AB-650 (Administering Microsoft 365 and AI Services) has no official Microsoft practice assessment yet, so this cheat sheet leans harder on primary-source accuracy than most: every table below traces back to Microsoft's official AB-650 study guide and the official AB-650 exam page, checked August 2026. It is a review aid, not a replacement for hands-on time — pair it with our free AB-650 practice test to find what still needs work.
AB-650 at a Glance
Passing Score
700 / 1000
Duration
100 minutes
Retirement Date
None (beta)
Official Practice Assessment
Not yet available
1. Tenants & workloads
20–25%
2. Govern & secure
40–45%
3. AI services
35–40%
1. Domain 1 Reference: Tenant & Workload Configuration
Tenant Configuration
| Setting | Covers |
|---|---|
| Branding | Logo, company URL, sign-in themes and backgrounds. |
| Domains | Adding, verifying, and managing custom domains for the tenant. |
| Org settings | Security/privacy defaults and the organization profile. |
| Licensing | Group-based and pay-as-you-go licensing for Microsoft 365 and AI services — Copilot, Agent 365, Copilot Studio each license separately. |
| Microsoft 365 Backup | Set up, restore, and monitor point-in-time backup for Exchange, SharePoint, OneDrive. |
| Network connectivity insights | Diagnose network performance affecting Microsoft 365 connectivity. |
| Service health | Monitor and configure notifications for Microsoft 365 service incidents. |
Workload Management
| Workload | Admin tasks |
|---|---|
| Exchange | Create and manage mailboxes, including shared mailboxes. |
| Teams | Channels, owners, members; Copilot in Teams meetings, including transcription settings. |
| SharePoint | Site creation and permissions; SharePoint/OneDrive for Copilot via Advanced Management, Microsoft Search in SharePoint, and site exclusions. |
2. Domain 2 Reference: Identity, Security & Purview Governance
Microsoft Entra Identity
| Users & guests | Create/manage M365 users; manage guest users and external access settings. |
| Groups | Create and manage Microsoft 365 groups (also the mechanism behind group-based licensing). |
| PIM | Privileged Identity Management — time-bound, justified role activation instead of standing admin access. |
| Administrative units | Scope admin permissions to a subset of users/groups/devices. |
| Bulk management | Microsoft Graph PowerShell for scripted, bulk identity operations. |
Authentication & Access
| Auth methods | Configure and manage which sign-in methods are allowed tenant-wide. |
| Password Protection | Bans weak/known-compromised passwords at set time. |
| SSPR | Self-service password reset configuration. |
| Conditional Access | Grant/block access using signals — includes ID Protection risk and MFA as controls. Also targets agent identities (see Domain 3). |
Defender for Office 365
| Alerts & threat policies | Configure detection rules and manage triggered alerts. |
| Investigate & respond | Investigate email/collaboration threats and take remediation action. |
| Attack simulation training | Benign simulated phishing plus assigned training for users who fall for it. |
Purview tool separation — the most-tested distinction: DLP stops sensitive data from leaving a location (including the Copilot location). Sensitivity labels classify content and set usage rights that travel with it. Retention policies schedule when content is kept or deleted. DSPM for AI monitors and secures AI-specific activity across all of the above.
Microsoft Purview
| DLP policies | Locations include Exchange, SharePoint, OneDrive, Teams, endpoints, and Microsoft 365 Copilot. |
| Information protection | Sensitive information types, sensitivity labels, and sensitivity label policies. |
| Data lifecycle management | Retention labels, retention label policies, and retention policies. |
| DLP alerts | Review and respond to alerts for both Microsoft 365 and AI services. |
| DSPM for AI | Monitor and secure AI activity — the Purview solution built specifically for AI oversight. |
Test what you just reviewed
Try 40 Free AB-650 Practice Questions
Scenario-based, with explanations for every option. No credit card required.
Start Free Practice →3. Domain 3 Reference: Copilot, Agents & Agent 365
Enabling & Managing Copilot
| Readiness | Tenant readiness (in-app experiences) and data readiness (leaks, oversharing, compliance) before rollout. |
| Copilot Search / web search | Controls what Copilot and Copilot Chat can search, tenant content vs. the open web. |
| Tenant settings | Self-service purchases, release preferences, AI disclaimer, video/image generation, Copilot in admin centers. |
| Copilot Cowork | Managed as part of the broader Copilot user experience settings. |
| Third-party AI & connectors | Manage non-Microsoft AI providers and Copilot connectors that bring in outside data sources. |
Agents & Microsoft Entra Agent ID
| Agent identity | A distinct Entra identity type for AI agents, lifecycle-managed via Entra Agent ID — not a repurposed user or service principal. |
| Sponsors & owners | Every agent identity requires a human sponsor accountable for its purpose; sponsorship auto-transfers to their manager if they leave. |
| Access packages | Time-bound, auditable, approval-gated access for agent identities — the same entitlement-management model used for humans. |
| Conditional Access for agents | Policies can target "agents acting as users" or all agent resources; supports Report-only mode and agent risk conditions. |
| Blueprints | Centralized templates so Conditional Access, permissions, and governance apply once and are inherited by every agent instance created from it. |
Agent Registry & Agent 365 Governance
| Agent registry | Single tenant-wide inventory across Copilot Studio, pro-code, and non-Microsoft agents; review, publish, reject, block, or reassign. |
| Agent Tools registry | Centralized view of AI tools and MCP servers agents can use, including bring-your-own MCP server registration. |
| Agent 365 monitoring | Monitor agent activity, protect sensitive data agents touch, evaluate compliance gaps. |
Monitoring AI Services
| Copilot Control System (CCS) | The umbrella for AI service cost management, Copilot usage/adoption reporting, and AI service health — lives in the Microsoft 365 admin center. |
| Usage reports | Workload-level Copilot adoption details in the admin center. |
4. Admin Center Quick-Path Reference
AB-650 spans four different admin surfaces. Memorizing which portal a feature lives in saves time on scenario questions that hinge on "where would you configure this." Paths below are current as of Microsoft's product documentation, checked August 2026 — Microsoft periodically reorganizes admin center navigation, so verify against the live portal near your exam date.
| Task | Portal | Path |
|---|---|---|
| View/disable agent identities | Entra admin center | entra.microsoft.com → Entra ID → Agents → Agent identities |
| Create Conditional Access policy for agents | Entra admin center | entra.microsoft.com → Entra ID → Conditional Access → Policies → New policy |
| Activate/manage PIM eligible roles | Entra admin center | entra.microsoft.com → ID Governance → Privileged Identity Management |
| Configure DLP policy (incl. Copilot location) | Microsoft Purview portal | purview.microsoft.com → Data Loss Prevention → Policies |
| Configure sensitivity labels | Microsoft Purview portal | purview.microsoft.com → Information Protection → Labels |
| Configure retention policies | Microsoft Purview portal | purview.microsoft.com → Data Lifecycle Management → Retention policies |
| Run attack simulation training | Microsoft Defender portal | security.microsoft.com → Email & collaboration → Attack simulation training |
| Review/publish agent submissions (registry) | Microsoft 365 admin center | admin.microsoft.com → Agent 365 → Agent registry |
| Manage Agent Tools / MCP servers | Microsoft 365 admin center | admin.microsoft.com → Agents → Tools → Registry |
| Configure Copilot agent access/data settings | Microsoft 365 admin center (Copilot Control System) | admin.microsoft.com → Copilot → Settings → Data access → Agents |
| View agent inventory / pin agents | Microsoft 365 admin center (Copilot Control System) | admin.microsoft.com → Agents → All agents |
| Upload a custom agent (ZIP package) | Microsoft 365 admin center (Copilot Control System) | admin.microsoft.com → Agents → All agents → Upload custom agent |
5. Terminology Quick List
DLP — Data Loss Prevention
DSPM — Data Security Posture Management
PIM — Privileged Identity Management
SSPR — Self-Service Password Reset
MFA — Multi-Factor Authentication
XDR — Extended Detection and Response (Defender XDR)
CCS — Copilot Control System
MCP — Model Context Protocol (agent tool servers)
Agent ID — Microsoft Entra's identity type for AI agents
Agent blueprint — Template an agent identity is created from and inherits governance from
Sponsor — Human accountable for an agent identity's purpose and lifecycle
Access package — Time-bound, approval-gated access grant (used for humans and agents)
SIT — Sensitive Information Type
PIM eligible role — A role a user must actively activate rather than hold standing
Reviewed everything? Prove it.
Take the free AB-650 readiness quiz — no signup required — or dive into 40 free practice questions calibrated to this beta exam's real difficulty.
Common Questions
Is a cheat sheet enough to pass AB-650?
No — treat it as a final-review memory aid after working through the official study guide and scenario practice questions. AB-650's scenarios test judgment about which tool applies, not just recall of a feature's name.
What is the difference between an agent identity and a regular Entra user?
An agent identity is a distinct Entra identity type built specifically for AI agents, with its own classification, metadata, and governance model (blueprints, sponsors, access packages) — it is not a repurposed user account or generic service principal.
What is the passing score for AB-650?
700 out of 1000, per Microsoft's official AB-650 study guide (checked August 2026), spread across all three domains on a scaled scoring system.
Where do I configure Conditional Access for agents versus for humans?
Both live in the same place — Entra admin center → Entra ID → Conditional Access → Policies. Agent-targeted policies add assignment options like "agents acting as users" and agent risk conditions that human-targeted policies don't have.
About This Cheat Sheet
Maintained by the MSCertQuiz team, who also build the 500-question AB-650 practice bank referenced above. Every table traces back to Microsoft's official AB-650 study guide and current product documentation, checked August 2026, rather than a static list carried over from an older exam.
Related AB-650 Resources
AB-650 Study Guide
Domain breakdown, resources, and a weighted study plan.
Free AB-650 Practice Questions
12 scenario questions with full answer rationale.
AB-650 Certification Page
The full 500-question practice bank and domain details.
All Certifications
Browse every Microsoft certification MSCertQuiz covers.