AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals
A condensed guide to Microsoft Exam AB-900, written from Microsoft Learn and organised around the skills list of 14 October 2026.
The guide is free. An account keeps it in your dashboard, where each module opens in order.
What is inside
Introduction to AB-900
By the end of this module you will know which credential AB-900 earns, what Microsoft assumes you can already do before you book it, how the three skill areas and their fifty-three bullets are weighted, why Microsoft Purview deserves more of your study time than any other product, what a scaled pass mark of 700 does and does not mean, and why the 14 October 2026 update should change almost nothing about how you prepare.
about 17 min
The core objects of Microsoft 365
How to tell which admin centre owns which object, what a licence assigned to a person or to a group actually switches on, how domains and organisation settings shape the whole tenant, and how mailboxes, distribution lists, sites, libraries, folders, teams, channels and policies fit together well enough to answer a scenario question without guessing.
about 20 min
Microsoft 365 security principles
How to explain the three Zero Trust principles in a sentence each, tell proving identity apart from granting permission and name the four ways permission is decided, choose between the authentication methods Microsoft Entra ID supports and say which resist phishing, describe the layers of email threat protection and where threat intelligence fits, and say what Microsoft Defender XDR adds on top of the products underneath it.
about 20 min
Core security features
How to explain what Microsoft Entra ID does for a tenant, choose between a user and a group as the thing you grant access to, read a Conditional Access policy as an if-then rule, work a failed sign-in from the sign-in logs through the sign-in diagnostic and the risk reports, interpret Identity Secure Score without over-reading it, find the right audit log for a change, say what Privileged Identity Management is for, and tell an app registration apart from an enterprise application.
about 20 min
Microsoft Purview, what each piece is for
How to tell the six Purview solutions the exam names apart by the job each one does, pick the right one for a scenario, explain what a sensitivity label can actually enforce, describe the three ways Purview classifies content, and work out what survives when several retention settings land on the same file.
about 20 min
How Copilot reaches data
How to explain, in a governance meeting or an exam question, exactly what happens between a user typing a prompt and Copilot answering it: which data it may touch, what Microsoft Graph and the semantic index add, which Microsoft 365, Microsoft Purview and Microsoft Defender controls are doing the enforcing at each stage, and what Microsoft's six responsible AI principles look like once they are built into a product.
about 20 min
Finding the risk
How to pick the right Microsoft Purview instrument for a question an auditor, a lawyer or an executive has just asked you, from measuring your distance to a standard in Compliance Manager through locating sensitive files in Data explorer, tracing what people did with them in Activity explorer, triaging DLP and Communication Compliance alerts, scoring insider risk, watching AI activity in DSPM for AI, and retrieving the actual document with Content search in eDiscovery.
about 19 min
Oversharing in SharePoint
How to recognise the signals that a tenant is overshared, which tool in the SharePoint admin centre answers which question, how to run and read a data access governance report including what it leaves out, and how SharePoint Advanced Management closes the gap afterwards with restricted access control, site access reviews and restricted content discovery.
about 19 min
What Copilot and agents can do
How to tell Copilot's built-in capabilities apart from what an agent adds, choose between a monthly per user licence and pay-as-you-go billing (including the awkward middle ground of SharePoint agents), name the Copilot features you can turn on or off and where each switch lives, and recognise the work that belongs to Researcher, to Analyst, or to an agent somebody in your organisation has to build.
about 20 min
Administering Copilot
How to get a Copilot licence onto the right person and take it off cleanly, run pay-as-you-go billing policies and the budgets that warn you without stopping anything, read the readiness, usage and Copilot Analytics numbers for what they actually measure, and manage the three separate kinds of prompt object a tenant ends up holding.
about 20 min
Administering agents
How to decide who may reach an agent through licences, tenant settings and per-agent assignment, what it actually takes to build one in SharePoint, Agent Builder, Copilot Studio or the Agents Toolkit, how the Requests queue turns a colleague's agent into a published one, and how to read usage, operational insights and lifecycle actions across the Microsoft 365 admin center and the Microsoft Power Platform admin center.
about 20 min
Final review and exam day
The revision page for the last week before AB-900, pulling the eleven teaching modules into three area recaps, giving you a cue for every scenario that turns on a near miss between two tools, listing the names you meet twice under different labels, and setting out what a 45 minute Fundamentals exam actually feels like from check-in to score report.
about 19 min
How it was written
These study notes summarise Microsoft Learn material for Exam AB-900, which leads to the Microsoft Certified: Microsoft 365 Copilot and Agent Administration Fundamentals certification. It is the administrator side of the same product AB-730 covers from the business user side: who may use Copilot, what it is allowed to reach, and how you show both to an auditor.
Fundamentals here means breadth rather than depth. The skills list runs to fifty-three bullets across ten groups, covering identity, Zero Trust, conditional access, Defender XDR, the whole of Microsoft Purview, oversharing in SharePoint, licensing and agent administration. The guide keeps to the depth the exam actually asks for.
Every module is written from the current documentation rather than copied from it, and was checked against Microsoft Learn a second time before publishing, by someone other than the writer. Each module says when it was last checked and links the Learn pages it drew on.
For the official list of skills measured, see the Microsoft Learn study guide for Exam AB-900.