AB-900 Tests Whether You Can Govern Microsoft 365 Data and Administer Copilot and Agents Safely
AB-900 rewards understanding how Microsoft 365 identity, permissions and Purview controls shape what Copilot and agents can reach, and handling basic Copilot and agent administration.
Check Your Readiness →Most candidates understand Microsoft 365 Certified: Copilot and Agent Administration Fundamentals (AB-900) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Data protection and governance is the largest domain at 35-40%, followed by core Microsoft 365 services (30-35%) and Copilot and agent administration (25-30%). Most scenarios reduce to who can access what, and which control changes that.
Block Copilot for everyone until every site has been reviewed by hand.
Run data access governance reports, tighten site permissions, apply restricted access control or restricted content discovery with SharePoint Advanced Management, and label sensitive content. This removes the exposure Copilot would surface.
Reset the user's password and remove MFA.
Check the Microsoft Entra sign-in logs to see whether a Conditional Access policy, MFA requirement or risky sign-in blocked the attempt, then fix the specific cause. Removing MFA weakens security without diagnosing anything.
Remove Copilot licenses from users who build agents.
Configure who can access and publish agents and require the agent approval process in the admin center, then monitor agents in the Microsoft 365 and Power Platform admin centers. Governance keeps the benefit while controlling risk.
Microsoft 365 Copilot only grounds responses in content the signed-in user already has permission to access through Microsoft Graph. The real risk is existing oversharing, which Copilot makes easier to find, so the fix is permissions and governance.
Sensitivity labels classify and protect content, for example with encryption, watermarks or access restrictions. Retention labels and policies decide how long content is kept and whether it is deleted afterwards.
Microsoft's Zero Trust model has three principles: verify explicitly, use least privilege access and assume breach. Network location alone is never treated as proof of trust.
Conditional Access requires Microsoft Entra ID P1 and Privileged Identity Management requires Entra ID P2 (both included in some Microsoft 365 suites). Tenants without them rely on security defaults for baseline MFA.
Microsoft 365 Copilot is a per-user license assigned in the Microsoft 365 admin center. Pay-as-you-go billing instead charges metered usage, such as agent use by people without that license, to an Azure subscription through a billing policy.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
Find out whether governance, core services or Copilot administration is costing you AB-900 points.