AB-650 Microsoft Administering Microsoft 365 and AI Services Free Practice Exam Questions (2026 Updated)

Microsoft 365 organization themes allow administrators to customize the appearance of the Microsoft 365 top navigation bar, including company logos, background colors, text colors, and accent colors.

Option D is correct because the requirements involve two different audiences: all users and Marketing group members.

First: Configure the default organization theme.

The default organization theme applies to all users in the Microsoft 365 tenant. Administrators can configure the company ' s logo through:

Microsoft 365 admin center → Settings → Org settings → Organization profile → Custom themes.

This establishes the company branding for users who are not assigned a specific group theme.

Second: Create a group theme assigned to Marketing.

Microsoft 365 supports additional group themes that can be assigned to Microsoft 365 groups.

Administrators can create a group theme, assign the Marketing group, and configure its custom navigation bar colors. The company logo should also be configured for this theme to ensure Marketing users receive the required branding.

Option A is incorrect because a group theme alone does not establish the company logo for all other users.

Option B is incorrect because Microsoft Entra company branding controls authentication experiences rather than Microsoft 365 navigation bar themes.

Option C is incorrect because SharePoint site themes do not provide the required Microsoft 365-wide group-specific navigation bar customization.

Therefore, two themes—one default organization theme and one Marketing group theme—meet all requirements with the minimum number of themes.

Microsoft Reference:

Microsoft Learn — Customize the theme for your organization .

Final Answer: D. Configure the default organization theme, and then create a group theme assigned to the Marketing group.

Microsoft 365 network connectivity insights help administrators evaluate how network configuration affects connectivity to Microsoft 365 services. Accurate office-location identification is essential for associating connectivity measurements with the appropriate branch.

Option C is correct because Microsoft 365 allows administrators to define office locations manually and associate each location with its corresponding local area network subnet ranges.

This configuration is particularly important when multiple branches exist in the same city. Because the branches have distinct IPv4 LAN subnets, Microsoft 365 can distinguish their connectivity measurements by using the configured subnet information.

Microsoft Learn explicitly supports the manual location configuration method when Windows Location Services is unavailable. Administrators can navigate to the Microsoft 365 admin center, access Network connectivity, and configure office locations with their respective LAN subnet information.

Option A is insufficient because simply running network tests does not establish the required persistent branch-specific subnet mapping.

Option B does not provide the local subnet information needed to distinguish branches reliably.

Option D conflicts with the stated requirement because Windows Location Services is disabled by policy. Furthermore, automatic geographic location discovery may not distinguish multiple offices in the same city.

Therefore, manually configuring both locations and their LAN subnet ranges meets the requirement.

Microsoft References:

https://learn.microsoft.com/en-us/Microsoft-365/Enterprise/office-365-network-mac-perf-overview?view=o365-worldwide

Answer Area

Correct Selection

Location 1

SharePoint sites

Location 2

OneDrive accounts

Microsoft Teams uses SharePoint Online and OneDrive for Business to store and share documents. Microsoft Purview DLP policies must therefore protect these underlying storage locations to prevent sensitive documents from being shared externally.

First selection: SharePoint sites.

Files shared through Microsoft Teams standard channels are stored in the associated SharePoint site. Private and shared channels also use SharePoint sites for document storage.

Applying a DLP policy to SharePoint sites allows Microsoft Purview to identify protected documents and restrict access for external users when policy conditions match.

Second selection: OneDrive accounts.

Files shared through individual or group chats in Microsoft Teams are stored in the sender ' s OneDrive for Business account.

Applying the same DLP policy to OneDrive accounts ensures that documents shared through Teams chats are also protected against unauthorized external access.

Why Teams chat and channel messages is incorrect:

The Teams chat and channel messages location protects sensitive information contained directly in messages, rather than the actual documents stored in SharePoint or OneDrive.

Microsoft explicitly states that protecting documents shared through Teams requires including both SharePoint and OneDrive in the DLP policy.

These locations must be combined with appropriate sensitive-content conditions and blocking actions to enforce the required protection.

Microsoft References:

Microsoft Learn — Data loss prevention and Microsoft Teams .

Microsoft Learn — Data Loss Prevention policy reference

Microsoft 365 Copilot requires supported Microsoft 365 applications to provide integrated AI functionality in desktop Word, Excel, PowerPoint, and other Office applications.

The sales department already has Microsoft 365 E3 and Microsoft 365 Copilot licenses. Consequently, the primary issue is not the licensing configuration but the installed Office application version.

Option B is correct because deploying Microsoft 365 Apps provides the continuously updated desktop applications that support Copilot integration. Administrators must ensure that users are signed in with appropriately licensed Microsoft Entra accounts and that the applications receive supported feature updates.

Option A is incorrect because Office LTSC Professional Plus 2024 is a perpetual-license product that does not receive the continuously delivered Copilot capabilities provided through Microsoft 365 Apps.

Option C is incorrect because Microsoft 365 E5 is not required when users already have qualifying Microsoft 365 E3 licenses and Copilot licenses.

Option D is incorrect because Microsoft Graph connectors integrate external information sources with Microsoft 365 search and Copilot grounding. They do not enable Copilot inside unsupported desktop applications.

Option E is incorrect because participation in the Frontier program is not required to activate standard licensed Copilot functionality.

Therefore, Microsoft 365 Apps must be deployed to the devices.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-copilot-requirements

https://support.microsoft.com/en-us/office/lifecycle/office-2024-and-office-ltsc-2024-faq

Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti-spam policies.

The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.

Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only. It cannot override the Standard preset security policy.

Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group ' s members. These users can then be evaluated by Policy1, provided its recipient conditions match.

Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.

Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.

Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.

Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.

Therefore, Group1 must be excluded from the Standard preset security policy.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies

https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access to privileged roles through eligible assignments and configurable role activation requirements.

Statement 1: Yes.

User1 has an eligible Global Administrator assignment. The PIM configuration specifies Require justification on activation: Yes. Therefore, User1 must submit a business justification when activating the role. The user must also satisfy the configured multifactor authentication requirement.

Statement 2: No.

User2 has an assigned (active) Global Administrator role rather than an eligible assignment. Active assignments provide permissions without requiring role activation. Consequently, the configured MFA-on-activation requirement does not apply to User2 in the manner described. Separate Conditional Access policies may still require MFA during sign-in.

Statement 3: No.

User3 has an eligible Global Administrator assignment. The activation maximum duration is eight hours, meaning each activation can remain active for no longer than eight hours.

However, this does not terminate the underlying eligibility. The eligible assignment is configured to expire after 15 days.

After an eight-hour activation expires, User3 can activate the role again, provided the eligible assignment remains valid and the activation requirements are satisfied.

The distinction between activation duration and eligibility duration is fundamental to Microsoft Entra PIM.

Microsoft References:

Microsoft Learn — Configure PIM role settings .

Microsoft Learn — Activate Microsoft Entra roles in PIM .

Microsoft Learn — Assign eligible and active roles .

Statement

Correct Answer

User2 can reference files in the Vendor Contracts folder by using Copilot Chat.

Yes

User1 has the access required for Microsoft 365 Copilot to ground responses in the Forecast files.

No

User1 has the access required for Microsoft 365 Copilot to ground responses in the Vendor Contracts files.

Yes

Microsoft 365 Copilot and Copilot Chat respect existing SharePoint permissions and Microsoft Purview sensitivity label encryption restrictions when accessing organizational content.

Statement 1: Yes.

User2 belongs to Group1 and has access to the Vendor Contracts folder through the Everyone except external users permission.

Although User2 does not have a paid Microsoft 365 Copilot license, Copilot Chat supports explicitly referencing accessible files, subject to supported experiences and file types. User2 can therefore reference supported Vendor Contracts files in a prompt.

However, Copilot Chat without a paid license does not automatically discover and ground responses across all organizational files through Microsoft Graph.

Statement 2: No.

User1 has a Microsoft 365 Copilot license and SharePoint access to Forecast. However, the Forecast documents are encrypted by a sensitivity label granting usage rights only to Group1.

Because User1 is outside Group1, the user lacks the necessary encryption permissions. Microsoft 365 Copilot cannot use those files for grounding.

Statement 3: Yes.

Vendor Contracts contains unlabeled files and grants access to Everyone except external users.

User1 is an internal user with a Microsoft 365 Copilot license and appropriate SharePoint access. No additional sensitivity-label encryption restricts the files.

Therefore, Copilot can use accessible Vendor Contracts files to ground responses.

Microsoft References:

Microsoft Support — Refer to specific files in Microsoft Copilot .

Microsoft Learn — Copilot data protection, permissions, and encryption .

Microsoft Learn — How Copilot Chat grounding works .

Setting to modify

Correct Configuration

Logical operator between PII Identifiers and Medical Terms

Change and to or

Medical Terms → Match accuracy → min

Increase from 50 to 85 (High confidence)

Microsoft Purview Data Loss Prevention uses sensitive information types (SITs), Boolean operators, and confidence levels to determine whether content matches a DLP rule.

First selection: Change AND to OR.

The exhibit currently combines PII Identifiers and Medical Terms using an AND operator. This requires content to contain both a U.S. Social Security Number and an ICD-9-CM medical term before the rule matches.

Consequently, medical content without a Social Security Number will not trigger the policy.

Changing the operator to OR allows the rule to detect ICD-9-CM information independently, increasing the likelihood of identifying medical content.

Second selection: Increase minimum match accuracy to 85.

Microsoft defines high-confidence ICD-9-CM matches using corroborating dictionary evidence within a 300-character proximity.

Increasing the minimum match accuracy from 50 to 85 ensures that the medical terms condition matches only the high-confidence pattern.

This reduces false positives caused by ambiguous medical terminology, although some genuine matches with insufficient supporting evidence might be missed.

Important consideration: Changing AND to OR also permits Social Security Number-only matches. If the production requirement is to detect exclusively medical content, removing the unrelated PII condition would be more precise.

The two requested configuration changes provide broader medical-content detection while increasing classification confidence.

Microsoft References:

Microsoft Learn — DLP rules, conditions, and logical operators .

Microsoft Learn — ICD-9-CM sensitive information type definition .

Microsoft Learn — Sensitive information type confidence levels

Microsoft Agent 365 provides security and compliance management capabilities through the Agent Registry in the Microsoft 365 admin center.

Option A is correct because the Security tab provides access to Microsoft Purview capabilities for monitoring agent activity and investigating sensitive information exposure.

Administrators can navigate to Microsoft 365 admin center → Agents → All agents → Agent Registry → Agent1 → Security.

According to Microsoft Learn, the Security tab provides three primary capabilities:

Monitor agent activity: Access Microsoft Purview Activity Explorer to examine agent activity, including events associated with sensitive information and sensitivity labels.

Protect sensitive data: Access Microsoft Purview AI observability to investigate sensitive agent interactions and potential oversharing.

Evaluate compliance gaps: Review available compliance assessments for the selected agent.

These capabilities support investigating whether Agent1 ' s interactions involve confidential organizational information.

Important distinction: The Security tab is an entry point to Microsoft Purview investigations; simply opening it does not automatically display or classify every prompt and response. Administrators must use the relevant monitoring experience, and the necessary licensing and permissions must be available.

Microsoft documents that viewing agent Security tab details requires an eligible Microsoft E7 or Agent 365 licence.

Therefore, the Security tab is the appropriate entry point for the requested investigation, although further review in Purview is necessary.

Microsoft SharePoint Restricted Access Control enables administrators to restrict access to a SharePoint site and its content to members of designated Microsoft Entra security groups or Microsoft 365 groups.

Option B is correct because Restricted Access Control adds an additional authorization requirement without replacing the site ' s existing SharePoint permissions.

When Group1 is configured as the restricted access control group for Site1, users must satisfy two conditions before accessing its documents: they must belong to Group1 and possess appropriate existing SharePoint permissions.

Users outside Group1 are denied access even when they previously received direct permissions or sharing links.

This protection also applies to Microsoft 365 Copilot and organization-wide search experiences. Microsoft Copilot respects the effective SharePoint authorization boundaries, preventing unauthorized users from accessing restricted content through Copilot responses.

Option A is incorrect because Microsoft 365 Archive is intended for inactive content storage rather than enforcing group-based authorization.

Option C is incorrect because Restricted SharePoint Search controls content discoverability, not the underlying ability to open files.

Option D is incorrect because Restricted Content Discovery limits search and Copilot discovery without enforcing the required group-based access restrictions.

Restricted Access Control therefore satisfies the complete requirement while preserving the existing permission structure.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-access-control

User2 can enable Copilot image generation for the subscription: Yes; User1 can use Microsoft 365 Copilot in the Exchange admin center: Yes; User3 can buy a Microsoft 365 Copilot license without admin approval: No

Microsoft 365 Copilot administrative controls determine who can manage AI functionality, access Copilot within administrative portals, and purchase licenses independently.

First statement: Yes. User2 holds the AI Administrator role, which provides permission to configure Microsoft Copilot settings, including image generation. An AI Administrator can navigate to the Microsoft 365 admin center, open Copilot settings, and modify the Copilot image generation configuration.

Second statement: Yes. User1 holds the Global Reader role. This is a recognized administrative role that provides read-only access to supported Microsoft 365 administrative portals, including Exchange admin center. Because Copilot in admin centers is configured as Allowed for all admins, User1 can access supported Copilot functionality within the permissions of the role. This does not grant permission to modify Exchange settings.

Third statement: No. The self-service purchasing configuration is Allow trials only. This permits eligible users to start supported trials but prevents them from purchasing Microsoft 365 Copilot licenses independently.

User3 has no administrative role and cannot bypass the purchasing restriction.

Therefore, the correct sequence is Yes, Yes, No.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-page

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

The Microsoft 365 Copilot Agent usage report provides centralized reporting on the adoption and activity of agents used through Microsoft 365 Copilot Chat and supported Microsoft 365 applications.

Option B is correct because the report supports usage analysis over the previous 7 or 30 days and provides agent-specific activity information.

Administrators can access the report through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft 365 Copilot, and Agents.

The report includes information about active agents, active users, agent responses, and usage trends. Its daily time-series reporting helps administrators examine usage patterns, while agent-level details support comparisons between Agent1 and Agent2.

Option A is incorrect because Microsoft Defender for Cloud Apps app governance primarily focuses on application permissions, OAuth applications, and associated security risks rather than Copilot agent activity reporting.

Option C is incorrect because billing and usage information primarily addresses consumption and associated charges rather than providing the complete agent adoption and activity reporting requested.

Option D is incorrect because Microsoft Purview Audit provides event-level audit records. Although relevant activities may be recorded, it is not the most direct reporting solution for comparing agent usage.

Therefore, the Microsoft 365 Copilot Agent usage report is the appropriate selection.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-agents-new

Microsoft Exchange Online supports converting an existing user mailbox to a shared mailbox while retaining its historical email content. This is appropriate when the original user no longer needs direct access but other employees must continue using the mailbox.

Option C is correct because converting Mailbox1 into a shared mailbox preserves the existing email messages and enables delegated access for other users.

The mailbox contains 42 GB of data, which is below the standard 50 GB unlicensed shared mailbox limit. Therefore, an additional mailbox license is not required solely because of its current size, provided no separately licensed features are necessary.

Option B is correct because Full Access permission allows Group1 members to open the mailbox and manage existing items. Send As permission enables them to send messages that appear to originate directly from Mailbox1.

Option E is incorrect because Send on Behalf permission displays the individual delegate ' s identity, whereas the requirement specifies that messages must appear to come from Mailbox1.

Option D is incorrect because Litigation Hold is designed for preservation and compliance purposes, not for providing collaborative mailbox access.

Option A is unnecessary for a standard shared mailbox of this size.

Therefore, converting the mailbox and granting Full Access and Send As permissions satisfies all three requirements.

Microsoft References:

https://learn.microsoft.com/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/create-shared-mailboxes

Legal: Files & other data assets; Research: Groups & sites

Microsoft Purview sensitivity labels support multiple scopes that determine which resources the labels can protect and which protection settings administrators can configure.

First selection: Files & other data assets.

The legal department requires document-level protection for Microsoft Word files stored in SharePoint and distributed to external counsel.

The Files & other data assets scope supports sensitivity labels that apply encryption and content markings directly to supported documents.

Because the protection is associated with the document itself, configured encryption and markings can remain with the file when it is downloaded or shared outside its original SharePoint location.

Second selection: Groups & sites.

The research department requires collaboration-level protection for a Microsoft Teams environment.

The Groups & sites scope supports sensitivity labels applied to Microsoft Teams, Microsoft 365 groups, and SharePoint sites. These labels can configure privacy settings, guest access restrictions, external sharing controls, and access restrictions for unmanaged devices.

The Emails scope is intended for email protection, while the Meetings scope controls supported meeting and chat protection capabilities.

Technical consideration: Groups & sites labels do not automatically encrypt every document stored within the associated container. Additionally, restrictions for unmanaged devices require the supporting Microsoft Entra Conditional Access configuration.

Therefore, Files & other data assets is appropriate for Legal, while Groups & sites is appropriate for Research.

Microsoft References:

https://learn.microsoft.com/en-us/purview/sensitivity-labels

https://learn.microsoft.com/en-us/purview/sensitivity-labels-teams-groups-sites

Microsoft Purview Data Loss Prevention (DLP) provides controls that prevent Microsoft 365 Copilot and supported agents from processing sensitive organizational information when generating responses.

Option C is correct because Microsoft Purview supports DLP policies that identify files by their sensitivity labels and prevent Copilot from using the protected content in generated responses.

Administrators can configure the solution through Microsoft Purview portal → Data loss prevention → Policies.

Create a policy using the Microsoft 365 Copilot and Copilot Chat location, with the following configuration:

Condition: Content contains → Sensitivity labels

Selection: The sensitivity label applied to the sensitive SharePoint files

Action: Prevent Copilot from processing content

The policy prevents supported Copilot experiences from processing the labeled documents while allowing unlabeled SharePoint content to remain available for grounding, subject to existing permissions.

Option A is incorrect because Microsoft Defender for Cloud Apps primarily provides cloud application discovery, monitoring, and session controls.

Option B is incorrect because an agent blueprint defines agent identity and configuration characteristics rather than providing sensitivity-label-based content restrictions.

Option D is incorrect because Restricted SharePoint Search limits searchable SharePoint locations rather than selectively excluding files based on sensitivity labels.

Therefore, Microsoft Purview DLP is the appropriate solution.

Microsoft References:

Microsoft Learn — Secure and govern Microsoft 365 Copilot agents .

Microsoft Learn — Manage access to agents in SharePoint .

Microsoft Learn — DLP for Copilot and Copilot Chat .

Final Answer: C. Microsoft Purview data loss prevention (DLP)

Microsoft Defender for Office 365 Plan 2 provides Attack simulation training capabilities, including dedicated Training campaigns that assign educational modules without requiring another simulated phishing attack.

Option A is correct because creating a Training campaign targeting Group1 allows administrators to reassign the required training directly to the current members of the group. Using Group1 avoids manually identifying recipients and minimizes administrative effort when group membership changes.

Administrators can configure training assignment notifications and reminder notifications during campaign creation. To deliver reminders as frequently as supported, they can select the twice-weekly reminder option.

Option B is correct because the Training threshold setting controls how soon users can receive a training module that was previously assigned.

The default threshold is 90 days. Because the earlier simulation assigned the module recently, this setting could prevent reassignment during the new campaign.

Setting Training threshold to 0 removes the restriction and permits the same module to be reassigned immediately.

Option C is incorrect because a 60-day threshold would still prevent reassignment to users whose previous assignment occurred within that period.

Option D is incorrect because a tenant payload creates customized phishing simulation content, not training assignments.

Option E is unnecessary because simulation automation creates automated phishing simulations rather than directly assigning training.

Therefore, A and B are correct.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-training-campaigns

https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-settings

Microsoft Purview auto-labeling policies automatically apply sensitivity labels to supported SharePoint and OneDrive documents when configured sensitive information conditions are satisfied.

AutoLabel1 requires the IP Address sensitive information type at High confidence, with a minimum instance count of two.

Statement 1: No.

File1.docx contains only one IP address. Although .docx is supported for automatic sensitivity labeling, the file does not meet the minimum requirement of two matching instances. Therefore, Sensitivity1 is not applied.

Statement 2: No.

File2.txt contains two IP addresses, satisfying the numerical threshold. However, SharePoint auto-labeling policies do not support .txt files. Microsoft documents supported file formats as modern Word, Excel, PowerPoint, and eligible PDF documents. Consequently, Sensitivity1 is not applied to File2.txt.

Statement 3: Yes.

File3.xlsx contains five IP addresses, exceeding the minimum instance count of two. The .xlsx format is supported by SharePoint auto-labeling policies. Assuming at least two IP addresses are detected at the configured High confidence level, the file satisfies the rule and receives Sensitivity1 once the policy processes it.

Thus, file format support and sensitive information matching must both be considered when evaluating auto-labeling behavior.

First target (Set-Mailbox): -GrantSendOnBehalfTo; Second target (Add-MailboxPermission): -AccessRights FullAccess

Exchange Online shared mailboxes support collaborative mailbox access through delegated permissions. The requirements involve two separate capabilities: modifying mailbox contents and sending messages while retaining sender identification.

First selection: -GrantSendOnBehalfTo.

This parameter grants Send on Behalf permissions. When a member of Group1 sends an email using Mailbox1, recipients can identify the individual sender because the message indicates that it was sent on behalf of the shared mailbox.

This differs from Send As permission, where the email appears to originate directly from the shared mailbox without identifying the delegate.

Second selection: -AccessRights FullAccess.

The Add-MailboxPermission cmdlet grants mailbox access permissions. Specifying FullAccess allows authorized group members to open Mailbox1 and create, read, modify, and delete mailbox items.

Full Access alone does not grant permission to send email from the mailbox. The separate Send on Behalf permission is therefore necessary.

The -AcceptMessagesOnlyFrom parameter restricts inbound senders, while -ForwardingAddress configures forwarding. Neither provides the requested delegated capabilities.

Together, Send on Behalf and Full Access meet the two functional requirements.

Microsoft References:

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/create-shared-mailboxes

Microsoft Entra ID supports the ForceDelete operation for removing custom domains that still have references to directory objects. This operation automatically updates supported references, reducing the need for manual administrative changes.

Option C is correct because the domain meets the main ForceDelete prerequisites: it uses managed authentication, is not the default domain, and has fewer than 1,000 references.

However, Microsoft explicitly requires administrators to update or remove domain references from Exchange-managed objects, including mail-enabled security groups and distribution lists, before executing ForceDelete.

After these references are removed, ForceDelete can automatically update eligible user principal names, email addresses, proxy addresses, group addresses, and application identifier URIs to the tenant ' s initial onmicrosoft.com domain.

Option A is incorrect because manually updating all 750 references creates unnecessary administrative effort.

Option B is incorrect because ForceDelete cannot automatically remove all Exchange-managed dependencies. The mail-enabled security group references must be corrected first.

Option D is incorrect because a default domain cannot be deleted while it remains designated as the default.

Therefore, clearing the Exchange-managed references and using ForceDelete is the most efficient supported approach.

Microsoft References:

Microsoft Learn — Manage custom domain names and ForceDelete .

Microsoft Graph — domain: forceDelete .