Microsoft AB-650 - Administering Microsoft 365 and AI Services

Microsoft Agent 365 provides security and compliance management capabilities through the Agent Registry in the Microsoft 365 admin center.

Option A is correct because the Security tab provides access to Microsoft Purview capabilities for monitoring agent activity and investigating sensitive information exposure.

Administrators can navigate to Microsoft 365 admin center → Agents → All agents → Agent Registry → Agent1 → Security.

According to Microsoft Learn, the Security tab provides three primary capabilities:

Monitor agent activity: Access Microsoft Purview Activity Explorer to examine agent activity, including events associated with sensitive information and sensitivity labels.

Protect sensitive data: Access Microsoft Purview AI observability to investigate sensitive agent interactions and potential oversharing.

Evaluate compliance gaps: Review available compliance assessments for the selected agent.

These capabilities support investigating whether Agent1 ' s interactions involve confidential organizational information.

Important distinction: The Security tab is an entry point to Microsoft Purview investigations; simply opening it does not automatically display or classify every prompt and response. Administrators must use the relevant monitoring experience, and the necessary licensing and permissions must be available.

Microsoft documents that viewing agent Security tab details requires an eligible Microsoft E7 or Agent 365 licence.

Therefore, the Security tab is the appropriate entry point for the requested investigation, although further review in Purview is necessary.

Microsoft Purview Data Loss Prevention (DLP) policies support different actions depending on the Microsoft 365 workload to which a policy is applied. Administrators must select a supported location before configuring a particular DLP action.

Option B is correct because the Set headers action is supported specifically for Exchange Online email.

This action allows administrators to add or modify an email message header when the message matches the conditions of a DLP rule. For example, an organization can configure a rule that detects sensitive financial information and adds a custom header indicating that the email requires additional handling.

Microsoft documents Set headers as a non-halting action, meaning it does not automatically stop subsequent DLP rule processing.

Option A is incorrect because OneDrive policies govern files and sharing activities rather than Exchange transport message headers.

Option C is incorrect because SharePoint DLP policies primarily protect stored documents and control access to sensitive content.

Option D is incorrect because Teams chat and channel messages do not expose the Exchange-specific Set headers action.

Therefore, the DLP policy must include the Exchange email location to support Set headers.

Microsoft Reference: Microsoft Learn — Data Loss Prevention policy reference .

Administrative unit members: The Branch1 users and Group1; Role to assign to Helpdesk1: User Administrator

Microsoft Entra administrative units enable organizations to delegate administrative permissions to specific subsets of directory objects, avoiding tenant-wide administrative assignments.

First selection: The Branch1 users and Group1.

The administrative unit must contain both the individual Branch1 user objects and the Group1 security group.

Including Branch1 users enables delegated administrators to manage those users within the administrative unit ' s scope. Including Group1 enables administrators to manage the group ' s properties and membership.

Microsoft specifically distinguishes between adding a security group and adding its members to an administrative unit. Adding Group1 does not automatically add its users. Therefore, selecting Group1 alone would not satisfy the password-reset requirement.

Second selection: User Administrator.

The User Administrator role provides permissions to manage supported user properties, reset passwords for eligible nonprivileged users, and manage group memberships.

When assigned at the administrative-unit scope, the role restricts its administrative operations to the applicable objects within that unit.

The Helpdesk Administrator role supports password-related helpdesk tasks but does not grant the broader group membership management capability required.

The Groups Administrator role focuses on group management without the necessary user password-reset capability.

Privileged Role Administrator provides excessive permissions for the scenario.

Therefore, the administrative unit must contain the Branch1 users and Group1, with Helpdesk1 assigned the scoped User Administrator role.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-members-add

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access to privileged administrator roles. It allows organizations to control when administrative privileges become active and enforce approval and authentication requirements.

First selection: Eligible assignment.

An eligible assignment requires engineers to explicitly activate the User Administrator role before receiving its administrative permissions.

Unlike an active assignment, which grants privileges immediately, an eligible assignment enables temporary privilege elevation only when required.

Permanent active and time-bound active assignments do not satisfy the mandatory activation requirement because their privileges are available throughout the assignment ' s active period.

Second selection: Require approval and multifactor authentication (MFA).

PIM role settings support requiring both MFA and designated approver authorization during role activation.

Administrators can configure these settings in Microsoft Entra admin center → ID Governance → Privileged Identity Management → Microsoft Entra roles → Roles → User Administrator → Role settings.

Enable the MFA requirement, select Require approval to activate, and designate the appropriate approver.

When an engineer requests activation, PIM evaluates the authentication requirements and routes the request for approval. The role becomes active only after the applicable requirements are satisfied and approval is granted.

Technical consideration: PIM can recognize MFA already completed during the current authentication session. Consequently, a fresh MFA prompt is not guaranteed for every activation.

cCompleted PowerShell Script (Corrected for Execution):

Connect-MgGraph -Scopes " GroupMember.ReadWrite.All "

$members = Import-Csv -Path " C:\Temp\members.csv "

foreach ($member in $members) {

New-MgGroupMemberByRef -GroupId $groupId `

-OdataId " https://graph.microsoft.com/v1.0/directoryObjects/$($member.memberObjectId) "

}

Disconnect-MgGraph

Microsoft Graph PowerShell provides cmdlets for managing Microsoft Entra security group memberships, including bulk membership updates from CSV files.

First selection: Connect-MgGraph. This command establishes an authenticated Microsoft Graph session. The GroupMember.ReadWrite.All delegated permission authorizes modification of supported group memberships, subject to the signed-in user ' s administrative privileges.

Second selection: New-MgGroupMemberByRef. This cmdlet adds an existing Microsoft Entra directory object to a security group by creating a membership reference.

The -GroupId parameter identifies Group1, while -OdataId supplies the Microsoft Graph URL of the user object being added.

Import-Csv reads the user identifiers from C:\Temp\members.csv. The foreach loop processes each CSV record and adds the corresponding user to Group1.

Get-MgGroupMember and Get-MgGroupMemberByRef retrieve existing memberships rather than creating them. Update-MgGroup modifies group properties but is not the appropriate membership-reference operation.

Important correction: The original exhibit uses $member.ObjectId, but the CSV column is named memberObjectId. The script must reference $member.memberObjectId; otherwise, the object identifier will not be retrieved correctly.

Therefore, the correct dropdown answers are Connect-MgGraph and New-MgGroupMemberByRef.

Microsoft References:

Microsoft Learn — New-MgGroupMemberByRef .

Microsoft Graph — Add members to groups .

Microsoft Graph PowerShell authentication commands .

The Microsoft 365 admin center provides dedicated features for reporting service disruptions and requesting technical assistance. The correct selection depends on whether the administrator is reporting an operational service issue or seeking guidance from Microsoft Support.

First selection: Service health.

The Service health dashboard enables administrators to monitor incidents, service degradation, outages, and advisories affecting Microsoft 365 workloads, including Exchange Online, Microsoft Teams, and SharePoint Online.

Administrators can navigate to Health → Service health. If they experience a problem that Microsoft has not reported, they can select Report an issue and submit information about the affected service. Microsoft evaluates these reports and may publish an incident or advisory when a service-side problem is confirmed.

Second selection: New service request.

The New service request feature allows administrators to request assistance from Microsoft Support, including guidance about creating and configuring Microsoft Entra user accounts.

Administrators can navigate to Support → New service request, describe their question, review suggested troubleshooting information, and contact Microsoft Support when additional assistance is required.

Message center publishes service announcements and planned changes, while Product feedback collects suggestions and feedback about Microsoft products. Neither is the most appropriate option for the stated requirements.

Therefore, Service health and New service request are the correct selections.

Microsoft References:

Microsoft Learn — How to check Microsoft 365 service health .

Microsoft Learn — Get support for Microsoft 365 for business .

Answer Area

Correct Selection

Add

An Azure subscription

Create

A resource group

Microsoft 365 Backup is a consumption-based backup and recovery service designed to protect Microsoft 365 data, including Exchange Online mailboxes, SharePoint sites, and OneDrive accounts.

Unlike traditional subscription-based services, Microsoft 365 Backup uses pay-as-you-go billing through Microsoft Azure.

First selection: An Azure subscription.

Microsoft 365 Backup requires a valid Azure subscription to enable consumption-based billing. Administrators must associate the backup service with an Azure subscription through the Microsoft 365 admin center.

A Microsoft 365 E3 subscription is sufficient for using Microsoft 365 Backup. Upgrading users to Microsoft 365 E5 is not required.

Second selection: A resource group.

A resource group provides a logical container for Azure resources and is required when configuring the Azure billing connection for Microsoft 365 Backup.

Administrators must create or select an existing resource group in the Azure subscription and configure the appropriate billing region.

Once these prerequisites are satisfied, administrators can enable Microsoft 365 Backup and create backup policies for Exchange Online, SharePoint Online, and OneDrive.

A Microsoft Purview retention policy is not a prerequisite because retention policies serve compliance and data lifecycle management purposes rather than backup configuration.

Similarly, creating a security group or application registration is not required for the standard Microsoft 365 Backup setup.

Therefore, adding an Azure subscription and creating a resource group are the correct selections.

Microsoft References:

Microsoft Learn — Set up Microsoft 365 Backup .

Microsoft Learn — Create and manage Microsoft 365 Backup policies

Microsoft 365 admin center provides centralized Agent settings to control both the categories of agents permitted within an organization and the users authorized to access them.

Option B, User access, is correct. This setting determines which users and groups can interact with organizational agents. Administrators should select the option for specific users or groups and assign Group1. This ensures that members of Group1 can use permitted agents while users outside the group are excluded from the pilot.

Option E, Allowed agent types, is correct. This setting controls which publisher categories are permitted. Administrators should allow agents developed by Microsoft and the organization while disabling agents from external publishers.

This configuration enables Group1 members to use Agent1 and approved Microsoft agents without allowing third-party agents.

Option A is incorrect because policy templates apply predefined governance and security configurations rather than defining the combination of user access and agent publisher categories.

Option C controls agent-sharing behavior rather than the overall ability to interact with agents.

Option D provides rules for agent management and lifecycle activities but does not replace the specific access and publisher controls required.

Microsoft ' s current documentation refers to Allowed agent types as Agent and plugin access. The underlying publisher restrictions remain consistent with the question.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-settings

Ensure that User1 can invite the contoso.com users to Teams: Assign the Guest Inviter role to User1.; Ensure that only the contoso.com users can be invited as guests to the Microsoft Entra tenant: From the External collaboration settings, edit the Collaboration restrictions settings.

Microsoft Entra External ID provides separate administrative controls for guest invitation permissions and permitted external collaboration domains.

First selection: Assign the Guest Inviter role to User1.

The tenant currently permits guest invitations only from users assigned specific administrative roles. Assigning the Guest Inviter role allows User1 to invite external collaborators without granting broader privileges such as Global Administrator or User Administrator.

This satisfies the principle of least privilege because User1 receives the permission necessary to perform guest invitations without unnecessary administrative authority.

Second selection: Edit the Collaboration restrictions settings.

Microsoft Entra External collaboration settings provide domain-based controls for external invitations. To restrict guest invitations to contoso.com, administrators must configure Collaboration restrictions to allow invitations only to specified domains and add contoso.com to the permitted domain list.

This prevents invitations to users from other external domains while allowing authorized inviters, including User1, to invite users from contoso.com.

Cross-tenant outbound access settings do not provide the required tenant-wide invitation domain allowlist. Guest user access restrictions control what existing guests can see in the directory rather than which domains can be invited.

Both configurations are necessary to satisfy the stated requirements.

Microsoft References:

https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure

https://learn.microsoft.com/en-us/entra/external-id/allow-deny-list

Microsoft Defender for Office 365 supports outbound spam policies that control sending limits and automatically restrict accounts exhibiting suspicious outbound email activity.

Option A is correct because a custom outbound anti-spam policy can target Group1 specifically, allowing administrators to enforce more restrictive sending limits for marketing department mailboxes without changing the organization-wide configuration.

Administrators can navigate to Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam, and create a custom outbound policy.

The policy should include Group1, configure the appropriate external recipient limit, and select Restrict the user from sending mail as the action when a limit is reached.

Option B is incorrect because modifying the default outbound policy would affect other users not covered by a higher-priority custom outbound policy.

Option C is incorrect because Strict preset security policies do not contain configurable outbound spam policies.

Option D is incorrect because Standard preset protection cannot provide a custom outbound sending limit.

Option E is incorrect because inbound anti-spam policies protect incoming email rather than restricting compromised users ' outgoing messages.

Crucially, Microsoft ' s documentation confirms that Strict and Standard preset security policies do not override outbound spam policies. Therefore, the custom outbound policy can apply to Group1 without excluding its members from Strict protection.

Microsoft References:

Microsoft Learn — Configure outbound spam policies .

Microsoft Learn — Preset security policies .