AB-650 Administering Microsoft 365 and AI Services

What's inside

AB-650 doesn't test whether you can find a setting in the Microsoft 365 admin center. It tests whether you can choose the right role, policy, Purview control or Copilot setting for a requirement, and say what each one does not do.

This independent study guide for the Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate exam distils what AB-650 really expects you to understand into the comparisons, configuration choices and traps that administration decisions turn on, with short PowerShell and Microsoft Graph examples throughout. Microsoft set 30 November 2026 as the retirement date for MS-102, and AB-650, launched on 30 October 2026, is the new Microsoft 365 administrator exam; Microsoft's partner programme names it as MS-102's replacement. This book is written for AB-650 and its focus on Copilot, agents and AI services, not for MS-102.

Organised by technology

Thirteen chapters, each readable on its own and together covering all three AB-650 skill areas:

• Configure and manage tenants and workloads: branding, domains and organisation settings, licences including group-based licensing and pay-as-you-go, licences for AI services, Microsoft 365 Backup, network connectivity insights, Service health, mailboxes, Teams and Copilot in Teams meetings, SharePoint sites and permissions, and SharePoint and OneDrive for Copilot.
• Govern and secure tenants and workloads: users, guests and external access, groups, roles and Privileged Identity Management, administrative units, bulk management with Microsoft Graph PowerShell, authentication methods, Password Protection, self-service password reset, Conditional Access and ID Protection, Defender for Office 365 alerts, threat policies and attack simulations, and Microsoft Purview data loss prevention, sensitivity labels, retention and DLP alerts.
• Manage and secure AI services: Copilot readiness and data oversharing, Purview Data Security Posture Management for AI, web search, Copilot Search and tenant settings, Copilot Cowork, third-party AI providers and connectors, agent identities with Microsoft Entra Agent ID, access packages, the agent registry, Microsoft Agent 365, and cost, usage and service health monitoring with the Copilot Control System.

Inside

• Comparison tables for every close call, such as which role, which policy type or which Purview control fits a requirement.
• 120+ Common trap callouts that name the answers that look right but aren't, and explain what's right instead.
• 9 diagrams, from the domain verification wizard and Copilot billing routes to Conditional Access, policy precedence, the DLP alert lifecycle and the path from agent blueprint to agent identity.
• Key takeaways at the end of every chapter for fast revision.
• A glossary of 280+ terms, each linked to Microsoft Learn, with a free online version for print readers.

Up to date

Microsoft 365 and Copilot change quickly. This edition reflects Microsoft's documentation as of November 2026 and the skills measured as Microsoft's study guide showed them then, including Microsoft 365 Backup, Microsoft Agent 365, Microsoft Entra Agent ID and the retirements and renamings that have reached the admin centers.

Understanding, not memorising

This book contains no exam questions. It explains the knowledge the exam expects, so you can answer questions you have never seen and apply the same judgement to a real tenant.

Written by Tony Rough, a cloud architect with more than twenty years in IT infrastructure who holds the Azure Solutions Architect Expert, Azure Administrator and Azure Security Engineer certifications.

Part of the Ultra Transcenders series from Distilled Press. An independent publication, not affiliated with, sponsored by or endorsed by Microsoft Corporation.

Is this book for you?

• Yes, if you're preparing for AB-650 and want to understand why the right answer is right, or you work with these services and want a compact reference organised by technology.
• It isn't a question bank. The book contains no exam questions. Use it alongside Microsoft's free official AB-650 study guide and practice assessment, and some hands-on time in Azure.
• Leads to Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate.

Which certification, which book?

Exam coverage

Every skill area in Microsoft's AB-650 outline, and the chapters that cover it.

See every objective and where the book covers it

Chapters

1. The Microsoft 365 tenant
2. Licences, backup and service health
3. Workloads: Mailboxes, Teams and SharePoint for Copilot
4. Identities in Microsoft Entra
5. Authentication and Conditional Access
6. Defender for Office 365
7. Purview: DLP, labels and retention
8. Purview for AI: DLP alerts and DSPM
9. Getting ready for Microsoft 365 Copilot
10. Running Copilot: settings, Cowork, providers and connectors
11. Agent identities and access
12. The agent registry and Agent 365
13. Monitoring AI services

Plus an appendix glossary of 200+ terms, each linked to Microsoft Learn, with the same terms explained free online for print readers.

Free study notes

Some sections of the book, free to read online:

• Group-based licensing in Microsoft 365

  Which groups can carry licences, who can assign them and how membership drives access.

• Administrative units in Microsoft Entra ID

  How administrative units scope roles to a subset of users, groups and devices.

• Authentication strengths in Conditional Access

  How built-in and custom authentication strengths define which method combinations satisfy a policy.

• Conditional Access fundamentals: assignments, conditions and controls

  How a Conditional Access policy combines assignments, conditions and access controls.

• Attack simulation training in Defender for Office 365

  What the harmless phishing simulations are, and the licence and permissions needed to run them.

• Data loss prevention for Microsoft 365 Copilot

  What the Copilot policy location is, which template offers it and the controls it provides.

• Finding oversharing before turning on Copilot

  How SharePoint data access governance reports and Purview data risk assessments help to find oversharing.

• Copilot release preferences and Frontier

  The three audience options for when tenant users receive new features, and where Frontier fits.

• Service health for Copilot

  Where Copilot issues are tracked: Service health for incidents and Message center for changes.

Study plan

A free week-by-week plan through the book at a 4-week or 8-week pace, with the study notes and exam skill areas for each week.

Open the AB-650 study plan