CertPractice

AB-900 study guide

AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals practice questions

Microsoft 365 core services, identity and security, Microsoft Purview data protection and governance, and basic administration of Microsoft 365 Copilot and agents. Mapped to the skills measured as of October 14, 2026.

Start free practice Official from Microsoft: Exam page · Study guide (skills measured)

Skills measured

3 skill areas and 53 objectives, as of October 14, 2026. Weights show the share of the exam each area makes up.

Identify the core features and objects of Microsoft 365 services (30-35%)
  • 1.1 Explain how license types assigned to users and groups affect access to Microsoft 365 features
  • 1.2 Explore the organization configurations by using the Microsoft 365 admin center (domain names and org settings)
  • 1.3 Identify the appropriate objects to configure by using the Exchange admin center (mailboxes and distribution groups)
  • 1.4 Identify the appropriate objects to configure by using the SharePoint admin center (sites, libraries, and folders)
  • 1.5 Identify the appropriate roles and permissions for sites in SharePoint in Microsoft 365
  • 1.6 Identify the appropriate objects to configure by using the Teams admin center (teams, channels, and policies)
  • 1.7 Explain the core Zero Trust principles
  • 1.8 Understand authorization
  • 1.9 Understand authentication methods
  • 1.10 Understand threat protection and intelligence
  • 1.11 Understand features and capabilities of Microsoft Defender XDR
  • 1.12 Understand features and capabilities of Microsoft Entra ID
  • 1.13 Understand conditional access policies
  • 1.14 Understand the purpose and benefits of SSO
  • 1.15 Identify the appropriate security object to use in an organization (users and groups)
  • 1.16 Identify the appropriate tools to troubleshoot common sign-in issues (multifactor authentication [MFA], conditional access, and risky sign-ins)
  • 1.17 Interpret Identity Secure Score in Microsoft Entra ID
  • 1.18 Use the appropriate tools to review audit logs for user and admin activity
  • 1.19 Identify the role of Privileged Identity Management (PIM) in an organization
  • 1.20 Understand App registrations and Enterprise applications
Understand data protection and governance tasks for Microsoft 365 and Copilot (35-40%)
  • 2.1 Understand features and capabilities of Microsoft Purview Information Protection, DLP, Insider Risk Management, Communication Compliance, DSPM for AI, and Data Lifecycle Management
  • 2.2 Identify the use cases for sensitivity labels in Microsoft Purview
  • 2.3 Understand data classification in Microsoft Purview
  • 2.4 Understand retention
  • 2.5 Understand how Copilot accesses data
  • 2.6 Understand how Microsoft Graph influences Copilot responses
  • 2.7 Understand how Copilot uses permissions and other controls in Microsoft 365, Microsoft Purview, and Microsoft Defender to protect against risks
  • 2.8 Understand responsible AI principles
  • 2.9 Identify compliance risks and recommendations by using Microsoft Purview Compliance Manager
  • 2.10 Identify sensitive information by using Microsoft Purview Data Explorer
  • 2.11 Identify risks by using Insider Risk Management
  • 2.12 Identify and respond to alerts generated by Microsoft Purview DLP
  • 2.13 Identify policy violations generated by Communication Compliance
  • 2.14 Identify user activities reported by Microsoft Purview activity explorer
  • 2.15 Discover and manage AI activity by using DSPM for AI
  • 2.16 Search for files and emails by using Content search in Microsoft Purview eDiscovery
  • 2.17 Identify the tools to troubleshoot oversharing in an organization
  • 2.18 Run a data access governance report in SharePoint
  • 2.19 Understand features and capabilities of SharePoint Advanced Management, including restricted access control
Perform basic administrative tasks for Copilot and agents (25-30%)
  • 3.1 Compare the built-in capabilities of Copilot and agents
  • 3.2 Compare Copilot monthly license model to pay-as-you-go, including SharePoint
  • 3.3 Identify which Copilot features can be enabled or disabled
  • 3.4 Identify use cases for Researcher
  • 3.5 Identify use cases for Analyst
  • 3.6 Identify use cases for custom agents
  • 3.7 Assign Copilot licenses
  • 3.8 Monitor and manage Copilot pay-as-you-go billing policies
  • 3.9 Monitor Copilot usage and adoption, including Copilot Analytics and the Microsoft 365 admin center
  • 3.10 Manage prompts, including saving, sharing, scheduling, and deleting
  • 3.11 Identify how to configure user access to agents
  • 3.12 Create an agent
  • 3.13 Understand approval process for agents
  • 3.14 Monitor agents, including usage, operational insights, and agent lifecycle, by working with the Microsoft 365 admin center and the Microsoft Power Platform admin center

Sample questions

Sample question 1 · Identify the core features and objects of Microsoft 365 services

A user has a Microsoft 365 E3 license, but the admin turned off the Exchange Online service plan inside that license. What is the result for the user?

  1. A. The user loses access to every app and service included in the E3 license
  2. B. The license is automatically converted to a trial license
  3. C. The user keeps the mailbox but cannot sign in to Teams
  4. D. Other services still work, but there is no Exchange Online mailbox
Show answer and explanation

Answer: D

Licenses are made up of service plans that can be turned on or off individually. Turning off Exchange Online removes only mailbox access; the other services in the license keep working.

Learn more: Understand subscriptions and licenses in Microsoft 365 for business · Assign or unassign licenses to a group in the Microsoft 365 admin center

Sample question 2 · Understand data protection and governance tasks for Microsoft 365 and Copilot

A company wants to stop users from emailing or sharing files that contain credit card numbers with people outside the organization. Which Microsoft Purview solution should it use?

  1. A. Data Lifecycle Management
  2. B. Insider Risk Management
  3. C. Data Loss Prevention
  4. D. Communication Compliance
Show answer and explanation

Answer: C

Data Loss Prevention (DLP) policies detect sensitive information such as credit card numbers and can warn or block when it is shared. Data Lifecycle Management controls how long content is kept, and Insider Risk Management correlates risky user behavior over time.

Learn more: Copilot Control System Security and Governance · Compare Microsoft 365 Copilot Features in E3 and E5 Licenses

Sample question 3 · Perform basic administrative tasks for Copilot and agents

A user without a Microsoft 365 Copilot license signs in with a work account and opens Microsoft 365 Copilot Chat. What are Copilot Chat responses grounded in by default?

  1. A. Every Teams chat and channel message in the organization
  2. B. Web data, with enterprise data protection applied
  3. C. Only the SharePoint sites the user has visited
  4. D. The user's mailbox, calendar, and OneDrive files
Show answer and explanation

Answer: B

Copilot Chat is web-grounded by default and applies enterprise data protection for signed-in work accounts. Grounding in the user's mailbox, calendar, files, and chats through Microsoft Graph requires a Microsoft 365 Copilot license.

Learn more: What is Microsoft 365 Copilot? · Agents admin guide for Microsoft 365

Sample question 4 · Identify the core features and objects of Microsoft 365 services

An organization wants users to have email addresses ending in @contoso.com instead of the initial onmicrosoft.com domain. Where does the admin start?

  1. A. SharePoint admin center, Settings, Site creation
  2. B. Exchange admin center, Mail flow, Connectors
  3. C. Microsoft 365 admin center, Settings, Domains
  4. D. Teams admin center, Org-wide settings
Show answer and explanation

Answer: C

Custom domains are added and verified under Settings > Domains in the Microsoft 365 admin center. Exchange connectors, Teams org-wide settings and SharePoint site settings do not add domains to the tenant.

Learn more: Microsoft 365 admin center - Overview · Add a custom domain to Microsoft 365

Sample question 5 · Understand data protection and governance tasks for Microsoft 365 and Copilot

What does applying a sensitivity label to a document do?

  1. A. Classifies the document and can apply protection like encryption
  2. B. Scans the document for malware before it can be shared
  3. C. Moves the document into a secure archive that only admins can open
  4. D. Keeps the document for a set period and then deletes it
Show answer and explanation

Answer: A

Sensitivity labels classify content and can apply protection such as encryption, watermarks, headers, and footers. Keeping and deleting content is the job of retention labels and policies, and malware scanning is a Microsoft Defender capability.

Learn more: Set up information protection capabilities · Microsoft 365 Copilot data protection architecture

Frequently asked questions

How many AB-900 practice questions are there?

245 original questions covering all 53 objectives in Microsoft's skills outline (skills measured as of October 14, 2026). Each one has an explanation, and most link to the relevant Microsoft Learn page.

Is it free?

The first 10 questions are free, with no account needed. Unlocking the full set costs US$9.99 for 30 days of access.

Are these real exam questions?

No. Every question is written from scratch and mapped to the published skills outline. They are not copied from the real exam, so they help you learn the material rather than memorize answers.

How does practice differ from exam mode?

Practice mode lets you check or view the answer after each question. Exam mode is timed (45 minutes), shuffles questions and answers, and scores you at the end.

Practice all AB-900 questions