--- title: "AB-650 Study Guide — AI Services Administrator Associate (beta)" description: "An interactive study guide built on 7 memory techniques to help you pass AB-650 — Microsoft’s newest beta certification for governing Microsoft 365, Microsoft Entra, and AI services at enterprise scale." url: "https://lucidlabs.com.au/insights/ab-650" --- # Master the AB-650 An interactive study guide built on 7 memory techniques to help you pass AB-650 — Microsoft’s newest beta certification for governing Microsoft 365, Microsoft Entra, and AI services at enterprise scale. Configure & Manage Tenants and Workloads ~33%Govern & Secure Tenants and Workloads ~33%Manage & Secure AI Services ~33% What it covers Configuring and managing Microsoft 365 tenants and workloads (org profile, licensing, admin roles, Graph PowerShell automation); governing and securing those tenants through Microsoft Entra ID, Conditional Access, identity governance, and Microsoft Purview; and managing and securing AI services — Microsoft Agent 365, agent identities, Microsoft 365 Copilot governance, and Defender XDR extended to the AI surface. AB-650 is a beta exam — Microsoft has not published domain weightings, so treat all three domains as roughly even at ~33% each. Ideal for Microsoft 365 administrators, security and compliance professionals, and IT managers who need to configure, govern, and secure Copilot, AI agents, and connected AI capabilities across a tenant. Aspire to this if You’re the person your organisation turns to when someone asks “who’s actually watching what our AI agents can access?” — this beta certification is Microsoft’s first credential built to answer that question with a governed, auditable answer instead of a shrug. Section 1 / Spatial Memory ## The Map Tap any component to see what you need to know for the exam. **🏢 Tenant & Org Profile** Domains · Org Profile · Settings **📇 Licensing & Subscriptions** SKUs · Group-Based · Agent 365 **🛠️ Admin Roles & Delegation** RBAC · Admin Units · PIM **⚙️ Workload Configuration** Exchange · SharePoint · Teams · Graph PS **🔑 Entra ID Governance** Identity Governance · Access Reviews **🚧 Conditional Access** Signals · Controls · Zero Trust **🤖 Agent Identities** Entra Agent ID · Lifecycle **🛡️ Purview Data Protection** Sensitivity Labels · DLP · Insider Risk **🧑‍💼 Microsoft Agent 365** Registry · Access · Oversight **✨ Copilot & Semantic Index Governance** Usage Reporting · Data Access · Permissions **🦺 Defender XDR for AI** Agent Threats · Prompt Injection · Response **🔐 AI Data Protection** Prompt DLP · Output Labelling · Audit Section 2 / Narrative Memory ## The Story Follow the narrative to build a mental model of how everything connects. 🏢 ### The Tenant Foundation An AI Services Administrator’s day starts at the tenant level — organisation profile, custom domains, and licensing. Before any AI capability is switched on, the fundamentals of Microsoft 365 configuration have to be solid: verified domains, correct release settings, and licences mapped to the right people (and now, the right agents). **Exam Intel**Org profile = name/domains/contacts/release preference. Custom domains verified via DNS. Multi-geo for data residency. Licensing now includes Agent 365 SKUs alongside Copilot and core M365 plans. 🛠️ ### Delegating Without Over-Granting No single admin should hold the keys to everything. Administrative units let you scope a regional admin’s reach to just their business unit. PIM turns standing Global Administrator rights into a time-bound, justified elevation. Custom roles fill the gaps when built-in roles are too coarse. **Exam Intel**Admin units = scoped delegation. PIM = just-in-time elevation, not standing access. Custom roles for precise permission sets. Least privilege is the default answer whenever a scenario asks which role someone should hold. ⚙️ ### Automating at Scale Manually clicking through three separate admin centres doesn’t scale past a handful of tenants. The Microsoft Graph PowerShell SDK becomes the administrator’s real interface — scripting configuration, auditing settings, and catching drift before it becomes an incident. **Exam Intel**Graph PowerShell SDK (Connect-MgGraph, Get-Mg\*, Update-Mg\*) is the modern scripting surface — expect it named as the automation tool of choice. Application (app-only) permissions power unattended scripts. 🔑 ### Governing Every Identity Microsoft Entra ID Governance treats access as something to be granted, reviewed, and revoked — not granted once and forgotten. Access reviews force recertification. Entitlement management packages bundle resources behind an approval flow with an expiry date. Lifecycle workflows tie access changes to HR events. **Exam Intel**Identity Governance = entitlement management + access reviews + PIM + lifecycle workflows. Access reviews reduce access sprawl. The same governance model now extends to agent identities, not just people. 🚧 ### Zero Trust, Every Sign-In Conditional Access is where Zero Trust becomes enforceable policy — evaluating user, device, location, and risk signals before granting access. Report-only mode lets admins test a policy’s blast radius before it goes live. Critically for this exam, CA policies now apply to agent sign-ins too. **Exam Intel**CA = signals + controls. Zero Trust = verify explicitly, least privilege, assume breach. CA now covers agent identities as first-class principals alongside users and devices. 🤖 ### A New Class of Worker Agent identities sit at the conceptual centre of this exam. An AI agent isn’t a service principal buried in app registrations — it’s provisioned in Microsoft Entra with its own identity, lifecycle, and access footprint, tracked and governed the way a human employee would be, from onboarding to offboarding. **Exam Intel**Agent identities = first-class Entra identities, distinct from users and classic service principals. Full lifecycle: provision, assign access, monitor, deprovision. Registered and tracked through Microsoft Agent 365. Over-permissioned agents are a bigger blast radius than over-permissioned users. 🛡️ ### Labels and Leakage Don’t Care Who’s Typing Sensitivity labels and DLP don’t distinguish between a human typing in Word and an agent generating a report — both are subject to the same classification and leakage-prevention rules. Insider Risk Management now also watches for AI-mediated risk, like an agent used to exfiltrate data in bulk. **Exam Intel**Sensitivity labels are inherited by AI-generated content. DLP inspects Copilot/agent prompts and responses. Insider Risk Management includes AI usage signals. Communication compliance monitors AI-generated content too. 🧑‍💼 ### Meet Microsoft Agent 365 Microsoft Agent 365 is the newest control plane in the M365 governance story — a registry and management layer purpose-built for AI agents. Where Intune manages devices and Entra manages identities, Agent 365 manages agents: registering them, scoping their access, and overseeing their entire lifecycle across whichever platform built them. **Exam Intel**Agent 365 = registry + access governance + lifecycle oversight for agents. Works across Copilot, Copilot Studio, and third-party agent platforms — interoperability, not lock-in. Expect this to anchor scenario questions in the beta exam. ✨ ### Copilot Doesn’t Get a Free Pass Rolling out Copilot broadly without reviewing SharePoint permissions is still the number-one governance mistake — the Semantic Index only ever surfaces what a user could already see, but “already see” can be far more than intended if permissions were never cleaned up. Usage reporting then tells you whether the rollout is actually landing. **Exam Intel**Oversharing review before enabling Copilot broadly. Semantic Index respects existing permissions — no privilege elevation. Usage reporting = adoption + feature engagement. Admins can exclude sites from Copilot’s grounding scope. 🦺 ### Defending the Agent Surface Defender XDR’s job doesn’t stop at endpoints and inboxes anymore. Agent identities can be compromised, prompt-injected, or manipulated into taking actions outside their intended scope — and Defender now correlates that activity across identity, endpoint, email, and cloud app signals just like it does for a compromised user account. **Exam Intel**Defender XDR extended to agent activity. Prompt injection and agent hijacking are named threat classes to know. AIR playbooks can contain a compromised agent. Cross-reference Defender alerts against Agent 365’s registry to identify the responsible agent and owner. 🔐 ### Data Protection Follows the Agent Every guarantee that applied to Copilot now extends to agents: prompts and responses aren’t used to train foundation models, processing stays within the tenant’s data residency boundary, and Purview audit logs capture agent interactions for eDiscovery and compliance review just as thoroughly as human ones. **Exam Intel**DLP for AI inspects prompts/responses. Output labelling inherits from the grounding source. Purview audit logs + eDiscovery cover agent interactions. Data residency (EU Data Boundary, tenant geo) applies to AI services. Prompts/responses are never used for model training. Section 3 / Acronym Memory ## Mnemonic Wall Memorable acronyms and phrases to anchor key exam concepts in your memory. 🏢 TLAG **T**enant profile, **L**icensing, **A**dmin roles, **G**raph PowerShell The four configuration fundamentals of Domain 1 — tenant setup, licence assignment (including Agent 365), delegated admin roles, and Graph PowerShell automation. 🔑 PIAL **P**IM, **I**dentity governance, **A**ccess reviews, **L**ifecycle workflows The governance toolkit in Microsoft Entra ID — just-in-time elevation, entitlement packages, periodic recertification, and HR-driven lifecycle automation. 🤖 PAMD **P**rovision, **A**ssign access, **M**onitor, **D**eprovision The agent identity lifecycle in Microsoft Entra — treat an AI agent like a new hire: provision its identity, assign least-privilege access, monitor its behaviour, and deprovision it when retired. 🧑‍💼 RAIL **R**egistry, **A**ccess governance, **I**nteroperability, **L**ifecycle oversight The four pillars of Microsoft Agent 365 — inventory every agent, scope its access to least privilege, work across agent-building platforms, and oversee it end to end. 🛡️ SDIC **S**ensitivity labels, **D**LP, **I**nsider risk, **C**ommunication compliance Purview’s four data-protection controls, all of which now extend to Copilot and agent interactions — not just human-authored content. 🦺 IEEA **I**dentity, **E**ndpoint, **E**mail, **A**pps The four signal domains Defender XDR correlates — now including agent identity activity — to detect threats like prompt injection and agent hijacking across the whole estate. Section 4 / Contrast Memory ## Versus Arena Side-by-side comparisons to sharpen your understanding of similar concepts. vs Agent 365vsCopilot Studio Click to compare #### Microsoft Agent 365 vs Copilot Studio | Aspect | Agent 365 | Copilot Studio | | --- | --- | --- | | Purpose | Govern and secure agents across the tenant | Build and publish agents | | Scope | All agents, any building platform | Agents you create in Studio | | Audience | IT and security administrators | Makers and developers | | Core function | Registry, access, lifecycle oversight | Topics, triggers, knowledge, actions | | Analogy | Like Intune, but for agents | Like a low-code app builder | | Output | A governed, monitored agent fleet | A working custom agent | Click to flip back vs Purview DLPvsDefender for Cloud Apps Click to compare #### Purview DLP vs Defender for Cloud Apps | Aspect | Purview DLP | Defender for Cloud Apps | | --- | --- | --- | | Purpose | Prevent sensitive data leaving via content/actions | Discover and control SaaS app risk | | Focus | Content classification and leakage | App usage, shadow IT, session control | | With AI | Inspects Copilot/agent prompts and responses | Monitors agent-to-SaaS-app connections | | Enforcement | Block or warn on policy match | Conditional access app control, block app | | Managed in | Microsoft Purview | Microsoft Defender XDR | | Best for | Stopping data leaving inside content | Controlling which apps agents/users can reach | Click to flip back vs Agent IdentityvsUser Identity Click to compare #### Agent Identity vs User Identity (in Microsoft Entra) | Aspect | Agent Identity | User Identity | | --- | --- | --- | | Owner | An AI agent (autonomous or semi-autonomous) | A human employee or guest | | Provisioning | Registered via Agent 365 / Entra Agent ID | HR-driven joiner workflow or manual creation | | Governance | Access reviews, CA, and PIM now extend to agents | Same tools, built for people first | | Risk profile | Can act at machine speed and scale | Bounded by human working patterns | | Lifecycle trigger | Task or workload assigned or retired | Hire, role change, termination | | Oversight owner | Agent owner plus security team | Manager plus IT admin | Click to flip back vs Sensitivity LabelsvsAccess Policies Click to compare #### Sensitivity Labels vs Access Policies | Aspect | Sensitivity Labels | Access Policies | | --- | --- | --- | | What it controls | Classification and protection of content itself | Who or what can reach a resource | | Travels with | The document or content, wherever it goes | Nothing — enforced only at the access point | | With AI | Inherited by Copilot/agent-generated output | Governs whether an agent can query a resource at all | | Enforcement point | Content-level (encryption, watermark, restrict) | Sign-in/request-level (Conditional Access, RBAC) | | Managed in | Microsoft Purview | Microsoft Entra ID | | Best for | Protecting content wherever it travels | Gatekeeping access before content is ever touched | Click to flip back vs Conditional AccessvsIdentity Governance Click to compare #### Conditional Access vs Identity Governance | Aspect | Conditional Access | Identity Governance | | --- | --- | --- | | Timing | Evaluated at every sign-in or request | Evaluated periodically (reviews) or on demand (PIM) | | Question answered | “Can this sign-in happen right now?” | “Should this access still exist?” | | Applies to | Users, devices, and now agent identities | Users, roles, groups, and agent identities | | Mechanism | Signals + controls (MFA, block, compliant device) | Approval workflows, expiry, recertification | | Failure mode without it | Unrestricted sign-in from any context | Access sprawl that never gets revoked | | Managed in | Microsoft Entra Conditional Access | Microsoft Entra ID Governance | Click to flip back Section 5 / Grouping Memory ## Cheat Sheet Organised reference grouped by exam domain — everything you need on one page. ### Configure & Manage Tenants and Workloads ~33% #### Tenant Fundamentals - Org profile: name, domains, contacts, release preference - Custom domains verified via DNS (TXT/MX records) - Multi-geo for tenants with data residency requirements - Service health + message centre for incidents and change tracking #### Licensing - Assign licences via admin centre, PowerShell, or group-based licensing - Copilot licence is an add-on to a qualifying base M365 plan - Microsoft Agent 365 has its own licensing model for agent governance - Usage reports track consumption against purchased seats #### Admin Roles & Delegation - Built-in Entra roles scope what an admin can configure - Administrative units delegate roles to a subset of users/groups/devices - PIM = just-in-time, time-bound role elevation - Custom roles fill gaps between built-in role scopes - Always choose the least-privilege role for the scenario #### Automation with Graph PowerShell - Microsoft Graph PowerShell SDK: Connect-MgGraph, Get-Mg\*, Update-Mg\* - Application (app-only) permissions for unattended scripts - Scriptable configuration + audit at scale beats manual admin-centre clicks - Scheduled scripts catch configuration drift before it becomes an incident ### Govern & Secure Tenants and Workloads ~33% #### Identity Governance - Entitlement management: bundled resources, request/approve, expiry - Access reviews: periodic recertification of group/app/role access - Lifecycle workflows: automate joiner/mover/leaver access changes - Reduces access sprawl for both human and agent identities #### Conditional Access & Zero Trust - Signals (user, device, location, risk, app) drive controls (block, MFA, compliant device) - Zero Trust: verify explicitly, least privilege, assume breach - Named locations + sign-in/user risk from Entra ID Protection - Report-only mode validates policy impact before enforcement - CA policies now target agent identities and agent sign-ins #### Agent Identities - AI agents provisioned as first-class Entra identities (Entra Agent ID) - Full lifecycle: provision, assign access, monitor, deprovision - Distinct from users and classic service principals - Registered and tracked centrally through Microsoft Agent 365 - Over-permissioned agents = larger blast radius than over-permissioned users #### Data Protection (Purview) - Sensitivity labels inherited by Copilot/agent-generated content - DLP policies extend to Copilot and agent interactions - Insider Risk Management includes AI usage signals - Communication compliance monitors AI-generated content - Retention and records management apply to AI-touched content ### Manage & Secure AI Services ~33% #### Microsoft Agent 365 - Control plane that registers, secures, and governs agents tenant-wide - Agent registry = single inventory of every deployed agent - Access governance applies least-privilege scoping per agent - Lifecycle oversight: onboarding, monitoring, retirement/decommission - Interoperates across Copilot, Copilot Studio, and third-party platforms #### Copilot & Semantic Index Governance - Usage reporting shows adoption, active users, feature engagement - Semantic Index respects existing permissions — no privilege elevation - Oversharing review (SharePoint/OneDrive) is the top pre-deployment task - Admins control data sources, connectors, and plugins available to Copilot - Restricted SharePoint Search excludes specific sites from grounding #### Defender XDR for AI - Extends detection/response to agent identity activity - Correlates identity, endpoint, email, and cloud app signals for agents - Prompt injection and agent hijacking are named threat classes - AIR playbooks can contain a compromised agent identity - Cross-reference alerts against Agent 365’s registry to find the responsible agent #### AI Data Protection & Compliance - DLP for AI inspects prompts and responses for sensitive data - Agent outputs inherit sensitivity labels from grounding sources - Purview audit logs + eDiscovery cover Copilot and agent interactions - Data residency (EU Data Boundary, tenant geo-boundary) applies to AI - Prompts and responses are never used to train foundation models Section 6 / Method of Loci ## The Memory Palace Walk through themed rooms — each object anchors a concept in spatial memory. ### The Tenant Control Room Configuration — Where the foundation is set 🏢 Org Profile Name, domains, technical contacts, release preference (Standard/Targeted) 📇 Licensing Per-user, group-based, or scripted assignment. Agent 365 has its own SKU 🛠️ Admin Roles Built-in roles + administrative units for scoped delegation ⏱️ PIM Just-in-time, time-bound elevation instead of standing admin access ⚙️ Graph PowerShell Connect-MgGraph / Get-Mg\* / Update-Mg\* for scripted config at scale ### The Governance Vault Identity & data governance — where access is proven, not assumed 🔑 Identity Governance Entitlement management, access reviews, lifecycle workflows 🚧 Conditional Access Signals + controls enforcing Zero Trust at every sign-in 🤖 Agent Identities First-class Entra identities for agents with their own lifecycle 🔒 Sensitivity Labels Classification that travels with content — inherited by AI output 👁️ Insider Risk Management Flags risky behaviour, including AI-mediated data exfiltration ### The Agent Command Centre Microsoft Agent 365 — Where every agent is registered and watched 📑 Agent Registry Single inventory of every agent deployed across the tenant 🎯 Access Scoping Least-privilege access per agent — only what the task requires 🔄 Lifecycle Oversight Onboarding, monitoring, and retirement/decommissioning of agents 🔗 Interoperability Governs agents from Copilot Studio and third-party platforms alike ### The AI Trust Boundary Security & compliance for AI — where the guarantees are enforced 📊 Copilot Usage Reporting Adoption, active users, feature engagement in the admin centre 🦺 Defender for AI Detects prompt injection, agent hijacking, compromised agent identities 🚫 Prompt DLP Inspects and blocks sensitive data leaking via prompts or responses 🧬 Output Label Inheritance AI-generated content inherits classification from its grounding source 🌍 Data Residency EU Data Boundary and tenant geo-boundary apply to AI processing too Section 7 / Pattern Recognition ## Pattern Spotter Decision trees and trigger-answer pairs — see the pattern, know the answer. Which Admin Tool for This Task? Which Admin Tool for This Task?   ├── Scope a regional admin’s permissions → Administrative units (Entra ID)  ├── Need just-in-time Global Admin access → Privileged Identity Management (PIM)  ├── Script tenant configuration at scale → Microsoft Graph PowerShell SDK  ├── Assign Copilot/Agent 365 licences to a department → Group-based licensing  └── See what changed in a specific setting → Message centre / audit log Which Governance Control? Which Governance Control?   ├── Sign-in should be blocked from a risky location → Conditional Access policy  ├── Group membership needs periodic recertification → Access reviews  ├── Standing admin access is too risky → PIM just-in-time elevation  ├── An agent needs scoped, least-privilege access → Entra agent identity + access policy  ├── Content must stay protected wherever it travels → Sensitivity labels (Purview)  └── Sensitive data must not leave via chat/agent output → DLP policy (Purview) Which AI Governance Tool? Which AI Governance Tool?   ├── Need an inventory of every agent in the tenant → Microsoft Agent 365 registry  ├── Check whether Copilot rollout is oversharing data → SharePoint/OneDrive permissions review  ├── Detect a compromised or hijacked agent → Defender XDR  ├── Stop a prompt from leaking confidential data → DLP for AI interactions (Purview)  └── Hold agent conversations for legal review → eDiscovery (Purview) ## Decision Cards “agent identity” or “Entra Agent ID”→AI agents provisioned as first-class Entra identities with their own lifecycle “Microsoft Agent 365”→Control plane that registers, scopes access for, and oversees every AI agent in the tenant “oversharing” before a Copilot rollout→Review SharePoint/OneDrive permissions — Semantic Index only shows what users can already access “prompt injection” or “agent hijacking”→Defender XDR threat classes extended to the AI/agent surface “sensitivity label inheritance” for AI output→Agent/Copilot-generated content inherits labels from the source it was grounded in “PIM” or “just-in-time elevation”→Time-bound, justified admin role activation instead of standing access “access reviews”→Periodic recertification of group, app, or role access to prevent sprawl “prompts not used for training”→AI data-privacy guarantee — prompts and responses never train the foundation model “Graph PowerShell SDK”→Connect-MgGraph / Get-Mg\* / Update-Mg\* — the scriptable interface for tenant automation Ready to certify? ## Train with practitioners, not presenters Lucid Labs delivers Microsoft certification training led by Microsoft Certified Trainers (MCTs) and grounded in real-world project experience. We adapt every session to your team's environment, data stack, and business objectives — because the best exam prep comes from engineers who build these solutions every day. 🎯 Tailored Content Training built around your organisation’s M365 tenant, Copilot rollout, and emerging agent estate — not generic slides for an exam that barely exists yet. 🛠️ Hands-On Labs Configure Conditional Access for agent identities, register agents in Microsoft Agent 365, and set up Purview data protection for AI in your own tenant with expert guidance. 📈 Exam + Capability Pass AB-650 while your organisation actually gets ahead — you’ll be one of the first administrators anywhere governing AI services with a certified, auditable approach. [Talk to us about Microsoft 365 Certified: AI Services Administrator Associate (AB-650) training](https://lucidlabs.com.au/?service=training-consulting&message=I%27m%20interested%20in%20AB-650%20Microsoft%20365%20AI%20Services%20Administrator%20and%20Copilot%2FAgent%20365%20governance%20training%20for%20my%20team.#contact) Custom training for teams & individuals — remote or on-site across Australia ![Keith Oak](https://lucidlabs.com.au/team/koak-400.jpg) Keith Oak Chief Technology Officer — Lucid Labs Microsoft Solutions Partner architect specialising in Fabric, Azure Data & AI, and GitHub Enterprise. 18+ years delivering data platforms for Australian businesses — building the systems these exams test every day. [LinkedIn ↗](https://www.linkedin.com/in/keithoak/)[lucidlabs.com.au ↗](https://lucidlabs.com.au/)Published 29-03-2026