Pass the Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate AB-650 Questions and answers with Dumpstech

Converting an existing Exchange Online user mailbox into a shared mailbox allows multiple employees to manage correspondence while preserving its existing messages, calendar information, and mailbox content.

Option B is correct because it satisfies the storage, access, and sender identity requirements.

The critical consideration is the mailbox size. Mailbox1 contains 72 GB of data, exceeding the 50 GB storage limit for an unlicensed shared mailbox. Microsoft requires an appropriate license, such as Exchange Online Plan 2, to increase a shared mailbox ' s primary mailbox capacity to 100 GB.

Consequently, the mailbox must retain suitable licensing after conversion.

Full Access permissions allow support users to open Mailbox1 and manage its existing content. Send As permissions enable users to send replies that appear to originate directly from support@contoso.com, without displaying the individual delegate ' s identity.

Option A is incorrect because removing the license would leave the 72 GB mailbox above the unlicensed shared mailbox storage limit.

Option C is incorrect because Send on Behalf displays the delegate ' s identity and also proposes removing the required license.

Option D does not preserve the existing mailbox as a shared mailbox with the specified delegation permissions.

The appropriate configuration is therefore to convert Mailbox1, grant Full Access and Send As, and retain the necessary license.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox

https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes

Microsoft Purview Information Protection provides data classification, sensitivity labeling, and protection capabilities for organizational information. However, Information Protection alone does not provide the dedicated investigation workflow required to identify individual AI agent interactions containing confidential information in prompts or responses.

The more appropriate solution is Microsoft Purview Data Security Posture Management (DSPM), using its AI observability and Activity explorer capabilities.

Microsoft DSPM supports visibility into AI agent activities, including Microsoft Agent 365. It can identify interactions involving sensitive information through integrated data classification, audit telemetry, sensitive information types, and trainable classifiers.

Administrators can navigate to the Microsoft Purview portal, open DSPM, and use Discover → Activity explorer → AI activities to investigate AI interactions. The AI observability page also provides agent-specific visibility into potentially sensitive interactions and associated risks.

Microsoft Purview Information Protection contributes classification and labeling capabilities to this process, but simply using Information Protection does not independently deliver the required agent-interaction investigation.

Therefore, the proposed solution does not fully satisfy the requirement, making Option B (No) the appropriate answer.

Microsoft References:

https://learn.microsoft.com/en-us/purview/ai-agent-365

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

Microsoft Entra pass-through authentication (PTA) enables users to authenticate to Microsoft 365 using their existing on-premises Active Directory credentials while ensuring that password validation occurs against the on-premises Active Directory environment.

With pass-through authentication, Microsoft Entra ID receives the cloud sign-in request and communicates with a pass-through authentication agent installed on an on-premises, domain-joined Windows Server.

The agent validates the submitted credentials against Active Directory Domain Services and returns the authentication result to Microsoft Entra ID.

This approach allows organizations to maintain password validation against their existing domain controllers while providing users with access to Microsoft 365 cloud services.

Option B is incorrect because Microsoft Entra seamless single sign-on reduces authentication prompts for domain-joined users but does not independently determine where password validation occurs.

Option C is incorrect because certificate-based authentication uses X.509 certificates rather than authenticating users through their existing domain passwords.

Option D is incorrect because password hash synchronization enables Microsoft Entra ID to validate passwords in the cloud using synchronized password hashes. It does not satisfy the requirement that password authentication occur against the on-premises domain.

Pass-through authentication therefore meets both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta

Administrative unit members: The Branch1 users and Group1; Role to assign to Helpdesk1: User Administrator

Microsoft Entra administrative units enable organizations to delegate administrative permissions to specific subsets of directory objects, avoiding tenant-wide administrative assignments.

First selection: The Branch1 users and Group1.

The administrative unit must contain both the individual Branch1 user objects and the Group1 security group.

Including Branch1 users enables delegated administrators to manage those users within the administrative unit ' s scope. Including Group1 enables administrators to manage the group ' s properties and membership.

Microsoft specifically distinguishes between adding a security group and adding its members to an administrative unit. Adding Group1 does not automatically add its users. Therefore, selecting Group1 alone would not satisfy the password-reset requirement.

Second selection: User Administrator.

The User Administrator role provides permissions to manage supported user properties, reset passwords for eligible nonprivileged users, and manage group memberships.

When assigned at the administrative-unit scope, the role restricts its administrative operations to the applicable objects within that unit.

The Helpdesk Administrator role supports password-related helpdesk tasks but does not grant the broader group membership management capability required.

The Groups Administrator role focuses on group management without the necessary user password-reset capability.

Privileged Role Administrator provides excessive permissions for the scenario.

Therefore, the administrative unit must contain the Branch1 users and Group1, with Helpdesk1 assigned the scoped User Administrator role.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-members-add

The Microsoft 365 Copilot Agent usage report provides centralized reporting on the adoption and activity of agents used through Microsoft 365 Copilot Chat and supported Microsoft 365 applications.

Option B is correct because the report supports usage analysis over the previous 7 or 30 days and provides agent-specific activity information.

Administrators can access the report through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft 365 Copilot, and Agents.

The report includes information about active agents, active users, agent responses, and usage trends. Its daily time-series reporting helps administrators examine usage patterns, while agent-level details support comparisons between Agent1 and Agent2.

Option A is incorrect because Microsoft Defender for Cloud Apps app governance primarily focuses on application permissions, OAuth applications, and associated security risks rather than Copilot agent activity reporting.

Option C is incorrect because billing and usage information primarily addresses consumption and associated charges rather than providing the complete agent adoption and activity reporting requested.

Option D is incorrect because Microsoft Purview Audit provides event-level audit records. Although relevant activities may be recorded, it is not the most direct reporting solution for comparing agent usage.

Therefore, the Microsoft 365 Copilot Agent usage report is the appropriate selection.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-agents-new

Microsoft SharePoint Restricted Access Control enables administrators to restrict access to a SharePoint site and its content to members of designated Microsoft Entra security groups or Microsoft 365 groups.

Option B is correct because Restricted Access Control adds an additional authorization requirement without replacing the site ' s existing SharePoint permissions.

When Group1 is configured as the restricted access control group for Site1, users must satisfy two conditions before accessing its documents: they must belong to Group1 and possess appropriate existing SharePoint permissions.

Users outside Group1 are denied access even when they previously received direct permissions or sharing links.

This protection also applies to Microsoft 365 Copilot and organization-wide search experiences. Microsoft Copilot respects the effective SharePoint authorization boundaries, preventing unauthorized users from accessing restricted content through Copilot responses.

Option A is incorrect because Microsoft 365 Archive is intended for inactive content storage rather than enforcing group-based authorization.

Option C is incorrect because Restricted SharePoint Search controls content discoverability, not the underlying ability to open files.

Option D is incorrect because Restricted Content Discovery limits search and Copilot discovery without enforcing the required group-based access restrictions.

Restricted Access Control therefore satisfies the complete requirement while preserving the existing permission structure.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-access-control

Ensure that User1 can invite the contoso.com users to Teams: Assign the Guest Inviter role to User1.; Ensure that only the contoso.com users can be invited as guests to the Microsoft Entra tenant: From the External collaboration settings, edit the Collaboration restrictions settings.

Microsoft Entra External ID provides separate administrative controls for guest invitation permissions and permitted external collaboration domains.

First selection: Assign the Guest Inviter role to User1.

The tenant currently permits guest invitations only from users assigned specific administrative roles. Assigning the Guest Inviter role allows User1 to invite external collaborators without granting broader privileges such as Global Administrator or User Administrator.

This satisfies the principle of least privilege because User1 receives the permission necessary to perform guest invitations without unnecessary administrative authority.

Second selection: Edit the Collaboration restrictions settings.

Microsoft Entra External collaboration settings provide domain-based controls for external invitations. To restrict guest invitations to contoso.com, administrators must configure Collaboration restrictions to allow invitations only to specified domains and add contoso.com to the permitted domain list.

This prevents invitations to users from other external domains while allowing authorized inviters, including User1, to invite users from contoso.com.

Cross-tenant outbound access settings do not provide the required tenant-wide invitation domain allowlist. Guest user access restrictions control what existing guests can see in the directory rather than which domains can be invited.

Both configurations are necessary to satisfy the stated requirements.

Microsoft References:

https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure

https://learn.microsoft.com/en-us/entra/external-id/allow-deny-list

Agent1: Publish the agent for Group1.; Agent2: Reject the submission.

Microsoft 365 Agent Registry provides an administrative approval workflow for agents submitted for organizational deployment. Requests marked Pending review require an administrator to evaluate the agent before publication.

Agent1: Publish the agent for Group1. Agent1 has passed the pilot approval process and must be deployed to a specific security group. Publishing the agent through the Microsoft 365 admin center enables administrators to select Group1 as the intended audience and complete the agent ' s security and permission review.

Because the requirement specifies that the agent must appear automatically, administrators must also select the appropriate preinstallation option during publication. Publishing alone makes an agent available for installation; preinstallation ensures that users do not need to install it manually.

Agent2: Reject the submission. Agent2 connects to an unapproved external data source, introducing a potential data governance and security risk. Rejecting its submission prevents the agent from becoming available to organizational users.

Granting admin consent would not resolve the unauthorized data-source risk, while updating the agent in the store is inappropriate for a newly submitted agent awaiting approval.

Therefore, publishing Agent1 for Group1 with preinstallation and rejecting Agent2 meets the stated requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-requests

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-actions

Microsoft Agent 365 provides centralized governance settings in the Microsoft 365 admin center to control who can interact with AI agents and who can distribute agents throughout the organization.

First selection: User access.

The User access setting determines which users or security groups are permitted to access and interact with agents.

Administrators can navigate to Microsoft 365 admin center → Agents → Settings → User access.

Under the access configuration, administrators should select Specific users or groups and assign Group1.

This restricts agent interaction to members of Group1 and prevents users outside the approved group from accessing agents through the governed experience.

Second selection: Sharing.

The Sharing setting determines which users can distribute agents created through Microsoft Copilot Agent Builder.

Administrators should navigate to Agents → Settings → Sharing, select Specific users or groups, and assign Group2.

This permits members of Group2 to distribute agents organization-wide while preventing other users from using organization-wide sharing.

The remaining settings serve different purposes. Agent Management Rules automate governance actions, Allowed agent types controls permitted publisher categories, and Policy template provides predefined governance configurations.

Therefore, User access controls agent interaction, while Sharing controls organization-wide distribution.

Microsoft Purview retention labels control how long content must be preserved and what action occurs after the configured retention period expires.

Option B is the intended examination answer, based on the default retention-period start date.

The exhibit shows Retention1 configured with a six-month retention period and the Retain and Delete action.

Microsoft documents that retention periods start from the content creation date by default, unless the label is explicitly configured to use another trigger.

File1 was created on January 1, 2025. Therefore, its six-month retention period ends on July 1, 2025.

The modification on January 10 does not reset the retention period under the default configuration. Similarly, deleting File1 on February 1 does not override the retention requirement.

Option A ignores the retention configuration. Option C would apply if retention began on the last modification date. Option D incorrectly calculates six months from the user-initiated deletion.

Important technical distinction: The question says permanently and unrecoverable. Microsoft ' s current SharePoint and OneDrive documentation states that retained content is subsequently moved through the Recycle Bin, where an additional 93-day recovery period can apply. Consequently, July 2025 represents the intended retention expiration and deletion processing date, not necessarily the final irreversible deletion date. Strictly interpreted, none of the options guarantees that outcome.

Microsoft References:

Microsoft Learn — Retention policies and labels .

Microsoft Learn — Retention behavior for SharePoint and OneDrive .