Microsoft · Exam reference
About the Microsoft AB-650 exam
Microsoft AB-650 leads to the Microsoft 365 Certified: AI Services Administrator Associate certification and takes over from MS-102 as the Microsoft 365 administrator exam. It covers tenant and workload configuration, governance and security across Microsoft Entra, Defender for Office 365 and Microsoft Purview, and the administration of Microsoft 365 Copilot, Copilot connectors and agents in Agent 365.
10
Sample questions
100 min
Exam time limit
70%
Practice pass mark
$165
Exam voucher
AB-650 is the exam behind the Microsoft 365 Certified: AI Services Administrator Associate credential, and it is the exam that replaces MS-102 when MS-102 retires in October 2026. It is in beta, which means your result is held back until Microsoft has enough data from the question pool to set a cut score. The blueprint splits three ways, and the split is what most candidates misjudge. Tenant and workload configuration, the familiar Microsoft 365 admin material, is only 20 to 25 percent of the exam. Governance and security take 40 to 45 percent. AI services take 35 to 40 percent. Roughly three quarters of AB-650 therefore sits outside what an MS-102 revision plan used to cover, and a candidate who studies domains, licensing and mailboxes will run into Purview and Agent 365 questions they have never seen. The AI half is genuinely new material rather than a rebadge. Microsoft asks about Data Loss Prevention requirements that reach Copilot, Data Security Posture Management for AI activity, agent identity lifecycle workflows in Microsoft Entra Agent ID, the approval and publishing flow in the agent registry, and how to read Copilot adoption through the Copilot Control System. Reading the documentation for those features is not the same as knowing which admin centre owns which setting, and the exam asks the second question. This course covers all three domains at their published weights, with practice questions written against the current beta objectives, flashcards for the terminology, and scenario items in the formats Microsoft uses on role-based exams.
Exam Domains Covered
Exam Format & Details
Microsoft does not publish an exact question count for AB-650. Its published guidance is that most certification exams contain 40 to 60 questions, and that associate role-based exams without labs allow 100 minutes of exam time within a 120 minute seat time. Question types on role-based exams include multiple choice, multiple select, drag and drop, build list, active screen, hot area and multi-part case studies. The passing score is 700 on a scale of 100 to 1000. AB-650 is currently a beta exam, so your score is released once Microsoft has finished collecting data on the question pool rather than at the end of your session. Booking is through Microsoft Learn and delivery is by Pearson VUE, either at a test centre or online with OnVUE. The standard voucher price for a Microsoft associate role-based exam is 165 USD, and pricing varies by the country or region in which the exam is proctored.
Why Practice Questions Matter
AB-650 is new enough that Microsoft has no practice assessment for it yet, and no candidate has years of exam feedback to draw on. That leaves the documentation, and reading Microsoft Learn will not tell you whether you can choose between the Microsoft 365 admin centre, the Purview portal and the Entra admin centre while a clock is running. Practice questions will. They also expose the weighting problem quickly: if your revision has been mostly tenant configuration, an hour of Purview, Copilot and Agent 365 questions shows you that now rather than on exam day.
Sample Practice Questions
The following questions are a preview of the type of syllabus-aligned questions you will practise in CertCrush. They reflect the format and reasoning style of the Microsoft AB-650 exam — not actual exam content.
Q1.A DLP alert reports that a document containing a health record identifier was shared externally. The analyst suspects the document is a template populated with sample values rather than a genuine record. Which tab in the alert confirms exactly what was detected in the content?
- A.Sensitive info types
- B.Events
- C.Details
- D.Actions
Domain: Govern and secure Microsoft 365 tenants and workloads
Q2.Contoso publishes announce@contoso.com so that a message sent to it is fanned out to 400 staff. No central copy of the message needs to be retained at the address. Which object meets this requirement with the least storage overhead?
- A.A distribution group
- B.A shared mailbox
- C.A Microsoft 365 group
- D.A room mailbox
Domain: Configure and manage Microsoft 365 tenants and workloads
Q3.Before announcing a usage-based AI feature, an administrator wants to guarantee that no single employee can burn the whole monthly credit allowance in one afternoon. Which setting in the spending policy addresses this directly?
- A.A monthly limit per user within the spending policy
- B.An alert threshold percentage with the administrator as recipient
- C.The Don't limit monthly spending option, reviewed weekly
- D.A per-agent credit cap defined in the Agents usage report
Domain: Manage and secure AI services in Microsoft 365
Q4.A manufacturer wants .iso and .vbs attachments blocked outright on arrival, whether or not a scan finds anything malicious inside them. Which setting does that?
- A.The common attachments filter in an anti-malware policy
- B.Zero-hour auto purge (ZAP)
- C.Safe Attachments set to Dynamic Delivery
- D.The Files tab of the Tenant Allow/Block List
Domain: Govern and secure Microsoft 365 tenants and workloads
Q5.Which two statements about synced Copilot connectors are correct? (Choose two.)
- A.They require admin access to the external service, such as a Google Workspace Super Admin or Confluence Admin account
- B.Typical defaults are an incremental crawl every 15 minutes and a full crawl daily
- C.They ignore source permissions and expose all indexed content to every licensed user
- D.They carry a per-gigabyte indexing charge on top of Microsoft 365 licences
- E.They query the source at runtime using the Model Context Protocol
Domain: Manage and secure AI services in Microsoft 365
Frequently Asked Questions
What is included in the free Microsoft AB-650 sample?
The free sample includes 10 syllabus-aligned practice questions, sample flashcards, and a preview chapter from the study guide. No account or payment is required to try the sample.
How many questions are in the full Microsoft AB-650 course?
The full course includes a comprehensive question bank covering all exam domains. You can see the total question count on the Microsoft AB-650 course page.
Are these official Microsoft exam questions?
No. CertCrush questions are independently written and syllabus-aligned — they mirror the format, difficulty, and reasoning style of the official exam. We are not affiliated with or endorsed by Microsoft.
Which domains does the Microsoft AB-650 course cover?
The course covers 3 exam domains: Configure and manage Microsoft 365 tenants and workloads, Govern and secure Microsoft 365 tenants and workloads, Manage and secure AI services in Microsoft 365.
Can I study on mobile?
Yes. CertCrush is fully responsive and works on phones, tablets, and desktops. The timed exam, flashcards, and study guide all work on mobile without installing an app.
What happens when I create an account?
Creating a free account lets you access full courses, track your weak areas by domain, and resume practice sessions across devices. No credit card is required to register.