AB-900 Exam Guide: Microsoft 365 Copilot and Agent Administration Fundamentals
AB-900 validates foundational ability to identify Microsoft 365 services and objects, understand data protection and governance for Microsoft 365 and Copilot, and perform basic administration for Copilot and agents. It serves beginning-level technical IT professionals and novice administrators, including learners without prior hands-on experience. This guide helps you decide whether your current Microsoft 365 knowledge is sufficient, which skill area deserves the most study time, and how to prepare using Microsoft’s official blueprint, learning resources, practice assessment, and exam sandbox.
What AB-900 validates
AB-900 is the exam for the Microsoft 365 Certified: Copilot and Agent Administration Fundamentals certification. Microsoft describes the certification as demonstrating how to support, secure, and protect an AI-enabled Microsoft 365 environment. The exam is therefore broader than learning how to write prompts: it tests the administrative context in which Microsoft 365 services, Copilot, data controls, and agents operate.
The exam is classified at Beginner level, with an Administrator role and Artificial intelligence subject area. Its intended scope combines Microsoft 365 administration fundamentals with Copilot and agent administration. A candidate should be able to recognize the purpose of common objects, locate the relevant administration experience, connect access decisions with security controls, and identify appropriate governance or monitoring actions.
Use the certification as a fit check rather than as a promise of a particular job outcome. It is a sensible starting point if you support Microsoft 365 users, are moving toward cloud or AI administration, or need a structured introduction to Microsoft 365 Copilot and agents. It is less suitable as a standalone preparation plan for advanced implementation, development, or security engineering work.
Who the exam is designed for
Microsoft’s AB-900T00-A course is designed for beginning-level technical IT professionals and novice administrators. The course states that prior hands-on experience is not required, and it introduces the essential components, concepts, and capabilities needed to use and manage Microsoft 365, Copilot, and agents.
That does not mean the exam has no technical vocabulary. The certification page and study guide expect familiarity with Microsoft 365 core services, security, identity and access, data protection, governance, Copilot, agents, and the administration centers used for workloads such as Exchange Online, SharePoint in Microsoft 365, Microsoft Teams, Microsoft Entra, and Microsoft Purview.
What this means for your preparation decision
If you already administer Microsoft 365, spend less time memorizing product names and more time tracing a requirement to the correct object, portal, permission, policy, or governance control. If you are new to administration, build the Microsoft 365 foundation first; Copilot concepts become easier when you understand identities, licenses, permissions, sites, and data location.
A useful diagnostic is to explain, without notes, what a user, group, team, site, library, mailbox, distribution group, role, policy, label, and retention setting is for. Then explain which administration center or service is associated with it. Gaps in those explanations are preparation priorities, not reasons to jump directly to question memorization.
Which skills are measured
The current AB-900 study guide lists three measured domains. Identify the core features and objects of Microsoft 365 services accounts for 30–35% of the exam. Understand data protection and governance tasks for Microsoft 365 and Copilot accounts for 35–40% of the exam. Perform basic administrative tasks for Copilot and agents accounts for 25–30% of the exam. Study all three domains, while giving the largest planned block to data protection and governance.
The study guide says its skills are measured as of July 22, 2026. Microsoft also notes that the bullets beneath each skill are illustrative and that related topics may be covered. Most questions cover generally available features, although commonly used preview features may also appear. Check the official study guide before scheduling if your preparation stretches across a blueprint update.
Identify the core features and objects of Microsoft 365 services — 30–35%
This domain asks you to recognize the roles of core Microsoft 365 objects and understand how administration choices affect access. The study guide includes users, groups, teams, sites, and libraries, together with license effects, organization configuration, and workload administration.
Prepare to distinguish the kind of task associated with the Microsoft 365 admin center, Exchange admin center, SharePoint admin center, Teams admin center, Microsoft Entra, and Microsoft Purview. The emphasis is not simply on recalling portal names. You should be able to select the appropriate object or administrative location for a stated requirement.
Security is part of this domain. Review Zero Trust principles, authentication, authorization, Conditional Access, single sign-on, Microsoft Entra capabilities, threat protection, Microsoft Defender XDR, security objects, sign-in troubleshooting tools, audit activity, Privileged Identity Management roles, app registrations, and enterprise applications. Connect each term to the problem it helps solve.
Understand data protection and governance tasks for Microsoft 365 and Copilot — 35–40%
This is the largest measured domain, so it should receive the largest share of your active study and review. The study guide covers Microsoft Purview capabilities, sensitivity labels, data classification, retention, Copilot’s data security implications, responsible AI, compliance and risk tools, oversharing in SharePoint, AI data security posture management, and eDiscovery.
Learn the purpose of Information Protection, data loss prevention, Insider Risk Management, Communication Compliance, DSPM for AI, and Data Lifecycle Management. Avoid treating them as interchangeable security labels. For each capability, write down the data or behavior it addresses, the administrative signal it produces, and the type of response an administrator might take.
Copilot-related preparation should include how Copilot accesses data, how Microsoft Graph affects responses, and how permissions and other controls in Microsoft 365, Microsoft Purview, and Microsoft Defender help protect against risk. Responsible AI is also in scope. A strong study note explains why existing permissions and data hygiene matter before an AI productivity feature is introduced.
Perform basic administrative tasks for Copilot and agents — 25–30%
This domain covers the administrative lifecycle rather than advanced agent development. Review Copilot features and licensing models, license assignment, usage and billing monitoring, prompt management, agent creation and monitoring, and the use of Microsoft 365 and Power Platform admin centers.
The official study material also identifies Researcher and Analyst use cases. Treat these as scenarios for matching a capability to a business or productivity need, not as a request to memorize marketing descriptions. For agents, understand the administrator’s responsibilities around configuration, availability, monitoring, and appropriate use.
Make a simple lifecycle diagram: establish prerequisites, assign access, configure or create the capability, monitor use, review risk or usage information, and adjust administration. This sequence helps you answer scenario questions where several actions sound plausible but only one addresses the stated administrative objective.
How to organize the official study material
Start with the AB-900 study guide and use its skill outline as your controlling checklist. Then use the associated Microsoft Learn training, documentation links, and practice assessment to resolve gaps. The official AB-900T00-A course provides a beginner-oriented introduction to Microsoft 365, Copilot, and AI-powered agents and can be taken through instructor-led or self-paced study.
Do not treat every linked page as a separate subject to finish mechanically. Use the blueprint to decide why you are opening a resource. For example, read Microsoft Entra material when you need to clarify identity, Conditional Access, or sign-in troubleshooting; read Purview material when you need to distinguish labels, retention, DLP, risk, and discovery; return to the study guide to confirm the topic remains relevant to AB-900.
Microsoft’s certification Q&A page points learners to learning paths for exploring Microsoft 365 administration and Copilot and agent administration. Those paths can provide structure, but the study guide remains the better boundary for deciding whether a topic deserves exam preparation time.
A sensible resource order
Use this order: study guide, foundational Microsoft Learn course or learning paths, targeted product documentation, hands-on exploration where available, official practice assessment, and a final study-guide review. This order prevents a practice score from becoming your first exposure to the terminology.
The AB-900T00-A course is listed as a one-day course, but that duration is a course listing, not a guarantee that one day is enough for the exam. A learner with little Microsoft 365 background may need additional reading and practice; an administrator may use the course as a fast orientation and spend more time on Copilot governance.
How to take notes that transfer to scenarios
Use a four-column table with these headings: requirement, object or control, administration location, and reason. Populate it with examples such as assigning a license, controlling access, protecting sensitive information, investigating activity, finding content, or monitoring Copilot and agent use.
Add a fifth column for common confusion. Examples include authentication versus authorization, a site versus a library, a label versus retention, a policy versus an alert, and a license assignment versus permission to access data. Scenario questions often become clearer when these pairs are separated.
A practical AB-900 study roadmap
A staged plan works better than reading every product page at the same depth. First map the blueprint, then build the Microsoft 365 object and security foundation, next study Purview and Copilot data governance, and finally work through Copilot and agent administration scenarios. Finish by using practice results to target weak areas rather than restarting the entire syllabus.
The roadmap below is deliberately activity-based. Adjust the time assigned to each stage to your background and schedule; Microsoft does not prescribe a universal preparation duration for AB-900.
Stage 1: establish the scope
Read the official study guide from beginning to end. Copy its three domain names into a checklist, including the associated percentage range in each entry. Mark every bullet as familiar, partly familiar, or unfamiliar. Do not begin with random practice questions; first determine what the exam is designed to assess.
Review the certification page for the current exam experience, available preparation links, language information, scheduling route, and policy links. Record the date of the study guide’s skills version in your notes so you know when to recheck it.
Stage 2: build the Microsoft 365 foundation
Study users, groups, teams, sites, libraries, mailboxes, distribution groups, domains, organization settings, and licensing. For each, answer three questions: what does it represent, who or what uses it, and where would an administrator configure or inspect it?
Move next to identity and security. Review authentication methods, authorization, MFA, Conditional Access, SSO, Zero Trust, Microsoft Entra, Defender XDR, audit logs, risky sign-ins, PIM, app registrations, and enterprise applications. Practice explaining the difference between proving identity and deciding what an identity may do.
Use portal orientation carefully. You do not need to turn every navigation item into a memorization exercise. Instead, match an administrative task to the product or center named by the study guide, then confirm the object and outcome.
Stage 3: study protection and governance
Create a Purview comparison sheet for Information Protection, sensitivity labels, classification, DLP, retention, Insider Risk Management, Communication Compliance, DSPM for AI, Data Lifecycle Management, Compliance Manager, Data Explorer, Activity Explorer, and eDiscovery. Include the signal each tool examines and the kind of question it helps answer.
Then study Copilot data security. Trace a hypothetical request from the user’s identity and permissions through Microsoft 365 data and Microsoft Graph to the response. Ask where oversharing, poor permissions, sensitive content, retention requirements, or compliance controls could affect risk. This is more useful than memorizing isolated feature descriptions.
Review responsible AI principles and governance risks alongside technical controls. The goal is to recognize a responsible administrative response when a scenario includes sensitive business data, inappropriate access, an unusual activity signal, or a compliance concern.
Stage 4: learn the Copilot and agent administration lifecycle
Study Copilot features, licensing models, license assignment, usage and billing monitoring, prompts, and agent creation and monitoring. Place each task in a lifecycle diagram and identify the relevant administration center. Include Power Platform admin center responsibilities where the study guide indicates them.
Use scenario cards rather than long summaries. One card might ask which action addresses lack of access; another might ask how to monitor adoption or billing; another might ask how an administrator should investigate a data-protection concern. Write the answer and the reason, then check it against Microsoft Learn documentation.
Stage 5: validate and repair gaps
Take the official AB-900 Practice Assessment after you have studied the domains once. Microsoft says Practice Assessments are available at no cost and can be attempted as many times as desired. Use the report to classify each missed item as a terminology gap, a control-selection gap, a portal or object gap, or a reading mistake.
Return to the source material for each category, then retake the assessment only after doing corrective study. A repeated answer pattern is not proof of readiness. Microsoft explicitly says practice questions are not the same as live exam questions and do not represent the exam’s full length or complexity.
Stage 6: rehearse the exam interface and decision process
Use the official exam sandbox before the appointment. It lets you interact with different question types in the interface used for the exam and understand the look and feel of the environment. This is a practical way to reduce interface uncertainty without relying on unauthorized question material.
On your final review, read the study guide’s domain labels and your confusion table. Avoid starting a new product area at the last moment unless it directly addresses a demonstrated gap. Prepare your account and scheduling details through the official Microsoft certification route, and verify current information there before booking.
What the exam experience officially includes
Microsoft states that AB-900 is proctored and may include interactive components. The certification page states that candidates have 45 minutes to complete the assessment. Use the sandbox to understand the interface, but do not infer the exact mix of question types, cases, or interactive tasks from a practice assessment.
The certification page lists English as an exam language. Language availability and accommodations can change, so confirm the current scheduling information on the official page rather than relying on a third-party listing. Microsoft’s study guide says that if the exam is not available in your preferred language, you can request an additional 30 minutes to complete it.
Microsoft’s study guide states that a score of 700 or greater is required to pass. Treat that as the official scoring threshold, not as a target for guessing how many questions must be correct: the relationship between a score and individual items is not supplied here.
Scheduling and account housekeeping
Use a personal Microsoft account when registering if possible. The certification page strongly recommends this because exam records may be lost and unrecoverable if an organizational account is used and you later leave that organization. Check the official page for the current Pearson VUE or Certiport scheduling route that applies to you.
Confirm the exam language, appointment details, accommodation process, and current policy before scheduling. If you need assistive devices, extra time, or another modification, request an accommodation through Microsoft’s stated process rather than assuming the standard appointment includes it.
Retake planning
If an attempt is unsuccessful, Microsoft states that the first retake can be taken 24 hours after the first attempt; later retake intervals vary. A retake is most useful when you can identify the domain and reasoning error that caused the result.
Before scheduling another attempt, rebuild the weak area from the blueprint and documentation. Do not use a retake interval to search for leaked questions or exam dumps. Such material is not a substitute for understanding Microsoft 365 administration, governance, and Copilot controls, and it cannot establish what will appear on a live assessment.
How to prepare without overstudying the wrong topics
The most efficient preparation is selective, not shallow. Allocate study effort according to the official domain ranges, then adjust for your own baseline. A Microsoft 365 administrator may need more Copilot governance work; a learner familiar with AI tools may need more time on Exchange, SharePoint, Teams, Entra, Purview, and licensing objects.
Keep a boundary between foundational recognition and advanced implementation. AB-900 asks for basic administration and foundational understanding. If a documentation page leads into advanced development or deep security engineering, record the concept needed for the blueprint and return to the exam domain unless the study guide explicitly connects the advanced topic.
Common mistakes that waste preparation time
Studying prompts while ignoring permissions is a major coverage error. Copilot administration is connected to identity, licensing, data access, governance, and monitoring; prompt familiarity alone does not cover the measured skills.
Memorizing portal names without learning objects is another weak approach. A scenario may describe a mailbox, distribution group, SharePoint site, library, team, channel, or policy without naming the administration center. Learn the relationship between the object and its management context.
Treating Purview features as synonyms creates avoidable confusion. Labels, retention, DLP, insider risk, communication compliance, eDiscovery, and activity investigation address different governance questions. Use your comparison sheet to decide what each control is intended to identify, protect, retain, investigate, or report.
Relying on practice questions as a complete simulation is unsafe. Microsoft says the Practice Assessment provides insight into style, wording, and difficulty, but its questions are not the live questions and do not represent the exam’s full length or complexity. Use it for diagnosis, not memorization.
Ignoring blueprint updates can make otherwise good notes stale. The AB-900 study guide identifies the skills measured as of July 22, 2026 and notes that localized versions may not update on the same schedule as English. Recheck the official guide when preparing over a long period.
A better final review method
For each domain, explain five scenarios aloud or in writing: grant or restrict access, locate the right object, protect sensitive data, investigate a signal, and administer or monitor Copilot or an agent. If you can name the relevant object or control and explain why it fits, you are reviewing reasoning rather than just vocabulary.
Keep a short list of unresolved terms. Resolve those terms using Microsoft Learn documentation, then remove them from the list only when you can distinguish them from their nearest alternatives. This prevents a final study session from becoming another passive reading cycle.
A decision checklist before you schedule
Schedule only after you can connect the blueprint to a specific study record. You should know which domain is weakest, which resources you used to repair it, and whether you have practiced the exam interface. You should also have checked the current official exam page for duration, language, delivery, accommodations, and registration details.
Readiness is not the same as recognizing familiar product names. You are in a stronger position when you can select an appropriate object, explain the access or governance consequence, and justify the administrative action in a short scenario.
Knowledge checklist
Confirm that you can identify the roles of users, groups, teams, sites, libraries, mailboxes, distribution groups, licenses, domains, and organization settings.
Confirm that you can distinguish authentication, authorization, MFA, Conditional Access, SSO, Zero Trust, audit activity, risky sign-ins, PIM, app registrations, and enterprise applications.
Confirm that you can explain the purposes of Microsoft Purview protection, governance, risk, compliance, retention, discovery, and activity tools, as well as Copilot’s relationship to permissions, Microsoft Graph, and organizational data.
Confirm that you can describe basic Copilot and agent administration, including licensing, assignment, prompts, monitoring, usage or billing review, and the relevant Microsoft 365 or Power Platform administration experience.
Action checklist
Read the current AB-900 study guide and record its skills version.
Complete the relevant beginner training or learning paths and use documentation to resolve specific gaps.
Take the no-cost official Practice Assessment, review the report, and study each weak topic rather than memorizing answer patterns.
Run the official exam sandbox.
Verify the current official scheduling page, account choice, language, accommodations, and exam policies before booking.
What to do next
Begin with the official AB-900 study guide and create the three-domain checklist today. Spend the first study block identifying Microsoft 365 objects and administration centers, then move to identity and security before studying Copilot governance. This order gives later topics a usable foundation instead of leaving Copilot as a collection of disconnected feature names.
When your first pass is complete, use the official Practice Assessment as a gap detector and the exam sandbox as an interface rehearsal. Return to the official certification page immediately before scheduling because delivery, language, policy, and other exam details are subject to change. Prepare to demonstrate understanding of administration decisions—not access to live questions.
Conclusion
AB-900 preparation should produce a clear administrative mental model: Microsoft 365 objects and identities determine access, governance controls protect and investigate data, and Copilot and agents are configured and monitored within that environment. Follow the measured domains, give data protection and governance its largest planned study share, validate gaps with Microsoft’s official resources, and confirm current exam details before scheduling. That approach is more reliable than memorizing unofficial question collections and keeps preparation aligned with the certification’s stated purpose.
