AB-900 is designed for people who need a broad administrative understanding of Microsoft 365 Copilot and agents. It combines Microsoft 365 foundations with data protection, governance and basic Copilot administration.
Understand the exam domains
| Skill area | Weight | Study focus |
|---|---|---|
| Core Microsoft 365 features and objects | 30–35% | Users, groups, licences, mailboxes, Teams, SharePoint sites and libraries, admin centres, authentication and Conditional Access concepts. |
| Data protection and governance for Microsoft 365 and Copilot | 35–40% | Permissions, oversharing, sensitivity labels, DLP, retention, audit, data boundaries and how Copilot respects existing access. |
| Basic administration for Copilot and agents | 25–30% | Licensing, readiness, settings, app and agent controls, deployment, monitoring, lifecycle and responsible use. |
Two-week study plan
Review tenants, domains, users, groups, licensing and the purpose of the Microsoft 365, Entra, Exchange, Teams, SharePoint and Purview admin centres.
Learn authentication methods, MFA, Conditional Access, SSO and least privilege. Be able to explain why Copilot does not bypass a user’s existing Microsoft 365 permissions.
Study sensitivity labels, DLP, retention, audit and SharePoint oversharing. Focus on how poor permissions and weak information governance affect Copilot outcomes.
Review licensing, readiness, deployment, Copilot settings, agents, integrated apps, app availability, monitoring and adoption. Understand the difference between a user-facing Copilot experience and an agent built for a defined task.
Complete the exam sandbox, revisit the official objective list and explain each objective aloud using an enterprise example.
Concepts that often need extra attention
Grounding and permissions
Copilot responses are grounded in the data and services available to the signed-in user. Existing permissions, labels and policy controls remain central. The administration problem is therefore not only enabling Copilot; it is improving identity, permissions and data governance before broad adoption.
Oversharing
Be able to identify oversharing risks in SharePoint and Teams, understand broad links and group membership, and recognise when restricted access, sensitivity labels or remediation are appropriate.
Agents
Understand agents as task-focused AI experiences that can use instructions, knowledge and actions. Know the importance of approved data sources, connector governance, owner accountability and lifecycle management.
Practical exercises
- Map a Microsoft 365 user request to the correct admin centre and object.
- Review a SharePoint site’s members, visitors and sharing settings.
- Create a simple sensitivity label design and explain its user impact.
- Draft a Copilot pilot group, success criteria and support model.
- List the controls you would apply to third-party agents and integrated apps.
- Use the Microsoft 365 Copilot readiness material to identify licensing, data and adoption dependencies.
Exam strategy
- Fundamentals questions usually test the purpose of a service or control, not deep implementation detail.
- Choose the Microsoft 365 object that directly satisfies the stated requirement.
- For security questions, protect data at the source rather than trying to filter every AI response afterwards.
- Distinguish between licensing, availability, configuration and user adoption.
Final readiness checklist
- I can explain the purpose of each major Microsoft 365 admin centre.
- I understand how permissions, labels, DLP and retention affect Copilot.
- I can explain basic Copilot and agent administration tasks.
- I reviewed the objective version applicable to my exam date.
Microsoft references
- Official AB-900 study guide
- Copilot and Agent Administration Fundamentals certification
- Course AB-900T00: Introduction to Microsoft 365 and AI administration
- Microsoft 365 Copilot documentation
- Microsoft Purview documentation
Review note: Certification objectives, Microsoft cloud features and portal labels change. Check the official Microsoft page for the date of your exam or production deployment.