AB-650 Study Guide

AB-650 measures whether you can do the day-to-day work of a Microsoft 365 administrator once Microsoft 365 Copilot and agents arrive: configuring the tenant and its workloads, governing identities, sign-in, email security and data protection, and enabling, securing and monitoring Copilot, agents and Microsoft Agent 365 at enterprise scale.

The exam has three domains. Governing and securing Microsoft 365 tenants and workloads carries the most weight at 40-45%, managing and securing AI services carries 35-40%, and configuring and managing tenants and workloads carries 20-25%. Copilot and agents run through all three: the first domain prepares SharePoint and OneDrive for Copilot, the second protects the data that Copilot and AI services touch with DLP and Data Security Posture Management, and the third enables, governs and monitors Copilot and agents themselves.

Configure and manage Microsoft 365 tenants and workloads — 20-25%

Tenant: branding (logo, company URL, themes and backgrounds), domains, organizational settings including security and privacy settings and the organization profile, Microsoft 365 licenses including group-based licensing and pay-as-you-go, licenses for Microsoft 365 Copilot, Microsoft Agent 365 and Microsoft Copilot Studio, Microsoft 365 Backup setup, restore and monitoring, network connectivity insights, and Service health with its notifications.

Workloads: mailboxes including shared mailboxes, teams with their channels, owners and members, Copilot settings for Teams meetings including transcription, SharePoint sites and their permissions, and preparing SharePoint and OneDrive for Copilot with SharePoint Advanced Management, Microsoft Search in SharePoint and site exclusions.

Govern and secure Microsoft 365 tenants and workloads — 40-45%

Identities in Microsoft Entra: users, guest users and external access settings, groups including Microsoft 365 groups, roles including Privileged Identity Management (PIM), administrative units, contacts, and bulk management including Microsoft Graph PowerShell.

Authentication and access: authentication methods, Microsoft Entra Password Protection, self-service password reset (SSPR), investigating and resolving authentication issues, and Conditional Access policies with Microsoft Entra ID Protection and multifactor authentication.

Microsoft Defender for Office 365: alerts, threat policies and rules, investigating and responding to email and collaboration threats, and attack simulations with training campaigns.

Microsoft Purview: requirements for Data Loss Prevention (DLP) policies across Exchange, SharePoint, OneDrive, Teams, endpoints and Copilot, for information protection (sensitive information types, sensitivity labels and label policies) and for data lifecycle management (retention labels, retention label policies and retention policies), reviewing and responding to DLP alerts for Microsoft 365 and AI services, and monitoring and securing AI activity with Data Security Posture Management (DSPM).

Manage and secure AI services in Microsoft 365 — 35-40%

Microsoft 365 Copilot: tenant readiness including in-app experiences, data readiness (data leaks, oversharing and compliance), web search for Copilot and Microsoft 365 Copilot Chat, Microsoft 365 Copilot Search, tenant Copilot settings (self-service purchases, Copilot in admin centers, release preferences, the AI disclaimer, and video and image generation), Copilot user experiences, Microsoft 365 Copilot Cowork, third-party AI providers, and Copilot connectors.

Agents in Microsoft 365 and Agent 365: lifecycle workflows for agent identities with Microsoft Entra Agent ID, securing agent access with access packages and Conditional Access, agent owners, agent settings (allowed agent types, sharing, templates and user access), discovering, publishing, rejecting, installing and blocking Microsoft, third-party and custom agents in the agent registry, and managing tools in Agent 365.

Securing and monitoring AI services: monitoring agent activity, protecting sensitive data and evaluating compliance gaps with Agent 365, managing and monitoring costs for AI services, Copilot usage reports in the Microsoft 365 admin center with workload-level adoption details, and usage, adoption and service health in the Copilot Control System.

The full bullet-level list lives in the official study guide. Treat it as your checklist:

The Official AB-650 Study Guide

How This Maps to CertiAce Practice Modules

The CertiAce question bank is organized by the three learning paths of the official AB-650 course on Microsoft Learn, and each path follows one skills-measured domain. The bank also adds two case studies that combine topics across the domains, so use the mapping below and the topics behind your missed questions to identify the skills-measured areas to revisit:

AB-650 has no prerequisites: the certification page lists none, and you earn the certification by passing AB-650 alone. No expert certification currently lists it as a prerequisite. The other three certifications above list no prerequisites either, so you can take them in any order: Copilot and Agent Administration Fundamentals (AB-900), Identity and Access Administrator Associate (SC-300) and Information Security Administrator Associate (SC-401). AB-650 tests the Entra and Purview tasks of a Microsoft 365 administrator, while SC-300 and SC-401 go deeper into each.

If Microsoft 365 administration or Copilot and agents are new to you, AB-900 first is a gentle on-ramp; if you already administer a Microsoft 365 tenant, go straight to AB-650.

The audience profile asks for experience with Microsoft 365 workloads and Microsoft Entra ID, an understanding of Defender XDR capabilities, and familiarity with Microsoft Graph PowerShell, and the learning paths add basic DNS concepts and familiarity with Microsoft Copilot. Check yourself against this table. Anything unfamiliar is where your preparation should start:

How long you need depends on where you start. Treat these estimates as planning guidance and adjust them to your starting knowledge and weekly study hours:

Step 1: Read the Official Study Guide

Skim the full skills-measured list once, and mark every bullet you could not explain to a colleague. That marked-up list is your personal syllabus: everything else in this plan exists to clear it. The page carries no "skills measured as of" date and no change log, so check it again shortly before your exam. Most questions cover generally available features, but commonly used preview features may also appear.

Product documentation moves faster than the skills list: current product pages say Microsoft Copilot and Microsoft Copilot Chat where the skills list says Microsoft 365 Copilot and Microsoft 365 Copilot Chat, current pages and the AI services learning path use Copilot controls for what the skills list calls the Copilot Control System, and the governance learning path still says DSPM for AI, which Microsoft Purview now lists as DSPM for AI (classic) next to the current Data Security Posture Management that the skills list names. Learn the skills-list names and expect to meet both in the docs.

The Official Study Guide

Step 2: Schedule Your Exam

Choose a realistic target date after reviewing the skills list and your available study time. A date on the calendar turns studying into a countdown, so pick one using the prep-time table above and plan backwards from it. The exam is available in English only. If the exam is not available in your native language, check the English as a Second Language accommodation and arrange any approved extra time before booking.

Exam accommodations

Certification and Exam Details Page

Step 3: Work Through the Official Learning Paths

Complete the three learning paths behind course AB-650T00-A on Microsoft Learn. They are the same three modules you will find in CertiAce practice, and each one follows one skills-measured domain. Their prerequisites differ: the tenant and workloads path assumes basic DNS concepts, the governance path assumes beginner-level PowerShell, and the AI services path asks for access to a Microsoft 365 E5 tenant, with Microsoft 365 E7 (Frontier Suite) preferred because it bundles the Microsoft Agent 365 and Microsoft Entra Suite licensing its agent-identity labs use. Product pages change faster than training modules, so if a unit and a current product page disagree, follow the product page. Take notes on concepts you cannot explain in simple terms, and flag anything that needs hands-on practice. If you prefer instructor-led training, course AB-650T00-A runs over three days and is listed as available from November 13, 2026.

Configure and manage Microsoft 365 tenants and workloads

Govern and secure Microsoft 365 tenants and workloads

Manage and secure Microsoft 365 AI services

Step 4: Get Hands-On Practice

AB-650 rewards administration you have done yourself. Many questions describe a tenant's users, groups, licenses and policies and ask what happens to a named user, message, file or agent, or which setting, role or policy meets a requirement, and those outcomes stick once you have configured them. A free one-month trial of a Microsoft 365 for business plan gives you a tenant with the Microsoft 365, Exchange, SharePoint, Teams and Microsoft Entra admin centers, which supports many of the core exercises. Microsoft 365 Business Premium is the most useful trial plan here because it includes Microsoft Entra ID P1 with Conditional Access and Defender for Office 365 Plan 1. If the sign-up page offers versions with and without Teams, choose one with Teams. Make sure you personally:

• Add and verify a custom domain, set an organization theme and sign-in branding, and review the organization profile and the security and privacy settings
• Assign licenses through a group, fix an assignment error, and set up Service health notifications
• Create a shared mailbox with delegated access, a team with a private channel, and a Teams meeting policy that controls Copilot and transcription
• Create a SharePoint site, change its permissions and sharing settings, and review the SharePoint Advanced Management controls for oversharing
• Create users in bulk with Microsoft Graph PowerShell, invite a guest, scope a role with an administrative unit, and compare a mail contact with a guest user
• Configure authentication methods and SSPR, create a Conditional Access policy in report-only mode, and investigate a sign-in with the sign-in logs and the What If tool
• Review the preset security policies, create a custom anti-spam or anti-phishing policy, and look at quarantine and the alerts in the Microsoft Defender portal
• Explore the Microsoft Purview portal: sensitive information types, sensitivity labels and label policies, DLP policies and alerts, retention policies, and Data Security Posture Management
• Review the Copilot settings, the agent settings and the agent registry and its requests in the Microsoft 365 admin center, and the usage reports once people use Copilot

Several objectives need more than that trial. Privileged Identity Management needs Microsoft Entra ID P2 or Microsoft Entra ID Governance, and risk-based Conditional Access needs Microsoft Entra ID P2. Attack simulation training needs Microsoft 365 E5 or Defender for Office 365 Plan 2, which Microsoft 365 E3 and Business Premium organizations can try for 90 days from the Microsoft Defender portal. The free Microsoft Purview Suite trial adds the E5-level Purview solutions for 90 days, but only to a tenant that has Microsoft 365 E3 (or Office 365 E3 with Enterprise Mobility + Security E3) and no E5. Licensed Copilot features need a Microsoft 365 Copilot license, while eligible users get Copilot Chat without one, and the Agent 365 features need a Microsoft Agent 365 license for each user, which Microsoft 365 E7 includes. The official AB-650T00 lab exercises are free to read and step by step: seven labs that follow the three learning paths, written for a hosted Microsoft 365 E7 lab tenant that the lab environment provides (sample people, groups, documents and agents, plus Copilot Credits for the Cowork exercise), with no Azure subscription required and every lab file linked for download. Learn from the documentation what you cannot try, and turn off recurring billing on any trial you do not want to keep before it ends.

Try or buy a Microsoft 365 for business subscription

Official AB-650T00 Lab Exercises

Step 5: Benchmark Your Knowledge

Use CertiAce to benchmark your readiness module by module. The practice modules map to the exam domains as shown above, so use the module mapping and the topics behind your missed questions to identify the skills-measured areas to revisit. Microsoft does not offer an official practice assessment for AB-650 yet; its certification page says practice assessments usually arrive within 8 weeks of an exam leaving beta and becoming generally available, so check the page again before your exam. Aim for consistent performance across every module, not one lucky high score; pay particular attention to questions that separate similar controls (an agent's owner versus its sponsor, restricted content discovery versus restricted access control, a retention label versus a retention policy), and if a topic is unstable, go back to learning plus hands-on practice.

CertiAce AB-650 Exam Practice

Step 6: Take the Exam

The day before, review only your weak topics (no brand-new material). On exam day, read each question for what it is truly asking and eliminate wrong options first. Many AB-650 questions describe a tenant (users, groups, licenses, roles, and policies with their include and exclude lists) and ask what happens to one named user, message, file or agent, so settle which policies and settings apply before you read the options, and watch for constraints such as least privilege, minimal administrative effort, or keeping existing access unchanged.

Worth knowing before you sit down:

• Microsoft Learn is available during the exam in a split screen. Use it to check details you genuinely need: the timer keeps running, and the exam is deliberately too long to look up every answer. Browsing is limited to Microsoft Learn itself (no Q&A, practice assessments, or profile), and personal notes and other websites are unavailable.
• You can take unscheduled breaks, but the clock keeps running and you cannot return to questions you already saw.
• Case studies lock when you leave them: finish each one before moving on, because you cannot revisit its questions afterwards.
• Check the exam time when you register: Microsoft has not yet published AB-650's duration on its certification or exam page. Role-based exams run 100 minutes, or 120 minutes when they may contain labs, and the overview pages at the start of the exam tell you whether yours has labs.
• Watch the naming: the skills list says Microsoft 365 Copilot, Microsoft 365 Copilot Chat and Copilot Control System, while many current product pages say Microsoft Copilot, Microsoft Copilot Chat and Copilot controls, so cross-check product names and objectives against the current study guide.
• Try the exam sandbox beforehand so the question formats and interface hold no surprises: Exam Sandbox