Microsoft AB-650 - Administering Microsoft 365 and AI Services

The Contoso case study specifies the following planned change:

Add an additional email address alias for the users in Group4.

Group4 is a Microsoft 365 group containing User1 and User2. Both users have Microsoft Exchange mailboxes.

Option C is correct because the Exchange Online PowerShell Set-Mailbox cmdlet supports modifying mailbox properties, including additional SMTP email addresses.

Administrators can use the -EmailAddresses parameter with the @{Add=...} syntax to add a secondary email address without removing existing addresses or modifying the primary SMTP address.

For example:

Set-Mailbox -Identity " user1@contoso.com " `

-EmailAddresses @{Add= " user1.alias@contoso.com " }

The same operation can be performed for the other Group4 members.

Option A is incorrect because Set-MailUser manages mail-enabled users who have external mailboxes, rather than Exchange Online user mailboxes.

Option B is incorrect because Update-MgUser manages Microsoft Entra user properties and is not the appropriate cmdlet for modifying Exchange Online mailbox proxy addresses.

Option D is incorrect because Set-ADUser manages on-premises Active Directory user objects. Contoso ' s users are cloud-only, and their Exchange Online mailboxes are managed in Microsoft 365.

Therefore, Set-Mailbox is the appropriate cmdlet for implementing the planned change.

Microsoft References:

Microsoft Learn — Add or remove email addresses for a mailbox in Exchange Online .

Microsoft Learn — Set-Mailbox PowerShell reference .

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .

Microsoft Purview Data Security Posture Management (DSPM) provides centralized visibility into sensitive information and its use across Microsoft 365 workloads, including interactions with Microsoft 365 Copilot.

DSPM includes reporting and investigation capabilities that help administrators understand how users interact with organizational information through AI applications.

The AI activity exploration capabilities provide information about Copilot interactions, including associated users, referenced files, sensitivity labels, and potentially sensitive information.

Because the financial files are classified with the Confidential sensitivity label, administrators can investigate activity involving labeled content and determine which users referenced sensitive organizational files during Copilot interactions.

DSPM minimizes administrative effort by providing predefined dashboards, reports, and integrated investigation workflows instead of requiring administrators to construct individual audit searches.

Option A is incorrect because Microsoft Entra audit logs primarily record identity and directory administrative activities, rather than providing detailed Copilot file-reference investigations.

Option C is incorrect because Content explorer identifies and examines classified organizational content. It is not the primary solution for correlating Copilot interactions with users and referenced files.

Option D is incorrect because Data Lifecycle Management manages retention and deletion requirements rather than providing dedicated AI interaction monitoring.

Therefore, Data Security Posture Management is the appropriate solution.

Microsoft References:

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

https://learn.microsoft.com/en-us/purview/ai-m365-copilot

Microsoft Entra ID supports the ForceDelete operation for removing custom domains that still have references to directory objects. This operation automatically updates supported references, reducing the need for manual administrative changes.

Option C is correct because the domain meets the main ForceDelete prerequisites: it uses managed authentication, is not the default domain, and has fewer than 1,000 references.

However, Microsoft explicitly requires administrators to update or remove domain references from Exchange-managed objects, including mail-enabled security groups and distribution lists, before executing ForceDelete.

After these references are removed, ForceDelete can automatically update eligible user principal names, email addresses, proxy addresses, group addresses, and application identifier URIs to the tenant ' s initial onmicrosoft.com domain.

Option A is incorrect because manually updating all 750 references creates unnecessary administrative effort.

Option B is incorrect because ForceDelete cannot automatically remove all Exchange-managed dependencies. The mail-enabled security group references must be corrected first.

Option D is incorrect because a default domain cannot be deleted while it remains designated as the default.

Therefore, clearing the Exchange-managed references and using ForceDelete is the most efficient supported approach.

Microsoft References:

Microsoft Learn — Manage custom domain names and ForceDelete .

Microsoft Graph — domain: forceDelete .

Microsoft Defender for Office 365 supports outbound spam policies that control sending limits and automatically restrict accounts exhibiting suspicious outbound email activity.

Option A is correct because a custom outbound anti-spam policy can target Group1 specifically, allowing administrators to enforce more restrictive sending limits for marketing department mailboxes without changing the organization-wide configuration.

Administrators can navigate to Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam, and create a custom outbound policy.

The policy should include Group1, configure the appropriate external recipient limit, and select Restrict the user from sending mail as the action when a limit is reached.

Option B is incorrect because modifying the default outbound policy would affect other users not covered by a higher-priority custom outbound policy.

Option C is incorrect because Strict preset security policies do not contain configurable outbound spam policies.

Option D is incorrect because Standard preset protection cannot provide a custom outbound sending limit.

Option E is incorrect because inbound anti-spam policies protect incoming email rather than restricting compromised users ' outgoing messages.

Crucially, Microsoft ' s documentation confirms that Strict and Standard preset security policies do not override outbound spam policies. Therefore, the custom outbound policy can apply to Group1 without excluding its members from Strict protection.

Microsoft References:

Microsoft Learn — Configure outbound spam policies .

Microsoft Learn — Preset security policies .

Use: The Microsoft 365 Apps admin center; To configure: Policy Management

Microsoft 365 administrators can control whether Microsoft Copilot uses public web information to generate responses through Microsoft 365 Cloud Policy.

First selection: The Microsoft 365 Apps admin center.

The Microsoft 365 Apps admin center provides access to Cloud Policy, which centrally manages settings for Microsoft 365 applications and supported Copilot experiences.

Administrators can access these settings through config.office.com.

Second selection: Policy Management.

Within the Microsoft 365 Apps admin center, administrators navigate to Customization and Policy Management. They can create or update a policy configuration containing the Allow web search in Copilot setting.

Microsoft documents a configuration that disables web search in Copilot Work mode while preserving web functionality in Copilot Web mode and Copilot Chat.

This distinguishes work-grounded AI interactions from the general web-based experience.

If administrators disable web search entirely, the restriction applies more broadly and does not satisfy the requirement to target only the work-grounded experience.

The Microsoft Purview portal governs information protection, compliance, and data security. It is not the primary interface for this Cloud Policy setting.

Therefore, the Microsoft 365 Apps admin center and Policy Management are the correct selections.

Technical note: Microsoft distinguishes Work mode from Copilot Chat in its current documentation. The relevant setting is Disabled in Microsoft Copilot Work mode; Enabled in Microsoft Copilot Web mode and Microsoft Copilot Chat. This is the documented configuration corresponding most closely to the question ' s intended work-only restriction.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/manage-public-web-access

Microsoft Purview auto-labeling policies automatically apply sensitivity labels to supported SharePoint and OneDrive documents when configured sensitive information conditions are satisfied.

AutoLabel1 requires the IP Address sensitive information type at High confidence, with a minimum instance count of two.

Statement 1: No.

File1.docx contains only one IP address. Although .docx is supported for automatic sensitivity labeling, the file does not meet the minimum requirement of two matching instances. Therefore, Sensitivity1 is not applied.

Statement 2: No.

File2.txt contains two IP addresses, satisfying the numerical threshold. However, SharePoint auto-labeling policies do not support .txt files. Microsoft documents supported file formats as modern Word, Excel, PowerPoint, and eligible PDF documents. Consequently, Sensitivity1 is not applied to File2.txt.

Statement 3: Yes.

File3.xlsx contains five IP addresses, exceeding the minimum instance count of two. The .xlsx format is supported by SharePoint auto-labeling policies. Assuming at least two IP addresses are detected at the configured High confidence level, the file satisfies the rule and receives Sensitivity1 once the policy processes it.

Thus, file format support and sensitive information matching must both be considered when evaluating auto-labeling behavior.

Microsoft Purview Data Loss Prevention (DLP) policies support different actions depending on the Microsoft 365 workload to which a policy is applied. Administrators must select a supported location before configuring a particular DLP action.

Option B is correct because the Set headers action is supported specifically for Exchange Online email.

This action allows administrators to add or modify an email message header when the message matches the conditions of a DLP rule. For example, an organization can configure a rule that detects sensitive financial information and adds a custom header indicating that the email requires additional handling.

Microsoft documents Set headers as a non-halting action, meaning it does not automatically stop subsequent DLP rule processing.

Option A is incorrect because OneDrive policies govern files and sharing activities rather than Exchange transport message headers.

Option C is incorrect because SharePoint DLP policies primarily protect stored documents and control access to sensitive content.

Option D is incorrect because Teams chat and channel messages do not expose the Exchange-specific Set headers action.

Therefore, the DLP policy must include the Exchange email location to support Set headers.

Microsoft Reference: Microsoft Learn — Data Loss Prevention policy reference .

Answer Area

Correct Selection

Site1

Restricted Content Discovery

Site2

Restricted Access Control

Microsoft SharePoint provides Restricted Content Discovery (RCD) and Restricted Access Control (RAC) to manage content discoverability and user authorization. Although both strengthen information governance, they serve different purposes.

First selection: Restricted Content Discovery.

Site1 requires administrators to prevent Microsoft 365 Copilot from discovering SharePoint content without modifying existing user permissions.

Restricted Content Discovery limits a site ' s visibility in organization-wide search and Microsoft 365 Copilot experiences. Users who already possess SharePoint permissions can continue accessing content directly.

Administrators can enable it through SharePoint admin center → Sites → Active sites → Site1 → Settings → Restrict content from Microsoft Copilot.

Second selection: Restricted Access Control.

Site2 requires an additional authorization boundary so that users must both belong to Group1 and possess existing SharePoint permissions.

Restricted Access Control enforces these two requirements simultaneously. Users outside Group1 are denied access even if they have direct permissions or sharing links.

Administrators can configure RAC through SharePoint admin center → Sites → Active sites → Site2 → Settings → Restricted site access, selecting Group1 as the permitted security group.

Microsoft 365 Archive manages inactive content, while organization-level sharing settings do not provide the site-specific authorization required.

Important distinction: RCD is not a security boundary and retains some discovery exceptions for previously accessed or owned content. RAC enforces access restrictions.

Microsoft References:

Microsoft Learn — Restricted Content Discovery .

Microsoft Learn — Restricted Access Control

Microsoft Purview Information Protection provides data classification, sensitivity labeling, and protection capabilities for organizational information. However, Information Protection alone does not provide the dedicated investigation workflow required to identify individual AI agent interactions containing confidential information in prompts or responses.

The more appropriate solution is Microsoft Purview Data Security Posture Management (DSPM), using its AI observability and Activity explorer capabilities.

Microsoft DSPM supports visibility into AI agent activities, including Microsoft Agent 365. It can identify interactions involving sensitive information through integrated data classification, audit telemetry, sensitive information types, and trainable classifiers.

Administrators can navigate to the Microsoft Purview portal, open DSPM, and use Discover → Activity explorer → AI activities to investigate AI interactions. The AI observability page also provides agent-specific visibility into potentially sensitive interactions and associated risks.

Microsoft Purview Information Protection contributes classification and labeling capabilities to this process, but simply using Information Protection does not independently deliver the required agent-interaction investigation.

Therefore, the proposed solution does not fully satisfy the requirement, making Option B (No) the appropriate answer.

Microsoft References:

https://learn.microsoft.com/en-us/purview/ai-agent-365

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about