center provides access to Cloud Policy, which centrally manages settings for Microsoft 365 applications and supported Copilot experiences.

Administrators can access these settings through config.office.com.

Second selection: Policy Management.

Within the Microsoft 365 Apps admin center, administrators navigate to Customization and Policy Management. They can create or update a policy configuration containing the Allow web search in Copilot setting.

Microsoft documents a configuration that disables web search in Copilot Work mode while preserving web functionality in Copilot Web mode and Copilot Chat.

This distinguishes work-grounded AI interactions from the general web-based experience.

If administrators disable web search entirely, the restriction applies more broadly and does not satisfy the requirement to target only the work-grounded experience.

The Microsoft Purview portal governs information protection, compliance, and data security. It is not the primary interface for this Cloud Policy setting.

Therefore, the Microsoft 365 Apps admin center and Policy Management are the correct selections.

Technical note: Microsoft distinguishes Work mode from Copilot Chat in its current documentation. The relevant setting is Disabled in Microsoft Copilot Work mode; Enabled in Microsoft Copilot Web mode and Microsoft Copilot Chat. This is the documented configuration corresponding most closely to the question ' s intended work-only restriction.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/manage-public-web-access

First dropdown: Get-MgGroupMember; Second dropdown: Update-MgUser; Third dropdown: -UserId

Microsoft Graph PowerShell provides cmdlets for managing Microsoft Entra groups and modifying user account attributes. This task requires retrieving members of an existing group and updating the EmployeeType property for each user.

First selection: Get-MgGroupMember. This cmdlet retrieves direct members of the specified Microsoft Entra group. The -GroupId parameter identifies the Contractors group using its unique identifier.

Second selection: Update-MgUser. This cmdlet updates Microsoft Entra user properties through Microsoft Graph. It supports the -EmployeeType parameter, which can be used to assign the value Part-time.

Third selection: -UserId. This parameter identifies the specific user object to modify. The foreach statement processes each returned member and applies the corresponding update.

Technical accuracy note: The video uses $person.ObjectId. Current Microsoft Graph PowerShell documentation normally exposes the member identifier as $person.Id. Additionally, the -All switch should be specified when retrieval of every group member is required across result pages.

A production-oriented implementation would therefore use the following structure, assuming the group contains user objects:

$members = Get-MgGroupMember -GroupId " < GroupId > " -All

foreach ($person in $members) { Update-MgUser -UserId $person.Id -EmployeeType " Part-time " }

The three dropdown answers remain correct; this implementation note distinguishes the original examination script from current Microsoft Graph behavior.

Microsoft References:

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.groups/get-mggroupmember

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/update-mguser