AB-650 AI Services Domain Explained: Copilot, Agents and Agent 365 for MS-102 Admins (2026)

Last updated: 26 October 2026. Written and fact-checked by the Examinotion team against the official Microsoft Learn study guide for AB-650 and the Microsoft 365, Microsoft Agent 365 and Microsoft Entra documentation.

TL;DR The AB-650 AI services domain is worth 35-40% of the exam and covers four skill groups: enabling Microsoft 365 Copilot, managing agents through Microsoft Entra Agent ID and the agent registry, governing agents with Microsoft Agent 365, and monitoring AI cost and usage. None of it appears in MS-102, so it is where migrating administrators need the most new study.

If you passed MS-102 or administer a Microsoft 365 tenant today, much of AB-650's tenant and governance material will feel familiar. The AI services domain will not. This guide walks through every skill in the "Manage and secure AI services in Microsoft 365" domain of AB-650: Administering Microsoft 365 and AI Services, explains where each one lives in the admin centres, and flags the naming and licensing traps that catch experienced administrators out.

Why the AI services domain decides AB-650 for MS-102 administrators

The AI services domain carries 35-40% of the AB-650 exam, and every skill in it is new compared with MS-102. AB-650 has three domains: configure and manage Microsoft 365 tenants and workloads (20-25%), govern and secure Microsoft 365 tenants and workloads (40-45%), and manage and secure AI services in Microsoft 365 (35-40%) [1]. The first two map closely to work an MS-102 administrator already does. The third does not.

MS-102, the Microsoft 365 Administrator exam, retires on 30 November 2026 at 11:59 PM Central Standard Time [4]. Microsoft also states that the related Microsoft 365 Certified: Administrator Expert certification cannot be earned or renewed after that date [5]. AB-650 leads to a different credential, Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate, which is still labelled beta [3]. If you are weighing up whether to sit MS-102 before it goes or move straight to AB-650, our MS-102 retirement decision guide covers that choice in detail.

Comparing the two official outlines makes the gap clear. MS-102's skills outline mentions Copilot only once, as a workload inside a data loss prevention bullet [4]. AB-650's AI services domain has 24 separate skills across four groups [1]:

Because AB-650 is still in beta, Microsoft can revise the outline before general availability. The study guide also warns that most questions cover generally available features, but "the exam may contain questions on Preview features if those features are commonly used" [1]. Always check the live outline before you book. For a broader view of all three domains, start with our AB-650 exam guide.

Enable and manage Microsoft 365 Copilot

The Copilot skill group is the largest in the AB-650 AI services domain, with nine skills covering readiness, data, search and tenant settings. The official bullets are: assess tenant readiness for Copilot, including in-app experiences; identify and resolve data readiness issues, including data leaks, data oversharing and data compliance; manage web search for Copilot and Microsoft 365 Copilot Chat; configure Microsoft 365 Copilot Search; configure tenant Copilot settings; manage Copilot user experiences; manage Microsoft 365 Copilot Cowork; manage third-party AI providers; and configure Copilot connectors [1].

Readiness and licences

The Copilot readiness report is the starting point for the readiness skill. In the Microsoft 365 admin centre it sits under Reports > Usage > Microsoft Copilot > Copilot, on the Readiness tab [8]. It shows how many users hold prerequisite licences, which users are on an eligible Microsoft 365 Apps update channel (Current Channel or Monthly Enterprise Channel), and a "Suggested candidate for Copilot" view that highlights the most active unlicensed users [8].

Licensing for AI services is formally assessed in the tenant domain rather than here, but you cannot separate the two in practice. That tenant bullet asks you to manage licences for Microsoft 365 Copilot, Microsoft Agent 365 and Microsoft Copilot Studio [1]. Microsoft's Agent 365 documentation describes Microsoft 365 E7 as including Microsoft 365 E5, Microsoft Copilot, Microsoft Agent 365 and Microsoft Entra Suite, while the Copilot licence can also be added to E3 or E5 [16].

Tenant Copilot settings

Tenant-wide Copilot settings live in the Microsoft 365 admin centre under Copilot > Settings, grouped into four tabs. Those tabs are User access, Data access, Copilot actions and Other settings, and Microsoft cites AI Administrator as an appropriate least-privileged role for managing them [6]. Map each exam bullet to its location:

• Self-service purchases: choose whether users can start trials or buy Copilot themselves, start trials only, or neither [6]
• Copilot in admin centres: controls the Copilot experience inside Microsoft's admin portals [6]
• Web search: governed by the "Allow web search in Copilot" policy, which is a Cloud Policy setting in the Microsoft 365 Apps admin centre rather than a toggle on the Copilot page [6]
• Third-party AI providers: two separate Data access settings, one for providers operating as independent processors and one for providers operating as Microsoft subprocessors [6]
• Image generation: under Copilot actions [6], while the exam bullet also names video generation [1]

Microsoft notes that "a setting's location or availability might differ from what's described here" [6], which is a fair warning for a product that moves monthly. Learn where each control lives in a real tenant instead of memorising screenshots.

Copilot Cowork and connectors

Microsoft 365 Copilot Cowork is generally available, and administrators grant access to it through a spending policy. Microsoft's Cowork governance page explains that the older agent-entry control has no effect on who can use Cowork; the spending policy is the access mechanism [25]. That detail is easy to get wrong if you assume Cowork behaves like any other agent. Copilot connectors, the final bullet, bring external content into Copilot's reach, so treat them as both a feature and a data-exposure decision.

Prepare SharePoint and data for Copilot

Data readiness for Copilot means finding and fixing oversharing before Copilot surfaces content that users can technically reach but should not see. The AB-650 bullet names data leaks, data oversharing and data compliance explicitly [1]. Copilot respects existing permissions, so a broadly shared SharePoint site becomes a broadly answerable one. Our explainer on how Microsoft 365 Copilot grounding works covers why permissions drive what Copilot can see.

Microsoft's guidance on configuring a secure and governed foundation for Copilot lays out three stages: remediate oversharing, set up guardrails, and meet regulations [9]. The tools it names are worth knowing by function:

Restricted Content Discovery is a temporary control, not a permissions fix. Microsoft describes RCD as "designed as a temporary governance control" and states that it "doesn't change existing permissions" [10]. In exam terms, RCD buys time while you run access reviews; it does not remediate the underlying oversharing. Microsoft also notes that SharePoint Advanced Management is included with Copilot licences [9].

Purview naming has shifted too. The current product is Data Security Posture Management, and the earlier AI-focused experience is now labelled DSPM for AI (classic) [11]. The AB-650 governance domain uses the plain "DSPM" wording [1]. If you want a deeper treatment of Purview, DLP and Copilot oversharing, our AB-900 data protection and governance guide covers those controls at fundamentals depth.

Implement and manage agents in Microsoft 365 and Agent 365

The agents skill group tests two halves of one job: giving agents governed identities in Microsoft Entra, and controlling which agents reach users through the agent registry. Its eight bullets cover Entra Agent ID lifecycle workflows, securing agent access with access packages and Conditional Access, managing agent owners, configuring agent settings, discovering agents in the registry, reviewing publish requests, installing or blocking agents including custom uploads, and managing tools in Agent 365 [1].

Microsoft Entra Agent ID

Microsoft Entra Agent ID gives AI agents their own identity accounts in Microsoft Entra ID, so they can be authenticated, governed and audited like other identities. Microsoft defines agent identities as "identity accounts within Microsoft Entra ID that provide unique identification and authentication capabilities for AI agents" [17]. Entra Agent ID is now generally available [18], alongside the general availability of Microsoft Agent 365 in May 2026 [14], although some related capabilities remain in preview.

The object model is worth learning precisely. Microsoft describes four object types: the agent identity blueprint, the agent identity blueprint principal, the agent identity, and the agent user [20]. Blueprints are the parent definitions from which individual agent identities are created.

Owners and sponsors are different roles, and the exam bullet on agent owners depends on the distinction. Owners are the technical administrators of an agent. Sponsors are the business representatives "accountable for the agent's purpose and lifecycle decisions", and at least one sponsor is required for each agent identity and blueprint [19]. If a sponsor leaves the organisation, sponsorship of their agent identities is automatically transferred to their manager, and Lifecycle Workflows include tasks that notify co-sponsors and the managers of sponsors [20].

For access, Entra ID Governance lets you use access packages to grant agents security group membership, OAuth API permissions and Entra roles. Requests can come from the agent itself, from its sponsor on its behalf, or by direct administrator assignment [20]. Conditional Access policies can be applied at the agent identity blueprint level, so every agent identity created from that blueprint inherits them [20].

Check licensing for Conditional Access for agents against the current documentation. Microsoft's Entra licensing page states that Conditional Access for agents requires Microsoft 365 E7, or a Microsoft Agent 365 licence paired with at least Microsoft Entra ID P1 or Microsoft 365 E3 [21]. Agent licensing has changed several times in 2026, so confirm it on the live licensing page before you sit.

The agent registry and agent settings

The agent registry is where administrators discover, approve, publish, install and block agents across the tenant. In the Microsoft 365 admin centre it sits under Agents > All agents > Registry, alongside Overview, Requests and Settings [12][13][16]. The registry groups agents into Microsoft agents, external partner-built agents, agents published by your organisation, and agents shared by their creators, and it highlights totals, agents without owners and unmanaged agents [12].

Approving publish requests is restricted. Microsoft states that approving agent requests or assigning ownership can only be performed by users in the AI Administrator or Global Administrator roles [16]. To upload a custom agent, you add it as a manifest package, choose who can install it, optionally deploy it to users, apply a policy template, and review its permissions [12].

Agent settings control the rules of the road. They include agent management rules, agent and plugin access (Microsoft, your organisation, or external publishers), security templates, sharing, user access, feedback sharing and tags [13]. One subtle point is testable: Microsoft states that the sharing control "only applies to agents built with Microsoft Copilot Agent Builder" [13], not to every agent type. Management rules also support bulk actions, such as blocking ownerless agents that have no usage [13].

Secure and govern agents with Microsoft Agent 365

Microsoft Agent 365 is Microsoft's control plane for observing, governing and securing agents across an organisation. Microsoft positions it as the way an organisation observes, governs and secures its growing number of agents [14]. Agent 365 became generally available for the commercial segment on 1 May 2026, licensed per user [14][15].

The AB-650 outline gives Agent 365 its own three-skill group: monitor agent activity, protect sensitive data, and evaluate compliance gaps, all by using Agent 365 [1]. Agent 365 does this by drawing on three Microsoft security products, and you should know which one does what [14]:

Microsoft's Entra governance documentation confirms the identity link directly: "Microsoft Agent 365 gives each AI agent its own Microsoft Entra Agent ID" [20]. Agent 365 also extends visibility to agents built on Copilot Studio, Microsoft Foundry and some partner platforms, though parts of the cross-platform integration remain in preview [15]. If you are unclear on the difference between the main agent-building platforms, our Copilot Studio vs Microsoft Foundry comparison explains where each fits.

Microsoft recommends Microsoft 365 E5 as a foundation for Agent 365 and requires at least one user to hold a qualifying Agent 365 licence [14]. At general availability Microsoft announced a standalone price of USD 15 per user per month [15]; local pricing varies by region. The final skill in the agents group, managing tools in Agent 365, is newer and thinly documented, so the Microsoft Learn module on curating agents with the agent registry and Agent 365 tools is the best primary source [26].

Monitor AI services: usage, cost and Copilot controls

The monitoring skill group tests whether you can measure AI adoption and control AI spend, using four named surfaces. The bullets are: manage and monitor costs for AI services; monitor Copilot usage reports in the Microsoft 365 admin centre, including workload-level adoption; monitor usage and adoption through the Copilot Control System; and monitor service health through the Copilot Control System [1].

Copilot controls (the outline's "Copilot Control System")

Microsoft's current documentation calls the framework "Copilot controls", while the AB-650 outline still says "Copilot Control System". The Copilot controls overview describes "an integrated framework for Microsoft Copilot and agents" built on three pillars: security and governance, management controls, and measurement and reporting [7]. Treat the two names as the same thing and expect either on exam day, at least until the outline is refreshed for general availability [1][7].

Usage reports

The Copilot usage report shows enabled and active users and adoption by app over 7, 28, 90 or 180 days. It sits at Reports > Usage > Microsoft Copilot > Copilot, on the Usage tab, and its data typically appears within 48 hours [22]. Microsoft explicitly states that the audit log is "not, however, intended to be used as the basis for Copilot usage reporting" [22], which makes a tidy distractor in any question about the right reporting source. For agents, the Agents > Overview page gives a 30-day view of active users, agent run time, pending requests and agents without owners [16].

Costs, Copilot Credits and pay-as-you-go

AI costs in Microsoft 365 are increasingly metered, and AB-650 expects you to manage that billing, not just licences. Microsoft describes Copilot Credits as "a common currency for eligible Microsoft services with usage-based billing", managed through the Cost management area of the Copilot section with spending policies [23]. Pay-as-you-go billing for services such as Copilot Chat and SharePoint agents is disabled by default and is set up in two steps: create a billing policy, then connect it to a service [24].

What carries over from MS-102 and what is genuinely new

Your MS-102 experience covers most of AB-650's tenant and governance domains, but almost none of the AI services domain. Comparing the two outlines, MS-102 is built around tenant deployment, Entra identity, Microsoft Defender XDR and Microsoft Purview compliance [4]. AB-650 keeps much of the tenant and identity material, narrows the security content to Defender for Office 365, adds DSPM and the review of DLP alerts for AI services, and introduces the full AI services domain [1].

This table reflects Examinotion's reading of the two official outlines, not an official Microsoft mapping. The practical message is simple: an MS-102 holder should spend most of their AB-650 study time on the AI services domain, even though it is not the largest by weighting.

A hands-on practice plan for the AI services domain

Hands-on time in a tenant is the most effective preparation for this domain, because most of its skills are admin-centre tasks. Microsoft's free learning path "Manage and secure Microsoft 365 AI services" has seven modules that line up with the outline, from Copilot readiness and rollout through agent identities, the agent registry and Agent 365 tools, to monitoring and optimising AI services [26]. Microsoft lists access to a Microsoft 365 E5 tenant as a prerequisite and describes E7 as preferred because it bundles Agent 365 and the Entra Suite [26].

If you need a lab, the Microsoft 365 Developer Program offers an E5 developer sandbox with 25 user licences for up to 90 days, but only qualifying members are eligible and a valid billing account is required [27]. Our guide to getting hands-on Microsoft 365 Copilot experience without a paid licence covers the other routes.

A practical sequence for a two-week block on this domain:

1. Days 1-3: Copilot settings and readiness. Walk every tab of Copilot > Settings, read the readiness report, and find the web search policy in the Microsoft 365 Apps admin centre.
2. Days 4-5: Data readiness. Run a DSPM data risk assessment, read the SAM Content Management Assessment, and practise enabling Restricted Content Discovery on a test site.
3. Days 6-8: Entra Agent ID. Create or inspect an agent identity, assign owners and sponsors, and build an access package and a Conditional Access policy that target agents.
4. Days 9-10: Agent registry. Approve and reject a publish request, upload a custom agent package, block an agent, and change sharing and user access settings.
5. Days 11-12: Agent 365 governance. Review agent activity, data protection and compliance views, and note which signal comes from Entra, Purview or Defender.
6. Days 13-14: Monitoring and cost. Read the usage report, set up a pay-as-you-go billing policy and a spending policy, and explore Copilot controls.

Microsoft has not yet published an official practice assessment for AB-650. Its exam page says practice assessments usually arrive within eight weeks of an exam leaving beta [2]. Beta exams are also not scored immediately [3], which our Microsoft beta exam guide explains in full. To fit this domain into a full preparation schedule, use our 30-day AB-650 study plan and the AB-650 study guide.

Frequently Asked Questions

What is Microsoft Agent 365 and is it on AB-650?

Microsoft Agent 365 is Microsoft's platform for observing, governing and securing AI agents across an organisation, and it became generally available on 1 May 2026. AB-650 tests it directly: one skill group covers monitoring agent activity, protecting sensitive data and evaluating compliance gaps with Agent 365, and another covers managing tools in Agent 365.

How much of AB-650 covers Copilot and agents?

The "Manage and secure AI services in Microsoft 365" domain accounts for 35-40% of AB-650 and contains 24 skills on Microsoft 365 Copilot, agents, Agent 365 and AI monitoring. Copilot also appears in the other domains, through AI licensing, SharePoint readiness, Teams meeting settings, DSPM and data loss prevention for Copilot, so the real share is higher.

Do I need a Copilot licence to study for AB-650?

You do not strictly need your own Copilot licence, but hands-on practice is far easier with one. Microsoft's AI services learning path expects access to a Microsoft 365 E5 tenant and prefers E7. The Microsoft 365 Developer Program sandbox is an option for qualifying members, and many skills can be explored in documentation and admin centre walkthroughs.

Is AB-650 harder than MS-102?

AB-650 is not easier just because it is an Associate exam. It drops some MS-102 security depth, such as Defender for Endpoint, but adds a large AI services domain covering technology that changes monthly. Microsoft publishes no pass rates, so expect the AI services material to be the hardest part for experienced administrators.

Are preview features tested on AB-650?

Microsoft says most AB-650 questions cover generally available features, but the exam may include preview features if they are commonly used. Microsoft Agent 365 and Microsoft Entra Agent ID are both generally available, while some related capabilities, such as parts of cross-platform agent integration, remain in preview. Study the generally available behaviour first.

Is the Copilot Control System the same as Copilot controls?

Yes. The AB-650 skills outline refers to the Copilot Control System, while Microsoft's current documentation titles the same framework Copilot controls. It brings together security and governance, management controls, and measurement and reporting for Microsoft Copilot and agents. Expect either name in the exam until Microsoft updates the outline.

Conclusion

The AI services domain is the part of AB-650 that separates a modern Microsoft 365 administrator from a traditional one. It asks you to treat Copilot as a governed service, agents as identities with owners and sponsors, and AI usage as a metered cost. Learn where each control lives, practise in a real tenant, and keep an eye on the live outline while the exam is in beta.

When you are ready to test yourself, start practising for AB-650 with Examinotion's exam-aligned practice questions, or browse Examinotion's Microsoft AI exam preparation catalogue to compare AB-650 with the other administrator and Copilot certifications.

Sources

1. Study guide for Exam AB-650: Administering Microsoft 365 and AI Services - Microsoft Learn, accessed 2026-10-26
2. Exam AB-650: Administering Microsoft 365 and AI Services (beta) - Microsoft Learn, accessed 2026-10-26
3. Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate (beta) - Microsoft Learn, accessed 2026-10-26
4. Study guide for Exam MS-102: Microsoft 365 Administrator - Microsoft Learn, accessed 2026-10-26
5. Microsoft 365 Certified: Administrator Expert - Microsoft Learn, accessed 2026-10-26
6. Configure Microsoft Copilot settings in the Microsoft 365 admin center - Microsoft Learn, accessed 2026-10-26
7. Copilot controls overview - Microsoft Learn, accessed 2026-10-26
8. Microsoft Copilot readiness report - Microsoft Learn, accessed 2026-10-26
9. Configure a secure and governed foundation for Microsoft Copilot - Microsoft Learn, accessed 2026-10-26
10. Restrict discovery of SharePoint sites and content - Microsoft Learn, accessed 2026-10-26
11. Learn about Data Security Posture Management - Microsoft Learn, accessed 2026-10-26
12. Agent Registry in Microsoft 365 admin center - Microsoft Learn, accessed 2026-10-26
13. Agent settings in the Microsoft 365 admin center - Microsoft Learn, accessed 2026-10-26
14. Microsoft Agent 365 overview - Microsoft Learn, accessed 2026-10-26
15. Microsoft Agent 365, now generally available, expands capabilities and integrations - Microsoft Security Blog, 1 May 2026, accessed 2026-10-26
16. Agent overview in Microsoft 365 admin center - Microsoft Learn, accessed 2026-10-26
17. What are agent identities? - Microsoft Learn, accessed 2026-10-26
18. What's new in Microsoft Entra Agent ID - Microsoft Learn, accessed 2026-10-26
19. Administrative relationships in Microsoft Entra Agent ID (owners, sponsors and managers) - Microsoft Learn, accessed 2026-10-26
20. Governing agent identities - Microsoft Learn, accessed 2026-10-26
21. Microsoft Entra licensing - Microsoft Learn, accessed 2026-10-26
22. Microsoft Copilot usage report - Microsoft Learn, accessed 2026-10-26
23. Usage-based billing and cost management for Copilot Credits - Microsoft Learn, accessed 2026-10-26
24. Pay-as-you-go overview - Microsoft Learn, accessed 2026-10-26
25. Manage Copilot Cowork for your organization - Microsoft Learn, accessed 2026-10-26
26. Manage and secure Microsoft 365 AI services (learning path) - Microsoft Learn, accessed 2026-10-26
27. Set up a Microsoft 365 developer sandbox subscription - Microsoft Learn, accessed 2026-10-26