AB-900 Study Guide

AB-900 measures whether you understand the Microsoft 365 environment an administrator looks after once Microsoft 365 Copilot and agents arrive: the core services and their admin centers, the identity and security features that protect them, the Microsoft Purview tools that protect and govern data, and the basic administration of Copilot licenses, billing, usage, prompts and agents. It is a fundamentals exam: most objectives ask you to identify, compare or choose the right admin center, feature or setting, with a few basic tasks such as assigning Copilot licenses and creating an agent.

The exam has three domains. Data protection and governance carries the most weight at 35-40%, the core features and objects of Microsoft 365 services carry 30-35%, and Copilot and agent administration carries 25-30%. Copilot runs through all three: it reaches organizational data with each user's own permissions, so the identity, permission and Purview topics of the first two domains are also how you govern Copilot.

Identify the core features and objects of Microsoft 365 services — 30-35%

Core objects: how license types assigned to users and groups decide which Microsoft 365 features people get, domain names and organization settings in the Microsoft 365 admin center, mailboxes and distribution groups in the Exchange admin center, sites, libraries and folders and the roles and permissions of SharePoint sites, and teams, channels and policies in the Teams admin center.

Security principles: the core Zero Trust principles, authorization, authentication methods, threat protection and intelligence, and the features and capabilities of Microsoft Defender XDR.

Security features: Microsoft Entra ID, Conditional Access policies, the purpose and benefits of single sign-on (SSO), users and groups as security objects, the tools for troubleshooting sign-in issues involving multifactor authentication (MFA), Conditional Access and risky sign-ins, Identity Secure Score, audit logs for user and admin activity, Privileged Identity Management (PIM), and app registrations versus enterprise applications.

Understand data protection and governance tasks for Microsoft 365 and Copilot — 35-40%

Microsoft Purview: Information Protection and the use cases for sensitivity labels, data classification, Data Loss Prevention (DLP), Insider Risk Management, Communication Compliance, Data Security Posture Management (DSPM) for AI, and Data Lifecycle Management and retention.

Copilot data security: how Copilot accesses data, how Microsoft Graph shapes its responses, how permissions and other controls in Microsoft 365, Microsoft Purview and Microsoft Defender protect against risks, and Microsoft's responsible AI principles.

Finding and responding to risks: compliance risks and recommendations in Compliance Manager, sensitive information in Data Explorer, user activities in Activity explorer, Insider Risk Management, DLP alerts, Communication Compliance policy violations, AI activity in DSPM for AI, and Content search in eDiscovery. Oversharing in SharePoint: the tools that troubleshoot it, data access governance reports, and SharePoint Advanced Management features such as restricted access control.

Perform basic administrative tasks for Copilot and agents — 25-30%

Capabilities: the built-in capabilities of Copilot compared with agents, the monthly Copilot license model compared with pay-as-you-go (including for SharePoint), which Copilot features can be turned on or off, and the use cases for Researcher, Analyst and custom agents.

Copilot administration: assigning Copilot licenses, monitoring and managing pay-as-you-go billing policies, monitoring usage and adoption with Copilot Analytics and the Microsoft 365 admin center, and managing prompts (saving, sharing, scheduling and deleting).

Agent administration: configuring user access to agents, creating an agent, the approval process for agents, and monitoring agent usage, operational insights and lifecycle in the Microsoft 365 admin center and the Microsoft Power Platform admin center.

The full bullet-level list lives in the official study guide. Treat it as your checklist:

The Official AB-900 Study Guide

How This Maps to CertiAce Practice Modules

The CertiAce question bank is organized by the two learning paths of the official AB-900 course on Microsoft Learn. The first path covers the first two skills-measured domains and the second covers the third, so use the mapping below and the topics behind your missed questions to identify the skills-measured areas to revisit:

AB-900 has no prerequisites: the certification page lists none. None of the three certifications above requires AB-900 or any other certification: Security, Compliance, and Identity Fundamentals (SC-900), AI Business Professional (AB-730) and Microsoft 365 and AI Services Administrator Associate (AB-650) list no prerequisites, so you can take them in any order. AB-900 is still useful groundwork for AB-650, which covers the same tenants, workloads, Purview protections and Copilot and agent governance at the associate level, and expects experience with Microsoft 365 workloads and Microsoft Entra ID, an understanding of Defender XDR capabilities, and familiarity with Microsoft Graph PowerShell.

The audience profile asks for familiarity with Microsoft 365 and its admin centers, and experience with AI-driven productivity tools and modern IT management practices. Check yourself against this table. Anything unfamiliar is where your preparation should start:

How long you need depends on where you start. Treat these estimates as planning guidance and adjust them to your starting knowledge and weekly study hours:

Step 1: Read the Official Study Guide

Skim the full skills-measured list once, and mark every bullet you could not explain to a colleague. That marked-up list is your personal syllabus: everything else in this plan exists to clear it. The change log for the October 14, 2026 update lists one minor change, in the core security features group. Product documentation moves faster than the skills list: many current product pages say Microsoft Copilot where the skills list says Microsoft 365 Copilot, and Microsoft Purview now lists DSPM for AI as DSPM for AI (classic) next to a newer Data Security Posture Management. Learn the skills-list names and expect to meet both in the docs. Most questions cover generally available features, but commonly used preview features may also appear.

The Official Study Guide

Step 2: Schedule Your Exam

Choose a realistic target date after reviewing the skills list and your available study time. A date on the calendar turns studying into a countdown, so pick one using the prep-time table above and plan backwards from it. Students and educators can also schedule through Certiport. The exam is available in thirteen languages. If the exam is not available in your native language, check the English as a Second Language accommodation and arrange any approved extra time before booking.

Exam accommodations

Certification and Exam Details Page

Step 3: Work Through the Official Learning Paths

Complete the two learning paths behind course AB-900T00-A on Microsoft Learn. The first covers core services, security foundations, and data protection and governance (the first two domains); the second covers Copilot and agent administration (the third). They are the same two modules you will find in CertiAce practice. Both paths expect basic functional experience with Microsoft 365 services and a proficient understanding of general IT practices. Product pages change faster than training modules, so if a unit and a current product page disagree, follow the product page. Take notes on concepts you cannot explain in simple terms, and flag anything that needs hands-on practice. If you prefer instructor-led training, course AB-900T00-A runs over one day.

Explore Microsoft 365 administration

Explore Microsoft 365 Copilot and agent administration

Step 4: Watch the Study Cram

John Savill's AB-900 Study Cram compresses the whole syllabus into one focused session with whiteboard explanations: ideal as a second pass after the learning paths, and again as a final refresher in your last days. It was published in December 2025, before the October 14, 2026 update, so cross-check its product names against the current skills list.

AB-900 Study Cram - Microsoft 365 Certified: Copilot and Agent Administration Fundamentals

Step 5: Get Hands-On Practice

AB-900 does not test click paths, but many questions ask which admin center, report, policy or setting fits a need, and those stick far better once you have seen them. A free one-month trial of a Microsoft 365 for business plan gives you a tenant with the Microsoft 365, Exchange, SharePoint, Teams and Microsoft Entra admin centers, which supports many of the core exercises. Microsoft 365 Business Premium is the most useful trial plan here because it includes Microsoft Entra ID P1 and Conditional Access. If the sign-up page offers versions with and without Teams, choose one with Teams. Make sure you personally:

• Review the domains and organization settings, and assign licenses to a user and to a group in the Microsoft 365 admin center
• Create a shared mailbox and a distribution group in the Exchange admin center, and a team with a private channel in Teams
• Create a team site, add a library inside it, and compare what the site's owners, members and visitors can do
• Create a Conditional Access policy in report-only mode, and investigate a sign-in in the Microsoft Entra sign-in logs
• Review your Identity Secure Score recommendations in the Microsoft Entra admin center
• Explore the Microsoft Purview portal: sensitivity labels, DLP policies and alerts, Compliance Manager, and an audit log search for an admin action
• With a Microsoft 365 Copilot license assigned, try Researcher and Analyst, then save, share and schedule a prompt
• Create an agent, then review the agent access and sharing settings and the usage reports in the Microsoft 365 admin center

Some objectives need more than that trial. Privileged Identity Management needs Microsoft Entra ID P2 or Microsoft Entra ID Governance, and risk-based Conditional Access needs Microsoft Entra ID P2. The free Microsoft Purview Suite trial adds the E5-level Purview solutions, including Insider Risk Management and Communication Compliance, for 90 days, but only to a tenant that has Microsoft 365 E3 (or Office 365 E3 with Enterprise Mobility + Security E3) and no E5. Researcher and Analyst come with a Microsoft 365 Copilot license, and pay-as-you-go billing policies bill to an Azure subscription. The Microsoft 365 Developer Program's E5 sandbox is limited to eligible members, such as Visual Studio Professional or Enterprise subscribers. Learn from the documentation what you cannot try, and turn off recurring billing on any trial you do not want to keep before it ends.

Try or buy a Microsoft 365 for business subscription

Microsoft Entra licensing

Step 6: Benchmark Your Knowledge

Use CertiAce to benchmark your readiness module by module. The practice modules map to the exam domains as shown above, so use the module mapping and the topics behind your missed questions to identify the skills-measured areas to revisit. Microsoft also offers a free official practice assessment for AB-900 on AI Skills Navigator (sign in to launch it). Aim for consistent performance across every module, not one lucky high score; pay particular attention to questions that separate similar tools (Data Explorer versus Activity explorer, app registrations versus enterprise applications, the Copilot license versus pay-as-you-go), and if a topic is unstable, go back to learning plus hands-on practice.

CertiAce AB-900 Exam Practice

Official Practice Assessment on AI Skills Navigator

Step 7: Take the Exam

The day before, review only your weak topics (no brand-new material). On exam day, read each question for what it is truly asking and eliminate wrong options first. Many AB-900 questions come down to matching a task to the right admin center, portal or tool, so settle that before you read the options: for example, licenses and Copilot settings in the Microsoft 365 admin center, Conditional Access and sign-in logs in the Microsoft Entra admin center, labels, DLP and audit search in the Microsoft Purview portal, incidents in the Microsoft Defender portal, and oversharing reports in the SharePoint admin center.

Worth knowing before you sit down:

• This is a closed-book exam: unlike the role-based exams, Microsoft Learn is NOT available during fundamentals exams.
• You can take unscheduled breaks, but the clock keeps running and you cannot return to questions you already saw.
• Watch the naming: the skills list uses names such as Microsoft 365 Copilot and DSPM for AI, while some current product pages use different ones, so cross-check product names and objectives against the current study guide.
• Try the exam sandbox beforehand so the question formats and interface hold no surprises: Exam Sandbox