Microsoft Updated AB-650 Exam Questions and Answers by kate

Microsoft Entra ID supports the ForceDelete operation for removing custom domains that still have references to directory objects. This operation automatically updates supported references, reducing the need for manual administrative changes.

Option C is correct because the domain meets the main ForceDelete prerequisites: it uses managed authentication, is not the default domain, and has fewer than 1,000 references.

However, Microsoft explicitly requires administrators to update or remove domain references from Exchange-managed objects, including mail-enabled security groups and distribution lists, before executing ForceDelete.

After these references are removed, ForceDelete can automatically update eligible user principal names, email addresses, proxy addresses, group addresses, and application identifier URIs to the tenant ' s initial onmicrosoft.com domain.

Option A is incorrect because manually updating all 750 references creates unnecessary administrative effort.

Option B is incorrect because ForceDelete cannot automatically remove all Exchange-managed dependencies. The mail-enabled security group references must be corrected first.

Option D is incorrect because a default domain cannot be deleted while it remains designated as the default.

Therefore, clearing the Exchange-managed references and using ForceDelete is the most efficient supported approach.

Microsoft References:

Microsoft Learn — Manage custom domain names and ForceDelete .

Microsoft Graph — domain: forceDelete .

Microsoft 365 Copilot relies on secure WebSocket (WSS) connections to support real-time, bidirectional communication between client applications and Microsoft cloud services.

Option A is correct because the reported Network connectivity insight specifically identifies WebSocket connection failures for hosts within *.cloud.microsoft.

Microsoft documentation explains that this insight occurs when a network device or web proxy prevents successful WebSocket connections. Administrators should configure the affected proxy to permit WebSocket protocol connections, including the HTTP-to-WebSocket upgrade process, for the required Microsoft 365 endpoints.

Because the problem affects only Branch1, the configuration should be applied to the Branch1 web proxy policy. This resolves the connectivity issue without changing policies for other offices.

Option B is incorrect because the reported failure concerns WebSocket connectivity, not DNS resolution or regional endpoint selection.

Option C is incorrect as the best answer because TLS inspection can interfere with WebSocket connections, but the scenario does not establish that TLS inspection is the cause. Exempting endpoints from TLS inspection may be appropriate after further diagnosis, but allowing the required WebSocket protocol directly addresses Microsoft ' s reported insight.

Option D is incorrect because standard HTTPS connectivity already succeeds. Allowing HTTPS alone does not guarantee successful WebSocket protocol upgrades.

Therefore, the Branch1 proxy must allow WSS connections to the required Microsoft 365 hosts.

Microsoft References:

Microsoft 365 Network Insights .

Review Microsoft 365 network connection failures and WebSocket errors .

Connect-MgGraph -Scopes: User.Read.All; $users =: Get-MgUser

Completed PowerShell Script:

Import-Module Microsoft.Graph

Connect-MgGraph -Scopes " User.Read.All "

$users = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,UserType,OnPremisesSyncEnabled

$users | Select-Object Id,DisplayName,UserPrincipalName,UserType,OnPremisesSyncEnabled |

Export-Csv -Path " C:\Exports\Users.csv " -NoTypeInformation

Disconnect-MgGraph

Microsoft Graph PowerShell provides delegated access to Microsoft Entra user objects through Microsoft Graph permission scopes. The script requires both an appropriate read permission and a command capable of retrieving every user.

First selection: User.Read.All.

The delegated User.Read.All permission allows the application to read users ' full profiles. This includes properties beyond the basic identity information exposed through User.ReadBasic.All.

The requested UserType and OnPremisesSyncEnabled properties are not part of the limited basic profile available through User.ReadBasic.All.

Although Directory.Read.All could also provide access, it grants broader directory-reading privileges. Consequently, User.Read.All is the least-privileged appropriate scope for the stated requirements.

Second selection: Get-MgUser.

The Get-MgUser cmdlet retrieves Microsoft Entra user objects. The -All parameter retrieves results across all available pages, ensuring that the export is not limited to the first page.

The -Property parameter explicitly requests the required attributes, including OnPremisesSyncEnabled, which is not returned in the default property set.

Finally, Select-Object selects the exported columns, Export-Csv creates the CSV file, and Disconnect-MgGraph ends the Graph session.

Microsoft References:

https://learn.microsoft.com/en-us/graph/permissions-reference

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/get-mguser

Microsoft Entra pass-through authentication (PTA) enables users to authenticate to Microsoft 365 using their existing on-premises Active Directory credentials while ensuring that password validation occurs against the on-premises Active Directory environment.

With pass-through authentication, Microsoft Entra ID receives the cloud sign-in request and communicates with a pass-through authentication agent installed on an on-premises, domain-joined Windows Server.

The agent validates the submitted credentials against Active Directory Domain Services and returns the authentication result to Microsoft Entra ID.

This approach allows organizations to maintain password validation against their existing domain controllers while providing users with access to Microsoft 365 cloud services.

Option B is incorrect because Microsoft Entra seamless single sign-on reduces authentication prompts for domain-joined users but does not independently determine where password validation occurs.

Option C is incorrect because certificate-based authentication uses X.509 certificates rather than authenticating users through their existing domain passwords.

Option D is incorrect because password hash synchronization enables Microsoft Entra ID to validate passwords in the cloud using synchronized password hashes. It does not satisfy the requirement that password authentication occur against the on-premises domain.

Pass-through authentication therefore meets both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta