AB-900 · Domain 2 of 3

AB-900 Domain 2: Understand data protection and governance tasks for Microsoft 365 and Copilot

This is the largest AB-900 domain. It covers Microsoft Purview for information protection, DLP, insider risk and lifecycle; how Copilot accesses data and respects permissions; identifying governance risks; and finding and fixing oversharing in SharePoint.

Exam format
35–40%
Official functional groups
4
Assessment estimate
15–22
Suggested study time estimate
10–15 hrs

About 11 min read Reviewed October 2026

Overview

Understand data protection and governance tasks for Microsoft 365 and Copilot is the largest AB-900 domain and the one most tied to securing an AI-enabled tenant. It has four objective groups. Understanding Microsoft Purview covers Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Security Posture Management for AI, Data Lifecycle Management, sensitivity labels, data classification and retention. Understanding Copilot's data security covers how Copilot accesses data, how Microsoft Graph influences its responses, how it uses permissions and controls to protect against risks, and responsible AI principles. Identifying risks covers Compliance Manager, Data Explorer, Insider Risk Management, DLP alerts, Communication Compliance, Activity Explorer, DSPM for AI and eDiscovery Content search. Identifying and monitoring oversharing covers SharePoint oversharing tools, data access governance reports and SharePoint Advanced Management.

At 35–40%, this domain carries the most weight, reflecting that Copilot's safety depends on correct data governance and permissions. The exam rewards knowing how Copilot respects existing permissions and how Purview protects and governs data.

How it's tested

AB-900 questions in this domain describe a data-protection, governance or Copilot-risk need and ask which Purview capability or control fits. Read the full scenario and all options before choosing, picking the feature or tool that most precisely matches what is described.

  • Right Purview capability

    A data-protection or governance need is described, and you choose Information Protection, DLP, Insider Risk, retention or DSPM for AI.

  • How Copilot accesses data

    A Copilot data-access question is posed, and you apply that Copilot respects existing permissions via Microsoft Graph.

  • Find oversharing

    An oversharing concern is described, and you choose the SharePoint data access governance tools.

Reasoning it through

A company worries that deploying Copilot will let users see sensitive documents. The fear that Copilot bypasses security is a misconception: Copilot only returns content the user already has permission to access, surfaced through Microsoft Graph. The real risk is pre-existing oversharing, so the correct approach is to find and fix oversharing with SharePoint data access governance reports and apply Purview protections such as sensitivity labels, rather than assuming Copilot itself leaks data.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

2.1 Understand Microsoft PurviewInformation Protection, DLP, Insider Risk, Communication Compliance, DSPM for AI, lifecycle, labels, classification and retention.
What it means
This covers the features of Microsoft Purview Information Protection, Data Loss Prevention (DLP), Insider Risk Management, Communication Compliance, Data Security Posture Management (DSPM) for AI and Data Lifecycle Management, plus use cases for sensitivity labels, data classification and retention.
What to understand
Information Protection classifies and labels data; DLP prevents sensitive data from leaving; Insider Risk Management detects risky internal activity; Communication Compliance monitors communications; DSPM for AI governs AI-related data risk; and Data Lifecycle Management handles retention and deletion. Sensitivity labels and classification underpin protection, including for Copilot.
How it shows up
A data-protection or governance need is described, and you must choose the Purview capability.
Common confusion
Confusing DLP (prevents data loss) with Information Protection (classifies and labels data) or retention (keeps or deletes data).
2.2 Understand data security implications of CopilotHow Copilot accesses data, Microsoft Graph, permissions and responsible AI.
What it means
This covers how Copilot accesses data, how Microsoft Graph influences Copilot responses, how Copilot uses permissions and other controls in Microsoft 365, Purview and Defender to protect against risks, and responsible AI principles.
What to understand
Copilot grounds its responses in the user's accessible data through Microsoft Graph, honoring existing Microsoft 365 permissions, so it never shows a user content they could not already access. Purview labels and DLP and Defender controls further protect data. Responsible AI principles guide fair, safe and transparent use.
How it shows up
A Copilot data-access or risk question is posed, and you must apply that Copilot respects existing permissions and controls.
Common confusion
Assuming Copilot bypasses permissions; Copilot only surfaces content the user already has access to.
2.3 Identify data protection and governance risks for Microsoft 365 and CopilotCompliance Manager, Data Explorer, Insider Risk, DLP alerts, Activity Explorer, DSPM for AI and eDiscovery.
What it means
This covers identifying compliance risks with Compliance Manager, sensitive information with Data Explorer, risks with Insider Risk Management, responding to DLP alerts, policy violations from Communication Compliance, user activities in Activity Explorer, AI activity with DSPM for AI, and searching files and emails with eDiscovery Content search.
What to understand
These tools surface and respond to risks: Compliance Manager scores compliance posture, Data Explorer finds sensitive data, Insider Risk and Communication Compliance flag risky behavior, DLP alerts signal data-loss attempts, and DSPM for AI tracks AI-related data activity. eDiscovery searches content for investigation.
How it shows up
A risk-identification or investigation need is described, and you must choose the Purview tool.
Common confusion
Confusing Compliance Manager (compliance posture and recommendations) with Data Explorer (finding sensitive information).
2.4 Identify and monitor oversharing in SharePoint in Microsoft 365Oversharing tools, data access governance reports and SharePoint Advanced Management.
What it means
This covers the tools to troubleshoot oversharing in an organization, running a data access governance report in SharePoint, and the features of SharePoint Advanced Management including restricted access control.
What to understand
Oversharing, where content is shared too broadly, is the main pre-existing risk a Copilot deployment exposes, since Copilot can surface anything a user can access. Data access governance reports identify oversharing, and SharePoint Advanced Management with restricted access control helps contain it.
How it shows up
An oversharing concern is described, and you must choose the SharePoint governance tool or report.
Common confusion
Assuming oversharing is a Copilot flaw; it is a pre-existing permissions problem Copilot can surface.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Sensitivity labels

    Classify and protect data by sensitivity.

    Remember
    They apply protection such as encryption.
    Tested as
    Protection questions.
    Trap
    Confusing labels with retention.

  • Data Loss Prevention

    Prevents sensitive data from leaving.

    Remember
    It blocks or alerts on risky sharing.
    Tested as
    Protection questions.
    Trap
    Confusing DLP with labeling.

  • Information Protection

    Classifies and labels data.

    Remember
    The foundation for protection.
    Tested as
    Protection questions.
    Trap
    Confusing it with DLP.

  • Retention and lifecycle

    Keeps or deletes data on a schedule.

    Remember
    It governs how long data is kept.
    Tested as
    Governance questions.
    Trap
    Confusing retention with DLP.

  • Insider Risk Management

    Detects risky internal user activity.

    Remember
    It flags potential insider threats.
    Tested as
    Risk questions.
    Trap
    Confusing it with external threat protection.

  • DSPM for AI

    Governs AI-related data risk and activity.

    Remember
    It discovers and manages AI data activity.
    Tested as
    AI governance questions.
    Trap
    Overlooking AI-specific data risk.

  • How Copilot accesses data

    Grounds responses in the user's accessible data via Graph.

    Remember
    It honors existing permissions.
    Tested as
    Copilot data questions.
    Trap
    Assuming it bypasses permissions.

  • Microsoft Graph and Copilot

    Graph provides the data context for responses.

    Remember
    It respects the user's access.
    Tested as
    Copilot data questions.
    Trap
    Expecting access beyond the user's.

  • Responsible AI principles

    Fair, safe, transparent and accountable AI use.

    Remember
    They guide Copilot governance.
    Tested as
    AI governance questions.
    Trap
    Ignoring responsible AI.

  • SharePoint oversharing

    Content shared too broadly.

    Remember
    Copilot can surface overshared content.
    Tested as
    Oversharing questions.
    Trap
    Blaming Copilot for the exposure.

  • Data access governance reports

    SharePoint reports that reveal oversharing.

    Remember
    They identify broadly shared content.
    Tested as
    Oversharing questions.
    Trap
    Not running the report.

  • Compliance Manager

    Scores and recommends compliance improvements.

    Remember
    It measures compliance posture.
    Tested as
    Risk questions.
    Trap
    Confusing it with Data Explorer.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Information Protection vs. DLP vs. retention

ConceptMeaningKey differenceCommon trap
Information Protection Classifies and labels data Applies protection Confusing with DLP
Data Loss Prevention Prevents sensitive data leaving Blocks or alerts Confusing with labeling
Retention / lifecycle Keeps or deletes data Governs data lifespan Confusing with DLP

How Copilot accesses data vs. the misconception

ConceptMeaningKey differenceCommon trap
Reality Honors existing permissions via Graph Only shows accessible content Assuming it bypasses permissions
Misconception Copilot leaks restricted data Not how it works Blaming Copilot for oversharing

Compliance Manager vs. Data Explorer vs. Insider Risk

ConceptMeaningKey differenceCommon trap
Compliance Manager Compliance posture and recommendations Scores compliance Confusing with Data Explorer
Data Explorer Finds sensitive information Locates sensitive data Confusing with Compliance Manager
Insider Risk Management Detects risky internal activity Flags insider threats Confusing with external threats

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Copilot leaks data

    What candidates pick
    Assume deploying Copilot will expose restricted documents to users.
    Why it looks right
    Copilot searches broadly.
    Why it's wrong
    Copilot only surfaces content the user already has permission to access, through Microsoft Graph; the real risk is pre-existing oversharing.

    Clue to watch for The concern is Copilot showing sensitive content.

  2. DLP labels data

    What candidates pick
    Use Data Loss Prevention to classify and label documents by sensitivity.
    Why it looks right
    Both protect data.
    Why it's wrong
    Information Protection classifies and labels data; DLP prevents sensitive data from leaving.

    Clue to watch for The need is to classify versus prevent sharing.

  3. Oversharing is Copilot's fault

    What candidates pick
    Treat overshared content surfaced by Copilot as a Copilot defect.
    Why it looks right
    Copilot surfaced it.
    Why it's wrong
    Oversharing is a pre-existing permissions problem; fix it with SharePoint data access governance and labels.

    Clue to watch for Content was already shared too broadly.

  4. Compliance Manager finds data

    What candidates pick
    Use Compliance Manager to locate sensitive information in the tenant.
    Why it looks right
    Both relate to compliance.
    Why it's wrong
    Compliance Manager scores compliance posture; Data Explorer finds sensitive information.

    Clue to watch for The need is to find sensitive data versus assess posture.

  5. Retention is DLP

    What candidates pick
    Use retention policies to stop sensitive data from being emailed externally.
    Why it looks right
    Both govern data.
    Why it's wrong
    Retention keeps or deletes data on a schedule; DLP prevents sensitive data from leaving.

    Clue to watch for The need is to block sharing versus control data lifespan.

Answer framework

For any Domain 2 scenario, use these steps to find the answer AB-900 expects.

  1. Identify whether the need is protecting data, understanding Copilot's data access, identifying a risk, or finding oversharing.
  2. For protection and governance, choose the Purview capability: Information Protection and labels to classify, DLP to prevent loss, retention for lifecycle, and Insider Risk and DSPM for AI for risk.
  3. Apply that Copilot honors existing permissions through Microsoft Graph, so AI risk comes from oversharing and weak permissions, not Copilot bypassing security.
  4. To identify risks, use Compliance Manager for posture, Data Explorer for sensitive data, DLP alerts, Activity Explorer, DSPM for AI and eDiscovery search as appropriate.
  5. To address oversharing, run SharePoint data access governance reports and use SharePoint Advanced Management with restricted access control.

Practice question

An organization is concerned that enabling Microsoft 365 Copilot will allow employees to view confidential files they should not see. Which statement correctly describes how Copilot handles data access, and what the organization should do?

Want more like this? The AB-900 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the most study time, since it is the largest and central to a safe Copilot deployment. Start with the single most important concept: Copilot only surfaces content a user can already access through Microsoft Graph, so it does not bypass permissions, and the real AI risk is pre-existing oversharing. This reframes many questions.

Next, learn the Microsoft Purview capabilities and keep them distinct: Information Protection and sensitivity labels classify, DLP prevents loss, retention governs lifecycle, and Insider Risk, Communication Compliance and DSPM for AI manage risk. Then learn the risk-identification tools, Compliance Manager, Data Explorer, Activity Explorer and eDiscovery, and the SharePoint oversharing tools.

Because AB-900 is hands-on for a fundamentals exam, exploring the Purview portal in a trial tenant helps these concepts stick. Afterwards, move to Domain 3, performing basic administrative tasks for Copilot and agents. AB-900 is more hands-on than older fundamentals exams, so use a free Microsoft 365 developer tenant to explore the admin experiences, and review missed practice questions by group to find weak spots.

FAQ

How much of AB-900 is Domain 2?

Understand data protection and governance tasks for Microsoft 365 and Copilot is 35–40% of the exam, the single largest domain.

Does Microsoft 365 Copilot bypass permissions?

No. Copilot grounds its responses in the data a user can already access through Microsoft Graph, so it never shows content the user could not already reach. The real risk is pre-existing oversharing.

What is the main data risk when deploying Copilot?

Pre-existing oversharing, where content is shared too broadly. Because Copilot can surface anything a user can access, oversharing becomes visible, so it should be found and fixed before and during deployment.

What is the difference between Information Protection and DLP?

Information Protection classifies and labels data by sensitivity and can apply protection such as encryption. Data Loss Prevention prevents sensitive data from leaving through risky sharing.

What is DSPM for AI?

Microsoft Purview Data Security Posture Management for AI, which discovers and manages data security risks related to AI activity, such as Copilot interactions with sensitive data.

How do I find oversharing in SharePoint?

Run a data access governance report in SharePoint to reveal broadly shared content, and use SharePoint Advanced Management, including restricted access control, to contain it.

How does Domain 2 connect to the rest of the exam?

It protects the data within the identity and security foundation of Domain 1, and governs the data that the Copilot and agents administered in Domain 3 can access.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered Microsoft Purview, how Copilot accesses data, risk tools and SharePoint oversharing. Test whether you can choose the right governance control under exam conditions.

Take the AB-900 practice test Check your AB-900 readiness

Keep going