Microsoft AB-650 - Administering Microsoft 365 and AI Services

Report: Explorer (Threat Explorer); View on the Email entity page: Timeline

Microsoft Defender for Office 365 provides Threat Explorer for investigating malicious and suspicious email messages. The Email entity page supplies detailed information about individual messages, including their delivery and post-delivery events.

First selection: Explorer (Threat Explorer).

Threat Explorer enables security analysts to search for email messages using properties such as subject, sender, recipient, detection technology, and delivery status.

The analyst can open Threat Explorer in the Microsoft Defender portal, select the relevant email view, and filter messages by the subject provided in the phishing report. Matching messages can then be examined individually.

Second selection: Timeline.

After identifying the suspicious message, the administrator can open its Email entity page and select the Timeline view.

The Timeline view displays the chronological history of message delivery and subsequent actions. It includes original delivery events, changes caused by Zero-hour Auto Purge (ZAP), quarantine actions, and other recorded message events.

This information enables the administrator to determine where the message was originally delivered and what actions occurred afterward.

Threat Explorer is therefore the correct investigation tool for locating messages by subject, while the Timeline view provides the required delivery and post-delivery history.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about

https://learn.microsoft.com/en-us/defender-office-365/mdo-email-entity-page

An administrator can create usernames that contain the: contoso221018.onmicrosoft.com, east.contoso221018.onmicrosoft.com, and contoso.com domains; Exchange Online can receive inbound email messages sent to the: contoso221018.onmicrosoft.com domain only

Microsoft 365 supports multiple verified domains within a tenant. These domains can be used for Microsoft Entra user principal names, while Exchange Online email routing depends on additional service configuration and DNS records.

The exhibit shows three domains with different status indicators: the default contoso221018.onmicrosoft.com domain is Healthy, contoso.com has Incomplete setup, and east.contoso221018.onmicrosoft.com has No services selected.

First selection: All three domains.

The intended interpretation is that the domains have been added to the tenant and are available for identity naming. A custom domain can be used for a user ' s sign-in name once domain ownership has been verified, even if other Microsoft 365 service configuration is incomplete.

Second selection: The default onmicrosoft.com domain only.

The default tenant domain provides Exchange Online ' s fallback email-routing namespace. In the exhibit, the custom domain has incomplete service configuration, while the additional subdomain has no services selected.

However, there is an important technical limitation: these administrative status indicators alone do not conclusively establish the live external MX records or every Exchange Online accepted-domain setting. Those configurations must be inspected to verify actual inbound mail routing.

The selections above represent the intended examination interpretation, not independent proof of the tenant ' s current DNS configuration.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain

https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain

First target (Set-Mailbox): -GrantSendOnBehalfTo; Second target (Add-MailboxPermission): -AccessRights FullAccess

Exchange Online shared mailboxes support collaborative mailbox access through delegated permissions. The requirements involve two separate capabilities: modifying mailbox contents and sending messages while retaining sender identification.

First selection: -GrantSendOnBehalfTo.

This parameter grants Send on Behalf permissions. When a member of Group1 sends an email using Mailbox1, recipients can identify the individual sender because the message indicates that it was sent on behalf of the shared mailbox.

This differs from Send As permission, where the email appears to originate directly from the shared mailbox without identifying the delegate.

Second selection: -AccessRights FullAccess.

The Add-MailboxPermission cmdlet grants mailbox access permissions. Specifying FullAccess allows authorized group members to open Mailbox1 and create, read, modify, and delete mailbox items.

Full Access alone does not grant permission to send email from the mailbox. The separate Send on Behalf permission is therefore necessary.

The -AcceptMessagesOnlyFrom parameter restricts inbound senders, while -ForwardingAddress configures forwarding. Neither provides the requested delegated capabilities.

Together, Send on Behalf and Full Access meet the two functional requirements.

Microsoft References:

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/create-shared-mailboxes

Top navigation bar logo and website link: An organization theme in Microsoft 365; Default sign-in page background: Company branding in Microsoft Entra

Microsoft 365 provides different branding mechanisms for the application interface and the Microsoft Entra authentication experience. Each requirement must be configured through the appropriate administrative service.

First selection: An organization theme in Microsoft 365.

An organization theme controls the appearance of the Microsoft 365 top navigation bar. Administrators can configure the default organizational theme, upload a company logo, and specify the URL that opens when users select the logo.

These options are managed through the Microsoft 365 admin center under Organization profile and organization themes.

Second selection: Company branding in Microsoft Entra.

Microsoft Entra company branding controls the appearance of authentication pages. It supports customizing sign-in page background images, logos, headers, colors, and other visual elements.

Configuring the default company branding ensures the background image is available to users authenticating through the organization ' s branded sign-in experience.

An application-specific branding theme would not satisfy the requirement for a default experience across all users. Similarly, a Microsoft 365 group theme applies to selected Microsoft 365 groups rather than the organization ' s default interface.

Therefore, organization themes and Microsoft Entra company branding are the two appropriate selections.

Microsoft References:

https://learn.microsoft.com/en-GB/microsoft-365/admin/setup/customize-your-organization-theme

https://learn.microsoft.com/en-us/entra/fundamentals/how-to-customize-branding

Microsoft 365 Copilot relies on secure WebSocket (WSS) connections to support real-time, bidirectional communication between client applications and Microsoft cloud services.

Option A is correct because the reported Network connectivity insight specifically identifies WebSocket connection failures for hosts within *.cloud.microsoft.

Microsoft documentation explains that this insight occurs when a network device or web proxy prevents successful WebSocket connections. Administrators should configure the affected proxy to permit WebSocket protocol connections, including the HTTP-to-WebSocket upgrade process, for the required Microsoft 365 endpoints.

Because the problem affects only Branch1, the configuration should be applied to the Branch1 web proxy policy. This resolves the connectivity issue without changing policies for other offices.

Option B is incorrect because the reported failure concerns WebSocket connectivity, not DNS resolution or regional endpoint selection.

Option C is incorrect as the best answer because TLS inspection can interfere with WebSocket connections, but the scenario does not establish that TLS inspection is the cause. Exempting endpoints from TLS inspection may be appropriate after further diagnosis, but allowing the required WebSocket protocol directly addresses Microsoft ' s reported insight.

Option D is incorrect because standard HTTPS connectivity already succeeds. Allowing HTTPS alone does not guarantee successful WebSocket protocol upgrades.

Therefore, the Branch1 proxy must allow WSS connections to the required Microsoft 365 hosts.

Microsoft References:

Microsoft 365 Network Insights .

Review Microsoft 365 network connection failures and WebSocket errors .

Group1: The Microsoft 365 Copilot usage report; Group2: The Microsoft 365 Copilot Chat usage report

Microsoft 365 provides separate reporting capabilities for licensed Copilot functionality and the broadly available Copilot Chat experience.

First selection: Microsoft 365 Copilot usage report.

Group1 contains users assigned Microsoft 365 Copilot licenses who interact with Copilot across Microsoft 365 applications and agents.

The Microsoft 365 Copilot usage report provides adoption and engagement information about these licensed experiences.

It includes enabled users, active users, usage by application, user activity information, and supported prompt-count metrics.

Administrators can use this report to evaluate whether licensed employees are actively using Copilot capabilities.

Second selection: Microsoft 365 Copilot Chat usage report.

Group2 users do not have Microsoft 365 Copilot licenses but use the Copilot Chat experience available through Microsoft 365.

The Copilot Chat usage report tracks conversational AI adoption, including active users, total prompts submitted, average prompts per user, and individual activity trends.

This makes it the appropriate report for measuring engagement among users who rely on Copilot Chat without the paid Copilot license.

The Microsoft 365 apps usage report measures general application usage, while the Copilot readiness report focuses on eligibility and deployment preparation.

Therefore, the licensed group requires the Copilot usage report, while the unlicensed group requires the Copilot Chat usage report.

Reporting clarification: Microsoft ' s current report documentation describes standard 7-, 28-, 90-, and 180-day periods. The video specifies 30 days, but the latest reporting interface may use a 28-day period instead.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-copilot-usage

The Microsoft 365 Copilot usage report provides adoption and engagement metrics across individual Microsoft 365 workloads, including Microsoft Word, Excel, PowerPoint, Outlook, and Teams.

Option C is correct because the Trend view within the Adoption by app section displays historical Copilot usage for individual applications.

Administrators can navigate to Microsoft 365 admin center → Reports → Usage → Microsoft Copilot → Copilot → Usage.

In the Adoption by app section, administrators can switch to Trend view and select Microsoft Word.

This displays daily activity trends for Copilot in Word, allowing administrators to identify decreases in usage even when the overall Copilot active-user rate remains stable.

Option A is incorrect because the Prompts submitted metric primarily measures Copilot Chat prompt activity rather than adoption trends for Microsoft Word.

Option B is incorrect because the Copilot readiness report evaluates deployment readiness and application usage prerequisites, not detailed Copilot adoption trends.

Option D is incorrect because Microsoft Purview audit logs provide activity-level records. Investigating those records would require additional administrative effort and analysis.

Reporting consideration: Microsoft currently documents standard reporting periods of 7, 28, 90, and 180 days. For the question ' s 30-day requirement, the 28-day view is the closest standard selection.

Therefore, Trend view with Adoption by app provides the required evidence with minimal administrative effort.

Microsoft References:

Microsoft Learn — Microsoft 365 Copilot usage report .

Microsoft Learn — Microsoft Copilot reports for IT administrators

You can add a Microsoft Entra cloud user to: Group1, Group2, and Group3; You can add Group5 to: Group1 and 3 only

Microsoft Entra group membership is governed by group type, membership assignment method, and source of authority.

First selection: Group1, Group2, and Group3.

The exhibit identifies Group1 and Group2 as cloud-managed Microsoft 365 groups using assigned membership. Microsoft 365 groups support user membership regardless of whether the group ' s Security enabled property is set to Yes or No.

Group3 is a cloud-managed security group with assigned membership, so administrators can also add a Microsoft Entra user directly.

Group4 uses dynamic membership, meaning users are included automatically according to configured rules rather than manually assigned.

Group5 originates from Windows Server Active Directory. Its membership is managed by the authoritative on-premises directory.

Second selection: Group1 and Group3 only.

Microsoft Entra supports nesting security groups within other compatible security groups. Consequently, Group5 can be added as a member of Group3.

Microsoft 365 groups do not support groups as members, and dynamic group membership cannot be manually modified.

The first answer above reflects Microsoft ' s documented group membership behavior rather than simply reproducing the recording ' s selected response.

Microsoft References:

https://learn.microsoft.com/en-us/graph/api/group-post-members

User2 can enable Copilot image generation for the subscription: Yes; User1 can use Microsoft 365 Copilot in the Exchange admin center: Yes; User3 can buy a Microsoft 365 Copilot license without admin approval: No

Microsoft 365 Copilot administrative controls determine who can manage AI functionality, access Copilot within administrative portals, and purchase licenses independently.

First statement: Yes. User2 holds the AI Administrator role, which provides permission to configure Microsoft Copilot settings, including image generation. An AI Administrator can navigate to the Microsoft 365 admin center, open Copilot settings, and modify the Copilot image generation configuration.

Second statement: Yes. User1 holds the Global Reader role. This is a recognized administrative role that provides read-only access to supported Microsoft 365 administrative portals, including Exchange admin center. Because Copilot in admin centers is configured as Allowed for all admins, User1 can access supported Copilot functionality within the permissions of the role. This does not grant permission to modify Exchange settings.

Third statement: No. The self-service purchasing configuration is Allow trials only. This permits eligible users to start supported trials but prevents them from purchasing Microsoft 365 Copilot licenses independently.

User3 has no administrative role and cannot bypass the purchasing restriction.

Therefore, the correct sequence is Yes, Yes, No.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-page

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

Answer Area

Correct Selection

Location 1

SharePoint sites

Location 2

OneDrive accounts

Microsoft Teams uses SharePoint Online and OneDrive for Business to store and share documents. Microsoft Purview DLP policies must therefore protect these underlying storage locations to prevent sensitive documents from being shared externally.

First selection: SharePoint sites.

Files shared through Microsoft Teams standard channels are stored in the associated SharePoint site. Private and shared channels also use SharePoint sites for document storage.

Applying a DLP policy to SharePoint sites allows Microsoft Purview to identify protected documents and restrict access for external users when policy conditions match.

Second selection: OneDrive accounts.

Files shared through individual or group chats in Microsoft Teams are stored in the sender ' s OneDrive for Business account.

Applying the same DLP policy to OneDrive accounts ensures that documents shared through Teams chats are also protected against unauthorized external access.

Why Teams chat and channel messages is incorrect:

The Teams chat and channel messages location protects sensitive information contained directly in messages, rather than the actual documents stored in SharePoint or OneDrive.

Microsoft explicitly states that protecting documents shared through Teams requires including both SharePoint and OneDrive in the DLP policy.

These locations must be combined with appropriate sensitive-content conditions and blocking actions to enforce the required protection.

Microsoft References:

Microsoft Learn — Data loss prevention and Microsoft Teams .

Microsoft Learn — Data Loss Prevention policy reference