AB-650 Exam Alignment
AB-650

Domain 2 — Manage identities and access in Microsoft Entra: create and manage users and guest users; manage M365 Groups; manage admin roles and role assignments; configure Privileged Identity Management (PIM); manage administrative units; manage contacts and bulk operations using Microsoft Graph PowerShell.

• Know the difference between M365 Groups, Security Groups, Distribution Groups, and Mail-enabled Security Groups
• Understand Privileged Identity Management (PIM) — eligible vs active role assignments and the approval/justification workflow
• Know what Administrative Units are and how they enable scoped delegation without administrative unit-level role limits
• Know that bulk user operations (create, update, delete) can be done via CSV import in the M365 Admin Center or Microsoft Graph PowerShell

Exam Tip: AB-650 Domain 2 tests PIM heavily as a new topic for M365 administrators. Know the difference between an eligible assignment (user must activate the role to use it, with optional MFA/approval) vs an active assignment (role is always active). Eligible assignments are the recommended approach for privileged roles like Global Administrator.

👤 User and Guest Account Management

User accounts in Microsoft 365 are stored in Microsoft Entra ID and accessed through the M365 Admin Center or the Entra Admin Center. AB-650 tests both internal user management and B2B guest user access.

👥 Microsoft 365 Groups & Group Types

🔐 Privileged Identity Management (PIM)

PIM provides just-in-time (JIT) privileged access for Entra ID roles and Azure resource roles. Instead of having permanent Global Admin rights, admins are eligible for the role and must activate it — reducing the attack surface from compromised admin accounts.

📇 Administrative Units

Administrative Units (AUs) enable scoped administration — restricting an admin’s scope to a subset of users, groups, or devices rather than the entire tenant. Essential for large organisations where regional IT teams manage their own users.

Connect-MgGraph -Scopes 'User.ReadWrite.All','Group.ReadWrite.All','RoleManagement.ReadWrite.Directory'

# Create a new internal user
$PasswordProfile = @{Password = 'TempP@ssw0rd!'; ForceChangePasswordNextSignIn = $true}
New-MgUser -DisplayName 'Carol Smith' -UserPrincipalName 'carol@contoso.com' -PasswordProfile $PasswordProfile -AccountEnabled $true

# Invite a B2B guest user
New-MgInvitation -InvitedUserEmailAddress 'bob@partner.com' -InviteRedirectUrl 'https://myapps.microsoft.com' -SendInvitationMessage $true

# Create a dynamic security group (auto-membership by department)
New-MgGroup -DisplayName 'IT-Department' -GroupTypes @('DynamicMembership') -SecurityEnabled $true -MailEnabled $false -MembershipRule "(user.department -eq 'IT')" -MembershipRuleProcessingState 'On'

# View PIM eligible role assignments for the directory
Get-MgRoleManagementDirectoryRoleEligibilitySchedule -All | Select-Object PrincipalId,RoleDefinitionId,Status | Format-Table -AutoSize

# Create an Administrative Unit
$AU = New-MgDirectoryAdministrativeUnit -DisplayName 'UK Staff' -Description 'All UK-based users'

# Bulk create users from CSV
Import-Csv 'C:\users.csv' | ForEach-Object {
    $PP = @{Password = $_.TempPassword; ForceChangePasswordNextSignIn = $true}
    New-MgUser -DisplayName $_.DisplayName -UserPrincipalName $_.UPN -PasswordProfile $PP -AccountEnabled $true -UsageLocation 'GB'
}

💡 Best Practices

• Enable PIM for all Global Administrator assignments immediately — permanently active Global Admin accounts are the highest-value target for attackers
• Use dynamic group membership rules for licence assignment where possible — users automatically receive the correct licences when attributes like department or jobTitle are set
• Require justification AND MFA for all PIM role activations — this provides an audit trail and prevents silent privilege escalation
• Use Administrative Units for multi-region or multi-department organisations to delegate helpdesk teams to manage only their own users without tenant-wide admin rights
• Set guest user access restrictions via Entra External Identities — by default, guests can enumerate all users and groups in the directory, which is a security risk
• Schedule quarterly PIM access reviews for all privileged roles — automated reviews in Entra Identity Governance can email role holders to confirm whether they still need the access

🎓 Interview Q&A

Next Module →Module 4: Authentication & Conditional Access→