AB-650 Microsoft Administering Microsoft 365 and AI Services Free Practice Exam Questions (2026 Updated)

The Contoso case study specifies the following planned change:

Add an additional email address alias for the users in Group4.

Group4 is a Microsoft 365 group containing User1 and User2. Both users have Microsoft Exchange mailboxes.

Option C is correct because the Exchange Online PowerShell Set-Mailbox cmdlet supports modifying mailbox properties, including additional SMTP email addresses.

Administrators can use the -EmailAddresses parameter with the @{Add=...} syntax to add a secondary email address without removing existing addresses or modifying the primary SMTP address.

For example:

Set-Mailbox -Identity " user1@contoso.com " `

-EmailAddresses @{Add= " user1.alias@contoso.com " }

The same operation can be performed for the other Group4 members.

Option A is incorrect because Set-MailUser manages mail-enabled users who have external mailboxes, rather than Exchange Online user mailboxes.

Option B is incorrect because Update-MgUser manages Microsoft Entra user properties and is not the appropriate cmdlet for modifying Exchange Online mailbox proxy addresses.

Option D is incorrect because Set-ADUser manages on-premises Active Directory user objects. Contoso ' s users are cloud-only, and their Exchange Online mailboxes are managed in Microsoft 365.

Therefore, Set-Mailbox is the appropriate cmdlet for implementing the planned change.

Microsoft References:

Microsoft Learn — Add or remove email addresses for a mailbox in Exchange Online .

Microsoft Learn — Set-Mailbox PowerShell reference .

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Answer Area

Correct Selection

Users that can approve the request

Admin1 and Admin3 only

User1 will be an AI administrator for

24 hours

Microsoft Entra Privileged Identity Management (PIM) enables eligible users to activate privileged administrator roles temporarily, subject to approval and activation-duration restrictions.

First selection: Admin1 and Admin3 only.

The Contoso case study specifies that approval is required to activate the AI Administrator role, but the Approvers setting is None.

According to Microsoft documentation, when no specific approvers are configured, active Global Administrators and Privileged Role Administrators become the default approvers.

Therefore:

Admin1: Global Administrator — can approve.

Admin2: AI Administrator — cannot approve merely by holding this role.

Admin3: Privileged Role Administrator — can approve.

Second selection: 24 hours.

The PIM configuration specifies an Activation maximum duration of 24 hours.

This means User1 can activate the AI Administrator role for a maximum of 24 hours following approval. After the activation period expires, PIM automatically removes the active privileges.

The one-month eligible assignment expiration controls how long User1 remains eligible to request activation. The 15-day active assignment expiration applies to separately assigned time-bound active roles, not this eligible role activation.

User1 can request a shorter activation duration, but 24 hours is the maximum permitted by the configuration.

Microsoft References:

Microsoft Learn — Configure Microsoft Entra PIM role settings .

Microsoft Learn — Activate Microsoft Entra roles in PIM .

Microsoft Foundry agents consume Azure resources, including AI model inference, token processing, and potentially additional services such as Code Interpreter, file search, and storage.

The Contoso case study specifies the following technical requirement:

" The total costs of Agent1 must be monitored and evaluated monthly. "

Option A is correct because Azure Cost Management + Billing provides comprehensive cost monitoring, analysis, and reporting for Azure resources, including resources consumed by Microsoft Foundry agents.

Administrators can navigate to Azure portal → Cost Management + Billing → Cost Management → Cost analysis.

Cost analysis supports monthly reporting, historical comparisons, cost breakdowns, filtering by resources or resource groups, and budget monitoring.

Option B is incorrect because billed messages in the Power Platform admin center relate to Power Platform and Copilot Studio consumption rather than comprehensive Microsoft Foundry agent costs.

Option C is incorrect because Microsoft 365 billing policies manage supported consumption-based Microsoft 365 Copilot services, not the complete Azure infrastructure costs associated with Foundry agents.

Option D is not the best answer because the Microsoft Foundry portal ' s Monitor experience provides valuable agent-level operational metrics and estimated token costs, but it does not necessarily capture every billable Azure resource used by an agent.

Microsoft explicitly recommends Azure Cost Management for comprehensive spending analysis and financial reconciliation.

Therefore, Cost Management + Billing in the Azure portal is the most appropriate solution for monitoring and evaluating Agent1 ' s total monthly costs.

Microsoft References:

Microsoft Learn — Plan and manage costs for Microsoft Foundry .

Microsoft Learn

Microsoft Learn — Monitor Microsoft Foundry costs using Azure Cost Management

Answer Area

Correct Selection

Users

Admin1 only

Portal

The Microsoft 365 Apps admin center

Microsoft 365 provides the Allow web search in Copilot policy to control whether Microsoft 365 Copilot and Microsoft 365 Copilot Chat can retrieve information from public web sources.

First selection: Admin1 only.

According to Microsoft Learn, the Cloud Policy service supports administration by Global Administrators, Office Apps Administrators, and Security Administrators.

In the Contoso scenario:

Admin1: Global Administrator — authorized to manage Cloud Policy.

Admin2: AI Administrator — can manage Copilot settings, but this role is not listed among those authorized to manage Cloud Policy configurations.

Admin3: Privileged Role Administrator — does not have the required Cloud Policy management permissions.

User1: Eligible for AI Administrator, but eligibility does not grant active administrative permissions.

Therefore, Admin1 is the only administrator explicitly authorized for this configuration.

Second selection: The Microsoft 365 Apps admin center.

Administrators configure web search through Microsoft 365 Apps admin center → Customization → Policy Management.

Create a Cloud Policy configuration and select the following setting:

Allow web search in Copilot

Configure it as:

Disabled in Microsoft Copilot and Microsoft Copilot Chat.

This disables public web search for both experiences, satisfying Contoso ' s requirement to use only Microsoft 365 information sources for Copilot responses.

Microsoft confirms that the Microsoft 365 admin center provides a shortcut to this setting, but the Cloud Policy itself is configured in the Microsoft 365 Apps admin center.

Microsoft References:

Microsoft Learn — Cloud Policy service and supported administrator roles .

Microsoft Learn — Manage Copilot settings .

Microsoft Learn — Manage web search for Copilot and Copilot Chat .

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.