Score Higher on Verified AB-650 | Administering Microsoft 365 and AI Services Exam Questions with Answers

Answer Area

Correct Selection

Users

Admin1 only

Portal

The Microsoft 365 Apps admin center

Microsoft 365 provides the Allow web search in Copilot policy to control whether Microsoft 365 Copilot and Microsoft 365 Copilot Chat can retrieve information from public web sources.

First selection: Admin1 only.

According to Microsoft Learn, the Cloud Policy service supports administration by Global Administrators, Office Apps Administrators, and Security Administrators.

In the Contoso scenario:

Admin1: Global Administrator — authorized to manage Cloud Policy.

Admin2: AI Administrator — can manage Copilot settings, but this role is not listed among those authorized to manage Cloud Policy configurations.

Admin3: Privileged Role Administrator — does not have the required Cloud Policy management permissions.

User1: Eligible for AI Administrator, but eligibility does not grant active administrative permissions.

Therefore, Admin1 is the only administrator explicitly authorized for this configuration.

Second selection: The Microsoft 365 Apps admin center.

Administrators configure web search through Microsoft 365 Apps admin center ? Customization ? Policy Management.

Create a Cloud Policy configuration and select the following setting:

Allow web search in Copilot

Configure it as:

Disabled in Microsoft Copilot and Microsoft Copilot Chat.

This disables public web search for both experiences, satisfying Contoso ' s requirement to use only Microsoft 365 information sources for Copilot responses.

Microsoft confirms that the Microsoft 365 admin center provides a shortcut to this setting, but the Cloud Policy itself is configured in the Microsoft 365 Apps admin center.

Microsoft References:

Microsoft Learn — Cloud Policy service and supported administrator roles .

Microsoft Learn — Manage Copilot settings .

Microsoft Learn — Manage web search for Copilot and Copilot Chat .

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Answer Area

Correct Selection

Users that can approve the request

Admin1 and Admin3 only

User1 will be an AI administrator for

24 hours

Microsoft Entra Privileged Identity Management (PIM) enables eligible users to activate privileged administrator roles temporarily, subject to approval and activation-duration restrictions.

First selection: Admin1 and Admin3 only.

The Contoso case study specifies that approval is required to activate the AI Administrator role, but the Approvers setting is None.

According to Microsoft documentation, when no specific approvers are configured, active Global Administrators and Privileged Role Administrators become the default approvers.

Therefore:

Admin1: Global Administrator — can approve.

Admin2: AI Administrator — cannot approve merely by holding this role.

Admin3: Privileged Role Administrator — can approve.

Second selection: 24 hours.

The PIM configuration specifies an Activation maximum duration of 24 hours.

This means User1 can activate the AI Administrator role for a maximum of 24 hours following approval. After the activation period expires, PIM automatically removes the active privileges.

The one-month eligible assignment expiration controls how long User1 remains eligible to request activation. The 15-day active assignment expiration applies to separately assigned time-bound active roles, not this eligible role activation.

User1 can request a shorter activation duration, but 24 hours is the maximum permitted by the configuration.

Microsoft References:

Microsoft Learn — Configure Microsoft Entra PIM role settings .

Microsoft Learn — Activate Microsoft Entra roles in PIM .