AB-900 Practice Test
Microsoft 365 Certified: Copilot and Agent Administration Fundamentals
The Purview governance and Copilot licensing questions trip most candidates. We prepare you for exactly those.
Our 500 AB-900 questions go deep on DSPM for AI, sensitivity labels, Copilot licensing models, and agent lifecycle management — the exact areas where M365-experienced candidates still fail.
Start Free Practice — 40 QuestionsNo credit card required. Upgrade to full 500 questions for $19.99 when ready.
Is this for you?
This is NOT for you if:
AB-900 Exam Details
What to expect on exam day
Questions
40-60 questions
Duration
60 minutes
Passing Score
700/1000
Exam Cost
$99 USD
Exam Domains Covered
Master all topics tested on the AB-900 exam
Identify the core features and objects of Microsoft 365 services (30-35%)
Understand data protection and governance tasks for Microsoft 365 and Copilot (35-40%)
Perform basic administrative tasks for Copilot and agents (25-30%)
Test Yourself Right Now
Try 5 real practice questions — no signup needed
5 Free AB-900 Questions
See how ready you are for the AB-900 exam. Each question includes a detailed explanation so you learn as you go.
Sample AB-900 Practice Questions
10 real questions from the free AB-900bank. Pick an answer in your head, then open “Show answer” for the explanation.
1. A company wants to require MFA only when users sign in from outside the corporate network. Which Microsoft Entra feature enables this?
- A. Conditional Access policies with named locations
- B. Privileged Identity Management for just-in-time activation of privileged administrator roles
- C. Identity Secure Score, which measures the tenant's identity security posture over time
- D. Self-Service Password Reset, which lets users reset their own passwords without IT help
Show answer
Correct answer: A
Conditional Access policies can use Named Locations to define trusted networks (e.g., corporate IP ranges) and apply MFA requirements only when sign-ins occur outside those locations. Identity Secure Score measures security posture, PIM manages privileged roles, and SSPR handles password resets.
2. An administrator needs to automatically redirect all email sent to a former employee to their manager. Which Exchange Online feature should be used?
- A. A mail flow rule (transport rule) that redirects messages based on the recipient condition
- B. Distribution list
- C. A resource mailbox configured for the former employee with delegate access for the manager
- D. Shared mailbox
Show answer
Correct answer: A
Mail flow rules (transport rules) in Exchange Online automatically process messages based on conditions - such as redirecting, copying, or modifying messages in transit. Shared mailboxes allow multi-user access but do not auto-redirect, distribution lists send to multiple recipients, and resource mailboxes are for rooms and equipment.
3. A user reports they cannot sign in to Microsoft 365 and suspects their account is flagged as risky. Which Microsoft Entra tool should the administrator use to investigate?
- A. The Sign-in diagnostic tool in Microsoft Entra ID for a specific sign-in event
- B. The Exchange Online admin center mailbox and mail flow troubleshooting tools
- C. The Microsoft 365 admin center active-user list and account status view
- D. The SharePoint admin center site and access troubleshooting settings
Show answer
Correct answer: A
The Sign-in diagnostic tool in Microsoft Entra ID helps administrators investigate sign-in failures by analyzing sign-in logs, Conditional Access policy results, and risk detections for a specific user and sign-in event. Exchange and SharePoint admin centers don't have identity troubleshooting tools.
4. Where can administrators search for user and admin activity logs across Microsoft 365 services?
- A. The Unified Audit Log in the Microsoft Purview compliance portal
- B. The SharePoint admin center, which surfaces SharePoint service activity by itself
- C. The Microsoft Teams admin center, which surfaces Teams service activity by itself
- D. The Exchange admin center, which surfaces Exchange service activity by itself
Show answer
Correct answer: A
The Unified Audit Log in Microsoft Purview consolidates activity logs from Exchange Online, SharePoint, Teams, OneDrive, and other M365 services in one place. Individual admin centers only show their own service logs. The Unified Audit Log is the central compliance tool.
5. Where in Microsoft 365 would an administrator add a custom domain name for the organization?
- A. Microsoft 365 admin center
- B. SharePoint admin center
- C. Teams admin center
- D. Exchange admin center
Show answer
Correct answer: A
Custom domain names are added and verified in the Microsoft 365 admin center under Settings > Domains. The Exchange, SharePoint, and Teams admin centers manage service-specific settings, not organization-level domain configuration.
Show 5 more questions
6. What does MFA (Multi-Factor Authentication) require from a user during sign-in?
- A. Two or more verification methods drawn from different authentication categories
- B. A hardware security token used by itself as the single verification method
- C. A single biometric scan used by itself as the verification method
- D. A username and password combination used as the single verification factor
Show answer
Correct answer: A
MFA requires users to provide two or more verification factors from different categories: something you know (password), something you have (phone/token), or something you are (biometric). Using only a password is single-factor. A single biometric or hardware token alone is also single-factor.
7. What does the Identity Secure Score in Microsoft Entra ID measure?
- A. How closely your identity security posture aligns with Microsoft's recommended best practices
- B. The number of sign-in risk events Microsoft Entra detected across the tenant in the past 30 days
- C. The percentage of users who completed mandatory security awareness training in the tenant
- D. The count of Conditional Access policies currently active and enforced across the tenant
Show answer
Correct answer: A
Identity Secure Score is a numeric percentage that reflects how closely your identity configuration aligns with Microsoft's recommended best practices, with each improvement action contributing points toward the maximum. It does not count sign-in risk events (which are tracked separately in Entra ID Protection), training completion (which sits in Microsoft Learn/Training apps), or the number of Conditional Access policies (which is a configuration count, not a posture score).
8. In Microsoft Entra ID, what is the primary purpose of a Security Group?
- A. Control access to resources by assigning permissions to the group once
- B. Send email messages to a group of users through one shared address
- C. Schedule meetings with multiple users from a single calendar entry
- D. Assign licenses to multiple users across the tenant in a single bulk operation
Show answer
Correct answer: A
Security Groups in Entra ID are used to manage access to resources by assigning permissions once to the group rather than individually to each user. Distribution groups are for email distribution, license assignment can use groups but it is not the primary purpose of a security group, and Teams handles meeting scheduling.
9. What is Microsoft Entra ID Protection used for?
- A. Detecting and remediating identity-based risks such as compromised accounts and risky sign-ins
- B. Detecting when users violate Conditional Access policies and flagging the policies for administrator review
- C. Enforcing password complexity rules and providing self-service password reset for end users
- D. Blocking sign-ins from devices that are not Entra-joined or managed by Microsoft Intune
Show answer
Correct answer: A
Microsoft Entra ID Protection focuses on detecting and remediating identity-based risks - compromised credentials, anonymous IP usage, leaked credentials, atypical sign-in locations - and integrates with Conditional Access to require MFA or block risky sign-ins. Option B describes Conditional Access reporting, not risk detection. Option C describes Entra password protection and SSPR. Option D describes device-based Conditional Access controls. None of these is the unique role of ID Protection.
10. Which Microsoft Defender product is specifically designed to detect and investigate threats targeting Active Directory on-premises identities?
- A. Microsoft Defender for Identity
- B. Microsoft Defender for Endpoint
- C. Microsoft Defender for Office 365
- D. Microsoft Defender for Cloud Apps
Show answer
Correct answer: A
Microsoft Defender for Identity (formerly Azure ATP) monitors on-premises Active Directory signals to detect lateral movement, credential attacks, and other identity-based threats. Defender for Endpoint covers devices, Defender for Office 365 covers email/collaboration, and Defender for Cloud Apps covers SaaS applications.
AB-900 study resources
Why Practice with MSCertQuiz?
Microsoft Learn teaches concepts. We prepare you for the actual exam.
Full coverage of M365 admin center, Exchange Online, SharePoint, and Teams administration
Deep Purview data governance — DLP, sensitivity labels, Insider Risk, and Compliance Manager
Copilot licensing, pay-as-you-go billing, analytics, and agent lifecycle management
Updated for the latest 2026 exam objectives — no outdated material
Not sure if you're ready for the AB-900 exam?
Take the free AB-900 Readiness Check →What Our Users Say
95% pass rate — Based on users who completed at least 2 practice exams
“The Purview and Copilot governance questions were exactly what the exam covered. The explanations helped me understand DSPM for AI and Compliance Manager in depth. Passed first try!”
Karen L.
AB-900 Certified
“As an M365 admin, I thought I knew most of this. The Copilot licensing and pay-as-you-go billing questions exposed real gaps in my knowledge. MSCertQuiz filled those gaps perfectly.”
Nathan P.
Microsoft 365 Administrator
“The agent administration and Copilot Analytics questions were detailed and realistic. I passed with 810 — well above the 700 threshold.”
Sophie M.
Passed AB-900 first try
Choose Your Plan
Start free, upgrade when you're ready to get serious
Free
Good for exploring the platform
- 40 practice questions
- Practice mode only
- Progress tracking
- No exam simulation mode
AB-900 Full Access
Best if your exam is in the next 2-4 weeks
- 500 practice questions
- Practice & Exam modes
- Detailed explanations
- Lifetime access
7-day money-back guarantee
Pro — All Certs
Best if you're planning multiple Microsoft exams
- ALL certifications included
- Unlimited questions
- New certs added free
- Cancel anytime
Save 30% vs buying individually
Your AB-900Exam Won't Wait
Candidates who complete at least 2 full mock exams pass at significantly higher rates than those who only study passively.
Don't risk $99 USD on the real exam without testing yourself first.
Start Free Practice NowNo credit card required • 40 free questions • Upgrade for $19.99 when ready
Official Microsoft Resources
Our practice questions are aligned with official Microsoft exam objectives. We recommend studying with Microsoft Learn first, then using MSCertQuiz to test your readiness.
View Official AB-900 Exam DetailsAB-900 Frequently Asked Questions
Everything you need to know about the AB-900 Microsoft 365 Copilot and Administration Fundamentals certification
What is the AB-900 exam?
How hard is the AB-900 exam?
What does AB-900 cover?
Is AB-900 worth getting in 2026?
What score do I need to pass AB-900?
How much does the AB-900 exam cost?
Does the AB-900 certification expire?
How long should I study for AB-900?
What are the prerequisites for AB-900?
How is AB-900 different from MS-900?
Is AB-900 harder than AI-900?
What is DSPM for AI in the AB-900 exam?
AB-900 Exam Cost 2026
The AB-900 exam costs $99 USD. This is the standard price for all Microsoft Fundamentals-level certifications. Pricing may vary slightly by region — confirm the current price on the official Microsoft Learn scheduling page before booking.
There are no formal prerequisites, and the AB-900 certification does not expire once earned. Microsoft occasionally offers free exam vouchers through events like Microsoft Ignite. At $99, AB-900 is one of the most targeted ways to validate Copilot administration skills as enterprises accelerate Microsoft 365 Copilot deployments.
AB-900 vs MS-900: What's the Difference?
Both certifications cover Microsoft 365, but they serve different purposes. Here's how to decide which one to take:
| AB-900 | MS-900 | |
|---|---|---|
| Focus | M365 + Copilot governance + AI data protection | M365 apps, cloud concepts, pricing, security basics |
| Unique topics | DSPM for AI, Copilot licensing, agent administration, Copilot Analytics | Cloud service models (IaaS/PaaS/SaaS), Teams/Exchange/SharePoint overview |
| Best for | M365 admins managing Copilot deployments | Anyone new to Microsoft 365 or cloud services |
| Cost | $99 USD | $99 USD |
| Expires? | No | No |
If you've already passed MS-900, AB-900 is the logical next step. If you haven't taken either, AB-900 alone is sufficient for the Copilot administrator path.
AB-900 Exam Topics: Domain Breakdown
Domain 1: Microsoft 365 Core Services
30–35%Exchange Online, SharePoint Online, Microsoft Teams, OneDrive for Business, Microsoft Entra ID basics, Microsoft 365 admin center tasks.
Domain 2: Data Protection and Governance
35–40%Microsoft Purview DLP policies, sensitivity labels, Insider Risk Management, Compliance Manager, DSPM for AI (data oversharing risks in Copilot), eDiscovery basics.
Domain 3: Copilot and Agent Administration
25–30%Copilot licensing models (per-user vs. pay-as-you-go), Copilot Analytics, Microsoft Copilot Studio agent lifecycle (create, publish, manage), agent governance and data connections.
Also Preparing For
Candidates studying AB-900 often prepare for these certifications next.