Practice Free AB-650 Administering Microsoft 365 and AI Services Exam Questions Answers With Explanation

Microsoft 365 groups provide integrated collaboration capabilities across Exchange Online, SharePoint Online, Microsoft Teams, Planner, and other Microsoft 365 workloads.

Option C is correct because upgrading an eligible distribution list to a Microsoft 365 group preserves its existing members and email addresses while enabling additional collaboration resources.

A Microsoft 365 group provides a shared mailbox, group calendar, SharePoint document library, and integration with Microsoft Teams. Group owners can manage membership without requiring administrators to perform routine membership changes.

Microsoft supports upgrading cloud-managed, simple, non-nested distribution lists to Microsoft 365 groups. Group1 has no nested groups, satisfying one important eligibility condition. Administrators must also confirm the remaining requirements before initiating the upgrade.

The upgrade can be initiated through the Exchange admin center. The distribution list owner can then approve the upgrade request.

Option A is incorrect because a SharePoint team site alone does not convert the existing distribution list or provide the complete Microsoft 365 group collaboration experience.

Option B is incorrect because dynamic security groups manage membership through attribute-based rules rather than providing shared collaboration resources.

Option D is incorrect because mail-enabled security groups provide email distribution and security permissions but not the shared files, calendar, and Teams integration required.

Therefore, upgrading Group1 is the most efficient solution.

Microsoft References:

Upgrade Distribution Lists to Microsoft 365 Groups .

Distribution list upgrade eligibility requirements .

Modify the password protection policy: User1 only; Invite an external user: User1, User2, User3, and User4

Microsoft Entra ID uses role-based access control (RBAC) to authorize administrative operations. The two activities in this question have different permission requirements.

First selection: User1 only.

Modifying the tenant-wide password protection policy requires privileged authorization. The Global Administrator role held by User1 includes the permissions required to configure Microsoft Entra Password Protection, including the custom banned-password list and smart lockout settings.

The Authentication Policy Administrator role can also manage these settings, but none of the other listed users holds that role. User2 ' s Security Administrator role does not provide this specific permission, while User4 ' s Password Administrator role concerns password administration rather than configuration of the tenant-wide password protection policy.

Second selection: User1, User2, User3, and User4.

Microsoft Entra external collaboration settings allow users to invite external guests. Under the default configuration, organizational users can invite external users, including users without administrative roles.

User1 can invite guests as a Global Administrator, and User2 also has the Guest Inviter role. User3 and User4 can invite external users under the default invitation settings.

Therefore, all four users qualify for the second activity.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure

List the AI app and agent inventory: AI observability; Review interactions: Activity explorer; Identify SharePoint exposure concerns: Data risk assessments

Microsoft Purview Data Security Posture Management (DSPM) combines AI activity visibility, sensitive-data investigations, and exposure assessments within a centralized data security framework.

First selection: AI observability. This capability provides an inventory of AI applications and agents, including their activity, risk characteristics, and sensitive interactions. Administrators can identify recently used agents and investigate potentially risky AI applications.

Second selection: Activity explorer. DSPM Activity explorer enables administrators to investigate events associated with sensitive information. Its AI activities view provides visibility into AI interactions, prompts and responses where supported, sensitive information detections, and data loss prevention policy matches. This makes it suitable for examining whether confidential SharePoint information was involved in an AI interaction.

Third selection: Data risk assessments. This capability identifies potential data exposure and oversharing risks. Administrators can assess sensitive content and investigate SharePoint locations where excessive access permissions or sharing configurations may expose information.

The remaining options perform different functions. Posture provides an overall data security dashboard, Remediation actions supports implementing security controls, and Reports provides summarized security information.

Consequently, AI observability, Activity explorer, and Data risk assessments are the correct selections for the three investigation requirements.

Microsoft References:

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

Microsoft Purview Information Protection provides data classification, sensitivity labeling, and protection capabilities for organizational information. However, Information Protection alone does not provide the dedicated investigation workflow required to identify individual AI agent interactions containing confidential information in prompts or responses.

The more appropriate solution is Microsoft Purview Data Security Posture Management (DSPM), using its AI observability and Activity explorer capabilities.

Microsoft DSPM supports visibility into AI agent activities, including Microsoft Agent 365. It can identify interactions involving sensitive information through integrated data classification, audit telemetry, sensitive information types, and trainable classifiers.

Administrators can navigate to the Microsoft Purview portal, open DSPM, and use Discover ? Activity explorer ? AI activities to investigate AI interactions. The AI observability page also provides agent-specific visibility into potentially sensitive interactions and associated risks.

Microsoft Purview Information Protection contributes classification and labeling capabilities to this process, but simply using Information Protection does not independently deliver the required agent-interaction investigation.

Therefore, the proposed solution does not fully satisfy the requirement, making Option B (No) the appropriate answer.

Microsoft References:

https://learn.microsoft.com/en-us/purview/ai-agent-365

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

Microsoft SharePoint Restricted Content Discovery (RCD) provides a site-specific mechanism for limiting how SharePoint content appears in organization-wide Microsoft 365 search and Microsoft 365 Copilot experiences.

Option B is correct because the administrator can apply Restricted Content Discovery directly to Site1 without modifying the search behavior of the other 999 SharePoint sites.

When RCD is enabled for Site1, its content is generally excluded from organization-wide discovery experiences and Copilot responses. This reduces the risk of confidential documents appearing in broad search results.

Restricted Content Discovery does not modify existing SharePoint permissions or remove files from the Microsoft 365 search index.

Option A is incorrect because Restricted SharePoint Search uses a tenant-wide allowlist approach and can affect search results across many SharePoint sites. Microsoft also began blocking new enablement of that feature on July 31, 2026.

Option C is incorrect because Copilot connectors integrate external data sources rather than restrict the discovery of existing SharePoint content.

Option D is incorrect because Microsoft Search bookmarks promote selected resources rather than restrict document discoverability.

Implementation qualification: Microsoft documents exceptions for content users own or have recently interacted with. RCD is not an absolute security boundary. If all access must be prevented, SharePoint permissions or Restricted Access Control must also be considered.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery

https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search

The Microsoft 365 Copilot usage report provides detailed adoption and engagement metrics that enable administrators to evaluate how effectively licensed users utilize Copilot across Microsoft 365 applications.

Option A is correct because the report supports the required analysis without relying on Microsoft Purview audit events or examining the content of user prompts.

Administrators can access the report through Microsoft 365 admin center ? Reports ? Usage ? Microsoft Copilot ? Copilot ? Usage.

The report provides several relevant metrics, including enabled users, active users, active-user rates, adoption trends, and application-specific activity across Word, Excel, PowerPoint, Outlook, Teams, and other supported applications.

The Adoption by app section enables administrators to compare licensed users against active Copilot users in each application. This helps identify applications where license deployment is increasing but actual engagement remains low.

The report also tracks supported Copilot feature interactions, enabling administrators to understand usage patterns and identify opportunities for targeted training.

For example, low adoption in Excel may indicate a need for training on AI-assisted data analysis, while low Teams engagement may indicate limited awareness of meeting summarization capabilities.

Microsoft specifically recommends using official Copilot usage reports rather than audit logs for adoption measurement because the reporting metrics are designed for consistent usage analysis.

Therefore, reviewing the Microsoft 365 Copilot usage report meets the stated goal.

First target (Set-Mailbox): -GrantSendOnBehalfTo; Second target (Add-MailboxPermission): -AccessRights FullAccess

Exchange Online shared mailboxes support collaborative mailbox access through delegated permissions. The requirements involve two separate capabilities: modifying mailbox contents and sending messages while retaining sender identification.

First selection: -GrantSendOnBehalfTo.

This parameter grants Send on Behalf permissions. When a member of Group1 sends an email using Mailbox1, recipients can identify the individual sender because the message indicates that it was sent on behalf of the shared mailbox.

This differs from Send As permission, where the email appears to originate directly from the shared mailbox without identifying the delegate.

Second selection: -AccessRights FullAccess.

The Add-MailboxPermission cmdlet grants mailbox access permissions. Specifying FullAccess allows authorized group members to open Mailbox1 and create, read, modify, and delete mailbox items.

Full Access alone does not grant permission to send email from the mailbox. The separate Send on Behalf permission is therefore necessary.

The -AcceptMessagesOnlyFrom parameter restricts inbound senders, while -ForwardingAddress configures forwarding. Neither provides the requested delegated capabilities.

Together, Send on Behalf and Full Access meet the two functional requirements.

Microsoft References:

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/create-shared-mailboxes

Microsoft Entra ID provides a group naming policy that enables organizations to enforce consistent naming conventions for Microsoft 365 groups.

First selection: The Microsoft Entra admin center.

Administrators configure the naming policy by navigating to the Microsoft Entra admin center and selecting Microsoft Entra ID ? Groups ? Naming policy.

The policy supports two principal capabilities: prefix-suffix naming conventions and custom blocked words.

Prefix-suffix rules automatically add predefined text or supported user attributes, such as Department or Company, to group names. Blocked-word policies prevent users from creating Microsoft 365 groups with prohibited terminology.

Second selection: Microsoft 365 only.

The Microsoft Entra group naming policy applies specifically to Microsoft 365 groups, including groups created through Microsoft Teams, Outlook, SharePoint, and other supported Microsoft 365 applications.

It does not apply to ordinary security groups, mail-enabled security groups, or Exchange distribution groups.

Exchange distribution groups can have separate naming policies configured through Exchange administration, but these are distinct from the Microsoft Entra Microsoft 365 group naming policy.

Microsoft 365 E5 includes the licensing required for this functionality.

An additional consideration is that certain privileged administrator roles are exempt from enforcement, and existing Microsoft 365 groups are not automatically renamed when the policy is introduced.

Therefore, the correct selections are the Microsoft Entra admin center and Microsoft 365 groups only.

Microsoft SharePoint Restricted Access Control enables administrators to restrict access to a SharePoint site and its content to members of designated Microsoft Entra security groups or Microsoft 365 groups.

Option B is correct because Restricted Access Control adds an additional authorization requirement without replacing the site ' s existing SharePoint permissions.

When Group1 is configured as the restricted access control group for Site1, users must satisfy two conditions before accessing its documents: they must belong to Group1 and possess appropriate existing SharePoint permissions.

Users outside Group1 are denied access even when they previously received direct permissions or sharing links.

This protection also applies to Microsoft 365 Copilot and organization-wide search experiences. Microsoft Copilot respects the effective SharePoint authorization boundaries, preventing unauthorized users from accessing restricted content through Copilot responses.

Option A is incorrect because Microsoft 365 Archive is intended for inactive content storage rather than enforcing group-based authorization.

Option C is incorrect because Restricted SharePoint Search controls content discoverability, not the underlying ability to open files.

Option D is incorrect because Restricted Content Discovery limits search and Copilot discovery without enforcing the required group-based access restrictions.

Restricted Access Control therefore satisfies the complete requirement while preserving the existing permission structure.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-access-control