AB-900 Exam Guide: Microsoft 365 Copilot and Agent Administration Fundamentals

Before an organization rolls out Microsoft 365 Copilot, someone needs to answer a deceptively simple question: What information will the AI be able to find? It is not enough to know how to write a good prompt. You also need to understand user identities, SharePoint permissions, data protection policies, licensing, and the agents people might connect to their work.

That is the territory covered by Exam AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals. This beginner-level Microsoft certification is about the administrative foundations behind an AI-enabled workplace. It is a particularly relevant starting point for students, help desk technicians, aspiring Microsoft 365 administrators, and anyone who wants to understand how enterprise AI is governed rather than simply used.

For candidates organizing their learning, our AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals course page provides an additional starting point for exam preparation. Use it alongside the official Microsoft Learn documentation to build a study plan that covers both certification objectives and practical administration concepts.

This guide covers the exam format, the current skills outline, the technology you should understand, and a realistic preparation plan. It follows Microsoft’s skills measured as of October 14, 2026.

What Is the Microsoft AB-900 Certification?

Passing AB-900 earns the Microsoft 365 Certified: Copilot and Agent Administration Fundamentals credential. It validates introductory knowledge of Microsoft 365 services, identity and security, data governance, and the basic administration of Copilot and agents. It does not claim that you are ready to architect an enterprise deployment alone; the word Fundamentals matters.

Microsoft provides a free practice assessment and an exam sandbox linked from the official AB-900 certification page. Availability, language options, prices, and exam policies can change, so confirm the booking details before paying.

AB-900 Exam Objectives: What Should You Study?

The October 2026 skills outline divides AB-900 into three areas. Notice that data protection and governance carry the largest weighting. That is a clue about what Microsoft considers essential for responsible Copilot administration.

1. Microsoft 365 Services, Identity, and Security (30–35%)

Start by learning the objects that administrators work with every day. A user is not the same thing as a group; a Teams channel is not the same thing as a SharePoint site; and an Exchange mailbox is not a distribution group. These distinctions sound basic, but they explain where access and administration actually happen.

You should be able to connect each workload with the appropriate management surface:

• Microsoft 365 admin center: Users, licenses, organization settings, and administrative entry points.
• Exchange admin center: Mailboxes, mail-enabled objects, and distribution groups.
• SharePoint admin center: Sites, sharing, access governance, and related policies.
• Teams admin center: Teams-related settings, channels, and policies.
• Microsoft Entra: Identities, authentication, Conditional Access, and privileged access.

Then move into security. Know the difference between authentication (proving who someone is) and authorization (deciding what they are allowed to access). Understand multifactor authentication (MFA), single sign-on (SSO), Conditional Access, Zero Trust principles, and the purpose of Privileged Identity Management (PIM). Be familiar with sign-in logs, Identity Secure Score, audit information, and the role of Microsoft Defender XDR in threat detection and response.

The exam is not asking you to become an identity architect overnight. It is asking whether you can recognize the right concept or tool when a common administrative problem appears.

2. Data Protection, Compliance, and Copilot Governance (35–40%)

This is the part of AB-900 I would study most carefully. Once AI can retrieve and summarize work content, weak information governance becomes much more visible.

Learn what the following Microsoft Purview capabilities are designed to do:

• Sensitivity labels classify content and can apply protections such as encryption or usage restrictions, depending on configuration.
• Data Loss Prevention (DLP) helps detect and prevent inappropriate handling or sharing of sensitive information.
• Data Lifecycle Management and retention help organizations keep or delete information according to policy.
• Insider Risk Management and Communication Compliance address particular risk and policy scenarios.
• Compliance Manager, Data Explorer, Activity Explorer, and eDiscovery Content Search support assessment, investigation, visibility, or discovery tasks.
• Data Security Posture Management (DSPM) helps organizations understand and manage data exposure and AI-related data risks. Microsoft documentation may distinguish newer DSPM experiences from the older “DSPM for AI” naming used in the exam objectives.

Do not treat these as interchangeable tools. A sensitivity label does not automatically correct an excessively broad SharePoint permission. A DLP policy is not the same as a retention policy. For scenario questions, identifying the actual problem is often more important than memorizing product names.

You should also understand SharePoint oversharing, including broad sharing links, organization-wide access, Data access governance reports, and the role of SharePoint Advanced Management. These topics connect directly to what Copilot can retrieve.

3. Copilot and Agent Administration (25–30%)

This final domain moves from underlying Microsoft 365 controls to the AI experiences themselves. The official objectives include:

• Comparing Copilot’s built-in capabilities with agents, including when a specialized agent is useful.
• Understanding the differences between user-based licensing and supported usage-based or pay-as-you-go services.
• Assigning Copilot licenses and identifying relevant feature controls.
• Recognizing use cases for Researcher, Analyst, and custom agents.
• Monitoring adoption, usage, billing, and applicable prompt-management features.
• Understanding agent creation, access, approval, monitoring, and lifecycle management.

You do not need to build a complex autonomous system to prepare for this fundamentals exam. You do need to know why an administrator might approve one agent, restrict another, and review an agent’s data access and usage over time.

How Microsoft 365 Copilot Uses Organizational Data

Here is the technical concept that ties much of the AB-900 syllabus together: Microsoft 365 Copilot uses organizational content and working context to ground its responses, while respecting the permissions applied to that content.

Microsoft Graph helps connect information across Microsoft 365 services, such as documents, email, meetings, and conversations. Copilot uses relevant content that the requesting user is authorized to access. The large language model then works with that context to generate an answer. The service has additional privacy, security, and compliance protections, but it does not make poor source permissions disappear.

Consider a simple example. A company stores a confidential planning document in SharePoint. Someone inadvertently grants read access to a very broad internal group. Later, an employee asks Copilot to summarize the company’s planning documents. If that employee already has access to the file, Copilot may be able to use it in a response. The problem began with the SharePoint permissions, not with Copilot inventing new access rights.

For an administrator, that suggests a practical order of operations: review identity and permissions, find potentially overshared content, apply suitable information protection controls, and then evaluate the Copilot experience. Microsoft’s enterprise documentation also states that prompts, responses, and Microsoft Graph data used by Copilot are not used to train the underlying foundation models.

This is also why Zero Trust matters to AI administration. “Verify explicitly,” “use least-privilege access,” and “assume breach” are more useful operating principles than simply turning on an AI feature and hoping existing sharing practices are good enough.

Copilot vs. Agents: What Is the Administrative Difference?

Think of Copilot as a general productivity experience that can help users work with content and tasks. An agent is a more focused experience configured for a particular purpose, knowledge source, or workflow. An agent might answer questions about an internal policy library or guide employees through a repeatable process.

From the administrator’s point of view, that creates another set of decisions: Who can use the agent? Who can publish it? What knowledge sources and actions does it use? Does it require approval? Who monitors its activity? How is it retired when it is no longer needed?

Microsoft provides agent management capabilities in the Microsoft 365 admin center, while some agent types and operational controls are also administered through the Power Platform admin center or related tools. The available controls depend on how an agent is built and deployed. Agents working with Microsoft 365 information follow applicable identity and access boundaries, but administrators must separately review external connections, actions, and permissions that a particular agent is configured to use.

Licensing Is Part of Governance, Not Just Purchasing

Do not assume that every Copilot feature is covered by one license or that pay-as-you-go is a substitute for every licensed capability. Microsoft supports different licensing and usage-based billing arrangements for different products and services. Some eligible chat experiences are included with qualifying Microsoft 365 subscriptions, while additional work-based capabilities or agents may require other licenses or usage-based billing.

For AB-900, learn to identify license assignment, billing policies, who is covered by a policy, usage reporting, and the difference between a subscription and metered consumption. One especially practical detail: Microsoft’s documentation for certain pay-as-you-go billing policies says that a configured budget can trigger notifications without enforcing a hard spending limit. Never assume an alert threshold is automatically a cost-control ceiling.

Is the AB-900 Certification Worth It?

For the right candidate, yes—but for a specific reason. AB-900 is useful evidence that you understand the administrative and security foundations of AI in Microsoft 365. It is more targeted than a general introduction to generative AI, and it brings identity, compliance, collaboration, and agent governance into the same conversation.

That makes it a sensible credential for students exploring cloud administration, early-career help desk and support professionals, junior Microsoft 365 administrators, or people who expect to support a Copilot rollout. It can also give non-specialists in IT operations a more precise vocabulary for discussing data access and AI risk with security teams.

Its limitations are equally important. A fundamentals credential is not a replacement for troubleshooting experience, security engineering skills, or hands-on deployment work. On a résumé, AB-900 becomes more convincing when paired with a small lab, a well-documented permission review, or a clear explanation of how you would govern an internal agent.

Another practical benefit: under Microsoft’s current credential policy, Fundamentals certifications do not expire, although Microsoft may update or retire certification programs as technology changes.

A Four-Week AB-900 Study Plan for Beginners

You do not have to memorize the entire Microsoft 365 documentation library. A more effective approach is to work from the published objectives, understand why each tool exists, and practice deciding which control belongs to which problem.

Week 1: Learn the Microsoft 365 Administrative Map

• Understand tenants, domains, users, groups, licenses, Teams, Exchange Online, and SharePoint sites.
• Learn where different objects are managed in the relevant admin centers.
• Review authentication, authorization, MFA, Conditional Access, PIM, and Zero Trust.
• Write a one-page comparison of Microsoft Entra, Microsoft Defender, and Microsoft Purview.

Week 2: Spend Extra Time on Data Protection

• Study sensitivity labels, DLP, retention, Insider Risk Management, eDiscovery, and AI-related posture management.
• Trace how a SharePoint sharing link or group membership can make content accessible.
• Learn what Data access governance reports can tell an administrator about oversharing.
• For each tool, ask: What risk does it address, and what does it not solve?

Week 3: Focus on Copilot and Agent Operations

• Understand Microsoft Graph grounding and user permission boundaries.
• Compare Copilot, Researcher, Analyst, and purpose-built agents at a conceptual level.
• Review license assignment, usage monitoring, billing policies, and agent approval.
• Study how an agent is published, made available to users, monitored, and eventually retired.

Week 4: Turn Knowledge into Exam Decisions

• Take the official Microsoft Learn practice assessment and review the domains where you struggle.
• Try the exam sandbox to become familiar with the question interface.
• Practice short scenarios: an employee cannot sign in; a SharePoint site is overshared; an agent needs approval; a DLP alert appears.
• Revisit the current AB-900 study guide before scheduling, especially if the exam objectives have changed.

During this final week, it also helps to organize your revision around a dedicated AB-900 exam preparation course. Compare your learning materials against Microsoft’s published objectives and spend extra time on topics where you cannot confidently explain the administrative reasoning behind an answer.

One Small Lab That Teaches More Than Flashcards

If you have authorized access to a training tenant with the necessary licenses and permissions, use sample data only and try this exercise. Do not loosen sharing settings in a production environment for the sake of practice.

1. Create or identify a test SharePoint site with fictional project documents.
2. Compare access for two test users or groups with different permissions.
3. Inspect how a direct permission differs from a broader sharing link, and document the effect.
4. Find where sharing governance reports and information protection controls are managed; availability will depend on licensing and roles.
5. If your tenant supports it, inspect Copilot licensing and agent management options without publishing an unreviewed agent.
6. Summarize the exercise in a short table: Risk → Relevant admin center → Control → Expected outcome.

The real value is in being able to explain a decision. If someone asks why an AI response could contain a particular document, “because the AI is powerful” is not an administrative answer. “Because that user already had access through an overly broad SharePoint permission” is.

Common AB-900 Mistakes to Avoid

• Studying only prompts: The exam is about administration, identity, governance, and security—not prompt writing alone.
• Confusing labels with permissions: Labels and access controls can work together, but they serve different purposes.
• Assuming Copilot bypasses security: Microsoft 365 Copilot respects applicable user access boundaries; overshared content is still a serious concern.
• Treating every agent as identical: Governance and deployment controls vary with the agent’s type, capabilities, and integrations.
• Equating 700 points with 70%: Microsoft uses a scaled score. A passing score of 700 does not establish a fixed percentage of questions correct.

AB-900 Frequently Asked Questions

Is AB-900 suitable for someone without an IT job?

Yes. It is a beginner-level exam, and Microsoft does not list another certification exam as a prerequisite. However, basic familiarity with Microsoft 365 and common IT concepts will make preparation easier.

How difficult is the Microsoft AB-900 exam?

It is a fundamentals-level assessment, but the breadth can surprise newcomers. Security terminology, Microsoft Purview products, SharePoint permissions, and licensing scenarios usually require more thought than simple product definitions. The best preparation is to understand how the pieces work together.

How long is the AB-900 exam, and what score do I need?

Microsoft currently lists 45 minutes to complete the assessment, with a passing score of 700 or higher on its scaled scoring system. Allow for any separate check-in and exam-administration steps described by your testing provider.

How much does the AB-900 exam cost?

At the time of writing, Microsoft’s certification page shows US$99, while specifying that pricing depends on the country or region in which the exam is proctored. Confirm the amount in your own registration flow.

Does the AB-900 certification expire?

Under Microsoft’s current policy, Fundamentals certifications do not expire and do not require annual renewal. Microsoft can still change or retire certification offerings.

Do I need to know Microsoft Copilot Studio?

You should understand what agents are, how they can be created and governed, and why the Power Platform admin center matters for some agent management tasks. AB-900 is not primarily a deep Copilot Studio development or programming exam.

Final Thoughts: Learn the Controls Behind the AI

The most useful way to approach AB-900 is to stop thinking of Copilot as a standalone chatbot. In a business environment, it sits inside a larger system of identities, permissions, information protection policies, licenses, and administrative decisions. An agent may add another layer of workflows and governance, but it does not remove the need to understand those foundations.

If you can explain why a user can access a document, which Microsoft tool would help investigate oversharing, how to govern an agent, and what a licensing or billing policy actually controls, you are learning material that matters beyond the exam. The certificate is a useful milestone; that judgment is the more durable skill.

For readers ready to take the next step, explore our Microsoft AB-900 certification study resources to continue organizing your exam preparation. Combine focused revision with practical Microsoft 365 administration experience and the official documentation below.

Official Microsoft References and Further Reading

The following resources are maintained by Microsoft. Start with the certification page and study guide, then use the technical documentation to explore subjects that are unfamiliar. Product names, licensing, and admin-center interfaces may change over time.

1. Microsoft Learn — AB-900 Certification and Exam Details
2. Microsoft Learn — Official AB-900 Study Guide and Skills Measured
3. Microsoft Learn — Explore Microsoft 365 Administration
4. Microsoft Learn — Explore Microsoft 365 Copilot and Agent Administration
5. Microsoft Learn — Copilot Data, Privacy, and Security
6. Microsoft Learn — SharePoint Data Access Governance Reports
7. Microsoft Learn — Manage Agents for Microsoft 365 Copilot
8. Microsoft Learn — Microsoft Purview Data Security Posture Management
9. Microsoft Learn — Set Up Microsoft Copilot Pay-as-You-Go Services
10. Microsoft Learn — Exam Scoring and Score Reports
11. Microsoft Learn — Credential Expiration Policies