Independent: not affiliated with Microsoft. Free to try; the study bundle adds a study guide and two practice exams.
5 original questions, none of them in the practice exams.
Pick an answer. Show answer explains every option and links its Microsoft source.
5 questions / Explanations link Microsoft sources / Last updated Oct 26, 2026
Question 1
Multiple choice
Domain 1 / Task 1.2 Manage Microsoft 365 workloads
The site administrators of Contoso's Legal site want to turn Restricted Content Discovery on and off for their own site during a permissions review, instead of filing a ticket with the SharePoint administrators each time. They must not be given any tenant-wide admin role. What should a SharePoint administrator do?
Show answerHide answer
Answer: A
Why
By default only SharePoint administrators can manage Restricted Content Discovery. Enabling delegation with Set-SPOTenant -DelegateRestrictedContentDiscoverabilityManagement $true lets site administrators manage the setting for their own sites. Each change a site administrator makes requires a justification, and enabling, disabling and the justifications are recorded as Microsoft Purview audit events.
Why not the others
BThe requirement rules out a tenant-wide admin role, and SharePoint Administrator controls every site in the tenant, not one site's discovery setting.
CThat turns the setting on once from the admin side, does not let the site administrators manage it, and the setting can be turned off again with -RestrictContentOrgWideSearch $false.
DUntil delegation is enabled at the tenant level, only SharePoint administrators can manage the setting.
Domain 2 / Task 2.1 Manage identities in Microsoft Entra
Proseware applies a 180-day expiration policy to all Microsoft 365 groups, and the policy lists an email address for notices about groups that have no owner. The group behind the Site Relocation team lost its only owner when she left the company, and for months nobody has visited the team's channels, opened its SharePoint files or read or sent group mail. Who is told that the group is about to expire, and what happens if nobody acts?
Show answerHide answer
Answer: B
Why
Groups with recent user activity in Outlook, SharePoint, Teams or Viva Engage are renewed automatically, so an inactive group is not. Owners get renewal notices 30, 15 and 1 day before expiration, and for a group without an owner the renewal and expiration notifications go to the email address set in the expiration policy. A group that is not renewed is deleted one day after its expiration date; its owners or an administrator can restore it within 30 days, a period that cannot be customized.
Why not the others
AThe notices go to the email address set in the policy, not to the group's own mailbox, and a group that is not renewed is deleted, not archived.
CThe notices go to the group's owners, or to the email address set in the policy when there is no owner, not to the group's own mailbox, and the 30-day restoration period is fixed rather than set in the policy.
DA group that is not renewed is deleted, not archived, and the 30-day restoration period is fixed rather than set in the policy.
Domain 2 / Task 2.4 Protect data with Microsoft Purview
A DLP policy for the Microsoft 365 Copilot and Copilot Chat location blocks prompts that contain a custom sensitive information type for customer account numbers. Policy Tips are turned off in the rule's user notification settings. Blocked users keep opening help desk tickets because the Learn about access restrictions link in the block message opens Microsoft Learn rather than Contoso's own data handling page on its compliance SharePoint site. The block must stay in place. Which two changes should you make to the DLP rule? Choose two.
Show answerHide answer
Answers: A and E
Why
Policy Tips must be on in the rule's user notification settings, and the compliance URL option points the Learn about access restrictions link at an existing page the affected users can open, entered as a full URL with https:// and the domain name. No new website is needed; an existing SharePoint, help desk or compliance page works. Only the link destination changes: the standard Copilot block message, the link text and the DLP enforcement action stay as they are.
Why not the others
BRewording the message would not change where the link opens; the compliance URL setting changes only the link destination, and the standard block message and link text stay as they are.
CA different action would remove the block the policy must keep.
DCopilot connectors bring external content into Copilot's grounding; the policy tip link just needs a page the users have permission to access.
Domain 3 / Task 3.1 Enable and manage Microsoft 365 Copilot
Northwind's procurement team has Cowork access through a spending policy and wants Cowork to fill in order forms on supplier portals, so you plan to turn on Cowork Browsing. The security team will agree only if the Microsoft Edge allowlist and blocklist policies it already enforces still apply to Cowork's browsing and every browser task is logged. What should you tell the security team?
Show answerHide answer
Answer: D
Why
Cowork completes web tasks in Microsoft Edge on the user's device, using the user's existing sign-ins, so browser tasks inherit the Conditional Access, DLP and tenant browsing policies already applied to that user, and Cowork respects the allowlist, blocklist and view-only policies the organization applies to Edge. Each browser task Cowork starts on a user's behalf is recorded in the unified audit log alongside other Cowork activity. The Cowork Browsing tenant setting turns the capability on or off, and it is off by default.
Why not the others
ABrowser tasks run in Microsoft Edge on the user's device, not in a hosted browser, and Cowork respects the allowlist, blocklist and view-only policies already applied to Edge, so the sites it can reach are governed there.
BBrowser tasks do count toward usage-based billing, but each one Cowork starts is also recorded in the unified audit log alongside other Cowork activity.
CBoth parts are wrong: Cowork runs in Edge on the user's device under the existing Edge policies, and each browser task is recorded in the unified audit log, not only counted for billing.
Domain 3 / Task 3.1 Enable and manage Microsoft 365 Copilot
Woodgrove has Microsoft 365 E5 but neither the SharePoint Advanced Management add-on nor Microsoft 365 Copilot licenses. A SharePoint administrator opens Reports > Data access governance in the SharePoint admin center for the first time and wants the sharing links report, to see which sites gained the most new sharing links recently. What must the administrator do, and when is the report available?
Show answerHide answer
Answer: A
Why
With Microsoft 365 E5 and no SharePoint Advanced Management, administrators can use the Data access governance activity reports, which return up to 10,000 sites, but data collection must be enabled first. Reports become available 24 hours after collection is enabled, contain only data from that point on, and the data is stored for 28 days; if no reports are generated for three months, collection pauses and must be re-enabled.
Why not the others
BMicrosoft 365 E5 tenants can access Data access governance reporting without the add-on; what they lack are the snapshot reports and the remedial actions.
CIt is the other way round: without SharePoint Advanced Management the snapshot reports are unavailable, and the activity reports, including the sharing links report, are available.
DReports become available 24 hours after collection is enabled and contain only data from when collection was enabled, so there is no earlier history to show.
The study bundle has two practice exams with 120 original questions, an answer key and an explanation for every answer, plus the 60-page study guide. Practice exam explanations are shorter than the ones on this page: a short paragraph per question, with no source links.
Study bundle
$19
120 practice questions / Study guide / Answer keys
Every bundle includes 6 months of access: download the PDFs, and any new editions, until 6 months after your purchase date. Your receipt has a license key. Enter it at overqual.com/download for the three PDFs, stamped with your email and order number. They are yours to keep.