Module 2: M365 Workloads & Copilot Integration

← Module 1: Tenant Config

Module 2 of 9

Module 3: Identity →

🧠 AB-650 Course · Module 2 of 9

M365 Workloads & Copilot Integration

📂 Course: AB-650: Administering Microsoft 365 and AI Services
📦 Module: 2 of 9
🎯 Exam: AB-650
📑 Domain: 1 — Configure & Manage M365 Tenants & Workloads (20–25%)
⌛ Read time: ~28 min
AB-650
AB-650 Exam Alignment
AB-650

Domain 1 — Configure and manage Microsoft 365 workloads: manage Exchange Online recipients including shared and resource mailboxes; manage Microsoft Teams including Copilot transcription settings; manage SharePoint Online sites including permissions; configure SharePoint Advanced Management (SAM); manage OneDrive settings for Copilot including site exclusions and restricted SharePoint search.

  • Know the three types of Exchange Online recipients: user mailboxes, shared mailboxes, and resource mailboxes (rooms/equipment)
  • Know that Microsoft Teams Copilot transcription must be enabled at the Teams admin center policy level before users can record Copilot-assisted meetings
  • Understand SharePoint Advanced Management features — especially site access reviews and Restricted Content Discovery for Copilot
  • Know the OneDrive storage quota settings location and Copilot-specific controls (restricted SharePoint search, site exclusions)
Exam Tip: AB-650 tests SharePoint Advanced Management (SAM) as a new topic not in MS-102. Know that SAM requires a Microsoft 365 E5 or Microsoft 365 Copilot licence, and its main function in the Copilot context is controlling which SharePoint sites Copilot can access via Restricted Content Discovery and site access reviews.
Module 2 covers the M365 workload administration tasks that every AB-650 administrator must perform — managing Exchange Online mailboxes, configuring Microsoft Teams with Copilot transcription, administering SharePoint Online sites, and using SharePoint Advanced Management to control what Copilot can access. These workloads form the data foundation on which Copilot and Agent 365 operate, making their correct configuration essential for AI service governance.

💌 Exchange Online — Recipients & Mailboxes

Exchange Online provides cloud email, calendar, and contacts for M365 users. The AB-650 exam tests recipient management — particularly shared and resource mailboxes — as part of Domain 1 workload administration.

Recipient Type Purpose Licence Required Access Method
User Mailbox Personal mailbox for an individual licensed user. Has a unique UPN and password. Exchange Online Plan 1 or 2 (included in M365 E3/E5) User logs in with their own credentials
Shared Mailbox Mailbox accessed by multiple users (e.g. info@, support@). No dedicated user account. No additional licence required (up to 50 GB). Over 50 GB requires Exchange Online Plan 2. Delegated access — users added as Full Access or Send As delegates
Resource Mailbox (Room) Represents a meeting room or conference space. Can auto-accept/decline meeting requests. No additional licence required Meeting requests sent to the resource; auto-accepts based on calendar availability
Resource Mailbox (Equipment) Represents a shared resource (projector, car, camera). Same auto-booking as room mailboxes. No additional licence required Meeting requests sent to the resource email address
Distribution Group Email distribution list — messages sent to the group are delivered to all members. None — recipients need their own mailboxes Managed in Exchange Admin Center or M365 Admin Center
Exchange Admin Center › Recipients › Mailboxes / Shared / Resources
☰
Exchange admin center
|
Recipients › Shared mailboxes
🏠 Home
Recipients
Mailboxes
Shared mailboxes
Resources
Groups
Contacts
🔌 Mail flow
🔒 Protection

Shared mailboxes
Display Name Email Address Members
Support Team support@contoso.com 4 members
Info info@contoso.com 2 members
Finance Requests finance@contoso.com 6 members
ⓘ Members of shared mailboxes need Full Access delegation. Send As permission allows them to reply as the shared mailbox address.

👥 Microsoft Teams & Copilot Transcription

Microsoft Teams is the collaboration hub for AB-650 administrators. The AB-650 exam focuses on Copilot-specific Teams settings — particularly controlling how Copilot uses meeting transcripts and recordings.

Teams Copilot Setting Location Effect
Copilot in Meetings Teams Admin Center → Meetings → Meeting policies → Copilot Controls whether Copilot can be used during meetings. Options: Disabled / Enabled without transcript / Enabled with transcript
Require transcription for Copilot Teams Admin Center → Meetings → Meeting policies When set to “Enabled with transcript”, Copilot only functions when transcription is running — ensures AI interactions are recorded for compliance
Allow transcription Teams Admin Center → Meetings → Meeting policies → Recording & Transcription Must be ON for users to start transcripts. If off, Copilot in meetings requiring transcription will not function.
Copilot in Teams Chat M365 Admin Center → Copilot → Settings Controls Copilot summarisation and assistance in Teams chat threads

🔥 AB-650 New Topic: Teams Copilot Transcription Policy

AB-650 tests the specific Teams meeting policy setting for Copilot. The three values for Copilot in meetings are: (1) Disabled — Copilot cannot be used in meetings; (2) Enabled without transcript — Copilot can assist but without a transcript, its meeting summaries are lost after the meeting; (3) Enabled with transcript (recommended) — transcription runs automatically when Copilot is activated, ensuring meeting summaries and action items are preserved. Policy is assigned per-user or per-group in the Teams Admin Center.

📄 SharePoint Online Site Management

SharePoint Online administration in AB-650 extends beyond MS-102 to include SharePoint Advanced Management (SAM) — a set of governance features critical for controlling Copilot’s access to organisational data.

Feature Admin Center AB-650 Relevance
Site creation SharePoint Admin Center → Sites → Active sites → Create Know site types: Team site (group-connected), Communication site, hub sites
External sharing policy SharePoint Admin Center → Policies → Sharing Tenant-level and site-level controls for sharing with external users (None / New & existing guests / Anyone)
Restricted Content Discovery SharePoint Admin Center → Settings → Restricted Content Discovery (SAM) New in AB-650: Excludes specific SharePoint sites from being surfaced by Copilot and Microsoft Search. Sites with sensitive data can be restricted without changing permissions.
Site Access Reviews SharePoint Admin Center → Settings → Site access reviews (SAM) Trigger site access reviews to identify users with access who no longer need it — reduces data oversharing exposure for Copilot
Data access governance (DAG) SharePoint Admin Center → Reports → Data access governance (SAM) Reports on sharing activity, sensitive data exposure, and sites with broad access — key for Copilot readiness assessment

⚠️ SharePoint Advanced Management (SAM) — Licence Requirement

SharePoint Advanced Management features (Restricted Content Discovery, Site Access Reviews, Data Access Governance) require either Microsoft 365 E5 or a Microsoft 365 Copilot add-on licence assigned to the tenant. SAM is not available in M365 E3 without these add-ons. AB-650 tests SAM heavily in the context of Copilot data governance — this is one of the most significant new topic areas vs MS-102.

PowerShell — Exchange Online, Teams & SharePoint Administration

# --- EXCHANGE ONLINE ---
Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Create a shared mailbox
New-Mailbox -Shared -Name 'Support Team' -Alias support -PrimarySmtpAddress support@contoso.com

# Add Full Access and Send As permissions
Add-MailboxPermission -Identity support@contoso.com -User alice@contoso.com -AccessRights FullAccess -AutoMapping $true
Add-RecipientPermission -Identity support@contoso.com -Trustee alice@contoso.com -AccessRights SendAs

# Create a room resource mailbox with auto-accept
New-Mailbox -Room -Name 'Conference Room A' -PrimarySmtpAddress roomA@contoso.com
Set-CalendarProcessing -Identity roomA@contoso.com -AutomateProcessing AutoAccept -AllowRecurringMeetings $true

# --- TEAMS COPILOT MEETING POLICY ---
Connect-MicrosoftTeams

# Create policy requiring transcription for Copilot (compliance best practice)
New-CsTeamsMeetingPolicy -Identity 'CopilotWithTranscript' -AllowTranscription $true -Copilot 'EnabledWithTranscript'
Grant-CsTeamsMeetingPolicy -Identity alice@contoso.com -PolicyName 'CopilotWithTranscript'

# --- SHAREPOINT ADVANCED MANAGEMENT ---
# Exclude a sensitive site from Copilot search (Restricted Content Discovery)
Set-PnPTenantSite -Url https://contoso.sharepoint.com/sites/HR-Sensitive -RestrictedContentDiscovery $true

# List all sites excluded from Copilot search
Get-PnPTenantSite -Filter "RestrictedContentDiscovery -eq 'True'" | Select-Object Url,Title

💡 Best Practices

  • Always configure shared mailboxes with the minimum required permissions — avoid granting Full Access to users who only need Send As for compliance reasons
  • Enable Copilot in Teams meetings with the EnabledWithTranscript setting for compliance-conscious organisations — this ensures AI-generated summaries are backed by a verifiable transcript
  • Review all SharePoint sites for broad sharing before enabling Copilot — Copilot can surface content from any site a user has access to, including widely shared ones
  • Use Restricted Content Discovery (SAM) for sensitive SharePoint sites rather than removing permissions — this excludes sites from Copilot without disrupting existing access workflows
  • Run the SharePoint Data Access Governance (DAG) report monthly to identify sites with overly broad sharing — this is a key part of the Copilot readiness assessment
  • Set site-level external sharing to the most restrictive setting that meets business needs — “New and existing guests” rather than “Anyone” for sites containing data accessible to Copilot

🎓 Interview Q&A

Q: What is SharePoint Advanced Management and which AB-650 scenarios require it?
SharePoint Advanced Management (SAM) is a set of governance features for SharePoint Online and OneDrive that is available with Microsoft 365 E5 or a Microsoft 365 Copilot add-on licence. It includes: Restricted Content Discovery (exclude sites from Copilot and Microsoft Search without changing permissions), Site Access Reviews (trigger periodic reviews of who has access to a site), Data Access Governance reports (identify sites with sensitive content and broad sharing), and Data security and compliance policies. For AB-650 administrators deploying Copilot, SAM is the primary tool for ensuring users cannot accidentally surface sensitive data they have access to through Copilot queries.

Q: What is the difference between Copilot in Teams set to “Enabled without transcript” vs “Enabled with transcript”?
Both settings allow users to use Copilot during a Teams meeting, but with a key difference. Enabled without transcript: Copilot can answer questions and assist during the meeting, but because no transcript is captured, Copilot’s meeting summary is lost when the meeting ends. Post-meeting Copilot features (recap, action items) are unavailable. Enabled with transcript (recommended): Transcription is automatically started when Copilot is activated, preserving all Copilot-generated content post-meeting. This setting is better for compliance because it creates an auditable record. Microsoft recommends “Enabled with transcript” for organisations that want full Copilot meeting functionality.

Q: An organisation wants to prevent Copilot from surfacing content from a sensitive HR SharePoint site, but they don’t want to change who has access to the site. What should they configure?
They should enable Restricted Content Discovery on the HR SharePoint site via SharePoint Advanced Management. This setting excludes the site from Microsoft 365 Copilot responses and Microsoft Search index, meaning Copilot will not surface documents or content from that site in its answers — even for users who have direct access. This is different from removing permissions: users can still navigate directly to the site and work with its content normally. Restricted Content Discovery requires the Microsoft 365 E5 or Copilot licence. Set via SharePoint Admin Center → Active sites → [Select site] → Settings → Restrict content discovery, or via PnP PowerShell with Set-PnPTenantSite -RestrictedContentDiscovery $true.

🎯 AB-650 Mock Test
Module 2 — M365 Workloads & Copilot Integration
5 questions · Scenario-based · AB-650 exam style · Pass mark: 70%

Question 1 of 5

A shared mailbox at support@contoso.com has grown beyond 50 GB due to large email attachments from customers. Users report they cannot send or receive new emails from the mailbox. What is the most likely cause and resolution?

ADelete old emails from the mailbox to bring it below 50 GB — no licence change needed
BAssign a Microsoft 365 E3 licence to the shared mailbox account to expand storage
CAssign an Exchange Online Plan 2 licence to the shared mailbox to get 100 GB storage and auto-expanding archive
DConvert the shared mailbox to a user mailbox to get larger storage

✅ Correct: C. Shared mailboxes have a default quota of 50 GB without a licence. Once the mailbox exceeds 50 GB, mail flow is blocked. Assigning an Exchange Online Plan 2 licence increases the quota to 100 GB and enables auto-expanding archiving for unlimited storage. Option A is a temporary fix that does not address the root cause. Option B (E3) includes Exchange Plan 1 (50 GB), not Plan 2. Converting to a user mailbox (D) would require a dedicated UPN and user account.

Question 2 of 5

A Teams administrator configures the global meeting policy to set “Copilot” to “Enabled with transcript.” A user with this policy starts a Teams meeting and activates Copilot, but transcription never starts automatically. What is the most likely cause?

AThe “Allow transcription” setting is disabled in the meeting policy, preventing transcription from starting
BThe user does not have a Microsoft 365 Copilot licence assigned
CThe Teams tenant is not in a supported region for Copilot transcription
DTeams requires a manual restart after policy changes before they take effect

✅ Correct: A. The Allow transcription setting in the Teams meeting policy must be enabled independently of the Copilot setting. Even if Copilot is set to “Enabled with transcript”, if “Allow transcription” is OFF, transcription cannot start and Copilot in meetings will not function as expected. Both settings must be configured: Copilot set to EnabledWithTranscript AND AllowTranscription set to True in the Teams meeting policy.

Question 3 of 5

Which SharePoint Advanced Management feature should an AB-650 administrator use to prevent Copilot from surfacing documents from a sensitive legal site, while ensuring lawyers can still access and work with those documents directly?

ASet the site’s external sharing to “Only people in your organisation”
BApply a sensitivity label with encryption to all documents in the site
CRemove the site from the SharePoint admin active sites list
DEnable Restricted Content Discovery on the site to exclude it from Copilot and Microsoft Search

✅ Correct: D. Restricted Content Discovery (SAM feature) is specifically designed for this scenario. It excludes the site from Copilot responses and Microsoft Search without changing site permissions — users with direct access can still navigate to and work with content normally. Options A and B affect sharing and content protection but don’t specifically control Copilot access. Option C would break the site for everyone.

Question 4 of 5

An organisation wants users to be able to send email from a shared mailbox (support@contoso.com) so that recipients see “Support Team” as the sender — not the individual user’s name. Which permission must be granted?

AFull Access — this allows reading and sending from the mailbox as oneself
BSend As — this allows sending email that appears to come from the shared mailbox address
CSend on Behalf — this allows sending from the shared mailbox showing both the sender and the mailbox
DEditor — this grants calendar editing rights on the shared mailbox

✅ Correct: B. Send As permission allows a delegate to send email that appears to come entirely from the shared mailbox (support@contoso.com) — recipients see only “Support Team” as the sender. Send on Behalf (C) shows “[User] on behalf of Support Team” — both names are visible. Full Access (A) allows opening and reading the mailbox but does not grant send permissions. Full Access is typically granted together with Send As for complete shared mailbox access.

Question 5 of 5

An administrator needs to review which SharePoint sites in the organisation have overly broad sharing that could expose sensitive data via Microsoft 365 Copilot. Which SharePoint Advanced Management feature provides this visibility?

ASharePoint Admin Center → Policies → Sharing → External sharing report
BMicrosoft Purview → Data Loss Prevention → Reports
CSharePoint Admin Center → Reports → Data access governance (DAG)
DMicrosoft 365 Admin Center → Reports → Usage → SharePoint activity

✅ Correct: C. The Data Access Governance (DAG) reports in the SharePoint Admin Center (a SAM feature) show sites with sensitive data exposure, broad sharing (anyone links, external sharing), and sites most likely to cause data oversharing issues for Copilot. This report is the starting point for the Copilot data readiness assessment. DLP reports (B) show policy matches but not sharing breadth. Option D shows usage activity, not sharing governance. Option A shows external sharing settings, not a comprehensive governance report.



🔒

This module is lockedComplete Module 1 and pass its mock test to unlock this module.