The correct answer is B. the Microsoft 365 admin center . Microsoft documents that administrators assign product licenses to users from the Microsoft 365 admin center , including on the Active users page where you can open a user account and manage Licenses and apps . Microsoft also documents license assignment workflows there for both direct assignment and group-based licensing scenarios. That makes the Microsoft 365 admin center the standard administrative portal for giving a user access to Microsoft 365 services and features.

The other options are incorrect for this task. The Microsoft Purview portal is used for compliance, governance, data protection, eDiscovery, audit, and related Purview solutions, not for assigning Microsoft 365 product licenses. The Microsoft Teams admin center is used to manage Teams settings, policies, devices, voice, and collaboration features, but it is not the central portal for assigning tenant product licenses to users.

Therefore, when the requirement is simply to assign a license to a user in a Microsoft 365 subscription, Microsoft’s documented answer is the Microsoft 365 admin center .

The correct answer is Activate the role. Microsoft Learn states that in Microsoft Entra Privileged Identity Management (PIM), when a user is made eligible for a Microsoft Entra role, they do not immediately have the permissions of that role. Microsoft specifically explains that eligible users must activate the role assignment before using the role. Only after activation does the user receive the permissions associated with that role for the approved time period.

That means if you are only eligible for the User Administrator role, you cannot create user accounts until you activate that role in PIM. The other options are incorrect because installing Microsoft Authenticator, requesting a license, or updating location information are not the universal prerequisite stated by Microsoft for using an eligible PIM role. Multifactor authentication can be required during activation depending on policy, but the core required action is still to activate the role first. Microsoft also notes that activation can involve entering a reason, selecting a duration, and completing any required approval or MFA steps.

The correct answer is D. the Microsoft 365 admin center . Microsoft Learn states that users with a Microsoft 365 Copilot license can use Copilot capabilities, and Microsoft specifically points administrators to the Microsoft 365 admin center and its setup guidance to assign the required licenses to users. Microsoft also documents that the Researcher and Analyst agents were deployed to existing users with Microsoft 365 Copilot licenses and that administrators govern these agents through the Microsoft 365 admin center .

The other portals are not the primary place for this task. Microsoft Entra admin center focuses on identity and access, Microsoft Purview focuses on compliance and governance, and Microsoft Defender focuses on security operations and threat protection. None of those is the main admin experience Microsoft documents for assigning Microsoft 365 Copilot access and managing the availability of Researcher and Analyst. Because the goal is to enable a user to use Microsoft 365 Copilot and its Microsoft-provided agents, the correct administrative tool is the Microsoft 365 admin center .

The correct answers are A and D because both tasks are supported directly in the Exchange admin center (EAC) . Microsoft Learn states that administrators can manage mail flow rules in Exchange Online from the EAC under Mail flow > Rules , which includes creating and managing transport rules for organizational email handling. Microsoft Learn also states that administrators can create shared mailboxes in the EAC under Recipients > Mailboxes , where a shared mailbox can be added and then delegated to users.

Option B is incorrect because adding a custom domain is normally done in the Microsoft 365 admin center , specifically on the Domains page. Although Exchange can later work with accepted domains and related mail flow settings, the act of adding and verifying a custom domain is not an Exchange admin center task. Option C is incorrect because license assignment is handled through Microsoft 365 or Microsoft Entra administrative tools, not the Exchange admin center.

The correct answer is Microsoft SharePoint sites . Microsoft Learn documents that Microsoft Purview sensitivity labels for containers can be applied to Microsoft Teams, Microsoft 365 groups, and SharePoint sites . These labels can control settings such as privacy, external sharing, and unmanaged device access for the labeled site. That is the official Microsoft feature that matches the sentence in the question.

The other options are not the best match for this item. Microsoft 365 Copilot conversations are not the standard object to which admins directly apply a sensitivity label in the way this question is asking. Copilot can honor labels on source content and may display label context in responses, but the selectable resource here is not “Copilot conversations.” Azure Blob Storage is also not the intended answer in the Microsoft 365 Copilot and Agent Admin context for Purview sensitivity labels.

So for this hotspot, the sentence is correctly completed with Microsoft SharePoint sites , because Microsoft explicitly supports applying Purview sensitivity labels to SharePoint sites as a container-level labeling capability.

The correct answer is Connectors . Microsoft documents that Microsoft 365 Copilot connectors are used to bring external, line-of-business data into Microsoft 365 Copilot so users can search, reason over, and act on content from non-Microsoft systems. Microsoft also states that admins must enable and configure Copilot connectors in the Microsoft 365 admin center , and once configured, those connectors can be selected as knowledge sources for custom agents. This directly matches the requirement to let users use an external system as a knowledge source for custom Microsoft 365 Copilot agents.

This is why the hotspot in the Copilot area should be set to Connectors , not Overview, Agents, Search, Billing & usage, or Settings. Overview provides status information, Agents is for agent management, Search is for Microsoft Search experiences, and Billing & usage is for metering and consumption tracking. The specific admin feature that enables external enterprise data sources for agent grounding is Connectors . Microsoft further explains that configured connectors can expose external knowledge securely and respect source-level permissions when used in agent scenarios.

The correct answer is A. Data access governance in the SharePoint admin center . Microsoft Learn documents Data access governance reports in the SharePoint admin center as the reporting solution used to understand data exposure, including permission structure and sharing link activity . Microsoft specifically states that the site permissions snapshot report provides visibility across SharePoint and OneDrive sites , helping administrators understand current permissions exposure, and that separate reports are created for SharePoint and OneDrive . Microsoft also documents sharing links activity reports as part of Data access governance for monitoring link-sharing activity, and notes that OneDrive support is available through PowerShell for those reports. Together, this is the Microsoft reporting capability aligned with permissions and active sharing links for OneDrive content.

The other options do not fit this requirement. Microsoft 365 admin center reports focus mainly on usage and activity reporting, not detailed permissions and sharing-link governance. Defender Audit is for security investigation activity, and Purview eDiscovery is for legal and investigative content search, not for generating OneDrive permissions and sharing-link governance reports. Therefore, the best Microsoft-documented answer is Data access governance in the SharePoint admin center .

The correct answer is B. the Microsoft Purview DSPM for AI solution . Microsoft documents that Data Security Posture Management for AI (DSPM for AI) in Microsoft Purview provides a central place to secure data for AI apps and proactively monitor AI use , including Copilots and agents . Microsoft also states that DSPM for AI helps organizations identify where sensitive content is used in AI interactions , review Copilot prompts and responses , analyze usage patterns , assess exposure and oversharing risks, and get recommendations for protections such as sensitivity labels and DLP policy coverage.

The other options do not fit this requirement. Microsoft Viva Insights focuses on productivity and work-pattern analytics, not sensitive-data protection in Copilot interactions. Microsoft Security Copilot is a security assistant for analysts, not the Purview governance solution that analyzes sensitive content use in Copilot and recommends data protections. Insider Risk Management is for identifying risky user behavior, not for broad AI interaction posture analysis and protection recommendations. Microsoft specifically positions DSPM for AI as the “front door” for discovering, monitoring, and protecting AI-related data usage in Microsoft 365 Copilot.

The correct answer is A. Microsoft Entra ID Protection . Microsoft Learn explains that Microsoft Entra ID Protection detects sign-in risk and user risk and can work with Conditional Access risk policies to automatically respond when suspicious authentication activity is identified. Microsoft documents specifically state that organizations can configure sign-in risk policies and user risk policies to automate responses such as blocking access , requiring multifactor authentication , or forcing password changes when risky activity is detected. Microsoft also notes that some very high-confidence risky sign-ins are automatically blocked by built-in protections.

The other options do not match this function. Microsoft Defender for Office 365 focuses on email, collaboration, and threat protection for tools like Exchange Online and Teams, not sign-in risk blocking. Microsoft Entra Privileged Identity Management (PIM) manages privileged role activation and governance, not risky sign-in detection. Microsoft Defender for Identity detects identity-related threats in hybrid identity environments, but the Microsoft feature used to automatically block risky sign-ins is Microsoft Entra ID Protection .

The correct answer is D. a sensitivity label policy . In Microsoft Purview, creating a sensitivity label by itself does not make it available to users. Microsoft Learn states that after you create sensitivity labels, you must publish them by creating a label policy so that users and groups can see and apply those labels in Microsoft 365 apps and services. Publishing controls which labels are available and to whom they are shown. This is why a sensitivity label policy is required to ensure that users can apply Label1 to files.

The other options do not meet the requirement. Auto-labeling policies apply labels automatically when content matches conditions, but they are not the primary mechanism for simply making a label available for user selection. A trainable classifier is used to identify content categories, not to publish a label. A retention label policy publishes retention labels for records and lifecycle purposes, which is different from sensitivity labeling for classification and protection. Therefore, the correct Microsoft-documented method to let users apply Label1 to files is to publish it using a sensitivity label policy .