AB-650 Exam Alignment
AB-650

Domain 2 — Manage authentication and secure access: manage authentication methods and authentication method policies; configure Microsoft Entra Password Protection and SSPR; investigate and resolve sign-in and MFA issues; configure Conditional Access policies; manage Entra ID Protection risk policies; configure agent Conditional Access (new in AB-650).

• Know the authentication methods available in Entra ID: FIDO2, Windows Hello for Business, Microsoft Authenticator, SMS, OATH hardware/software tokens, certificate-based authentication
• Understand Conditional Access policy evaluation: conditions (user, device, location, app, risk) and grant controls (MFA, compliant device, approved app)
• Know that Entra ID Protection risk levels (low, medium, high) can trigger Conditional Access policies automatically
• Understand agent Conditional Access — new in AB-650 — applies Conditional Access to AI agent identities managed by Entra Agent ID

Exam Tip: AB-650 tests Conditional Access scenarios heavily. Know the order of evaluation: Named Locations and compliant device checks happen BEFORE MFA prompts. Know that “Report-only” mode lets you evaluate a CA policy impact without enforcing it — use this before enabling new policies in production.

🔐 Authentication Methods in Microsoft Entra ID

Microsoft Entra ID supports a range of authentication methods, managed via the Authentication methods policy (replacing the legacy per-method settings). AB-650 tests which methods are available and when each should be used.

🔓 Conditional Access Policies

Conditional Access is the primary tool for enforcing access controls in Microsoft 365. It evaluates signals (user, device, location, app, risk) and applies grant or session controls.

🔒 Entra Password Protection & SSPR

Connect-MgGraph -Scopes 'Policy.Read.All','Policy.ReadWrite.ConditionalAccess','UserAuthenticationMethod.ReadWrite.All'

# Get all Conditional Access policies and their state
Get-MgIdentityConditionalAccessPolicy | Select-Object DisplayName,State,Id | Format-Table -AutoSize

# Create a Conditional Access policy requiring MFA for Exchange Online
$Policy = @{
  DisplayName = 'Require MFA for Exchange Online'
  State = 'enabled'
  Conditions = @{
    Users = @{IncludeUsers = @('All')}
    Applications = @{IncludeApplications = @('00000002-0000-0ff1-ce00-000000000000')}
  }
  GrantControls = @{
    Operator = 'OR'
    BuiltInControls = @('mfa')
  }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $Policy

# Issue a Temporary Access Pass for passwordless onboarding
New-MgUserAuthenticationTemporaryAccessPassMethod -UserId 'carol@contoso.com' -StartDateTime (Get-Date) -LifetimeInMinutes 60

# Review high-risk sign-in detections (Entra ID Protection)
Get-MgRiskDetection -Filter "riskLevel eq 'high'" | Select-Object UserDisplayName,RiskEventType,RiskLevel,DetectedDateTime | Format-Table -AutoSize

💡 Best Practices

• Always create a break-glass emergency access account and exclude it from ALL Conditional Access policies — store credentials in a physical safe; this prevents full lockout if CA misconfiguration occurs
• Use Report-only mode when creating new Conditional Access policies — monitor the impact in sign-in logs for 7–14 days before enabling enforcement
• Migrate users from SMS MFA to Microsoft Authenticator or FIDO2 — SMS is vulnerable to SIM swap attacks and is not considered phishing-resistant
• Enable SSPR before enabling Conditional Access MFA — users who cannot complete MFA need SSPR as a recovery path
• Issue Temporary Access Passes (TAPs) to new hires for initial authentication and passwordless method registration — never email temporary passwords
• Configure Entra Password Protection in Audit mode first to see which passwords would be blocked before switching to Enforced mode

🎓 Interview Q&A

Next Module →Module 5: Securing M365 with Defender for Office 365→