AB-900 Study Guide 2026: Complete Exam Breakdown & Pass Strategy
Everything you need to pass the Microsoft 365 Copilot and Administration Fundamentals exam — all 3 domains explained, a 3-week study plan, and what actually appears on exam day.
Quick Summary
- • AB-900 is a Fundamentals-level exam: 40–60 questions, 60 minutes, 700/1000 passing score
- • Covers 3 domains: M365 core services, data protection & governance, Copilot & agent administration
- • Most candidates pass with 2–3 weeks of preparation
- • Exam cost: $99 USD — no prerequisites required
- • Hardest part: Copilot-specific content (DSPM for AI, agent lifecycle, pay-as-you-go billing) not covered by older M365 resources
What Is the AB-900 Exam?
The AB-900 — officially titled Microsoft 365 Copilot and Administration Fundamentals — validates foundational knowledge across Microsoft 365 services, data protection and governance for Copilot environments, and basic administrative tasks for Microsoft Copilot and AI agents.
This is not a cloud-general exam like AZ-900 or a pure productivity exam like MS-900. AB-900 sits at the intersection of M365 administration, Microsoft Purview governance, and the emerging discipline of AI agent administration — a combination that did not exist as a formal exam objective two years ago.
AB-900 is right for you if you are:
- • An M365 administrator managing Copilot licenses and deployments
- • A compliance or governance professional responsible for AI data protection
- • An IT helpdesk or support professional in an organization rolling out Copilot
- • A business stakeholder involved in Copilot deployment decisions
- • Anyone building toward MS-102 or SC-300 who wants a solid M365 fundamentals baseline
| Detail | Information |
|---|---|
| Exam Code | AB-900 |
| Full Name | Microsoft 365 Copilot and Administration Fundamentals |
| Questions | 40–60 |
| Time Limit | 60 minutes |
| Passing Score | 700 out of 1000 |
| Price | $99 USD |
| Level | Fundamentals (Beginner) |
| Prerequisites | None |
| Certification Expiry | Does not expire |
AB-900 Exam Domains & What They Actually Test
Microsoft publishes the official exam skills outline, but the weighting descriptions alone do not tell you where candidates actually struggle. Here is a domain-by-domain breakdown.
Domain 1: Identify the Core Features and Objects of Microsoft 365 Services
30–35%- • Exchange Online: mailboxes, shared mailboxes, distribution groups, mail flow rules
- • SharePoint Online and OneDrive: site collections, document libraries, permissions, how Copilot retrieves content via Microsoft Graph
- • Microsoft Teams: team structures, channels, meeting recordings, Copilot in Teams summarization
- • Microsoft Entra ID: users, groups, licenses, the identity backbone for Copilot access control
- • Microsoft 365 licensing models: which licenses include Copilot, add-on licensing, and user-based vs pay-as-you-go billing
- • Common trap: confusing SharePoint site collection admin permissions with M365 admin center roles
Domain 2: Understand Data Protection and Governance Tasks for Microsoft 365 and Copilot
35–40%- • Microsoft Purview DLP: creating policies, enforcement actions (block, block with override, warn), how DLP applies to Copilot interactions
- • Sensitivity labels: label policies, auto-labeling, and how Copilot respects labels when generating content
- • Retention policies vs retention labels: scope, precedence, and how retained content interacts with Copilot outputs
- • Insider Risk Management: risk indicators, policies, and detecting anomalous Copilot usage
- • DSPM for AI (Data Security Posture Management): assessing data exposure risks specific to Copilot — frequently under-studied, always on the exam
- • Microsoft Purview Compliance Manager: compliance score, assessments, improvement actions, Copilot-related controls
Domain 3: Perform Basic Administrative Tasks for Copilot and Agents
25–30%- • Microsoft Copilot admin center: configuration settings, user enablement, feature management, organizational settings
- • Copilot licensing: assigning licenses, pay-as-you-go billing model, usage monitoring via Copilot usage reports
- • Microsoft Copilot Analytics: adoption metrics, user engagement data, Viva Insights integration
- • Agent administration: creating, publishing, and managing Microsoft Copilot agents — agent lifecycle from creation to deployment to decommission
- • Microsoft Copilot Studio: basic admin awareness of what it is and how to govern agents built with it (you do not need to build agents)
- • Tenant-wide Copilot settings: data residency, public web content access toggle, feedback policies, audit logging for Copilot interactions
How Difficult Is the AB-900 Exam?
Harder than it looks. AB-900 is a fundamentals exam, which creates a false sense of security. Most candidates who fail do so for one of three reasons:
The Purview domain tests nuances between overlapping features
DLP vs. Insider Risk Management vs. sensitivity labels is a classic confusion point. All three can restrict what users do with sensitive content — but they operate differently and the exam tests when to use each.
DSPM for AI is genuinely new material
Microsoft's Data Security Posture Management framework for AI environments has no equivalent in older M365 certifications. Candidates who assume this is the same as SC-900 content will be unprepared.
Questions test application, not recall
"An administrator needs to prevent X, which feature should they configure?" requires you to reason through the answer — not just recognize a term. This is where passive study fails.
Candidates with 6–12 months of hands-on M365 admin experience need 2–3 weeks of focused preparation. Those coming from a business or non-technical background should plan for 3–4 weeks.
3-Week AB-900 Study Plan
The Most Tested AB-900 Topics
DLP vs Insider Risk Management vs Sensitivity Labels
All three can restrict what users do with sensitive content — but they operate differently. DLP blocks specific actions in real time. Sensitivity labels classify and protect content persistently. IRM detects behavioral patterns across time. The exam tests which is appropriate for a given scenario.
DSPM for AI
Data Security Posture Management for AI is Microsoft's framework for identifying and reducing data exposure risks specific to Copilot. It surfaces in the Microsoft Purview portal and identifies overshared content that Copilot could surface inappropriately. Most candidates underestimate this topic.
Copilot Licensing vs Pay-As-You-Go Billing
Standard Microsoft 365 Copilot requires a per-user add-on license. Pay-as-you-go billing allows consumption-based access without pre-assigned licenses. The exam tests when each model applies and how administrators configure billing in the M365 admin center.
Retention Policy vs Retention Label Precedence
When both a retention policy and retention label apply to content, the label takes precedence. When two retention policies conflict, the more restrictive one wins. These precedence rules are a common exam question type.
Agent Lifecycle Administration
Administrators govern Copilot agents through the Copilot admin center and Microsoft Copilot Studio. Key admin tasks: approving agents for deployment, monitoring usage, disabling agents, and managing agent permissions. The exam does not require you to build agents — only to manage them.
Frequently Asked Questions About AB-900
What is the AB-900 exam?
AB-900 is Microsoft's fundamentals certification for Microsoft 365 Copilot and Administration. It validates foundational knowledge of M365 services, data protection and governance for Copilot environments, and basic administrative tasks for Copilot and AI agents. The exam costs $99 USD, has 40–60 questions, takes 60 minutes, and requires 700/1000 to pass.
How hard is the AB-900 exam?
Harder than most fundamentals exams. The Copilot-specific content — DSPM for AI, agent lifecycle management, and pay-as-you-go billing — is genuinely new material that even experienced M365 administrators need to study. Candidates who treat it as an easy fundamentals exam typically fail. Plan for 2–3 weeks of preparation.
What does AB-900 cover?
Three domains: core M365 services (Exchange Online, SharePoint, Teams, Entra ID) at 30–35%; data protection and governance including Microsoft Purview DLP, sensitivity labels, retention, Insider Risk Management, and DSPM for AI at 35–40%; and Copilot and agent administration including licensing, billing, analytics, and agent lifecycle at 25–30%.
Is AB-900 worth getting in 2026?
Yes. As Microsoft 365 Copilot adoption accelerates across enterprise customers, administrators who understand Copilot governance, data protection, and agent management are in high demand. AB-900 validates those skills with a verifiable credential at $99 with no expiry. The window to differentiate yourself with this certification is open right now.
What score do I need to pass AB-900?
You need 700 out of 1000. Microsoft uses scaled scoring — it is not a simple 70%. Some questions are weighted more heavily than others. Targeting 80%+ consistently on practice exams gives you a comfortable margin for exam day.
Do I need prior experience to take AB-900?
No experience is required — AB-900 has no prerequisites. Candidates with hands-on M365 administration experience will find the content significantly more accessible. Those without M365 experience should plan for closer to 4 weeks of preparation, with extra time on the Microsoft Purview governance domain.
How is MSCertQuiz different from free AB-900 practice tests?
Free practice tests for AB-900 are rare, and the ones that exist are typically outdated on Copilot-specific content. MSCertQuiz offers 500 AB-900 questions updated for 2026, covering DSPM for AI, agent lifecycle management, and Copilot pay-as-you-go billing. Every question includes a detailed explanation that teaches the reasoning, not just the right answer.
Ready to Practice AB-900?
500 practice questions across all 3 domains — DSPM for AI, Copilot licensing, agent administration, and full Purview coverage. Start with 40 questions free.
Start Free AB-900 Practice →