Exam AB-650: Microsoft 365 and AI Services Administrator Associate

Microsoft 365 administration is evolving as organizations integrate Copilot, AI agents, and intelligent automation into their daily operations. Administrators must understand how to manage these capabilities while maintaining security, compliance, and governance.

Preparing for the AB-650 certification can help you:

• Master Microsoft 365 Administration: Configure and manage Microsoft 365 tenants, domains, licenses, mailboxes, Teams, SharePoint, and OneDrive.

• Strengthen Identity and Access Management: Manage Microsoft Entra users, groups, administrative roles, authentication methods, and Conditional Access policies.

• Improve Security and Compliance: Use Microsoft Defender and Microsoft Purview to protect workloads, manage sensitive information, and respond to security threats.

• Administer Microsoft 365 Copilot: Configure Copilot settings, manage user experiences, assess tenant readiness, and address data readiness issues.

• Manage AI Agents: Discover, configure, secure, and govern Microsoft and third-party agents using Microsoft 365 and Agent 365.

• Protect Organizational Data: Implement Data Loss Prevention, sensitivity labels, retention policies, and AI activity monitoring.

• Monitor AI Services: Track Copilot adoption, AI service usage, licensing costs, and service health.

• Support Enterprise-Scale Productivity: Maintain secure, compliant, and reliable Microsoft 365 services across organizational environments.

The AB-650 certification covers three major skill areas focused on Microsoft 365 administration, security, governance, and AI service management.

1. Configure and Manage Microsoft 365 Tenants and Workloads — 20–25%

Learn how to configure Microsoft 365 tenants, manage organizational settings, administer licenses, and maintain core Microsoft 365 workloads.

Key learning areas include:

• Configuring Microsoft 365 tenant branding, domains, and organizational settings.

• Managing Microsoft 365 licenses and AI service subscriptions.

• Configuring Microsoft 365 Backup and network connectivity insights.

• Monitoring Microsoft 365 service health and notifications.

• Creating and managing Exchange mailboxes, including shared mailboxes.

• Managing Microsoft Teams, channels, owners, and members.

• Configuring Copilot capabilities in Teams meetings.

• Creating and managing SharePoint sites and permissions.

• Preparing SharePoint and OneDrive for Microsoft 365 Copilot.

2. Govern and Secure Microsoft 365 Tenants and Workloads — 40–45%

Develop the skills required to manage identities, implement authentication controls, secure Microsoft 365 workloads, and protect organizational information.

Key learning areas include:

• Managing Microsoft 365 users, groups, guest accounts, and administrative roles.

• Implementing Microsoft Entra Privileged Identity Management (PIM).

• Managing authentication methods, password protection, and self-service password reset.

• Configuring Conditional Access and multifactor authentication.

• Managing Microsoft Defender for Office 365 threat policies and alerts.

• Investigating and responding to email and collaboration threats.

• Implementing attack simulations and training campaigns.

• Configuring Microsoft Purview Data Loss Prevention policies.

• Managing sensitivity labels, retention policies, and information protection.

• Monitoring AI activity using Microsoft Purview Data Security Posture Management.

3. Manage and Secure AI Services in Microsoft 365 — 35–40%

Learn how to administer Microsoft 365 Copilot, manage AI agents, implement Agent 365 governance, and monitor AI service usage across the organization.

Key learning areas include:

• Assessing Microsoft 365 tenant readiness for Copilot.

• Identifying and resolving data readiness issues, including oversharing and data leaks.

• Configuring Copilot Search, web search, and tenant-level Copilot settings.

• Managing Copilot user experiences and third-party AI providers.

• Configuring Copilot connectors and Microsoft 365 Copilot Cowork.

• Managing agent identities through Microsoft Entra Agent ID.

• Configuring agent access, ownership, sharing, and lifecycle workflows.

• Discovering, approving, publishing, and managing agents through the agent registry.

• Securing and governing agents using Microsoft Agent 365.

• Monitoring agent activity and protecting sensitive information.

• Managing AI service costs, adoption, usage reports, and service health.

The AB-650 certification assesses three major competency areas:

• Configure and manage Microsoft 365 tenants and workloads

• Govern and secure Microsoft 365 tenants and workloads

• Manage and secure AI services in Microsoft 365

Candidates should develop a strong understanding of Microsoft 365 administration, identity management, information protection, Copilot configuration, and agent governance.

Domain 1: Configure and Manage Microsoft 365 Tenants and Workloads (20–25%)

Configure and manage a Microsoft 365 tenant

• Configure Microsoft 365 tenant branding, including logos, company URLs, themes, and backgrounds.

• Implement and manage organizational domains.

• Configure organizational settings, including security, privacy, and organization profile settings.

• Manage and monitor Microsoft 365 licenses, including group-based licensing and pay-as-you-go.

• Manage and monitor AI service licenses, including Microsoft 365 Copilot, Microsoft Agent 365, and Microsoft Copilot Studio.

• Configure and use Microsoft 365 Backup, including setup, restoration, and monitoring.

• Configure and review network connectivity insights.

• Monitor Microsoft 365 service health and configure service health notifications.

Manage Microsoft 365 workloads

• Create and manage Exchange mailboxes, including shared mailboxes.

• Create and manage Microsoft Teams, including channels, owners, and members.

• Configure Copilot settings for Teams meetings, including transcription.

• Create and manage SharePoint sites and their permissions.

• Configure SharePoint and OneDrive for Copilot.

• Manage SharePoint Advanced Management, Microsoft Search in SharePoint, and site exclusions.

Domain 2: Govern and Secure Microsoft 365 Tenants and Workloads (40–45%)

Manage identities in Microsoft Entra

• Create and manage Microsoft 365 users.

• Manage guest users and external access settings.

• Create and manage groups, including Microsoft 365 groups.

• Manage Microsoft 365 administrative roles, including Microsoft Entra Privileged Identity Management (PIM).

• Create and manage administrative units.

• Create and manage contacts.

• Perform bulk management operations using Microsoft Graph PowerShell.

Implement and manage authentication and access in Microsoft Entra

• Configure and manage authentication methods.

• Implement and manage Microsoft Entra Password Protection.

• Configure self-service password reset (SSPR).

• Investigate and resolve authentication issues.

• Implement and manage Microsoft Entra Conditional Access policies.

• Configure Conditional Access with Microsoft Entra ID Protection and multifactor authentication.

Secure Microsoft 365 workloads

• Manage security alerts in Microsoft Defender for Office 365.

• Configure threat protection policies and rules.

• Investigate and respond to email and collaboration threats using Defender for Office 365.

• Configure and manage attack simulations, including training campaigns.

Protect data in Microsoft 365 using Microsoft Purview

• Identify requirements for Microsoft Purview Data Loss Prevention (DLP) policies across Exchange, SharePoint, OneDrive, Teams, endpoints, and Copilot.

• Identify information protection requirements, including sensitive information types, sensitivity labels, and sensitivity label policies.

• Identify data lifecycle management requirements, including retention labels, retention label policies, and retention policies.

• Review and respond to DLP alerts affecting Microsoft 365 and AI services.

• Monitor and secure AI activity using Microsoft Purview Data Security Posture Management (DSPM).

Domain 3: Manage and Secure AI Services in Microsoft 365 (35–40%)

Enable and manage Microsoft 365 Copilot

• Assess Microsoft 365 tenant readiness for Copilot, including in-app experiences.

• Identify and resolve Copilot data readiness issues, including data leaks, oversharing, and compliance concerns.

• Manage web search for Copilot and Microsoft 365 Copilot Chat.

• Configure Microsoft 365 Copilot Search.

• Configure tenant-level Copilot settings, including self-service purchases, Copilot in admin centers, release preferences, AI disclaimers, and video and image generation.

• Manage Microsoft 365 Copilot user experiences.

• Manage Microsoft 365 Copilot Cowork.

• Manage third-party AI providers.

• Configure Copilot connectors.

Implement and manage agents in Microsoft 365 and Agent 365

• Manage agent identity lifecycle workflows using Microsoft Entra Agent ID.

• Secure agent access using access packages and Conditional Access.

• Manage agent owners.

• Configure agent settings, including allowed agent types, sharing, templates, and user access.

• Discover and manage Microsoft and third-party agents through the agent registry.

• Review agent requests and publish or reject agents in the agent registry.

• Install, block, and control access to agents, including uploading custom agents.

• Manage tools in Agent 365.

Secure and govern agents using Agent 365

• Monitor agent activity using Agent 365.

• Protect sensitive organizational data through agent governance.

• Evaluate compliance gaps using Agent 365.

Monitor AI services in Microsoft 365

• Manage and monitor costs associated with Microsoft 365 AI services.

• Monitor Copilot usage reports in the Microsoft 365 admin center, including workload-level adoption details.

• Monitor AI service usage and adoption using the Copilot Control System.

• Monitor AI service health using the Copilot Control System.

The AB-650 certification is intended for professionals responsible for administering, securing, governing, and optimizing Microsoft 365 environments and AI-powered workplace services.

It is particularly relevant for:

• Microsoft 365 Administrators: Professionals who manage Microsoft 365 tenants, workloads, licensing, users, and organizational settings.

• Cloud Administrators: Administrators responsible for Microsoft cloud services, identity management, and enterprise productivity environments.

• Microsoft Entra Administrators: Professionals managing identities, authentication, Conditional Access, privileged roles, and access governance.

• Security Administrators: Professionals responsible for Microsoft Defender, threat protection, security monitoring, and incident investigation.

• Compliance Administrators: Professionals working with Microsoft Purview, Data Loss Prevention, information protection, retention, and compliance policies.

• AI and Copilot Administrators: Professionals responsible for deploying, configuring, securing, and monitoring Microsoft 365 Copilot and AI services.

• IT Infrastructure Administrators: Professionals managing enterprise Microsoft 365 workloads and collaborating across infrastructure, security, endpoints, and applications.

Candidates should have practical experience administering Microsoft 365 workloads and Microsoft Entra ID.

The following knowledge and experience are recommended:

• Experience managing Microsoft 365 tenants and workloads.

• Practical knowledge of Microsoft Entra ID and identity administration.

• Understanding of authentication methods, Conditional Access, and multifactor authentication.

• Familiarity with Microsoft Defender XDR capabilities.

• Understanding of Microsoft Defender for Office 365 and threat protection.

• Knowledge of Microsoft Purview information protection and compliance capabilities.

• Familiarity with Microsoft Graph PowerShell for bulk administration and management tasks.

• Understanding of Microsoft 365 Copilot, AI agents, and connected AI services.

• Awareness of Microsoft Agent 365 and agent governance concepts.

This certification is particularly suitable for administrators who already have Microsoft 365 operational experience and want to extend their skills into AI service administration and agent governance.

The introduction of Microsoft 365 Copilot and AI agents is expanding the responsibilities of Microsoft 365 administrators. Organizations need professionals who can manage these services while ensuring that identity, access, data protection, and compliance requirements remain in place.

Preparing for AB-650 can help you:

• Develop expertise in Microsoft 365 tenant and workload administration.

• Understand identity management and authentication using Microsoft Entra.

• Strengthen your knowledge of Microsoft Defender and Microsoft Purview.

• Learn how to configure and govern Microsoft 365 Copilot.

• Understand agent identity management and access controls using Microsoft Entra Agent ID.

• Explore Microsoft Agent 365 capabilities for agent monitoring and governance.

• Manage AI service usage, licensing, adoption, and operational health.

• Build the skills required to support secure AI-powered productivity environments.

A structured preparation plan should cover all three exam domains, with particular attention to tenant security, data governance, Copilot administration, and agent lifecycle management.