AB-900 · Domain 1 of 3

AB-900 Domain 1: Identify the core features and objects of Microsoft 365 services

This domain covers the building blocks and security foundations of a Microsoft 365 tenant: the core objects managed through the admin centers, the Microsoft 365 security principles including Zero Trust, and the identity and access features such as Microsoft Entra ID, MFA, Conditional Access and single sign-on.

Exam format
30–35%
Official functional groups
3
Assessment estimate
13–20
Suggested study time estimate
5–10 hrs

About 11 min read Reviewed October 2026

Overview

Identify the core features and objects of Microsoft 365 services establishes the Microsoft 365 foundation that Copilot and agents build on. It has three objective groups. Identifying core objects covers how licenses affect access, organization configuration in the Microsoft 365 admin center, and the objects managed in the Exchange, SharePoint and Teams admin centers, such as mailboxes, sites, libraries, teams and channels. Understanding security principles covers Zero Trust, authentication and authorization, threat protection, and Microsoft Defender XDR. Identifying core security features covers Microsoft Entra ID, Conditional Access, single sign-on, security objects, troubleshooting sign-in issues, Identity Secure Score, audit logs, Privileged Identity Management, and app registrations.

At 30–35%, this is a core domain. AB-900 is a fundamentals exam, but it is built around administering an AI-enabled tenant, so it tests which admin center manages which object and which identity and security feature fits a need, more practically than the older fundamentals exams.

How it's tested

AB-900 questions are scenario-based and often ask which admin center, object or security feature fits a described need, more practically than older fundamentals exams. In this domain they describe a management or identity need and reward the right admin center, object or Entra ID feature. Read the scenario for which service it points to.

  • Right admin center

    An object to manage is described, and you choose the Microsoft 365, Exchange, SharePoint or Teams admin center.

  • Identity or access feature

    A security need is described, and you choose Entra ID, MFA, Conditional Access, SSO or PIM.

  • Troubleshoot sign-in

    A sign-in problem is described, and you choose the tool to diagnose MFA, Conditional Access or risky sign-ins.

Reasoning it through

An administrator must manage mailboxes and distribution groups for the organization. The Microsoft 365 admin center handles broad organization settings and users, and the SharePoint and Teams admin centers handle sites and teams, but mailboxes and distribution groups are managed in the Exchange admin center, which is the specific console for email objects, so that is where the task is performed.

Functional groups 3

Official functional groups from the Microsoft outline, in outline order.

1.1 Identify the core objects of Microsoft 365 servicesLicenses, the admin centers, and Exchange, SharePoint and Teams objects.
What it means
This covers how license types assigned to users and groups affect access to features, exploring organization configuration such as domain names and settings in the Microsoft 365 admin center, and identifying the objects managed in the Exchange admin center (mailboxes and distribution groups), the SharePoint admin center (sites, libraries and folders) with roles and permissions, and the Teams admin center (teams, channels and policies).
What to understand
Each workload has its own admin center for its objects: the Microsoft 365 admin center for organization-wide settings and users, Exchange for email, SharePoint for sites and content, and Teams for teams and channels. Licenses determine which features a user can access. Knowing which console manages which object is the core skill.
How it shows up
An object to manage is described, and you must choose the correct admin center.
Common confusion
Confusing which admin center manages an object; mailboxes are in Exchange, sites in SharePoint, and teams in the Teams admin center.
1.2 Understand the Microsoft 365 security principlesZero Trust, authentication and authorization, threat protection and Defender XDR.
What it means
This covers the core Zero Trust principles, understanding authorization and authentication methods, understanding threat protection and intelligence, and the features and capabilities of Microsoft Defender XDR.
What to understand
Zero Trust assumes breach and verifies every request explicitly, using least privilege. Authentication verifies identity while authorization grants access. Threat protection and Defender XDR detect and respond to threats across the environment. These principles frame how Microsoft 365, and Copilot within it, is secured.
How it shows up
A security principle or threat-protection need is described, and you must identify Zero Trust, the authentication or authorization concept, or Defender XDR.
Common confusion
Confusing authentication with authorization; authentication verifies who the user is, while authorization determines what they can access.
1.3 Identify the core security features of Microsoft 365 servicesEntra ID, Conditional Access, SSO, sign-in troubleshooting, Secure Score, audit logs and PIM.
What it means
This covers the features of Microsoft Entra ID, Conditional Access policies, the purpose and benefits of single sign-on, choosing the right security object such as users and groups, troubleshooting sign-in issues with MFA, Conditional Access and risky sign-ins, interpreting the Identity Secure Score, reviewing audit logs, the role of Privileged Identity Management, and app registrations and enterprise applications.
What to understand
Microsoft Entra ID is the identity service. Conditional Access applies access policies based on signals, MFA adds a second factor, and single sign-on lets users authenticate once for many apps. Privileged Identity Management provides just-in-time elevated access. Identity Secure Score measures identity security posture, and audit logs record activity.
How it shows up
An identity or access need is described, and you must choose Entra ID, Conditional Access, MFA, SSO, PIM or a troubleshooting tool.
Common confusion
Confusing Conditional Access with Privileged Identity Management; Conditional Access governs access conditions, while PIM governs time-bound elevation of privileged roles.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Microsoft 365 admin centers

    Separate consoles: Microsoft 365, Exchange, SharePoint and Teams.

    Remember
    Each manages its own objects.
    Tested as
    Object management questions.
    Trap
    Choosing the wrong admin center.

  • Licenses and access

    License types determine which features a user can use.

    Remember
    Assign licenses via users or groups.
    Tested as
    Access questions.
    Trap
    Expecting a feature without the license.

  • Zero Trust

    Verify explicitly, use least privilege, assume breach.

    Remember
    Trust nothing by default.
    Tested as
    Security principle questions.
    Trap
    Treating the network as a trust boundary.

  • Authentication vs. authorization

    Verifying identity versus granting access.

    Remember
    MFA and SSO authenticate; roles authorize.
    Tested as
    Security questions.
    Trap
    Confusing the two.

  • Microsoft Entra ID

    The Microsoft 365 identity and directory service.

    Remember
    It manages identities and access.
    Tested as
    Identity questions.
    Trap
    Confusing it with a single feature.

  • Conditional Access

    Grants or blocks access based on signals.

    Remember
    It enforces conditions such as MFA for risky sign-ins.
    Tested as
    Access questions.
    Trap
    Confusing it with PIM.

  • Multifactor authentication

    A second authentication factor beyond a password.

    Remember
    It strengthens sign-in security.
    Tested as
    Identity questions.
    Trap
    Confusing it with authorization.

  • Single sign-on

    Authenticate once to access many applications.

    Remember
    It improves security and usability.
    Tested as
    Identity questions.
    Trap
    Confusing it with MFA.

  • Privileged Identity Management

    Just-in-time, time-bound elevation of privileged roles.

    Remember
    It reduces standing privileged access.
    Tested as
    Access questions.
    Trap
    Confusing it with Conditional Access.

  • Identity Secure Score

    A measure of identity security posture in Entra ID.

    Remember
    It recommends identity improvements.
    Tested as
    Security posture questions.
    Trap
    Confusing it with a compliance score.

  • Defender XDR

    Extended detection and response across Microsoft 365.

    Remember
    It correlates threats across services.
    Tested as
    Threat protection questions.
    Trap
    Confusing it with a single-product tool.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Which admin center manages the object

ConceptMeaningKey differenceCommon trap
Microsoft 365 admin center Org settings, users, domains Organization-wide Using it for workload-specific objects
Exchange admin center Mailboxes and distribution groups Email objects Looking in the wrong console
SharePoint admin center Sites, libraries and folders Content and sites Confusing with Teams
Teams admin center Teams, channels and policies Collaboration Confusing with SharePoint

Authentication vs. authorization vs. Zero Trust

ConceptMeaningKey differenceCommon trap
Authentication Verifies identity Who the user is Confusing with authorization
Authorization Grants access What the user can do Confusing with authentication
Zero Trust Verify explicitly, least privilege The overall security model Treating the network as trusted

Conditional Access vs. MFA vs. PIM

ConceptMeaningKey differenceCommon trap
Conditional Access Access policy based on signals Conditions of access Confusing with PIM
MFA A second authentication factor A control Conditional Access can require Treating it as a policy engine
PIM Time-bound privileged role elevation Just-in-time admin access Confusing with Conditional Access

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Wrong admin center

    What candidates pick
    Manage mailboxes in the SharePoint or Teams admin center.
    Why it looks right
    They are all Microsoft 365 consoles.
    Why it's wrong
    Mailboxes and distribution groups are managed in the Exchange admin center.

    Clue to watch for The object is email, a site, a team or an organization setting.

  2. MFA is authorization

    What candidates pick
    Use multifactor authentication to grant a user access to a resource.
    Why it looks right
    Both relate to access.
    Why it's wrong
    MFA strengthens authentication; authorization grants access through roles and permissions.

    Clue to watch for The need is to grant or limit what a user can do.

  3. Conditional Access is PIM

    What candidates pick
    Use Conditional Access to give time-bound elevated admin access.
    Why it looks right
    Both govern access.
    Why it's wrong
    Time-bound privileged elevation is Privileged Identity Management; Conditional Access sets access conditions.

    Clue to watch for The need is just-in-time elevation of an admin role.

  4. No license, feature works

    What candidates pick
    Expect a user to access a feature without the required license.
    Why it looks right
    The feature exists in the tenant.
    Why it's wrong
    License types determine which features a user can access, so the right license must be assigned.

    Clue to watch for A user cannot access a feature they should have.

  5. Network is trusted

    What candidates pick
    Assume users inside the network need no further verification.
    Why it looks right
    The network perimeter feels safe.
    Why it's wrong
    Zero Trust verifies every request explicitly regardless of network location.

    Clue to watch for The scenario involves trusting based on network location.

  6. SSO replaces MFA

    What candidates pick
    Treat single sign-on as a replacement for multifactor authentication.
    Why it looks right
    Both relate to sign-in.
    Why it's wrong
    SSO lets users authenticate once for many apps; MFA adds a second factor. They complement each other.

    Clue to watch for The need is stronger authentication versus fewer sign-ins.

Answer framework

For any Domain 1 Microsoft 365 scenario, use these steps to find the answer AB-900 expects.

  1. Decide whether the need is managing an object, understanding a security principle, or using an identity feature.
  2. For objects, choose the admin center that owns it: Microsoft 365 for org settings, Exchange for mailboxes, SharePoint for sites, Teams for teams.
  3. Separate authentication from authorization, and apply Zero Trust by verifying explicitly rather than trusting the network.
  4. For identity, choose the right feature: Entra ID for identity, Conditional Access for access conditions, MFA for a second factor, SSO for single sign-on, and PIM for time-bound elevation.
  5. For sign-in problems, use the tools to diagnose MFA, Conditional Access and risky sign-ins, and check the Identity Secure Score and audit logs.

Practice question

An administrator needs to grant certain users elevated administrative permissions only for the a limited period they are performing a specific task, rather than permanently. Which Microsoft Entra feature should they use?

Want more like this? The AB-900 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain as learning the Microsoft 365 foundation that Copilot sits on. Start with the admin centers: build a clear map of which console manages which object, since the Exchange, SharePoint and Teams admin centers each own distinct objects, and the Microsoft 365 admin center handles organization-wide settings. Learn how licenses gate feature access.

Next, master the security principles and identity features, which recur across the exam. Fix firmly the authentication-versus-authorization distinction, the Zero Trust model, and the roles of Conditional Access, MFA, single sign-on and Privileged Identity Management, which candidates often confuse. Learn where Identity Secure Score and audit logs fit.

Although AB-900 is a fundamentals exam, it is more hands-on than older fundamentals, so a free Microsoft 365 developer tenant to explore the admin centers helps. Afterwards, move to Domain 2, data protection and governance, the largest domain. AB-900 is more hands-on than older fundamentals exams, so use a free Microsoft 365 developer tenant to explore the admin experiences, and review missed practice questions by group to find weak spots.

FAQ

How much of AB-900 is Domain 1?

Identify the core features and objects of Microsoft 365 services is 30–35% of the exam, covering the Microsoft 365 foundation and security that Copilot builds on.

Which admin center manages mailboxes?

The Exchange admin center manages mailboxes and distribution groups. SharePoint manages sites and libraries, Teams manages teams and channels, and the Microsoft 365 admin center handles organization-wide settings and users.

What is Zero Trust?

A security model that verifies every request explicitly, applies least privilege, and assumes breach, rather than trusting requests based on network location.

What is the difference between Conditional Access and PIM?

Conditional Access grants or blocks access based on signals such as user, device and risk. Privileged Identity Management provides time-bound, just-in-time elevation of privileged roles.

What is the difference between authentication and authorization?

Authentication verifies who a user is, using methods such as MFA and single sign-on. Authorization determines what the user is allowed to access.

Is AB-900 the same as the old MS-900?

No. AB-900 replaced MS-900, which retired on 31 March 2026. It keeps Microsoft 365 fundamentals but is built around administering an AI-enabled tenant, adding Copilot and agent administration and governance.

How does Domain 1 connect to the rest of the exam?

The Microsoft 365 objects, identity and security here are the foundation that the data governance of Domain 2 and the Copilot and agent administration of Domain 3 build on.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered the Microsoft 365 admin centers, objects and identity and security features. Test whether you can choose the right console and security feature under exam conditions.

Take the AB-900 practice test Check your AB-900 readiness

Keep going