🧠 AB-650 Course · Module 9 of 9 · Domain 3 🔥 Final Module
Securing & Monitoring AI Services
AB-650 Exam Alignment
AB-650
Domain 3 — Monitor and secure AI services: monitor agent activity and protect sensitive data accessed by agents; evaluate compliance gaps using Microsoft Purview; manage and monitor AI service costs; monitor Microsoft 365 Copilot usage reports and workload-level adoption in the M365 Admin Center; monitor usage and service health with the Copilot Control System.
- Know the Microsoft 365 Copilot Dashboard location and what metrics it shows (active users, feature adoption, satisfaction scores)
- Understand the Copilot Control System — the unified administrative view for Copilot settings, health, and governance
- Know where AI service costs are monitored — M365 Admin Center → Billing → Your products → AI services
- Understand how Purview DSPM for AI surfaces compliance gaps in AI service usage
Exam Tip: Module 9 ties together all of Domain 3. AB-650 will ask monitoring and cost questions that require knowing WHICH admin center to use. Copilot usage reports → M365 Admin Center → Reports → Microsoft 365 Copilot. Service health for Copilot → M365 Admin Center → Health → Service health (Copilot appears as a separate monitored service). AI cost monitoring → Billing → Your products.
Module 9 is the capstone of the AB-650 course — bringing together security monitoring, compliance evaluation, cost management, and service health for all AI services deployed in the organisation. An AB-650 administrator’s job does not end at deployment — ongoing monitoring of how Copilot and agents are being used, what data they’re accessing, and how much they’re costing is a continuous operational responsibility.
📊 Monitoring Agent Activity
Agent activity monitoring covers two levels: the operational logs of what agents are doing (in Agent 365 and Entra ID) and the compliance-level view of what sensitive data agents are accessing (in Microsoft Purview).
| Monitoring Source | What It Shows | Location |
|---|---|---|
| Entra ID Sign-in logs (agents) | Every authentication event by agent service principals — which M365 resources agents authenticated to, from which IP/location, and whether authentication succeeded or was blocked | Entra Admin Center → Monitoring → Sign-in logs → Filter by service principal type: Agent |
| Agent 365 activity reports | How frequently each agent is used, by which users and departments, and which actions agents performed most frequently | M365 Admin Center → Copilot → Agents → [Select agent] → Usage |
| Purview audit logs | Copilot and agent interactions captured in the unified audit log — includes which documents Copilot accessed, which agents ran actions, and any DLP policy matches | Microsoft Purview compliance portal → Audit → Search (filter by Copilot activities) |
| Purview DSPM for AI | Aggregate view of sensitive data accessed by AI services — which sensitivity label categories, which users, which agents accessed the most sensitive content | Microsoft Purview → Information protection → DSPM for AI |
| Microsoft Defender for Cloud Apps | For organisations with Defender for Cloud Apps — provides shadow AI discovery (unsanctioned AI tool usage), anomaly detection in Copilot usage, and CASB-level governance for AI apps | Microsoft Defender portal → Cloud apps → Cloud app catalogue (filter: AI) |
📋 Evaluating Compliance Gaps with Purview
Microsoft Purview provides the compliance evaluation layer for AI services. The DSPM for AI dashboard identifies compliance gaps — areas where AI services are operating outside the organisation’s data governance policies.
Microsoft Purview › Information protection › DSPM for AI › Compliance gaps
Information Protection
Overview
Sensitivity labels
Label policies
DSPM for AI
Data Loss Prevention
Policies
Alerts
Activity explorer
Audit
Search
DSPM for AI — Compliance gap summary
⚠️ Unlabelled documents accessed by Copilot users (last 30 days)2,847
🔒 Highly Confidential content surfaced in Copilot responses142
🤖 Agent interactions with sensitive data (no DLP policy)38
✅ DLP policies covering Copilot interactions3 active
Click each gap to view affected users, documents, and recommended remediation actions.
💰 AI Service Cost Management
| AI Service | Billing Model | Where to Monitor Costs |
|---|---|---|
| Microsoft 365 Copilot | Per-user per-month subscription add-on. Fixed cost per assigned licence — monitor for unused licences (assigned but low/no usage). | M365 Admin Center → Billing → Your products → Microsoft 365 Copilot. Cross-reference with Copilot usage reports to identify underutilised licences. |
| Microsoft Agent 365 | Per-user per-month or capacity-based billing depending on deployment model | M365 Admin Center → Billing → Your products → Microsoft Agent 365 |
| Microsoft Copilot Studio | Billed per user (for creators) OR per message consumed (for tenant-wide agent usage). Message capacity is monitored and alerts when approaching limits. | M365 Admin Center → Billing → Your products → Copilot Studio. Copilot Studio Admin Center → Billing & capacity for message capacity consumption. |
| Microsoft 365 Backup | Pay-as-you-go: billed per GB of data protected per month | M365 Admin Center → Settings → Microsoft 365 Backup → Storage consumption. Billing → Bills for monthly charges. |
💡 Cost Optimisation — Copilot Unused Licences
Microsoft 365 Copilot licences are a significant cost. Use the Microsoft 365 Copilot Dashboard (M365 Admin Center → Reports → Microsoft 365 Copilot) to identify users who have been assigned a Copilot licence but have zero or very low usage in the past 30 days. Consider reclaiming these licences via group-based licensing adjustments and reassigning them to users who actively want Copilot. This is tested in AB-650 as a cost governance scenario.
🧠 Copilot Usage Reports & Adoption Monitoring
| Report | What It Shows | Location |
|---|---|---|
| Microsoft 365 Copilot Dashboard | Overall Copilot adoption — active users per workload (Word, Excel, Teams, Outlook, etc.), feature-level usage (meetings summarised, emails drafted), and user satisfaction scores (thumbs up/down on Copilot responses) | M365 Admin Center → Reports → Microsoft 365 Copilot → Dashboard |
| Copilot usage by workload | Drill down into which M365 workloads have the highest Copilot adoption — Teams Copilot most used vs Word Copilot least used. Helps prioritise training for underperforming workloads. | M365 Admin Center → Reports → Microsoft 365 Copilot → Usage |
| Copilot user-level report | Per-user Copilot activity — last activity date, which features used. Useful for identifying inactive licensed users. Note: subject to tenant privacy settings — may show obfuscated user names. | M365 Admin Center → Reports → Microsoft 365 Copilot → Users |
| Viva Insights Copilot analytics | Deeper Copilot adoption analytics for organisations with Microsoft Viva Insights — shows time saved, meeting summary usage, email response efficiency | Viva Insights admin portal (requires Viva Insights licence) |
❤ Copilot Control System & AI Service Health
The Copilot Control System is the unified administrative framework in Microsoft 365 that consolidates Copilot settings, governance controls, monitoring, and service health into a coherent view for AB-650 administrators.
🔥 Copilot Control System — What It Unifies
- Copilot settings governance: Web search toggle, Restricted SharePoint Search, agent management, connector configuration — all from M365 Admin Center → Copilot
- AI service health: Microsoft 365 Copilot and Agent 365 now appear as separate services in M365 Admin Center → Health → Service health. Incidents affecting AI services are tracked here.
- Compliance integration: Links directly to Purview DSPM for AI, DLP policy status for Copilot, and audit log search for Copilot interactions
- Usage and adoption visibility: Surface link to the Copilot Dashboard and per-workload adoption reports
- Cost accountability: Summary of AI service subscription costs and capacity consumption
Microsoft Graph PowerShell — AI Usage & Service Health Monitoring
Connect-MgGraph -Scopes 'Reports.Read.All','ServiceHealth.Read.All' # Get Copilot user activity report (last 30 days) — export to CSV Get-MgReportMicrosoft365CopilotUserDetail -Period D30 -OutFile 'CopilotUsage.csv' Import-Csv 'CopilotUsage.csv' | Select-Object UserPrincipalName,LastActivityDate,CopilotChatLastActivityDate | Format-Table -AutoSize # Get service health for Copilot and Agent 365 Get-MgServiceAnnouncementHealthOverview | Where-Object {$_.Service -like '*Copilot*' -or $_.Service -like '*Agent*'} | Select-Object Service,Status | Format-Table -AutoSize # Get active incidents affecting AI services Get-MgServiceAnnouncementIssue -Filter "status ne 'resolved'" | Where-Object {$_.Service -like '*Copilot*'} | Select-Object Id,Title,Service,Status,StartDateTime | Format-Table -AutoSize # Search Purview audit log for Copilot interactions (Security & Compliance PS) Connect-IPPSSession -UserPrincipalName admin@contoso.com Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -RecordType CopilotInteraction -ResultSize 100 | Select-Object CreationDate,UserIds,Operations | Format-Table -AutoSize
💡 Best Practices
- Review the Copilot Dashboard weekly during the first 3 months of deployment — track active user trends and identify departments with low adoption for targeted training intervention
- Set up service health email notifications for Copilot and Agent 365 services — administrators should receive alerts within minutes of an AI service incident affecting users
- Review Purview DSPM for AI compliance gaps monthly — unlabelled documents frequently accessed by Copilot indicate a labelling gap that should be addressed with auto-labeling policies
- Audit Copilot Studio message capacity consumption monthly — organisations pay per message in capacity model; unexpected spikes indicate runaway agents that may need to be blocked
- Reclaim Copilot licences from users with zero activity in the past 30 days — reassign to users on the waiting list and reduce unnecessary subscription costs
- Review agent service principal sign-in logs quarterly — agents that have not authenticated in 90+ days may be unused and should be disabled or removed from the registry
🎓 Interview Q&A
Q: Where do Microsoft 365 Copilot and Agent 365 service incidents appear in the M365 Admin Center?
Both Microsoft 365 Copilot and Microsoft Agent 365 appear as separate monitored services in M365 Admin Center → Health → Service health. When there is an incident (service degradation, partial outage, full outage) affecting Copilot — for example, Copilot responses failing in Teams or SharePoint — it appears in the service health list alongside Exchange Online, SharePoint Online, and other M365 services. Administrators can subscribe to email notifications for Copilot service health incidents so they are alerted proactively rather than discovering issues from user complaints. Historic incidents can be reviewed in the “History” tab of service health.
Q: How should an administrator identify Microsoft 365 Copilot licences that are being wasted (assigned but not used)?
Go to M365 Admin Center → Reports → Microsoft 365 Copilot and open the Users report. This shows per-user activity including the last date they used any Copilot feature. Filter for users with no activity in the past 30 days (LastActivityDate is blank or older than 30 days) — these users have licences assigned but are not using Copilot. Cross-reference with department to understand if it’s a training/awareness gap (these users need enablement) or a genuine non-need (these users’ licences should be reclaimed). Reclaim via the group-based licensing approach — remove inactive users from the Copilot licence group. Note: privacy settings may obfuscate individual usernames in reports — if so, the Global Admin or the tenant privacy setting must be adjusted to see user-level detail.
Q: What is the Copilot Control System and what does it consolidate for AB-650 administrators?
The Copilot Control System is Microsoft’s unified administrative framework for governing Microsoft 365 Copilot and AI services. It consolidates: (1) Copilot settings — web search toggle, Restricted SharePoint Search, agent and connector management; (2) AI service health — Copilot and Agent 365 service status and incident tracking; (3) Compliance controls — links to Purview DSPM for AI, DLP policy status for Copilot, audit log; (4) Usage and adoption — Copilot Dashboard, workload-level adoption reports; (5) Cost visibility — AI service subscription and capacity consumption. Before AB-650, these were scattered across multiple admin centres. The Copilot Control System brings them together in M365 Admin Center → Copilot as the single administrative pane for AI services.
🎯 AB-650 Final Module Test
Module 9 — Securing & Monitoring AI Services
Question 1 of 5
An administrator notices that Microsoft 365 Copilot responses in Teams have been failing for users for the past 30 minutes. Where should they check first to confirm this is a Microsoft service issue rather than a local configuration problem?
✅ Correct: B. Service health in the M365 Admin Center is the first place to check for AI service outages and degradations. Microsoft 365 Copilot appears as a separate monitored service — any active incidents, advisories, or ongoing outages are listed here with status (Investigating, Service degradation, Service interruption) and updates. The Copilot Dashboard (A) shows usage trends, not live service health. Purview (C) monitors compliance, not live service incidents. Entra sign-in logs (D) help diagnose authentication issues but won’t show if Microsoft’s own Copilot infrastructure is down.
Question 2 of 5
A finance director reports that Copilot is costing more than expected. The administrator suspects that Copilot Studio agents are consuming excessive message capacity. Where should they investigate the message capacity consumption?
✅ Correct: D. Copilot Studio message capacity is monitored in two places: the M365 Admin Center → Billing → Your products shows the subscription details and total capacity, while the Copilot Studio Admin Center (admin.powerplatform.microsoft.com → Resources → Copilot Studio) → Billing & capacity shows detailed message consumption per agent and per environment. This helps identify which specific agents are consuming the most messages. Purview (B) and Azure Cost Management (C) don’t track Copilot Studio message-level consumption.
Question 3 of 5
The Purview DSPM for AI dashboard shows 3,000 unlabelled documents were accessed by Copilot users in the past 30 days. What is the most appropriate remediation action to address this compliance gap?
✅ Correct: A. The appropriate response to a large volume of unlabelled documents is to implement service-side auto-labeling policies that scan SharePoint and OneDrive content and automatically apply sensitivity labels based on content patterns (SITs). This addresses the root cause — missing labels — at scale without requiring user action. RSS (B) limits which sites Copilot searches but doesn’t resolve the labelling gap. Blocking licences (C) is disruptive and not proportionate. DLP blocking for all unlabelled content (D) would break most Copilot interactions since most documents may be legitimately “General” or “Public” and simply haven’t been labelled yet.
Question 4 of 5
An administrator wants to monitor how many users are actively using Microsoft Teams Copilot meeting summaries vs how many have the Copilot licence but have never used that feature. Which report provides this workload-level breakdown?
✅ Correct: C. The Microsoft 365 Copilot usage report in M365 Admin Center → Reports → Microsoft 365 Copilot provides workload-level adoption breakdowns — showing active users per M365 workload including Teams meeting summaries, Teams chat Copilot, Outlook Copilot, Word Copilot, Excel Copilot, and PowerPoint Copilot. This is exactly the data needed to see which features are being used vs ignored. Service health (A) shows incidents, not usage. Teams Admin Center analytics (B) show Teams usage but not Copilot feature-level breakdown. Purview audit log (D) records individual interactions but requires manual analysis to build adoption metrics.
Question 5 of 5
A security team discovers that an agent’s service principal has been making authentication requests to SharePoint from an IP address in a country where the organisation has no operations. What should the administrator do immediately?
✅ Correct: D. An agent making authentication requests from unexpected geographic locations is a high-priority security incident that warrants immediate action. Disabling the agent’s service principal in Entra ID immediately stops ALL authentication by that agent — preventing any further potential data access while the incident is investigated. This is faster and more complete than revoking only SharePoint permissions (C, which leaves other access paths open) or waiting to create a CA policy (B). Documentation and CA policy creation follow the immediate containment step. After investigation, the service principal can be re-enabled with appropriate controls (geolocation CA policy, network-restricted access).
🔒
This module is lockedComplete Module 8 and pass its mock test to unlock this final module.
🎉 AB-650 Course Complete!
You have completed all 9 modules of the AB-650: Administering Microsoft 365 and AI Services course. You are now prepared for the Microsoft 365 Certified: AI Services Administrator Associate certification exam. Good luck!