Administering Microsoft 365 and AI Services AB-650 Exam Questions with Experts Answers Updated Recently

Microsoft Exchange Online supports converting an existing user mailbox to a shared mailbox while retaining its historical email content. This is appropriate when the original user no longer needs direct access but other employees must continue using the mailbox.

Option C is correct because converting Mailbox1 into a shared mailbox preserves the existing email messages and enables delegated access for other users.

The mailbox contains 42 GB of data, which is below the standard 50 GB unlicensed shared mailbox limit. Therefore, an additional mailbox license is not required solely because of its current size, provided no separately licensed features are necessary.

Option B is correct because Full Access permission allows Group1 members to open the mailbox and manage existing items. Send As permission enables them to send messages that appear to originate directly from Mailbox1.

Option E is incorrect because Send on Behalf permission displays the individual delegate ' s identity, whereas the requirement specifies that messages must appear to come from Mailbox1.

Option D is incorrect because Litigation Hold is designed for preservation and compliance purposes, not for providing collaborative mailbox access.

Option A is unnecessary for a standard shared mailbox of this size.

Therefore, converting the mailbox and granting Full Access and Send As permissions satisfies all three requirements.

Microsoft References:

https://learn.microsoft.com/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox

https://learn.microsoft.com/en-us/exchange/collaboration/shared-mailboxes/create-shared-mailboxes

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .