AB-650 Exam Alignment
AB-650

Domain 3 — Administer Microsoft 365 Copilot: assess tenant readiness for Copilot including in-app experiences; identify and resolve data readiness issues (leaks, oversharing, compliance gaps); manage Copilot web search and Copilot Chat settings; configure Microsoft 365 Copilot Search; configure tenant settings for AI (self-service purchases, release preferences, AI disclaimer, video and image generation); manage Copilot user experiences — Cowork, third-party AI providers, and connectors.

• Know the Copilot tenant readiness assessment — available in M365 Admin Center → Copilot → Readiness
• Understand Restricted SharePoint Search — a Copilot-specific setting that limits which SharePoint sites Copilot can search to an approved allow-list
• Know the difference between Copilot Chat (web grounding) and M365 Copilot Chat (work grounding via Microsoft Graph)
• Understand Microsoft 365 Copilot Search — a Copilot-powered search experience that replaces classic SharePoint and M365 search for licensed users

Exam Tip: AB-650 Domain 3 is the most heavily weighted and the most unique content vs MS-102. Know the Copilot readiness assessment steps in order: (1) licence check, (2) data readiness (oversharing), (3) network readiness, (4) device/app readiness (M365 Apps on Current Channel). These four areas are tested as a complete workflow.

🎬 Copilot Tenant Readiness Assessment

Before enabling Copilot for users, administrators should verify the tenant meets the readiness criteria. The Copilot readiness report in the M365 Admin Center provides a structured assessment across four dimensions.

📑 Restricted SharePoint Search

Restricted SharePoint Search (RSS) is a Copilot-specific configuration that limits which SharePoint sites appear in Copilot responses and Microsoft 365 Copilot Search. Instead of searching all SharePoint content the user has access to, Copilot only searches an administrator-approved set of sites.

🌐 Copilot Chat & Web Search Settings

🔗 Connectors & Copilot Experiences

Connect-MgGraph -Scopes 'User.Read.All'

# Check which users have Copilot licence assigned
$CopilotSku = Get-MgSubscribedSku | Where-Object {$_.SkuPartNumber -eq 'Microsoft_365_Copilot'}
Get-MgUser -All -Property DisplayName,UserPrincipalName,AssignedLicenses |
  Where-Object {$_.AssignedLicenses.SkuId -contains $CopilotSku.SkuId} |
  Select-Object DisplayName,UserPrincipalName | Sort-Object DisplayName | Format-Table -AutoSize

# Configure Restricted SharePoint Search (SPO PowerShell)
Connect-SPOService -Url https://contoso-admin.sharepoint.com

# Enable Restricted SharePoint Search and add allowed sites
Set-SPOTenantCopilotSetting -RestrictedSharePointSearch $true
Add-SPOTenantCopilotAllowedSite -SiteUrl 'https://contoso.sharepoint.com/sites/Marketing'
Add-SPOTenantCopilotAllowedSite -SiteUrl 'https://contoso.sharepoint.com/sites/IT-Policies'

# Review current RSS status and allowed sites
Get-SPOTenantCopilotSetting | Select-Object RestrictedSharePointSearch,AllowedSites

💡 Best Practices

• Complete all four readiness checks (licence, data, network, app channel) before enabling Copilot for users — deploying Copilot to users with M365 Apps on Semi-Annual Channel results in Copilot features not appearing in Office apps
• Enable Restricted SharePoint Search for the first 3–6 months of Copilot deployment — start with 10–20 well-governed sites and expand as confidence in data governance grows
• Disable self-service purchases for AI add-ons — without this, users can purchase Copilot, Agent 365, and Copilot Studio directly with a credit card and bypass procurement processes
• Use Targeted Release for a pilot group before enabling new Copilot features for all users — this gives the IT team time to test and document new features before widespread deployment
• Configure the AI disclaimer to remind users that Copilot-generated content should be reviewed before use — important for regulated industries and any external communications
• Review Copilot connector permissions carefully before enabling — connectors bring external system data into Copilot’s knowledge base, and misconfigured connectors can expose sensitive external system data to all Copilot users

🎓 Interview Q&A

Next Module →Module 8: Agent 365 & Agents Administration→