Free AB-900 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

A SharePoint site is the most appropriate object as it is a self-contained unit that meets all the specified requirements. Each new site provides a unique home page, its own distinct permissions boundary separate from other sites, and the capability to host multiple document libraries, lists, and other applications. This structure allows each project to be managed independently, which is the core goal.

A. A new document library is a component within a site for storing files; it does not have its own home page or serve as a primary permissions boundary for other lists.

B. A new folder is simply a container within a document library or list and inherits permissions by default; it does not provide a home page or a unique permission set.

C. A new list is used for storing structured data items, not for creating home pages or containing multiple document libraries.

1. Microsoft Learn. (2023). Introduction to SharePoint. "What is a SharePoint site?" section. A site is described as a container for lists

libraries

pages

and other components

with its own permissions.

2. Microsoft Learn. (2024). Planning your SharePoint hub sites. "Plan your sites" section. This document outlines that individual sites (team sites or communication sites) are the fundamental building blocks for different purposes

each with its own content and permissions.

3. Microsoft Learn. (2023). SharePoint site permissions. This document clarifies that permissions are managed at the site level

establishing it as the primary security boundary.

The Content explorer (formerly referred to as Data explorer) in the Microsoft Purview compliance portal provides a detailed, near real-time view of items identified as containing sensitive information types or belonging to specific sensitivity labels. It allows administrators to filter content by location (SharePoint, OneDrive, Exchange), sensitive information type, and other metadata. This meets the requirement to understand where regulated data resides without copying it, and the results can be exported for external analysis.

A. A DLP policy simulation tests the potential impact of a policy before enforcement; it is not designed for comprehensive data exploration and discovery.

B. Relying on manual user labeling is inconsistent and does not provide the systematic, comprehensive snapshot of all existing sensitive data that is required.

D. Searching audit logs is an indirect method that shows user activity. It is not an efficient or direct way to get a snapshot of all sensitive data at rest.

1. Microsoft. (2024). Get started with content explorer. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/data-classification-content-explorer. (See sections: "Prerequisites for accessing content explorer" and "How to use content explorer").

2. Microsoft. (2024). View content in content explorer. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/data-classification-content-explorer-view-content. (See section: "Filter").

Microsoft's Responsible AI principles of Accountability and Reliability & Safety emphasize human oversight for AI systems. For high-impact scenarios like customer communications, it is crucial that a human reviews and takes responsibility for the final content. This practice ensures accuracy, appropriateness, and maintains brand voice. Communicating the AI's limitations is part of the Transparency principle, ensuring users understand that Copilot is an assistant, not an infallible decision-maker. This approach mitigates risks associated with unverified AI-generated content being sent to customers.

B. This is an operational tactic, not a responsible AI principle. It doesn't address the quality or appropriateness of the content itself.

C. Disabling logging contradicts the principles of Transparency and Accountability, as it prevents auditing or understanding how the AI is being used.

D. This practice violates the principle of Accountability by removing human oversight and judgment, which is essential for responsible AI use.

1. Microsoft. (2023). Microsoft Responsible AI Standard

v2. Section 1.6

"Accountability

" Principle 6

Guideline 1: "Establish meaningful human oversight."

2. Microsoft Learn. (2024). Get started with Copilot for Microsoft 365. Section: "Our commitment to responsible AI." Paragraph 2: "We believe that when you create AI

you must do it responsibly. That means putting people first and building in safeguards to protect them."

3. Microsoft Learn. (2024). Data

Privacy

and Security for Microsoft Copilot for Microsoft 365. Section: "Microsoft's commitment to responsible AI." Paragraph 3: "The Accountability principle requires that we hold ourselves accountable for operating our AI systems in a way that is consistent with our AI principles."

An App registration acts as the global definition or template for an application. It's where a developer defines the application's identity, including its name, supported account types, and redirect URIs. When an application is granted consent to access a specific tenant, a service principal object is created. This service principal is represented as an "Enterprise application" in the Microsoft Entra admin center UI. The Enterprise application is the local instance within that tenant, used for managing access, assigning users and groups, and configuring single sign-on (SSO) and conditional access policies.

A. They are distinct, related objects. An app registration is the global blueprint, while an enterprise app is the local instance (service principal) in a tenant.

B. This reverses the concepts. App registrations define the application's technical details like reply URLs, while Enterprise apps handle user assignments and access policies.

D. Security groups are used to assign permissions to Enterprise apps; they are a mechanism for access control but do not replace the application objects themselves.

1. Microsoft Learn. "Application and service principal objects in Microsoft Entra ID." Microsoft Entra documentation. Section: "Relationship between application registration

application objects

and service principals." This document explicitly states

"The application registration is the global representation of your application... A service principal is the local representation

or application instance

of a global application object in a single tenant."

2. Microsoft Learn. "Quickstart: Register an application with the Microsoft identity platform." Microsoft Entra documentation. This guide walks through the process of creating an App registration

defining its core identity properties.

3. Microsoft Learn. "Managing enterprise applications." Microsoft Entra documentation. This section covers the management of service principals (Enterprise apps) within a tenant

including user assignment and SSO configuration.

The most appropriate operational response is a structured, risk-based approach. DLP alerts in Microsoft Purview serve as the initial detection point. The SOC should review these alerts to triage them, assess their severity, and understand the context. For high-risk or complex cases that require broader correlation with other security signals (like endpoint behavior from Defender or identity logs), escalating the incident to a centralized SIEM/XDR platform like Microsoft Sentinel or Defender XDR is the standard best practice for a comprehensive investigation.

A. Disable all DLP alerts: This is negligent, as it ignores the security risk and the organization's responsibility to protect sensitive data.

B. Treat every DLP alert as a confirmed incident: This is an overreaction that would lead to excessive business disruption and alert fatigue, as many DLP alerts are false positives or low-risk events.

C. Configure alerts only for Copilot prompts: This creates a significant security gap by ignoring the actual exfiltration actions (e.g., copy, print) that often follow data exposure.

1. Microsoft Learn. (2024). Overview of data loss prevention. Section: "DLP policy alerts and reports". Microsoft Corporation. Retrieved from https://learn.microsoft.com/en-us/purview/dlp-overview

2. Microsoft Learn. (2024). Get started with data loss prevention alerts. Section: "Investigate an alert". Microsoft Corporation. Retrieved from https://learn.microsoft.com/en-us/purview/dlp-alerts-dashboard-get-started

3. Microsoft Learn. (2024). Microsoft Purview data security and compliance protections for Microsoft Copilot. Section: "Data Loss Prevention (DLP)". Microsoft Corporation. Retrieved from https://learn.microsoft.com/en-us/purview/ai-microsoft-purview

4. Microsoft Learn. (2024). Investigate data loss prevention alerts with Microsoft Defender XDR. Microsoft Corporation. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/security/defender/investigate-dlp-alerts-in-defender

The correct answers are C and D. Microsoft Learn explains that agents created with Agent Builder in

Microsoft 365 Copilot allow you to define specific instructions that extend Microsoft 365 Copilot for a

business scenario. Microsoft also documents that you can add knowledge sources such as specific

public websites and SharePoint content so the agent can reason over targeted information instead of

relying only on the default chat experience. Those two capabilities directly match the needs in

options C and D.

Option A is incorrect because grouping chats is a Copilot notebook scenario, not the reason to build

an agent. Option B is incorrect in the context of creating an agent in the Microsoft 365 Copilot app.

Agent Builder supports declarative agents with instructions, knowledge, and capabilities, but

Microsoft Learn describes custom AI model control as part of custom engine agents built with tools

such as Copilot Studio, SDKs, or Foundry, not as a standard Agent Builder feature in the Microsoft 365

Copilot app. Therefore, when the task is specifically to create an agent in the app, the valid reasons

are custom instructions and reasoning over a specific website.

The primary purpose of Microsoft Entra Privileged Identity Management (PIM) is to enforce the principle of least privilege. It achieves this by moving away from permanent ("standing") administrative access. Instead, PIM enables organizations to provide just-in-time (JIT) privileged access, where users must request and justify elevation into a role. This access is time-bound, meaning it automatically expires after a set period. This process minimizes the window of opportunity for attackers to compromise highly privileged accounts and reduces the overall security risk associated with standing admin roles.

A. Storing passwords in a separate vault is a function of a password manager or vaulting solution, not the primary purpose of PIM.

B. Automatically backing up configuration settings is a function of backup and recovery tools, which is unrelated to identity and access management.

D. Encrypting network traffic is a function of protocols like TLS or solutions like VPNs, not a role of Privileged Identity Management.

1. Microsoft Entra documentation. (2023). What is Microsoft Entra Privileged Identity Management? Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure. See the introductory paragraph and the "What does it do?" section.

2. Microsoft Entra documentation. (2023). Plan a Privileged Identity Management deployment. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-deployment-plan. See section: "Minimize standing admin access".

A Restricted Access Control (RAC) policy—available through the SharePoint Advanced Management (SAM) add-on—lets an admin specify a single Microsoft Entra security group that exclusively controls access to selected SharePoint sites. When a RAC policy is applied, any user who is not a member of the designated group is blocked, regardless of other SharePoint permissions or sharing links, perfectly aligning with leadership’s requirement to confine access to the high-risk M&A sites while leaving the rest of the tenant unchanged.

B. Breaking inheritance and manually editing permissions can still be bypassed by existing or future sharing links and must be maintained per site.

C. Setting “Only people in your organization” still allows every licensed internal user, not just the specific security group.

D. Moving content to a new tenant is heavy-weight, disrupts search/co-authoring, and exceeds the stated “leave the rest of the tenant unchanged” directive.

1. Microsoft Learn – “Apply a Restricted Access Control (RAC) policy to a SharePoint site” (https://learn.microsoft.com/sharepoint/restricted-access-control)

Section: “How RAC policies work”.

2. Microsoft Learn – “SharePoint Advanced Management add-on capabilities” (https://learn.microsoft.com/sharepoint/sharepoint-advanced-management)

Sub-section “Restricted access control policies”.

This approach correctly separates the investigation into two appropriate tools based on the scope of each requirement. Microsoft Entra audit logs are specifically designed to capture directory-level configuration changes, including admin role modifications and application consent events. Microsoft Purview Audit (unified audit log) is the comprehensive solution for tracking user and admin activities across all Microsoft 365 workloads, including Exchange Online, SharePoint, and Teams. This separation ensures investigators use the most appropriate and comprehensive data source for each aspect of the investigation.

Option A is incorrect: Microsoft Entra sign-in logs only capture authentication events (successful and failed sign-ins). They do not record configuration changes like role modifications or application consent, nor do they capture detailed user activities within workloads like file access in SharePoint or message deletions in Exchange.

Option B is incorrect: Microsoft Entra audit logs are limited to directory-level events and do not capture activities within Microsoft 365 workloads. They would miss critical user actions in Exchange Online, SharePoint, and Teams that are essential for the second part of the investigation.

Option C is incorrect: While Microsoft 365 Defender's advanced hunting provides powerful threat investigation capabilities, it does not replace audit logs. It focuses on security signals and threats rather than comprehensive audit trails of all user and admin activities, particularly directory configuration changes.

1. Microsoft Learn - "Monitor Microsoft Entra activity with audit logs" (docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs) - Details that Entra audit logs capture directory changes including role assignments and app consent

2. Microsoft Learn - "Search the audit log in Microsoft Purview" (docs.microsoft.com/microsoft-365/compliance/audit-log-search) - Explains unified audit log captures activities across all Microsoft 365 services

3. Microsoft 365 Security Documentation - "Investigate incidents in Microsoft 365 Defender" (docs.microsoft.com/microsoft-365/security/defender/investigate-incidents) - Clarifies Defender's role in security investigations versus audit logging

4. Microsoft Learn - "Microsoft Entra sign-in logs" (docs.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins) - Specifies sign-in logs contain only authentication events

5. Microsoft Purview Documentation - "Auditing solutions in Microsoft Purview" (docs.microsoft.com/microsoft-365/compliance/audit-solutions-overview) - Describes comprehensive workload coverage of unified audit log

To monitor user adoption and interaction with specific agents or plugins within Microsoft 365 Copilot, administrators use the dedicated report in the Microsoft 365 admin center. This report is located under the Reports > Usage section and is officially titled the "Microsoft Copilot for Microsoft 365 usage report." It provides key metrics on adoption, usage, retention, and user sentiment, which are essential for understanding how the AI tools, including custom agents, are being utilized across the organization. The report's primary function is to provide usage analytics, making "Usage" the correct category.

A. Security: Security reports focus on threat protection, compliance, and risk management, not on user activity or feature adoption metrics.

B. Licensing: The Licensing section is used to manage and assign product licenses to users, not to track how the licensed features are being used.

C. Health: The Health section reports on the operational status and incidents of Microsoft 365 services, not on user engagement or analytics.

1. Microsoft Learn. (2024). Microsoft Copilot for Microsoft 365 usage report. "In the Microsoft 365 admin center

go to the Reports > Usage page." This document confirms the exact location and purpose of the report is for tracking usage.

2. Microsoft Learn. (2024). Overview of the Microsoft 365 admin center. This document outlines the distinct functions of the admin center sections

showing that "Usage

" "Health

" "Security

" and "Billing" (which includes Licensing) are separate areas with different administrative purposes.

The scenario describes a complex, multi-step business process that requires automation, integration with multiple systems (HR system, Teams), and a consistent, governed workflow. In Microsoft Copilot Studio, a custom agent (also referred to as a custom copilot) is the appropriate component to build for this purpose. It can be designed to follow specific logic, connect to various data sources and applications using connectors and plugins, and execute a series of actions in a predefined sequence, moving beyond simple one-off prompts to encapsulate an entire business workflow.

A. prompt library: This is a collection of reusable prompts for users, not an automated workflow that connects to backend systems to perform actions.

B. single macro: A macro typically automates a simple, repetitive task within one application, not a complex, multi-system workflow as described.

D. static FAQ page: This is a non-interactive information source and lacks any capability for automation, system integration, or executing workflows.

1. Microsoft Learn. "Overview of Microsoft Copilot Studio." Microsoft Copilot Studio documentation. "Microsoft Copilot Studio lets you create powerful AI-powered copilots for a range of requests—from providing simple answers to common questions to resolving issues requiring complex conversations. Engage with customers and employees in multiple languages across websites

mobile apps

Facebook

Microsoft Teams

or any channel supported by the Azure Bot Framework."

2. Microsoft Learn. "Quickstart: Create and deploy a plugin-based copilot." Microsoft Copilot Studio documentation. This guide demonstrates building a copilot that uses plugins to connect to external data and perform actions

which is the core of the described requirement.

The scenario describes a need to detect complex patterns of potential IP theft by correlating various user activities over time, such as file access, data exfiltration, and HR signals like resignation. Microsoft Purview Insider Risk Management is designed for this exact purpose. It uses machine learning templates to analyze signals from across Microsoft 365, correlate them into potential risks, and generate alerts for investigation. It also includes built-in privacy features like pseudonymization to protect user identities during the initial review phase.

A. Communication compliance focuses on scanning user communications (email, Teams) for specific policy violations, not correlating broad user activities like file exports or HR data.

B. eDiscovery (Premium) is a reactive tool used to collect, review, and export data for legal investigations after an incident, not for proactive risk detection.

D. A Microsoft Purview Audit retention policy only governs how long audit logs are stored; it does not analyze the logs to proactively identify or correlate risky behaviors.

1. Microsoft Learn. (2024). Learn about Microsoft Purview Insider Risk Management. This document states

"Insider risk management correlates various signals to identify potential malicious or inadvertent insider risks

such as IP theft

data leakage

and security violations."

2. Microsoft Learn. (2024). Investigate insider risk management activities. Under the section "User activity in content explorers

" it describes how policies can be triggered by signals like "User resignation or termination date." The "Privacy" section also details the pseudonymization feature.

The statement is false. Microsoft Purview retention policies and traditional backup solutions serve fundamentally different purposes and are not interchangeable. Retention is a compliance and data governance tool designed to ensure data is kept for legal, regulatory, or business requirements and cannot be permanently deleted before its retention period ends. Backup is an operational recovery tool designed for business continuity and disaster recovery, allowing for the restoration of data to a specific point in time in case of corruption, accidental mass deletion, or system failure. Retention is not designed for rapid, large-scale operational recovery.

A. The statement is a common but dangerous misconception. Relying on retention for operational recovery is impractical and leaves an organization vulnerable to data loss scenarios that backups are designed to mitigate.

1. Microsoft Learn. (2024). Learn about retention policies & retention labels. "The goal isn't to help you back up your data. Instead

the goal is to retain content to meet your organization's data compliance requirements." (Paraphrased from the core concept of the document).

2. Microsoft Learn. (2024). Shared responsibility in the cloud. This document outlines that while Microsoft ensures service availability

the customer is responsible for protecting the security of their data and identities

which includes implementing appropriate backup strategies.

3. Microsoft Service Trust Portal. (2023). Microsoft 365 Data Resiliency. "Point-in-time restoration of data is not a service that is provided by Microsoft... For this reason

we recommend that customers use third-party backup solutions."

Microsoft Purview Data Lifecycle Management (DLM) indeed provides retention labels and policies that let organizations keep required content, delete what is no longer needed, and maintain auditable proof of compliance across Teams, SharePoint, and Exchange. This aligns precisely with the records manager’s description.

No alternative options were supplied.

1. Microsoft Purview documentation – “Data lifecycle management in Microsoft 365”

Overview

paragraphs 1-3 (https://learn.microsoft.com/purview/data-lifecycle-management).

2. Microsoft Purview Records Management – “Prove compliance” section

Microsoft Learn

2024-01-10.

The statement is false. Copilot Studio provides robust security and sharing options that integrate directly with Microsoft Entra ID. The recommended and most scalable method for managing access is to share the copilot with Microsoft Entra security groups. An administrator can create a security group for each business unit, share the relevant copilot with that group, and then manage access simply by adding or removing users from the group in Microsoft Entra ID. This avoids manual, per-user configuration within the copilot itself and aligns with standard enterprise access management practices.

This is a True/False question. The statement is demonstrably false as sharing with security groups is a core feature.

1. Microsoft Learn. (2024). Share your copilot with other users. "You can control who can chat with the copilot (and who can't) by sharing it. You can share your copilot with security groups... Sharing with a security group means members of that group can chat with the copilot." Section: "Share with security groups".

2. Microsoft Learn. (2024). Configure user access control in Copilot Studio. "Copilot Studio lets you control who can chat with your copilot using security groups. This is useful for copilots that handle sensitive or restricted information." Section: "Share the copilot with a security group".

The statement is True. Microsoft Entra Identity Secure Score is designed to reflect nuanced security postures. For many improvement actions, particularly those that apply to a population of users or devices, the score is calculated based on the percentage of completion. If an organization enables MFA for a subset of its users (such as administrators), it will receive partial points for the broader "all users" MFA control, proportional to the percentage of total users now protected. This allows organizations to get credit for incremental progress toward a better security posture.

This is a True/False style question. The statement accurately describes how scoring works for many improvement actions in Identity Secure Score, making 'A' (True) the only correct choice.

1. Microsoft Entra documentation. "What is the Microsoft Entra Identity Secure Score?". Microsoft Learn. learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-identity-secure-score. "Each improvement action is worth 10 points or less

and in most cases

the score is given as a percentage of the configuration completed. For example

if you enable MFA for 50 of your 100 total users

you get 5 points (50% of the 10 total points available)."

2. Microsoft Entra documentation. "Improve your secure score". Microsoft Learn. learn.microsoft.com/en-us/entra/identity/monitoring-health/how-to-improve-secure-score. "Some recommendations are scored in a binary way... Others are scored as a percentage of the total configuration."

The proposed solution does not meet the goal because folder names provide no security. By leaving the default inherited permissions in place, the "HR-Private" folder is accessible to everyone who has access to the parent "Documents" library. To secure the folder, an administrator must explicitly break permission inheritance for that folder and then grant unique permissions only to the HR staff group.

The question asks for a "Yes" or "No" validation of the solution. The only other logical option is "Yes," which is incorrect because security through obscurity (relying on a name) is not a valid security control in SharePoint. Permissions must be explicitly configured.

1. Microsoft Learn. (2024). Customize permissions for a SharePoint list or library. Under the section "Break permission inheritance

" it states

"By default

all sites

lists

and libraries in a site collection inherit permissions from the site that is directly above them... To assign unique permissions... you must first break permissions inheritance."

2. Microsoft Learn. (2023). Understanding permission levels in SharePoint. This document explains the concept of inheritance

where permissions from a parent object (like a site or library) are passed down to child objects (like a folder)

which is the default behavior that makes the proposed solution insecure.

The Researcher feature/agent in Microsoft Word is intended to locate reliable sources on the web, generate structured outlines, insert citations, and compile multi-source reports—not merely rephrase sentences. Hence the assertion that it is “mainly intended for simple, one-step edits” and “does not draw on multiple sources or produce structured reports” is incorrect.

(Only one option provided; no alternatives to refute.)

1. Microsoft Support – “Use Researcher in Word” (support.microsoft.com/en-us/office

article = 0fc5fac6-4bf1-4f0c-a9ab-5b5a9f2b94e2)

sections “Add reliable sources” and “Create an outline”.

2. Microsoft Learn – “Researcher and Editor in Word”

para. “Generate structured research papers with citations” (2023-12-15).

In a Zero Trust security model, the fundamental principle is "never trust, always verify." This means that no user, device, or network segment should be inherently trusted based solely on their location or network connection. The Zero Trust model explicitly rejects the traditional perimeter-based security approach where internal networks are considered trusted. Instead, it requires continuous verification of every transaction, regardless of where the connection originates from - whether it's from inside the corporate network, VPN, or external locations.

The scenario describes a direct violation of Zero Trust principles by suggesting that users on the corporate LAN or VPN should bypass conditional access checks and device compliance validation. This traditional "castle-and-moat" approach assumes that everything inside the corporate network is safe, which is precisely what Zero Trust architecture seeks to eliminate.

Why the True Option is Wrong: Accepting the statement as true would mean endorsing a security approach that directly contradicts the core tenets of Zero Trust. Microsoft's Zero Trust model explicitly requires:

- Verification of every transaction

- Assumption that breach has already occurred

- Least privilege access principles

- Continuous validation of security posture

Trusting users solely based on network location without further verification represents a significant security vulnerability and is antithetical to Zero Trust principles.

The statement would be "True" only in a traditional, perimeter-based security model, which Zero Trust is designed to replace. In a Zero Trust architecture, network location is just one signal among many and never confers implicit trust. Every access request must be treated as if it originates from an open network.

1. Microsoft Documentation - "What is Zero Trust?" Microsoft Learn

Security documentation. Specifically states: "Zero Trust assumes breach and verifies each request as though it originates from an open network" (https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-overview)

2. Microsoft Documentation - "Zero Trust deployment guide for Microsoft 365" Microsoft Learn

Architecture Center. Section on "Verify explicitly" principle: "Always authenticate and authorize based on all available data points

including user identity

location

device health

service or workload

data classification

and anomalies" (https://learn.microsoft.com/en-us/microsoft-365/security/microsoft-365-zero-trust)

3. NIST Special Publication 800-207 - "Zero Trust Architecture" National Institute of Standards and Technology

Section 2.1: "Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location" (https://doi.org/10.6028/NIST.SP.800-207)

The colleague's guidance is correct and represents the standard administrative best practice. The most direct and efficient method to prevent external senders from emailing a distribution group is to configure the delivery management settings on the distribution group object itself within the Exchange admin center. This setting allows an administrator to explicitly permit messages only from senders within the organization, causing the Exchange transport service to reject messages from any external email address. This centralizes the control on the intended target (the group) rather than attempting to manage it through complex and inefficient rules on individual member mailboxes.

The alternative, False, is incorrect. Attempting to manage this restriction at the individual mailbox level is not scalable, is prone to error, and is not the intended design for controlling group message delivery. The control exists specifically on the distribution group object for this purpose.

1. Microsoft Learn. "Manage distribution groups in Exchange Online." Microsoft Docs. Accessed May 2024. In the section on editing group properties

the "Delivery management" settings are described

which include the option to "Choose whether people inside or outside your organization can send email to this distribution group."

2. Microsoft Learn. "Allow only messages from people in my organization." Exchange Online PowerShell documentation. Accessed May 2024. The documentation for the Set-DistributionGroup cmdlet shows the -RequireSenderAuthenticationEnabled $true parameter

which programmatically enforces that only authenticated (internal) users can send to the group. This corresponds to the setting in the Exchange admin center.