Microsoft Administering Microsoft 365 and AI Services AB-650 Exam Dumps: Updated Questions & Answers (November 2026)

Microsoft Purview Data Loss Prevention (DLP) provides controls that prevent Microsoft 365 Copilot and supported agents from processing sensitive organizational information when generating responses.

Option C is correct because Microsoft Purview supports DLP policies that identify files by their sensitivity labels and prevent Copilot from using the protected content in generated responses.

Administrators can configure the solution through Microsoft Purview portal → Data loss prevention → Policies.

Create a policy using the Microsoft 365 Copilot and Copilot Chat location, with the following configuration:

Condition: Content contains → Sensitivity labels

Selection: The sensitivity label applied to the sensitive SharePoint files

Action: Prevent Copilot from processing content

The policy prevents supported Copilot experiences from processing the labeled documents while allowing unlabeled SharePoint content to remain available for grounding, subject to existing permissions.

Option A is incorrect because Microsoft Defender for Cloud Apps primarily provides cloud application discovery, monitoring, and session controls.

Option B is incorrect because an agent blueprint defines agent identity and configuration characteristics rather than providing sensitivity-label-based content restrictions.

Option D is incorrect because Restricted SharePoint Search limits searchable SharePoint locations rather than selectively excluding files based on sensitivity labels.

Therefore, Microsoft Purview DLP is the appropriate solution.

Microsoft References:

Microsoft Learn — Secure and govern Microsoft 365 Copilot agents .

Microsoft Learn — Manage access to agents in SharePoint .

Microsoft Learn — DLP for Copilot and Copilot Chat .

Final Answer: C. Microsoft Purview data loss prevention (DLP)

Answer Area

Correct Selection

Agents flagged by aggregated security and compliance signals

Agents at risk

Agents that lack accountable lifecycle management

Agents without owners

Microsoft Agent 365 provides centralized governance action cards within the Microsoft 365 admin center to identify security risks, ownership gaps, and agent lifecycle issues.

First selection: Agents at risk.

The Agents at risk card identifies agents associated with aggregated security and compliance risk signals from Microsoft Entra, Microsoft Defender, and Microsoft Purview.

Administrators can select Manage agent risks to open the Agent Registry with the relevant agents filtered by identified risk.

This enables security teams to investigate potentially compromised agents, inappropriate permissions, data exposure concerns, and other detected security issues.

Second selection: Agents without owners.

The Agents without owners card identifies agents that do not have an assigned owner responsible for governance and lifecycle management.

Administrators can select Assign Owner to review affected agents and establish ownership accountability.

An assigned owner helps ensure ongoing technical maintenance, appropriate access management, and governance oversight.

The remaining action cards address different scenarios. Agents with exceptions identifies agents experiencing operational errors, while Pending requests for agents identifies agent deployment requests awaiting administrative approval.

Microsoft documents that AI Administrators and Global Administrators can perform the relevant governance actions.

Therefore, Agents at risk and Agents without owners are the correct selections.

Microsoft References:

Microsoft Learn — Agent 365 overview and governance action cards .

Microsoft Learn — Agent Registry and security risk management .

Option

Correct Action

B

Change Mode from Audit to Enforced

D

Install the Microsoft Entra Password Protection DC Agent on all writable domain controllers

F

Install the Microsoft Entra Password Protection Proxy

Microsoft Entra Password Protection extends global and custom banned password policies to on-premises Active Directory Domain Services (AD DS).

Option B is correct. The exhibit shows that password protection for Windows Server Active Directory is enabled but operates in Audit mode. Audit mode records weak password attempts without rejecting them. Changing the setting to Enforced ensures passwords failing validation are rejected.

Option D is correct. Microsoft Entra Password Protection requires the DC Agent on every writable domain controller to provide consistent enforcement. The agent evaluates password changes and resets against the downloaded banned password policies.

Option F is correct. The Password Protection Proxy communicates with Microsoft Entra ID and enables domain controllers to retrieve updated global and custom banned password policies. This component is mandatory for on-premises deployment.

Option A is incorrect because the Default Domain Policy does not configure Microsoft Entra ' s banned password lists.

Option C is incorrect because the Application Proxy connector provides application connectivity, not password protection.

Option E is incorrect because the exhibit already shows Enforce custom list set to Yes.

Important: Microsoft recommends installing the Password Protection Proxy on a domain-joined member server rather than a domain controller in production. Installing it on a domain controller is supported for testing but creates additional security considerations.

Also, password protection evaluates new password changes and resets; it does not retroactively invalidate existing passwords.

Microsoft References:

Microsoft Learn — Enable on-premises Microsoft Entra Password Protection .

Microsoft Learn — Deploy Microsoft Entra Password Protection DC Agents and Proxy .

Microsoft Learn — Troubleshoot banned passwords being accepted .

Microsoft 365 provides Message Center and Service Health notification mechanisms for communicating organizational service changes and operational issues.

First selection: Message Center Preferences. The Microsoft 365 Message Center publishes information about important product changes, feature releases, service updates, and administrative actions. Administrators can configure email preferences to receive notifications about major updates. This directly meets Group1 ' s requirement.

Second selection: Service Health alerts. Service Health supports email notifications for incidents and advisories affecting Microsoft 365 services. Administrators can configure notifications for selected services and designate recipient email addresses. This is the likely intended selection for Group2 if maintenance events means operational service disruptions or advisories.

Microsoft documentation qualification: Planned maintenance is treated differently. Microsoft ' s current documentation explicitly states that planned maintenance announcements appear in Message Center rather than the Service Health dashboard. Therefore, if Group2 requires notifications specifically about planned maintenance, Message Center is the appropriate source, and the proposed Service Health selection does not completely meet that requirement.

The distinction is important when implementing the configuration. Major product updates and planned maintenance communications belong to Message Center; active incidents and service advisories belong to Service Health.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/message-center

https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health

You can add a Microsoft Entra cloud user to: Group1, Group2, and Group3; You can add Group5 to: Group1 and 3 only

Microsoft Entra group membership is governed by group type, membership assignment method, and source of authority.

First selection: Group1, Group2, and Group3.

The exhibit identifies Group1 and Group2 as cloud-managed Microsoft 365 groups using assigned membership. Microsoft 365 groups support user membership regardless of whether the group ' s Security enabled property is set to Yes or No.

Group3 is a cloud-managed security group with assigned membership, so administrators can also add a Microsoft Entra user directly.

Group4 uses dynamic membership, meaning users are included automatically according to configured rules rather than manually assigned.

Group5 originates from Windows Server Active Directory. Its membership is managed by the authoritative on-premises directory.

Second selection: Group1 and Group3 only.

Microsoft Entra supports nesting security groups within other compatible security groups. Consequently, Group5 can be added as a member of Group3.

Microsoft 365 groups do not support groups as members, and dynamic group membership cannot be manually modified.

The first answer above reflects Microsoft ' s documented group membership behavior rather than simply reproducing the recording ' s selected response.

Microsoft References:

https://learn.microsoft.com/en-us/graph/api/group-post-members

Modify the password protection policy: User1 only; Invite an external user: User1, User2, User3, and User4

Microsoft Entra ID uses role-based access control (RBAC) to authorize administrative operations. The two activities in this question have different permission requirements.

First selection: User1 only.

Modifying the tenant-wide password protection policy requires privileged authorization. The Global Administrator role held by User1 includes the permissions required to configure Microsoft Entra Password Protection, including the custom banned-password list and smart lockout settings.

The Authentication Policy Administrator role can also manage these settings, but none of the other listed users holds that role. User2 ' s Security Administrator role does not provide this specific permission, while User4 ' s Password Administrator role concerns password administration rather than configuration of the tenant-wide password protection policy.

Second selection: User1, User2, User3, and User4.

Microsoft Entra external collaboration settings allow users to invite external guests. Under the default configuration, organizational users can invite external users, including users without administrative roles.

User1 can invite guests as a Global Administrator, and User2 also has the Guest Inviter role. User3 and User4 can invite external users under the default invitation settings.

Therefore, all four users qualify for the second activity.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure

Microsoft 365 Backup supports restoring SharePoint sites to an earlier point in time, either by replacing the original site or creating a new site from backup.

Option C is correct because Site1 is protected by a retention policy with Preservation Lock. This prevents administrators from weakening or removing the protected retention configuration.

Microsoft documents that SharePoint sites subject to strict SEC 17a-4(f) preservation requirements cannot undergo an in-place restore that would violate the immutability guarantee.

By selecting Create new sites from backups, administrators restore the complete site to a separate SharePoint URL without replacing the existing protected site.

The original Site1 and its Preservation Lock remain unaffected.

Option A is incorrect because an in-place restore is incompatible with strict preservation requirements.

Option B is incorrect because restoring to a new folder does not provide the requested full SharePoint site restore.

Option D is incorrect because replacing the original site could roll back protected content and metadata, conflicting with the preservation requirement.

Microsoft notes that some less restrictive retention holds permit in-place restores. However, creating a new site is the appropriate approach for maintaining strict preservation guarantees.

Microsoft References:

Microsoft Learn — Restore data in Microsoft 365 Backup .

Microsoft Learn — Retention policies and Preservation Lock .

Final Answer: C. Create new sites from backups.

Answer Area

Correct Selection

A user that is assigned the Global Administrator role as active

will lose the role after 15 days

You can make the Global Administrator role available to activation requests

for up to three months

Microsoft Entra Privileged Identity Management (PIM) distinguishes between active role assignments, eligible role assignments, and temporary role activation.

First selection: will lose the role after 15 days.

The exhibit specifies:

Allow permanent active assignment: No

Expire active assignments after: 15 days

An active assignment grants Global Administrator permissions without requiring the user to activate the role.

Because permanent active assignments are disabled, PIM requires time-bound assignments. The maximum assignment duration is 15 days. Once an assignment expires, the user loses the assigned administrative privileges unless the assignment is renewed.

The eight-hour activation limit does not apply to directly assigned active roles.

Second selection: for up to three months.

The exhibit also specifies:

Allow permanent eligible assignment: No

Expire eligible assignments after: 3 months

An eligible assignment allows a user to request activation of the Global Administrator role during the eligibility period.

Therefore, the role can remain available for activation requests for up to three months.

Each individual activation can last a maximum of eight hours, as specified by the separate Activation maximum duration setting.

The 15-day limit applies to active assignments, not eligible assignments.

Microsoft References:

Microsoft Learn — Configure Microsoft Entra role settings in PIM .

Microsoft Learn — Assign Microsoft Entra roles in PIM .

Microsoft Defender XDR provides a unified incident investigation experience that correlates Microsoft Purview Data Loss Prevention alerts with security signals from other Microsoft Defender workloads.

Option C is correct because Microsoft Defender incidents combine related DLP alerts and security events into a single investigation context. This enables analysts to examine potentially connected activity instead of investigating each isolated alert independently.

Microsoft Defender can correlate DLP detections with signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and other integrated security services.

The incident investigation experience also supports remediation actions directly against affected entities. Depending on the relevant workload, authorization, and alert evidence, analysts can take actions such as resetting a user ' s password, disabling an account, applying a sensitivity label, removing file-sharing permissions, or isolating a compromised device.

Option A is incorrect because Activity explorer primarily provides visibility into user and data activities.

Option B is incorrect because Content explorer focuses on inspecting classified and sensitive content.

Option D is less appropriate because individual Defender alerts do not provide the same consolidated correlation and incident-management capabilities.

Option E supports DLP alert investigation but does not provide the same unified cross-product security correlation and remediation experience.

Therefore, Microsoft Defender incidents satisfy both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/defender-xdr/dlp-investigate-alerts-defender

Group1: The Microsoft 365 Copilot usage report; Group2: The Microsoft 365 Copilot Chat usage report

Microsoft 365 provides separate reporting capabilities for licensed Copilot functionality and the broadly available Copilot Chat experience.

First selection: Microsoft 365 Copilot usage report.

Group1 contains users assigned Microsoft 365 Copilot licenses who interact with Copilot across Microsoft 365 applications and agents.

The Microsoft 365 Copilot usage report provides adoption and engagement information about these licensed experiences.

It includes enabled users, active users, usage by application, user activity information, and supported prompt-count metrics.

Administrators can use this report to evaluate whether licensed employees are actively using Copilot capabilities.

Second selection: Microsoft 365 Copilot Chat usage report.

Group2 users do not have Microsoft 365 Copilot licenses but use the Copilot Chat experience available through Microsoft 365.

The Copilot Chat usage report tracks conversational AI adoption, including active users, total prompts submitted, average prompts per user, and individual activity trends.

This makes it the appropriate report for measuring engagement among users who rely on Copilot Chat without the paid Copilot license.

The Microsoft 365 apps usage report measures general application usage, while the Copilot readiness report focuses on eligibility and deployment preparation.

Therefore, the licensed group requires the Copilot usage report, while the unlicensed group requires the Copilot Chat usage report.

Reporting clarification: Microsoft ' s current report documentation describes standard 7-, 28-, 90-, and 180-day periods. The video specifies 30 days, but the latest reporting interface may use a 28-day period instead.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-copilot-usage