Hands-on labs

These hands-on labs give you practice configuring, securing, and governing Microsoft 365 tenants, workloads, Microsoft 365 Copilot, and agents. They complement the AB-650 learning paths on Microsoft Learn.

New to these labs?Read about the lab environment, the AllFiles (F:) drive, and how the labs build on each other.
Get started

7 labs · 450 minutes of hands-on practice · Complete the labs in order. They build on one Microsoft 365 E7 lab tenant, and no Azure subscription is required.

Learning path 1: Configure and manage Microsoft 365 tenants and workloads2 labs · 110 minutes

Related training on Microsoft Learn: Configure and manage Microsoft 365 tenants and workloads

Lab 1: Operate the Microsoft 365 tenant

40 minutesLevel 3003 exercises

Set the organization baseline, assign and troubleshoot service entitlements with group-based licensing, and investigate tenant health, connectivity, and recovery readiness up to the Microsoft 365 Backup billing boundary.

  1. Establish the organization baseline (10 min)
  2. Assign and troubleshoot service entitlements (15 min)
  3. Investigate health, connectivity, and recovery readiness (15 min)

Lab 2: Enable collaboration and govern its content

70 minutesLevel 3002 exercises

Deliver a working collaboration space with a delegated shared mailbox, a team with a private channel, and a meeting Copilot policy, then create finance sites, remove an excessive access grant, and separate permission enforcement from Copilot discovery.

  1. Deliver a working collaboration space (35 min)
  2. Correct exposure and verify discovery (35 min)
Learning path 2: Govern and secure Microsoft 365 tenants and workloads3 labs · 195 minutes

Related training on Microsoft Learn: Govern and secure Microsoft 365 tenants and workloads

Lab 3: Administer identities and delegated access

40 minutesLevel 3002 exercises

Bulk-create and verify accounts with least-privileged Microsoft Graph PowerShell, compare a mail contact with a guest, scope a helpdesk role with an administrative unit, and run a PIM activation through approval, deactivation, and audit correlation.

  1. Change the directory population (20 min)
  2. Delegate an administrative task (20 min)
Lab files: F:\Lab03\new-hires.csv

Lab 4: Control sign-in and protect communications

100 minutesLevel 3004 exercises

Configure scoped authentication and recovery controls, evaluate Conditional Access decisions, set Defender for Office 365 protection scope, and interpret sample investigation evidence before creating a draft training campaign.

  1. Configure method and recovery policy (25 min)
  2. Resolve an access decision (30 min)
  3. Set effective protection scope (25 min)
  4. Investigate and plan training (20 min)

Lab 5: Protect and govern information

55 minutesLevel 3002 exercises

Create and test Microsoft Purview classification, sensitivity-label, DLP, retention, and DSPM controls with sample finance content.

  1. Classify and publish (20 min)
  2. Prevent loss and govern lifecycle (35 min)
Lab files: F:\Lab05\Lab5-SIT-Match.txt, F:\Lab05\Lab5-SIT-NearMiss.txt, F:\Lab05\Lab5-DLP-Worksheet.txt
Learning path 3: Manage and secure Microsoft 365 AI services2 labs · 145 minutes

Related training on Microsoft Learn: Manage and secure Microsoft 365 AI services

Lab 6: Roll out and administer Copilot and Cowork

60 minutesLevel 3003 exercises

Gate a Microsoft 365 Copilot rollout, route Copilot settings to the right admin controls, and scope Microsoft 365 Copilot Cowork with the tenant credit method.

  1. Gate a Copilot rollout (10 min)
  2. Match Copilot controls to experiences (20 min)
  3. Grant, use, and observe Cowork (30 min)
Lab files: F:\Lab06\17-cowork-consumption-practice.csv

Lab 7: Govern agents and operate AI services

85 minutesLevel 3005 exercises

Establish accountable agent identity and access, curate the Agent Registry and tools, monitor the agent estate, govern sharing and availability, and operate Microsoft 365 AI services.

  1. Establish agent identity and access (30 min)
  2. Curate the Agent Registry and tools (20 min)
  3. Monitor the agent estate (15 min)
  4. Govern agent sharing and availability (10 min)
  5. Operate Microsoft 365 AI services (10 min)