Microsoft AB-650 - Administering Microsoft 365 and AI Services

Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti-spam policies.

The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.

Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only. It cannot override the Standard preset security policy.

Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group ' s members. These users can then be evaluated by Policy1, provided its recipient conditions match.

Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.

Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.

Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.

Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.

Therefore, Group1 must be excluded from the Standard preset security policy.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies

https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined

Microsoft 365 provides Message Center and Service Health notification mechanisms for communicating organizational service changes and operational issues.

First selection: Message Center Preferences. The Microsoft 365 Message Center publishes information about important product changes, feature releases, service updates, and administrative actions. Administrators can configure email preferences to receive notifications about major updates. This directly meets Group1 ' s requirement.

Second selection: Service Health alerts. Service Health supports email notifications for incidents and advisories affecting Microsoft 365 services. Administrators can configure notifications for selected services and designate recipient email addresses. This is the likely intended selection for Group2 if maintenance events means operational service disruptions or advisories.

Microsoft documentation qualification: Planned maintenance is treated differently. Microsoft ' s current documentation explicitly states that planned maintenance announcements appear in Message Center rather than the Service Health dashboard. Therefore, if Group2 requires notifications specifically about planned maintenance, Message Center is the appropriate source, and the proposed Service Health selection does not completely meet that requirement.

The distinction is important when implementing the configuration. Major product updates and planned maintenance communications belong to Message Center; active incidents and service advisories belong to Service Health.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/message-center

https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health

Connect-MgGraph -Scopes: User.Read.All; $users =: Get-MgUser

Completed PowerShell Script:

Import-Module Microsoft.Graph

Connect-MgGraph -Scopes " User.Read.All "

$users = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,UserType,OnPremisesSyncEnabled

$users | Select-Object Id,DisplayName,UserPrincipalName,UserType,OnPremisesSyncEnabled |

Export-Csv -Path " C:\Exports\Users.csv " -NoTypeInformation

Disconnect-MgGraph

Microsoft Graph PowerShell provides delegated access to Microsoft Entra user objects through Microsoft Graph permission scopes. The script requires both an appropriate read permission and a command capable of retrieving every user.

First selection: User.Read.All.

The delegated User.Read.All permission allows the application to read users ' full profiles. This includes properties beyond the basic identity information exposed through User.ReadBasic.All.

The requested UserType and OnPremisesSyncEnabled properties are not part of the limited basic profile available through User.ReadBasic.All.

Although Directory.Read.All could also provide access, it grants broader directory-reading privileges. Consequently, User.Read.All is the least-privileged appropriate scope for the stated requirements.

Second selection: Get-MgUser.

The Get-MgUser cmdlet retrieves Microsoft Entra user objects. The -All parameter retrieves results across all available pages, ensuring that the export is not limited to the first page.

The -Property parameter explicitly requests the required attributes, including OnPremisesSyncEnabled, which is not returned in the default property set.

Finally, Select-Object selects the exported columns, Export-Csv creates the CSV file, and Disconnect-MgGraph ends the Graph session.

Microsoft References:

https://learn.microsoft.com/en-us/graph/permissions-reference

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/get-mguser

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Answer Area

Correct Selection

Users

Admin1 only

Portal

The Microsoft 365 Apps admin center

Microsoft 365 provides the Allow web search in Copilot policy to control whether Microsoft 365 Copilot and Microsoft 365 Copilot Chat can retrieve information from public web sources.

First selection: Admin1 only.

According to Microsoft Learn, the Cloud Policy service supports administration by Global Administrators, Office Apps Administrators, and Security Administrators.

In the Contoso scenario:

Admin1: Global Administrator — authorized to manage Cloud Policy.

Admin2: AI Administrator — can manage Copilot settings, but this role is not listed among those authorized to manage Cloud Policy configurations.

Admin3: Privileged Role Administrator — does not have the required Cloud Policy management permissions.

User1: Eligible for AI Administrator, but eligibility does not grant active administrative permissions.

Therefore, Admin1 is the only administrator explicitly authorized for this configuration.

Second selection: The Microsoft 365 Apps admin center.

Administrators configure web search through Microsoft 365 Apps admin center → Customization → Policy Management.

Create a Cloud Policy configuration and select the following setting:

Allow web search in Copilot

Configure it as:

Disabled in Microsoft Copilot and Microsoft Copilot Chat.

This disables public web search for both experiences, satisfying Contoso ' s requirement to use only Microsoft 365 information sources for Copilot responses.

Microsoft confirms that the Microsoft 365 admin center provides a shortcut to this setting, but the Cloud Policy itself is configured in the Microsoft 365 Apps admin center.

Microsoft References:

Microsoft Learn — Cloud Policy service and supported administrator roles .

Microsoft Learn — Manage Copilot settings .

Microsoft Learn — Manage web search for Copilot and Copilot Chat .

Answer Area

Correct Selection

Users that can approve the request

Admin1 and Admin3 only

User1 will be an AI administrator for

24 hours

Microsoft Entra Privileged Identity Management (PIM) enables eligible users to activate privileged administrator roles temporarily, subject to approval and activation-duration restrictions.

First selection: Admin1 and Admin3 only.

The Contoso case study specifies that approval is required to activate the AI Administrator role, but the Approvers setting is None.

According to Microsoft documentation, when no specific approvers are configured, active Global Administrators and Privileged Role Administrators become the default approvers.

Therefore:

Admin1: Global Administrator — can approve.

Admin2: AI Administrator — cannot approve merely by holding this role.

Admin3: Privileged Role Administrator — can approve.

Second selection: 24 hours.

The PIM configuration specifies an Activation maximum duration of 24 hours.

This means User1 can activate the AI Administrator role for a maximum of 24 hours following approval. After the activation period expires, PIM automatically removes the active privileges.

The one-month eligible assignment expiration controls how long User1 remains eligible to request activation. The 15-day active assignment expiration applies to separately assigned time-bound active roles, not this eligible role activation.

User1 can request a shorter activation duration, but 24 hours is the maximum permitted by the configuration.

Microsoft References:

Microsoft Learn — Configure Microsoft Entra PIM role settings .

Microsoft Learn — Activate Microsoft Entra roles in PIM .

Microsoft Foundry agents consume Azure resources, including AI model inference, token processing, and potentially additional services such as Code Interpreter, file search, and storage.

The Contoso case study specifies the following technical requirement:

" The total costs of Agent1 must be monitored and evaluated monthly. "

Option A is correct because Azure Cost Management + Billing provides comprehensive cost monitoring, analysis, and reporting for Azure resources, including resources consumed by Microsoft Foundry agents.

Administrators can navigate to Azure portal → Cost Management + Billing → Cost Management → Cost analysis.

Cost analysis supports monthly reporting, historical comparisons, cost breakdowns, filtering by resources or resource groups, and budget monitoring.

Option B is incorrect because billed messages in the Power Platform admin center relate to Power Platform and Copilot Studio consumption rather than comprehensive Microsoft Foundry agent costs.

Option C is incorrect because Microsoft 365 billing policies manage supported consumption-based Microsoft 365 Copilot services, not the complete Azure infrastructure costs associated with Foundry agents.

Option D is not the best answer because the Microsoft Foundry portal ' s Monitor experience provides valuable agent-level operational metrics and estimated token costs, but it does not necessarily capture every billable Azure resource used by an agent.

Microsoft explicitly recommends Azure Cost Management for comprehensive spending analysis and financial reconciliation.

Therefore, Cost Management + Billing in the Azure portal is the most appropriate solution for monitoring and evaluating Agent1 ' s total monthly costs.

Microsoft References:

Microsoft Learn — Plan and manage costs for Microsoft Foundry .

Microsoft Learn

Microsoft Learn — Monitor Microsoft Foundry costs using Azure Cost Management

Answer Area

Correct Selection

Project documents

Sensitive information type (SIT)

Proposal documents

Exact data match (EDM)

Microsoft Purview provides different classification technologies for identifying sensitive information. The appropriate method depends on whether the information follows a predictable pattern or must match known values.

First selection: Sensitive information type (SIT).

Contoso ' s project documents contain project codes consisting of the letters PR, followed by a hyphen and nine digits, such as PR-123456789.

This predictable structure makes a custom sensitive information type appropriate. Administrators can create a SIT using a regular expression such as:

PR-[0-9]{9}

Supporting keywords and confidence requirements can further minimize false positives.

Second selection: Exact data match (EDM).

Contoso ' s proposal documents contain customer IDs consisting of seven to ten alphanumeric characters. The valid customer IDs are recorded in an Excel workbook.

EDM is appropriate because it compares detected values against a known reference dataset. Administrators can prepare the customer IDs for EDM classification using a supported data format.

EDM reduces false positives by identifying customer IDs that actually exist in the reference data rather than matching arbitrary alphanumeric strings.

A fingerprint SIT would be more appropriate for Contoso ' s feedback forms, which use a standardized template. Trainable classifiers are better suited to content requiring contextual or semantic classification.

Therefore, a custom SIT for project codes and EDM for known customer IDs satisfy both requirements.

Microsoft References:

Microsoft Learn — Create custom sensitive information types .

Microsoft Learn — Exact Data Match sensitive information types .

Microsoft Learn — Reduce false positives using classifiers

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.