Microsoft 365 is expanding beyond traditional productivity applications with the introduction of Copilot and AI-powered agents. As organizations adopt these capabilities, administrators need to understand not only how Microsoft 365 services work, but also how AI features are licensed, secured, governed, monitored, and managed.

The AB-900 exam, associated with Microsoft 365 Copilot and Agent Administration Fundamentals, focuses on these foundational administration skills. Microsoft currently classifies the certification at the beginner level and expects candidates to be familiar with Microsoft 365 services, security, identity and access, data protection, governance, Copilot, and agents.

Understand the AB-900 Exam Scope

A good preparation strategy starts with the current skills measured by Microsoft. As of July 22, 2026, Microsoft divides the exam into three major areas:

This distribution shows that data protection and governance receive the greatest emphasis. However, candidates also need a broad understanding of Microsoft 365 administration, security, Copilot capabilities, and agent management.

Microsoft currently lists 45 minutes for the assessment on the certification page, while the exact experience can include interactive components. A passing score of 700 or greater is required.

Learn the Core Microsoft 365 Objects

The first exam domain begins with Microsoft 365's basic services and administrative objects. Candidates should understand how users, groups, teams, sites, libraries, mailboxes, and distribution groups fit into the Microsoft 365 environment.

Licensing is an important part of this topic. You should understand how license assignments affect the features available to users and groups. Rather than memorizing every license combination, concentrate on understanding the relationship between licensing and service access.

Microsoft also expects candidates to recognize the appropriate administrative center for different tasks. The Microsoft 365 admin center, Exchange admin center, SharePoint admin center, and Teams admin center each provide tools for managing different workloads.

A practical exercise is to imagine an administrator receiving a request to modify a mailbox, configure a SharePoint site, or manage a Teams policy. Knowing which service and administrative center should be used is an important fundamental skill.

Build Microsoft 365 Security Knowledge

Security is closely connected with everyday Microsoft 365 administration. The AB-900 objectives include Zero Trust principles, authorization, authentication, threat protection, Microsoft Defender XDR, Microsoft Entra ID, Conditional Access, single sign-on, and identity-related troubleshooting.

Start with the difference between authentication and authorization. Authentication establishes who a user is, while authorization determines what that user is permitted to access.

Then study Conditional Access and understand how policies can evaluate factors such as users, applications, locations, devices, and risk before allowing access.

Microsoft Entra ID is another major area. Become familiar with users, groups, application registrations, enterprise applications, risky sign-ins, MFA, and Privileged Identity Management.

Instead of studying these features independently, connect them through realistic situations. For example, consider an employee signing in from an unfamiliar location. What identity controls could evaluate the sign-in, and how might the organization respond?

Explore Microsoft Purview

Data protection and governance represent 35–40% of the current AB-900 exam, making Microsoft Purview one of the most important preparation areas.

Candidates should understand the purpose of Microsoft Purview capabilities including Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Lifecycle Management, Compliance Manager, and Data Security Posture Management for AI.

Sensitivity labels deserve particular attention. Understand why organizations classify information and how labels can support data protection policies.

Retention is another important concept. Candidates should understand the role of retention policies and how organizations can manage information throughout its lifecycle.

The exam is not simply about identifying product names. You should understand which Purview capability addresses a particular governance or compliance requirement.

Understand How Copilot Accesses Data

Microsoft 365 Copilot introduces an important security concept: AI does not operate separately from the organization's existing permissions and controls.

Microsoft's AB-900 objectives specifically require candidates to understand how Copilot accesses data, how Microsoft Graph influences responses, and how permissions and controls across Microsoft 365, Purview, and Defender help protect information.

This is a crucial area to study because Copilot can surface information that a user already has permission to access. Poorly configured permissions and oversharing can therefore create governance concerns.

Think about the relationship between a user's access and the information Copilot can use when generating a response. This will help you understand why identity, SharePoint permissions, data governance, and Copilot administration are closely connected.

Study SharePoint Oversharing

SharePoint is an important part of the Copilot data ecosystem, so Microsoft includes oversharing as a specific area within the AB-900 objectives.

Candidates should know how to identify and monitor oversharing and understand tools available for investigating data access. Microsoft specifically references data access governance reports and SharePoint Advanced Management capabilities, including restricted access control.

A useful scenario is an organization where sensitive documents are stored in SharePoint and users have broader permissions than intended. Think about how an administrator could discover excessive access and what controls might help reduce the exposure.

This makes the topic easier to understand than simply memorizing feature descriptions.

Compare Copilot and Agents

The third domain focuses on basic Copilot and agent administration. Microsoft expects candidates to understand the differences between built-in Copilot capabilities and agents, including their use cases and licensing models.

Agents can provide specialized capabilities for particular business tasks, while Copilot offers broader AI assistance across Microsoft 365 experiences.

Microsoft's official learning path includes a dedicated module covering Copilot and agents, including their architecture, capabilities, licensing, deployment, and practical use cases.

When studying this section, focus on the questions an administrator would actually face:

What capability is needed? Which licensing model applies? Can a feature be enabled or disabled? Who should have access? How should usage be monitored?

Learn Copilot Licensing and Billing

Licensing is another important administrative responsibility. The AB-900 blueprint requires candidates to compare Copilot's monthly licensing model with pay-as-you-go options, including SharePoint scenarios. It also covers assigning Copilot licenses and managing pay-as-you-go billing policies.

The goal is to understand the administrative implications rather than memorize pricing figures that may change.

Study how administrators assign licenses, configure billing policies, and monitor usage. Microsoft also expects candidates to understand Copilot usage and adoption reporting through the Microsoft 365 admin center and Copilot Analytics.

This is a good example of why current Microsoft documentation should be part of your preparation.

Understand Copilot Monitoring and Prompts

Administration does not stop after Copilot is enabled. Organizations also need visibility into adoption and usage.

Microsoft includes prompt management as part of the current AB-900 objectives. Candidates should understand tasks such as saving, sharing, scheduling, and deleting prompts.

Monitoring should be approached from both technical and organizational perspectives. An administrator may need to identify whether users are actually adopting Copilot, which capabilities are being used, and whether additional governance or training is necessary.

This makes analytics an important complement to licensing and configuration.

Learn Basic Agent Administration

Agents introduce another administration layer. Microsoft expects AB-900 candidates to understand how to configure user access, create agents, understand approval processes, and monitor agent usage and lifecycle information.

The Microsoft 365 admin center and Microsoft Power Platform admin center both play roles in agent management.

Think about the full lifecycle of an agent: creation, approval, access, usage, monitoring, operational review, and eventual retirement. This lifecycle perspective helps connect the individual exam objectives.

Focus on Responsible AI

Responsible AI is particularly important because Copilot and agents operate on organizational information and influence how users work.

The AB-900 objectives include understanding responsible AI principles as they relate to Copilot. Candidates should consider transparency, appropriate data access, privacy, security, and responsible usage.

A strong administrator recognizes that simply turning on an AI feature is not the same as deploying it responsibly. Permissions, governance, security policies, and user awareness all contribute to a safer implementation.

Use Microsoft's Official Learning Resources

Microsoft provides several official preparation resources for AB-900. Its current study guide recommends self-paced learning modules, documentation, community resources, videos, and the Exam Readiness Zone.

Microsoft's certification page also provides a practice assessment designed to show candidates the style, wording, and difficulty of questions they are likely to encounter.

For additional revision, find practice material for AB-900 that reinforces the official exam objectives and helps you identify knowledge gaps. Practice questions are most useful when you review the reasoning behind each answer instead of memorizing response patterns.

A practical study sequence is to begin with Microsoft 365 administration, move into identity and security, then spend substantial time on Purview and Copilot data governance before finishing with Copilot and agent administration.

Practice Realistic Administrative Scenarios

Scenario-based revision can bring all these concepts together.

Imagine a company introducing Microsoft 365 Copilot to several departments. Before deployment, administrators need to review licenses, identity controls, SharePoint permissions, data governance, sensitive information, and Copilot settings.

Then imagine that an employee can see information through Copilot that should not be broadly available. You should be able to reason through whether the problem relates to permissions, oversharing, data governance, or another control.

Now consider an organization that wants a specialized AI assistant. You should understand when an agent may be appropriate, how access should be controlled, how approval works, and how its usage can be monitored.

These scenarios provide a much stronger learning experience than studying product definitions individually.

Prepare With an Administrator's Mindset

AB-900 is fundamentally about understanding how Microsoft 365 administration changes in an AI-enabled environment. The exam combines traditional Microsoft 365 concepts—users, groups, Teams, SharePoint, Exchange, Entra ID, authentication, and security—with newer areas involving Copilot, agents, Purview, AI governance, licensing, and monitoring.

Give particular attention to data protection and governance, since it represents the largest portion of the current blueprint. At the same time, build enough practical knowledge to understand how Copilot and agents are deployed and administered.

Using Microsoft's current study guide, official learning paths, documentation, practice assessment, and hands-on administrative scenarios can give you a structured foundation for approaching the AB-900 exam with greater confidence.