Microsoft 365 and AI Services Administrator Associate (AB-650)

B is correct.

Explanation: Configuring Chat pay-as-you-go requires both a supported Microsoft 365 role and Azure rights. The Billing Administrator, AI Administrator, or Global Administrator role satisfies the Microsoft 365 requirement. Owner or Contributor rights on the selected Azure subscription and resource group satisfy the Azure side of the setup requirement.

A is incorrect: the License Administrator role alone is not sufficient, and Azure ownership does not replace the required Microsoft 365 administrator role.

C is incorrect: the Groups Administrator role is a license-assignment role and is not supported for configuring Chat pay-as-you-go billing policies in the tenant.

D is incorrect: both Microsoft 365 roles and Azure rights are strictly required, and only the specifically listed Microsoft 365 administrator roles qualify.

A is correct.

Explanation: A WSS finding means WebSocket connections to the reported domain failed. Microsoft Copilot requires WSS connectivity to copilot.cloud.microsoft. The investigation should focus on proxy, firewall, timeout, and routing settings along the connection. You should then rerun the connectivity test after identifying and correcting the underlying cause.

B is incorrect: Network tests do not include user identities or licensing information, so the finding does not establish an individual licensing cause for the connection failure.

C is incorrect: Network tests do not include device details, so the finding does not establish an individual device state as the cause of the connection failure.

D is incorrect: Mailbox permissions are unrelated to failed WebSocket connections to a documented Copilot domain, so investigating them would not address the network finding.

C is correct.

Explanation: The custom notification domain setting applies to supported system notifications, such as Teams missed-activity messages. However, OneDrive and SharePoint one-time passcodes continue to use the default no-reply@notify.microsoft.com address. Choosing a custom notification domain does not automatically rewrite every single message sent by Microsoft 365.

A is incorrect: While missing DNS records affect email readiness, the evidence states that one-time passcodes keep the Microsoft sender regardless of the custom domain setup.

B is incorrect: The custom notification domain setting can take up to 24 hours to take effect. The evidence provides no 72-hour delay for one-time passcodes.

D is incorrect: Ordinary user-to-user email remains completely unchanged by this setting. The custom domain configuration only applies to supported system notifications sent by products.

C is correct.

Explanation: The organization-level setting acts as a ceiling for external sharing. Every individual site keeps its own sharing setting, which can match the organization ceiling or sit below it, but never exceed it. With Existing guests as the ceiling, the Finance site can restrict itself further to Only people in your organization, but cannot be loosened to Anyone.

A is incorrect: Site owners cannot loosen a site beyond the organization ceiling, so Anyone is not allowed when the ceiling is set to Existing guests.

B is incorrect: The OneDrive setting does not raise the SharePoint ceiling. OneDrive can only be equally or more restrictive than the SharePoint setting.

D is incorrect: A site can be more restrictive than the ceiling, so Only people in your organization is valid. New and existing guests exceeds the ceiling.

A is correct.

Explanation: Signing in establishes who a person is, but their available capabilities depend on the assigned license and its service plans. A license can be assigned while a specific service plan within it is disabled. Check the license and the relevant service plan before buying another subscription.

B is incorrect: The shared directory connects identities across services. The symptom is a disabled service capability, not an external collaboration or tenant boundary issue.

C is incorrect: The default geography determines service provisioning and data location. It does not control whether a specific user can access a licensed capability.

D is incorrect: The initial domain allows you to create accounts before adding a custom domain. Using it does not block access to licensed services.

B is correct.

Explanation: Group-based licensing processes direct members only, so the Group2 members never received the license from the Group1 assignment. Assigning the license directly to Group2 or making its users direct members of Group1 places them where the licensing engine processes them. The confirmation message reflected only the users it processed.

A is incorrect: nested groups are not processed at all, so waiting does not change coverage and no later processing reaches Group2 members.

C is incorrect: service plan toggles control apps within a license for assigned users, and they do not extend the assignment to nested members.

D is incorrect: usage location issues affect users the engine processes, and Group2 members were never processed, so reassigning to Group1 changes nothing.

B is correct.

Explanation: A full SharePoint restore can use the original URL or a new location. Choosing a new location lets Finance inspect or retrieve the recovered content without replacing the live version. Restoring to the original URL would replace the scoped live content and metadata with the selected prior state.

A is incorrect: Restoring to the original URL replaces live content and metadata, which Finance wants to avoid until it has inspected the recovered content.

C is incorrect: Version history helps recover individual item versions and is not a tenant-scale recovery plan, so it does not return a whole site.

D is incorrect: Legal holds preserve content for investigation and eDiscovery rather than returning content to active use, so they do not restore a site.

C is correct.

Explanation: The Helpdesk Administrator role can view Service Health and set up notification preferences, so Global Administrator is not needed. Incident notifications cover active problems affecting availability. Each admin can register up to two email addresses, which allows routing alerts to both the lead and a shared mailbox.

A is incorrect: Global Administrator carries access the task does not need, and one address does not cover both the lead and the shared mailbox.

B is incorrect: Daily manual checks can miss issues flagged between visits. Notifications are what deliver incidents to the inbox as soon as Microsoft posts them.

D is incorrect: Advisories cover lower-impact issues, so advisory-only notifications would not report the active problems affecting service availability that the lead needs to monitor.

A is correct.

Explanation: A delegate can hold Send As and Send on Behalf on the same mailbox at the same time. When that happens, Send As always takes precedence, and the message goes out without disclosing the delegate. You must check for Send As and remove it if disclosure is required.

B is incorrect: Full Access only lets a delegate open and manage the mailbox. It does not change the From field presentation for recipients.

C is incorrect: Plan 2 relates to primary mailbox size, archive, and hold. It does not control how the sender appears to recipients.

D is incorrect: Send on Behalf is configured on the mailbox, not in the recipient's client, and Send As overrides it regardless.

C is correct.

Explanation: An internal relay domain can have known recipients in Microsoft 365 and other recipients on an organization's own mail system. To ensure mail reaches the on-premises server, relaying unknown cloud recipients requires an outbound connector from Microsoft 365 to that specific destination system. This matches the hybrid routing requirement.

A is incorrect: For an authoritative domain, every valid address is a recipient object in Microsoft 365, and mail for unknown recipients is rejected.

B is incorrect: The MX record directs incoming mail to Microsoft 365 but does not relay unknown recipients. An outbound connector is required.

D is incorrect: An authoritative domain rejects unknown recipients, so a connector would not make this domain relay mail to the on-premises system.