Microsoft 365 is getting smarter, and that is changing what organizations expect from administrators. With AI becoming deeply integrated into Microsoft 365 services, the ability to simply manage users, apps, and configurations is no longer the whole story. The AB-650: Microsoft 365 AI Services Administrator Associate exam is designed around this shift, bringing AI services, administration, security, governance, and real-world Microsoft 365 scenarios into the spotlight. If you’re planning to take AB-650, the big question is not just “What should I study?” but “Do I actually know how to manage AI-powered Microsoft 365 environments?”
And this is where preparation can get tricky. There’s a lot to cover, and studying every Microsoft 365 and AI topic without a clear direction can quickly become overwhelming. So what does the AB-650 exam really test? Which topics deserve the most attention? How should you practice, and what can you do to avoid common preparation mistakes? In this guide, we’ll break down the AB-650 exam and show you how to build a focused preparation strategy, strengthen your practical understanding, and walk into the exam knowing exactly what you need to revise.
How to Prepare for the AB-650: Microsoft 365 AI Services Administrator Associate Exam
MS-102 retires on 30 November 2026. Its replacement, AB-650, doesn’t just add a few Copilot questions to the old syllabus — it rebuilds the exam so that governance and AI services account for 75–85% of the paper, and there’s no official practice assessment yet to lean on. Here’s exactly what’s tested, how it’s weighted, and how to prepare for an exam Microsoft itself is still finishing.
Most Microsoft exam updates are incremental — a few objectives reworded, a handful of new features added. AB-650 is not that. It replaces one of Microsoft’s most widely held administrator certifications with an exam built around a genuinely different job: the same tenant, identity, and security work as before, plus governing Copilot and AI agents as first-class enterprise resources with their own identities, owners, and lifecycles. This guide walks through exactly what’s tested, how the domains are weighted, and how to prepare properly for an exam that’s still in beta and doesn’t yet have Microsoft’s own practice assessment to lean on.
A quick note before we start
AB-650 is a beta exam as of this writing, with general availability expected around October 2026. Beta exams are not scored immediately — results are held until the exam goes live and rescored, with final results released roughly 10 days later. Domain weightings, feature names, and pricing can shift before GA. Always cross-check current specifics against the official Microsoft Learn AB-650 exam page and study guide before booking.
Why AB-650 Exists Now
For years, the Microsoft 365 administrator’s job had a stable shape: tenants, identities, mailboxes, sites, teams, threat policies, compliance. MS-102 tested exactly that, and it became one of the most widely held Microsoft certifications precisely because that job barely changed year to year. It’s now officially retiring on 30 November 2026 at 11:59 PM Central Standard Time — a firm, Microsoft-confirmed date, later than the October 2026 figure that circulates on some third-party sites.
What replaced that stable job description is the reason AB-650 exists. A new layer now sits on top of classic administration: Copilot has to be licensed, grounded in the right data, and governed. Agents — the automated, AI-driven actors now operating inside Microsoft 365 — have identities, owners, sponsors, and a lifecycle of their own. Prompts and responses are data that Microsoft Purview has to see and protect. AI consumption produces a bill someone has to manage. AB-650, officially titled Administering Microsoft 365 and AI Services, validates that expanded scope directly.
AB-650 isn’t MS-102 with a Copilot module bolted on. It’s built on the premise that managing AI agents as enterprise resources is now core to the administrator’s job, not an add-on to it.
The certification earned is the Microsoft 365 Certified: AI Services Administrator Associate credential. As a candidate, Microsoft describes your role plainly: you configure, manage, secure, and govern Microsoft 365 tenants, workloads, and AI services — including Copilot, agents, and connected AI capabilities — enabling secure, compliant, and scalable productivity across the organisation, and operating those services at enterprise scale.
A beta discount worth knowing about (with a catch)
Microsoft offered the first 300 candidates 80% off the AB-650 beta exam using code AB-650SkyClub, valid through 18 August 2026 — though the offer explicitly excluded Turkey, Pakistan, India, and China. If that window has closed by the time you’re reading this, don’t worry: the exam itself and the preparation in this guide remain exactly as relevant once AB-650 goes fully live.
The Exam Itself: Format, Scoring, the Catch
Before touching a single domain, it’s worth understanding the exam’s mechanics precisely — and being honest about the one genuine complication that makes AB-650 harder to prepare for than a typical Microsoft Associate exam.
| Exam Detail | Specification |
|---|---|
| Exam time | 100 minutes (120 minutes total seat time) |
| Passing score | 700 out of 1000 (≈70% competency) |
| Question count | Not published; Microsoft’s general guidance suggests 40–60 questions |
| Format | Scenario-based multiple choice; no hands-on lab component |
| Official practice assessment | Not currently available (unusual for an Associate exam) |
| Beta scoring | Delayed — rescored at GA, final results ~10 days after |
That missing practice assessment deserves more attention than it usually gets in exam guides. Most Associate-level Microsoft exams ship with a free or low-cost official practice assessment that closely mirrors the real question style. AB-650’s own exam page states plainly that the Practice Assessment is not currently available, and Microsoft typically releases one within about eight weeks of an exam leaving beta. Until then, you’re preparing primarily from the skills-measured outline and hands-on practice, not from a Microsoft-authored mock exam.
What that actually means for how you should study
Without an official practice assessment, the skills-measured document on Microsoft Learn becomes your single most important study asset — it’s the exact source Microsoft’s exam writers work from. Read every bullet under every domain before you touch any third-party material, and flag any term you don’t immediately recognise. Third-party practice questions can help with format familiarity, but treat the official outline as ground truth, especially while the exam is this new.
One more mechanical detail worth knowing if you’re sitting the beta version specifically: your result won’t come back immediately. Microsoft holds beta exam scores until the exam officially goes live, rescoring the full item bank based on how all beta candidates performed, and releases final pass/fail results roughly ten days after that. If you’re taking the beta for the discount described in Chapter 1, be prepared for that waiting period as part of the deal.
The 3 Domains, Ranked by Weight
AB-650’s skills-measured outline organises the exam into three domains, and the weighting is the single most important planning input for anyone preparing — especially if you’re coming from an MS-102 background and assuming the exam is weighted the way daily administration work is weighted. It isn’t.
| Domain | Weight | What It Covers |
|---|---|---|
| 1. Configure and manage Microsoft 365 tenants and workloads | 20–25% | Tenant setup, branding, organisational settings, license management — the most familiar territory for existing M365 admins |
| 2. Govern and secure Microsoft 365 tenants and workloads | 40–45% | Microsoft Entra ID, Conditional Access, Privileged Identity Management, Defender for Office 365, Microsoft Purview |
| 3. Manage and secure AI services in Microsoft 365 | 35–40% | Copilot readiness and deployment, Microsoft Entra Agent ID, agent lifecycle and governance, Agent 365, monitoring and cost |
The headline that should shape your entire study plan
Domains 2 and 3 together account for roughly 75–85% of the exam. Classic tenant and workload administration — the part every existing MS-102 holder already knows cold — is only 20–25%. If you assume this exam rewards deep M365 admin experience the way MS-102 did, you will systematically under-prepare for governance and AI services, which is where the vast majority of questions actually sit.
This reordering has a practical consequence worth stating directly: prior MS-102 experience is necessary but not sufficient for AB-650. It gives you a genuine head start on Domain 1 and a meaningful chunk of Domain 2’s identity and Defender content, but it gives you almost nothing on the Entra Agent ID, agent lifecycle, and Agent 365 material inside Domain 3 — because that material didn’t exist as an exam topic until this exam. Chapters 5 and 6 walk through both of the heavyweight domains in detail; Chapter 4 covers the smaller but not-skippable Domain 1.
Domain 1: Configure & Manage Tenants
At 20–25% of the exam, Domain 1 is the lightest-weighted section — and, for anyone with prior Microsoft 365 administration exposure, the most immediately familiar. That familiarity is exactly why it’s tempting to under-study it, which is a mistake: questions can and do come from every domain, and this is genuinely easy marks for anyone who prepares it properly.
| Skill Area | What’s Actually Tested |
|---|---|
| Tenant branding | Configuring logo, company URL, themes, and backgrounds across the tenant’s sign-in and app experiences |
| Organisational settings | Managing security and privacy settings and the organisation profile at the tenant level |
| License management | Assigning and monitoring Microsoft 365 licenses, including group-based licensing and pay-as-you-go models |
| Workload configuration | Setting up the principal productivity and collaboration workloads a tenant runs on |
The learning path that still applies almost unchanged
Because this domain overlaps heavily with legacy MS-102 content, the existing Microsoft Learn paths “Configure your Microsoft 365 tenant” and “Manage your Microsoft 365 tenant” remain directly relevant preparation — tenant setup, domains, subscription management, user and license management, roles, service health monitoring, and Microsoft Graph PowerShell. If you’ve already worked through MS-102 material, this domain needs review, not relearning.
The one genuinely new wrinkle inside this otherwise familiar domain is license management for AI services specifically — group-based licensing now needs to account for Copilot and Agent 365 SKUs alongside the traditional E3/E5 tiers, which is exactly the kind of overlap this exam is built around. Chapter 7 covers the licensing complexity in full, since it bridges Domain 1’s licensing skills with Domain 3’s AI services content directly.
Domain 2: Govern & Secure (The Big One)
At 40–45%, this is the single largest domain on the exam — bigger than the AI services domain, and more than double the weight of classic tenant administration. If your study time isn’t disproportionately allocated here, your preparation isn’t matched to the actual exam.
| Skill Area | What’s Actually Tested |
|---|---|
| Microsoft Entra ID | Managing identity, groups, authentication methods, and Conditional Access policies |
| Privileged Identity Management (PIM) | Just-in-time and time-bound access to privileged roles, reducing standing administrative access |
| Defender for Office 365 | Threat policies, safe attachments and links, and Defender XDR capabilities across the tenant |
| Microsoft Purview | Data Loss Prevention (DLP), sensitivity labels, retention policies, and compliance controls |
| DSPM for AI | Data Security Posture Management for AI — the newest Purview capability, purpose-built for AI-era data risk |
Domain 2 is where AB-650 stops being a Microsoft 365 exam and starts being a security-and-governance exam that happens to run on Microsoft 365.
DSPM for AI deserves particular attention because it’s genuinely new content with fewer outside study resources than the rest of this domain. It exists specifically to answer a question classic Purview tooling wasn’t built for: what happens to sensitive data once it flows into a prompt, a Copilot response, or an agent’s working memory? Expect scenario questions that test whether you know DSPM for AI is the tool that surfaces that exposure, distinct from traditional DLP, which was built around documents and messages rather than model interactions.
The identity-governance thread running through this whole domain
Conditional Access and PIM aren’t tested as isolated topics — they recur constantly in Domain 3 scenarios too, applied specifically to agent identities rather than human ones. Get genuinely comfortable with Conditional Access policy structure and PIM’s approval workflows here in Domain 2, because that same knowledge gets tested again, in an AI-governance context, in the next domain.
Domain 3: Manage & Secure AI Services
At 35–40%, this is the domain with the least outside study material and the most genuinely new concepts — and for candidates coming from an MS-102 background, it’s where the real preparation work happens. Nothing here can be skipped or assumed from prior experience.
| Skill Area | What’s Actually Tested |
|---|---|
| Copilot readiness | Preparing SharePoint and OneDrive for Copilot — permissions cleanup, Microsoft Search configuration, and site exclusions to control oversharing risk |
| Copilot deployment | Licensing, enabling, and rolling out Microsoft 365 Copilot across the organisation |
| Microsoft Entra Agent ID | Managing AI agents as enterprise identities — provisioning, ownership, and lifecycle, distinct from human identities |
| Agent registry & lifecycle | Tracking agents as enterprise objects with owners, sponsors, permissions, and a defined decommissioning path |
| Microsoft Agent 365 | The governance layer purpose-built for managing agents at enterprise scale |
| Copilot Studio & Copilot Cowork | Administering custom agent-building tools and collaborative AI workspaces |
| Monitoring & cost | Tracking AI workload health, usage, and consumption-based billing across the tenant |
Oversharing is the single most exam-relevant Copilot concept
Before Copilot ever launches, an administrator’s job is verifying that Copilot won’t surface content a user technically has access to but was never meant to see in practice — years of overly broad SharePoint permissions, forgotten shared links, stale group memberships. Expect scenario questions built around exactly this: a Copilot readiness assessment reveals oversharing risk, and you need to know which tools (site access reviews, sensitivity labels, DSPM for AI from Domain 2) actually resolve it.
Agent identity is the other pillar worth internalising deeply, because it’s the concept the entire domain is organised around. Treat an AI agent the way you’d treat a service account or an application identity: it needs an owner, defined permissions scoped to least privilege, a monitored activity trail, and an offboarding process when it’s retired. Microsoft Entra Agent ID and the agent registry exist specifically to apply identity-governance discipline — the same discipline tested in Domain 2 — to a category of actor that didn’t exist in the MS-102 syllabus at all.
A specific role name worth memorising
Viewing the full agent inventory in the Microsoft 365 admin center requires at minimum the AI Reader role. This is exactly the kind of least-privilege detail a scenario question hangs on — expect a question that describes someone unable to view agent activity and asks which role resolves it with the least additional privilege granted.
The Licensing Trap
Most Microsoft exam prep starts with “spin up a free developer tenant and try everything yourself,” and that advice works beautifully for Domain 1 and most of Domain 2. It only partly works for Domain 3, and understanding why is worth a chapter of its own, because otherwise you’ll spend hours confused about why your lab tenant won’t show you half the features this guide describes.
Microsoft Agent 365, the governance layer covered in Chapter 6, is included with Microsoft 365 E7, available as an add-on to E5, A5, and Business Premium, or accessible via the Defender Suite plus Purview Suite combination. A standard free developer tenant, the usual go-to for exam labs, typically doesn’t carry this licensing by default.
| Feature | Licensing Reality |
|---|---|
| Core tenant admin, Entra ID, Defender, Purview basics | Available on standard developer/trial tenants |
| Microsoft 365 Copilot | Requires a Copilot add-on license on top of E3/E5 |
| Microsoft Agent 365 governance layer | Included in E7; add-on to E5/A5/Business Premium; or via Defender Suite + Purview Suite |
| Microsoft Entra Agent ID controls | Requires appropriate Entra Agent ID licensing for Conditional Access and identity governance on agents |
| DSPM for AI | Tied to Purview premium licensing tiers |
What to actually do about it
Do the free tier properly first — a standard developer tenant still gets you genuine hands-on practice across most of Domains 1 and 2, and a meaningful slice of Domain 3’s Copilot readiness work (permissions review, site exclusions, Microsoft Search configuration don’t require premium AI licensing). For the Agent 365 and Entra Agent ID material specifically, lean more heavily on Microsoft’s official documentation, architecture diagrams, and admin center screenshots than on hands-on trial-and-error, since the licensing barrier is real and not easily worked around for free.
This is also, incidentally, why third-party practice question sets are more useful for this exam than usual, precisely because they can describe scenarios involving licensed features you may not be able to click through yourself. Just hold them to the same standard as any exam-prep material: they should explain the reasoning behind an answer, not just supply it, since reasoning is what transfers to a question you haven’t seen before.
AB-650 vs. MS-102 vs. AB-900 vs. AB-620
Microsoft launched several AI-adjacent certifications in close succession during 2026, and it’s genuinely easy to book the wrong one. Here’s how they actually differ.
| Exam | Level | Focus | Status |
|---|---|---|---|
| MS-102 | Associate | Classic Microsoft 365 administration — tenant, identity, security, compliance, no AI content | Retiring 30 Nov 2026 |
| AB-900 | Fundamentals | Microsoft 365 Copilot and agent administration at an introductory, conceptual level | Live |
| AB-620 | Associate | Building AI agents (Copilot Studio-centric), aimed at agent builders rather than administrators | Live |
| AB-650 | Associate | Full administrator scope — tenants, governance, and AI services together, replacing MS-102 | Beta |
The genuinely useful on-ramp if AB-650 feels overwhelming
If you’re newer to the Copilot and agent ecosystem generally, AB-900 (Fundamentals level) is a considerably gentler introduction to the same concepts — Copilot licensing basics, agent concepts, governance at a high level — without AB-650’s depth or its security-heavy Domain 2. Passing AB-900 first won’t exempt you from any AB-650 content, but it builds the vocabulary and mental model that make Domain 3 far less disorienting when you get there.
Worth being precise about one point of confusion specifically: AB-650 is a successor to MS-102, not a renaming of it. Candidates moving from MS-102 preparation should retain everything they’ve already learned about tenants, identity, Defender, and Purview, and add substantial new material on Copilot and agent administration on top — not swap one syllabus for another. The overlap is real, but so is the gap, and Chapter 3’s domain weighting tells you exactly how large that gap is.
Your Study Plan: 4–6 Weeks
Because AB-650 has no official practice assessment yet and no published question count, your preparation needs to lean more heavily on the skills-measured outline and hands-on practice than a typical exam plan would. Here’s a structured four-to-six week approach, weighted to match Chapter 3’s domain breakdown rather than splitting time evenly.
Compressing to four weeks
If you’re short on time, merge Weeks 1–2 into a single week and Weeks 5–6 into a single week, but do not compress Weeks 3–4 — that’s 40–45% of the exam and deserves the largest uninterrupted block of study time you can give it. Cutting corners on Domain 1 costs you a handful of easy marks; cutting corners on Domain 2 costs you the exam.
A study habit specific to this exam’s newness
Keep a running list of every skills-measured bullet you don’t immediately understand, from either domain, and resolve each one against official Microsoft documentation before moving on. Because AB-650 lacks a mature ecosystem of study guides, blog posts, and community-answered questions that older exams have accumulated, gaps you leave unresolved are less likely to get filled by accidentally stumbling on the answer elsewhere.
Common Myths & Beta-Exam Traps
A brand-new beta exam, launched into a crowded field of similarly-named certifications, generates confusion fast. A few misconceptions are worth correcting directly.
| The Myth | The Reality |
|---|---|
| “AB-650 is just MS-102 renamed with a few AI questions added.” | It’s a rebuilt exam where governance and AI services together make up 75–85% of the paper. Classic tenant administration, the entirety of what MS-102 tested, is only 20–25%. |
| “My MS-102 knowledge covers most of this exam.” | It covers Domain 1 fully and a meaningful share of Domain 2’s identity and Defender content, but almost none of Domain 3 — Entra Agent ID, the agent registry, and Agent 365 are genuinely new material with no MS-102 equivalent. |
| “I can prepare the same way I would for any other Associate exam.” | AB-650 currently has no official Microsoft practice assessment, which most Associate exams do have. Lean more heavily on the official skills-measured outline and hands-on practice than you otherwise would. |
| “A free developer tenant will let me practice everything in this exam.” | Core tenant, identity, and Defender content works fine on a free tenant, but Microsoft Agent 365 and full Entra Agent ID governance sit behind E7 or add-on licensing that a standard trial typically doesn’t include. |
| “If I take the beta exam, I’ll know my result right away.” | Beta exams are held unscored until the exam goes fully live and the item bank is rescored, with final results released roughly 10 days after that — not immediately, as with a live exam. |
| “AB-900 or AB-620 can substitute for AB-650 if I’m an administrator.” | AB-900 is a Fundamentals-level conceptual overview and AB-620 targets agent builders using Copilot Studio — neither covers AB-650’s administrator-level governance and security depth. |
Which Study Path Fits You?
“Prepare for AB-650” looks different depending on where you’re starting. Here’s a map across four common situations.
Already hold MS-102, moving to AB-650
Your foundation is real, but resist the temptation to skim — the exam’s weighting has moved away from what you already know.
- Do a fast review pass on Domain 1 (it should feel largely familiar) and a deeper review of Domain 2’s identity and Defender content
- Treat Domain 3 as genuinely new learning, not a light add-on — give it a full, dedicated study week rather than folding it into general review
- Pay specific attention to how Conditional Access and PIM concepts from Domain 2 reappear applied to agent identities in Domain 3
New to Microsoft 365 administration entirely
You have no habits to unlearn, which is a genuine advantage on an exam this newly weighted — but you need the full 6-week plan, not a compressed one.
- Start with the Domain 1 learning paths properly; don’t skip fundamentals to rush toward the more exciting AI content
- Build genuine hands-on time with Entra ID and Conditional Access before moving to Purview — identity concepts underpin nearly everything else on the exam
- Consider AB-900 first if the AI and agent vocabulary in Domain 3 feels disorienting; it’s a gentler, Fundamentals-level on-ramp to the same concepts
Coming from a security or compliance background
Domain 2 will likely feel like home. Your gap is the Microsoft 365 tenant and workload administration layer around it.
- Move quickly through Domain 2’s Entra ID, Defender, and Purview material — your existing security fluency should transfer directly
- Spend proportionally more time on Domain 1’s tenant configuration and licensing, since this is the least security-adjacent content on the exam
- In Domain 3, focus specifically on Copilot readiness and oversharing risk — a natural extension of data-governance thinking you likely already have
Taking the beta specifically for the discount
Sensible strategy, with two things worth planning around explicitly.
- Remember the discount excluded India, Pakistan, Turkey, and China — confirm current eligibility and deadline before assuming it applies to you
- Prepare as thoroughly as for a full-price exam; a discounted beta seat is still a real exam attempt, and beta exams can be harder to gauge given the missing official practice assessment
- Plan for the delayed scoring — you won’t get a pass/fail result immediately, so don’t build time-sensitive plans (a job application deadline, say) around an instant result
Assessment: Are You AB-650 Ready?
Answer five quick questions honestly and this will point to your most likely readiness level and recommended next step.
AB-650 readiness assessment
5 questions · your result updates and explains itself as you answer
Certification Path, Costs & Next Steps
AB-650 sits at a specific, timely point in the Microsoft 365 certification landscape, and understanding the surrounding path helps you plan beyond just passing this one exam.
| Item | Detail |
|---|---|
| Exam price | Varies by country/region of the proctoring location; check the official Microsoft Learn AB-650 page for current local pricing |
| Beta discount (time-limited) | 80% off for first 300 candidates via code AB-650SkyClub, through 18 Aug 2026; excluded India, Pakistan, Turkey, China |
| Recommended experience | 6–12 months of hands-on Microsoft 365 and Entra ID experience |
| Related certifications | AB-900 (Fundamentals on-ramp), AB-620 (AI Agent Builder Associate, for builders rather than administrators) |
| What it replaces | MS-102: Microsoft 365 Administrator, retiring 30 Nov 2026 |
Practice with scenario questions built around all three AB-650 domains
TestPrepTraining.ai’s AB-650 practice tests are mapped to the official skills-measured outline covered in this guide — realistic, scenario-based questions across tenant administration, governance, and AI services, each with a detailed explanation of the reasoning behind the answer.
Frequently Asked Questions
The bottom line
AB-650 rewards candidates who study by the exam’s actual weighting rather than by what feels familiar. Give Domain 2’s governance and security content the largest, earliest block of your study time, treat Domain 3’s agent and Copilot governance material as genuinely new learning rather than a light add-on, work around the licensing limits on hands-on practice with strong documentation study, and lean on the official skills-measured outline heavily while no Microsoft practice assessment exists. Do that, and a beta exam most candidates are still figuring out becomes a straightforward, well-mapped target instead of a moving one.


