AB-650 Study Guide Changes

The same, one level down: how each group of MS-102 became a group of AB-650. A group marked Higher level is covered by broader skills: the skills of the old group that have no counterpart are shown as covered by it, not as removed.

Green underlined text is in AB-650 but not in MS-102, or is worded differently. Red strikethrough text is in MS-102 but not in AB-650. Everything else is the same in both. Skills are matched by topic, so a skill that was reworded a lot can show as removed and added. A grey note after a skill says it moved to another domain: where it is now, or where it came from. The notes in "Skills at a glance" say how each area changed. This is the whole AB-650 study guide, so you can see each difference in place.

AB-650 skills measured, compared to MS-102

Skills at a glance

• Configure and manage Microsoft 365 tenants and workloads (20–25%) — split from Deploy and manage a Microsoft 365 tenant
• Govern and secure Microsoft 365 tenants and workloads (40–45%) — merged from Deploy and manage a Microsoft 365 tenant, Implement and manage Microsoft Entra identity and access, Manage security and threats by using Microsoft Defender XDR and Manage compliance by using Microsoft Purview
• Manage and secure AI services in Microsoft 365 (35–40%) — new in AB-650
• Deploy and manage a Microsoft 365 tenant (25–30%) — split into Configure and manage Microsoft 365 tenants and workloads and Govern and secure Microsoft 365 tenants and workloads
• Implement and manage Microsoft Entra identity and access (25–30%) — merged into Govern and secure Microsoft 365 tenants and workloads
• Manage security and threats by using Microsoft Defender XDR (30–35%) — merged into Govern and secure Microsoft 365 tenants and workloads
• Manage compliance by using Microsoft Purview (10–15%) — merged into Govern and secure Microsoft 365 tenants and workloads

Configure and manage Microsoft 365 tenants and workloads (20–25%)

Configure and manage a Microsoft 365 tenant

• Configure branding in a Microsoft 365 tenant, including logo, company URL, themes, and backgrounds
• Implement and manage domains
• Configure org and manage organizational settings, including Security & security and privacy settings and Organization the organization profile ← from Deploy and manage a Microsoft 365 tenant
• Manage and monitor Microsoft 365 licenses, including group-based licensing and pay-as-you-go
• Manage and monitor licenses for AI services, including Microsoft 365 Copilot, Microsoft Agent 365, and Microsoft Copilot Studio
• Configure and manage use Microsoft 365 Backup Backup, including setup, restore, and monitor ← from Deploy and manage a Microsoft 365 tenant and 1 more skill of the old guide
• Configure and review Network network connectivity insights ← from Deploy and manage a Microsoft 365 tenant
• Monitor the health of Microsoft 365 services by using Service Health, health, including notification configuration of notifications ← from Deploy and manage a Microsoft 365 tenant

Manage Microsoft 365 workloads

• Create and manage mailboxes, including shared mailboxes
• Create and manage teams in Microsoft Teams, including channels, owners, and members
• Configure settings for Copilot in Teams meetings, including transcription
• Create and manage SharePoint sites, including permissions
• Configure SharePoint and OneDrive for Copilot, including SharePoint Advanced Management, Microsoft Search in SharePoint, and site exclusions

Govern and secure Microsoft 365 tenants and workloads (40–45%)

Manage identities in Microsoft Entra

• Create and manage users in Microsoft Entra ID, including external 365 users ← from Deploy and manage a Microsoft 365 tenant and 1 more skill of the old guide
• Manage guest users and external access settings
• Create and manage groups, including Microsoft 365 Groups and manage shared mailboxes groups ← from Deploy and manage a Microsoft 365 tenant and 2 more skills of the old guide
• Manage Microsoft Entra ID roles in for Microsoft 365, including Microsoft Entra Privileged Identity Management (PIM) ← from Deploy and manage a Microsoft 365 tenant and 1 more skill of the old guide
• Manage delegation by using Create and manage administrative units ← from Deploy and manage a Microsoft 365 tenant
• Create and manage contacts
• Perform bulk user management, including Microsoft Graph PowerShell and Microsoft Entra PowerShell ← from Deploy and manage a Microsoft 365 tenant

Implement and manage authentication and access in Microsoft Entra

• Implement Configure and manage authentication methods ← from Implement and manage Microsoft Entra identity and access
• Implement and manage Microsoft Entra Password Protection ← from Implement and manage Microsoft Entra identity and access and 1 more skill of the old guide
• Implement and manage Configure self-service password reset (SSPR) ← from Implement and manage Microsoft Entra identity and access
• Investigate and resolve authentication issues ← from Implement and manage Microsoft Entra identity and access
• Implement and manage multifactor authentication (MFA) by using Microsoft Entra Conditional Access policies policies, including Microsoft Entra ID Protection and multifactor authentication ← from Implement and manage Microsoft Entra identity and access and 2 more skills of the old guide

Secure Microsoft 365 workloads

• Configure alert policies Manage alerts in Microsoft Defender for Office 365 ← from Manage security and threats by using Microsoft Defender XDR
• Implement Configure threat policies and rules in Microsoft Defender for Office 365 ← from Manage security and threats by using Microsoft Defender XDR
• Investigate and respond to email and collaboration threats by using Microsoft Defender for Office 365 ← from Manage security and threats by using Microsoft Defender XDR
• Manage Configure and manage attack simulations, including training campaigns ← from Manage security and threats by using Microsoft Defender XDR

Protect data in Microsoft 365 by using Microsoft Purview

• Configure DLP policies Identify requirements for Microsoft 365 workloads, Purview Data Loss Prevention (DLP) policies, including Exchange Online, SharePoint Online, those for Exchange, SharePoint, OneDrive, Teams, Power BI, endpoints, and Microsoft 365 Copilot ← from Manage compliance by using Microsoft Purview and 1 more skill of the old guide
• Implement Identify requirements for information protection, including sensitive information types, sensitivity labels labels, and sensitivity label policies ← from Manage compliance by using Microsoft Purview
• Implement Identify requirements for data lifecycle management, including retention labels, retention label policies, and retention policies ← from Manage compliance by using Microsoft Purview
• Review and respond to DLP alerts, events, alerts for Microsoft 365 and reports AI services ← from Manage compliance by using Microsoft Purview
• Monitor and secure AI activity by using Microsoft Purview Data Security Posture Management (DSPM)

Manage and secure AI services in Microsoft 365 (35–40%)

Enable and manage Microsoft 365 Copilot

• Assess tenant readiness for Copilot, including in-app experiences
• Identify and resolve data readiness issues for Copilot, including data leaks, data oversharing, and data compliance
• Manage web search for Copilot and Microsoft 365 Copilot Chat
• Configure Microsoft 365 Copilot Search
• Configure Copilot settings for a tenant, including self-service purchases, Copilot in admin centers, release preferences, AI disclaimer, and video and image generation
• Manage Copilot user experiences
• Manage Microsoft 365 Copilot Cowork
• Manage third-party AI providers
• Configure Copilot connectors

Implement and manage agents in Microsoft 365 and Agent 365

• Manage the lifecycle workflows for agent identities by using Microsoft Entra Agent ID
• Secure agent access, including access packages and conditional access
• Manage agent owners
• Configure agent settings, including allowed agent types, sharing, templates, and user access
• Discover and manage Microsoft and third-party agents in the agent registry
• Review requests and publish or reject agents in the agent registry
• Install, block, or control access to agents in the agent registry, including uploading custom agents
• Manage tools in Agent 365

Secure and govern agents by using Agent 365

• Monitor agent activity by using Agent 365
• Protect sensitive data by using Agent 365
• Evaluate compliance gaps by using Agent 365

Monitor AI services in Microsoft 365

• Manage and monitor costs for AI services in Microsoft 365
• Monitor usage reports for Copilot in the Microsoft 365 admin center, including workload-level adoption details
• Monitor usage and adoption for AI services in Microsoft 365 by using the Copilot Control System
• Monitor service health by using the Copilot Control System

Deploy and manage a Microsoft 365 tenant (25–30%)

Implement and manage a Microsoft 365 tenant

• Create a tenant
• Implement and manage domains
• Configure org settings, including Security & privacy and Organization profile → now in Configure and manage Microsoft 365 tenants and workloads
• Monitor the health of Microsoft 365 services by using Service Health, including configuration of notifications → now in Configure and manage Microsoft 365 tenants and workloads
• Configure and review Network connectivity insights → now in Configure and manage Microsoft 365 tenants and workloads
• Configure and monitor software updates by using the Microsoft 365 admin center
• Monitor Microsoft 365 adoption and usage → now in Configure and manage Microsoft 365 tenants and workloads
• Configure and manage Microsoft 365 Backup → now in Configure and manage Microsoft 365 tenants and workloads

Manage users and groups

• Create and manage users in Microsoft Entra ID, including external users → now in Govern and secure Microsoft 365 tenants and workloads
• Create and manage contacts in the Microsoft 365 admin center → now in Govern and secure Microsoft 365 tenants and workloads
• Create and manage groups, including Microsoft 365 Groups and manage shared mailboxes → now in Govern and secure Microsoft 365 tenants and workloads
• Manage and monitor Microsoft 365 licenses, including group-based licensing → now in Govern and secure Microsoft 365 tenants and workloads
• Perform bulk user management, including Microsoft Graph PowerShell and Microsoft Entra PowerShell → now in Govern and secure Microsoft 365 tenants and workloads

Manage roles and role groups

• Implement and manage roles in Microsoft 365 and Microsoft Entra ID → now in Govern and secure Microsoft 365 tenants and workloads
• Manage permissions for Microsoft Defender XDR, Microsoft Purview and other Microsoft 365 workloads using roles or role groups → now in Govern and secure Microsoft 365 tenants and workloads
• Manage delegation by using administrative units → now in Govern and secure Microsoft 365 tenants and workloads
• Manage Microsoft Entra ID roles in Microsoft Entra Privileged Identity Management (PIM) → now in Govern and secure Microsoft 365 tenants and workloads

Implement and manage Microsoft Entra identity and access (25–30%)

Implement and manage identity synchronization with Microsoft Entra tenant

• Prepare for identity synchronization, including IdFix
• Implement and manage directory synchronization by using Microsoft Entra Connect Sync or Microsoft Entra Cloud Sync
• Monitor synchronization by using Microsoft Entra Connect Health
• Troubleshoot synchronization, including Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync

Implement and manage authentication

• Implement and manage authentication methods → now in Govern and secure Microsoft 365 tenants and workloads
• Implement and manage self-service password reset (SSPR) → now in Govern and secure Microsoft 365 tenants and workloads
• Implement and manage Microsoft Entra Password Protection → now in Govern and secure Microsoft 365 tenants and workloads
• Investigate and resolve authentication issues → now in Govern and secure Microsoft 365 tenants and workloads

Implement and manage secure access

• Plan for identity protection
• Implement and manage Microsoft Entra Identity Protection → now in Govern and secure Microsoft 365 tenants and workloads
• Plan Conditional Access policies → now in Govern and secure Microsoft 365 tenants and workloads
• Implement and manage Conditional Access policies → now in Govern and secure Microsoft 365 tenants and workloads
• Implement and manage multifactor authentication (MFA) by using Conditional Access policies → now in Govern and secure Microsoft 365 tenants and workloads

Manage security and threats by using Microsoft Defender XDR (30–35%)

Review and respond to security reports and alerts generated by Microsoft Defender XDR

• Review and respond to threats by using Microsoft Security Exposure Management, including the Microsoft Secure Score
• Review and respond to incidents and alerts generated by Microsoft Defender XDR, including advanced hunting
• Review and respond to issues identified in Microsoft Defender XDR reports
• Review and respond to threats identified by Microsoft Defender Threat Intelligence

Implement and manage email and collaboration protection by using Microsoft Defender for Office 365

• Implement threat policies and rules in Microsoft Defender for Office 365 → now in Govern and secure Microsoft 365 tenants and workloads
• Configure alert policies in Microsoft Defender for Office 365 → now in Govern and secure Microsoft 365 tenants and workloads
• Investigate and respond to email and collaboration threats by using Microsoft Defender for Office 365 → now in Govern and secure Microsoft 365 tenants and workloads
• Manage attack simulations, including training campaigns → now in Govern and secure Microsoft 365 tenants and workloads
• Manage restricted entities, including blocked users

Implement and manage endpoint protection by using Microsoft Defender for Endpoint

• Onboard devices to Microsoft Defender for Endpoint
• Configure endpoint settings
• Review and respond to vulnerabilities identified in the Microsoft Defender Vulnerability Management dashboard

Implement and manage Microsoft Defender for Cloud Apps

• Configure the app connector for Microsoft 365
• Configure Microsoft Defender for Cloud Apps policies, including triggering alerts
• Interpret activity log
• Configure Cloud App Discovery
• Review and respond to issues identified in Cloud App Discovery

Manage compliance by using Microsoft Purview (10–15%)

Implement Microsoft Purview information protection and data lifecycle management

• Implement and manage sensitive information types by using keywords, keyword lists, or regular expressions → covered at a higher level by Protect data in Microsoft 365 by using Microsoft Purview
• Implement retention labels, retention label policies, and retention policies → now in Govern and secure Microsoft 365 tenants and workloads
• Implement sensitivity labels and sensitivity label policies → now in Govern and secure Microsoft 365 tenants and workloads
• Monitor label usage by using Content explorer, Activity explorer, and label reports → covered at a higher level by Protect data in Microsoft 365 by using Microsoft Purview

Implement Microsoft Purview data loss prevention (DLP)

• Configure DLP policies for Microsoft 365 workloads, including Exchange Online, SharePoint Online, OneDrive, Teams, Power BI, and Microsoft 365 Copilot → now in Govern and secure Microsoft 365 tenants and workloads
• Configure Endpoint DLP → now in Govern and secure Microsoft 365 tenants and workloads
• Review and respond to DLP alerts, events, and reports → now in Govern and secure Microsoft 365 tenants and workloads

As a candidate for this Microsoft Certification, you configure, manage, secure, and govern Microsoft 365 tenants, workloads, and AI services, including Microsoft 365 Copilot, agents, and connected AI capabilities. You enable secure, compliant, and scalable productivity across the organization by governing data access, protecting information, and supporting collaboration between users and agents. You operate and continuously optimize Microsoft 365 and AI services at enterprise scale, helping to ensure reliable and effective outcomes in an AI-powered workplace.

As a Microsoft 365 and AI services administrator, you collaborate with architects and administrators across workloads, infrastructure, identity, security, compliance, endpoints, and applications.

For this exam, you should have experience with Microsoft 365 workloads and Microsoft Entra ID, an understanding of Defender XDR capabilities, and familiarity with Microsoft Graph PowerShell.

3 domains, 10 skill groups, 58 skills. See the Current tab for the full outline.