Microsoft Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate AB-650 New Questions

User2 can enable Copilot image generation for the subscription: Yes; User1 can use Microsoft 365 Copilot in the Exchange admin center: Yes; User3 can buy a Microsoft 365 Copilot license without admin approval: No

Microsoft 365 Copilot administrative controls determine who can manage AI functionality, access Copilot within administrative portals, and purchase licenses independently.

First statement: Yes. User2 holds the AI Administrator role, which provides permission to configure Microsoft Copilot settings, including image generation. An AI Administrator can navigate to the Microsoft 365 admin center, open Copilot settings, and modify the Copilot image generation configuration.

Second statement: Yes. User1 holds the Global Reader role. This is a recognized administrative role that provides read-only access to supported Microsoft 365 administrative portals, including Exchange admin center. Because Copilot in admin centers is configured as Allowed for all admins, User1 can access supported Copilot functionality within the permissions of the role. This does not grant permission to modify Exchange settings.

Third statement: No. The self-service purchasing configuration is Allow trials only. This permits eligible users to start supported trials but prevents them from purchasing Microsoft 365 Copilot licenses independently.

User3 has no administrative role and cannot bypass the purchasing restriction.

Therefore, the correct sequence is Yes, Yes, No.

Microsoft References:

Microsoft Purview supports service-side sensitivity auto-labeling for Exchange Online email, including inspection of supported email attachments.

Statement 1: Yes, conditionally.

When an active Exchange auto-labeling policy detects sensitive information in a supported Office attachment, it applies the configured sensitivity label to the email, even if the email body does not contain sensitive information.

File1.docx contains an IP address and uses a supported Word format. If that IP address satisfies the auto-labeling policy ' s conditions, the email receives Sensitivity1.

The sensitivity label ' s Auto-labeling for files and emails setting being None does not prevent a separately configured service-side auto-labeling policy from functioning.

Statement 2: No.

Microsoft documentation explicitly states that Exchange auto-labeling labels the email rather than its attachments. Therefore, File1.docx does not receive Sensitivity1 simply because its content triggered the email label.

Consequently, the configured watermark is not automatically added to File1.docx.

Statement 3: No.

File2.xml is not a supported Office attachment format for Exchange sensitivity auto-labeling. Additionally, the service-side labeling process does not apply document headers to attachments.

Therefore, File2.xml does not receive the configured header.

Microsoft Purview Data Loss Prevention (DLP) policies evaluate content against configured sensitive information types, confidence levels, and instance-count thresholds. Matching content is then subject to the rule ' s configured actions and notifications.

First selection: Available to both internal and external users.

The exhibit shows that Policy1 has no action configured under the Actions section. Although user notifications are enabled, no access restriction or encryption action has been selected.

Therefore, Policy1 does not block internal or external access to matching files. Existing SharePoint or OneDrive permissions remain effective.

Second selection: No.

Policy1 defines three sensitive information types: SWIFT Code at Medium confidence, EU Debit Card Number at High confidence, and Credit Card Number at High confidence.

Each condition permits between 1 and 9 instances.

A file containing 18 credit card numbers exceeds the configured maximum of nine. Assuming no other sensitive information type satisfies the rule, the file does not match Policy1.

Because user notifications are triggered by matching DLP rules, no notification emails are generated.

Selecting three notification recipient categories does not independently trigger notifications when the DLP conditions are not met.

Therefore, the correct selections are available to both internal and external users and no.

Microsoft Defender for Office 365 Plan 2 provides Attack simulation training capabilities, including dedicated Training campaigns that assign educational modules without requiring another simulated phishing attack.

Option A is correct because creating a Training campaign targeting Group1 allows administrators to reassign the required training directly to the current members of the group. Using Group1 avoids manually identifying recipients and minimizes administrative effort when group membership changes.

Administrators can configure training assignment notifications and reminder notifications during campaign creation. To deliver reminders as frequently as supported, they can select the twice-weekly reminder option.

Option B is correct because the Training threshold setting controls how soon users can receive a training module that was previously assigned.

The default threshold is 90 days. Because the earlier simulation assigned the module recently, this setting could prevent reassignment during the new campaign.

Setting Training threshold to 0 removes the restriction and permits the same module to be reassigned immediately.

Option C is incorrect because a 60-day threshold would still prevent reassignment to users whose previous assignment occurred within that period.

Option D is incorrect because a tenant payload creates customized phishing simulation content, not training assignments.

Option E is unnecessary because simulation automation creates automated phishing simulations rather than directly assigning training.

Therefore, A and B are correct.

Microsoft References: