AB-650 practice questions

Question 1

An Exchange Online incident has affected Tailspin Toys users for three hours. In Service health, the incident's status just changed from Restoring service to Extended recovery. The CIO wants to tell all staff that email is fully fixed and close the internal incident ticket. What should the administrator advise?

Accepted Answer

Hold the announcement, because Extended recovery means corrective action hasn't yet reached every affected system Learn's service health status definitions say Extended recovery means corrective action is in progress to restore service to most users but will take some time to reach all affected systems, or that a temporary fix is reducing impact while Microsoft waits to apply a permanent fix. The all-clear is Service restored, when Microsoft confirms corrective action has resolved the underlying problem, so the internal ticket should stay open until then.

Question 2

Fabrikam is retiring fabrikam.net. Every user, shared and resource mailbox, contact, group and distribution list now uses fabrikam.com except the administrator's own account, which signs in as admin@fabrikam.net, and fabrikam.net is still the default domain. A second Global Administrator signs in on fabrikam.com. Which sequence lets the domain removal succeed?

Accepted Answer

Set fabrikam.com as the default domain, change your own username to fabrikam.com and sign in again with it, then remove fabrikam.net Learn's Remove a domain page lists the prerequisites: the domain isn't the default domain; no users, shared or resource mailboxes, contacts, groups, distribution lists or teams use it; and no admin account signs in with it. Two blockers remain here, the default flag and the administrator's own username. Learn has you change your own username, then sign out and back in on the new domain, which is safe because another Global Administrator exists on a different domain. Domain changes take the Domain Name Administrator role.

Question 3

An administrator at Fabrikam runs Get-MgUser -Filter "endsWith(userPrincipalName,'@fabrikam.com')" -All to list the users in one domain. Microsoft Graph returns a Request_UnsupportedQuery error saying the endsWith operator isn't supported because required parameters might be missing. What should the administrator change?

Accepted Answer

Add -ConsistencyLevel eventual and -CountVariable to the Get-MgUser command A filter using endsWith on userPrincipalName is an advanced query. The Learn article on advanced query capabilities for directory objects says such requests need the ConsistencyLevel header set to eventual and the $count query parameter; without either, the request returns an error. In Graph PowerShell that pair is -ConsistencyLevel eventual with -CountVariable, and the error text itself suggests adding exactly those two.

Question 4

Woodgrove Bank synchronizes 3,000 employees from on-premises Active Directory with password hash synchronization and also has 60 cloud-only contractor accounts. Auditors require contractor passwords to expire every 90 days. A User Administrator sets the password expiration policy to 90 days under Settings, then Org settings, then Security and privacy. What is the result?

Accepted Answer

Only the 60 cloud-only contractor accounts expire every 90 days; the synced employees aren't covered by this policy Learn's Set the password expiration policy page scopes the setting to cloud-only users and says it doesn't apply to hybrid identities that use password hash sync, pass-through authentication or on-premises federation such as AD FS. Passwords never expire by default; a User Administrator can set 14 to 730 days, and the admin center and Microsoft 365 apps no longer send expiration notifications.

Question 5

Litware's privacy office approved showing real names in usage reports. A compliance analyst with the Reports Reader role still sees hashed user and site names in the Microsoft 365 admin center usage reports, the Teams admin center usage reports and the Microsoft 365 usage analytics app in Power BI. What single change shows the names on all three, and who can make it?

Accepted Answer

A Global Administrator clears Conceal user, group, and site names in all reports under Org settings, then Services, then Reports Learn's Microsoft 365 admin center usage reports overview says reports hide user, group and site details by default and that Global Administrators can change this on the Reports page under the Services tab of Org settings. The same setting applies to the usage reports in Microsoft Graph, Power BI and the Teams admin center, so one change covers all three surfaces, and showing identifiable information is logged in the Microsoft Purview audit log.

Question 6

At Fabrikam, a service desk lead must assign and remove product licenses for individual users, set the usage location on accounts that have none, and reprocess failed group license assignments. The lead must not create users, change group membership, or buy subscriptions. Which Microsoft Entra role should the lead receive to follow least privilege?

Accepted Answer

License Administrator The Microsoft Entra built-in roles reference describes License Administrator as able to read, add, remove, and update license assignments on users and groups, reprocess license assignments, and update users' usage location. It can't purchase or manage subscriptions, create or manage groups, or manage users beyond usage location. That covers every task the lead needs and nothing the stem forbids, which is what least privilege asks for.

Question 7

Contoso pays for Microsoft 365 Backup through a pay-as-you-go billing policy under Billing, then Pay-as-you-go, in the Microsoft 365 admin center. Finance wants an email to its mail-enabled finance group when monthly spending reaches 80 percent of $3,000, and wants backup charges to stop automatically once spending hits $3,000. What should the administrator configure and tell Finance?

Accepted Answer

Set a $3,000 monthly budget with an 80 percent alert, and explain that charges stop only if Backup is disconnected from the policy. The pay-as-you-go setup page for the Billing node lets a billing policy carry a budget that resets monthly, quarterly, or yearly, alerts at 100 percent by default, and accepts up to four more thresholds from 1 to 99 percent, sent to email-enabled groups. The same page is explicit that reaching 100 percent doesn't stop the service or billing. Only disconnecting stops charges, so Finance can have the 80 percent email but not an automatic cutoff.

Question 8

Contoso wants Microsoft 365 Backup to protect its SharePoint sites and executive mailboxes. A SharePoint Administrator opens Settings, then Microsoft 365 Backup, in the Microsoft 365 admin center for the first time. What must be in place before any backup policy can protect content?

Accepted Answer

A pay-as-you-go billing policy linked to an Azure subscription and a resource group in that subscription. The Set up Microsoft 365 Backup page puts pay-as-you-go billing first: a valid Azure subscription, a resource group, a region, and Owner or Contributor rights on the subscription. Only then are backup policies created under Settings, then Microsoft 365 Backup. The service bills $0.15 per GB per month of protected data with free restores rather than per user, and it keeps backups inside the Microsoft 365 data trust boundary.

Question 9

An employee left Woodgrove Bank, and the administrator removed the employee's Microsoft 365 E3 license that day. The manager now wants the employee's mailbox, 12 GB with no archive or hold, kept as a shared mailbox for the team. On the user's Mail tab in the Microsoft 365 admin center, Convert to shared mailbox doesn't appear. What should the administrator do?

Accepted Answer

Reassign the license, convert the mailbox to shared, then remove the license The Convert a user mailbox to a shared mailbox page is explicit: the user mailbox needs a license assigned before conversion, otherwise the convert option isn't shown, and a removed license must be added back first. After conversion the license can be removed, because a shared mailbox under 50 GB with no archive or hold needs none. The user account stays, since it anchors the shared mailbox.

Question 10

Fabrikam's IT operations manager reviews Service health every morning. It never lists the Exchange Online planned maintenance that Microsoft schedules, and she wants one place to follow planned maintenance and upcoming changes her team may need to prepare for. Where should she look?

Accepted Answer

Message center in the Microsoft 365 admin center, filtered to Exchange Online posts Learn's How to check Microsoft 365 service health page states that planned maintenance events aren't shown in Service health and points admins to Message center to track them, including when a change happens, its effect and how to prepare. Message center, under Health in the admin center, is also where Microsoft tries to give at least 30 days' notice of changes that need admin action.

Question 11

Tailspin Toys' accounts payable staff need the vendor address billing@fabrikam.com listed in the global address list so they can pick it in Outlook and add it to a distribution group. The vendor must not be able to sign in to any Tailspin Toys resource. Which object should an Exchange administrator create?

Accepted Answer

A mail contact in the Exchange admin center, under Recipients then Contacts The Learn article on managing mail contacts in Exchange Online describes mail contacts as mail-enabled objects for people outside the organization, each with an external email address, created in the Exchange admin center under Recipients, then Contacts, with Add a mail contact. Contacts appear in the shared address book and can be members of distribution groups, and they carry no sign-in credentials, which fits a vendor who must not be able to sign in.

Question 12

Contoso has a Conditional Access policy for all users and all resources with Block access as its grant control. Its Client apps condition is configured with only Exchange ActiveSync clients selected. The sign-in logs show IMAP4 and POP3 sign-in attempts for which this policy's result is Not applied. What should the administrator change so that the policy also covers those attempts without affecting modern authentication clients?

Accepted Answer

Select Other clients in the Client apps condition, alongside Exchange ActiveSync clients. Legacy authentication maps to two Client apps choices: Exchange ActiveSync clients and Other clients. Other clients covers basic authentication over mail protocols such as IMAP, POP, SMTP and MAPI, plus older Office apps without modern authentication. Learn's block legacy authentication policy checks both boxes with Block access, so adding Other clients brings the IMAP4 and POP3 attempts into scope while modern clients stay unaffected.

Question 13

Litware uses pass-through authentication and has Microsoft Entra ID P1. In AD DS, the account lockout threshold is 10 invalid attempts and the account lockout duration is 15 minutes. A password spray against cloud sign-ins is locking user accounts in AD DS. Which smart lockout values should the administrator set on the Password protection page in the Microsoft Entra admin center?

Accepted Answer

Lockout threshold of 5 and lockout duration of 1,200 seconds The smart lockout page gives two rules for pass-through authentication: the Microsoft Entra lockout threshold must be less than the AD DS threshold, with AD DS at least two or three times higher, and the Microsoft Entra lockout duration must be longer than the AD DS lockout duration. Microsoft Entra sets duration in seconds and AD DS in minutes. A threshold of 5 against 10, and 1,200 seconds (20 minutes) against 15 minutes, lets cloud lockout stop the spray before AD DS locks the accounts.

Question 14

A Tailspin Toys user sees error AADSTS53003 when opening a line-of-business web app. The help desk finds the failed event in the Microsoft Entra sign-in logs. Where should they look first to identify the policy that stopped the sign-in?

Accepted Answer

The Conditional Access tab of the event, which lists the policies that applied and each result AADSTS53003 is BlockedByConditionalAccess: a Conditional Access policy didn't allow token issuance. Learn's troubleshooting steps are to find the event in the sign-in logs, narrowing by correlation ID or user if needed, and open its Conditional Access tab, which shows the specific policy or policies that interrupted the sign-in. Selecting a policy name there opens that policy's configuration for review.

Question 15

Contoso enabled SMS in the Authentication methods policy for a single group of 40 retail staff. Office workers outside that group still receive SMS verification codes at sign-in. The legacy multifactor authentication service settings still have Text message to phone selected, and Manage migration is set to Migration in Progress. What should the administrator do so that only the retail staff can use SMS?

Accepted Answer

Set Manage migration to Migration Complete so that Microsoft Entra ID ignores the legacy method settings Until migration is complete, Microsoft Entra ID honors every method policy at once: a user enabled for a method in any policy can register and use it, so Text message to phone in the legacy MFA settings keeps SMS open to everyone. The Manage authentication methods page describes Migration in Progress as respecting legacy settings, while Migration Complete uses only the Authentication methods policy for sign-in and SSPR and ignores the legacy settings. Completing the migration leaves the retail group's SMS targeting as the only rule.

Question 16

For a year, Fabrikam's SSPR policy required one method, and many users registered only one method, a mobile phone number. Today an administrator changes Number of methods required to reset to 2. Tomorrow, a user who registered only that mobile phone number forgets their password and opens the SSPR portal. What happens?

Accepted Answer

The user can't reset, sees an error page, and needs an administrator to reset the password The SSPR how-it-works page covers this exact change: a user with one registered method is unable to reset or unlock once two methods are required. SSPR checks that the user has data for at least as many enabled methods as the policy requires; if not, the user sees an error and must ask an administrator for a reset. Raising the count safely means getting users to register a second method before the change.

Question 17

Litware put a policy that requires multifactor authentication for all users into Report-only. An accountant signed in to Outlook on the web with only a password, and the Report-only tab of that sign-in event lists the policy with the result Report-only: User action required. What does this result tell the administrator?

Accepted Answer

The conditions matched, and meeting the policy needs an interactive MFA prompt, which report-only mode doesn't send. Report-only evaluates a policy without enforcing it. User action required means every configured condition matched, but the grant control can be met only by something the user must do, such as an MFA challenge or accepting terms of use, and report-only mode doesn't prompt the user for it. The result isn't a failure: with the policy On, this accountant would be asked for MFA rather than blocked.

Question 18

At Contoso, Ana is covered by the Strict preset security policy, Ben by the Standard preset security policy, and Carl only by the default anti-spam policy. No anti-spam setting has been changed from its default. A newsletter reaches all three with a bulk complaint level (BCL) of 6 and no spam, phishing, or malware verdict. Where does each copy end up?

Accepted Answer

Ana: quarantine; Ben: Junk Email folder; Carl: Inbox A message is treated as bulk when its BCL meets or exceeds the policy's bulk email threshold. The BCL article lists thresholds of 5 for Strict, 6 for Standard, and 7 for the default policy, with Strict quarantining bulk and Standard and the default policy moving it to Junk Email. BCL 6 meets Strict's 5 and Standard's 6 but not the default 7, so Ana's copy is quarantined, Ben's goes to Junk Email, and Carl's reaches the Inbox.

Question 19

Fabrikam's quarantine policies let users request the release of their quarantined messages. The service desk team, rather than the administrators who get these emails today, must receive the notification emails that user release requests generate. What should the administrator change?

Accepted Answer

The email recipients of the User requested to release a quarantined message alert policy User release requests trigger the default alert policy named User requested to release a quarantined message, an Informational alert that notifies administrators by default. The quarantine policies article says admins can customize that policy's email notification recipients, and default alert policies let you change the recipient list and daily notification limit even though their other settings are locked. Adding the service desk team there sends the request emails to them.

Question 20

At Litware, Nora holds the Attack Payload Author role and builds tenant payloads for the awareness program. She now also has to create payload automations and schedule simulation automations, but she must not get permissions to manage threat policies or other Defender for Office 365 settings. Which role should replace Attack Payload Author for her?

Accepted Answer

Attack Simulation Administrator The get started article describes Attack Simulation Administrator as creating and managing all aspects of attack simulation campaigns, and it lists what Attack Payload Author can't do: create or edit simulations, training campaigns, simulation automations, or payload automations. Attack simulation training permissions come from Microsoft Entra roles, and this one is scoped to attack simulations, unlike Security Administrator, which also manages threat policies.

Question 21

Contoso built a simulation automation with three social engineering techniques and eight payloads, a Randomized schedule with a maximum of one simulation, Unique payloads on, and Target all selected users in every simulation run selected. After it ran, all 600 targeted users had received the same payload. What explains the result?

Accepted Answer

The automation made one run, and a run uses one payload for all its users The simulation automations article says each run gets one social engineering technique and one payload, and every user assigned to that run receives it. Multiple payloads form a pool for different runs, not a mix inside one run, and Unique payloads only avoids reuse across runs. With a randomized maximum of one, the automation can create at most one run, so all 600 users saw the same payload.

Question 22

Contoso runs Attack simulation training. User reported messages go to Microsoft and to an Exchange Online reporting mailbox that its normal Safe Links and Safe Attachments policies cover. Employees who correctly reported a simulated phishing message with the built-in Report button were later assigned training as if they had clicked the payload. The SOC must keep receiving every report in that mailbox. What should the administrator configure?

Accepted Answer

Add the reporting mailbox as a SecOps mailbox in the advanced delivery policy The user reported settings article says to identify the reporting mailbox as a SecOps mailbox in the advanced delivery policy, and warns that without it a user reported message might trigger a training assignment by the phishing simulation product. The Attack simulation training FAQ gives the cause: Safe Links or Safe Attachments can detonate the reported messages, and detonations result in training assignments. For SecOps mailboxes, the advanced delivery policy keeps Safe Links and Safe Attachments from detonating them.

Question 23

Fabrikam licenses Microsoft 365 E3, which includes Defender for Office 365 Plan 1 as of July 1, 2026. A phishing message reached 60 Inboxes. In Real-time detections, the Take action wizard offers the administrator only Submit to Microsoft for review and Tenant Allow/Block List entries, but she needs to soft delete the delivered copies from that wizard. What does Fabrikam need?

Accepted Answer

Defender for Office 365 Plan 2, which adds Threat Explorer and Move or delete The threat hunting article's Take action table lists Move or delete as a Defender for Office 365 Plan 2 action. With Plan 1, which the service description says Microsoft 365 E3 includes from July 1, 2026, Real-time detections offers only Submit to Microsoft for review and Tenant Allow/Block List entries. Soft deleting delivered mail from the wizard therefore needs Plan 2 and its Threat Explorer. Permissions such as Search and Purge matter only once the action exists.

Question 24

On June 2, Tailspin Toys ran a training campaign that assigned a phishing awareness module to every employee. A new campaign on August 18 assigned the same module, but employees who finished it in June weren't assigned it, and those who never finished show Training Previously Assigned. For next week's campaign, management wants the module assigned to every targeted employee regardless of earlier assignments. What should the administrator change?

Accepted Answer

Set the training threshold on the Settings tab to 0 The training threshold, 90 days by default and counted from when a module is assigned, keeps a module from being reassigned to users who completed it or were assigned it during that period, and the Training Previously Assigned status shows that effect. June 2 to August 18 falls inside 90 days. The training campaigns article says that setting the threshold to 0 on the Settings tab removes it, so training is always assigned.

Question 25

Woodgrove Bank synchronizes accounts from on-premises Active Directory with Microsoft Entra Connect Sync. Mei, a synchronized user, transfers to the London office. Her job title must change, and her usage location must become GB so the right services can be licensed. A User Administrator is handling both changes. Where should each change be made?

Accepted Answer

Job title in on-premises Active Directory, then wait for sync; usage location directly in the Microsoft Entra admin center. The Learn article on adding or updating a user's profile information says that for users whose source of authority is Windows Server Active Directory, identity, contact info, and job info must be changed in Active Directory and show up after the next sync cycle. The same note says Microsoft Entra ID attributes such as Usage Location can be updated directly in the Microsoft Entra admin center. Job title is job info; usage location is a cloud attribute.

Question 26

Contoso has Microsoft Entra ID P1 and a Conditional Access policy that requires MFA for guests. Guests from Fabrikam, another Microsoft Entra organization, complete MFA at home and then again in Contoso. MFA must stay required, but MFA done in Fabrikam's tenant should satisfy it, while guests from every other partner still complete MFA in Contoso. What should you configure?

Accepted Answer

In cross-tenant access settings, add Fabrikam under Organizational settings and trust MFA on its inbound Trust settings tab. Inbound trust settings let Contoso's Conditional Access policies accept MFA claims from another Microsoft Entra organization: the MFA policy still applies, but a guest who already completed MFA at home isn't challenged again. Set on Fabrikam's entry under Organizational settings, the trust covers Fabrikam only, because organizational settings take precedence over the defaults that every other partner keeps. Trust settings require Microsoft Entra ID P1.

Question 27

Woodgrove Bank put the CFO's account, which holds no admin roles, in the restricted management administrative unit Exec-Protect. Two support staff hold Helpdesk Administrator scoped to Exec-Protect, and both are unavailable tonight when the CFO needs a password reset. Lena, a Global Administrator at tenant scope, must reset it without taking the account out of the unit, even briefly. What should she do?

Accepted Answer

Assign herself the Helpdesk Administrator role scoped to Exec-Protect, and then reset the CFO's password In a restricted management administrative unit, only administrators assigned at that unit's scope can change the Microsoft Entra properties of its members, so Lena's tenant-scope Global Administrator role can't reset the password. The restricted management article lets Global Administrators and Privileged Role Administrators assign roles scoped to the unit, including to themselves, and records the assignment in the audit logs. A unit-scoped Helpdesk Administrator can reset passwords for non-administrators in the unit.

Question 28

Litware's tenant was created with the United States as its country. An administrator creates 40 accounts for a new office in Brazil with a script that sets display name, UPN, password, and the Country or region property to Brazil, but never sets usage location. The accounts are added to a security group that has Microsoft 365 E3 assigned through group-based licensing. What happens?

Accepted Answer

The licenses are applied, and each account takes the tenant's location, the United States. The Microsoft 365 admin center article on group-based licensing notes that a license can't be assigned directly to a user until the user's location is set, and that for group-based licensing any user without a specific location inherits the tenant's location. Country or region is a separate profile property from usage location, so these Brazil staff are licensed as if they were in the United States. Set usage location when accounts are created.

Question 29

A Privileged Role Administrator at Fabrikam must give the eight members of the existing Service-Desk security group the Helpdesk Administrator role through a group assignment. Service-Desk was created last year with assigned membership, and it doesn't appear in the picker when she adds an assignment to the role. What should she do?

Accepted Answer

Create a new role-assignable security group, add the eight users to it, and assign the role to that group Only groups created with isAssignableToRole set to true, shown in the admin center as Microsoft Entra roles can be assigned to the group, can hold a role. The role-assignable groups article says the property can be set only on new groups, is immutable, and can't be applied to an existing group. Creating one takes at least Privileged Role Administrator, its membership must be Assigned, and nesting isn't supported, so a new group with the eight users as direct members is the path.

Question 30

Contoso assigns its Windows Autopilot deployment profile to a Microsoft Entra group. Every Autopilot device registered in the tenant, including devices registered next month, must get the profile without anyone maintaining a member list. Which group should the administrator create for the profile assignment?

Accepted Answer

A security group with Dynamic Device membership and a rule on device.devicePhysicalIds Microsoft 365 groups can include only users, and a dynamic rule targets users or devices but never both, so a self-maintaining device group has to be a security group with the Dynamic Device membership type. The dynamic membership rules article lists devicePhysicalIds, the attribute Windows Autopilot uses, as a device rule property, with an example that matches all Autopilot devices, and names Autopilot profile assignment as a use for dynamic groups. Devices need no license to be members.

Question 31

Litware set its guest invite settings to Only users assigned to specific admin roles can invite guest users. A project coordinator must now invite vendor staff as B2B guests for a new project and should hold no other administrative permissions. Which role should you assign to the coordinator?

Accepted Answer

Guest Inviter The external collaboration settings article says that with Only users assigned to specific admin roles selected, only users with User Administrator or Guest Inviter can invite guests, and that Guest Inviter lets individuals invite guests without a higher privileged administrator role. The Least privileged roles by task reference also lists Guest Inviter as the least privileged role for creating guest users.

Question 32

Litware has 3,000 Windows 11 devices that are already onboarded to Microsoft Defender for Endpoint through Intune. The compliance team wants Endpoint DLP policies to apply to these devices with the least administrative effort. What should the admin do?

Accepted Answer

Turn on device onboarding in the Purview portal and use the devices that are already listed there. Learn's onboarding overview says device onboarding is shared across Microsoft 365 and Defender for Endpoint: devices already onboarded to Defender for Endpoint appear in the managed devices list, and no further steps are needed to onboard them. The admin goes to Settings, then Device onboarding, then Devices, turns on device onboarding (usually about 60 seconds, up to 30 minutes), and then scopes Endpoint DLP policies to those devices.

Question 33

Woodgrove Bank has Microsoft 365 E3 with no add-ons. An Exchange DLP rule is set to send an alert every time an activity matches. Within 10 minutes, four different users each send a message that matches the rule, yet the DLP Alerts dashboard shows a single alert that holds all four events. The security operations lead asks why. What explains the single alert?

Accepted Answer

Single-event alerts from one rule are grouped within a fixed 15-minute window on E3 that admins can't change. Learn's Get started with DLP alerts page says single-event alerts from the same rule are aggregated when the events fall within a set window of each other: 60 seconds on E5 and 15 minutes on E3, and the admin can't configure either window. Four matches in 10 minutes on an E3 tenant land in one window, so one alert carrying four events is expected behavior, not a fault. Separate alerts per sender would need the tenant-level user and rule based aggregation, which is in preview.

Question 34

Contoso has Microsoft 365 E3 with no compliance or security add-ons. The DLP admin turns on single-event alerts in the Exchange, SharePoint, and OneDrive policies, and the security team asks where its analysts should triage those alerts. Where should the admin point them?

Accepted Answer

The DLP Alerts dashboard in the Microsoft Purview portal, under Data loss prevention, then Alerts. Learn's page on investigating DLP alerts with Microsoft Defender XDR lists the licenses needed to investigate DLP incidents in the Defender portal: Office 365 E5 or A5, Microsoft 365 E5 or A5, and the E5 or A5 Compliance and Information Protection and Governance offers. Any DLP subscription, E3 included, can raise single-event alerts, and the Purview DLP Alerts dashboard is where they are viewed, triaged, and given a status.

Question 35

Tailspin Toys runs shared Windows 11 kiosks in its warehouses. An Endpoint DLP policy blocks printing of files with customer data, and it must apply to anyone who signs in to a kiosk, including daily temporary workers who aren't in any group. The admin scoped users to the Kiosk-Operators group and devices to the kiosk device group. Temporary workers still print those files. What should the admin change?

Accepted Answer

Set the user scope to All users and groups, and keep the kiosk device group as the device scope. The device scoping section of Learn's DLP policy reference says a Devices policy is enforced only when both the user and the device are in scope. Temporary workers aren't in Kiosk-Operators, so the policy never applies when they sign in. Learn's own pattern for kiosks used by many people is All users and groups for the user scope plus specific devices and device groups for the device scope, which covers every user on the kiosks without touching other laptops.

Question 36

Fabrikam licenses Microsoft Agent 365. On one day, a single analyst is the only user of an Agent Builder agent. She chats with it from 9:00 to 9:10 AM, returns at 9:25 AM and chats until 9:30 AM, then returns at 10:15 AM for one more exchange. With the agent's Activity tab date range set to that day, what does the tab report?

Accepted Answer

One active user and two sessions, because only a gap of over 30 minutes starts a session The Activity tab counts a user as active after a single interaction in the date range, however often she returns, so the analyst is one active user. A session is a back-and-forth conversation, and a new one starts after 30 minutes of inactivity. The 15-minute gap before 9:25 AM keeps her in the first session, and the 45-minute gap before 10:15 AM starts a second. The tab needs E7 or Agent 365 and currently covers Agent Builder, SharePoint, and Microsoft 365 Agents Toolkit agents.

Question 37

Contoso's tenant is in the EU. Last year its admin opted in to Anthropic models under Anthropic's own commercial terms. Claude has since disappeared from Researcher and the Copilot model picker, and the AI providers operating as Microsoft subprocessors page shows Anthropic set to No users. Only the Research security group should get Claude. What should the AI Administrator do?

Accepted Answer

Opt in to Anthropic again on the subprocessors page and assign the Research security group. Anthropic now operates as a Microsoft subprocessor, and in the EU, EFTA, and the UK its setting defaults to No users. The older independent processor setting was decommissioned on May 1, 2026, so organizations that opted in under Anthropic's own terms must opt in again on the AI providers operating as Microsoft subprocessors page. Access is assigned per provider to users or security groups, so assigning Research returns Claude to that group across Copilot experiences.

Question 38

Fabrikam's Cowork spending policy draws on prepaid capacity packs and on an Azure subscription that carries a Copilot Credit pre-purchase plan (P3). Pay-as-you-go is enabled on the same subscription, and both prepaid sources still hold credits this month. In what order does Cowork usage draw on these sources?

Accepted Answer

Prepaid capacity packs first, then P3 commit units, then pay-as-you-go billing The managing usage-based billing page states that when a policy uses both prepaid capacity packs and a subscription with a Copilot Credit pre-purchase plan, billing follows a fixed order to keep spending predictable: prepaid capacity packs, then the P3 plan, then pay-as-you-go. Pay-as-you-go only picks up what the prepaid sources can't cover, and with no prepaid credits left and pay-as-you-go off, requests are blocked.

Question 39

Woodgrove Bank is preparing for an ISO certification audit of the management system that governs how it develops and uses AI, including agents run under Agent 365. The compliance manager wants a Compliance Manager assessment whose controls match that standard. Which regulatory template should the assessment use?

Accepted Answer

ISO/IEC 42001:2023 ISO/IEC 42001 specifies requirements for establishing, implementing, maintaining, and continually improving an AI management system, and Compliance Manager offers a premium template for it. The Compliance Manager assessments page lists it among the four AI regulation templates under Premium AI templates, with the EU Artificial Intelligence Act, ISO/IEC 23894:2023, and NIST AI RMF 1.0. Among the choices, only 42001 is an ISO standard for AI, so its template matches the audit.

Question 40

Contoso has Microsoft 365 E7. On the All agents page, an agent's Risks column shows 4, and its Risk details pane lists Microsoft Purview among the platforms contributing signals. A Global Administrator selects the Microsoft Purview link to review the Insider Risk Management alerts but can't view them. What should the administrator do?

Accepted Answer

Assign themselves the IRM Analyst or IRM Investigator role, which that Purview link requires. Each platform named in the Risk details pane is a deep link, and what opens depends on the viewer's roles. The agent registry page's table accepts Global Administrator, Global Reader, Security Reader, Security Administrator, or AI Administrator for the Entra and Defender links, but only IRM Analyst or IRM Investigator for Purview IRM alerts, and says Global Administrator alone is insufficient. In Purview those are the Insider Risk Management Analysts and Investigators role groups, which a Global Administrator can add themselves to.

Question 41

Litware's records team wants members of the Research group to stop creating new Copilot Pages and Copilot Notebooks in the Microsoft Copilot app. Loop workspaces must keep working for everyone, and nobody outside Research should be affected. What should the Office Apps admin do?

Accepted Answer

In Cloud Policy, disable Create and view Copilot Pages and Copilot Notebooks in a configuration for Research. Creation of Copilot Pages and Copilot Notebooks is governed by the Create and view Copilot Pages and Copilot Notebooks setting in Cloud Policy, which is enabled by default and can be scoped to a group. Disabling it for Research stops new Pages and Notebooks, hides the Notebooks module in the Copilot app, and deletes nothing that already exists. Pages and Notebooks are independent of Loop, so Loop workspaces keep working.

Question 42

Fabrikam's security team wants to stop administrators from using Copilot inside the Microsoft 365, Exchange, SharePoint, and Teams admin centers, while Copilot for licensed end users stays exactly as it is. Several of the administrators hold no Copilot license, yet they already use Copilot in those admin centers. What should the AI Administrator do?

Accepted Answer

Turn off Microsoft Copilot in admin centers on the User access tab of Copilot settings. Microsoft Copilot in admin centers, on the User access tab under Copilot then Settings, decides whether users with an admin role can use Copilot in the Microsoft 365, Exchange, SharePoint, and Teams admin centers. It is allowed for all admins by default, which is why unlicensed admins already use it. Turning it off removes Copilot from those admin centers and leaves end-user Copilot alone. The admin experience needs no extra Copilot license, so licenses aren't the lever.

Question 43

Woodgrove Bank has a Conditional Access policy, set to On, that blocks every agent identity derived from its trading blueprint from All resources. Later, the hosting service uses the blueprint to call Microsoft Graph and create two new agent identities, and an existing trading agent calls a partner pricing service with a static API key that isn't registered in Microsoft Entra ID. What happens?

Accepted Answer

Both succeed; the blueprint's creation token and API-key calls are outside Conditional Access. The Conditional Access for agents page lists its boundaries: policies don't apply when an agent identity blueprint acquires a Microsoft Graph token to create an agent identity or an agent's user account, and Conditional Access protects only resources secured by Microsoft Entra ID, so a call made with an API key bypasses token issuance entirely. The block still applies once the new agent identities request tokens for Entra-protected resources.

Question 44

At Tailspin Toys, six platform engineers in an assigned-membership security group must be able to edit an agent identity blueprint's settings and manage its credentials. Adding the group as an owner of the blueprint fails, and the team won't accept any tenant-wide admin role. What should the administrator do?

Accepted Answer

Add each of the six engineers individually as an owner of the blueprint. The owners, sponsors, and managers page says individual users, including guests, and service principals can be owners, while groups aren't supported as owners. Owners hold administrative rights scoped to their blueprint or agent identity: they edit settings, manage credentials, change configurations, and add more owners. Adding each engineer as an owner meets the need with no directory role, and multiple owners also give backup coverage.

Question 45

Fabrikam bills Copilot Studio agents through a Power Platform billing plan and Cowork through its default spending policy, both on one Azure subscription. In Azure Cost Management, finance sees all of it under a single Microsoft Copilot Studio service and wants Cowork charges separated from next month on. What should the admin do?

Accepted Answer

Bill the Cowork policy to its own Azure subscription or resource group. The article comparing admin center views with the Azure bill says Cowork, Copilot Studio, and Work IQ API consumption is billed through one Copilot Credits service labeled Microsoft Copilot Studio, and that attributing cost to one service means separating it by Azure subscription or resource group. A Global or Billing Administrator can change an existing spending policy's billing method without recreating the policy.

Question 46

Tailspin Toys' insider risk team wants Insider Risk Management to detect prompt injection attacks and access to protected materials when employees interact with agents managed by Agent 365. Which policy template should the team create its policy from?

Accepted Answer

The Risky AI usage template The Purview page for Agent 365 points Insider Risk Management to the Risky AI usage policy template to detect risky usage that includes prompt injection attacks and access to protected materials. The policy templates page adds that this template scores user prompts and AI responses containing sensitive information in Microsoft 365 Copilot, Microsoft Copilot, and agents, and that its detections feed user risk scoring in Adaptive Protection. The other three templates score file, departure, and device signals rather than AI interactions.

Question 47

Tailspin Toys wants makers who build agents with Microsoft Copilot Agent Builder to stop sharing them with the whole organization. Makers must still be able to share an agent directly with individual colleagues, and no group of makers should keep broad sharing rights. Which configuration under Agents then Settings meets these requirements?

Accepted Answer

Set Sharing to No users, and leave User access at its default of All users. Sharing on the Agent settings page offers All users, No users, and Specific users. No users turns off sharing at the organization level while still letting users share directly with specific individuals, which matches Tailspin's requirement exactly. Specific users restricts broad sharing to designated groups, so a group would keep it. The page also notes that the Sharing control applies only to agents built with Microsoft Copilot Agent Builder, the maker population in this scenario.

Question 48

Woodgrove Bank has 35 assigned Microsoft Copilot licenses and no Viva Insights licenses. Executives who open the Copilot Dashboard want to compare adoption with similar companies, but no benchmarks appear. What has to change before benchmarks are available?

Accepted Answer

Reach at least 50 Copilot licenses or 50 Viva Insights licenses. The Copilot Dashboard is the strategic report in the measurement and reporting pillar of Copilot controls, and its license table decides which features a tenant gets. Tenants with 1 to 49 Copilot licenses get the Readiness page and adoption and impact metrics, but not benchmarks, agent insights, intelligent summaries, or delegation. Those arrive with at least 50 Copilot licenses or at least 50 Viva Insights licenses.

Question 49

Litware's search administrator is bulk importing 40 acronyms into Copilot Search from a CSV file. Legal must approve each definition before users can see it in search results, and the review will take several days. How should the administrator set up the import?

Accepted Answer

Set State to Draft for each row, then move each acronym to Published after approval. The Copilot Search admin experience article gives acronyms three states: Published, which users see in Copilot Search; Draft, which stays out of search results until an admin moves it to Published; and Excluded, which prevents an acronym from appearing. State is a mandatory column in the acronym import file, so importing each row as Draft and publishing after Legal signs off matches the review requirement.

Question 50

Litware's sales team relies on a shared Agent Builder agent that a single employee owns. That owner moves to a new role in two months. The team lead wants a colleague to have full edit rights starting now, while the current owner keeps full access until the move. What should the AI Administrator do in the Microsoft 365 admin center?

Accepted Answer

Open the agent's Owners pane and use Add owner to add the colleague. The governance and lifecycle actions page says Agent Builder agents support multiple owners, and all owners have the same rights to edit, share, manage, and maintain the agent, with no primary or secondary roles. Add owner leaves the current owner in place, so both keep full access during the transition. The departing owner can be removed later, since only the last remaining owner can't be removed.

Question 51

Litware turned on Restricted SharePoint Search in March 2026 with 60 reviewed sites on its allowed list. The Budget Planning site isn't on the list and isn't associated with any hub site, yet a planner who edited two files there last week gets Copilot answers that quote them. What explains this?

Accepted Answer

Restricted SharePoint Search still surfaces files a user recently viewed, edited, or created. The Restricted SharePoint Search page says the feature isn't a security boundary and doesn't guarantee that only allowed sites appear. Results and Copilot responses still draw on files a user viewed, edited, or created, files shared directly with them, and their frequently visited sites, up to the last 2,000 such entities. The planner edited the files last week, so Copilot can use them. The feature is retiring, and new enablement has been blocked since July 31, 2026.

Question 52

Contoso licenses Microsoft 365 E5 for every user and has bought no add-ons. An administrator goes to Agents, then All agents, in the Microsoft 365 admin center and selects an agent on the Registry list. The agent's Security tab shows no details, and the list has no Risks column. What should Contoso buy so both appear?

Accepted Answer

Microsoft Agent 365 licenses, sold per user as an add-on for eligible plans that include E5 The agent details page in the Microsoft 365 admin center says a Microsoft E7 or Agent 365 license is needed to see the Risks column in the Agent Registry and the details on an agent's Security tab, and Contoso's E5 tenant has neither. The Entra licensing page adds that Agent 365 is included in Microsoft 365 E7 and is otherwise sold as an add-on for Microsoft E5, A5, or Business Premium, licensed per user, so buying Agent 365 licenses turns on both views.

Question 53

Woodgrove Bank labels Finance workbooks in Excel for Windows with a label that encrypts them and grants the Finance group the Editor permission level, then saves them to a SharePoint site. Copilot in Excel for Windows summarizes an open workbook, but Copilot Chat never finds or cites these files, SharePoint search can't find words inside them, and Excel for the web can't open them. What should you do?

Accepted Answer

Run Set-SPOTenant -EnableAIPIntegration $true, then have the existing labeled files edited or uploaded again. Until sensitivity labels for Office files in SharePoint and OneDrive are enabled, those services can't process encrypted files, so search, Office for the web, and similar features fail, and Copilot reaches such files only as data in use in Office apps on Windows. Turn it on with Set-SPOTenant -EnableAIPIntegration $true or Turn on now in the Purview portal. Files labeled earlier don't change until they're edited or uploaded again.

Question 54

In Microsoft Purview Data Security Posture Management, the weekly default data risk assessment flags Fabrikam's Deals site: many files contain sensitive information types but carry no sensitivity label. The deal team still needs Copilot to use the site's other content, and the flagged files must end up protected by labels. Which remediation from the site's Protect tab fits this finding?

Accepted Answer

Create an auto-labeling policy, which applies a sensitivity label to files with sensitive data. The data risk assessments page lists four Protect tab actions: restrict access by label, restrict all items, create an auto-labeling policy, and create retention policies. The auto-labeling action is the one for sensitive information found in unlabeled files: Information Protection applies a sensitivity label automatically, so the files gain protection while the rest of the site stays available to Copilot.

Question 55

Two days ago, Tailspin Toys' AI Administrator added the executive team's Microsoft Entra ID group under Manage access settings for Microsoft Copilot Dashboard. The executives can open the dashboard in the Viva Insights web app, but the AI Administrator still can't. What should the admin do?

Accepted Answer

Add their own account in the same access settings and allow up to 24 hours. The article on managing Copilot Dashboard settings notes that the AI Administrator doesn't have automatic access to the Viva Insights web app and must add themselves through the same Manage access settings page. Changes to that access list take effect within 24 hours. The executives got in because their group was added, and the admin's own account wasn't part of it.

Question 56

Fabrikam runs customer-facing Copilot Studio agents on its public website and forecasts about 1.5 million Copilot Credits over the next 12 months, most of it in two seasonal peaks. Finance wants a discount for committing up front, wants credits unused in a quiet month to stay usable later in the year, and wants the agents to keep answering if demand beats the forecast. Which purchasing approach meets all three goals?

Accepted Answer

Buy a Copilot Credit pre-purchase plan sized to the forecast, and keep a pay-as-you-go billing policy linked to cover usage beyond it. The usage-based billing comparison page describes Copilot Credit pre-purchase plans as discounted commit units that cover eligible usage across a one-year term or until the units run out, so a quiet month's credits stay available for the peaks. The same page says usage draws down the pre-purchase balance first and can then bill through pay-as-you-go when it's enabled, which keeps the agents answering past the forecast.

Question 57

Fabrikam's Confidential label encrypts files and assigns the Co-Author permission level to Add all users and groups in your organization. Labels are enabled for Office files in SharePoint and OneDrive, and the files are explicitly shared with an Agent 365 agent instance (preview). The agent instance summarizes unlabeled files but returns nothing from Confidential ones. What should the administrator change?

Accepted Answer

Add the agent instance to the label's encryption settings by name, with at least VIEW and EXTRACT Agent instances, agents with their own identity, are available through the Frontier preview program. The Purview page for Agent 365 sets two conditions for an agent instance to use labeled files: the files must be explicitly shared with it, and label encryption must explicitly grant the agent instance the VIEW and EXTRACT usage rights. It adds that a label configured for Add all users and groups in your organization or Add any authenticated users isn't sufficient. Sharing and label enablement are already in place, so the explicit grant is the missing piece.

Question 58

Woodgrove Bank already licenses Microsoft 365 E5 for every user. A 25-person automation team builds and owns about 400 agents across Copilot Studio and Microsoft Foundry, and the bank wants the generally available Microsoft Agent 365 to observe, govern, and secure them. Which licensing action enables Agent 365 and covers those agents?

Accepted Answer

Assign Agent 365 licenses to the 25 team members, since agents that a licensed user owns or manages need no license of their own. The Agent 365 overview says the product has been generally available for the Commercial segment since May 1, 2026, is licensed per user, and needs at least one user with a qualifying Agent 365 license before it can be enabled. The Frontier program FAQ adds that under general availability every agent managed or owned by a licensed user is covered by that user's Agent 365 or Microsoft 365 E7 license. Licensing the 25 owners covers the 400 agents.

Question 59

Contoso's Copilot program lead holds the AI Administrator role. In Copilot, then Cost Management, she can change the limits and alerts on the existing spending policy, but she can't create the new Cowork spending policy for the Legal group. Which role should she also be given so she can create it?

Accepted Answer

Billing Administrator The usage-based billing role requirements separate editing from creating. AI Administrator and License Administrator can edit spending policies and manage limits and alerts, but they can't create spending policies. Global Administrator and Billing Administrator are the roles that run the initial setup, which activates the default spending policy, and that set billing methods in policies, so Billing Administrator lets her add the Legal policy without Global Administrator.

Question 60

Fabrikam runs production agents in Amazon Bedrock and Google Vertex AI. The AI administrator wants those agents listed in the agent registry in the Microsoft 365 admin center for central visibility and governance, without asking the agent teams to do any development work. What should the administrator do?

Accepted Answer

From the All agents page, open Connected platforms, connect each environment with its credentials, then select Sync agents. Connected platforms is the registry's route for agents that live on external AI platforms, and Amazon Bedrock and Google Vertex AI are both supported. From its web part on the All agents page, the administrator selects Manage, adds a connection per environment with its platform, region, and credentials, validates and saves it, and then selects Sync agents to pull those agents into the registry. Nothing changes in the agents' code, so the teams do no development work.

Question 61

At Woodgrove Bank, User access under Agents then Settings is set to Specific users/groups with only the AI-Pilot group selected. A loan officer who isn't in AI-Pilot can't use an agent whose Available to setting is All users in the organization. The bank wants this officer to use agents without opening agents to every employee. What should the administrator do?

Accepted Answer

Add the loan officer, or a security group that contains the officer, to the User access setting. User access under Agents then Settings is the tenant-wide gate on using agents. With Specific users/groups selected, the Agent settings page says only the users or groups picked there can use agents, even if they have permission to install and use agents from the registry. Available to is already All users, so the officer's block comes from User access; adding the officer, or a group containing the officer, fixes it for that person without opening agents to everyone.

Question 62

Litware's on-call team wants Service health email only when a Copilot problem makes the service or a major function unavailable. It doesn't want mail about problems that affect some users and usually come with a workaround. What should the admin configure?

Accepted Answer

Customize, then Email in Service health, with incidents selected and advisories cleared The service health article defines an incident as a critical issue in which the service or a major function is unavailable, and an advisory as a problem affecting some users while the service stays available, often with a workaround. Under Customize, then Email, each admin chooses incidents or advisories, the services to cover, and up to two addresses, so incidents only for Copilot matches the on-call rule.

Question 63

Fabrikam creates new claims-processing agent identities from one agent identity blueprint every week. Security wants a single Conditional Access policy that blocks every claims agent, current and future, from a finance API registered in Microsoft Entra ID. No step may be required per new agent, and agents built from other blueprints must stay out of scope. How should the policy's agent assignment be set?

Accepted Answer

Include the claims blueprint so every agent identity derived from it is covered. The Conditional Access for agents page says a policy applied at the agent identity blueprint level automatically covers all agent identities derived from it, including new ones added in the future. In the policy builder, the blueprint is picked on the Agent blueprint principals tab of the agent selection. That meets both constraints: no action per new agent, and agents from other blueprints are never in scope.

Question 64

Woodgrove Bank's change board wants most users to receive deferred-capable Copilot updates later so it can validate them first. A 40-member IT pilot security group must get the same updates as soon as they reach general availability. The admin opens Copilot release preferences: General Availability in Copilot settings. What should she configure?

Accepted Answer

Select Deferred Release, then add the IT pilot group as an exception so it stays on Standard Release. Copilot release preferences offer Standard Release, the default, and Deferred Release, which holds major deferred-capable updates for 30 days after the Standard rollout begins. You choose the option most users should get, then add up to 100 exceptions to the other one, and each member of an excepted group counts toward that limit. Deferred Release with the 40-member pilot group excepted to Standard gives the pilot general availability timing while everyone else waits.

AB-650 practice questions, with full explanations

The AB-650 bookshelf

Work the 75 questions, one topic at a time

Microsoft 365 Tenant Administration (11 questions)

Contoso wants Microsoft 365 Backup to protect its SharePoint sites and executive mailboxes. A SharePoint Administrator opens Settings, then Microsoft 365 Backup, in the Microsoft 365 admin center for the first time. What must be in place before any backup policy can protect content?

Fabrikam's IT operations manager reviews Service health every morning. It never lists the Exchange Online planned maintenance that Microsoft schedules, and she wants one place to follow planned maintenance and upcoming changes her team may need to prepare for. Where should she look?

Authentication and Conditional Access (6 questions)

A Tailspin Toys user sees error AADSTS53003 when opening a line-of-business web app. The help desk finds the failed event in the Microsoft Entra sign-in logs. Where should they look first to identify the policy that stopped the sign-in?

Microsoft Defender XDR (7 questions)

Fabrikam's quarantine policies let users request the release of their quarantined messages. The service desk team, rather than the administrators who get these emails today, must receive the notification emails that user release requests generate. What should the administrator change?

Entra ID Fundamentals (7 questions)

Litware set its guest invite settings to Only users assigned to specific admin roles can invite guest users. A project coordinator must now invite vendor staff as B2B guests for a new project and should hold no other administrative permissions. Which role should you assign to the coordinator?

Data Loss Prevention (4 questions)

Litware has 3,000 Windows 11 devices that are already onboarded to Microsoft Defender for Endpoint through Intune. The compliance team wants Endpoint DLP policies to apply to these devices with the least administrative effort. What should the admin do?

Contoso has Microsoft 365 E3 with no compliance or security add-ons. The DLP admin turns on single-event alerts in the Exchange, SharePoint, and OneDrive policies, and the security team asks where its analysts should triage those alerts. Where should the admin point them?

Copilot, agents and AI services (30 questions)

Litware's records team wants members of the Research group to stop creating new Copilot Pages and Copilot Notebooks in the Microsoft Copilot app. Loop workspaces must keep working for everyone, and nobody outside Research should be affected. What should the Office Apps admin do?

Tailspin Toys' insider risk team wants Insider Risk Management to detect prompt injection attacks and access to protected materials when employees interact with agents managed by Agent 365. Which policy template should the team create its policy from?

Woodgrove Bank has 35 assigned Microsoft Copilot licenses and no Viva Insights licenses. Executives who open the Copilot Dashboard want to compare adoption with similar companies, but no benchmarks appear. What has to change before benchmarks are available?

Litware's search administrator is bulk importing 40 acronyms into Copilot Search from a CSV file. Legal must approve each definition before users can see it in search results, and the review will take several days. How should the administrator set up the import?

Litware turned on Restricted SharePoint Search in March 2026 with 60 reviewed sites on its allowed list. The Budget Planning site isn't on the list and isn't associated with any hub site, yet a planner who edited two files there last week gets Copilot answers that quote them. What explains this?

Two days ago, Tailspin Toys' AI Administrator added the executive team's Microsoft Entra ID group under Manage access settings for Microsoft Copilot Dashboard. The executives can open the dashboard in the Viva Insights web app, but the AI Administrator still can't. What should the admin do?

Contoso's Copilot program lead holds the AI Administrator role. In Copilot, then Cost Management, she can change the limits and alerts on the existing spending policy, but she can't create the new Cowork spending policy for the Legal group. Which role should she also be given so she can create it?

Litware's on-call team wants Service health email only when a Copilot problem makes the service or a major function unavailable. It doesn't want mail about problems that affect some users and usually come with a workaround. What should the admin configure?

A Reports Reader at Litware exports the Copilot usage report and finds anonymized values where user names should be. The privacy office approves showing names so managers can follow up with inactive users. What change reveals the names?

Mixed objectives (10 questions)

Contoso's Merger team finished its project. Members must still be able to read every conversation and file for the next two years, but no one may post new messages and members may not edit files. The team might need to be reactivated if the deal reopens. What should the Teams administrator do?

Contoso's CISO wants Copilot kept out of meetings organized by the Acquisitions team. An admin set the Copilot setting in the Acquisitions team's meeting policy to Off. Three weeks later, licensed attendees used Copilot throughout a meeting organized by an Acquisitions analyst. What explains this?

Litware's legal team stores signed contracts in a SharePoint site. They want contract owners to declare individual contracts as records so they can't be edited or deleted, and they want a named reviewer to approve deletion when each contract reaches 10 years. Which approach meets both requirements?

Litware requires approval to activate the Exchange Administrator role in Privileged Identity Management, and the role settings name no approvers. Tomas, who is eligible for the role, submits an activation request with a justification. Who can approve the request?

Other certification question sets