Microsoft AB-650 Dumps

You can add a Microsoft Entra cloud user to: Group1, Group2, and Group3; You can add Group5 to: Group1 and 3 only

Microsoft Entra group membership is governed by group type, membership assignment method, and source of authority.

First selection: Group1, Group2, and Group3.

The exhibit identifies Group1 and Group2 as cloud-managed Microsoft 365 groups using assigned membership. Microsoft 365 groups support user membership regardless of whether the group ' s Security enabled property is set to Yes or No.

Group3 is a cloud-managed security group with assigned membership, so administrators can also add a Microsoft Entra user directly.

Group4 uses dynamic membership, meaning users are included automatically according to configured rules rather than manually assigned.

Group5 originates from Windows Server Active Directory. Its membership is managed by the authoritative on-premises directory.

Second selection: Group1 and Group3 only.

Microsoft Entra supports nesting security groups within other compatible security groups. Consequently, Group5 can be added as a member of Group3.

Microsoft 365 groups do not support groups as members, and dynamic group membership cannot be manually modified.

The first answer above reflects Microsoft ' s documented group membership behavior rather than simply reproducing the recording ' s selected response.

Microsoft References:

Microsoft 365 admin center provides centralized Agent settings to control both the categories of agents permitted within an organization and the users authorized to access them.

Option B, User access, is correct. This setting determines which users and groups can interact with organizational agents. Administrators should select the option for specific users or groups and assign Group1. This ensures that members of Group1 can use permitted agents while users outside the group are excluded from the pilot.

Option E, Allowed agent types, is correct. This setting controls which publisher categories are permitted. Administrators should allow agents developed by Microsoft and the organization while disabling agents from external publishers.

This configuration enables Group1 members to use Agent1 and approved Microsoft agents without allowing third-party agents.

Option A is incorrect because policy templates apply predefined governance and security configurations rather than defining the combination of user access and agent publisher categories.

Option C controls agent-sharing behavior rather than the overall ability to interact with agents.

Option D provides rules for agent management and lifecycle activities but does not replace the specific access and publisher controls required.

Microsoft ' s current documentation refers to Allowed agent types as Agent and plugin access. The underlying publisher restrictions remain consistent with the question.

Microsoft References:

Microsoft Entra ID supports the ForceDelete operation for removing custom domains that still have references to directory objects. This operation automatically updates supported references, reducing the need for manual administrative changes.

Option C is correct because the domain meets the main ForceDelete prerequisites: it uses managed authentication, is not the default domain, and has fewer than 1,000 references.

However, Microsoft explicitly requires administrators to update or remove domain references from Exchange-managed objects, including mail-enabled security groups and distribution lists, before executing ForceDelete.

After these references are removed, ForceDelete can automatically update eligible user principal names, email addresses, proxy addresses, group addresses, and application identifier URIs to the tenant ' s initial onmicrosoft.com domain.

Option A is incorrect because manually updating all 750 references creates unnecessary administrative effort.

Option B is incorrect because ForceDelete cannot automatically remove all Exchange-managed dependencies. The mail-enabled security group references must be corrected first.

Option D is incorrect because a default domain cannot be deleted while it remains designated as the default.

Therefore, clearing the Exchange-managed references and using ForceDelete is the most efficient supported approach.

Microsoft References:

Microsoft Learn — Manage custom domain names and ForceDelete .

Microsoft Graph — domain: forceDelete .

Microsoft Entra administrative units provide role-based administrative delegation restricted to specific users, groups, or devices. They enable organizations to distribute administrative responsibilities without granting permissions across the entire tenant.

First selection: An administrator unit.

An administrative unit allows Contoso to organize Branch1 users and restrict Admin1 ' s administrative scope to those users.

To minimize administrative effort, configure dynamic user membership based on the Office location attribute:

(user.physicalDeliveryOfficeName -eq " Branch1 " )

This rule automatically includes users whose Office location is Branch1 and removes users when their relevant attribute no longer matches.

A Microsoft 365 group or security group alone cannot restrict the scope of a Microsoft Entra administrator role to its individual members.

Second selection: User Administrator.

The User Administrator role provides the necessary permissions to reset supported user passwords, assign or remove licenses, and modify user attributes.

Assigning this role to Admin1 at the scope of the Branch1 administrative unit, rather than at tenant scope, restricts those administrative operations to users within that unit.

The Helpdesk Administrator and Password Administrator roles provide password-management capabilities but do not grant the complete user and license administration permissions required.

Therefore, an administrative unit combined with an administrative-unit-scoped User Administrator role satisfies all requirements.

Microsoft Purview Information Protection provides data classification, sensitivity labeling, and protection capabilities for organizational information. However, Information Protection alone does not provide the dedicated investigation workflow required to identify individual AI agent interactions containing confidential information in prompts or responses.

The more appropriate solution is Microsoft Purview Data Security Posture Management (DSPM), using its AI observability and Activity explorer capabilities.

Microsoft DSPM supports visibility into AI agent activities, including Microsoft Agent 365. It can identify interactions involving sensitive information through integrated data classification, audit telemetry, sensitive information types, and trainable classifiers.

Administrators can navigate to the Microsoft Purview portal, open DSPM, and use Discover → Activity explorer → AI activities to investigate AI interactions. The AI observability page also provides agent-specific visibility into potentially sensitive interactions and associated risks.

Microsoft Purview Information Protection contributes classification and labeling capabilities to this process, but simply using Information Protection does not independently deliver the required agent-interaction investigation.

Therefore, the proposed solution does not fully satisfy the requirement, making Option B (No) the appropriate answer.

Microsoft References:

The Microsoft 365 Copilot Agent usage report provides centralized reporting on the adoption and activity of agents used through Microsoft 365 Copilot Chat and supported Microsoft 365 applications.

Option B is correct because the report supports usage analysis over the previous 7 or 30 days and provides agent-specific activity information.

Administrators can access the report through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft 365 Copilot, and Agents.

The report includes information about active agents, active users, agent responses, and usage trends. Its daily time-series reporting helps administrators examine usage patterns, while agent-level details support comparisons between Agent1 and Agent2.

Option A is incorrect because Microsoft Defender for Cloud Apps app governance primarily focuses on application permissions, OAuth applications, and associated security risks rather than Copilot agent activity reporting.

Option C is incorrect because billing and usage information primarily addresses consumption and associated charges rather than providing the complete agent adoption and activity reporting requested.

Option D is incorrect because Microsoft Purview Audit provides event-level audit records. Although relevant activities may be recorded, it is not the most direct reporting solution for comparing agent usage.

Therefore, the Microsoft 365 Copilot Agent usage report is the appropriate selection.

Microsoft References:

Microsoft Entra ID Governance provides entitlement management through access packages, enabling organizations to automate access requests, approvals, assignments, and expiration.

Option A is correct because access packages support both required capabilities: self-service access requests with approval and automatic revocation when the approved assignment expires.

Administrators can create an access package containing the resources or groups that grant access to Agent1. They then configure an assignment policy that allows eligible contractors to request access.

On the policy ' s Requests settings, administrators can enable approval and designate the appropriate approvers. This ensures that contractors cannot receive access without authorization.

On the Lifecycle settings, administrators can configure access package assignments to expire after a specified number of days. Setting the duration to 30 days automatically ends the assignment at the end of the project.

Option B is incorrect because PIM primarily manages just-in-time privileged role and group access, rather than the complete self-service entitlement management process requested.

Option C is incorrect because Conditional Access evaluates access conditions but does not independently provide request approval and assignment expiration.

Option D is incorrect because recurring access reviews periodically assess existing access instead of providing the required initial request-and-approval workflow.

Therefore, an access package meets both requirements.

Microsoft References:

Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti-spam policies.

The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.

Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only. It cannot override the Standard preset security policy.

Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group ' s members. These users can then be evaluated by Policy1, provided its recipient conditions match.

Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.

Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.

Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.

Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.

Therefore, Group1 must be excluded from the Standard preset security policy.

Microsoft References:

Agent1: Publish the agent for Group1.; Agent2: Reject the submission.

Microsoft 365 Agent Registry provides an administrative approval workflow for agents submitted for organizational deployment. Requests marked Pending review require an administrator to evaluate the agent before publication.

Agent1: Publish the agent for Group1. Agent1 has passed the pilot approval process and must be deployed to a specific security group. Publishing the agent through the Microsoft 365 admin center enables administrators to select Group1 as the intended audience and complete the agent ' s security and permission review.

Because the requirement specifies that the agent must appear automatically, administrators must also select the appropriate preinstallation option during publication. Publishing alone makes an agent available for installation; preinstallation ensures that users do not need to install it manually.

Agent2: Reject the submission. Agent2 connects to an unapproved external data source, introducing a potential data governance and security risk. Rejecting its submission prevents the agent from becoming available to organizational users.

Granting admin consent would not resolve the unauthorized data-source risk, while updating the agent in the store is inappropriate for a newly submitted agent awaiting approval.

Therefore, publishing Agent1 for Group1 with preinstallation and rejecting Agent2 meets the stated requirements.

Microsoft References:

Track the number of unique Site1 pages visited by users: From the Microsoft 365 admin center, review the SharePoint site usage reports.; Monitor the Site1 collection storage quotas: From the SharePoint admin center, review the Active sites page.

Microsoft 365 provides both analytical usage reporting and administrative site-management capabilities for SharePoint Online. These functions serve different monitoring requirements.

First selection: SharePoint site usage reports.

The Microsoft 365 admin center includes SharePoint site usage reports that provide information about site activity, storage consumption, and user engagement.

The report contains a metric named Pages visited, representing the number of unique pages visited on a SharePoint site during the reporting period. This differs from Page views, which represents the total number of page views, including repeated visits.

Administrators can access this information through Reports, Usage, and SharePoint site usage.

Second selection: Active sites page.

The SharePoint admin center provides the Active sites page for managing and monitoring individual SharePoint sites.

Administrators can select Site1 and inspect information such as allocated storage, current storage consumption, and site details. When manual storage limits are configured, administrators can also review or change the site ' s storage allocation.

The Microsoft 365 usage report is designed primarily for analytical reporting, while the SharePoint Active sites page provides administrative oversight of site collections and their storage configurations.

Therefore, the two selected administrative locations satisfy the requirements.

Microsoft References:

Microsoft Purview retention labels control how long content must be preserved and what action occurs after the configured retention period expires.

Option B is the intended examination answer, based on the default retention-period start date.

The exhibit shows Retention1 configured with a six-month retention period and the Retain and Delete action.

Microsoft documents that retention periods start from the content creation date by default, unless the label is explicitly configured to use another trigger.

File1 was created on January 1, 2025. Therefore, its six-month retention period ends on July 1, 2025.

The modification on January 10 does not reset the retention period under the default configuration. Similarly, deleting File1 on February 1 does not override the retention requirement.

Option A ignores the retention configuration. Option C would apply if retention began on the last modification date. Option D incorrectly calculates six months from the user-initiated deletion.

Important technical distinction: The question says permanently and unrecoverable. Microsoft ' s current SharePoint and OneDrive documentation states that retained content is subsequently moved through the Recycle Bin, where an additional 93-day recovery period can apply. Consequently, July 2025 represents the intended retention expiration and deletion processing date, not necessarily the final irreversible deletion date. Strictly interpreted, none of the options guarantees that outcome.

Microsoft References:

Microsoft Learn — Retention policies and labels .

Microsoft Learn — Retention behavior for SharePoint and OneDrive .

The Microsoft 365 Copilot usage report provides organizational insights into how licensed users adopt and interact with Microsoft 365 Copilot across supported Microsoft 365 applications.

Option C is correct because the report is specifically designed to measure Copilot adoption, engagement, and utilization among enabled users.

Administrators can access it through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft Copilot, and the Copilot usage report.

The report provides metrics such as enabled users, active users, active-user rates, and adoption trends across Microsoft 365 workloads, including Word, Excel, PowerPoint, Outlook, and Teams.

It also provides historical trend views that management can use to evaluate whether licensed employees are adopting Copilot over time.

Option A is incorrect because the Copilot Chat usage report focuses on conversational activity in Copilot Chat rather than providing the broader licensed Copilot adoption reporting requested.

Option B is incorrect because Copilot credits reporting focuses on usage-based consumption and associated billing rather than adoption patterns among licensed users.

Option D is incorrect because the Microsoft 365 apps usage report measures application activity more generally, rather than Copilot-specific adoption.

Therefore, the Microsoft 365 Copilot usage report provides the appropriate management evidence.

Microsoft References:

Converting an existing Exchange Online user mailbox into a shared mailbox allows multiple employees to manage correspondence while preserving its existing messages, calendar information, and mailbox content.

Option B is correct because it satisfies the storage, access, and sender identity requirements.

The critical consideration is the mailbox size. Mailbox1 contains 72 GB of data, exceeding the 50 GB storage limit for an unlicensed shared mailbox. Microsoft requires an appropriate license, such as Exchange Online Plan 2, to increase a shared mailbox ' s primary mailbox capacity to 100 GB.

Consequently, the mailbox must retain suitable licensing after conversion.

Full Access permissions allow support users to open Mailbox1 and manage its existing content. Send As permissions enable users to send replies that appear to originate directly from support@contoso.com, without displaying the individual delegate ' s identity.

Option A is incorrect because removing the license would leave the 72 GB mailbox above the unlicensed shared mailbox storage limit.

Option C is incorrect because Send on Behalf displays the delegate ' s identity and also proposes removing the required license.

Option D does not preserve the existing mailbox as a shared mailbox with the specified delegation permissions.

The appropriate configuration is therefore to convert Mailbox1, grant Full Access and Send As, and retain the necessary license.

Microsoft References:

Microsoft 365 Copilot requires supported Microsoft 365 applications to provide integrated AI functionality in desktop Word, Excel, PowerPoint, and other Office applications.

The sales department already has Microsoft 365 E3 and Microsoft 365 Copilot licenses. Consequently, the primary issue is not the licensing configuration but the installed Office application version.

Option B is correct because deploying Microsoft 365 Apps provides the continuously updated desktop applications that support Copilot integration. Administrators must ensure that users are signed in with appropriately licensed Microsoft Entra accounts and that the applications receive supported feature updates.

Option A is incorrect because Office LTSC Professional Plus 2024 is a perpetual-license product that does not receive the continuously delivered Copilot capabilities provided through Microsoft 365 Apps.

Option C is incorrect because Microsoft 365 E5 is not required when users already have qualifying Microsoft 365 E3 licenses and Copilot licenses.

Option D is incorrect because Microsoft Graph connectors integrate external information sources with Microsoft 365 search and Copilot grounding. They do not enable Copilot inside unsupported desktop applications.

Option E is incorrect because participation in the Frontier program is not required to activate standard licensed Copilot functionality.

Therefore, Microsoft 365 Apps must be deployed to the devices.

Microsoft References:

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.