Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
You have a Microsoft 365 subscription.
You have product documents in an external software as a service (SaaS) knowledge base named KB1.
You plan to enable users to find and reason over the content in KB1 by using Microsoft 365 Copilot and Microsoft Search.
You need to configure a Copilot connector. The solution must meet the following requirements:
Index the KB1 content into Microsoft Graph.
Preserve the source permissions of KB1.
What should you configure?
Microsoft 365 Copilot connectors integrate information from external systems into Microsoft 365 Copilot and Microsoft Search. Two principal connector architectures are available: synced connectors and federated connectors.
Option A is correct because synced Copilot connectors ingest external content into Microsoft Graph and make the indexed information available for search and Copilot grounding.
A synced connector can connect to external SaaS knowledge bases, retrieve documents and associated metadata, and store the indexed information in Microsoft's search infrastructure.
The connector also supports access control lists (ACLs), ensuring that users receive search results and Copilot responses only for content they are authorized to access in the source system.
Preserving source permissions requires configuring the connector to honor the knowledge base's original access control model rather than making the indexed content visible to everyone.
Option B is incorrect because a custom Power Platform connector provides integration with external APIs but does not inherently index knowledge base content into Microsoft Graph.
Option C is incorrect because federated Copilot connectors retrieve external data in real time without indexing the information into Microsoft 365. This directly conflicts with the indexing requirement.
Option D is incorrect because embedding exported files in a Copilot Studio agent does not provide the required Microsoft Graph indexing and synchronized source permissions.
Therefore, a synced Copilot connector satisfies both requirements.
Microsoft Reference:
https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/overview
https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/manage-access-permissions
You have a Microsoft 365 subscription.
The users in your company's sales department are assigned Microsoft 365 E3 licenses and Microsoft 365 Copilot licenses. Microsoft Office LTSC Professional Plus 2021 is installed on the users' Windows devices.
The sales department users report that Microsoft 365 Copilot is unavailable in Microsoft Word, Excel, and PowerPoint on the devices.
You need to enable Copilot across desktop app experiences.
What should you do?
Microsoft 365 Copilot requires supported Microsoft 365 applications to provide integrated AI functionality in desktop Word, Excel, PowerPoint, and other Office applications.
The sales department already has Microsoft 365 E3 and Microsoft 365 Copilot licenses. Consequently, the primary issue is not the licensing configuration but the installed Office application version.
Option B is correct because deploying Microsoft 365 Apps provides the continuously updated desktop applications that support Copilot integration. Administrators must ensure that users are signed in with appropriately licensed Microsoft Entra accounts and that the applications receive supported feature updates.
Option A is incorrect because Office LTSC Professional Plus 2024 is a perpetual-license product that does not receive the continuously delivered Copilot capabilities provided through Microsoft 365 Apps.
Option C is incorrect because Microsoft 365 E5 is not required when users already have qualifying Microsoft 365 E3 licenses and Copilot licenses.
Option D is incorrect because Microsoft Graph connectors integrate external information sources with Microsoft 365 search and Copilot grounding. They do not enable Copilot inside unsupported desktop applications.
Option E is incorrect because participation in the Frontier program is not required to activate standard licensed Copilot functionality.
Therefore, Microsoft 365 Apps must be deployed to the devices.
Microsoft Reference:
https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-copilot-requirements
https://support.microsoft.com/en-us/office/lifecycle/office-2024-and-office-ltsc-2024-faq
You have a Microsoft 365 subscription.
Corporate management wants evidence of Microsoft 365 Copilot adoption trends across paid Copilot users.
You need to provide the evidence by using a Microsoft 365 admin center usage report.
What should you use?
The Microsoft 365 Copilot usage report provides organizational insights into how licensed users adopt and interact with Microsoft 365 Copilot across supported Microsoft 365 applications.
Option C is correct because the report is specifically designed to measure Copilot adoption, engagement, and utilization among enabled users.
Administrators can access it through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft Copilot, and the Copilot usage report.
The report provides metrics such as enabled users, active users, active-user rates, and adoption trends across Microsoft 365 workloads, including Word, Excel, PowerPoint, Outlook, and Teams.
It also provides historical trend views that management can use to evaluate whether licensed employees are adopting Copilot over time.
Option A is incorrect because the Copilot Chat usage report focuses on conversational activity in Copilot Chat rather than providing the broader licensed Copilot adoption reporting requested.
Option B is incorrect because Copilot credits reporting focuses on usage-based consumption and associated billing rather than adoption patterns among licensed users.
Option D is incorrect because the Microsoft 365 apps usage report measures application activity more generally, rather than Copilot-specific adoption.
Therefore, the Microsoft 365 Copilot usage report provides the appropriate management evidence.
Microsoft Reference:
https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage
You have a Microsoft 365 subscription.
Several support engineers at your company require temporary access to Microsoft Entra administrator roles.
You need to configure role access for the engineers. The solution must meet the following requirements:
The engineers must activate role access before role use.
Role access must expire automatically after activation.
What should you do?
Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access through eligible role assignments. This capability allows administrators to grant temporary access to sensitive Microsoft Entra administrator roles without maintaining permanent privileged permissions.
When engineers are assigned as eligible for an administrator role, they do not immediately receive the role's active privileges. Instead, they must activate the role before performing privileged administrative tasks.
The activation process can require multifactor authentication, justification, approval, or other security controls, depending on the configured PIM role settings.
Administrators can define a maximum activation duration. Once the activation period expires, the active role assignment expires automatically, and the user must activate the role again before performing privileged operations.
Option A is incorrect because access packages manage access to resources but do not inherently implement just-in-time activation for Microsoft Entra administrator roles.
Option B is incorrect because administrative units restrict the scope of delegated administration without providing automatic role activation and expiration.
Option D is incorrect because active membership in a role-assignable group grants privileges without requiring activation.
Therefore, PIM eligible role assignments satisfy both requirements: explicit activation and automatic expiration.
Microsoft Reference:
https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
You have a Microsoft 365 E5 subscription that contains customer financial files. The files have a sensitivity label named Confidential applied.
You need to review Microsoft 365 Copilot interactions that reference the financial files and identify users that referenced the files. The solution must minimize administrative effort.
What should you use?
Microsoft Purview Data Security Posture Management (DSPM) provides centralized visibility into sensitive information and its use across Microsoft 365 workloads, including interactions with Microsoft 365 Copilot.
DSPM includes reporting and investigation capabilities that help administrators understand how users interact with organizational information through AI applications.
The AI activity exploration capabilities provide information about Copilot interactions, including associated users, referenced files, sensitivity labels, and potentially sensitive information.
Because the financial files are classified with the Confidential sensitivity label, administrators can investigate activity involving labeled content and determine which users referenced sensitive organizational files during Copilot interactions.
DSPM minimizes administrative effort by providing predefined dashboards, reports, and integrated investigation workflows instead of requiring administrators to construct individual audit searches.
Option A is incorrect because Microsoft Entra audit logs primarily record identity and directory administrative activities, rather than providing detailed Copilot file-reference investigations.
Option C is incorrect because Content explorer identifies and examines classified organizational content. It is not the primary solution for correlating Copilot interactions with users and referenced files.
Option D is incorrect because Data Lifecycle Management manages retention and deletion requirements rather than providing dedicated AI interaction monitoring.
Therefore, Data Security Posture Management is the appropriate solution.
Microsoft Reference:
https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about
https://learn.microsoft.com/en-us/purview/ai-m365-copilot
Your network contains an on-premises Active Directory Domain Services (AD DS) domain.
You have a Microsoft 365 subscription that syncs with the domain.
Users must sign in to Microsoft 365 by using their existing domain passwords, and password authentication must occur against the domain.
You need to configure the cloud authentication method.
What should you configure?
Microsoft Entra pass-through authentication (PTA) enables users to authenticate to Microsoft 365 using their existing on-premises Active Directory credentials while ensuring that password validation occurs against the on-premises Active Directory environment.
With pass-through authentication, Microsoft Entra ID receives the cloud sign-in request and communicates with a pass-through authentication agent installed on an on-premises, domain-joined Windows Server.
The agent validates the submitted credentials against Active Directory Domain Services and returns the authentication result to Microsoft Entra ID.
This approach allows organizations to maintain password validation against their existing domain controllers while providing users with access to Microsoft 365 cloud services.
Option B is incorrect because Microsoft Entra seamless single sign-on reduces authentication prompts for domain-joined users but does not independently determine where password validation occurs.
Option C is incorrect because certificate-based authentication uses X.509 certificates rather than authenticating users through their existing domain passwords.
Option D is incorrect because password hash synchronization enables Microsoft Entra ID to validate passwords in the cloud using synchronized password hashes. It does not satisfy the requirement that password authentication occur against the on-premises domain.
Pass-through authentication therefore meets both requirements.
Microsoft Reference:
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. Standard protection is enabled for all recipients.
The subscription contains a mail-enabled security group named Group1. Group1 contains users that require custom inbound anti-spam actions. A custom anti-spam inbound policy named Policy1 is applied to Group1 and has a priority value of 0.
You discover that email sent to the users in Group1 is evaluated by using the Standard preset security policy instead of Policy1.
You need to ensure that Policy1 is applied to Group1. All other recipients must continue to receive the Standard protection settings.
What should you do?
Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti-spam policies.
The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.
Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only. It cannot override the Standard preset security policy.
Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group's members. These users can then be evaluated by Policy1, provided its recipient conditions match.
Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.
Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.
Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.
Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.
Therefore, Group1 must be excluded from the Standard preset security policy.
Microsoft Reference:
https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies
https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined
Exam domains verified against: Official Microsoft AB-650 exam guide, last checked October 2026.
You learn to set up and manage a Microsoft 365 tenant and its associated workloads. This covers the initial configuration steps and ongoing management tasks needed to keep your Microsoft 365 environment running smoothly across different services and applications.
Sample question from this domain above: Q2
Managing identities, authentication and access happens through Microsoft Entra. You protect Microsoft 365 workloads and guard data using Microsoft Purview. These skills ensure your organization stays secure while users can access the resources they need.
You enable and manage Microsoft 365 Copilot for your organization. Implementing and managing agents works across Microsoft 365 and Agent 365. Securing and governing those agents uses Agent 365 tools. Monitoring AI services keeps your AI deployments healthy and performing well.
Common questions about the exam itself
