AB-900 vs MS-900: what changed?
MS-900, Microsoft 365 Fundamentals, retired on March 31, 2026. AB-900 is the fundamentals exam that people coming from MS-900 now look at, but it is not the same exam with a new number. MS-900 asked you to describe Microsoft 365: cloud concepts, apps, security and licensing. AB-900 asks you to identify, monitor and perform basic administrative work in a tenant where Copilot and agents are running. It is narrower in scope and noticeably more hands-on.
The two exams side by side
| MS-900 (retired) | AB-900 | |
|---|---|---|
| Certification | Microsoft 365 Certified: Fundamentals | Microsoft 365 Certified: Copilot and Agent Administration Fundamentals |
| Status | Retired March 31, 2026 | Current |
| Level | Fundamentals | Fundamentals |
| Duration | 45 minutes | 45 minutes |
| Passing score | 700 | 700 |
| Languages offered | 12 | 13 |
| Renewal | None | None |
Domains compared
| MS-900 domain | Where it went in AB-900 |
|---|---|
| Describe cloud concepts | Dropped. SaaS, IaaS and PaaS are no longer tested as a topic |
| Describe Microsoft 365 apps and services | Narrowed to the admin centers: Microsoft 365, Exchange, SharePoint and Teams |
| Describe security, compliance, privacy, and trust in Microsoft 365 | Split and deepened: security moved into core features, compliance became the largest domain with Purview at its centre |
| Describe Microsoft 365 pricing, licensing, and support | Narrowed to how licences affect access, and Copilot’s monthly licence versus pay-as-you-go |
| — | New: Perform basic administrative tasks for Copilot and agents |
What carries over
If you passed or studied for MS-900, these parts of your knowledge still apply:
- Zero Trust and its three principles: verify explicitly, use least-privilege access, assume breach.
- Microsoft Entra ID basics: users, groups, multifactor authentication, conditional access and single sign-on.
- The Purview family at a name level: sensitivity labels, DLP, retention, Insider Risk Management, eDiscovery.
- Microsoft Defender XDR as the unified view across endpoints, identities, email and cloud apps.
- Licensing as the thing that decides which features a user can reach.
MS-900 mostly asked what these are. AB-900 asks which one you would use for a given problem, and in several cases what you would see in the admin center when you do.
What is new
Copilot’s data access model. How Copilot grounds answers in Microsoft Graph, why it only returns what the signed-in user can already open, and why that makes oversharing the headline risk. MS-900 had nothing like this.
Oversharing tools. SharePoint data access governance reports, SharePoint Advanced Management and restricted access control. These appear as their own objective group.
Purview for AI. Data Security Posture Management (DSPM) for AI, used to discover and manage AI activity, sits alongside the long-standing Purview solutions.
Investigation tools. Compliance Manager, Data Explorer, activity explorer, DLP alerts, Communication Compliance policy violations and eDiscovery Content search. The outline expects you to know where to look, not just what exists.
Identity administration detail. Identity Secure Score, troubleshooting sign-ins, reviewing audit logs, Privileged Identity Management, and the difference between app registrations and enterprise applications.
Copilot and agent administration. Assigning Copilot licences, pay-as-you-go billing policies, usage reports and Copilot Analytics, managing prompts, Researcher and Analyst, creating an agent, configuring who can use agents, the approval process, and monitoring agents in the Microsoft 365 admin center and the Power Platform admin center.
What was dropped
- Cloud concepts: deployment and service models, and the benefits of cloud computing
- The broad tour of Microsoft 365 productivity and collaboration apps
- Endpoint and application management, automated operating system deployment and desktop virtualisation
- Deployment, migration and support options for Microsoft 365
Microsoft notes that related topics can still appear, so none of this is forbidden ground. But it is no longer where the marks are.
Is it a harder exam?
Yes, somewhat. MS-900 could be passed by someone who had read about Microsoft 365 but never signed in to an admin center. AB-900 assumes you have seen the Microsoft 365 admin center, the SharePoint admin center and the Purview portal, and it expects you to tell similar tools apart: DLP from sensitivity labels, Insider Risk Management from Communication Compliance, Data Explorer from activity explorer. See is AB-900 hard? for more.
If you already hold MS-900
Your certification stays on your Microsoft Learn profile. Fundamentals certifications do not expire, so retirement does not remove it, and there is no renewal assessment to worry about. What retirement does mean is that no one can earn it any more, and it describes a Microsoft 365 without Copilot. If your role now includes Copilot rollout or data governance, AB-900 is the more current signal.
The fastest route is the four-week study plan, spending less time in week one on the admin centers you already know and more in week two on Purview and oversharing.