AB-650 Govern and Secure Domain Guide 2026: Entra, Defender for Office 365 and Purview

Last updated: November 2026. Written and fact-checked by the Examinotion team against the official Microsoft Learn study guide for AB-650 and the Microsoft Entra, Defender for Office 365 and Microsoft Purview documentation.

TL;DR The "Govern and secure Microsoft 365 tenants and workloads" domain is the largest part of AB-650, at 40-45%. It covers four skill groups: Microsoft Entra identities, authentication and Conditional Access, Defender for Office 365, and Microsoft Purview data protection. Most of it carries over from MS-102, but the security scope is narrower and AI data protection is new.

If you are preparing for AB-650: Administering Microsoft 365 and AI Services, this domain decides more of your score than any other. It is also the domain where experienced MS-102 administrators most often study the wrong things, because AB-650 keeps the identity and Purview core of MS-102 but drops large parts of its Defender XDR content. This guide walks through every skill in the domain, maps each one to the Microsoft documentation that supports it, and flags the details that tend to separate a pass from a near miss.

Why the govern and secure domain carries 40-45% of AB-650

The "Govern and secure Microsoft 365 tenants and workloads" domain is the heaviest of the three AB-650 domains, at 40-45% of the exam. The other two are "Configure and manage Microsoft 365 tenants and workloads" (20-25%) and "Manage and secure AI services in Microsoft 365" (35-40%) [1]. In practice, close to half of your questions will test identity, access, email security and data protection.

AB-650 leads to the Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate certification, and it is the only exam required for that credential [3]. The exam is offered in English only, and Microsoft prices it by the country or region in which it is proctored [2]. The passing score is 700 [1]. As an Associate certification it expires annually, and you renew it through a free online assessment on Microsoft Learn [1].

The domain contains 21 skills split into four groups [1]:

Read the exact verbs in the Purview bullets, because they set the depth of the questions. Three of the five Purview skills begin with "Identify requirements for", which signals scenario questions about choosing the right control rather than step-by-step configuration [1]. The identity, authentication and Defender bullets, by contrast, use verbs such as "create", "configure", "implement" and "manage" [1], so expect more hands-on, task-based questions there.

The study guide also notes that most questions cover generally available features, although "the exam may contain questions on Preview features if those features are commonly used" [1]. For a broader view of all three domains, start with our AB-650 exam guide.

Manage identities in Microsoft Entra

The identity skill group tests everyday Microsoft Entra ID administration: users, guests, groups, roles, administrative units, contacts and bulk changes. The seven official bullets are: create and manage Microsoft 365 users; manage guest users and external access settings; create and manage groups, including Microsoft 365 groups; manage roles for Microsoft 365, including Microsoft Entra Privileged Identity Management (PIM); create and manage administrative units; create and manage contacts; and perform bulk management, including Microsoft Graph PowerShell [1].

Guests and external access

Microsoft Entra B2B collaboration is enabled by default, and two separate settings areas control it. Cross-tenant access settings govern how your tenant authenticates with other Microsoft Entra tenants, inbound and outbound, while external collaboration settings control who can invite guests [6]. Where the two conflict, the most restrictive setting applies [6]. Guest accounts appear in the directory as user objects, typically with a user type of Guest [6].

Administrative units

An administrative unit (AU) limits an administrator's management scope to a subset of users, groups or devices, and AUs cannot be nested. A role assigned without an AU scope applies to the whole tenant [7]. Two details make good exam distractors. Adding a group to an AU brings the group itself into scope, not its members [7]. And AUs restrict management permissions only, so they do not stop users browsing other users through default directory permissions [7].

Licensing matters here too. Microsoft states that each AU administrator needs a Microsoft Entra ID P1 licence, AU members need only Microsoft Entra ID Free, and AUs with dynamic membership need P1 for every member [7].

Roles and Privileged Identity Management

Privileged Identity Management (PIM) provides just-in-time, time-bound and approval-based activation of privileged roles. It can require multifactor authentication (MFA) and a justification on activation, and it supports access reviews and an audit history of role activity [8]. The core distinction to learn is between eligible assignments, which the user must activate before use, and active assignments, which apply immediately [8].

Only a Privileged Role Administrator or Global Administrator can manage Microsoft Entra role assignments in PIM [8]. PIM is a licensed capability: Microsoft states that you need either Microsoft Entra ID Governance licences or Microsoft Entra ID P2 licences to use PIM and all of its settings [8][25].

Bulk management with Microsoft Graph PowerShell

Microsoft Graph PowerShell is the module the exam expects for bulk user management, because the older Azure AD PowerShell module is deprecated. Microsoft scheduled Azure AD PowerShell for deprecation in March 2024 and recommends Microsoft Graph PowerShell in its place [23]. A typical workflow connects with Connect-MgGraph -Scopes "User.ReadWrite.All", creates accounts with New-MgUser, and loops through a CSV file with Import-Csv for bulk creation [9].

Set a usage location before you assign a licence. Microsoft's guidance is that a user account needs a usage location before Set-MgUserLicense can assign a licence to it [9]. It is a small detail, but it is exactly the kind of prerequisite that turns up in a "why did this script fail" scenario.

Implement and manage authentication and access

The authentication skill group covers how users prove who they are and the policies that decide whether they get in. The five bullets are: configure and manage authentication methods; implement and manage Microsoft Entra Password Protection; configure self-service password reset (SSPR); investigate and resolve authentication issues; and implement and manage Microsoft Entra Conditional Access policies, including Microsoft Entra ID Protection and MFA [1].

Authentication methods and SSPR

The Authentication methods policy is now the recommended place to manage sign-in methods in Microsoft Entra ID. Microsoft states that from 30 September 2025, authentication methods can no longer be managed in the legacy MFA and SSPR policies, although security questions are still enabled through the legacy SSPR policy [10]. If an exam option suggests enabling a method such as Microsoft Authenticator in the legacy policies, treat it with suspicion.

Self-service password reset (SSPR) requires users to register at least one authentication method, and administrators can require one or two. Microsoft highly recommends enabling two or more authentication methods, so users still have a way in if one method is unavailable [11]. For hybrid identities, where passwords live in on-premises Active Directory, SSPR depends on password writeback [11]. Administrator accounts are held to a stronger two-gate policy than standard users [11].

Microsoft Entra Password Protection

Microsoft Entra Password Protection blocks weak passwords by combining a global banned password list with an optional custom list. The global list is applied automatically and cannot be disabled, and the custom list holds up to 1,000 terms [12]. Passwords are normalised and fuzzy-matched against both lists, then scored, and a password needs at least five points to be accepted [12].

The licensing split is testable. Microsoft states that the global list is available with Microsoft Entra ID Free for cloud-only users, while the custom list requires Microsoft Entra ID P1 or P2 [12]. Users synchronised from on-premises Active Directory need P1 or P2 for both [12].

Conditional Access and ID Protection

Conditional Access policies are if-then statements that Microsoft Entra ID evaluates after the first authentication factor is complete. Signals include the user or group, location, device, application and risk, and the decision is either to block access or to grant it with controls such as MFA, an authentication strength or a compliant device [13]. Conditional Access requires Microsoft Entra ID P1 [13].

Report-only mode lets you test a Conditional Access policy without enforcing it. Report-only policies are evaluated at sign-in and the results appear in the sign-in logs and, with an Azure Monitor subscription, in the Conditional Access insights workbook [14]. Two caveats are worth remembering: policies scoped to user actions cannot be evaluated in report-only mode, and a report-only policy that requires a compliant device can still prompt users on macOS, iOS and Android for a device certificate [14].

Microsoft Entra ID Protection supplies the risk signals that risk-based Conditional Access policies act on. It provides three reports, covering risk detections, risky sign-ins and risky users [15]. Risk-based policies need Microsoft Entra ID P2, and when a user completes the required control, such as MFA or a secure password reset, the risk is remediated automatically [13][15]. Administrators can also dismiss risk, confirm a sign-in safe or confirm a user compromised [15].

The "investigate and resolve authentication issues" bullet ties these together. In practice it means reading sign-in logs, working out which Conditional Access policy applied, and spotting whether a method, a risk level or a device state blocked the user [13][14].

Secure Microsoft 365 workloads with Defender for Office 365

The workload security skill group is focused entirely on Microsoft Defender for Office 365, not the wider Defender XDR suite. Its four bullets are: manage alerts in Microsoft Defender for Office 365; configure threat policies and rules in Defender for Office 365; investigate and respond to email and collaboration threats by using Defender for Office 365; and configure and manage attack simulations, including training campaigns [1].

Plan 1 versus Plan 2

Knowing which Defender for Office 365 features belong to Plan 1 and which need Plan 2 answers a surprising number of scenario questions. Plan 1 adds Safe Links, Safe Attachments (including for SharePoint, OneDrive and Teams), impersonation protection in anti-phishing policies, and Real-time detections [16]. Plan 2 adds attack simulation training, Threat Explorer, Threat Trackers, campaigns, automated investigation and response (AIR) and priority account protection [16].

Source for the table: Microsoft's Defender for Office 365 overview [16].

Threat policies and preset security policies

Preset security policies are the quickest way to apply Microsoft's recommended threat protection settings, and there are three of them. Built-in protection applies Safe Links and Safe Attachments by default, while the Standard and Strict presets apply progressively tighter settings [17]. Users covered by the Standard or Strict presets, or by custom Safe Links or Safe Attachments policies, are not affected by Built-in protection [17]. As a quick example of the difference, Standard sends spam to the Junk Email folder, while Strict sends it to quarantine [17].

The exam bullet says "threat policies and rules" rather than naming each policy, so be comfortable with the full set: anti-malware, anti-spam, anti-phishing, Safe Links and Safe Attachments, and when a custom policy is a better fit than a preset [1][17].

Attack simulation and training campaigns

Attack simulation training requires Microsoft 365 E5 or Defender for Office 365 Plan 2. Microsoft notes that organisations with Microsoft 365 E3 get only a limited trial [18]. Simulations can use social engineering techniques including Credential Harvest, Malware Attachment, Link in Attachment, Link to Malware, Drive-by-url and OAuth Consent Grant, and QR code payloads are supported [18].

A training campaign is different from a simulation. Training campaigns assign training to users without sending a simulated attack first [18]. That distinction maps directly onto the "including training campaigns" wording in the exam bullet. One more detail worth knowing: Microsoft states there are no PowerShell cmdlets for attack simulation training [18].

Protect data in Microsoft 365 with Microsoft Purview

The Purview skill group tests whether you can pick the right data protection control for a requirement, including controls for Copilot and other AI services. The five bullets are: identify requirements for Microsoft Purview Data Loss Prevention (DLP) policies, including those for Exchange, SharePoint, OneDrive, Teams, endpoints and Copilot; identify requirements for information protection, including sensitive information types, sensitivity labels and sensitivity label policies; identify requirements for data lifecycle management, including retention labels, retention label policies and retention policies; review and respond to DLP alerts for Microsoft 365 and AI services; and monitor and secure AI activity by using Microsoft Purview Data Security Posture Management (DSPM) [1].

DLP, including DLP for Copilot

Microsoft Purview DLP can now protect Microsoft 365 Copilot and Copilot Chat as a policy location in its own right. Microsoft's documentation, titled "Microsoft Purview DLP for Microsoft 365 Copilot and Cowork", explains that the Copilot location is available only in the Custom policy template, and that selecting it disables the other locations in that policy [19]. In other words, Copilot DLP is a separate policy, not a tick box added to your Exchange policy.

The Copilot location supports several protections: excluding files and emails with specific sensitivity labels from Copilot processing, blocking external web search when a prompt contains sensitive information types, and, in preview, blocking prompts that contain sensitive information types [19]. Microsoft also notes that a single rule cannot combine sensitive information type and sensitivity label conditions, and that policy changes can take up to four hours to apply [19]. Our explainer on how Microsoft 365 Copilot grounding works shows why permissions and labels shape what Copilot can reach.

Sensitivity labels and label policies

A sensitivity label is a persistent classification stored in an item's metadata, and each item can carry only one. Labels reach users through sensitivity label policies, which can set a default label, require users to justify removing or lowering a label, and make labelling mandatory [20]. If a user is in several label policies and their settings conflict, the policy with the highest priority wins [20].

Encrypted content needs the right usage rights before Copilot can use it. Microsoft states that for labels that apply encryption, Copilot returns data only when the user has the EXTRACT usage right [20]. Expect that detail in any question that asks why Copilot did not summarise a protected document.

Retention labels versus retention policies

Retention policies apply settings at the container level, while retention labels apply them to individual items. A retention policy targets locations such as a SharePoint site or an Exchange mailbox, while a retention label is applied to a specific document, email or folder [21]. Label settings travel with content when it moves within the tenant, and policy settings do not [21].

A document or email can carry both a sensitivity label and a retention label at the same time, because they solve different problems [20]. Retention labels do not persist outside Microsoft 365, whereas sensitivity labels do [21].

DSPM and DLP alerts for AI services

Data Security Posture Management (DSPM) is the Purview experience for monitoring and securing AI activity, and it is the newest Purview skill on the exam. Microsoft's current DSPM unifies data security posture across Microsoft 365 and other data sources, including AI observability and data risk assessments [22]. It supersedes the earlier experiences, now labelled "DSPM for AI (classic)" and "DSPM (classic)", which remain available [22]. The exam bullet uses the plain "DSPM" name, so study the current version and treat the classic names as a terminology trap [1][22].

The companion bullet, reviewing and responding to DLP alerts for Microsoft 365 and AI services, extends ordinary DLP alert triage to AI interactions [1]. If you studied Purview for a fundamentals exam, our AB-900 data protection and governance guide covers the same controls at a lighter depth and is a useful warm-up.

What carries over from MS-102 and what does not

Most of AB-650's govern and secure domain carries over from MS-102, but AB-650 drops much of MS-102's Defender XDR and identity synchronisation content. MS-102, the Microsoft 365 Administrator exam, retires on 30 November 2026 at 11:59 PM Central Standard Time [4]. Microsoft's June 2026 credentials roundup lists the AB-650 certification as the recommended new certification for the retiring Microsoft 365 Administrator Expert, although Microsoft has also said it does not see AB-650 as an exact equivalent [5].

MS-102's skills outline has four domains: deploy and manage a Microsoft 365 tenant (25-30%), implement and manage Microsoft Entra identity and access (25-30%), manage security and threats by using Microsoft Defender XDR (30-35%), and manage compliance by using Microsoft Purview (10-15%) [4]. AB-650 folds identity, security and compliance into one 40-45% domain and gives the rest of its weight to tenant administration and AI services [1].

This comparison is Examinotion's reading of the two official outlines [1][4], not an official Microsoft mapping. Remember that the study guide says the bullets illustrate how skills are assessed and that related topics may also appear, so do not delete your Defender XDR knowledge entirely [1]. The exam's audience profile still expects an understanding of Defender XDR capabilities [2]. If you are still deciding whether to sit MS-102 before it goes, our MS-102 retirement decision guide covers that choice.

Terminology traps in this domain

Several products in this domain have been renamed, and the exam uses the current names. Use this list to translate older study material:

• Azure Active Directory is now Microsoft Entra ID. Azure AD Premium P1 and P2 became Microsoft Entra ID P1 and P2, and the official governance product name is Microsoft Entra ID Governance [23].
• Azure AD PowerShell was scheduled for deprecation in March 2024. Microsoft Graph PowerShell is the recommended module [23].
• The Microsoft Purview compliance portal has been retired. Purview tasks now live in the Microsoft Purview portal [24].
• DSPM for AI is now DSPM for AI (classic). The earlier DSPM is now DSPM (classic), and the current product is simply Data Security Posture Management [22].
• Legacy MFA and SSPR policies no longer manage authentication methods. The Authentication methods policy does, apart from security questions [10].

How to practise the govern and secure domain

Hands-on time in a Microsoft 365 tenant is the most efficient preparation for this domain, because most of its skills are admin centre tasks with specific prerequisites. A useful sequence for a two-week study block:

1. Days 1-3: Identities. Create users individually and in bulk with Microsoft Graph PowerShell, invite a guest, build an administrative unit and assign a scoped role, then make a user eligible for a role in PIM and activate it.
2. Days 4-6: Authentication. Review the Authentication methods policy, configure SSPR with two required methods, and add custom banned passwords to Password Protection.
3. Days 7-8: Conditional Access. Build an MFA policy in report-only mode, read the results in the sign-in logs, then add a risk-based policy and review the ID Protection reports.
4. Days 9-11: Defender for Office 365. Compare the Standard and Strict presets, review alerts and investigate a message, and set up an attack simulation and a separate training campaign.
5. Days 12-14: Purview. Create a DLP policy for the Copilot location, publish a sensitivity label policy, decide between a retention policy and a retention label for three sample requirements, and explore DSPM.

Microsoft's AB-650 exam page says the official practice assessment is not yet available, and that practice assessments usually arrive within eight weeks of an exam being out of beta and generally available [2]. Until then, use our AB-650 practice questions and answers to test your reasoning, and fit this domain into a full schedule with our 30-day AB-650 study plan and the AB-650 study guide.

Frequently Asked Questions

What is the largest domain on the AB-650 exam?

The largest AB-650 domain is "Govern and secure Microsoft 365 tenants and workloads", worth 40-45% of the exam. It covers Microsoft Entra identities, authentication and Conditional Access, Defender for Office 365 and Microsoft Purview data protection. The AI services domain follows at 35-40%, and tenant and workload configuration accounts for 20-25%.

Does AB-650 cover Conditional Access and PIM?

Yes. AB-650 explicitly lists implementing and managing Microsoft Entra Conditional Access policies, including Microsoft Entra ID Protection and multifactor authentication. It also lists managing Microsoft 365 roles, including Privileged Identity Management. Expect scenario questions on eligible versus active role assignments, report-only policies and which licence a risk-based policy requires.

Is Defender XDR on the AB-650 exam?

AB-650's security skills focus on Microsoft Defender for Office 365: alerts, threat policies, investigating email and collaboration threats, and attack simulations. Defender XDR incidents, Secure Score and Defender for Endpoint are not listed as skills, unlike on MS-102. The audience profile still expects an understanding of Defender XDR capabilities, so keep the broad concepts fresh.

How much of MS-102 carries over to AB-650?

Most of the MS-102 identity, access and Purview content carries over to AB-650, including PIM, Conditional Access, SSPR, DLP, sensitivity labels and retention. AB-650 drops identity synchronisation and most Defender XDR content, keeps Defender for Office 365, and adds DSPM, DLP alerts for AI services and a full AI services domain worth 35-40%.

What Microsoft Purview topics are on AB-650?

AB-650 tests Microsoft Purview Data Loss Prevention for Exchange, SharePoint, OneDrive, Teams, endpoints and Copilot, plus sensitive information types, sensitivity labels and label policies, retention labels and retention policies. It also covers reviewing DLP alerts for Microsoft 365 and AI services and monitoring AI activity with Data Security Posture Management.

Do I need Microsoft Graph PowerShell for AB-650?

Yes, at a practical level. AB-650 lists bulk management, including Microsoft Graph PowerShell, as a skill, and its audience profile expects familiarity with Graph PowerShell. Learn how to connect with the right scopes, create users with New-MgUser, import users from a CSV file and assign licences with Set-MgUserLicense after setting a usage location.

Conclusion

The govern and secure domain is where AB-650 is won or lost on weighting alone. For MS-102 administrators the good news is that identity, access and Purview fundamentals carry straight over. The trap is spending study time on Defender XDR depth the exam no longer lists, while underestimating DLP for Copilot, DSPM and the exact licensing behind each Entra feature. Work through each skill in a real tenant, learn the verbs in each bullet, and check the live study guide before you book.

When you are ready to test yourself, start practising for AB-650 with Examinotion's exam-aligned practice questions, or browse Examinotion's Microsoft AI exam preparation courses to compare AB-650 with the other administrator and Copilot certifications. If you are weighing AB-650 against the fundamentals route, our AB-900 vs AB-650 comparison can help.

Sources

1. Study guide for Exam AB-650: Administering Microsoft 365 and AI Services - Microsoft Learn, accessed 2026-11-04
2. Exam AB-650: Administering Microsoft 365 and AI Services - Microsoft Learn, accessed 2026-11-04
3. Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate - Microsoft Learn, accessed 2026-11-04
4. Study guide for Exam MS-102: Microsoft 365 Administrator - Microsoft Learn, accessed 2026-11-04
5. Microsoft Credentials roundup: June 2026 - Microsoft Tech Community, accessed 2026-11-04
6. What is Microsoft Entra B2B collaboration? - Microsoft Learn, accessed 2026-11-04
7. Administrative units in Microsoft Entra ID - Microsoft Learn, accessed 2026-11-04
8. What is Privileged Identity Management? - Microsoft Learn, accessed 2026-11-04
9. Create Microsoft 365 user accounts with PowerShell - Microsoft Learn, accessed 2026-11-04
10. Manage authentication methods - Microsoft Learn, accessed 2026-11-04
11. Self-service password reset deep dive - Microsoft Learn, accessed 2026-11-04
12. Password protection in Microsoft Entra ID - Microsoft Learn, accessed 2026-11-04
13. Microsoft Entra Conditional Access: Zero Trust Policy Engine - Microsoft Learn, accessed 2026-11-04
14. Conditional Access Policy Insights: Monitoring and Evaluation - Microsoft Learn, accessed 2026-11-04
15. What is Microsoft Entra ID Protection? - Microsoft Learn, accessed 2026-11-04
16. Why do I need Microsoft Defender for Office 365? - Microsoft Learn, accessed 2026-11-04
17. Preset security policies - Microsoft Learn, accessed 2026-11-04
18. Get started using Attack simulation training - Microsoft Learn, accessed 2026-11-04
19. Microsoft Purview DLP for Microsoft 365 Copilot and Cowork - Microsoft Learn, accessed 2026-11-04
20. Learn about sensitivity labels - Microsoft Learn, accessed 2026-11-04
21. Learn about retention policies and labels to retain or delete - Microsoft Learn, accessed 2026-11-04
22. Learn about Microsoft Purview Data Security Posture Management (DSPM) - Microsoft Learn, accessed 2026-11-04
23. New name for Azure Active Directory - Microsoft Learn, accessed 2026-11-04
24. Learn about the Microsoft Purview portal - Microsoft Learn, accessed 2026-11-04
25. Microsoft Entra ID Governance licensing fundamentals - Microsoft Learn, accessed 2026-11-04