AB-900 study guide · 2026

The 3 AB-900 domains, explained

3 domains and 10 official functional groups. Understand data protection and governance tasks for Microsoft 365 and Copilot carries the most weight at 35–40%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 2 See all domains
Questions
40–60 (varies)
Time
45 minutes
Passing score
700 / 1000
Outline
AB-900 skills measured as of 14 October 2026 (current)

Exam blueprint

Bar widths follow the official weights, scaled to fit the bar. Weight ranges are drawn at their midpoint.

  1. 1 30–35%
  2. 2 35–40%
  3. 3 25–30%
  1. 1 Identify the core features and objects of Microsoft 365 services
  2. 2 Understand data protection and governance tasks for Microsoft 365 and Copilot
  3. 3 Perform basic administrative tasks for Copilot and agents

All 3 domains

10 official functional groups 20–35 hrs suggested study

  1. Domain 01 30–35%

    Identify the core features and objects of Microsoft 365 services

    This domain covers the building blocks and security foundations of a Microsoft 365 tenant: the core objects managed through the admin centers, the Microsoft 365 security principles including Zero Trust, and the identity and access features such as Microsoft Entra ID, MFA, Conditional Access and single sign-on.

    Inside this domain

    • Identify the core objects of Microsoft 365 services
    • Understand the Microsoft 365 security principles
    • Identify the core security features of Microsoft 365 services

    Watch for Wrong admin center

    Functional groups
    3
    Questions est.
    13–20
    Study time est.
    5–10 hrs
  2. Domain 02 35–40%

    Understand data protection and governance tasks for Microsoft 365 and Copilot

    This is the largest AB-900 domain. It covers Microsoft Purview for information protection, DLP, insider risk and lifecycle; how Copilot accesses data and respects permissions; identifying governance risks; and finding and fixing oversharing in SharePoint.

    Inside this domain

    • Understand Microsoft Purview
    • Understand data security implications of Copilot
    • Identify data protection and governance risks for Microsoft 365 and Copilot
    • Identify and monitor oversharing in SharePoint in Microsoft 365

    Watch for Copilot leaks data

    Functional groups
    4
    Questions est.
    15–22
    Study time est.
    10–15 hrs
  3. Domain 03 25–30%

    Perform basic administrative tasks for Copilot and agents

    This domain covers administering Copilot and agents: their capabilities and licensing, basic Copilot tasks such as assigning licenses, managing billing, monitoring adoption and managing prompts, and agent tasks such as access, creation, approval and lifecycle monitoring.

    Inside this domain

    • Understand features and capabilities of Copilot and agents
    • Perform basic administrative tasks for Copilot
    • Perform basic administrative tasks for agents

    Watch for Monthly for occasional use

    Functional groups
    3
    Questions est.
    11–16
    Study time est.
    5–10 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 20–35 hrs of study.

  1. 2 Understand data protection and governance tasks for Microsoft 365 and Copilot 35–40% · 10–15 hrs
  2. 1 Identify the core features and objects of Microsoft 365 services 30–35% · 5–10 hrs
  3. 3 Perform basic administrative tasks for Copilot and agents 25–30% · 5–10 hrs

Try one

Practice questionDomain 2: Understand data protection and governance tasks for Microsoft 365 and Copilot

An organization is concerned that enabling Microsoft 365 Copilot will allow employees to view confidential files they should not see. Which statement correctly describes how Copilot handles data access, and what the organization should do?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Wrong admin center

    Clue The object is email, a site, a team or an organization setting.

  • Domain 2

    Copilot leaks data

    Clue The concern is Copilot showing sensitive content.

  • Domain 3

    Monthly for occasional use

    Clue The usage is occasional or variable and cost should follow it.

Other Cloud Computing certifications

Study guides for exams that overlap with AB-900.

Practise what you read

AB-900 domains: common questions

How many domains are in the AB-900 exam?

AB-900 has 3 domains with 10 official functional groups between them: Identify the core features and objects of Microsoft 365 services, Understand data protection and governance tasks for Microsoft 365 and Copilot and Perform basic administrative tasks for Copilot and agents.

Which AB-900 domain carries the most weight?

Understand data protection and governance tasks for Microsoft 365 and Copilot is the heaviest at 35–40%, followed by Identify the core features and objects of Microsoft 365 services (30–35%). The lightest is Perform basic administrative tasks for Copilot and agents (25–30%). Weights come from Microsoft's official outline.

What is the AB-900 exam format?

Questions: 40–60 (varies). Time allowed: 45 minutes. Passing score: 700 / 1000.

How long should I study for AB-900?

Our planning estimate is 20–35 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Understand data protection and governance tasks for Microsoft 365 and Copilot, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows AB-900 skills measured as of 14 October 2026 (current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (AB-900 skills measured as of 14 October 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.