Microsoft AB-650: Administering Microsoft 365 and AI Services (beta)

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Govern and secure Microsoft 365 tenants and workloads

   A contractor needs temporary access to a SharePoint site, and access must end automatically after 90 days. Which feature is most appropriate?

   1. AA permanent member account whose password expires after twelve months
   2. BSharing a link that has no expiration date and is open to anyone
   3. CGuest user access with an access review or expiration policy for the group
   4. DAdding the contractor to the Global Administrator role in Entra ID with tenant-wide scope
   Show answer and explanationHide answer

   Correct answer: C

   Guest access combined with group expiration or access reviews limits the time an external user can keep access. Permanent accounts, never-expiring links and administrator roles all give access beyond the requirement.

2. Question 2Manage and secure AI services in Microsoft 365

   Before rolling out Microsoft 365 Copilot, the administrator finds that some SharePoint sites contain sensitive files that are open to all employees. What is the best first step?

   1. ADisable search for SharePoint sites across the tenant until the site owners confirm their content and permissions
   2. BEnable Microsoft 365 Copilot for every licensed user immediately and address the oversharing in the affected SharePoint sites in a later phase
   3. CDelete the SharePoint sites that contain sensitive files and recreate them with new permissions
   4. DIdentify and remediate oversharing by reviewing site permissions and sensitivity labels before broad Copilot access
   Show answer and explanationHide answer

   Correct answer: D

   Copilot respects the user's existing permissions, so oversharing in SharePoint can expose sensitive content in answers. Reviewing permissions and labels first closes the gap. Enabling broadly first, deleting sites and disabling search do not address the data readiness issue.

3. Question 3Configure and manage Microsoft 365 tenants and workloads

   A tenant administrator wants every new user in the sales department to receive Microsoft 365 licenses automatically when they join the group. Which feature should be configured?

   1. APurchasing a separate license pool per user
   2. BManually assigning licenses to each user in the admin center
   3. CGroup-based licensing on a Microsoft Entra security group
   4. DEnabling multifactor authentication for the group
   Show answer and explanationHide answer

   Correct answer: C

   Group-based licensing assigns and removes licenses automatically based on group membership, which matches a join-driven process. Manual assignment does not scale, purchasing pools does not assign licenses, and MFA is an authentication control.

4. Question 4Govern and secure Microsoft 365 tenants and workloads

   A global administrator should not hold the role permanently, but must be able to activate it only when needed, with approval and a time limit. Which Microsoft Entra feature provides this?

   1. APermanent role assignment with no approval step
   2. BPrivileged Identity Management (PIM) with eligible assignments
   3. CA shared administrator password stored in a SharePoint document library
   4. DConditional Access sign-in rule for compliant devices
   Show answer and explanationHide answer

   Correct answer: B

   PIM provides eligible role assignments that are activated on demand, with optional approval and time limits. Permanent assignments and shared passwords increase standing privilege, and Conditional Access does not manage role activation.

5. Question 5Manage and secure AI services in Microsoft 365

   An organization wants to allow Copilot to search the public web for answers, but only for specific groups of users during a pilot. Which configuration applies?

   1. ABlock web search for Copilot tenant-wide with the policy enforced at the tenant level and no pilot exceptions
   2. BAllow web search for everyone by default in the Copilot settings without a group scope
   3. CManage web search for Copilot in the admin settings and scope the setting to the pilot group
   4. DAsk each user to install a browser extension that routes Copilot web queries
   Show answer and explanationHide answer

   Correct answer: C

   Web search for Copilot is managed in the admin settings and can be scoped to groups for a pilot. Tenant-wide blocks or unscoped allowance do not match the pilot requirement, and browser extensions are not the control.