Microsoft 365 Certified: AI Services Administrator Associate (beta) — Practice Set 1

Question 1

You are onboarding a new Microsoft 365 tenant and need the sign-in page and Microsoft 365 app launcher to display the company logo, custom theme colors, and a custom background image. Where should you configure these settings?

Accepted Answer

Organizational branding, including logo, company URL, themes, and backgrounds, is configured through the branding settings in the Microsoft 365 admin center (which applies Microsoft Entra ID company branding). Purview handles compliance and data protection, Conditional Access controls authentication requirements, and the Copilot Control System monitors AI usage and adoption — none of these manage visual branding.

Question 2

Your organization acquired a new subsidiary and needs its users to authenticate under a custom domain such as contoso-subsidiary.com instead of the default onmicrosoft.com domain. What must you do before you can assign this domain to user accounts?

Accepted Answer

To use a custom domain, an administrator must add the domain to the tenant and verify ownership (typically via a DNS TXT or MX record), then configure the DNS records required for services such as Exchange Online. A separate tenant is not required for a new domain, licensing is unrelated to domain verification, and Password Protection addresses weak passwords, not domain management.

Question 3

You need to reduce manual license assignment overhead as new employees join departments that all require the same set of Microsoft 365 and Copilot licenses. Which two capabilities can help you achieve this? (Select two.)

Accepted Answer

Group-based licensing lets administrators assign licenses to a group rather than individual users; combining this with dynamic group membership rules (for example, based on department attribute) means new employees are automatically licensed as soon as they're added to the directory and matched by the rule. Pay-as-you-go licensing addresses billing model, not automatic assignment. Manual per-user assignment is exactly the overhead being avoided. Sensitivity label policies relate to information protection, not licensing.

Question 4

A department accidentally deleted a SharePoint document library containing several months of project files. Leadership wants the ability to restore the data to a point before the deletion occurred, and also wants ongoing protection against future accidental data loss across Exchange, SharePoint, and OneDrive. Which Microsoft 365 capability should you configure and set up?

Accepted Answer

Microsoft 365 Backup provides point-in-time backup and restore capability for Exchange, SharePoint, and OneDrive data, allowing recovery from accidental deletions or corruption. Purview DLP prevents sensitive data from leaving the organization but doesn't back up or restore deleted content. Identity Protection addresses risky sign-ins and compromised accounts. Service health notifications alert you to service outages, not data loss.

Question 5

Users in a branch office are reporting slow performance when connecting to Microsoft 365 services. As the administrator, where can you review insights about network paths and connectivity quality between your users and Microsoft 365?

Accepted Answer

Network connectivity insights provide visibility into the network paths, ISPs, and connection quality that users experience when reaching Microsoft 365, helping administrators diagnose performance issues. PIM manages privileged role activation, the Copilot Control System reports on AI adoption and usage, and DSPM focuses on AI data security posture — none address general network connectivity diagnostics.

Question 6

You want Copilot in Microsoft Teams meetings to automatically produce a transcript that Copilot can reference to generate meeting summaries. What must you configure to enable this?

Accepted Answer

Copilot in Teams meetings relies on meeting transcription being enabled; administrators configure transcription settings so Copilot can access the transcript to generate summaries and answer questions about the meeting. SharePoint Advanced Management and Search in SharePoint govern SharePoint/OneDrive content indexing for Copilot, not Teams meeting transcription. Graph PowerShell is used for bulk administrative tasks, not meeting configuration.

Question 7

An external vendor needs temporary access to a specific SharePoint site to collaborate on a project, but should not appear as a full employee in the directory or access other internal resources. What is the appropriate way to grant this access?

Accepted Answer

Guest user access through Microsoft Entra B2B collaboration lets external users be invited with scoped access to specific resources, such as a single SharePoint site, without creating a full internal identity. Creating a full internal account overprovisions access for a temporary external collaborator. Administrative units organize management scope for administrators, not external guest permissions. Assigning Global Administrator to an external vendor is a severe security risk and unrelated to the scenario.

Question 8

You want to delegate the ability to reset passwords and manage user accounts for only the Sales department to a departmental IT lead, without granting that lead permissions over the entire tenant. What should you configure?

Accepted Answer

Administrative units allow you to restrict an administrator's permissions to a defined subset of the organization, such as a specific department, so a delegated admin can manage users within that scope only. Conditional Access controls authentication conditions, not administrative scope. Sensitivity label policies protect data classification. A dynamic group automates membership but does not by itself delegate administrative permissions.

Question 9

You need to onboard 500 new users from a CSV export of an HR system, creating accounts, assigning licenses, and adding each to the correct department group, without manually clicking through the admin center for each user. Which two approaches support this at scale? (Select two.)

Accepted Answer

Microsoft Graph PowerShell supports scripting and bulk cmdlets that can loop through imported data (such as a CSV) to create users, assign licenses, and manage group membership programmatically, which is essential for large-scale, repeatable administrative operations. Manually creating 500 accounts individually does not scale. A sensitivity label policy classifies and protects documents, not bulk account provisioning. Password Protection blocks weak/banned passwords and is unrelated to bulk onboarding.

Question 10

Your security team wants to ensure that whenever a user is assigned the Exchange Administrator role, that role assignment is time-bound, requires justification, and requires approval rather than being a standing permanent assignment. Which capability should you implement?

Accepted Answer

Privileged Identity Management (PIM) enables just-in-time, time-bound activation of privileged roles like Exchange Administrator, requiring justification and optionally approval before the role becomes active, reducing standing administrative privilege. SSPR lets users reset their own forgotten passwords. Administrative units scope management boundaries but don't add time-bound approval workflows to role activation. Password Protection blocks weak or banned passwords.

Question 11

Employees frequently call the help desk to reset forgotten passwords, consuming significant support time. Which feature allows users to securely reset their own passwords without administrator involvement?

Accepted Answer

Self-service password reset (SSPR) allows users to verify their identity through registered authentication methods and reset their own password without contacting the help desk, reducing support overhead. Conditional Access enforces access policies based on signals like location or device. Attack simulation training tests user susceptibility to phishing. ID Protection detects and responds to identity risk, not routine password resets.

Question 12

Your organization wants to require multifactor authentication for all users signing in from outside the corporate network, but not for sign-ins from trusted office locations, and wants this enforced dynamically based on real-time sign-in risk as well. Which capability should you configure?

Accepted Answer

Conditional Access policies let you define conditions such as network location and combine them with signals from Microsoft Entra ID Protection (real-time and aggregate risk detection) to dynamically require multifactor authentication only when needed. SSPR only handles self-service password resets. Password Protection blocks weak/banned passwords, not conditional access enforcement. Administrative units scope delegated administration, not sign-in policy enforcement.

Question 13

Several employees report receiving emails that impersonate the CEO asking for urgent wire transfers. You want to define organization-wide rules that detect and act on this type of impersonation and phishing pattern automatically. Where should you configure this?

Accepted Answer

Threat policies in Microsoft Defender for Office 365, including anti-phishing and impersonation protection policies, allow administrators to configure detection and automated response to impersonation and phishing attempts. DLP policies prevent sensitive data exfiltration, not phishing detection. Password Protection blocks weak passwords. Retention label policies govern how long content is kept, unrelated to email threat detection.

Question 14

Your security team wants to measure how susceptible employees are to phishing and provide targeted training to those who fall for simulated attacks. Which capability should you configure?

Accepted Answer

Attack simulation training in Defender for Office 365 lets administrators launch realistic phishing simulations against users and automatically enroll those who fail the simulation into targeted training campaigns. DSPM monitors AI data security posture, not phishing susceptibility. Conditional Access enforces sign-in requirements. Sensitivity label policies classify and protect content, not user training.

Question 15

The compliance team is concerned that Copilot responses could surface sensitive financial data from SharePoint sites that some employees have inappropriate access to, even though the underlying files are not being deliberately shared outside the company. Which Microsoft Purview capability is specifically designed to monitor and secure this kind of AI-related data risk?

Accepted Answer

DSPM for AI is purpose-built to monitor AI interactions (like Copilot prompts and responses) and identify risks such as oversharing or exposure of sensitive data surfaced through AI tools due to overly broad permissions, even without deliberate exfiltration. Retention label policies govern how long content is retained, not AI-specific exposure risk. Password Protection and SSPR relate to authentication and passwords, not AI data risk monitoring.

Question 16

Legal requires that emails related to a specific litigation matter be retained for seven years and cannot be deleted by users during that period, even if a general mailbox retention policy would normally allow deletion after 90 days. What should you configure?

Accepted Answer

Retention labels (as part of data lifecycle management) can be applied to specific content to enforce a defined retention period, such as seven years for litigation-related items, overriding shorter default policies for that specific content. Sensitivity labels classify and protect content but don't independently control retention duration. Conditional Access governs authentication, not data retention. DLP policies prevent inappropriate sharing of sensitive data, not retention duration.

Question 17

You want to prevent employees from pasting credit card numbers into a Copilot prompt or having Copilot include such data in generated responses, and you want alerts raised when this is attempted. Which type of policy addresses this requirement?

Accepted Answer

Purview DLP policies can be scoped to cover Copilot interactions, in addition to Exchange, SharePoint, OneDrive, Teams, and endpoints, to detect sensitive information types like credit card numbers and trigger alerts or block the action. Retention label policies control how long data is kept, not what sensitive data can be entered into prompts. Password Protection blocks weak passwords. SharePoint Advanced Management site exclusions control which sites Copilot can index, not general DLP monitoring.

Question 18

Before rolling out Microsoft 365 Copilot broadly, your organization wants to identify whether files are overshared across the tenant (for example, documents shared with 'Everyone' or via overly broad links) so Copilot doesn't surface content to users who shouldn't see it. What should you do first?

Accepted Answer

Assessing tenant and data readiness for Copilot — including identifying data leaks, oversharing, and compliance issues — is the recommended first step before broad rollout, since Copilot surfaces content based on the requesting user's existing permissions. Enabling Copilot in admin centers and configuring generation settings are rollout configuration steps that come later. Managing third-party AI providers is a separate governance task unrelated to internal data oversharing assessment.

Question 19

Your organization wants Microsoft 365 Copilot Chat to be able to pull in current information from the public internet when answering user questions, in addition to organizational content. Which setting controls this behavior?

Accepted Answer

Web search settings specifically control whether Copilot and Copilot Chat can retrieve and ground responses using public web content in addition to organizational data. Copilot connectors integrate specific external data sources (like a CRM), not general public web search. Sensitivity label policies classify and protect organizational content. The agent registry manages discovery and governance of agents, not web search behavior.

Question 20

You need to control which categories of Copilot experiences roll out to your organization first, such as opting into the Targeted Release preferences before broad general availability rollout. Where do you configure this?

Accepted Answer

Tenant-level Copilot settings include release preferences (such as Targeted Release/early access) along with self-service purchases, admin center integration, AI disclaimers, and generation features, all configured centrally for how Copilot rolls out to the organization. DSPM for AI monitors data risk, not rollout timing. Entra Agent ID manages agent identity lifecycle. Copilot Control System cost reports track spending, not release preferences.

Question 21

Your organization is rolling out autonomous agents built with Microsoft Copilot Studio and wants to ensure agent identities are properly governed. Which two capabilities specifically relate to managing agent identity and access in Microsoft Entra Agent ID? (Select two.)

Accepted Answer

Microsoft Entra Agent ID governs the identity lifecycle of agents (creation, updates, deprovisioning) and lets administrators secure agent access using mechanisms like access packages and Conditional Access, mirroring how human identities are governed. Tenant branding, shared mailbox permissions, and SharePoint retention labels are unrelated to agent identity governance.

Question 22

A department wants to publish a custom-built agent so other employees across the company can discover and install it. Before other users can find and use the agent, what must an administrator do?

Accepted Answer

Custom and third-party agents go through a governance process in the agent registry where an administrator reviews the submission and decides whether to publish it for organization-wide discovery or reject it. Retention labels and sensitivity labels apply to content classification and lifecycle, not agent publishing approval. Agents are not assigned Microsoft 365 user licenses in the way human users are.

Question 23

Your compliance team asks you to demonstrate that agents deployed through Agent 365 are not inadvertently accessing or exposing regulated customer data, and to identify any gaps against policy. Which Agent 365 capability directly addresses this requirement?

Accepted Answer

Evaluating compliance gaps using Agent 365 is the capability specifically designed to assess whether deployed agents are operating within policy and regulatory requirements, and to surface where gaps exist. Managing tools controls what capabilities agents can invoke, not compliance evaluation. Managing agent owners assigns accountable individuals but doesn't evaluate compliance. Configuring allowed agent types is a governance setting for what agents can be created, not a compliance assessment activity.

Question 24

Finance leadership wants a monthly view of how much the organization is spending across its various AI services in Microsoft 365, including Copilot and agent-related consumption, to inform budget decisions. Where should you look?

Accepted Answer

Cost management and monitoring capabilities for AI services in Microsoft 365 let administrators track and report on spending across Copilot and related AI consumption, which is exactly what finance leadership needs for budgeting. Retention label policies govern data lifecycle, not cost. Conditional Access controls authentication requirements. SharePoint site permissions reports show access control, not spending.

Question 25

You want a single place to see overall adoption trends for Copilot and other AI services across the organization, as well as the health status of those AI services, rather than checking multiple individual admin centers. Which tool should you use?

Accepted Answer

The Copilot Control System is the centralized tool for monitoring usage and adoption trends for AI services across Microsoft 365, as well as service health, giving administrators a unified view instead of checking separate admin centers. DLP reports show data protection events, not adoption or health. Entra sign-in logs track authentication events, not AI service adoption. SharePoint Advanced Management focuses on SharePoint site governance, not organization-wide AI monitoring.

AB-650 — Microsoft 365 Certified: AI Services Administrator Associate (beta)