Microsoft · AB-900
Validates knowledge of Microsoft 365 core services, data protection, governance, and Copilot and agent administration. Covers Microsoft Entra, Microsoft Purview, and the admin centers for Exchange Online, SharePoint, and Teams.
Practice Questions
700
≈ 14 practice exams
Duration
60 minutes
Passing Score
700/1000
Difficulty
FoundationalLast Updated
Mar 2026
Use this AB-900 practice exam to prepare for Microsoft 365 Certified: Copilot and Agent Administration Fundamentals (AB-900) with realistic questions, detailed explanations, and focused study modes. The practice bank includes 700 questions for Microsoft AB-900, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to recurring topics such as Core Features and Objects of Microsoft 365 Services, Microsoft 365 Security Principles and Zero Trust, Microsoft Entra and Conditional Access, Microsoft Purview Data Protection and Governance, and Data Security Implications of Microsoft 365 Copilot. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
The Microsoft 365 Certified: Copilot and Agent Administration Fundamentals (AB-900) is a beginner-level certification that validates foundational knowledge of Microsoft 365 core services, security, data protection, governance, and the administration of Microsoft 365 Copilot and AI agents. It demonstrates the ability to support, secure, and protect an AI-enabled Microsoft 365 environment. The exam covers the full breadth of the Microsoft 365 ecosystem, including Exchange Online, SharePoint, Microsoft Teams, Microsoft Entra for identity and access management, and Microsoft Purview for compliance and data protection.
First made available as a beta and reaching general availability on January 27, 2026, AB-900 reflects the growing organizational need to govern AI-powered productivity tools responsibly. It addresses how Microsoft Graph influences Copilot responses, how permissions and sensitivity labels protect data in Copilot interactions, and how administrators can monitor and manage both Copilot licenses and AI agents through the Microsoft 365 admin center, Microsoft Power Platform admin center, and related tooling. It is the entry-level counterpart to more advanced Copilot and Microsoft 365 administration role-based certifications.
This certification is designed for IT administrators, support engineers, and helpdesk professionals who work in or are entering Microsoft 365 environments where Copilot and AI agents are being deployed. It is appropriate for those in roles such as Microsoft 365 administrator, junior cloud administrator, IT generalist, or modern workplace engineer who need to demonstrate foundational competence in managing and securing AI-driven productivity tools.
The certification is also well-suited for business technology professionals, compliance officers, or governance specialists who interact with Microsoft Purview, Microsoft Entra, and Copilot administration. Candidates should have experience with AI-driven productivity tools and modern IT management practices, and a working familiarity with Microsoft 365 admin centers.
There are no formal prerequisites required to sit for the AB-900 exam. However, Microsoft recommends candidates have hands-on familiarity with Microsoft 365 core services and admin centers, including Exchange Online, SharePoint in Microsoft 365, Microsoft Teams, Microsoft Entra, and Microsoft Purview. Candidates should understand core security concepts such as authentication methods, conditional access policies, Zero Trust principles, and single sign-on (SSO).
Practical experience with AI-driven productivity tools and a basic understanding of how Microsoft 365 Copilot accesses organizational data via Microsoft Graph is strongly recommended. Familiarity with licensing models, user and group management, and compliance tooling in Microsoft Purview will also help candidates succeed on the exam.
The AB-900 exam is a proctored assessment with a 45-minute time limit. It may include interactive components in addition to traditional question formats. The exam is delivered in English through Pearson VUE, and students and educators may also schedule through Certiport. A score of 700 out of 1000 is required to pass.
Most questions cover features that are Generally Available (GA), though questions on Preview features may appear if those features are commonly used. Candidates who need the exam in a non-English language may request an additional 30 minutes. If a candidate fails, they may retake the exam after 24 hours; subsequent retake wait times vary per Microsoft's retake policy.
Earning the AB-900 certification positions professionals as credible administrators in organizations adopting Microsoft 365 Copilot and AI agents, a rapidly expanding segment of enterprise IT. It serves as a foundation for more advanced Microsoft 365 certifications, such as the Microsoft 365 Certified: Administrator Expert or role-based associate certifications covering security, compliance, and identity. As organizations accelerate AI tool deployment, the ability to govern, secure, and administer Copilot environments is increasingly listed as a required or preferred qualification in Microsoft 365 administrator job postings.
Because AB-900 is a foundational-level certification, it is particularly valuable for professionals transitioning into cloud administration or seeking to formalize existing knowledge. It complements other Microsoft fundamentals certifications and is recognized in procurement, compliance, and IT operations roles where demonstrable knowledge of AI governance in Microsoft 365 is required. Salary impact varies by region and role, but Microsoft 365 administrators with AI governance skills are increasingly in demand as enterprises scale Copilot deployments.
5 sample questions with answers and explanations. The full bank has 700 questions, enough for 14 full-length practice exams.
Preview — answers shown1. Contoso has deployed Microsoft 365 Copilot and wants to apply Conditional Access policies specifically targeting the Copilot service. The security team discovers that Microsoft 365 Copilot is not visible in their Conditional Access app picker. What should the administrator do to make Microsoft 365 Copilot available as a target resource in Conditional Access policies? (Select one!)
Explanation
Microsoft 365 Copilot and Microsoft Security Copilot are not automatically included in the Conditional Access app picker or the All Resources selection. Administrators must manually create the service principal using the New-MgServicePrincipal cmdlet with AppId fb8d773d-7ef8-4ec0-a117-179f88add510 for Enterprise Copilot Platform. This makes Copilot available as a targetable resource in Conditional Access policies. Enabling it through the M365 admin center Copilot settings does not register the service principal for Conditional Access. Entra ID P2 is not required specifically for this registration. Microsoft does not require a support request for this action as it is a self-service PowerShell operation.
2. Litware has a Microsoft 365 E3 subscription and is deploying Microsoft 365 Copilot. The SharePoint administrator discovers that several sites have content shared with "Everyone Except External Users" (EEEU). The administrator wants to hide this broad permission option from end users to prevent future oversharing. What should the administrator do? (Select one!)
Explanation
Using PowerShell to hide the Everyone Except External Users claim from the People Picker control prevents end users from selecting this broad permission group when sharing content. This is a proactive safeguard recommended by Microsoft to reduce accidental oversharing risks before deploying Copilot. Disabling external sharing does not affect internal broad-scope permissions like EEEU. Restricted SharePoint Search is a temporary measure that limits search scope but does not remove or hide permission options. Applying sensitivity labels with encryption protects content but does not prevent users from sharing with EEEU in the first place.
3. Litware's security administrator is evaluating Microsoft Defender XDR components. Which Defender XDR component specifically monitors on-premises Active Directory Domain Services domain controllers to detect lateral movement and compromised accounts? (Select one!)
Explanation
Microsoft Defender for Identity specifically monitors on-premises Active Directory Domain Services domain controllers to detect lateral movement, compromised accounts, and identity-based threats. It analyzes network traffic and user behavior patterns to identify suspicious activities targeting organizational identities. Defender for Endpoint protects devices and endpoints with preventive protection, EDR, and vulnerability management. Defender for Cloud Apps focuses on SaaS application security including cloud app discovery and session controls. Defender for Office 365 protects email and collaboration tools with Safe Links, Safe Attachments, and anti-phishing capabilities.
4. Fabrikam has both a 7-year retention policy and a 3-year deletion policy applied to the same SharePoint document library. An employee asks what will happen to documents in the library after 3 years. What is the outcome based on Microsoft Purview's principles of retention? (Select one!)
Explanation
Microsoft Purview's principles of retention state that retention always wins over deletion, and the longest retention period wins. When a 7-year retention policy and a 3-year deletion policy both apply to the same content, the content is retained for the full 7 years. Administrators are not prompted to resolve the conflict because the principles of retention automatically resolve it. The recycle bin scenario described does not reflect how retention policies work in Microsoft Purview.
5. Adatum Corporation has configured six Responsible AI principles for their Microsoft 365 Copilot deployment. During a governance review, they need to identify which principle ensures that users always know they are interacting with an AI system and can understand how design decisions were made. Which Responsible AI principle addresses this requirement? (Select one!)
Explanation
Transparency is the Responsible AI principle that ensures users know they are using AI, that design decisions are communicated clearly, and that source citations are provided. Microsoft implements transparency by making it clear when users interact with Copilot and providing references for generated content. Fairness focuses on treating everyone equally and avoiding differential treatment of similar groups. Accountability defines clear roles and responsibilities and establishes ethical standards with auditable chains. Inclusiveness focuses on empowering everyone and providing alternative interaction methods for accessibility.
Microsoft Certified: Security Operations Analyst Associate (SC-200)
SC-200 · 599 questions
Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ-802)
AZ-802 · 600 questions
Microsoft 365 Certified: Administrator Expert (MS-102)
MS-102 · 965 questions
Microsoft 365 Certified: Fundamentals (MS-900)
MS-900 · 1201 questions
Administering Information Security in Microsoft 365 (SC-401)
SC-401 · 939 questions
Administering Windows Server Hybrid Core Infrastructure (AZ-800)
AZ-800 · 898 questions
$17.99
One-time access to this exam