Pass the Microsoft Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate AB-650 Questions and answers with CertsForce

Microsoft 365 provides Message Center and Service Health notification mechanisms for communicating organizational service changes and operational issues.

First selection: Message Center Preferences. The Microsoft 365 Message Center publishes information about important product changes, feature releases, service updates, and administrative actions. Administrators can configure email preferences to receive notifications about major updates. This directly meets Group1 ' s requirement.

Second selection: Service Health alerts. Service Health supports email notifications for incidents and advisories affecting Microsoft 365 services. Administrators can configure notifications for selected services and designate recipient email addresses. This is the likely intended selection for Group2 if maintenance events means operational service disruptions or advisories.

Microsoft documentation qualification: Planned maintenance is treated differently. Microsoft ' s current documentation explicitly states that planned maintenance announcements appear in Message Center rather than the Service Health dashboard. Therefore, if Group2 requires notifications specifically about planned maintenance, Message Center is the appropriate source, and the proposed Service Health selection does not completely meet that requirement.

The distinction is important when implementing the configuration. Major product updates and planned maintenance communications belong to Message Center; active incidents and service advisories belong to Service Health.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/message-center

https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health

First dropdown: Connect-MgGraph; Second dropdown: Get-MgSubscribedSku; Third dropdown: Set-MgUserLicense

Microsoft Graph PowerShell provides commands for connecting to Microsoft Graph, retrieving subscribed license products, and assigning licenses with individual service plans disabled.

First selection: Connect-MgGraph. This command establishes an authenticated Microsoft Graph PowerShell session using delegated permissions. Appropriate licensing administration permissions must be available to the signed-in administrator.

Second selection: Get-MgSubscribedSku. This command retrieves the subscribed licensing SKUs and their associated service plans. The required product is identified through its SKU part number, and its service plans can be examined to locate Microsoft Bookings.

Third selection: Set-MgUserLicense. This cmdlet assigns or removes licenses for a specified user. Administrators can use the -AddLicenses parameter to provide a license configuration containing the intended SKU identifier and disabled service-plan identifiers.

Important technical corrections: The original exhibit filters on EnterprisePack, which identifies Office 365 E3, whereas Microsoft 365 E3 ordinarily uses SPE_E3. The exhibited script also uses Select -ExcludeProperty ServicePlanID; to build a valid disabled-plan identifier collection, Microsoft documents Select -ExpandProperty ServicePlanId.

The three dropdown choices are correct, but these additional corrections are required if the script is to assign Microsoft 365 E3 and disable Bookings reliably in production.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/assign-licenses-to-user-accounts-with-microsoft-365-powershell

Microsoft Entra ID supports soft deletion of Microsoft 365 groups, retaining their directory objects and associated service resources for a defined recovery period.

First selection: Group3 only.

The original examination answer reflects the established Microsoft 365 group restoration capability. Microsoft 365 groups can be restored with their membership, Exchange mailbox, SharePoint site, calendar, and supported associated resources.

Traditional distribution groups and mail-enabled security groups do not use the same Microsoft Entra Microsoft 365 group soft-delete recovery workflow.

Second selection: 30 days.

Microsoft maintains deleted Microsoft 365 groups in a recoverable state for 30 days. Administrators can restore them during that period by using the Microsoft Entra admin center or supported PowerShell commands.

Current Microsoft documentation correction: Microsoft now also supports restoration of cloud security groups through a public-preview capability. Therefore, Group1 may also be recoverable if it is a cloud security group in a supported tenant.

The exhibit identifies Group1 only as Security and does not specify whether it is cloud-managed or synchronized from Active Directory.

As a result, Group3 only is the intended historical answer, but it is no longer unconditionally correct under current Microsoft documentation. The 30-day retention period remains correct.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/users/groups-restore-deleted

https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/restore-deleted-group

Report: Explorer (Threat Explorer); View on the Email entity page: Timeline

Microsoft Defender for Office 365 provides Threat Explorer for investigating malicious and suspicious email messages. The Email entity page supplies detailed information about individual messages, including their delivery and post-delivery events.

First selection: Explorer (Threat Explorer).

Threat Explorer enables security analysts to search for email messages using properties such as subject, sender, recipient, detection technology, and delivery status.

The analyst can open Threat Explorer in the Microsoft Defender portal, select the relevant email view, and filter messages by the subject provided in the phishing report. Matching messages can then be examined individually.

Second selection: Timeline.

After identifying the suspicious message, the administrator can open its Email entity page and select the Timeline view.

The Timeline view displays the chronological history of message delivery and subsequent actions. It includes original delivery events, changes caused by Zero-hour Auto Purge (ZAP), quarantine actions, and other recorded message events.

This information enables the administrator to determine where the message was originally delivered and what actions occurred afterward.

Threat Explorer is therefore the correct investigation tool for locating messages by subject, while the Timeline view provides the required delivery and post-delivery history.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about

https://learn.microsoft.com/en-us/defender-office-365/mdo-email-entity-page

Microsoft Defender for Office 365 provides configurable inbound anti-spam policies that enable administrators to filter unwanted email according to sender characteristics, geographic origin, languages, and recipient groups.

Option C is correct because a custom anti-spam inbound policy supports geographic filtering through the From these countries setting and can be scoped to selected recipient groups.

Administrators can configure the policy through the following steps:

Navigate to Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam.

Select Create policy → Inbound.

Under Users, groups, and domains, specify Group1 as the recipient group.

Under Bulk email threshold & spam properties, enable From these countries and select the countries or regions from which unwanted messages originate.

Configure the appropriate spam action, such as moving detected messages to Junk Email or quarantine.

This configuration ensures that geographic spam filtering applies specifically to Group1 without altering protection settings for other recipients.

Option A is incorrect because connection filter policies operate on source IP addresses and do not provide the required group-specific geographic filtering.

Options B and D are incorrect because preset security policies do not provide the required customizable country-based filtering settings.

Option E is incorrect because anti-phishing policies focus on spoofing, impersonation, and phishing detection rather than geographic spam filtering.

Implementation consideration: Recipient-group targeting supports mail-enabled security groups, distribution groups, and Microsoft 365 groups. Also, Standard or Strict preset security policies take precedence over custom inbound anti-spam policies for recipients included in those presets.

Microsoft Exchange Online supports converting an existing user mailbox to a shared mailbox while retaining its historical email content. This is appropriate when the original user no longer needs direct access but other employees must continue using the mailbox.

Option C is correct because converting Mailbox1 into a shared mailbox preserves the existing email messages and enables delegated access for other users.

The mailbox contains 42 GB of data, which is below the standard 50 GB unlicensed shared mailbox limit. Therefore, an additional mailbox license is not required solely because of its current size, provided no separately licensed features are necessary.

Option B is correct because Full Access permission allows Group1 members to open the mailbox and manage existing items. Send As permission enables them to send messages that appear to originate directly from Mailbox1.

Option E is incorrect because Send on Behalf permission displays the individual delegate ' s identity, whereas the requirement specifies that messages must appear to come from Mailbox1.

Option D is incorrect because Litigation Hold is designed for preservation and compliance purposes, not for providing collaborative mailbox access.

Option A is unnecessary for a standard shared mailbox of this size.

Therefore, converting the mailbox and granting Full Access and Send As permissions satisfies all three requirements.

Microsoft References:

https://learn.microsoft.com/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/create-shared-mailboxes

Modify the password protection policy: User1 only; Invite an external user: User1, User2, User3, and User4

Microsoft Entra ID uses role-based access control (RBAC) to authorize administrative operations. The two activities in this question have different permission requirements.

First selection: User1 only.

Modifying the tenant-wide password protection policy requires privileged authorization. The Global Administrator role held by User1 includes the permissions required to configure Microsoft Entra Password Protection, including the custom banned-password list and smart lockout settings.

The Authentication Policy Administrator role can also manage these settings, but none of the other listed users holds that role. User2 ' s Security Administrator role does not provide this specific permission, while User4 ' s Password Administrator role concerns password administration rather than configuration of the tenant-wide password protection policy.

Second selection: User1, User2, User3, and User4.

Microsoft Entra external collaboration settings allow users to invite external guests. Under the default configuration, organizational users can invite external users, including users without administrative roles.

User1 can invite guests as a Global Administrator, and User2 also has the Guest Inviter role. User3 and User4 can invite external users under the default invitation settings.

Therefore, all four users qualify for the second activity.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure

Microsoft Defender XDR provides a unified incident investigation experience that correlates Microsoft Purview Data Loss Prevention alerts with security signals from other Microsoft Defender workloads.

Option C is correct because Microsoft Defender incidents combine related DLP alerts and security events into a single investigation context. This enables analysts to examine potentially connected activity instead of investigating each isolated alert independently.

Microsoft Defender can correlate DLP detections with signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and other integrated security services.

The incident investigation experience also supports remediation actions directly against affected entities. Depending on the relevant workload, authorization, and alert evidence, analysts can take actions such as resetting a user ' s password, disabling an account, applying a sensitivity label, removing file-sharing permissions, or isolating a compromised device.

Option A is incorrect because Activity explorer primarily provides visibility into user and data activities.

Option B is incorrect because Content explorer focuses on inspecting classified and sensitive content.

Option D is less appropriate because individual Defender alerts do not provide the same consolidated correlation and incident-management capabilities.

Option E supports DLP alert investigation but does not provide the same unified cross-product security correlation and remediation experience.

Therefore, Microsoft Defender incidents satisfy both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/defender-xdr/dlp-investigate-alerts-defender

Microsoft Agent 365 provides centralized governance of tools and Model Context Protocol (MCP) servers that AI agents use to access external services and organizational data.

Option D is correct because the Microsoft 365 admin center ' s Tools management interface enables administrators to block an individual MCP server without disabling the agent or unrelated MCP servers.

In this scenario, MCP2 is currently marked Available but has not completed its security review. Allowing agents to invoke MCP2 could expose procurement information before appropriate security controls have been validated.

Administrators can navigate to the Microsoft 365 admin center, select Agents → Tools → Registry, locate MCP2, and select Block.

Blocking MCP2 changes its availability and prevents agents from using the tools exposed by that server. MCP1 remains available because it is a separate MCP server, and Agent1 itself is not disabled.

Option A is incorrect because agent management rules do not provide the direct server-specific blocking action requested.

Option B is incorrect because the Agent Registry manages agents, whereas the Tools Registry provides MCP server controls.

Option C is incorrect because policy templates are not the direct mechanism for blocking an individual MCP server.

Therefore, blocking MCP2 from Tools satisfies the requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-plugins-skills-mcp-servers

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-tools-overview

Microsoft SharePoint Restricted Content Discovery (RCD) provides a site-specific mechanism for limiting how SharePoint content appears in organization-wide Microsoft 365 search and Microsoft 365 Copilot experiences.

Option B is correct because the administrator can apply Restricted Content Discovery directly to Site1 without modifying the search behavior of the other 999 SharePoint sites.

When RCD is enabled for Site1, its content is generally excluded from organization-wide discovery experiences and Copilot responses. This reduces the risk of confidential documents appearing in broad search results.

Restricted Content Discovery does not modify existing SharePoint permissions or remove files from the Microsoft 365 search index.

Option A is incorrect because Restricted SharePoint Search uses a tenant-wide allowlist approach and can affect search results across many SharePoint sites. Microsoft also began blocking new enablement of that feature on July 31, 2026.

Option C is incorrect because Copilot connectors integrate external data sources rather than restrict the discovery of existing SharePoint content.

Option D is incorrect because Microsoft Search bookmarks promote selected resources rather than restrict document discoverability.

Implementation qualification: Microsoft documents exceptions for content users own or have recently interacted with. RCD is not an absolute security boundary. If all access must be prevented, SharePoint permissions or Restricted Access Control must also be considered.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery

https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search