AB-650 Exam Dumps - Administering Microsoft 365 and AI Services

Microsoft SharePoint Restricted Access Control (RAC) provides an additional authorization boundary for SharePoint sites. It restricts site and content access to members of designated Microsoft Entra security groups or Microsoft 365 groups while preserving existing SharePoint permissions.

Option C is correct because configuring Restricted Access Control for Site1 and specifying Group1 satisfies both conditions simultaneously. Users must belong to Group1 and already possess appropriate SharePoint permissions. Membership in Group1 alone does not grant access.

Users outside Group1 are denied access even if they have direct permissions or previously received sharing links. Restricted Access Control can be configured for an individual communication site without modifying its existing permission assignments.

Option A is incorrect because sharing restrictions primarily control sharing operations rather than comprehensively enforcing the existing-content access boundary required.

Option B is incorrect because Restricted Content Discovery limits content visibility in organization-wide search and Microsoft 365 Copilot but does not prevent users with existing permissions from directly accessing files.

Option D is incorrect because manually changing SharePoint permissions could achieve access restrictions but would violate the requirement to preserve existing permissions and minimize administrative effort.

Therefore, configuring Restricted Access Control specifically for Site1 is the appropriate solution.

Microsoft Reference: Microsoft Learn — Restrict SharePoint site access .

Track the number of unique Site1 pages visited by users: From the Microsoft 365 admin center, review the SharePoint site usage reports.; Monitor the Site1 collection storage quotas: From the SharePoint admin center, review the Active sites page.

Microsoft 365 provides both analytical usage reporting and administrative site-management capabilities for SharePoint Online. These functions serve different monitoring requirements.

First selection: SharePoint site usage reports.

The Microsoft 365 admin center includes SharePoint site usage reports that provide information about site activity, storage consumption, and user engagement.

The report contains a metric named Pages visited, representing the number of unique pages visited on a SharePoint site during the reporting period. This differs from Page views, which represents the total number of page views, including repeated visits.

Administrators can access this information through Reports, Usage, and SharePoint site usage.

Second selection: Active sites page.

The SharePoint admin center provides the Active sites page for managing and monitoring individual SharePoint sites.

Administrators can select Site1 and inspect information such as allocated storage, current storage consumption, and site details. When manual storage limits are configured, administrators can also review or change the site ' s storage allocation.

The Microsoft 365 usage report is designed primarily for analytical reporting, while the SharePoint Active sites page provides administrative oversight of site collections and their storage configurations.

Therefore, the two selected administrative locations satisfy the requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/sharepoint-site-usage-ww

https://learn.microsoft.com/en-us/sharepoint/manage-sites-in-new-admin-center

Microsoft 365 Agent Registry provides centralized visibility into agents available within an organization. Administrators can filter the inventory using properties such as publisher type, deployment channel, platform, and status.

Option D is correct because the requirements identify two independent filtering conditions: external publisher ownership and availability within Microsoft Teams.

The Publisher type: Third party filter identifies agents developed and distributed by external organizations rather than Microsoft or the organization ' s internal developers.

The Channel: Teams filter identifies agents deployed to Microsoft Teams, where authorized users can discover and interact with them.

Applying both filters restricts the resulting inventory to third-party agents associated with the Teams channel.

Administrators can export the filtered agent list from the Microsoft 365 admin center for auditing. The export includes relevant metadata such as the agent name, channel, publisher, publisher type, platform, and status.

Option A is incorrect because Microsoft 365 apps is not the same deployment channel as Teams.

Option B is incorrect because Your users identifies internally created or shared agents rather than third-party publishers.

Option C is incorrect because Your org identifies agents published by the organization.

Therefore, Teams and Third party are the required filter values.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry

Top navigation bar logo and website link: An organization theme in Microsoft 365; Default sign-in page background: Company branding in Microsoft Entra

Microsoft 365 provides different branding mechanisms for the application interface and the Microsoft Entra authentication experience. Each requirement must be configured through the appropriate administrative service.

First selection: An organization theme in Microsoft 365.

An organization theme controls the appearance of the Microsoft 365 top navigation bar. Administrators can configure the default organizational theme, upload a company logo, and specify the URL that opens when users select the logo.

These options are managed through the Microsoft 365 admin center under Organization profile and organization themes.

Second selection: Company branding in Microsoft Entra.

Microsoft Entra company branding controls the appearance of authentication pages. It supports customizing sign-in page background images, logos, headers, colors, and other visual elements.

Configuring the default company branding ensures the background image is available to users authenticating through the organization ' s branded sign-in experience.

An application-specific branding theme would not satisfy the requirement for a default experience across all users. Similarly, a Microsoft 365 group theme applies to selected Microsoft 365 groups rather than the organization ' s default interface.

Therefore, organization themes and Microsoft Entra company branding are the two appropriate selections.

Microsoft References:

https://learn.microsoft.com/en-GB/microsoft-365/admin/setup/customize-your-organization-theme

https://learn.microsoft.com/en-us/entra/fundamentals/how-to-customize-branding

The Microsoft 365 Copilot Agent usage report provides centralized reporting on the adoption and activity of agents used through Microsoft 365 Copilot Chat and supported Microsoft 365 applications.

Option B is correct because the report supports usage analysis over the previous 7 or 30 days and provides agent-specific activity information.

Administrators can access the report through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft 365 Copilot, and Agents.

The report includes information about active agents, active users, agent responses, and usage trends. Its daily time-series reporting helps administrators examine usage patterns, while agent-level details support comparisons between Agent1 and Agent2.

Option A is incorrect because Microsoft Defender for Cloud Apps app governance primarily focuses on application permissions, OAuth applications, and associated security risks rather than Copilot agent activity reporting.

Option C is incorrect because billing and usage information primarily addresses consumption and associated charges rather than providing the complete agent adoption and activity reporting requested.

Option D is incorrect because Microsoft Purview Audit provides event-level audit records. Although relevant activities may be recorded, it is not the most direct reporting solution for comparing agent usage.

Therefore, the Microsoft 365 Copilot Agent usage report is the appropriate selection.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-agents-new

First dropdown: Connect-MgGraph; Second dropdown: Get-MgSubscribedSku; Third dropdown: Set-MgUserLicense

Microsoft Graph PowerShell provides commands for connecting to Microsoft Graph, retrieving subscribed license products, and assigning licenses with individual service plans disabled.

First selection: Connect-MgGraph. This command establishes an authenticated Microsoft Graph PowerShell session using delegated permissions. Appropriate licensing administration permissions must be available to the signed-in administrator.

Second selection: Get-MgSubscribedSku. This command retrieves the subscribed licensing SKUs and their associated service plans. The required product is identified through its SKU part number, and its service plans can be examined to locate Microsoft Bookings.

Third selection: Set-MgUserLicense. This cmdlet assigns or removes licenses for a specified user. Administrators can use the -AddLicenses parameter to provide a license configuration containing the intended SKU identifier and disabled service-plan identifiers.

Important technical corrections: The original exhibit filters on EnterprisePack, which identifies Office 365 E3, whereas Microsoft 365 E3 ordinarily uses SPE_E3. The exhibited script also uses Select -ExcludeProperty ServicePlanID; to build a valid disabled-plan identifier collection, Microsoft documents Select -ExpandProperty ServicePlanId.

The three dropdown choices are correct, but these additional corrections are required if the script is to assign Microsoft 365 E3 and disable Bookings reliably in production.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/assign-licenses-to-user-accounts-with-microsoft-365-powershell

Microsoft 365 Copilot relies on secure WebSocket (WSS) connections to support real-time, bidirectional communication between client applications and Microsoft cloud services.

Option A is correct because the reported Network connectivity insight specifically identifies WebSocket connection failures for hosts within *.cloud.microsoft.

Microsoft documentation explains that this insight occurs when a network device or web proxy prevents successful WebSocket connections. Administrators should configure the affected proxy to permit WebSocket protocol connections, including the HTTP-to-WebSocket upgrade process, for the required Microsoft 365 endpoints.

Because the problem affects only Branch1, the configuration should be applied to the Branch1 web proxy policy. This resolves the connectivity issue without changing policies for other offices.

Option B is incorrect because the reported failure concerns WebSocket connectivity, not DNS resolution or regional endpoint selection.

Option C is incorrect as the best answer because TLS inspection can interfere with WebSocket connections, but the scenario does not establish that TLS inspection is the cause. Exempting endpoints from TLS inspection may be appropriate after further diagnosis, but allowing the required WebSocket protocol directly addresses Microsoft ' s reported insight.

Option D is incorrect because standard HTTPS connectivity already succeeds. Allowing HTTPS alone does not guarantee successful WebSocket protocol upgrades.

Therefore, the Branch1 proxy must allow WSS connections to the required Microsoft 365 hosts.

Microsoft References:

Microsoft 365 Network Insights .

Review Microsoft 365 network connection failures and WebSocket errors .

SharePoint Data Access Governance provides reporting capabilities that help administrators identify overshared sites, excessive permissions, and potentially risky content exposure without changing the existing SharePoint authorization configuration.

Option D is correct because Data Access Governance reports can identify sites that have broad access permissions, anonymous sharing links, and permissions granted to large organizational groups.

Administrators can access these reports through the SharePoint admin center under Reports and Data access governance.

The site permissions snapshot report provides visibility into permissioned users, guest access, broken permission inheritance, and sharing links.

Sharing links activity reports can also identify sites where users have created Anyone links, organization-wide links, or externally shared links.

These capabilities are especially important for Microsoft 365 Copilot because Copilot respects existing SharePoint permissions. Overshared content may therefore appear in responses provided to users who have access through excessively broad permissions.

Option A primarily measures site usage rather than evaluating permission exposure.

Option B focuses on classified content rather than analyzing SharePoint site permission structures.

Option C involves reviewing user access assignments, rather than identifying overshared sites across the SharePoint environment.

Option E supports compliance content searches but is not the dedicated solution for detecting broad site permissions.

Data Access Governance reports provide the required visibility without modifying permissions.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/data-access-governance-reports

https://learn.microsoft.com/en-us/sharepoint/data-access-governance-site-permissions-report