AB-650 Practice Questions and Answers: 15 Worked Examples (2026)

Last updated: October 2026. Fact-checked against the Microsoft Learn AB-650 exam page, study guide and product documentation.

TL;DR Microsoft has not yet released an official practice assessment for AB-650, so original, outline-mapped questions are the best way to test yourself. Below are 15 worked AB-650 practice questions spread across all three skills domains in proportion to their weighting, each with the correct answer, an explanation of every distractor and a Microsoft Learn reference.

Exam AB-650 (Administering Microsoft 365 and AI Services) is the single exam behind the Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate certification, and on 30 October 2026 both its exam page and certification page are still labelled beta [2][3]. It tests whether you can run a Microsoft 365 tenant and govern the Copilot, agent and AI services that now sit inside it. Every question in this article was written by the Examinotion team against the official AB-650 skills outline [1]. If you are still at the "what is this exam?" stage, read the AB-650 exam guide first, then come back to test yourself.

How these AB-650 practice questions are built

These AB-650 practice questions are original scenarios, each mapped to a named skill in Microsoft's published study guide [1]. None reproduces, paraphrases or imitates real exam content. Microsoft exam candidates agree not to disclose exam questions, and Examinotion never sources material from sites claiming to supply them.

Each question follows the pattern Microsoft uses for associate-level administrator exams: a short business scenario, a constraint that rules out the obvious answer, and four plausible options. The explanation under each answer says why the right option fits the constraint and why each wrong option fails. Read the explanations even when you answer correctly, because a right answer reached for the wrong reason is a gap you will meet again on exam day.

The question count per domain follows the official weighting [1]:

AB-650 exam format at a glance

The AB-650 exam format is only partly published, and the honest answer to several common questions is "Microsoft has not said". The table separates what is confirmed from what is not.

Microsoft's recommended background is experience with Microsoft 365 workloads and Microsoft Entra ID, an understanding of Defender XDR capabilities and familiarity with Microsoft Graph PowerShell [1]. That is guidance rather than a formal prerequisite, but it is an accurate picture of the depth the questions assume. If you are coming from the retiring MS-102 exam, which Microsoft retires on 30 November 2026 at 11:59 PM Central Standard Time [6], the MS-102 to AB-650 decision guide covers the switch.

One more format point matters for how you read the questions below. The AB-650 study guide states that most questions cover generally available features, although the exam may include Preview features that are commonly used [1]. Microsoft also does not disclose which question formats a given exam uses [4]. Our guide to Microsoft exam question types explains the formats you might meet.

Domain 1 practice questions: Microsoft 365 tenants and workloads

The tenants and workloads domain covers tenant settings, licensing, Microsoft 365 Backup, Service health, mailboxes, Teams, SharePoint sites and configuring SharePoint and OneDrive for Copilot [1]. It carries 20-25% of the AB-650 score.

Question 1

A ransomware incident encrypted files across a SharePoint site three days ago. The organisation protects the site with Microsoft 365 Backup. The business wants the site returned to a pre-incident state as quickly as possible, in its original location. What should the administrator do?

• A. Restore the site from the SharePoint recycle bin
• B. Perform an in-place restore of the site from an express restore point taken before the incident
• C. Restore the site to a new URL and ask users to move their work across manually
• D. Open a support request so Microsoft can restore the site from its own service backups

Answer: B

Why: Microsoft 365 Backup protects SharePoint sites, OneDrive accounts and Exchange mailboxes, and keeps recovery points every 10 minutes for the past two weeks for SharePoint and OneDrive [9]. An incident three days old is well inside that window, and the fastest path is an in-place restore from one of the roughly daily express restore points the restore workflow recommends [9]. The recycle bin (A) holds deleted items, not earlier versions of files that ransomware encrypted in place. Restoring to a new URL (C) works but fails the "original location, as quickly as possible" requirement. Option D ignores a backup product the organisation already pays for.

Question 2

An IT operations lead has two requirements. First, the team wants advance notice of upcoming changes to Microsoft 365 services so it can prepare users. Second, two on-call engineers must receive email when a service incident is posted. Which two actions meet the requirements? Select two.

• A. Review planned changes in Message center rather than Service health
• B. Configure Service health email notifications for the two on-call engineers' addresses
• C. Wait for planned maintenance to appear as an advisory in Service health
• D. Assign both engineers the Global Administrator role so they see incidents first

Answer: A and B

Why: Service health shows incidents (critical issues) and advisories (problems affecting some users while the service remains available), but planned maintenance is not shown there. Microsoft directs administrators to Message center for upcoming changes [10]. Service health email notifications can be sent to up to two email addresses, which exactly fits the two on-call engineers [10]. Option C waits in the wrong place. Option D is a least-privilege failure, since roles such as Service Support Administrator and Helpdesk Administrator can already view service health [10].

Question 3

Before a Microsoft 365 Copilot rollout, a data readiness review finds that a legacy finance SharePoint site is visible to far more people than intended. Fixing the permissions properly will take several weeks. In the meantime, the organisation does not want content from that site surfacing in organisation-wide search and Copilot results, but the site's existing members must keep working normally. The organisation has Copilot licences and SharePoint Advanced Management. What should the administrator do first?

• A. Enable Restricted Content Discovery on the site
• B. Remove the site from the Microsoft 365 search index
• C. Apply a sensitivity label to the site so its files inherit the label
• D. Remove all permissions from the site until the review is finished

Answer: A

Why: Restricted Content Discovery is a site-level control designed as a temporary governance measure. It stops a site's content appearing in organisation-wide search and Copilot discovery without changing existing permissions, so members keep their access [11]. It also does not remove content from the search index, so Purview eDiscovery and auto-labelling continue to work [11]. The one trade-off is that it also hides Copilot actions on the site itself [11], which is acceptable for an interim control. Removing the site from the index (B) breaks search for legitimate users too. Container labels on sites are not inherited by the items inside them [16], so option C does not protect the files. Option D stops the business working. Note that Restricted Content Discovery requires SharePoint Advanced Management and does not support OneDrive [11].

Domain 2 practice questions: governing and securing Microsoft 365

The governance and security domain is the largest at 40-45%. It covers Microsoft Entra identities and roles, authentication and Conditional Access, Microsoft Defender for Office 365 and data protection with Microsoft Purview [1].

Question 4

An organisation must reduce standing administrative access. Exchange administrators should hold the Exchange Administrator role only while they are doing admin work, each activation must be approved by the messaging lead, and every activation must be logged. What should the identity team configure?

• A. Permanent active assignments of the Exchange Administrator role, with a quarterly access review
• B. Eligible assignments of the Exchange Administrator role in Microsoft Entra Privileged Identity Management (PIM), with approval required on activation
• C. A Conditional Access policy that requires multifactor authentication for the Exchange admin centre
• D. A dedicated administrative unit containing the Exchange administrators

Answer: B

Why: The requirement is just-in-time, approved and audited role activation, which is the purpose of Privileged Identity Management. The AB-650 outline names PIM explicitly under managing roles for Microsoft 365 [1]. An eligible assignment means the user holds no active privilege until they activate the role, and the role setting can require an approver. Option A keeps standing access, which is what the organisation is trying to remove. Option C strengthens sign-in but leaves the privilege permanent. Option D scopes who can be managed, not when a role is active.

Question 5

A multinational organisation wants its German helpdesk team to reset passwords and update profile details for users in the Berlin and Munich offices only. The team must not be able to manage users in any other country. What is the least-privileged design?

• A. Assign the helpdesk team the User Administrator role at the tenant level
• B. Create an administrative unit containing the German users and assign the helpdesk team a user management role scoped to that administrative unit
• C. Create a Microsoft 365 group containing the German users and make the helpdesk team its owners
• D. Assign the helpdesk team the Global Administrator role and ask them to follow a written procedure

Answer: B

Why: Administrative units exist to scope Microsoft Entra roles to a subset of users or groups, and creating and managing them is a named AB-650 skill [1]. A role assigned at the administrative unit scope applies only to members of that unit, which satisfies "Germany only". Option A grants tenant-wide user management. Group ownership (C) controls group membership, not password resets or user profiles. Option D relies on a procedure rather than a technical control and grants far more privilege than the task needs.

Question 6

An organisation runs an autonomous agent that calls Microsoft Graph on its own schedule, with no signed-in user, using its own agent identity. Security has an existing Conditional Access policy targeting all users that blocks sign-ins from high-risk locations. A review shows the policy has never evaluated the agent's access. What should the security team do?

• A. Add the agent's creator to the existing user policy
• B. Create a Conditional Access policy that targets the agent identity, or the agent identity blueprint it was created from
• C. Target the agent's user account, because that automatically covers the agent identity as well
• D. Nothing, because Conditional Access cannot apply to agents

Answer: B

Why: Microsoft documents three Conditional Access patterns for agents. When an agent acts on behalf of a user, you target the user. When an agent acts with application-only access, as here, you target the agent identity or its blueprint. When an agent signs in as an agent user, you target agent users [13]. A policy that targets the agent identity does not apply to the agent's user account, and the reverse is also true, so option C is wrong [13]. Option A targets a person who is not involved in the sign-in, and option D is false. Conditional Access for agents needs Microsoft 365 E7, or an Agent 365 licence paired with at least Microsoft Entra P1 or Microsoft 365 E3 [13].

Question 7

A security team on Microsoft 365 E3 wants to run attack simulations that test whether staff will approve a malicious OAuth app consent request, in addition to credential-harvesting simulations. What does the organisation need?

• A. Nothing extra, because Microsoft 365 E3 includes every attack simulation technique
• B. Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2
• C. The Attack Payload Author role assigned to the security team
• D. A training campaign, which runs OAuth simulations automatically

Answer: B

Why: Attack simulation training requires Microsoft 365 E5 or Defender for Office 365 Plan 2 for full use, while E3 organisations get only a limited trial covering Credential Harvest [14]. OAuth Consent Grant is one of the full product's techniques [14]. The Attack Payload Author role (C) only creates payloads, and the Attack Simulation Administrator role is the one that creates and manages simulations [14]. Training campaigns (D) assign training to users without running a simulation at all [14].

Question 8

A compliance officer wants two controls for Microsoft 365 Copilot. First, Copilot must not respond to prompts that contain credit card numbers. Second, Copilot must not process files and emails labelled "Highly Confidential". The administrator starts building a Microsoft Purview data loss prevention (DLP) policy. Which design will work?

• A. One DLP policy using a built-in financial template, with a single rule that combines the credit card sensitive information type and the "Highly Confidential" label as conditions
• B. A custom DLP policy scoped to the "Microsoft 365 Copilot and Copilot Chat" location, with one rule for the credit card sensitive information type and a separate rule for the "Highly Confidential" label
• C. An Exchange DLP policy, because Copilot reads email through Exchange
• D. A retention label applied to all "Highly Confidential" content

Answer: B

Why: The Copilot DLP location is "Microsoft 365 Copilot and Copilot Chat", and it is available only through the Custom policy template [15]. It can block prompts containing sensitive information types (a capability still rolling out in preview) and exclude labelled files and emails from processing, but sensitive information type conditions and sensitivity label conditions cannot be combined in the same rule, so two rules are needed [15]. Option A fails on both the template and the combined rule. Exchange DLP (C) does not govern Copilot processing, and retention (D) manages lifecycle, not AI access. Two exam-worthy limits are worth remembering: files uploaded directly into a prompt are not scanned, and policy changes can take up to four hours to apply [15].

Question 9

A user reports that Microsoft 365 Copilot refuses to summarise a protected strategy document but does include a link to it in its response. The user can open and read the document normally. The document carries a sensitivity label with encryption. What is the most likely cause?

• A. The user lacks a Microsoft 365 Copilot licence
• B. The label grants the user the VIEW usage right but not the EXTRACT usage right
• C. The document is stored in OneDrive rather than SharePoint
• D. Restricted Content Discovery is enabled on the user's OneDrive

Answer: B

Why: When a user has VIEW but not EXTRACT on encrypted content, Copilot will not summarise it but can reference it with a link, which matches the symptom exactly [16]. EXTRACT appears in Purview as "Copy and extract content" and is included in Full control [16]. Option A would stop Copilot working entirely rather than for one document. Storage location (C) is not the deciding factor, and Restricted Content Discovery (D) does not support OneDrive [11]. On exam day, link "Copilot can see it but won't summarise it" to usage rights.

Domain 3 practice questions: AI services and agents in Microsoft 365

The AI services domain carries 35-40% of the score and is the part of AB-650 with no MS-102 equivalent. It covers enabling and managing Microsoft 365 Copilot, managing agents with Microsoft Entra Agent ID and the agent registry, governing agents with Microsoft Agent 365, and monitoring AI usage and cost [1]. For a deeper walkthrough of this domain, see our AB-650 AI services and Agent 365 guide.

Question 10

An employee has built a line-of-business agent and submitted it for publication to the organisation. The head of IT wants a dedicated administrator for agents to review and publish such requests, without granting tenant-wide administrative control. Which Microsoft Entra role should be assigned?

• A. Global Administrator
• B. AI Administrator
• C. Global Reader
• D. Teams Administrator

Answer: B

Why: The AI Administrator role manages all aspects of Microsoft Copilot and AI-related enterprise services in Microsoft 365, including approving and publishing line-of-business agents [12]. In the admin centre, organisation agents go through submission and approval, where administrators review each request and either publish the agent or reject it [18]. The AI Administrator role is a privileged role, but far narrower than Global Administrator (A), which would work but breaches least privilege. Global Reader (C) can view Copilot settings but not change them [19]. Teams Administrator (D) manages the Teams service and is not the role Microsoft assigns to approve and publish line-of-business agents [12]. A naming trap to watch: Purview documentation refers to the same role as "Microsoft Entra AI Admin" [15].

Question 11

An administrator reviewing Agents > All Agents > Registry in the Microsoft 365 admin centre notices that one Copilot Studio agent appears twice: once as "Shared by creator" and once as "Published by your org". The administrator suspects a duplicate created in error. What is the correct interpretation?

• A. The registry is corrupted and the agent must be deleted and rebuilt
• B. Both entries are legitimate, because the same Copilot Studio agent can be both shared by its creator and published by the organisation
• C. One of the entries is a third-party copy and should be blocked immediately
• D. The agent was uploaded twice as a .zip manifest and one upload should be removed

Answer: B

Why: The agent registry groups agents into four types: Microsoft agents, external partner-built agents, agents published by your organisation and agents shared by their creator. Microsoft notes that the same Copilot Studio agent can legitimately appear under both "Shared by creator" and "Published by your org" [17]. Deleting (A) or blocking (C) would disrupt a working agent on a false premise. Option D confuses the "Add agent" .zip manifest upload path with how Copilot Studio agents appear [17].

Question 12

A finance director is concerned that staff are buying Microsoft 365 Copilot on company cards through self-service purchase. The organisation still wants staff to be able to start trials so it can gauge demand. Where and how should the administrator meet the requirement?

• A. In the Microsoft 365 admin centre, under Copilot > Settings > User access, set Microsoft Copilot self-service purchases to allow trials only
• B. In the Microsoft Entra admin centre, block the Copilot app with Conditional Access
• C. Remove every user's Microsoft 365 Copilot licence
• D. Set self-service purchases to prevent all trials and purchases

Answer: A

Why: Self-service purchase control for Copilot sits under Copilot > Settings > User access in the Microsoft 365 admin centre, with three choices: allow trials or purchases, allow trials only, or prevent self-service purchases [19]. "Allow trials only" meets both halves of the requirement. Option D blocks trials as well. Options B and C attack the wrong problem, since the concern is purchasing, not licensed use. Configuring self-service purchases is named in the AB-650 outline under tenant Copilot settings [1].

Question 13

An organisation wants users without Microsoft 365 Copilot licences to use SharePoint agents in Copilot Chat on a pay-as-you-go basis. A Global Reader opens the pay-as-you-go page and finds nothing switched on. What must happen to enable the billing?

• A. Nothing, because pay-as-you-go is enabled by default for every tenant
• B. A Global Administrator, Billing Administrator or AI Administrator must create a billing policy linked to an Azure subscription, then connect that policy to the service
• C. The Global Reader must create the billing policy, because Global Reader has billing rights
• D. Each user must buy a Copilot licence before pay-as-you-go can be configured

Answer: B

Why: Pay-as-you-go for Copilot Chat, SharePoint agents and the Retrieval API (preview) is disabled by default and is set up in two steps: add a billing policy linked to an Azure subscription, then connect it to a service [20]. Global Administrators, Billing Administrators and AI Administrators can manage it, while Global Readers have read-only access [20]. That rules out options A and C. Option D defeats the purpose, since pay-as-you-go exists to serve unlicensed users. Usage is billed through the linked Azure subscription [20]. Other metered AI services, such as Copilot Cowork, are billed in Copilot Credits instead, so read each scenario carefully [26].

Question 14

A Copilot adoption lead reviews the Microsoft Copilot usage report and asks two questions: why is the number of active users much lower than the number of enabled users, and why are usernames not shown? Which two statements answer the questions correctly? Select two.

• A. Enabled users are those with a Copilot licence, while active users are those who took an intentional action, such as submitting a prompt. Opening the Copilot pane alone does not count
• B. Usernames are concealed by default in usage reports, and an administrator can change that setting
• C. Active users are calculated from the unified audit log, which is the recommended basis for Copilot usage reporting
• D. The report only covers the last seven days, so most users are excluded

Answer: A and B

Why: The Copilot usage report defines enabled users as those with Copilot licences and active users as those who took an intentional action with Copilot, so opening the chat pane does not count but submitting a prompt does [21]. Usernames are hidden by default [21]. Microsoft states that audit log counts are not intended to be used as the basis for Copilot usage reporting, which rules out option C [21]. The report offers 7, 28, 90 and 180-day views, so option D is false [21].

Question 15

The registry's "Agents without owners" summary tile shows a count of one. The agent is a Copilot Studio agent used daily by the sales team, and its creator has left the organisation. What should the administrator do first?

• A. Delete the agent, because unowned agents are a security risk
• B. Assign a current employee as the agent's owner so lifecycle accountability is restored, then review its access
• C. Ignore the tile, because ownership has no effect on agents
• D. Block the agent for all users and ask the sales team to rebuild it

Answer: B

Why: Managing agent owners is a named AB-650 skill [1]. The registry flags "Agents without owners" [17], and the admin centre's Assign new owner action lets an administrator give an ownerless shared Copilot Studio or Agent Builder agent a new owner [27]. Reassigning ownership keeps a business-critical agent running while restoring an accountable human for access reviews and lifecycle decisions. Separately, in Microsoft Entra Agent ID, Copilot Studio agents receive an agent identity automatically with the creator recorded as sponsor [22], so check that record too. Deleting (A) or blocking (D) disrupts the business before anyone has assessed the risk, and option C ignores a governance signal Microsoft built into the registry deliberately.

Where former MS-102 candidates lose marks on AB-650

MS-102 administrators bring strong identity, Defender and Purview knowledge to AB-650, but the scoring weight has shifted. More than a third of AB-650 sits in the AI services domain [1], which MS-102 never tested. These are the traps the questions above are built around.

1. Treating agents like apps. Agents have their own identities in Microsoft Entra Agent ID, their own Conditional Access patterns and their own registry. Microsoft Agent 365 has been generally available for the Commercial segment since 1 May 2026 [23], and it is included with Microsoft 365 E7 and available as an add-on to E5, A5 and Business Premium [22].
2. Reaching for permissions when the scenario says "interim". Restricted Content Discovery is temporary and leaves permissions untouched [11]. If the question stresses speed and no disruption, permission changes are usually the distractor.
3. Mixing DLP conditions. Sensitive information types and sensitivity labels cannot share a rule in the Copilot DLP location [15].
4. Using stale product names. Microsoft's admin documentation increasingly says "Microsoft Copilot" where the study guide says "Microsoft 365 Copilot" [19][21], and DSPM for AI is now labelled "classic", replaced by Data Security Posture Management [24]. Know both names, because the exam may use either.
5. Forgetting least privilege. Many AB-650 options "work" but grant too much. When Global Administrator appears as an option, check whether a narrower role such as AI Administrator does the job [12].

How to score yourself and what to do next

Score yourself honestly: a question counts as correct only if you chose the right answer for the reason given in the explanation. A lucky guess is a gap.

Fifteen questions are a diagnostic, not a readiness test. Readiness looks like consistent results on full-length, timed sets that draw new questions each time and cover every domain in proportion to its weighting [1]. Because the governance and security domain carries 40-45%, roughly two in five of the questions you practise should sit there.

Microsoft does not apply a guessing penalty, so you should never leave an item blank [8]. During the beta period you can sit AB-650 only once, and if you fail you can retake it once the exam is live [25]. After that, the general retake policy requires a 24-hour wait after a first failed attempt and a 14-day wait between later attempts, with a maximum of five attempts in 12 months [25].

Using practice questions while AB-650 is in beta

Beta status changes how you should treat any AB-650 practice material, including this article. Microsoft says beta exams are not scored immediately because it is gathering data on question quality [3]. Beta candidates typically receive scores about 10 days after the exam goes live, roughly 10-12 weeks after the beta period starts, and a pass during beta counts towards the certification [5].

Three practical consequences follow. First, keep the study guide open as your master checklist, because the outline can change and related topics may be tested beyond the listed bullets [1]. Second, prioritise generally available features, since that is where most questions sit [1]. Third, expect product names in Microsoft's documentation to move faster than the outline, as the naming traps above show. Our Microsoft beta exam guide explains the beta process in full.

Frequently Asked Questions

Is there an official AB-650 practice assessment?

No. On 30 October 2026, Microsoft's AB-650 exam page states that the practice assessment is not currently available. Microsoft says practice assessments usually appear within eight weeks of an exam leaving beta and becoming generally available. Until then, original practice questions mapped to the official skills outline are the main structured way to test yourself.

How many questions are on the AB-650 exam?

Microsoft has not published a question count or duration for AB-650. Its general guidance is that most Microsoft certification exams contain between 40 and 60 questions, and the number varies by exam. Any exact figure for AB-650 quoted on a third-party site is an estimate, not a Microsoft-published fact.

What is the passing score for AB-650?

AB-650 requires a score of 700 or greater on Microsoft's scaled range of 1 to 1,000. A scaled score accounts for the difficulty of the questions you receive, so 700 does not necessarily mean answering 70% correctly. Microsoft does not penalise wrong answers, so answer every question rather than leaving any blank.

Is AB-650 harder than MS-102?

AB-650 is not simply harder or easier than MS-102, but it is broader. It keeps MS-102's identity, Defender and Purview depth while adding an AI services domain worth 35-40% of the score, covering Copilot settings, agent identities, the agent registry, Agent 365 and AI cost monitoring. Experienced MS-102 administrators should budget most new study time there.

What question types appear on AB-650?

Microsoft does not reveal which question formats a specific exam uses before you sit it. Its exam sandbox demonstrates multiple choice, drag and drop, hot area, active screen, build list, case studies and labs, and many exams also ask you to select more than one answer. The free exam sandbox at aka.ms/examdemo lets you practise these interactions before exam day.

Does AB-650 replace MS-102?

MS-102 retires on 30 November 2026, and Microsoft's partner announcements link AB-650's launch to that retirement. However, they are not like-for-like. MS-102 counted towards the Expert-level Microsoft 365 Administrator certification, which also retires, whereas AB-650 is a standalone Associate certification with a much larger focus on Copilot and agent governance.

Start practising for AB-650

AB-650 rewards administrators who can choose between two workable configurations under a constraint, which is exactly what the scenarios above test. With no official practice assessment yet [2], original, outline-mapped practice is the most direct way to find your gaps before you book.

Start practising for AB-650 with Examinotion's full-length practice tests, weighted to the official domain split and written to associate-level difficulty, with a full explanation on every answer. No provider can honestly promise a pass: practice reduces risk and exposes gaps, it does not guarantee an outcome. Preparing for more than one Microsoft certification? Compare the full catalogue on the Microsoft exams hub.

Sources

1. Study guide for Exam AB-650: Administering Microsoft 365 and AI Services - Microsoft Learn, accessed 2026-10-30
2. Exam AB-650: Administering Microsoft 365 and AI Services (beta) - Microsoft Learn, accessed 2026-10-30
3. Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate (beta) - Microsoft Learn, accessed 2026-10-30
4. Exam duration and exam experience - Microsoft Learn, accessed 2026-10-30
5. About beta exams - Microsoft Learn, accessed 2026-10-30
6. Exam MS-102: Microsoft 365 Administrator - Microsoft Learn, accessed 2026-10-30
7. Partner Center announcements, October 2026 - Microsoft Learn, accessed 2026-10-30
8. Exam scoring and score reports - Microsoft Learn, accessed 2026-10-30
9. Microsoft 365 Backup overview - Microsoft Learn, accessed 2026-10-30
10. How to check Microsoft 365 service health - Microsoft Learn, accessed 2026-10-30
11. Restrict discovery of SharePoint sites and content - Microsoft Learn, accessed 2026-10-30
12. Microsoft Entra built-in roles - Microsoft Learn, accessed 2026-10-30
13. Conditional Access for agent identities - Microsoft Learn, accessed 2026-10-30
14. Get started using Attack simulation training - Microsoft Learn, accessed 2026-10-30
15. Learn about DLP for Microsoft 365 Copilot and Cowork - Microsoft Learn, accessed 2026-10-30
16. Microsoft Purview considerations for Microsoft 365 Copilot - Microsoft Learn, accessed 2026-10-30
17. Agent Registry in the Microsoft 365 admin center - Microsoft Learn, accessed 2026-10-30
18. Manage agents in the Microsoft 365 admin center - Microsoft Learn, accessed 2026-10-30
19. Configure Microsoft Copilot settings in the Microsoft 365 admin center - Microsoft Learn, accessed 2026-10-30
20. Pay-as-you-go overview - Microsoft Learn, accessed 2026-10-30
21. Microsoft Copilot usage report - Microsoft Learn, accessed 2026-10-30
22. What are agent identities? - Microsoft Learn, accessed 2026-10-30
23. Microsoft Agent 365 overview - Microsoft Learn, accessed 2026-10-30
24. Data Security Posture Management for AI (classic) - Microsoft Learn, accessed 2026-10-30
25. Exam retake policy - Microsoft Learn, accessed 2026-10-30
26. Usage-based billing and cost management for Copilot Credits - Microsoft Learn, accessed 2026-10-30
27. Governance and lifecycle actions for agents - Microsoft Learn, accessed 2026-10-30