AB-650 Microsoft 365 and AI Services Administrator Roadmap

Build a reliable Microsoft 365 administration baseline before layering security or AI services.

• Configure branding, organization profile, privacy and security settings, verified domains, DNS, and the default domain
• Manage users, groups, contacts, licenses, group-based licensing, processing errors, pay-as-you-go, and AI service licenses
• Monitor Microsoft 365 Copilot, Agent 365, and Copilot Studio entitlement and utilization
• Create shared mailboxes and manage Exchange recipients and delegated access
• Create teams, channels, owners, members, guests, external access, and meeting transcription or Copilot settings
• Create SharePoint sites and manage owners, permissions, sharing, OneDrive, Microsoft Search, and site exclusions
• Configure Microsoft 365 Backup protection, restore content, validate recovery, and monitor operations
• Use Service health, notifications, Network Connectivity Insights, and documented escalation paths

Verify explicitly, use least privilege, and assume breach across users, guests, administrators, and supported agent identities.

• Create and manage users, guest users, contacts, groups, Microsoft 365 groups, administrative units, and scoped roles
• Use bulk operations and Microsoft Graph PowerShell with least-privilege permissions and auditable output
• Review external access, guest sponsorship, memberships, entitlement, inactivity, and removal
• Replace standing privileged roles with eligible PIM assignments where appropriate
• Configure role activation duration, MFA or authentication context, justification, approval, notification, and access review
• Configure authentication methods, phishing-resistant strengths, Password Protection, and SSPR
• Investigate sign-in, registration, password-reset, and authentication-method issues from logs and diagnostics
• Plan Conditional Access scope, emergency access, report-only testing, What If, staged enforcement, and rollback
• Use ID Protection risk signals and require risk-appropriate remediation where licensing supports it

Protect collaboration and sensitive information through layered prevention, detection, investigation, response, and lifecycle controls.

• Review the Defender for Office 365 protection stack, Standard and Strict presets, and justified custom policies
• Configure anti-phishing, anti-spam, anti-malware, Safe Links, Safe Attachments, reporting, quarantine, and Tenant Allow/Block List governance
• Investigate email and collaboration alerts through incidents, Explorer, entity pages, submissions, and automated investigation evidence
• Plan authorized attack simulation training with safe payloads, target groups, training, notifications, privacy, and support
• Define sensitive information types, sensitivity labels, label policies, encryption, markings, and auto-labeling where supported
• Design DLP intent, locations, scope, conditions, actions, policy tips, override, alerts, simulation, tuning, and enforcement
• Create retention labels, retention-label policies, and retention policies for keep, delete, records, and Copilot interaction requirements
• Use Activity explorer, audit, DLP alerts, and Defender correlation to investigate data events
• Apply administrative scoping and separation of duties to security and compliance administration

Enable Copilot only after identity, workload, permission, content, policy, cost, support, and network readiness are measurable.

• Assess licenses, in-app experiences, network, Service health, organizational settings, support, and pilot personas
• Find and remediate SharePoint and OneDrive oversharing, broad groups, anonymous links, stale sites, missing owners, and obsolete content
• Use SharePoint Advanced Management, data access governance, DSPM data-risk assessments, search restrictions, or site exclusions appropriately
• Validate direct access, Microsoft Search, Copilot Search, and Copilot responses with controlled authorized and unauthorized personas
• Configure web search, Microsoft 365 Copilot Search, release preferences, self-service purchase, AI disclaimer, and generation settings
• Manage Copilot user experiences, Copilot Cowork, third-party AI providers, and current tenant capabilities according to policy
• Review Copilot connectors for source ownership, indexed data, ACL mapping, crawl scope, data flow, cost, monitoring, and retirement
• Use labels, DLP, retention, audit, DSPM, and Defender evidence to protect and investigate AI activity
• Teach users to validate output, handle sensitive data, report issues, and understand that Copilot honors existing access rather than repairing it

Operate agents as accountable identities and governed applications with bounded tools, data, access, monitoring, cost, and lifecycle.

• Use Microsoft Entra Agent ID to manage agent owners, sponsors, authentication, authorization, lifecycle workflows, risk, sign-ins, and audit
• Secure agent access with dedicated identities, access packages, narrow permissions, Conditional Access where supported, reviews, and expiration
• Configure allowed agent types, sharing, templates, user access, and ownership expectations
• Discover Microsoft and third-party agents in Agent Registry and review pending requests
• Publish, reject, install, block, upload, scope, version, re-review, or retire agents according to documented criteria
• Limit Agent 365 tools by purpose, identity, resource, input, destination, and human approval for consequential actions
• Monitor Agent 365 activity, sensitive-data access, DLP, DSPM, Defender, audit, compliance gaps, owner status, and lifecycle
• Monitor Copilot and AI cost, Copilot Credits, license utilization, workload-level adoption, task outcomes, support, and incidents
• Use Copilot Control System and Microsoft 365 Service health to monitor adoption and reliability
• Complete both projects, review every domain, explain distractors, and rehearse expansion, containment, rollback, and retirement