Your guide to AB-650, the Associate exam for configuring, governing and securing Microsoft 365 and the AI services on top of it, and the exam that replaces MS-102 when it retires on .
Microsoft 365 administrators who run tenants, identity, security and compliance, and now Microsoft 365 Copilot and agents: MS-102 candidates and holders, AB-900 holders stepping up, and admins handed a Copilot rollout.
About 100 minutes (not yet published by Microsoft), English only, passing score 700 out of 1000, £106 excluding tax in the UK. Currently in beta.
Microsoft Entra identity and Conditional Access, Defender for Office 365, Microsoft Purview, Microsoft 365 Copilot settings, agents in the agent registry and Microsoft Agent 365, and AI cost and usage monitoring.
Governing and securing tenants and workloads is 40 to 45 percent of the exam. Count the Copilot skills in the other domains and about 30 of the 58 skills are about AI services.
AB-650 arrives alongside a certification retirement, so it is worth being precise about what it is and what it is not:
The Microsoft AB-650 exam, officially titled Administering Microsoft 365 and AI Services, leads to the Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate certification (Microsoft's announcements also use the shorter Microsoft 365 Certified: AI Services Administrator Associate). Microsoft describes the candidate as someone who configures, manages, secures and governs Microsoft 365 tenants, workloads and AI services, including Microsoft 365 Copilot, agents and connected AI capabilities, and who works with architects and other administrators across workloads, identity, security, compliance, endpoints and applications.
It is an Associate-level, role-based exam with no prerequisite. It is delivered in English only, the passing score is 700 out of 1000, and in the UK it costs £106 excluding tax. Microsoft has not yet published its length; 100 minutes is Microsoft's standard for associate exams without labs. The exam is in beta: Microsoft scores beta exams only once the exam goes live, with final results about 10 days later, and it may revise the skills outline at general availability. Like other associate certifications it expires annually, and you renew it by passing a free online assessment on Microsoft Learn.
Administrators working towards or holding the Microsoft 365 Administrator Expert credential, which cannot be earned or renewed after 30 November 2026.
The same Microsoft 365 Copilot and agent administration ground as AB-900, at associate depth: configuring and troubleshooting rather than recognising.
Administrators whose organisation is adopting Microsoft 365 Copilot, Microsoft Agent 365 or Microsoft Copilot Studio and needs licences, settings, access and spend under control.
People who run Microsoft Entra, Defender for Office 365 and Microsoft Purview day to day. Governance and security is the largest domain on the exam.
AB-650 has no prerequisite, but Microsoft writes it for working administrators and lists this experience in its skills outline:
AB-650 covers three domains, ten skill groups and 58 skills. The domain and group names are Microsoft's; the skills follow Microsoft's wording in British spelling. Governing and securing tenants and workloads carries the most weight.
Built to Microsoft's beta outline. If it changes at GA, you get the updated set free within 14 days.
The tenant itself and the workloads that run in it: branding, domains and organisational settings, licences for Microsoft 365 and for AI services, Microsoft 365 Backup, network connectivity and service health, then mailboxes, teams, Copilot in Teams meetings, SharePoint sites and preparing SharePoint and OneDrive for Copilot.
Identity, access, threat protection and data protection: users, guests, groups, roles and Privileged Identity Management in Microsoft Entra, authentication methods and Conditional Access, Microsoft Defender for Office 365, and data loss prevention, information protection, retention and Data Security Posture Management in Microsoft Purview.
The AI services on top of Microsoft 365: enabling and configuring Microsoft 365 Copilot, running agents through Microsoft Entra Agent ID, the agent registry and Microsoft Agent 365, and monitoring AI usage, adoption, cost and service health.
Microsoft’s outline names the Copilot Control System. Microsoft’s own AB-650 training notes that the framework is now titled Copilot controls, so expect both names.
Microsoft notes that the bullets under each skill illustrate how it is assessed and that related topics may also appear, and that most questions cover generally available features, with Preview features possible where they are commonly used.
If you prepared for MS-102, about half of AB-650 will feel familiar. Comparing Microsoft's two published outlines, 32 of MS-102's 54 skills carry over in some form, one is reshaped and 21 are dropped, while 31 of AB-650's 58 skills are new, 24 of them in the AI services domain.
MS-102 led to an Expert certification that needed an associate certification first, and was offered in seven languages. AB-650 leads to an Associate certification with no prerequisite, and is offered in English only.
Several of the things AB-650 names have been renamed or moved since Microsoft froze the beta outline in July 2026. Learn the current names alongside the outline's, and practise in a trial tenant rather than reading.
Domains, branding and organisational settings, group-based licensing and pay-as-you-go, Microsoft 365 Backup, Service health, shared mailboxes, teams and the Copilot setting in Teams meeting policies.
Users, guests, groups, roles with Privileged Identity Management, administrative units, authentication methods, SSPR, Password Protection and Conditional Access with ID Protection, plus bulk changes in Microsoft Graph PowerShell.
Preset and custom threat policies and their precedence, the alert queue, Threat Explorer, automated investigation and response, and attack simulation training.
DLP across Exchange, SharePoint, OneDrive, Teams, endpoints and Copilot, sensitivity and retention labels, DLP alerts, and Data Security Posture Management for AI activity.
SharePoint Advanced Management, Restricted Content Discovery and Restricted Access Control. Restricted SharePoint Search can no longer be newly enabled (since 31 July 2026), so treat it as a legacy setting.
Readiness, web search (a Cloud Policy setting in the Microsoft 365 Apps admin centre), Copilot Search, organisational prompts in Prompt Lab, Copilot Cowork access through spending policies, third-party AI providers and Copilot connectors.
Agent identities, sponsors and Lifecycle Workflows in Microsoft Entra Agent ID, the agent registry and agent settings in the Microsoft 365 admin centre, tools, and monitoring and governing agents with Microsoft Agent 365.
Copilot Credits, billing policies and spending policies, the Copilot usage and agent usage reports, and the Copilot Control System, now titled Copilot controls.
Microsoft publishes free self-paced training for AB-650 on Microsoft Learn: three learning paths, one for each exam domain, with 17 modules and roughly 23 hours of content, last updated in October 2026. The instructor-led course AB-650T00-A: Administer Microsoft 365 and AI services runs over three days and is listed as available from 13 November 2026.
Learning path 1 · 5 modules · Domain 1
Provisioning and branding a tenant, licensing Microsoft 365 and AI services, keeping a tenant resilient and healthy, Exchange Online and Microsoft Teams, and governing SharePoint and OneDrive for Microsoft 365 Copilot.
Learning path 2 · 5 modules · Domain 2
Identities in Microsoft Entra, authentication and access, email and collaboration security in Defender for Office 365, information protection, and data loss prevention and lifecycle in Microsoft Purview.
Learning path 3 · 7 modules · Domain 3
Readiness and rollout, Copilot settings and extensibility, agent identities in Microsoft Entra Agent ID, the agent registry and tools, monitoring and governing agents with Microsoft Agent 365, and monitoring and optimising AI services.
Microsoft has not published a practice assessment for AB-650 yet; it says practice assessments usually arrive within 8 weeks of an exam leaving beta. Until then, Microsoft's training, hands-on time in a trial tenant and full-length practice tests are the strongest combination.
Written to Microsoft’s AB-650 skills outline and domain weights
Built to the beta outline, free update at GA
Start with 5 free AB-650 questions, then unlock seven full-length practice tests.
Start Free PracticeBuilt to the beta outline, free update at GA
Thirty days split by Microsoft's domain weights: six for tenants and workloads, twelve for governance and security, nine for AI services, then three days of full-length practice tests.
Days 1-6
Work through a trial tenant
Branding, domains and organisational settings, then licences: group-based licensing, pay-as-you-go, and licences for Microsoft 365 Copilot, Microsoft Agent 365 and Microsoft Copilot Studio. Finish with Microsoft 365 Backup, network connectivity insights and Service health notifications.
Shared mailboxes, teams and channels, the Copilot setting in Teams meeting policies, SharePoint site permissions, and the controls that keep sites out of Copilot: Restricted Content Discovery and Restricted Access Control.
Days 7-12
Microsoft Entra
Users, guests and external access, groups, roles and Privileged Identity Management, administrative units and contacts, then one bulk change in Microsoft Graph PowerShell.
Authentication methods, Password Protection and SSPR, then Conditional Access with ID Protection and MFA. Practise resolving failed sign-ins from the sign-in logs and the What If tool.
Days 13-18
Defender for Office 365 and Microsoft Purview
Preset and custom threat policies and which one wins, the alert queue, Threat Explorer, and an attack simulation with a training campaign.
Which DLP, sensitivity label or retention control a requirement needs, DLP alerts for Microsoft 365 and AI services, and Data Security Posture Management for AI activity.
Days 19-25
The new ground
Copilot readiness and oversharing, web search, Copilot Search, the tenant Copilot settings, Prompt Lab, Copilot Cowork access, third-party AI providers and Copilot connectors.
Agent identities and sponsors in Microsoft Entra Agent ID, agent access, owners and settings, publishing, blocking and uploading agents in the agent registry, and tools in Microsoft Agent 365.
Days 26-30
Then full practice tests
Monitoring agent activity, protecting sensitive data and finding compliance gaps with Microsoft Agent 365, then AI costs, Copilot usage reports and the Copilot Control System.
Full-length practice tests in Timed mode, targeted review of your weakest sub-groups, and a final pass through Microsoft’s skills outline bullet by bullet.
Prepare for the Microsoft 365 and AI Services Administrator Associate exam with 280 exam-style scenario questions, seven full-length practice tests, 14 case studies, and detailed explanations across all three domains.