Microsoft AB-650 Real Exam Dumps [September 2026 Update]

The official Microsoft AB-650 study guide lists “Govern and secure Microsoft 365 tenants and workloads” as the largest domain at 40-45%. Not the AI services domain. The governance and security domain. This distinction matters because the most common framing in third-party exam commentary positions AB-650 as primarily an AI certification – “40% of the exam is AI content that MS-102 never covered.” That is accurate as a description of what is new, but it misidentifies where the most exam weight lives. The governance domain at 40-45% tests Purview DLP, sensitivity labels, information protection, eDiscovery, retention policies, Conditional Access, Microsoft Entra PIM, and Defender for Office 365 – the security and compliance content that MS-102 holders know well. But AB-650 extends every one of these capabilities into the AI workload context, and that extension is the hardest material within the largest domain. Configuring a DLP policy in Exchange is familiar. Configuring a DLP policy scoped to the Microsoft 365 Copilot location – which requires different policy conditions, different sensitive information types, and different alert responses because AI queries are not traditional file-based workflows – is what the exam tests that MS-102 preparation does not cover. The governance domain is large, and its AI extension is where M365 admins who feel confident in their MS-102 security knowledge will find the hardest questions.

The Microsoft AB-650 (Administering Microsoft 365 and AI Services) is the exam for Microsoft 365 Certified: AI Services Administrator Associate – replacing MS-102 (retiring October/November 2026). The exam beta launched July 2026; GA is targeted for October 2026. Three domains: Govern and secure Microsoft 365 tenants and workloads (40-45%), Manage and secure AI services in Microsoft 365 (35-40%), Configure a Microsoft 365 tenant (approximately 15-20%). Passing score: 700/1000. Fee: $165.

Cert Empire’s AB-650 exam questions are built across all three domains with emphasis on the Purview AI governance capabilities within Domain 1 (the largest domain) and the Agent 365 registry and Entra Agent ID content in Domain 2 (all of which is new with no MS-102 equivalent).

Exam Snapshot

Three Domain Structure – Official Weights

Domain 1 is the largest domain. The exam’s heaviest concentration tests the traditional governance skills that MS-102 holders know – but extended into AI workload contexts that MS-102 never covered.

Domain 1: Govern and Secure Microsoft 365 Tenants and Workloads (40-45%)

Microsoft Purview – Extended Into AI

DLP policies scoped to Copilot (AI-specific extension): Traditional Microsoft Purview DLP policies monitor and protect data as it moves through Exchange, SharePoint, OneDrive, Teams, and endpoints. AB-650 adds a new DLP policy location: Microsoft 365 Copilot. Copilot DLP policies monitor for sensitive information within Copilot prompts and responses. The configuration difference from traditional DLP: Copilot DLP evaluates the text of AI interactions rather than file content, requires different sensitive information types appropriate for prompt/response contexts, and generates alerts specific to AI data exposure incidents rather than traditional sharing events.

The exam tests: how to identify requirements for Copilot-specific DLP policies (the official study guide explicitly lists this as a skills-measured item), how to review and respond to DLP alerts generated by AI interactions, and how the Copilot DLP policy location differs from other DLP policy locations in its scope and enforcement mechanism.

Data Security Posture Management (DSPM) for AI: DSPM for AI analyzes the organization’s AI usage across Microsoft 365 Copilot and agents to identify data exposure risks. It answers questions like: which sensitive data can Copilot access? Which users can ask Copilot questions that might surface protected information? Where are the oversharing gaps that would allow Copilot to expose data that users should not see directly?

The exam tests how to monitor and secure AI activity using Purview DSPM for AI, what data it analyzes (SharePoint permissions, sensitivity label coverage, Copilot usage patterns), and what remediation capabilities it provides (identifying documents that need sensitivity labels, flagging overshared data, generating reports for governance review).

Tenant readiness assessment for Copilot: Before enabling Copilot for an organization, administrators must assess whether the tenant’s data is appropriately governed – whether sensitive data has sensitivity labels, whether oversharing in SharePoint creates unintended Copilot access, and whether DLP policies cover the AI workload. The exam tests how to conduct this tenant readiness assessment and how to resolve specific readiness issues: data leaks (sensitive data accessible to Copilot that should not be), data oversharing (too many users able to access certain SharePoint content through Copilot), and compliance gaps.

Sensitivity labels and Copilot: Sensitivity labels applied to documents affect how Copilot can reference those documents. Documents with certain labels may be excluded from Copilot’s context, preventing Copilot from citing or referencing highly classified content in its responses. The exam tests how sensitivity label policies interact with Copilot’s document access behavior.

Retention and eDiscovery for AI interactions: Copilot interactions (prompts and responses) can be retained, subject to compliance holds, and discoverable under eDiscovery policies. The exam tests how retention policies are configured to capture and retain Copilot interaction history and how eDiscovery tools can search for content within AI interaction logs.

Microsoft Entra Identity and Access

Conditional Access for AI: Conditional Access policies can require specific conditions (compliant device, specific location, MFA) before granting access to Copilot and AI services. The exam tests how to configure Conditional Access policies scoped to AI services and what conditions are appropriate for governing AI access versus general Microsoft 365 access.

Privileged Identity Management (PIM) for M365 roles: PIM provides just-in-time access to privileged Microsoft 365 admin roles. When an admin needs to make a governance change, they activate their role for a limited time period rather than holding permanent privileged access. The exam tests PIM configuration for Microsoft 365 admin roles: eligible versus active assignment, activation requirements (MFA, justification), and activation duration limits.

Defender for Office 365

Safe Links and Safe Attachments: Safe Links rewrites URLs in emails and documents and checks them at click time against the current threat intelligence. Safe Attachments detonates email attachments in a sandbox environment before delivering them to recipients. The exam tests policy configuration: protection level (audit versus block), the scope of which users the policy applies to, and how policies interact with each other when multiple policies could apply to the same user.

Zero-hour Auto Purge (ZAP): ZAP retroactively removes messages from mailboxes after delivery when new threat intelligence identifies them as malicious. The exam tests what ZAP covers (phishing, spam, malware) and how the quarantine management workflow handles ZAP-removed messages.

Domain 2: Manage and Secure AI Services in Microsoft 365 (35-40%)

Microsoft 365 Copilot Administration

Copilot licensing and enablement: Microsoft 365 Copilot requires specific licenses in addition to the base Microsoft 365 licenses. The exam tests how Copilot licenses are assigned, how to verify which users have Copilot access, and how to control self-service Copilot license purchases (whether users can purchase Copilot subscriptions independently or whether this requires administrator action).

Copilot tenant settings: The Microsoft 365 admin center includes a Copilot settings area where administrators configure tenant-wide Copilot behavior: web search controls (whether Copilot can use web search to supplement its responses), release preferences (whether the tenant gets new Copilot features as they release or after a delay), the AI disclaimer (a customizable disclosure displayed to users), and image/video generation settings. The exam tests each of these settings and what the appropriate configuration is for described organizational requirements.

Copilot Search and Copilot connectors: Copilot Search enables natural language search across Microsoft 365 content. Copilot connectors (Microsoft Graph connectors) allow third-party data sources to be surfaced in Copilot responses. The exam tests how to configure Copilot Search settings and how to manage which connectors are deployed for the organization.

Copilot Control System and usage reporting: The Copilot Control System in the Microsoft 365 Admin Center provides usage analytics – how many users are using Copilot, what types of tasks they are performing, and what adoption trends look like. The exam tests how to access and interpret Copilot usage reports and what they reveal about adoption across the organization.

Microsoft Agent 365 and the Agent Registry

What Microsoft Agent 365 is: Agent 365 is the Microsoft control plane for AI agents operating within the Microsoft 365 environment. It provides a centralized view of all agents – Microsoft-built (like Copilot agents), partner-built (from the Microsoft 365 Marketplace), and custom-built (created within the organization) – along with lifecycle management, usage monitoring, and policy enforcement capabilities.

The agent registry: The agent registry is the unified inventory of agents authorized to operate in the tenant. Administrators use the agent registry to discover what agents are running, review requests from users to add new agents, publish approved agents, block unapproved agents, and upload custom organizational agents. The exam tests the registry management workflow: how agents appear in the registry, what administrative actions are available for each agent, and what happens to agent requests that have not yet been approved.

Microsoft Entra Agent ID: Autonomous AI agents need their own identities rather than sharing human user identities. Entra Agent ID provides each agent with a distinct identity in Microsoft Entra, enabling: authentication of the agent to Microsoft 365 resources (using the agent’s own credentials rather than a shared service account), authorization controls through role assignments scoped to the agent’s specific access needs, audit logging that attributes agent-performed actions to the specific agent identity, and revocation (revoking an agent’s access without affecting other agents or users).

Conditional Access for agent identities: Conditional Access policies can be applied to Entra Agent IDs just as they apply to user identities, but the configuration differs because agents cannot perform interactive authentication (no MFA capability). The exam tests how Conditional Access is adapted for agent identities: access package scoping, time-limited access grants, and how the authentication flow for agents differs from the authentication flow for human users.

Managing agent access to sensitive data: Agents that access SharePoint, Exchange, or other Microsoft 365 data do so through permissions granted to their Entra Agent ID. The exam tests how to review and manage what data each agent can access, how to apply sensitivity label restrictions to agent data access, and how Purview DSPM for AI surfaces agent-related data exposure risks alongside user Copilot risks.

Monitoring agent activity: The Microsoft 365 admin center and Purview provide visibility into agent activity: which agents are active, what tasks they are performing, whether agent activity generates compliance alerts, and how agent interaction history is retained for compliance purposes. The exam tests how to access and interpret agent activity monitoring and what compliance obligations apply to agent-generated content.

Domain 3: Configure a Microsoft 365 Tenant (~15-20%)

Microsoft 365 tenant administration fundamentals: Core tenant configuration – organizational settings, licensing management (including Copilot and Agent 365 licenses specifically), service health monitoring, and Microsoft 365 Apps deployment. The exam tests these fundamentals at the level expected of an M365 administrator with experience beyond day-one setup.

Microsoft 365 Backup: Backup for Microsoft 365 provides organizational backup of SharePoint, OneDrive, and Exchange data with administrator-controlled backup and restore. The exam tests how Microsoft 365 Backup is configured, what it covers, and how restore operations work. This is notably different from per-user backup that end users could previously configure – Microsoft 365 Backup is administrator-managed at the organizational level.

Network connectivity insights: Microsoft 365 provides network connectivity reporting that shows how network conditions affect Microsoft 365 application performance for different office locations. Administrators can use this to identify network configuration improvements. The exam tests what network connectivity insights show and how they are used in capacity and performance planning.

Groups and collaboration governance: Microsoft 365 Groups governance – naming policies, group creation restrictions, expiration policies, and guest access controls – affects every collaboration workload including Teams and SharePoint. The exam tests governance policy configuration and how to manage the group lifecycle across the organization.

5 Study Tips for Microsoft AB-650

• Tip 1: Study Purview DLP for Copilot as the hardest content within the largest domain. Know how Copilot DLP policy scope differs from traditional DLP, what the Copilot location covers, and how DSPM for AI complements DLP by providing posture-level visibility rather than transaction-level policy enforcement.
• Tip 2: Study Agent 365 and Entra Agent ID as distinct new content – not a variation of managed identities or service principals. Know the agent registry workflow (discover, review, publish/block), what Entra Agent ID enables, and why Conditional Access for agent identities requires a different configuration approach than for user identities.
• Tip 3: Your MS-102 Purview, Defender for Office 365, and Entra knowledge carries forward and covers the foundational content of Domain 1. Invest new study time in the AI extensions (Copilot DLP, DSPM, tenant readiness assessment) rather than re-studying content you already know.
• Tip 4: Study the Copilot Control System and usage reporting specifically – what the admin center shows about adoption, how usage metrics are interpreted, and how they connect to licensing and governance decisions.
• Tip 5: Practice with Cert Empire’s AB-650 exam questions weighted to the official domain distribution, with particular depth on Purview AI extensions within Domain 1 and Agent 365 / Entra Agent ID within Domain 2.

Best Study Resources

• Cert Empire AB-650 exam questions PDF and practice simulator (July 2026 beta-aligned edition).
• Official Microsoft AB-650 study guide (learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/ab-650) – the primary exam reference with confirmed domain weights and skill measurements.
• Microsoft documentation: Microsoft Purview DSPM for AI, Agent 365, Entra Agent ID, Copilot admin center.
• Examinotion AB-650 exam guide (examinotion.com/blog/ab-650-exam-guide) – regularly updated against the live Microsoft study guide.
• mscertquiz.com AB-650 practice questions – 500 questions aligned to the three-domain blueprint.

Career Opportunities After AB-650

• Microsoft 365 AI Services Administrator
• Modern Workplace Security Administrator
• Microsoft 365 Governance Specialist
• AI Services Compliance Manager
• Enterprise Copilot Deployment Lead

AB-650 positions its holders at the intersection of traditional Microsoft 365 administration and AI services governance – the role that organizations expanding Copilot and AI agents across their Microsoft 365 environments need urgently. M365 administrators with AB-650 credentials earn between USD 85,000 and USD 135,000, with AI governance specialization commanding increasing premiums as organizational AI deployments scale.

Why Candidates Choose Cert Empire for AB-650 Preparation

✔ Purview DLP for Copilot and DSPM for AI questions. Our AB-650 questions test the AI extension of the governance domain – the hardest content within the largest exam domain – at the policy configuration depth the real exam uses.

✔ Agent 365 registry management and Entra Agent ID questions. We cover agent discovery, registry workflow (publish, block, manage), Entra Agent ID configuration, and why Conditional Access for agents differs from Conditional Access for users.

✔ Domain-weight-aligned question distribution. Our question bank allocates 40-45% to Domain 1 (Govern and Secure), 35-40% to Domain 2 (AI Services), and ~15-20% to Domain 3 (Configure Tenant) – matching the official Microsoft study guide weights.

✔ MS-102 foundation coverage alongside new AI content. We cover the Purview, Defender, and Entra baseline that carries forward from MS-102, alongside the AI-specific extensions that AB-650 adds to each.

✔ Practice under real exam conditions with the Cert Empire Exam Simulator. Our AB-650 simulator runs questions in timed sessions across all three official domains with domain-level tracking.

✔ Instant access, 90-day free updates, and 24/7 support. As Microsoft updates AB-650 from beta to GA and the study guide evolves, your materials update automatically. Our support team is available around the clock.

✔ Backed by a full money-back guarantee. If our exam questions do not help you pass, we refund your purchase with no conditions.

FAQ’s

What is Microsoft AB-650?

AB-650 (Administering Microsoft 365 and AI Services) is the exam for Microsoft 365 Certified: AI Services Administrator Associate. It replaces MS-102 and covers Microsoft 365 tenant governance, security, and the administration of Copilot and AI agents.

What are the three AB-650 domains and their weights?

Govern and secure Microsoft 365 tenants and workloads (40-45%), Manage and secure AI services in Microsoft 365 (35-40%), and Configure a Microsoft 365 tenant (~15-20%). Govern and Secure is the largest domain – larger than the AI services domain.

When does MS-102 retire?

MS-102 is scheduled to retire in October/November 2026. Check the official Microsoft Learn retirement page for the confirmed date, as this timing may be adjusted.

Is AB-650 just MS-102 with AI content added?

Not quite. AB-650 carries forward the governance and security foundation from MS-102 but extends every capability into AI workload contexts (DLP for Copilot, DSPM for AI, sensitivity labels affecting Copilot access, Conditional Access for agent identities). It also adds entirely new content with no MS-102 equivalent: Agent 365, the agent registry, and Entra Agent ID.

What is Microsoft Agent 365?

Agent 365 is Microsoft’s control plane for AI agents operating within the Microsoft 365 environment. It provides the agent registry (a centralized inventory of all agents), lifecycle management (approve, block, deploy agents), usage monitoring, and governance capabilities. It is administered through the Microsoft 365 admin center.

Related Certifications Worth Exploring

AB-650 certified professionals pursuing adjacent Microsoft AI credentials will find our Microsoft AI-102 Azure AI Engineer Associate exam questions page covers the Azure AI engineering credential that complements AB-650’s Microsoft 365 AI governance focus with Azure AI service development expertise. For those pursuing the broader Microsoft 365 administrator credential pathway, our MS-102 Microsoft 365 Administrator exam questions page covers the predecessor credential while it remains available before its retirement.