Microsoft AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Understand data protection and governance tasks for Microsoft 365 and Copilot

   A company wants content to be labeled automatically when it contains credit card numbers, and the label should restrict external sharing. Which Microsoft Purview feature should be used?

   1. AMicrosoft Teams channel tags for organizing team content and conversations
   2. BSharePoint site descriptions and navigation for site visitors, members, and owners
   3. CExchange message tracking for mail routing and delivery status logs
   4. DSensitivity labels with auto-labeling conditions and protection settings
   Show answer and explanationHide answer

   Correct answer: D

   Sensitivity labels with auto-labeling detect sensitive information types such as card numbers and can apply protection that limits sharing. Channel tags, message tracking and site descriptions do not classify or protect content.

2. Question 2Perform basic administrative tasks for Copilot and agents

   Which two statements about Copilot licensing are accurate? (Choose two.)

   1. ACopilot licenses are shared by multiple users at the same time
   2. BCopilot billing cannot be monitored by admins
   3. CMicrosoft 365 Copilot is licensed per user and requires a supported base license
   4. DPay-as-you-go billing can be configured for certain Copilot experiences by policy
   5. EEvery user in the tenant receives Copilot automatically at no cost
   Show answer and explanationHide answer

   Correct answer: C, D

   Microsoft 365 Copilot is a per-user license on a supported base plan, and pay-as-you-go billing policies can apply to some Copilot experiences. Automatic free access, shared concurrent licenses and no billing visibility are not accurate.

3. Question 3Identify the core features and objects of Microsoft 365 services

   A new employee needs Copilot features in Word and Teams. The admin assigned the employee a Microsoft 365 license that does not include Copilot. What must the admin do?

   1. AAssign a Microsoft 365 Copilot license to the user, in addition to a supported base license
   2. BAdd the employee to a Microsoft 365 distribution group that is mail-enabled for Outlook delivery and routing
   3. CTurn on Copilot in the SharePoint admin center for the user's personal site collection
   4. DCreate a new Exchange Online mailbox for the employee and grant shared calendar access
   Show answer and explanationHide answer

   Correct answer: A

   Microsoft 365 Copilot is licensed per user on top of a supported base license, so the user needs the Copilot add-on license. Site settings, mailboxes and distribution groups do not grant Copilot access.

4. Question 4Identify the core security features of Microsoft 365 services

   Which Zero Trust principle means that access decisions should be made by verifying the user, device and context on every request rather than trusting the network?

   1. AAssume the network is safe
   2. BDisable authentication for internal users
   3. CGrant standing administrator access to everyone
   4. DVerify explicitly
   Show answer and explanationHide answer

   Correct answer: D

   Verify explicitly means checking identity, device health and context for each access decision. Trusting the network and standing administrator access contradict Zero Trust, and disabling authentication removes verification.

5. Question 5Understand data protection and governance tasks for Microsoft 365 and Copilot

   A regulator requires that customer emails be kept for seven years even if users delete them. Which Microsoft Purview capability satisfies this requirement?

   1. ARetention policies that retain content for seven years
   2. BInsider risk policies that flag departing employees
   3. CData loss prevention rules that block outbound emails
   4. DCommunication compliance alerts for offensive language
   Show answer and explanationHide answer

   Correct answer: A

   Retention policies keep content for a defined period regardless of user deletion, which meets a seven-year requirement. DLP blocks or warns on sharing, insider risk identifies behavior, and communication compliance flags messages.