TL;DR
A one-page recap of the stable facts on the Microsoft AB-400 (Power Platform Developer Associate) exam, grouped by the four exam domains: plug-in stages, execution context, service protection limits, endpoint behavior, alternate keys, and flow and PCF rules.
Full disclosure: MSCertQuiz sells AB-400 practice exams, and the team that writes those questions wrote this sheet too. Facts come from Microsoft Learn, including the Dataverse event framework and service protection limits pages.
Domain weights and what sits in each
| Domain | Weight | Main objective groups |
|---|---|---|
| Build Microsoft Power Platform solutions | 15–20% | Technical architecture, solution component design, ALM |
| Extend the user experience | 25–30% | Client scripting, PCF code components, code apps, code app deployment |
| Extend Microsoft Power Platform | 35–40% | Plug-ins, platform APIs, Azure Functions, flows, Foundry agents |
| Develop integrations | 10–15% | Dataverse events, data synchronization, custom connectors |
Domain 1: pipelines and lifecycle
| Item | Rule |
|---|---|
| Personal pipeline (platform host) | One development and two target environments; cannot be extended or shared |
| Custom pipelines host | Governed pipelines; extensible with Power Automate approvals, shareable, more than two stages |
| Development + host in one environment | Not supported |
| Environment variable definition | Travels with the solution |
| Environment variable value | Set per environment; supply it in the deployment settings file for automated imports |
Domain 1: where the logic belongs
| Requirement | Mechanism |
|---|---|
| Stop a save before the database transaction starts | Synchronous PreValidation plug-in that throws InvalidPluginExecutionException |
| Set or change a value before the row is saved | PreOperation plug-in on the target |
| Immediate check in the form with no server round trip | Client script or business rule |
| Work that can finish after the save, outside the user wait | PostOperation step in asynchronous mode |
| Long-running work called from a flow | Azure Function, polled through a Durable Functions starter |
Domain 2: client scripting and PCF
| Item | Rule |
|---|---|
| Cancel a form save | Register with addOnSave; call executionContext.getEventArgs().preventDefault() |
| Cancel a process status change | formContext.data.process.addOnPreProcessStatusChange, then getEventArgs().preventDefault() |
| Post-change process events | Fire after the change; cannot undo it |
| PCF lifecycle | init, updateView, getOutputs, destroy |
| PCF manifest | ControlManifest.Input.xml; declare Device, Utility, and WebAPI features there |
| pac pcf push without --solution-unique-name | Temporary unmanaged PowerAppsTools solution tied to the publisher prefix |
| Code app and data loss policy | Enforced when the app launches |
Domain 3: the event execution pipeline
| Stage | Number | Transaction | Use it for |
|---|---|---|---|
| PreValidation | 10 | Outside for the initial operation, before security checks | Cancel by throwing InvalidPluginExecutionException |
| PreOperation | 20 | Inside | Change values on the target before it is saved |
| MainOperation | 30 | Internal | Reserved, except custom APIs and custom virtual table data providers |
| PostOperation | 40 | Inside; async steps run outside | Work after the save; async mode is allowed only here |
Domain 3: execution context members
| Member | Holds |
|---|---|
| InputParameters | The request message, such as Target |
| OutputParameters | The response values, available after the main operation |
| SharedVariables | Data passed between plug-ins in one pipeline |
| ParentContext.SharedVariables | Where PreOperation and PostOperation plug-ins find values set in PreValidation for Create, Update, Delete, RetrieveExchangeRate |
| PreEntityImages / PostEntityImages | Row snapshots registered by alias; PostEntityImages exist only in PostOperation |
Domain 3: custom API message type
| Choice | HTTP | Changes data? |
|---|---|---|
| Function | GET, parameters in the URL | No |
| Action | POST, parameters in the body | Yes |
| Private flag | No effect on the method | Controls discoverability only |
Domain 3: service protection limits
| Measure | Default per web server | Response |
|---|---|---|
| Requests | 6,000 in a five-minute sliding window | 429 with Retry-After |
| Combined execution time | 20 minutes (1,200 seconds) in the same window | 429 with Retry-After |
| Concurrent requests | 52 or more | 429 with Retry-After |
| Scope | Per user; not applied to plug-in or workflow code | Use x-ms-dop-hint for parallelism |
Domain 3: Azure Functions and flow rules
| Situation | Rule |
|---|---|
| HTTP-triggered function, 20-minute job | HTTP response limit is 230 seconds; use a Durable Functions starter that returns 202 Accepted with a Location header and poll it |
| Premium plan unbounded timeout | Does not lift the 230-second HTTP response limit |
| Scheduled or event-driven work | Timer trigger for schedules; queue, Service Bus, or Event Hubs triggers for events |
| Flow trigger condition | Must start with @; multiple conditions combine with AND; evaluated before a run is created |
| OR logic in a trigger | One condition that uses @or(...) |
| Condition action as first step | Runs after the trigger already created a run |
Domain 4: endpoints and event delivery
| Item | Behavior |
|---|---|
| One-way Service Bus contract, no listener | Post fails; retries at longer intervals until the async system job is aborted and shows Failed |
| Queue endpoint | Message waits in the queue until read |
| Async webhook step failing | Open the failed System Job; the registration can delete the job on success |
| Endpoints registered with the Plug-in Registration Tool | Webhooks, Azure Service Bus, Azure Event Hub |
Domain 4: alternate keys
| Limit | Value |
|---|---|
| Keys per table | Up to 10 |
| Key size | 900 bytes and 16 columns |
| Allowed column types | Decimal, whole number, single line of text, date and time, lookup, choice |
| Column security | A column that uses it cannot join a key |
| Characters that break GET and PATCH | / < > * % & : \ ? + |
| Virtual tables | Alternate keys are not supported |
Not on this sheet by design: Foundry agents, MCP servers, Work IQ, policy templates, and background operations. Their documentation is still changing, so check the live Microsoft Learn page instead of a snapshot.
Turn these tables into answers
Drill stage order, limits, and endpoint behavior on scenario questions where a wrong option is built from a near-miss of these facts.
Start AB-400 practice →Using this sheet
Is this cheat sheet enough to pass AB-400?
No. It holds stable reference facts only. Use the study guide for sequencing and practice questions for application.
Why are the agent and code app topics so thin here?
Foundry agents, MCP servers, Work IQ, and code apps rest on documentation that is still changing. Read the live Microsoft Learn pages for those topics before the exam.
Where do the figures come from?
Limits and stage behavior come from Microsoft Learn pages on the Dataverse event framework, service protection API limits, and alternate keys, checked on October 15, 2026.
Can I print it?
Yes. The tables print cleanly; use your browser print dialog.