Viv SharmaAB-650 is the exam for the Microsoft 365 Certified: AI Services Administrator Associate certification. It expands the traditional Microsoft 365 administrator role into secure administration of Microsoft 365 Copilot, agents and connected AI services. The exam is in beta, so the preparation strategy should prioritise the published skills outline and hands-on administration over unofficial question banks.
Exam snapshot
Skills measured
| Domain | Weight | What to master |
|---|---|---|
| Configure and manage Microsoft 365 tenants and workloads | 20–25% | Tenant settings, identities, groups, licences, Exchange, SharePoint, Teams, service health and Graph PowerShell. |
| Govern and secure Microsoft 365 tenants and workloads | 40–45% | Entra, Conditional Access, Defender XDR, Purview, information protection, retention, audit, eDiscovery and secure collaboration. |
| Manage and secure AI services in Microsoft 365 | 35–40% | Copilot readiness, licences, agents, data controls, Copilot Control System, Agent 365, usage, cost, adoption and service health. |
The weightings make governance the largest domain, but AI administration is close behind. Do not treat the AI section as a product tour: be ready to decide which control belongs in Entra, Purview, SharePoint, Defender, Copilot Control System or an agent governance workflow.
Build a representative lab
- A Microsoft 365 developer or test tenant with test users, groups and workload data.
- Role assignments that let you compare Global Administrator with least-privilege roles.
- Conditional Access policies in report-only mode and test exclusions.
- SharePoint sites with deliberately different ownership and sharing models.
- Purview sensitivity labels, retention and DLP policies.
- Copilot or Copilot Chat access, depending on available licensing.
- A controlled agent creation and approval scenario.
- Microsoft Graph PowerShell for repeatable verification.
PowerShell commands to recognise
Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","Reports.Read.All"
Get-MgOrganization
Get-MgSubscribedSku
Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,AccountEnabled
Get-MgIdentityConditionalAccessPolicy
Invoke-MgGraphRequest -Method GET `
-Uri "https://graph.microsoft.com/v1.0/reports/getMicrosoft365CopilotUsageUserDetail(period='D30')"Exact report endpoints and permissions can change. Practise interpreting Graph permission errors and validating the current Microsoft documentation rather than memorising a single command.
Four-week study plan
Review tenant configuration, domains, users, groups, licences, admin roles, service health and core administration across Exchange Online, Teams and SharePoint. Automate inventory and validation with Microsoft Graph PowerShell.
Build Conditional Access in report-only mode, review authentication methods and PIM, then configure sensitivity labels, retention, DLP, audit and eDiscovery. Trace how one overshared SharePoint file becomes visible to a user and therefore to Copilot.
Assess readiness, assign licences through controlled groups, review app and network prerequisites, separate Copilot from Copilot Studio, and define agent inventory, approval, publishing and monitoring controls.
Use usage and adoption reports, monitor service health, review costs, investigate agent activity and practise end-to-end scenarios. Finish with timed recall against every published objective.
Scenario practice
Overshared data
A pilot user gets an unexpected Copilot answer sourced from a broadly shared site. Identify the existing permission path, remediate access, assess sensitivity and review whether restricted content discovery is required.
Unapproved agent
An agent is published with a connector to business data. Determine who can disable or restrict it, how consent was granted, which data policies apply and what evidence must be retained.
Conditional Access failure
A Copilot user is blocked on mobile. Separate licence, app protection, compliant device, session control and authentication-strength causes using sign-in logs.
Low adoption
Licences are assigned but active usage is low. Use workload-level reports, scenario-based training, champions and measurable use cases rather than a generic prompt workshop.
Exam technique
- Choose the least-privilege role that can perform the task.
- Distinguish readiness, prevention, detection, investigation and remediation controls.
- Remember that Copilot respects the user’s existing permissions; it does not repair poor information architecture.
- For agents, consider identity, connectors, consent, data sources, publishing, monitoring and lifecycle together.
- Read the question for scope: tenant, workload, site, user, app or agent.
Final readiness checklist
- I can explain all three exam domains without notes.
- I have configured and investigated Conditional Access and Purview controls.
- I can assess SharePoint and OneDrive content governance before Copilot rollout.
- I can separate Copilot user enablement from Copilot Studio and agent publishing.
- I can use Graph PowerShell to inventory and verify tenant state.
- I checked the official AB-650 study guide for updates immediately before the exam.
Microsoft references
- Exam AB-650: Administering Microsoft 365 and AI Services
- Official AB-650 study guide
- Microsoft 365 Certified: AI Services Administrator Associate
- Microsoft 365 Copilot documentation
Review note: AB-650 is in beta as at 28 August 2026. Objectives and exam availability may change.