Microsoft 365 Copilot and Agent Administration FundamentalsStudy guide
Fundamentals of administering Microsoft 365, Copilot, and agents with data protection (AB-900, successor to MS-900).
About Microsoft 365 Copilot and Agent Administration Fundamentals (AB-900)
Microsoft 365 Copilot and Agent Administration Fundamentals (AB-900) is a Fundamentals-level certification from Microsoft. This page organizes the exam scope into a 3-chapter, 9-section study guide and lets you check your understanding with exam-style practice questions. A good flow is to read the chapters below in order, then test yourself via "Practice questions."
Exam domains (approximate weighting)
- Core features and objects of Microsoft 365 services~32%
- Data protection and governance for Microsoft 365 and Copilot~38%
- Basic administration for Copilot and agents~30%
Weights are approximate guidance for the live exam. Each domain is covered in detail in the chapters and sections below.
Official exam information: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/ab-900
1Core features and objects of Microsoft 365 services
- 1.1Core objects of Microsoft 365 services
Understand how license assignment to users/groups affects access, organization configuration in the Microsoft 365 admin center, and the key objects configured in the Exchange Online, SharePoint, and Teams admin centers (mailboxes/distribution lists, sites/libraries, teams/channels/policies), plus roles and permissions.
- 1.2Microsoft 365 security principles
Understand Zero Trust principles, authorization vs authentication methods, threat protection and intelligence, and the features and role of Microsoft Defender XDR—the security foundation of Microsoft 365.
- 1.3Core security features of Microsoft 365
Understand Microsoft Entra features, conditional access and SSO, choosing users vs groups, troubleshooting sign-in issues (MFA, conditional access, risky sign-ins), Identity Secure Score, audit logs, Privileged Identity Management (PIM), and app registrations vs enterprise apps.
2Data protection and governance for Microsoft 365 and Copilot
- 2.1Data protection with Microsoft Purview
Understand the key Microsoft Purview capabilities (Information Protection and sensitivity labels, Data Loss Prevention (DLP), Insider Risk Management, Communication Compliance, DSPM for AI, Data Lifecycle Management) plus data classification and retention.
- 2.2Data security of Copilot
Understand how Microsoft 365 Copilot accesses data, how Microsoft Graph influences its responses, how Copilot is protected against risks via permissions and controls in Microsoft 365/Purview/Defender, and responsible AI principles.
- 2.3Data protection risks and SharePoint oversharing
Understand ways to identify risks—Compliance Manager, Purview Data/Activity Explorer, Insider Risk Management, DLP alerts, Communication Compliance violations, DSPM for AI, eDiscovery Content search—and how to identify SharePoint oversharing (data access governance report, SharePoint Advanced Management restricted site access).
3Basic administration for Copilot and agents
- 3.1Features of Copilot and agents
Understand the difference between Copilot and agents’ built-in capabilities, Copilot license models (monthly vs pay-as-you-go including SharePoint), which features can be enabled/disabled, and use cases for Researcher, Analyst, and custom agents.
- 3.2Basic administrative tasks for Copilot
Understand assigning Copilot licenses, monitoring and managing pay-as-you-go billing policies, monitoring usage and adoption via Copilot Analytics and the Microsoft 365 admin center, and managing prompts (saving, sharing, scheduling, deleting).
- 3.3Basic administrative tasks for agents
Understand configuring user access to agents, creating an agent, the agent approval process, and monitoring agents (usage, operational insights, lifecycle) using the Microsoft 365 admin center and the Microsoft Power Platform admin center.