Pass the Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate AB-650 Questions and answers with Dumpstech

Microsoft Exchange Online supports shared mailbox creation and delegated mailbox permission management through both the Microsoft 365 admin center and Exchange admin center (EAC).

First selection: Exchange admin center and Microsoft 365 admin center only.

Administrators can create shared mailboxes through either administrative interface.

In the Microsoft 365 admin center, navigate to Teams & groups → Shared mailboxes → Add a shared mailbox.

Alternatively, in the Exchange admin center, navigate to Recipients → Mailboxes → Add a shared mailbox.

Both interfaces support creating Mbox1 and configuring its basic mailbox properties.

Second selection: Exchange admin center and Microsoft 365 admin center only.

Both portals support granting Send As permissions.

In the Microsoft 365 admin center, select Mbox1 under Shared mailboxes and open Manage mailbox permissions.

In the Exchange admin center, select Mbox1 under Recipients, open Manage mailbox delegation, and configure Send As permissions for User1.

The Send As permission enables User1 to send messages that appear to originate directly from Mbox1 without displaying User1 as the sender.

The Microsoft Entra admin center manages identity objects, roles, groups, and authentication settings. It does not provide the Exchange mailbox creation and mailbox delegation interfaces required by this question.

Therefore, both tasks can be performed through the Exchange admin center and Microsoft 365 admin center.

Microsoft References:

Microsoft Learn — Shared mailboxes in Exchange Online .

Microsoft Learn — Create a shared mailbox .

Microsoft Learn — Configure shared mailbox permissions

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access through eligible role assignments. This capability allows administrators to grant temporary access to sensitive Microsoft Entra administrator roles without maintaining permanent privileged permissions.

When engineers are assigned as eligible for an administrator role, they do not immediately receive the role ' s active privileges. Instead, they must activate the role before performing privileged administrative tasks.

The activation process can require multifactor authentication, justification, approval, or other security controls, depending on the configured PIM role settings.

Administrators can define a maximum activation duration. Once the activation period expires, the active role assignment expires automatically, and the user must activate the role again before performing privileged operations.

Option A is incorrect because access packages manage access to resources but do not inherently implement just-in-time activation for Microsoft Entra administrator roles.

Option B is incorrect because administrative units restrict the scope of delegated administration without providing automatic role activation and expiration.

Option D is incorrect because active membership in a role-assignable group grants privileges without requiring activation.

Therefore, PIM eligible role assignments satisfy both requirements: explicit activation and automatic expiration.

Microsoft References:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

Microsoft Entra self-service password reset (SSPR) allows users to reset their passwords without contacting an administrator or helpdesk. Administrators can configure which authentication methods users must complete to verify their identities.

Option A is correct because Authentication methods controls the verification methods available during password reset, including Microsoft Authenticator push notifications.

In the legacy SSPR configuration, administrators navigate to Microsoft Entra admin center → Entra ID → Password reset → Authentication methods.

The Mobile app notification method allows users to verify their identities by responding to a Microsoft Authenticator notification.

An important configuration consideration is that the legacy SSPR experience supports app notifications when two authentication methods are required for password reset. When only one method is required, the mobile application verification code is supported instead.

To restrict the pilot to Group1, administrators must separately configure Properties, enable SSPR for selected users, and select Group1.

Option B configures administrator-specific password reset requirements. Option C controls SSPR enablement and targeting, but not the authentication method itself. Option D controls registration requirements, and Option E configures password reset notifications.

Current documentation qualification: Microsoft has deprecated management of authentication methods through legacy SSPR policies. For new deployments, administrators should configure Microsoft Authenticator through the centralized Authentication methods policy.

Microsoft Exchange Online supports converting an existing user mailbox to a shared mailbox while retaining its historical email content. This is appropriate when the original user no longer needs direct access but other employees must continue using the mailbox.

Option C is correct because converting Mailbox1 into a shared mailbox preserves the existing email messages and enables delegated access for other users.

The mailbox contains 42 GB of data, which is below the standard 50 GB unlicensed shared mailbox limit. Therefore, an additional mailbox license is not required solely because of its current size, provided no separately licensed features are necessary.

Option B is correct because Full Access permission allows Group1 members to open the mailbox and manage existing items. Send As permission enables them to send messages that appear to originate directly from Mailbox1.

Option E is incorrect because Send on Behalf permission displays the individual delegate ' s identity, whereas the requirement specifies that messages must appear to come from Mailbox1.

Option D is incorrect because Litigation Hold is designed for preservation and compliance purposes, not for providing collaborative mailbox access.

Option A is unnecessary for a standard shared mailbox of this size.

Therefore, converting the mailbox and granting Full Access and Send As permissions satisfies all three requirements.

Microsoft References:

https://learn.microsoft.com/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/create-shared-mailboxes

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.