Microsoft 365 Certified – Copilot and Agent Administration Fundamentals (AB-900)

Learning plan

About 20 hours of focused study, split into 4 phases. Pick your weekly pace and the timeline adjusts.

Estimated finish: 2 weeks

What the exam covers

Source: official exam guide. Weights can change, so check before you start.

Before you start

• A Microsoft 365 test tenant with admin rights (a trial tenant or the Microsoft 365 Developer Program if you qualify). Never practise policy changes in production
• Basic identity vocabulary - users, groups, MFA, single sign-on

1. Week 1 · 6 h

   Microsoft 365 objects, identity and security

   • Explain how licences assigned to users and groups unlock features, and find org settings and domains in the Microsoft 365 admin center
   • Know which objects live in the Exchange (mailboxes, distribution groups), SharePoint (sites, libraries, permissions) and Teams (teams, channels, policies) admin centers
   • Explain Zero Trust, authentication vs authorization, Conditional Access, SSO, PIM, and app registrations vs enterprise applications in Microsoft Entra ID
   • Troubleshoot a failed sign-in with the Entra sign-in logs, MFA status and risky sign-ins, and read Identity Secure Score
   • Describe what Microsoft Defender XDR does for threat protection

   Hands-on: In a test tenant, create a security group, assign it a licence, then build a report-only Conditional Access policy that requires MFA for that group and check the sign-in log to see how it would have applied.

   Use: AB-900 study guide · AB-900T00 course and self-paced paths · Microsoft Entra ID documentation

2. Weeks 1–2 · 8 h

   Purview and Copilot data security (largest domain)

   • Explain how Copilot reaches data through Microsoft Graph and why it only returns what the user can already open
   • Use sensitivity labels, data classification, DLP, retention, Insider Risk Management and Communication Compliance, and know which one fits a scenario
   • Use DSPM for AI to discover AI activity and risky prompts, and use Content search in eDiscovery to find files and emails
   • Read Compliance Manager recommendations, Data Explorer and Activity Explorer results, and DLP alerts
   • Find oversharing with a SharePoint data access governance report, and restrict a site with SharePoint Advanced Management restricted access control

   Hands-on: Create a sensitivity label called Confidential, apply it to a test document in SharePoint, add a DLP policy that flags credit card numbers in Teams chats, then open DSPM for AI and review the recommended policies for Copilot.

   Use: Microsoft Purview documentation · Purview data security and compliance for AI · SharePoint Advanced Management

3. Week 2 · 4 h

   Copilot and agent administration

   • Assign Copilot licences and turn individual Copilot features on or off
   • Compare monthly Copilot licences with pay-as-you-go billing (including SharePoint), and set up and monitor a pay-as-you-go billing policy
   • Monitor adoption with Copilot Analytics and the usage reports in the Microsoft 365 admin center
   • Control who can use which agents, run the agent approval process, and track agent usage and lifecycle in the Microsoft 365 and Power Platform admin centers
   • Know the use cases for Researcher, Analyst and custom agents

   Use: Set up Microsoft 365 Copilot · Microsoft 365 Copilot documentation

4. Week 2 · 2 h

   Practice assessment and review

   • Take the free AB-900 practice assessment and re-study whichever Purview tool you mix up most
   • Build a one-page table of admin center to task (Entra, Purview, SharePoint, Teams, Microsoft 365, Power Platform)

   Use: Microsoft exam sandbox

You're ready to book when…

• You can name the right admin center and tool for any task in the study guide within a few seconds
• You can explain why Copilot oversharing is a permissions problem and list three tools that fix it
• You can tell DLP, sensitivity labels, retention and Insider Risk Management apart by scenario
• You score 80% or higher on the official practice assessment twice

Exam tips

• The exam is 45 minutes. Students and educators can book it through Certiport as well as Pearson VUE.
• The skills outline was updated on October 14, 2026, with minor changes to the core security features section.