Free AB-900 Practice Questions with Detailed Explanations

Test your Microsoft 365 Copilot and Administration Fundamentals readiness with 25 free practice questions covering Copilot features, Microsoft Purview, licensing, and AI agents.

16 min read
Updated April 2026
AB-900 Fundamentals

The AB-900 (Microsoft 365 Copilot and Administration Fundamentals) exam validates your understanding of Microsoft 365 Copilot's capabilities, Microsoft Purview's data governance role in Copilot, licensing and billing, and how to build and manage AI agents in Copilot Studio. It's ideal for administrators, business decision-makers, and IT professionals evaluating or deploying Copilot.

These 25 questions cover all four exam domains with emphasis on real-world administration and governance scenarios — exactly the style you'll see on test day. Check the AB-900 certification page for full exam details.

What You'll Get:

  • 25 scenario-based questions across all 4 exam domains
  • Admin and governance scenarios — real-world decision making
  • Detailed explanations for every answer option
  • Scoring guide to assess your readiness

What These Questions Cover

6
M365 & Copilot Fundamentals
Copilot capabilities and M365 services
6
Microsoft Purview
Data governance and compliance for Copilot
7
Licensing & Administration
Copilot licensing, billing, and admin controls
6
Copilot Agents
Copilot Studio, agents, and extensibility

📝 Practice Test Instructions

  • • Each question has ONE correct answer
  • • Many questions are admin scenario-based — think as an M365 administrator
  • • Note your answers before scrolling to the answer key
  • • Aim to complete all 25 questions in 25 minutes

Microsoft 365 & Copilot Fundamentals

Questions 1–6

1

Microsoft 365 Copilot Overview

An organization is evaluating Microsoft 365 Copilot. A stakeholder asks: "What data does Copilot access when I ask it to summarize my recent emails?"

Which statement BEST describes how Microsoft 365 Copilot accesses user data?

A)Copilot only accesses data the signed-in user has permission to view, grounded by Microsoft Graph
B)Copilot accesses all data in the Microsoft cloud tenant regardless of permissions
C)Copilot uses internet search results, not the user's own data
D)Copilot requires data to be uploaded to a separate AI database before it can be accessed
2

Copilot in Microsoft 365 Apps

A marketing manager wants to create a PowerPoint presentation about Q3 results. They have the data in an Excel spreadsheet and a Word document with the narrative. They want Copilot to automatically create the presentation using this content.

Which Microsoft 365 Copilot capability enables creating presentations from existing files?

A)Copilot in Outlook
B)Copilot in PowerPoint with "Create from file"
C)Microsoft Designer
D)Copilot in Teams
3

Copilot in Teams

During a 90-minute meeting, a manager arrives 30 minutes late. They want to quickly understand what was discussed before they joined without watching the recording.

Which Microsoft 365 Copilot feature in Teams addresses this need?

A)Teams Copilot — generate meeting notes after the meeting ends
B)Teams live captions with transcription
C)Teams Copilot — ask "What did I miss?" to get a real-time or post-meeting summary of the discussion
D)Microsoft Loop in Teams
4

Copilot in Outlook

A sales executive receives 200+ emails per day. They want to use Copilot to quickly understand which emails need a response, get summaries of long email threads, and draft professional replies.

Which Copilot in Outlook capabilities address these needs?

A)Copilot can only draft new emails — it cannot summarize or prioritize
B)Copilot in Outlook requires Microsoft Copilot for Microsoft 365 E5 license
C)Copilot automatically replies to all emails without human review
D)Thread summarization, priority inbox identification, and Draft with Copilot for reply drafting
5

Microsoft 365 Services Foundation

Microsoft 365 Copilot is described as a "layer on top of Microsoft 365." An administrator asks what the underlying platform is that Copilot uses to connect to user data across all Microsoft 365 services.

Which Microsoft platform provides the data connectivity layer that Copilot uses?

A)Microsoft Graph
B)Microsoft Azure OpenAI Service directly
C)Microsoft Dataverse
D)Microsoft SharePoint Online
6

Copilot vs Copilot Studio

A company wants to create a custom internal HR chatbot that answers questions about company policies using their HR handbook. This chatbot should be accessible within Microsoft Teams. This is NOT a standard Microsoft 365 Copilot scenario.

Which Microsoft product is designed for building custom AI assistants and agents?

A)Microsoft 365 Copilot with system prompts
B)Microsoft Copilot Studio
C)Azure OpenAI Service
D)Microsoft Power Automate
🔐

Microsoft Purview & Copilot Governance

Questions 7–12

7

Purview and Copilot Data Access

A compliance officer is concerned that Microsoft 365 Copilot might surface confidential HR documents when employees ask it general questions. They want to ensure Copilot respects existing document sensitivity classifications.

How does Microsoft Purview help govern what Copilot can access and surface?

A)Purview blocks all Copilot access to SharePoint documents
B)Purview creates a separate data lake for Copilot to use instead of live data
C)Purview sensitivity labels and data classification enforce access controls — Copilot only surfaces content the user can already access, and sensitivity labels add an additional signal for Copilot to be cautious with highly classified content
D)Purview requires all data to be re-indexed before Copilot can use it
8

Sensitivity Labels

Your organization classifies documents as Public, Internal, Confidential, and Highly Confidential. You want Microsoft 365 Copilot to always display the sensitivity label of documents it references in generated content, so users know the classification level of the source material.

Which Microsoft Purview feature enables this content classification visibility?

A)Microsoft Purview Audit
B)Microsoft Purview Insider Risk Management
C)Microsoft Purview Communication Compliance
D)Microsoft Purview Sensitivity Labels
9

Microsoft Purview Audit for Copilot

Your legal team needs to investigate what Copilot interactions occurred for a specific user over the past 90 days as part of an eDiscovery request. They need a log of prompts and responses.

Which Microsoft Purview capability logs Copilot user interactions for compliance and eDiscovery?

A)Microsoft Purview Audit (Standard or Premium) with Copilot activity logging
B)Microsoft Purview Compliance Manager
C)Microsoft Defender for Cloud Apps
D)Microsoft Entra ID Sign-in logs
10

Communication Compliance

Your financial services firm must monitor Copilot-generated content for regulatory compliance — specifically to detect if Copilot is helping employees draft communications that contain prohibited terms related to market manipulation.

Which Microsoft Purview feature monitors communications including Copilot outputs for policy violations?

A)Microsoft Purview Sensitivity Labels
B)Microsoft Purview Communication Compliance
C)Microsoft Purview Information Protection
D)Microsoft Defender for Office 365
11

Oversharing Risks

Before deploying Microsoft 365 Copilot, an IT administrator wants to identify documents and SharePoint sites that are overshared across the organization — content that more users can access than intended. Copilot could surface this over-permissioned content.

Which Microsoft Purview tool helps identify and remediate oversharing before Copilot deployment?

A)Microsoft Purview Compliance Manager
B)Microsoft Purview Data Map
C)SharePoint Advanced Management — Data Access Governance reports
D)Microsoft Defender for Cloud Apps
12

Retention Policies and Copilot

Your organization must retain all Microsoft 365 Copilot interaction data (prompts and responses) for 7 years to meet financial compliance regulations.

Which Microsoft Purview feature manages the retention of Copilot interaction data?

A)Microsoft Purview Communication Compliance
B)Azure Log Analytics
C)Microsoft 365 Backup
D)Microsoft Purview Retention Policies for Copilot interactions
💳

Licensing, Billing & Administration

Questions 13–19

13

Copilot License Requirements

An organization wants to deploy Microsoft 365 Copilot to 200 employees. The IT admin asks what base Microsoft 365 licenses are required before purchasing Copilot add-on licenses.

Which Microsoft 365 base licenses qualify for Microsoft 365 Copilot add-on?

A)Microsoft 365 E3, E5, Business Standard, or Business Premium (or Microsoft 365 F3)
B)Any Microsoft 365 plan including Business Basic
C)Microsoft 365 Copilot is included free with all Microsoft 365 plans
D)Only Microsoft 365 E5 qualifies
14

Copilot License Assignment

Your organization purchased 100 Microsoft 365 Copilot licenses. You need to assign them to specific users and track who has been assigned a license.

Where in the Microsoft 365 admin center do you assign Copilot licenses to users?

A)Microsoft 365 admin center — Billing > Subscriptions
B)Microsoft 365 admin center — Users > Active users > Manage licenses
C)Microsoft Entra admin center — Applications > Copilot
D)Microsoft Copilot Studio admin settings
15

Copilot for Microsoft 365 vs Microsoft Copilot

A user with no Microsoft 365 Copilot license notices that Microsoft 365 apps show a Copilot button that accesses web-grounded AI. Another user with a Microsoft 365 Copilot license gets additional capabilities that access company data.

Which statement correctly distinguishes these two Copilot experiences?

A)They are identical experiences regardless of license
B)The free version accesses company data; the licensed version accesses the internet
C)Microsoft Copilot (free/Entra ID) uses web grounding only. Microsoft 365 Copilot (licensed) uses Microsoft Graph to access organizational data in addition to web grounding
D)Copilot is only available with Microsoft 365 E5 licenses
16

Copilot Usage Analytics

A CIO wants to understand Copilot adoption across the organization — how many licensed users are actively using Copilot, which apps they use it in most, and whether usage is growing over time.

Where can admins find Microsoft 365 Copilot usage analytics?

A)Microsoft Entra ID admin center — Sign-in logs
B)Power BI Premium reports dashboard
C)Microsoft Viva Insights — Advanced insights
D)Microsoft 365 admin center — Reports > Usage > Copilot activity
17

Pinned Apps and Copilot Management

You want to control which Microsoft 365 Copilot features are available to specific user groups. For example, you want the legal department to have access to Copilot in Teams meetings but want to disable Copilot draft email suggestions in Outlook for all users initially.

Which admin center provides controls for managing Microsoft 365 Copilot feature availability by user group?

A)Microsoft 365 admin center — Settings > Copilot
B)Microsoft Entra admin center — Conditional Access
C)SharePoint admin center — Tenant settings
D)Teams admin center — App policies
18

Copilot Billing Model

Your CFO asks: "If a user with a Microsoft 365 Copilot license doesn't use Copilot for an entire month, do we still pay for that month?"

How is Microsoft 365 Copilot typically billed?

A)Pay-per-query — only pay when Copilot is actively used
B)Per user, per month subscription — you pay for assigned licenses regardless of usage
C)Annual flat fee per tenant regardless of user count
D)Metered billing based on Microsoft Graph API calls
19

Microsoft 365 Copilot Pages (Admin)

An administrator needs to prevent users from sharing Copilot-generated content outside the organization via Copilot Pages (formerly Loop components in Copilot).

Where would an admin configure sharing settings for Microsoft Loop and Copilot Pages content?

A)Microsoft Entra ID external collaboration settings
B)Teams admin center — Messaging policies
C)SharePoint admin center — Settings > SharePoint and Loop integration settings
D)Microsoft Purview Communication Compliance
🤖

Microsoft Copilot Agents

Questions 20–25

20

Copilot Studio Basics

A business unit wants to create a custom AI agent that answers employee questions about company benefits, travel policies, and IT procedures — all sourced from their internal SharePoint knowledge base. No coding should be required.

Which Microsoft tool enables building this custom knowledge agent without code?

A)Azure OpenAI Service with RAG
B)Azure AI Foundry
C)Microsoft Power Apps
D)Microsoft Copilot Studio
21

Agent Types

Your organization wants an AI agent that monitors a SharePoint folder and automatically sends a Teams notification with a summary whenever a new contract document is uploaded.

Which type of agent behavior describes this automated monitoring and response?

A)Autonomous agent (or automated agent) triggered by an event or schedule
B)Conversational agent triggered by user queries
C)Declarative agent with web grounding
D)Retrieval Augmented Generation agent
22

Declarative Agents

You want to extend Microsoft 365 Copilot with a specialized variant that focuses only on sales-related topics. When a user interacts with this agent, it should use Copilot's LLM capabilities but be scoped to sales knowledge and tools.

What type of Copilot extension provides a scoped, persona-specific Copilot experience within Microsoft 365 Copilot?

A)A Copilot Studio custom engine agent
B)A Declarative agent (formerly Copilot extension)
C)A Microsoft 365 Copilot add-in
D)A Power Automate cloud flow
23

Agent Knowledge Sources

You are building a Copilot Studio agent that should answer questions using three knowledge sources: your company SharePoint site, a public website, and a PDF uploaded directly to the agent.

Which knowledge source types does Copilot Studio support for agent knowledge bases?

A)Only Azure Cognitive Search indices
B)Only Microsoft Graph data
C)SharePoint Online sites, public websites, uploaded files (PDF, Word, etc.), Azure AI Search, and Dataverse
D)Only SQL databases via connectors
24

Agent Governance and Management

Your organization wants to ensure that employees can only use approved Copilot agents and custom-built agents within Microsoft 365. You want to prevent users from accessing third-party agents from the Copilot agent store without admin approval.

Where would an admin manage which agents are allowed or blocked for users?

A)Microsoft Entra ID — Application permissions
B)Teams admin center — App permission policies
C)Microsoft Purview Communication Compliance
D)Microsoft 365 admin center — Settings > Integrated apps > Copilot agents
25

Copilot Studio Licensing

An organization wants to build a customer-facing Copilot Studio agent that will handle thousands of external customer interactions per month. They need to understand the licensing model for customer-facing (external) Copilot Studio agents.

How are external-facing Copilot Studio agents typically licensed?

A)Metered billing per message (conversations billed based on Copilot Studio capacity/message packs)
B)Included free with Microsoft 365 Copilot licenses
C)Per-user licensing based on the number of customers who interact with it
D)Flat monthly fee per agent regardless of usage

✋ Stop Here Before Scrolling!

Have you answered all 25 questions? Complete the test before checking the answers below.

Pro tip: The AB-900 exam focuses heavily on governance and admin scenarios — think as an M365 admin, not an end user

📝 Answer Key with Detailed Explanations

Review each explanation carefully, even for questions you answered correctly

Quick Answer Reference

Q1
A
Q2
B
Q3
C
Q4
D
Q5
A
Q6
B
Q7
C
Q8
D
Q9
A
Q10
B
Q11
C
Q12
D
Q13
A
Q14
B
Q15
C
Q16
D
Q17
A
Q18
B
Q19
C
Q20
D
Q21
A
Q22
B
Q23
C
Q24
D
Q25
A
1

Question 1: Microsoft 365 Copilot Data Access

✓ Correct Answer: A) Copilot only accesses data the signed-in user has permission to view, grounded by Microsoft Graph

Why this is correct:

Microsoft 365 Copilot is built on Microsoft Graph, which enforces the signed-in user's existing permissions. If a user cannot access a document in SharePoint, Copilot cannot retrieve or surface that document in its responses. Copilot does not bypass existing access controls — it operates strictly within the user's permission boundary.

Why other answers are incorrect:

B: Copilot strictly respects existing permissions — it cannot access content the user doesn't have access to.
C: Microsoft 365 Copilot uses the user's organizational data via Microsoft Graph. Bing/web grounding is a separate feature, and for Microsoft 365 Copilot the primary grounding is organizational data.
D: No separate AI database is required — Copilot accesses data in real-time through Microsoft Graph, not a copy or mirror.

💡 Key Concept:

Key principle: Copilot = user's permissions applied to AI. What the user can see, Copilot can use. What the user cannot see, Copilot cannot surface. This is fundamental to the security model.

2

Question 2: Copilot in PowerPoint

✓ Correct Answer: B) Copilot in PowerPoint with "Create from file"

Why this is correct:

Copilot in PowerPoint includes a "Create a presentation from file" feature that takes a Word document, Excel file, or PDF as input and generates a structured, formatted presentation from its content. This automates the conversion of existing content into slides.

Why other answers are incorrect:

A: Copilot in Outlook handles email composition, summarization, and scheduling assistance — not presentation creation.
C: Microsoft Designer is a design tool for creating graphics, images, and visual content — not for generating presentations from data files.
D: Copilot in Teams handles meeting summaries, chat assistance, and collaboration — not presentation creation from files.

💡 Key Concept:

Copilot in PowerPoint key features: Create from file (from Word/PDF), Draft a presentation (from prompt), Summarize presentation, Add a slide, Organize sections. Requires presentation to be saved in OneDrive or SharePoint.

3

Question 3: Copilot in Teams — Meeting

✓ Correct Answer: C) Teams Copilot — ask "What did I miss?" to get a real-time or post-meeting summary of the discussion

Why this is correct:

Copilot in Teams meetings can answer natural language questions about the meeting, including "What was discussed before I joined?" or "What decisions were made?" during live meetings (with transcription enabled) or after the meeting from the transcript. This is a key productivity scenario the exam tests.

Why other answers are incorrect:

A: Meeting notes are generated after the meeting — but the question specifically asks about catching up in real time ("arrives late, wants to know what was discussed").
B: Teams live captions provide transcription but require the user to scroll through them — not an AI-powered summary or Q&A.
D: Microsoft Loop provides collaborative workspaces but doesn't answer "what did I miss" questions about meeting content.

💡 Key Concept:

Copilot in Teams meetings requires: Meeting recording/transcription enabled by admin, Microsoft 365 Copilot license for the meeting organizer or participant. Key queries: "Summarize the meeting so far," "What action items were mentioned," "What were the main points of disagreement."

4

Question 4: Copilot in Outlook

✓ Correct Answer: D) Thread summarization, priority inbox identification, and Draft with Copilot for reply drafting

Why this is correct:

Copilot in Outlook provides: Thread Summarize (condenses long email chains into bullet points), Coaching tips for draft improvement, Draft with Copilot (generates full email drafts from a prompt), and prioritization assistance. These address all three scenarios mentioned.

Why other answers are incorrect:

A: Copilot in Outlook can do much more than draft — it summarizes threads, identifies priorities, coaches on tone, and more.
B: Microsoft 365 Copilot is available as an add-on for E3 and E5 as well as Business Standard and Business Premium — not E5 only.
C: Copilot drafts suggestions for human review and approval — it never automatically sends emails without the user reviewing and sending.

💡 Key Concept:

Copilot in Outlook features: Thread Summarize, Draft (new and reply), Coaching (improve tone/length/formality), Meeting prep (summarize recent emails before a meeting). All require M365 Copilot license.

5

Question 5: Microsoft Graph

✓ Correct Answer: A) Microsoft Graph

Why this is correct:

Microsoft Graph is the API platform that provides unified access to data, intelligence, and insights across Microsoft 365 services (Exchange, SharePoint, Teams, OneDrive, Outlook, etc.). Copilot uses Microsoft Graph to retrieve relevant organizational data — emails, documents, meetings, contacts — to ground its responses in the user's actual context.

Why other answers are incorrect:

B: Azure OpenAI Service provides the language model that powers Copilot's AI responses, but it's the LLM engine — not the data connectivity layer for Microsoft 365 content.
C: Microsoft Dataverse is a data platform used by Power Platform (Power Apps, Power Automate) — it's not the primary connector for Microsoft 365 data for Copilot.
D: SharePoint Online is one data source — but it's one component accessed through Microsoft Graph, not the connectivity layer itself.

💡 Key Concept:

Microsoft 365 Copilot architecture: User prompt → LLM (Azure OpenAI GPT-4) → Microsoft Graph (retrieves user's M365 data) → LLM generates grounded response. Microsoft Graph is the "data connector" that makes Copilot aware of your organizational context.

6

Question 6: Copilot Studio

✓ Correct Answer: B) Microsoft Copilot Studio

Why this is correct:

Microsoft Copilot Studio (formerly Power Virtual Agents + Copilot Studio) is the low-code/no-code tool for building custom AI agents and chatbots. It connects to custom knowledge sources (SharePoint, uploaded files, etc.), can be deployed to Teams, and doesn't require coding — perfect for building HR knowledge bots.

Why other answers are incorrect:

A: Microsoft 365 Copilot doesn't support system-level customization or knowledge restriction to specific data sources for general users.
C: Azure OpenAI Service is a developer-focused API requiring coding — not low-code.
D: Power Automate is for workflow automation — not building conversational AI agents or chatbots.

💡 Key Concept:

Copilot Studio vs M365 Copilot: M365 Copilot = end-user productivity AI built into M365 apps. Copilot Studio = tool to BUILD custom agents/bots. Copilot Studio agents can be published to Teams, websites, other M365 channels.

7

Question 7: Purview and Copilot Data Access

✓ Correct Answer: C) Purview sensitivity labels and data classification enforce access controls — Copilot only surfaces content the user can already access, and sensitivity labels add an additional signal

Why this is correct:

Microsoft Purview sensitivity labels classify content by confidentiality level. Copilot respects the underlying access permissions enforced by these labels — it cannot surface content users don't have access to. Highly sensitive labeled content is handled with additional care in Copilot responses.

Why other answers are incorrect:

A: Purview doesn't block all Copilot access — it enforces appropriate access controls that are already defined.
B: Copilot accesses live production data through Microsoft Graph — not a separate AI data lake.
D: No special re-indexing is required — Copilot uses Microsoft Search indices that are already present in Microsoft 365.

💡 Key Concept:

Purview + Copilot readiness: Before deploying Copilot, organizations should: apply sensitivity labels to classify content, audit permissions and fix oversharing, enable Purview audit for Copilot activity logging, configure retention policies for Copilot interactions.

8

Question 8: Sensitivity Labels

✓ Correct Answer: D) Microsoft Purview Sensitivity Labels

Why this is correct:

Sensitivity Labels in Microsoft Purview classify and protect content by marking it with visual indicators (watermarks, headers) and enforcing protection policies (encryption, access restrictions). When Copilot generates content from labeled source material, it can inherit or display the label, ensuring users see the classification of referenced content.

Why other answers are incorrect:

A: Purview Audit logs Copilot interactions — it doesn't apply visual classification labels to documents.
B: Insider Risk Management detects risky user behavior — it doesn't classify document sensitivity.
C: Communication Compliance monitors communications for policy violations — it doesn't classify document sensitivity.

💡 Key Concept:

Sensitivity label behavior in Copilot: When Copilot summarizes a Highly Confidential document, the generated summary may inherit the Highly Confidential label. This ensures classification propagates through AI-generated content, maintaining information protection policies.

9

Question 9: Purview Audit for Copilot

✓ Correct Answer: A) Microsoft Purview Audit (Standard or Premium) with Copilot activity logging

Why this is correct:

Microsoft Purview Audit logs Microsoft 365 activity, including Microsoft 365 Copilot interactions (CopilotInteraction event type). This includes prompts, responses, and the files referenced. Legal and compliance teams can search audit logs for specific users and date ranges during eDiscovery investigations.

Why other answers are incorrect:

B: Compliance Manager assesses compliance posture against regulations — it doesn't provide searchable interaction logs.
C: Defender for Cloud Apps monitors cloud app usage at a network level — not the content of Copilot interactions.
D: Entra ID Sign-in logs track authentication events — not Copilot prompts and responses.

💡 Key Concept:

Copilot Audit log event: CopilotInteraction event type in the Microsoft Purview Audit log. Contains: AppHost (which M365 app was used), Prompts, Files referenced. Requires Audit Standard (90 days) or Audit Premium (365+ days) for retention.

10

Question 10: Communication Compliance

✓ Correct Answer: B) Microsoft Purview Communication Compliance

Why this is correct:

Communication Compliance in Microsoft Purview monitors communications across Microsoft 365 (Teams, Exchange, Copilot outputs) for policy violations — including custom policies that detect specific terms or patterns. It enables financial services firms to meet regulatory requirements around monitored communications.

Why other answers are incorrect:

A: Sensitivity Labels classify document confidentiality — they don't monitor communications for prohibited content patterns.
C: Information Protection is about protecting (encrypting/labeling) content — not monitoring communications for policy violations.
D: Microsoft Defender for Office 365 focuses on malware and phishing protection — not regulatory compliance communication monitoring.

💡 Key Concept:

Communication Compliance use cases: Financial services (monitor for insider trading language), Healthcare (protect PHI in communications), Legal (attorney-client privilege), Policy violations (harassment, hate speech). Works on Teams, Exchange, and Copilot-generated content.

11

Question 11: Oversharing Risks

✓ Correct Answer: C) SharePoint Advanced Management — Data Access Governance reports

Why this is correct:

SharePoint Advanced Management (available with Microsoft 365 Copilot or as an add-on) includes Data Access Governance reports that identify overshared content: "Everyone" sharing links, externally shared files, sites with broad permissions. This is the recommended tool for pre-Copilot deployment permission cleanup.

Why other answers are incorrect:

A: Compliance Manager assesses compliance against standards — not SharePoint permission oversharing.
B: Microsoft Purview Data Map is a data catalog for discovering data assets across on-premises and cloud — not SharePoint permission analysis.
D: Defender for Cloud Apps can detect some oversharing patterns but SharePoint Advanced Management is the purpose-built tool for this specific pre-Copilot governance task.

💡 Key Concept:

Copilot readiness — permission hygiene: SharePoint Advanced Management reports identify: sites shared with "Everyone," "Everyone except external users," external guest access, sharing link inventory. Fix oversharing BEFORE Copilot deployment to prevent unintended data exposure.

12

Question 12: Retention Policies for Copilot

✓ Correct Answer: D) Microsoft Purview Retention Policies for Copilot interactions

Why this is correct:

Microsoft Purview Retention Policies can be configured to cover Microsoft 365 Copilot interactions (prompts and responses are stored as a workload in Microsoft 365). You can create a retention policy that applies to Copilot interactions and set the retention period to 7 years to meet compliance requirements.

Why other answers are incorrect:

A: Communication Compliance monitors content for violations — it doesn't manage data retention periods.
B: Azure Log Analytics retains diagnostic and activity logs — not Microsoft 365 Copilot interaction content.
C: Microsoft 365 Backup provides point-in-time restoration of M365 data — it's not a compliance retention solution.

💡 Key Concept:

Copilot retention: Copilot interaction data (prompts + responses) is stored in users' Exchange mailboxes (hidden folder). Purview retention policies targeting Exchange can cover this data. Same retention capabilities as Teams chat retention.

13

Question 13: Copilot License Requirements

✓ Correct Answer: A) Microsoft 365 E3, E5, Business Standard, or Business Premium (or Microsoft 365 F3)

Why this is correct:

Microsoft 365 Copilot is an add-on license that requires an eligible base Microsoft 365 subscription. The qualifying plans include E3, E5, Business Standard, Business Premium, and F3. Basic plans (Microsoft 365 Business Basic) are not eligible because they lack the necessary collaboration and productivity app entitlements.

Why other answers are incorrect:

B: Not all Microsoft 365 plans are eligible — Business Basic doesn't qualify.
C: Microsoft 365 Copilot is a paid add-on at $30/user/month (subject to change) — it's not included free.
D: E3 qualifies — it's not E5 only.

💡 Key Concept:

Microsoft 365 Copilot eligible base plans (as of 2026): M365 E3, E5, Business Standard, Business Premium, Office 365 E3/E5, F3. Add-on price: $30 USD/user/month. Must assign Copilot license to individual users from the add-on subscription.

14

Question 14: License Assignment

✓ Correct Answer: B) Microsoft 365 admin center — Users > Active users > Manage licenses

Why this is correct:

In the Microsoft 365 admin center, licenses are managed per user through Users > Active users > select a user > Licenses and apps tab > assign/remove licenses. This is the primary interface for assigning Microsoft 365 Copilot licenses to specific users.

Why other answers are incorrect:

A: Billing > Subscriptions shows your subscription overview and purchasing — not the per-user license assignment interface.
C: Entra admin center manages identities, authentication, and app registrations — not M365 license assignment.
D: Copilot Studio admin settings manage agent governance — not M365 Copilot license assignment.

💡 Key Concept:

License management options: M365 admin center (GUI per user or bulk CSV), PowerShell with Microsoft Graph API (Set-MgUserLicense), Entra ID group-based licensing (assign licenses based on group membership — best for large organizations).

15

Question 15: Copilot vs M365 Copilot

✓ Correct Answer: C) Microsoft Copilot (free/Entra ID) uses web grounding only. Microsoft 365 Copilot (licensed) uses Microsoft Graph to access organizational data in addition to web grounding

Why this is correct:

There are two distinct Copilot experiences in Microsoft 365 apps: (1) Microsoft Copilot (free, web-grounded) — uses Bing web search for context, no access to organizational data. (2) Microsoft 365 Copilot (licensed add-on) — uses Microsoft Graph to access the user's emails, documents, meetings, and chats in addition to web grounding.

Why other answers are incorrect:

A: They have meaningfully different capabilities — the licensed version adds organizational data grounding.
B: This is backwards — the licensed version accesses organizational data; the free version uses web search.
D: Microsoft 365 Copilot is available as an add-on for E3 and other eligible plans, not just E5.

💡 Key Concept:

Microsoft Copilot (no license) = web search + public information. Microsoft 365 Copilot (licensed) = web search + your organizational data (emails, docs, chats). The organizational data grounding is what provides the productivity value for enterprise use.

16

Question 16: Copilot Usage Analytics

✓ Correct Answer: D) Microsoft 365 admin center — Reports > Usage > Copilot activity

Why this is correct:

The Microsoft 365 admin center provides Copilot usage reports showing: total users with licenses, active users, usage by app (Teams, Outlook, Word, etc.), and adoption trends over time. Admins can use these reports to demonstrate ROI and identify departments needing additional training.

Why other answers are incorrect:

A: Entra ID Sign-in logs show authentication events — not Copilot feature usage.
B: Power BI reports are custom-built dashboards — not where native M365 Copilot usage reports live.
C: Microsoft Viva Insights provides work pattern analytics (meeting time, focus time) — not specifically Copilot feature adoption metrics.

💡 Key Concept:

Microsoft 365 admin center Reports > Usage shows: Copilot usage by product (Teams, Outlook, Word, etc.), active user counts, feature usage rates, department adoption. Helps admins track ROI and target training for low-adoption groups.

17

Question 17: Copilot Management

✓ Correct Answer: A) Microsoft 365 admin center — Settings > Copilot

Why this is correct:

The Microsoft 365 admin center has a dedicated Copilot settings page (Settings > Copilot or Settings > Microsoft 365 Copilot) where admins can configure: which Copilot features are enabled by default, web content access settings, plugin and agent management, and data privacy preferences.

Why other answers are incorrect:

B: Conditional Access controls access to apps based on identity and device conditions — not individual Copilot feature toggles within M365 apps.
C: SharePoint admin center manages SharePoint-specific settings — not organization-wide Copilot feature management.
D: Teams admin center manages Teams-specific settings — not all M365 Copilot features across all apps.

💡 Key Concept:

M365 Copilot admin controls: M365 admin center Settings > Copilot (feature availability, web grounding, plugins). Entra ID group-based policies for license scope. Teams admin center for Teams Copilot meeting settings.

18

Question 18: Copilot Billing Model

✓ Correct Answer: B) Per user, per month subscription — you pay for assigned licenses regardless of usage

Why this is correct:

Microsoft 365 Copilot uses a standard subscription model — you pay per licensed user per month regardless of how much (or how little) that user actually uses Copilot. This is the same model as other M365 license add-ons. If you want to reduce cost, you must unassign the license.

Why other answers are incorrect:

A: Copilot is not pay-per-query — it's a flat per-user subscription.
C: Licensing is per-user, not a flat tenant fee — 10 users = 10 licenses, 1,000 users = 1,000 licenses.
D: Microsoft Graph API calls in Copilot are not separately metered for M365 Copilot users — it's covered by the subscription.

💡 Key Concept:

Cost optimization: Only assign Copilot licenses to active users. Use Copilot usage reports to identify licensed users who aren't using it. Reassign licenses from inactive users to others who would benefit. Review and adjust license counts quarterly.

19

Question 19: Copilot Pages Admin

✓ Correct Answer: C) SharePoint admin center — Settings > SharePoint and Loop integration settings

Why this is correct:

Copilot Pages (formerly Loop components embedded in Copilot) store content in SharePoint. External sharing of this content is controlled through SharePoint sharing settings. The SharePoint admin center controls Loop and Pages integration, including whether content can be shared externally.

Why other answers are incorrect:

A: Entra ID external collaboration settings control guest access and B2B invitations at a broader level — not specifically Loop/Copilot Pages content sharing.
B: Teams messaging policies control message formatting, read receipts, etc. — not Copilot Pages sharing.
D: Communication Compliance monitors content — it doesn't control sharing permissions.

💡 Key Concept:

Copilot Pages storage: Content created in Copilot Pages is stored in a user's OneDrive (in a Microsoft Loop subfolder) and governed by SharePoint sharing policies. Admin controls for Loop: SharePoint admin center > Settings > Microsoft Loop.

20

Question 20: Copilot Studio Basics

✓ Correct Answer: D) Microsoft Copilot Studio

Why this is correct:

Microsoft Copilot Studio is the purpose-built low-code platform for creating custom AI agents. It has a visual designer, native integration with SharePoint as a knowledge source, Teams channel deployment, and no coding required. Admins and business users can build and publish agents without developer involvement.

Why other answers are incorrect:

A: Azure OpenAI with RAG is a developer-focused solution requiring code — not low-code.
B: Azure AI Foundry is a developer platform for building AI applications — not low-code agent building.
C: Power Apps builds custom business applications with forms and data — not conversational AI agents.

💡 Key Concept:

Copilot Studio capabilities: Knowledge sources (SharePoint, files, websites), Topics (conversation flows), Actions (Power Automate flows, REST APIs), Channels (Teams, web chat, M365 Copilot), Analytics (conversation metrics), Generative answers (AI-powered responses).

21

Question 21: Agent Types

✓ Correct Answer: A) Autonomous agent (or automated agent) triggered by an event or schedule

Why this is correct:

Autonomous agents (also called automated agents in Copilot Studio) are triggered by events, schedules, or data changes — not by user queries. The described behavior (monitoring a folder, detecting a new file, automatically sending a notification) is event-driven automation — exactly what autonomous agents do.

Why other answers are incorrect:

B: Conversational agents wait for user input and respond to queries — they don't proactively monitor for events.
C: Declarative agents extend M365 Copilot with scoped knowledge and persona — not for autonomous event monitoring.
D: RAG is a technique for grounding AI responses with retrieved documents — it describes how an agent answers, not when it activates.

💡 Key Concept:

Agent types in Copilot Studio: Conversational (responds to user queries), Autonomous/Automated (triggered by events, schedules, or conditions — proactive). Autonomous agents use Power Automate triggers under the hood.

22

Question 22: Declarative Agents

✓ Correct Answer: B) A Declarative agent (formerly Copilot extension)

Why this is correct:

Declarative agents are scoped variants of Microsoft 365 Copilot that use the same underlying GPT-4 model but are configured with specific: instructions (persona and focus area), knowledge sources (specific SharePoint sites, files), and tools (specific actions). They appear within M365 Copilot chat as specialized assistants.

Why other answers are incorrect:

A: Custom engine agents use a custom AI engine (e.g., Azure AI) instead of Copilot's GPT-4 — they offer more flexibility but require more development effort.
C: M365 Copilot doesn't have "add-ins" in the traditional sense — the extension model uses agents and plugins.
D: Power Automate cloud flows automate tasks but aren't AI agents or Copilot extensions.

💡 Key Concept:

Copilot extension types: Declarative agents (scoped Copilot variant, use Copilot's LLM), Custom engine agents (bring your own LLM/AI), Plugins/connectors (add capabilities to Copilot like API calls, data retrieval). Declarative agents are most common for persona-specific use cases.

23

Question 23: Agent Knowledge Sources

✓ Correct Answer: C) SharePoint Online sites, public websites, uploaded files (PDF, Word, etc.), Azure AI Search, and Dataverse

Why this is correct:

Microsoft Copilot Studio supports multiple knowledge source types: SharePoint sites (native integration), uploaded documents (PDF, Word, PowerPoint), public websites (via web scraping), Azure AI Search indices (for enterprise knowledge bases), and Dataverse (for structured business data).

Why other answers are incorrect:

A: Azure Cognitive Search (AI Search) is one option but Copilot Studio supports many more source types — it's not limited to AI Search only.
B: Microsoft Graph is a connectivity API — it's not a knowledge source type in Copilot Studio. Graph can provide context but knowledge sources are explicit content bases.
D: SQL databases can be accessed via connectors or Power Automate actions but aren't a direct knowledge source type — knowledge sources are document/file-based.

💡 Key Concept:

Copilot Studio knowledge sources best practices: Use SharePoint for managed organizational knowledge. Upload curated PDFs for specific topic areas. Keep knowledge sources focused — agents with broad, noisy knowledge sources perform worse than agents with curated sources.

24

Question 24: Agent Governance

✓ Correct Answer: D) Microsoft 365 admin center — Settings > Integrated apps > Copilot agents

Why this is correct:

The Microsoft 365 admin center's Integrated Apps section manages which apps and agents are available to users. Admins can block specific agents from the Copilot agent store, require approval before users can install agents, or allow only pre-approved agents. This is the primary governance control for Copilot agent deployment.

Why other answers are incorrect:

A: Entra ID Application permissions control OAuth app API access — not Copilot agent deployment governance.
B: Teams admin center App permission policies control Teams apps (including some agents deployed to Teams) but the comprehensive Copilot agent governance is in the M365 admin center Integrated Apps.
C: Purview Communication Compliance monitors content — it doesn't control which agents users can access.

💡 Key Concept:

Copilot agent governance: M365 admin center > Settings > Integrated apps > Agents. Options: Allow all (self-service), Allow specific agents (admin approved list), Block all (admin deploys only). Combines with Teams app policies for Teams-specific deployment.

25

Question 25: Copilot Studio Licensing

✓ Correct Answer: A) Metered billing per message (conversations billed based on Copilot Studio capacity/message packs)

Why this is correct:

External-facing (anonymous or authenticated external users) Copilot Studio agents are billed using a message-pack consumption model. Organizations purchase Copilot Studio capacity (in messages) and each agent interaction consumes messages from this pool. This scales with actual usage rather than per-user.

Why other answers are incorrect:

B: M365 Copilot licenses are for internal M365 users — they don't cover external customer-facing agent conversations.
C: Copilot Studio external agents are not billed per customer — they're billed per message consumption.
D: It's not a flat monthly fee — it scales with usage volume via message packs.

💡 Key Concept:

Copilot Studio licensing: Internal (employee-facing) agents = covered by Copilot Studio included in M365 Copilot license OR Copilot Studio standalone license. External (customer-facing) agents = message-pack consumption billing. Message = one back-and-forth interaction turn.

📊 How Did You Score?

23–25
Exam Ready
Excellent! Schedule your exam.
19–22
Almost There
Review Purview governance and Copilot Studio.
14–18
Keep Studying
Focus on licensing and admin scenarios.
0–13
More Study Needed
Study Copilot capabilities and Purview governance.

Ready for More AB-900 Practice?

These 25 questions are just a sample. The actual AB-900 exam has 40–60 questions.

MSCertQuiz AB-900 includes 500 questions covering:

  • ✓ All Microsoft 365 Copilot app capabilities in depth
  • ✓ Microsoft Purview governance for Copilot deployments
  • ✓ Copilot licensing, billing, and admin center management
  • ✓ Copilot Studio agents — conversational and autonomous
  • ✓ Real-world admin decision scenarios for the latest exam content

$14.99 One-Time Payment

Lifetime access • No subscription • 500 questions