AB-650 Exam Alignment
AB-650

Domain 1 — Configure and manage a Microsoft 365 tenant: configure branding in a Microsoft 365 tenant including logo, company URL, themes, and backgrounds; implement and manage domains; configure and manage organizational settings including security and privacy settings and the organization profile; manage and monitor Microsoft 365 licenses including group-based licensing and pay-as-you-go; manage and monitor licenses for AI services including Microsoft 365 Copilot, Microsoft Agent 365, and Microsoft Copilot Studio; configure and use Microsoft 365 Backup including setup, restore, and monitor; configure and review network connectivity insights; monitor the health of Microsoft 365 services by using Service health including notification configuration.

• Know the M365 Admin Center URL: admin.microsoft.com and each AI-specific sub-section (Copilot, Agent settings)
• Distinguish between standard M365 licences and AI services licences (Copilot, Agent 365, Copilot Studio)
• Know the Microsoft 365 Backup products: Exchange Online (up to 1 year), SharePoint Online (up to 1 year), and OneDrive (up to 1 year)
• Understand group-based licensing for bulk assignment of AI service licences
• Know Network Connectivity Insights location in admin center and what metrics it surfaces

Exam Tip: AB-650 Domain 1 tests licensing scenarios heavily — expect questions like “A user needs access to Copilot Chat but not Copilot Studio. Which licence(s) must be assigned?” Know the three AI licences (Microsoft 365 Copilot, Microsoft Agent 365, Microsoft Copilot Studio) and what each enables before sitting the exam.

🏠 The Microsoft 365 Admin Center for AB-650

The Microsoft 365 Admin Center at admin.microsoft.com is the primary management console for all AB-650 administrative tasks. For AB-650 candidates, the admin center has expanded significantly beyond the MS-102 era — it now includes dedicated sections for Copilot, Agent settings, and AI services licensing that form the foundation of Domain 3.

🆓 Tenant Branding

Tenant branding in Microsoft 365 controls how the sign-in experience and administrative interfaces appear to users across the organisation. Configured under Settings → Org settings → Organization profile, branding settings apply globally to the Microsoft 365 sign-in page and Microsoft Entra ID authentication flows.

Configurable Branding Elements

🌐 Custom Domains

Every Microsoft 365 tenant starts with a default .onmicrosoft.com domain. Custom domains (e.g. contoso.com) are added so that users have professional email addresses and SharePoint URLs. Custom domain management is at Settings → Domains.

Domain Verification Process

🔒 Organizational Settings — Security & Privacy

Organisational settings at Settings → Org settings and Settings → Security & privacy control tenant-wide defaults for user behaviour, authentication, and data handling. These settings apply to all users unless overridden by policies at the user or group level.

Key Security & Privacy Settings

🌟 AI Services Licensing NEW IN AB-650

This is the most significant new Domain 1 topic for AB-650 candidates. Managing licences for AI services requires understanding three distinct Microsoft AI products — each with its own licensing model, prerequisites, and capabilities. These are managed at Billing → Licences and Billing → Your products in the M365 Admin Center.

The Three AB-650 AI Service Licences

Group-Based Licensing for AI Services

Group-based licensing allows you to assign AI service licences to a Microsoft Entra security group or Microsoft 365 group rather than individual users. When a user is added to the group, the licence is automatically assigned. When removed, the licence is automatically reclaimed. This is the recommended approach for scaling Copilot rollouts to hundreds or thousands of users.

Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All","Directory.ReadWrite.All"

# Get all available SKUs including AI service licences
Get-MgSubscribedSku | Select-Object SkuPartNumber,SkuId,ConsumedUnits,@{N="Available";E={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}} | Sort-Object SkuPartNumber | Format-Table -AutoSize

# Find the Microsoft 365 Copilot licence SKU ID
$CopilotSku = Get-MgSubscribedSku | Where-Object {$_.SkuPartNumber -eq "Microsoft_365_Copilot"}
Write-Host "Copilot SKU ID: $($CopilotSku.SkuId) | Available: $($CopilotSku.PrepaidUnits.Enabled - $CopilotSku.ConsumedUnits)"

# Assign Copilot licence to a single user
$UserId = (Get-MgUser -Filter "UserPrincipalName eq 'alice@contoso.com'").Id
Set-MgUserLicense -UserId $UserId -AddLicenses @{SkuId = $CopilotSku.SkuId} -RemoveLicenses @()

# Assign AI service licence to a group (group-based licensing)
$GroupId = (Get-MgGroup -Filter "DisplayName eq 'Copilot-Pilot-Users'").Id
Set-MgGroupLicense -GroupId $GroupId -AddLicenses @{SkuId = $CopilotSku.SkuId} -RemoveLicenses @()

# Get all Copilot-licensed users
Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses |
  Where-Object {$_.AssignedLicenses.SkuId -contains $CopilotSku.SkuId} |
  Select-Object DisplayName,UserPrincipalName | Format-Table -AutoSize

# Check for group-based licensing assignment errors
Get-MgGroupMemberWithLicenseError -GroupId $GroupId |
  Select-Object DisplayName,UserPrincipalName | Format-Table -AutoSize

💾 Microsoft 365 Backup NEW IN AB-650

Microsoft 365 Backup is a native Microsoft 365 backup and restore service (distinct from Azure Backup) that provides point-in-time restore capabilities for Exchange Online mailboxes, SharePoint Online sites, and OneDrive accounts. It is managed entirely within the Microsoft 365 Admin Center and does not require Azure subscription or third-party backup tools.

Microsoft 365 Backup — Key Capabilities

Connect-MgGraph -Scopes "BackupRestore.Read.All","BackupRestore.ReadWrite.All"

# Get the overall M365 Backup service status
Get-MgSolutionBackupRestoreServiceApp | Select-Object Id,Status,LastModifiedDateTime | Format-List

# Get Exchange Online protection policies (which mailboxes are protected)
Get-MgSolutionBackupRestoreExchangeProtectionPolicy | Select-Object Id,DisplayName,Status,CreatedDateTime | Format-Table -AutoSize

# Get SharePoint Online protection policies
Get-MgSolutionBackupRestoreSharePointProtectionPolicy | Select-Object Id,DisplayName,Status,CreatedDateTime | Format-Table -AutoSize

# Get OneDrive protection policies
Get-MgSolutionBackupRestoreOneDriveForBusinessProtectionPolicy | Select-Object Id,DisplayName,Status,CreatedDateTime | Format-Table -AutoSize

# List restore sessions (active or completed restores)
Get-MgSolutionBackupRestoreRestoreSession | Select-Object Id,Status,CreatedDateTime,LastModifiedDateTime | Format-Table -AutoSize

🌐 Network Connectivity Insights

Network Connectivity Insights (Health → Network connectivity in the M365 Admin Center) provides visibility into how your organisation’s network is performing for Microsoft 365 traffic. It aggregates data from the Microsoft 365 connectivity test tool, the Windows 365 connectivity test, and optional on-premises data from the Network Connectivity Test scripts deployed to office locations.

Key Network Connectivity Metrics

❤ Service Health Monitoring & Notifications

Service Health (Health → Service health in the M365 Admin Center) provides real-time status of all Microsoft 365 services and past incident history. For AB-650 administrators, service health monitoring includes the AI services: Microsoft 365 Copilot, Agent 365, and Copilot Studio now appear as separate monitored services.

Connect-MgGraph -Scopes "ServiceHealth.Read.All"

# Get current service health status for all M365 services
Get-MgServiceAnnouncementHealthOverview | Select-Object Service,Status | Sort-Object Service | Format-Table -AutoSize

# Get only services with active issues
Get-MgServiceAnnouncementHealthOverview | Where-Object {$_.Status -ne "ServiceOperational"} |
  Select-Object Service,Status | Format-Table -AutoSize

# Get active incidents and advisories
Get-MgServiceAnnouncementIssue -Filter "status ne 'resolved'" |
  Select-Object Id,Title,Service,Status,Classification,StartDateTime |
  Sort-Object StartDateTime -Descending |
  Format-Table -AutoSize

# Get service health for Copilot and Agent 365 specifically
Get-MgServiceAnnouncementHealthOverview | Where-Object {$_.Service -like "*Copilot*" -or $_.Service -like "*Agent*"} |
  Select-Object Service,Status | Format-Table -AutoSize

# Get recent Message Center posts (new features and planned changes)
Get-MgServiceAnnouncementMessage -Filter "lastModifiedDateTime gt 2026-01-01" |
  Select-Object Title,Category,Severity,LastModifiedDateTime |
  Sort-Object LastModifiedDateTime -Descending -First 10 |
  Format-Table -AutoSize

Service Health Email Notifications

Admins can configure email alerts so service incidents are sent automatically without requiring active monitoring of the admin center. Navigate to Health → Service health → Preferences → Email to configure:

• Email address(es) to receive service health alerts (up to 2 email addresses per admin)
• Which services to monitor (select all or specific services including Copilot, Agent 365)
• Alert frequency: Real-time alerts for new incidents, or a daily digest
• Major service incidents send immediate alerts regardless of frequency settings

🎓 Interview Q&A

Next Module →Module 2: M365 Workloads & Copilot Integration→