AB-900 Exam Study Guide 2026 Syllabus Tips and Study Plan

Microsoft 365 Copilot and AI agents are changing the way organizations manage information, automate tasks, and support employees. However, introducing these tools into a workplace involves more than simply purchasing licenses. Administrators must understand user access, security, data protection, governance, agent management, and responsible AI.

The Microsoft AB-900 exam is designed to test these foundational administrative skills. It covers Microsoft 365 services, identity and security, Microsoft Purview, Copilot administration, and the management of AI-powered agents.

This detailed AB-900 exam study guide explains the latest exam syllabus, important Microsoft services, preparation resources, common mistakes, and a practical 30-day study plan. Whether you are a new Microsoft 365 administrator or an IT professional moving into AI administration, this guide will help you prepare in a structured way.

What Is the Microsoft AB-900 Exam?

AB-900 is the required exam for the Microsoft 365 Certified: Copilot and Agent Administration Fundamentals certification.

It is a beginner-level certification, but it covers several important administrative areas. Candidates need to understand how Microsoft 365 services work and how Microsoft Copilot and AI agents interact with organizational data, permissions, security policies, and governance controls.

The exam focuses on three major areas:

Core Microsoft 365 services and objects
Data protection and governance for Microsoft 365 and Copilot
Basic administration of Copilot and agents

Microsoft describes the related AB-900 training course as suitable for beginning-level IT professionals and novice administrators. Previous hands-on experience is not strictly required, but practical familiarity with Microsoft 365 will make the exam easier.

You can use updated AB-900 practice questions to evaluate your knowledge after completing each part of the syllabus.

AB-900 Exam Details

Here is a quick overview of the Microsoft AB-900 exam:

Exam detail	Information
Exam code	AB-900
Certification	Microsoft 365 Certified: Copilot and Agent Administration Fundamentals
Certification level	Fundamentals
Exam duration	45 minutes
Passing score	700 out of 1,000
Question types	Multiple-choice and other interactive formats may appear
Exam provider	Pearson VUE
Student exam provider	Certiport
Available language	English
Exam price	Based on the candidate’s country or region
Recommended experience	Foundational Microsoft 365 and Copilot knowledge

Microsoft does not list one fixed global price for AB-900. The cost is displayed according to the country or region where the exam is taken.

Always review the official Microsoft AB-900 certification page before booking because exam availability, pricing, languages, and policies may change.

Who Should Take the AB-900 Certification?

The AB-900 certification is suitable for people who want to develop foundational knowledge of Microsoft 365 Copilot and AI agent administration.

The exam may be valuable for:

Junior Microsoft 365 administrators
IT support professionals
Help desk technicians
Functional consultants
Microsoft 365 users
Security and compliance beginners
Copilot adoption specialists
AI administration beginners
Students beginning a Microsoft career
Professionals responsible for organizational AI adoption

You do not need to be an advanced Microsoft 365 engineer. However, you should understand the purpose of common services such as Exchange Online, SharePoint, Microsoft Teams, Microsoft Entra, and Microsoft Purview.

Skills Measured in the AB-900 Exam

According to Microsoft’s syllabus effective July 22, 2026, the exam covers three skill areas.

AB-900 exam domain	Exam weight
Identify the core features and objects of Microsoft 365 services	30–35%
Understand data protection and governance tasks for Microsoft 365 and Copilot	35–40%
Perform basic administrative tasks for Copilot and agents	25–30%

Data protection and governance carries the highest percentage. Candidates should therefore dedicate enough preparation time to Microsoft Purview, Copilot data access, oversharing, and compliance risks.

Complete AB-900 Exam Syllabus

Core Features and Objects of Microsoft 365 Services

This section represents approximately 30–35% of the exam.

Candidates must identify the main Microsoft 365 objects and understand which admin center is used to configure them.

Core Microsoft 365 Objects

Start by understanding these common objects:

Users
Security groups
Microsoft 365 groups
Teams
Channels
Mailboxes
Distribution groups
SharePoint sites
Document libraries
Files and folders
Licenses
Roles and permissions

You should understand how licenses assigned to users and groups control access to Microsoft 365 products and features.

You should also know the basic purpose of the following administration portals:

Admin portal	Primary purpose
Microsoft 365 admin center	Users, licenses, domains and organization settings
Exchange admin center	Mailboxes, mail flow and distribution groups
SharePoint admin center	Sites, sharing, storage and access
Teams admin center	Teams, users, meetings and policies
Microsoft Entra admin center	Identity, authentication and access
Microsoft Purview portal	Compliance, data security and governance
Power Platform admin center	Environments, agents and Power Platform governance

The exam may describe an administrative requirement and ask you to select the correct portal or Microsoft 365 object.

Microsoft 365 Security Principles

The AB-900 exam study guide includes foundational Microsoft 365 security concepts.

Prepare these areas:

Zero Trust
Authentication
Authorization
Multifactor authentication
Single sign-on
Conditional Access
Threat protection
Microsoft Defender XDR
Risky sign-ins
Audit logs
Privileged Identity Management
Identity Secure Score

Zero Trust follows the principle that no user, device, application, or request should be automatically trusted. Access should be verified, limited to what is required, and continuously evaluated.

Authentication and Authorization

Authentication verifies the identity of a user. Authorization determines what an authenticated user is allowed to access or perform.

For example, a password combined with a mobile authentication request can verify the user’s identity. A SharePoint permission then determines whether that user can read, edit, or share a document.

Conditional Access

Conditional Access policies use signals to make access decisions. These signals may include:

User identity
Device status
Location
Application
Sign-in risk
Requested resource

A policy might require multifactor authentication when an administrator signs in from an unfamiliar location.

Privileged Identity Management

Microsoft Entra Privileged Identity Management helps organizations manage and monitor privileged access. It can provide time-limited, approval-based role activation instead of giving users permanent administrative permissions.

Data Protection and Governance for Microsoft 365 and Copilot

This is the largest section of the exam and accounts for approximately 35–40%.

Candidates need to understand how Microsoft Purview protects organizational information and how existing data permissions affect Copilot responses.

What Is Microsoft Purview?

Microsoft Purview provides tools for data security, compliance, information protection, risk management, and governance.

AB-900 candidates should understand the basic purpose of:

Information Protection
Data Loss Prevention
Data Lifecycle Management
Insider Risk Management
Communication Compliance
Compliance Manager
Data Explorer
Activity Explorer
Content Search
eDiscovery
Data Security Posture Management for AI

You do not need advanced configuration knowledge for every tool. However, you should be able to match an organizational requirement with the correct feature.

For example:

Use a sensitivity label to classify and protect confidential documents.
Use Data Loss Prevention to identify and restrict inappropriate sharing of sensitive information.
Use Insider Risk Management to identify risky user behavior.
Use Communication Compliance to detect policy violations in messages.
Use Data Lifecycle Management to retain or delete information according to organizational policies.

Sensitivity Labels

Sensitivity labels help classify and protect data according to its importance.

An organization might create labels such as:

Public
Internal
Confidential
Highly Confidential

Depending on their configuration, labels can apply encryption, access restrictions, content markings, or sharing controls.

Data Loss Prevention

Microsoft Purview Data Loss Prevention policies help identify sensitive information and prevent inappropriate sharing.

DLP can detect information such as:

Credit card numbers
National identification numbers
Health information
Financial records
Custom sensitive information types

Candidates should understand that DLP can monitor data across supported Microsoft 365 services and generate alerts when policy rules are matched.

How Does Microsoft 365 Copilot Access Data?

Copilot uses Microsoft Graph and works within a user’s existing permissions. It can use information that the signed-in user is already authorized to access.

This means Copilot does not automatically give every employee access to every file. However, it can make existing permission problems more visible. If a user already has unnecessary access to a sensitive SharePoint site, Copilot may use permitted content from that site when generating a relevant response.

That is why organizations should review permissions and correct oversharing before expanding Copilot access.

Important concepts include:

Microsoft Graph
User permissions
SharePoint access
Sensitivity labels
DLP policies
Audit logs
Responsible AI
Data residency
Compliance requirements

Responsible AI Principles

Candidates should understand Microsoft’s general responsible AI principles:

Fairness
Reliability and safety
Privacy and security
Inclusiveness
Transparency
Accountability

Responsible AI is not limited to preventing harmful answers. It also involves protecting information, explaining system limitations, monitoring results, and maintaining human accountability.

Identifying and Monitoring Oversharing

Oversharing happens when users have broader access to information than they need.

Common causes include:

Public or organization-wide SharePoint links
Incorrect group membership
Excessive site permissions
Unrestricted external sharing
Old access permissions
Poorly managed document libraries

Prepare to identify how the following features can help:

SharePoint data access governance reports
Restricted Access Control
SharePoint Advanced Management
Activity Explorer
Audit logs
Microsoft Purview tools

The objective is not to prevent collaboration. It is to ensure that users and Copilot can only access appropriate information.

Basic Administration of Copilot and Agents

This section accounts for approximately 25–30% of the exam.

It tests whether candidates understand Copilot features, licensing, monitoring, prompt management, and agent administration.

Copilot and Agent Capabilities

Microsoft 365 Copilot works across supported Microsoft 365 applications and organizational data. Agents can provide focused capabilities for specific information, processes, or business requirements.

Candidates should understand the differences between:

Built-in Copilot capabilities
Researcher
Analyst
Custom agents
Licensed Copilot access
Pay-as-you-go usage

Researcher can help users conduct multi-step research using available sources. Analyst can assist with data analysis and structured reasoning. Custom agents can be created for particular organizational knowledge or workflows.

Microsoft 365 Copilot Licensing

Study the differences between:

Monthly Copilot licensing
Pay-as-you-go billing
User-assigned licenses
Supported SharePoint pay-as-you-go scenarios

You should know how an administrator assigns licenses and where Copilot usage or billing policies can be monitored.

Monitoring Copilot Usage

Administrators can evaluate Copilot adoption and usage through supported reporting and analytics features.

Important areas include:

Microsoft 365 admin center
Copilot Analytics
Usage reports
Adoption trends
Pay-as-you-go billing policies
User readiness
Feature availability

Usage information can help an organization determine whether employees are adopting Copilot and whether additional training is necessary.

Managing Prompts

The updated AB-900 syllabus includes basic prompt-management actions such as:

Saving prompts
Sharing prompts
Scheduling prompts
Deleting prompts

Candidates should understand that prompts may become reusable organizational assets. Shared prompts should therefore be managed according to access, data, and governance requirements.

Basic Agent Administration

Prepare for questions involving:

Configuring user access to agents
Creating an agent
Understanding agent approval
Monitoring agent usage
Reviewing operational insights
Managing the agent lifecycle
Applying governance controls

Administrators may work with both the Microsoft 365 admin center and the Power Platform admin center when managing agents.

AB-900 30-Day Study Plan

Week 1: Learn Microsoft 365 Fundamentals

Focus on:

Users and groups
Microsoft 365 licenses
Exchange Online
SharePoint sites and libraries
Microsoft Teams
Admin centers
Authentication and authorization

Create a table that matches every Microsoft 365 object with its appropriate admin center.

Week 2: Study Identity, Security and Microsoft Purview

Cover:

Microsoft Entra ID
Multifactor authentication
Conditional Access
Single sign-on
Zero Trust
Microsoft Defender XDR
Sensitivity labels
DLP
Retention
Insider Risk Management
Communication Compliance

Pay special attention to the difference between tools that sound similar.

Week 3: Learn Copilot and Agent Administration

Study:

How Copilot accesses organizational data
Microsoft Graph
User permissions
Copilot licenses
Pay-as-you-go options
Researcher and Analyst
Custom agents
Agent approval
Agent monitoring
Prompt management

If you have access to a Microsoft 365 test environment, explore the administration portals and identify where each feature appears.

Week 4: Complete Practice Tests and Review Weak Areas

During the final week:

Take a timed AB-900 practice test.
Review every incorrect response.
Group mistakes by syllabus domain.
Return to Microsoft Learn for weak topics.
Repeat questions after studying the explanation.
Use the official exam sandbox.
Practice completing questions within 45 minutes.

You can review Microsoft AB-900 practice material after completing the syllabus.

Best Resources for AB-900 Preparation

Use a combination of official learning, practical exploration, notes, and practice questions.

Recommended resources include:

Official documentation should remain the primary source for current product behavior and exam changes.

How to Use AB-900 Practice Questions

Practice questions are most valuable when you use them to identify knowledge gaps.

Follow this method:

Finish the relevant Microsoft Learn modules.
Take a practice test without using notes.
Review both correct and incorrect answers.
Write down the reason behind each mistake.
Study the related product or feature.
Retake the assessment after a few days.
Focus on understanding scenarios rather than memorizing wording.

Microsoft also provides a free official practice assessment for AB-900. It is designed to introduce the style and difficulty of the certification questions, but it is not a replacement for training or experience.

Common AB-900 Exam Preparation Mistakes

Avoid these common mistakes:

Studying Copilot but ignoring Microsoft 365 fundamentals
Confusing authentication with authorization
Ignoring Microsoft Purview
Memorizing portal names without understanding their purpose
Assuming Copilot can access all organizational data
Skipping SharePoint permission and oversharing topics
Confusing Copilot with custom agents
Ignoring licensing and pay-as-you-go billing
Memorizing practice-test answers
Using material based on an outdated syllabus

The exam tests whether you can connect a requirement with the correct Microsoft feature.

AB-900 Exam-Day Tips

On exam day:

Read the complete question before viewing the options.
Identify whether the question concerns identity, security, governance, Copilot, or agents.
Look for words such as “best,” “most appropriate,” or “least administrative effort.”
Eliminate options that use the wrong admin center.
Flag difficult questions and return to them later.
Do not spend too much time on one scenario.
Leave enough time for a final review.

Microsoft gives candidates 45 minutes for the assessment, so time management is important.

Frequently Asked Questions About AB-900

Is AB-900 a beginner-level exam?

Yes. AB-900 is a fundamentals-level exam for candidates developing foundational knowledge of Microsoft 365 Copilot and agent administration.

What is the passing score for AB-900?

Microsoft states that candidates need a scaled score of 700 or greater to pass its technical certification exams. A score of 700 does not necessarily mean exactly 70% of questions were answered correctly.

How long is the AB-900 exam?

Candidates have 45 minutes to complete the exam.

How many questions are on the AB-900 exam?

Microsoft does not promise a fixed question count for this specific exam. The number and type of questions can change. Candidates should rely on the official exam page rather than websites claiming an exact guaranteed number.

Is practical experience required for AB-900?

Advanced experience is not required, but familiarity with Microsoft 365, Copilot, Microsoft Entra, SharePoint, and Microsoft Purview can make preparation easier.

Is AB-900 the replacement for MS-900?

No. AB-900 and MS-900 are separate exams. MS-900 covers general Microsoft 365 fundamentals, while AB-900 focuses on Copilot, AI agents, data governance, and related administrative responsibilities.

Does AB-900 include Microsoft Purview?

Yes. Data protection and governance is the largest exam domain. Candidates should understand sensitivity labels, DLP, retention, insider risk, communication compliance, eDiscovery, and DSPM for AI.

Are AB-900 practice questions enough to pass?

Practice questions can identify weak areas, but they should be combined with Microsoft Learn, official documentation, and practical exploration.

What happens if I fail AB-900?

Microsoft normally allows a second attempt 24 hours after the first failed attempt. Longer waiting periods apply to subsequent attempts. Check the latest Microsoft exam retake policy before scheduling another attempt.

The AB-900 certification is a valuable starting point for professionals who want to understand how Microsoft 365 Copilot and AI agents are administered in a secure organization.

Successful preparation requires more than learning Copilot features. You should understand Microsoft 365 objects, admin centers, Microsoft Entra security, Microsoft Purview, data permissions, oversharing risks, Copilot licensing, prompt management, and the agent lifecycle.

Use this AB-900 exam study guide as a preparation checklist. Start with Microsoft 365 fundamentals, spend additional time on data protection and governance, and then practice Copilot and agent administration scenarios.

Once you have completed the official learning material, assess your readiness with updated AB-900 practice questions and review every weak topic before exam day.

AB-900 Exam Study Guide 2026 Syllabus Preparation Tips and Study Plan