AB-650 — frequently asked questions

No. The Intune app is for device management and compliance. Service health is managed through the Microsoft 365 Admin center or its mobile companion.

Company Portal is for users to enroll devices and check compliance. The Intune app is for installing corporate apps. Neither handles service health.

Mail-enabled security groups have Exchange-specific attributes (like SMTP aliases) tied to the domain. The system requires these to be updated or removed before the domain object itself can be deleted, even with the force flag.

It implies avoiding scripts or actions that require touching hundreds of individual objects (like 750 users). It favors resolving the root dependency (the security groups) rather than individually editing every dependent entity.

No. Deleting a file moves it to the Recycle Bin, but the retention label continues to apply until the full retention period expires from the last modification date.

Modifying the file updates the last-modified timestamp. For retention labels, this resets the retention period, starting the countdown anew from the modification date.

DLP policies can block specific actions, but Sensitivity Labels provide a persistent classification of the data itself. This ensures that the data is protected consistently across all locations and services, including preventing Copilot from indexing it in the first place.

Auto-labeling policies automatically scan content for specified patterns (like the PR-XXXXXXXXX code) and apply labels without manual intervention, reducing the need for ongoing manual classification by administrators.

Device attributes such as deviceOSType and deviceTrustType. User membership or group assignment does not affect the rule unless explicitly included in the filter.

The membership rule (device.deviceTrustType –eq “Workplace”) checks device properties. It does not contain any reference to Group1 or user identities.

The three core components are Locations (where data is scanned), Conditions (criteria for detecting sensitive info), and Actions (steps taken when a violation occurs).

No, a single DLP policy rule applies the same actions across all selected locations. To have different behaviors, you would need separate policies.

No. Service health is for viewing status. You must go to Support > New service request to open a ticket.

Service health monitors Microsoft's infrastructure status. Support is for contacting Microsoft engineers for technical help.

Yes, you can use the New-Mailbox cmdlet in the Exchange Online PowerShell module. However, this question specifically asks for Microsoft 365 portals.

No. The Microsoft Entra admin center manages identities, groups, and access policies, but it does not handle Exchange mailbox creation or permission assignment.

Copilot uses WebSockets (WSS) for persistent connections, not just standard HTTP/HTTPS. Proxies often block WSS upgrades by default, even if they allow regular web traffic.

No, if HTTPS is already succeeding, the firewall is allowing port 443. The blockage is likely at the proxy level where it rejects the WebSocket protocol upgrade.

Message Center communicates planned changes, major updates, and product announcements to help tenants prepare. Service Health monitors the operational status of services, reporting active incidents, degradations, and scheduled maintenance.

No, you must explicitly configure Message Center Preferences in the Microsoft 365 admin center to define which user groups receive Major or Important messages. Without this configuration, users may not see these critical updates.