AB-900
Microsoft 365 Copilot and Agent Administration Fundamentals
AB-900 Exam Guide: Microsoft 365 Copilot and Agent Administration Fundamentals
AB-900 validates foundational ability to identify Microsoft 365 services and objects, protect and govern Microsoft 365 and Copilot data, and perform basic administration for Copilot and agents. It is aimed at beginning-level technical IT professionals and novice administrators, including learners without prior hands-on experience. This guide helps you decide whether your current Microsoft 365 knowledge is sufficient, which skill area deserves the most study time, and when to use Microsoft’s official practice and exam-preparation tools.
What does AB-900 validate?
AB-900 validates whether you can support, secure, and protect an AI-enabled Microsoft 365 environment at a foundational administrator level. The exam is not limited to Copilot features: it also tests the Microsoft 365 objects, identity controls, security concepts, data protection, governance tools, and administrative centers that Copilot and agents depend on.
Microsoft identifies three assessed capabilities: identifying the core features and objects of Microsoft 365 services; understanding data protection and governance tasks for Microsoft 365 and Copilot; and performing basic administrative tasks for Copilot and agents. These capabilities connect ordinary tenant administration with AI-related controls rather than treating Copilot as a standalone product.
The official study guide says that most questions cover generally available features, although commonly used preview features may also appear. Treat the current study guide as the controlling scope document. Its skills are listed as measured as of July 22, 2026, so review the live guide again before scheduling if your preparation extends beyond that point.
Who should take this exam?
AB-900 is a sensible starting point for a beginning-level technical IT professional or novice administrator who needs a structured introduction to Microsoft 365, Copilot, and agents. Microsoft’s associated AB-900T00-A course states that prior hands-on experience is not required, which makes the exam accessible to learners who are building their first administration foundation.
The target profile is broader than someone who only uses Microsoft 365 applications. Microsoft says candidates should be familiar with core services, security, identity and access, data protection, governance, Microsoft 365 Copilot, and agents. Familiarity with the Exchange Online, SharePoint in Microsoft 365, Microsoft Teams, Microsoft Entra, and Microsoft Purview administration centers is also expected.
Choose AB-900 if your immediate goal is to understand the administrative decisions around Microsoft 365 and AI-enabled productivity. If your goal is Azure infrastructure, AB-900 is not a substitute for Azure fundamentals; the supplied Azure materials describe AZ-900 as the certification for cloud concepts, core Azure services, and Azure management and governance.
How is the exam weighted?
Study time should follow the official domain weights, with the largest allocation going to data protection and governance. Use the percentages as a planning signal, not as a promise about the number or order of questions you will see.
The domain “Identify the core features and objects of Microsoft 365 services” represents 30–35% of AB-900. It includes objects such as users, groups, teams, sites, and libraries; license effects; organization settings; administration-center responsibilities; permissions; and core identity and security concepts.
The domain “Understand data protection and governance tasks for Microsoft 365 and Copilot” represents 35–40% of AB-900. It covers Microsoft Purview capabilities, sensitivity labels, data classification, retention, Copilot’s access to data, responsible AI, compliance and risk tools, eDiscovery, and SharePoint oversharing.
The domain “Perform basic administrative tasks for Copilot and agents” represents 25–30% of AB-900. It includes Copilot capabilities and licensing models, assigning licenses, monitoring usage and billing, managing prompts, creating and monitoring agents, and using the Microsoft 365 and Power Platform admin centers.
Because the domain labels are part of the meaning, record each study result against its named domain. For example, a weak score in “Understand data protection and governance tasks for Microsoft 365 and Copilot” calls for Purview and Copilot data-security review; it should not be described merely as weakness in a percentage category.
What should you know about Microsoft 365 objects and administration centers?
Start by learning what each object represents and which administration center manages it. AB-900 expects recognition and selection, not just vocabulary recall: a scenario may require you to distinguish a user from a group, a SharePoint site from a library, or a Teams policy from a team or channel configuration.
Build an object map with four columns: object, purpose, administration center, and access or policy relationship. Include users, groups, teams, channels, sites, libraries, folders, mailboxes, distribution groups, domains, organization settings, roles, and role groups. Then add the center associated with the task: Microsoft 365 admin center, Exchange admin center, SharePoint admin center, Teams admin center, Microsoft Entra, Microsoft Purview, or Power Platform admin center.
Pay particular attention to how licenses assigned to users and groups affect access to Microsoft 365 features. Do not study licensing as a list of product names alone. For each licensing scenario, ask who receives the entitlement, what feature access it enables, and whether the question is asking about an assignment decision or a workload configuration.
Security fundamentals belong in this same foundation. Review Zero Trust, authentication, authorization, threat protection, Microsoft Defender XDR, Microsoft Entra capabilities, Conditional Access, single sign-on, MFA, risky sign-ins, audit logs, Privileged Identity Management, app registrations, and enterprise applications. The practical test is whether you can select the relevant control or investigation tool for a stated administrative problem.
How should you study data protection and governance?
Give data protection and governance the largest block of your preparation because “Understand data protection and governance tasks for Microsoft 365 and Copilot” represents 35–40% of AB-900. Study each control by the risk it addresses, the data or activity it governs, and the evidence an administrator would review.
Use Microsoft Purview as the organizing framework. The study guide identifies Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Security Posture Management for AI, and Data Lifecycle Management. Add sensitivity labels, data classification, retention, Compliance Manager, Data Explorer, Activity Explorer, eDiscovery, and alerts to your review list.
Copilot-related questions require more than knowing that AI produces answers. Review how Copilot accesses data, how Microsoft Graph affects responses, and how permissions and other controls in Microsoft 365, Microsoft Purview, and Microsoft Defender help protect against risk. Connect this to responsible AI and to risks such as sensitive data exposure, inappropriate access, and oversharing in SharePoint.
A useful study exercise is to write a short response to each of these prompts: Which tool helps identify sensitive information? Which control limits inappropriate data movement? Which service reports user activity? Which feature supports retention? Which tool helps investigate content? Which capability detects or manages AI activity? Check every answer against Microsoft documentation rather than relying on a memorized product association.
Keep governance distinct from identity. Authentication determines how a user proves identity; authorization and permissions determine what the user can access; governance and protection determine how data is classified, retained, monitored, investigated, or restricted. AB-900 connects these ideas, so studying them as unrelated product names creates avoidable confusion.
What Copilot and agent administration should you practice?
The Copilot and agent domain represents 25–30% of AB-900. Prepare to explain basic administrative choices: which Copilot capability or licensing model fits a requirement, how a Copilot license is assigned, how usage and billing are monitored, how prompts are managed, and how agents are created and monitored.
The official course describes Copilot and AI-powered agents as an extension of the Microsoft 365 foundation. Study the relationship in that order: tenant and workload configuration first, identity and permissions second, data protection and governance third, and Copilot or agent administration fourth. This sequence makes it easier to reason through scenarios where an AI feature depends on an underlying Microsoft 365 control.
Use the Microsoft 365 admin center and, where relevant, the Power Platform admin center as navigation concepts. You do not need to turn preparation into an attempt to memorize every portal screen. Instead, practice identifying the administrative objective and then the center or control that is most likely to own it.
Include Copilot use cases named in the supplied research, including Researcher and Analyst. Understand the administrative context of these capabilities without assuming that a user-facing feature automatically grants permission to all organizational data. Always bring the question back to license assignment, authorized access, data protection, and monitoring.
Agents deserve separate notes for lifecycle actions: creation, configuration, monitoring, and governance. A strong answer should account for both what an agent can do and how an administrator controls its access, use, and organizational risk. Do not use unofficial “exact question” material as a substitute for understanding these relationships.
Which official resources should form the study sequence?
Use the AB-900 study guide as the scope check, the AB-900T00-A course as the structured introduction, Microsoft documentation for clarification, the official practice assessment for readiness, and the exam sandbox for interface familiarity. This sequence moves from “what is tested?” to “can I apply it?” without depending on leaked or reconstructed exam questions.
Begin with the official AB-900 study guide at https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/ab-900. Read the audience profile, skills at a glance, detailed skill bullets, scoring information, updates, and useful links. Turn each detailed bullet into a checklist item and mark it as unfamiliar, recognized, explainable, or practice-ready.
Next, use Course AB-900T00-A: Introduction to Microsoft 365 and AI administration at https://learn.microsoft.com/en-us/training/courses/ab-900t00. Microsoft lists it as a beginner course related to the certification and says it can be approached through instructor-led training or self-paced study. Its purpose is to introduce Microsoft 365 foundations before Copilot and agent administration.
Then consult the relevant Microsoft 365, Microsoft Copilot, Microsoft admin center, Microsoft Purview, and identity documentation linked from the study guide. Documentation is most useful when you have a specific gap to resolve. Avoid opening many pages without recording the decision or distinction each page clarified.
The official Microsoft Q&A response at https://learn.microsoft.com/en-us/answers/questions/5889450/copilot-ab-900-certificate-copllot points readers toward learning paths for Microsoft 365 administration and Copilot agent administration. Treat that Q&A as a navigation aid, while using the official study guide to decide whether a topic belongs in your preparation.
Use the free AB-900 practice assessment at https://learn.microsoft.com/en-us/credentials/certifications/practice-assessments-for-microsoft-certifications after your first pass through the blueprint. Microsoft says practice assessments can be attempted as many times as desired and are available at no cost. The results should determine your next study block, not serve as a memorization bank.
Finally, open the exam sandbox from the certification page at https://learn.microsoft.com/en-us/credentials/certifications/copilot-and-agent-administration-fundamentals/. The sandbox lets you experience the interface and interact with different question types. This is useful for reducing interface uncertainty, but it does not replace learning Microsoft 365 or practicing administrative reasoning.
How can you build a practical study roadmap?
A four-stage roadmap works well for a beginner: establish the Microsoft 365 foundation, study protection and governance, connect Copilot and agents to administration, and then diagnose gaps with official tools. Adjust the amount of time spent in each stage to your baseline, but do not skip the first stage simply because Copilot is your main interest.
Stage one: create the foundation. Work through the core-object and administration-center topics in the study guide. Make a one-page map of users, groups, teams, channels, sites, libraries, folders, mailboxes, distribution groups, domains, roles, and permissions. Add Microsoft Entra authentication, authorization, Conditional Access, MFA, SSO, audit, and PIM concepts. Finish by explaining aloud which tool you would use for common access and sign-in problems.
Stage two: study protection and governance. Organize notes by capability rather than alphabetically. For Purview, record the purpose of Information Protection, DLP, Insider Risk Management, Communication Compliance, DSPM for AI, Data Lifecycle Management, eDiscovery, Compliance Manager, Data Explorer, and Activity Explorer. Add a separate section for sensitivity labels, classification, retention, Copilot data access, Graph influence, responsible AI, and SharePoint oversharing.
Stage three: connect administration to Copilot and agents. Review Copilot capabilities, licensing models, license assignment, usage and billing monitoring, prompt management, agent creation, and agent monitoring. For each topic, write one “administrator must decide” statement. Examples include deciding who receives a license, which data access boundaries matter, which activity requires monitoring, and which control is appropriate when an agent exposes a governance concern.
Stage four: test and repair. Take the official practice assessment, classify every missed or guessed response by its named domain, and return to the study guide or documentation for that domain. Repeat only after you can explain the correction. Then use the sandbox to become comfortable with the examination interface and question types. A high practice result without an explanation of why each option is correct is not enough to schedule confidently.
How should you use hands-on practice when access is limited?
Hands-on practice should reinforce the administrative model, not become a requirement you cannot meet. The associated course states that prior hands-on experience is not required, so a learner without a tenant can still prepare through structured study, documentation, object mapping, and scenario analysis.
If you have an authorized Microsoft 365 environment, practice locating the Microsoft 365 admin center, Exchange admin center, SharePoint admin center, Teams admin center, Microsoft Entra, Microsoft Purview, and Power Platform admin center. Observe how users, groups, licenses, sites, teams, policies, roles, labels, alerts, and activity records relate to one another. Do not change production settings merely to create practice.
For every practical task, record four things: the administrative goal, the object involved, the control or center used, and the expected evidence of success. For example, a license task should identify the recipient and access effect; an investigation task should identify the relevant log, explorer, alert, or case; an agent task should identify the creation or monitoring action and its governance boundary.
When a live environment is unavailable, use screenshots or documentation diagrams only to answer a specific question. Portal layouts can change, while the exam’s underlying skill remains the administrative purpose. Prioritize understanding what a setting controls over memorizing its location in a menu.
What exam-day details are confirmed?
Microsoft states that AB-900 is proctored, may include interactive components, and gives candidates 45 minutes to complete the assessment. The certification page lists English as an available language and provides scheduling routes through Pearson VUE, with Certiport available if you are a student or educator.
Confirm current scheduling information on the official certification page before booking because language availability, registration instructions, pricing, and delivery information can change. The page says price is based on the country or region in which the exam is proctored, so do not rely on an old price shown elsewhere.
Microsoft recommends registering with a personal Microsoft account. Its guidance warns that registering with an organizational work or school account can cause exam records to be lost and unrecoverable if you leave that organization. Make the account decision before scheduling, not after the result is issued.
Use the accommodation process if you require assistive devices, extra time, or another modification. The study guide says that if the exam is not available in your preferred language, you can request an additional 30 minutes. Check the current official instructions and submit any request early enough for it to be handled before the appointment.
The study guide says a score of 700 or greater is required to pass. Microsoft also states that an unsuccessful candidate can retake AB-900 24 hours after the first attempt; later retake intervals vary. A retake should follow targeted gap analysis rather than an immediate return to memorization.
Which preparation mistakes cost candidates time?
The most damaging mistake is studying Copilot as an isolated feature set. AB-900 links Copilot and agents to Microsoft 365 objects, permissions, identity, data protection, governance, and monitoring. Build those dependencies first so that scenario questions become administration decisions rather than disconnected product trivia.
Do not treat the domain weights as question counts. The official percentages describe the relative skills measured: 30–35% for identifying Microsoft 365 features and objects, 35–40% for data protection and governance tasks, and 25–30% for Copilot and agent administration. They do not tell you the exact number, sequence, or format of questions.
Do not memorize practice-assessment answers. Microsoft explicitly says its practice questions are not the same as live exam questions and do not represent the exam’s full length or complexity. The assessment can show style, wording, and difficulty, but it is a diagnostic resource, not a prediction of the live paper.
Do not confuse recognition with readiness. Being able to define Conditional Access, a sensitivity label, or an agent is different from selecting the appropriate control in a scenario. For every term, add its purpose, scope, related object, and the evidence an administrator would examine.
Do not ignore the current study guide. Microsoft notes that localized exams may be updated after the English version and that some localized versions may not follow the expected schedule. Review the live guide and the scheduling page close to your appointment, especially if language or timing affects your plan.
Finally, do not schedule simply because you have completed a course. Course completion proves exposure to the material, not command of every assessed domain. Schedule when you can explain the study-guide objectives, repair practice-assessment gaps, and work through the sandbox without interface confusion.
How do you decide whether you are ready?
You are ready to consider scheduling when you can explain the purpose of each assessed domain, map common Microsoft 365 objects to their administration centers, distinguish identity controls from data-governance controls, and describe how Copilot and agents fit within licensing, permissions, protection, and monitoring. Use official practice results to find remaining gaps rather than to claim certainty.
Run a final domain review using three questions. For “Identify the core features and objects of Microsoft 365 services,” can you select the correct object, center, role, permission, or identity control? For “Understand data protection and governance tasks for Microsoft 365 and Copilot,” can you match a data or compliance risk to the appropriate Purview capability? For “Perform basic administrative tasks for Copilot and agents,” can you explain the licensing, configuration, usage, prompt, creation, and monitoring decision?
If one domain remains substantially weaker, delay the appointment and study that domain directly. If your weakness is terminology, build comparison notes. If it is scenario reasoning, write short administrative cases and justify the control you select. If it is interface uncertainty, use the sandbox. If it is a current-feature question, return to Microsoft documentation and verify the feature’s status rather than trusting an older source.
After the final review, check your personal Microsoft account, language and accommodation needs, scheduling route, and current official exam information. Then schedule through the route identified by Microsoft and keep your preparation anchored to the AB-900 study guide.
Conclusion
AB-900 preparation is strongest when it follows the way Microsoft frames the role: understand the Microsoft 365 foundation, protect and govern organizational data, and then administer Copilot and agents within those boundaries. Start with the current study guide, weight your work toward data protection and governance, use the beginner course to structure learning, and treat the practice assessment and sandbox as diagnostic and interface tools. Before booking, verify the live certification page and make sure your account, language, accommodation, and readiness decisions are settled.