AB-900 cheat sheet
Last-minute reference for AB-900. Data protection and governance is the largest domain; Copilot and agents is the smallest.
Exam facts
| Duration | 45 minutes |
| Passing score | 700 / 1000 |
| Price | Set per country or region; shown at booking |
| Level | Fundamentals; does not expire |
| Outline version | As of October 14, 2026 |
Skill areas
| Area | Weight |
|---|---|
| Understand data protection and governance tasks for Microsoft 365 and Copilot | 35–40% |
| Identify the core features and objects of Microsoft 365 services | 30–35% |
| Perform basic administrative tasks for Copilot and agents | 25–30% |
Requirement to tool
| Requirement | Answer |
|---|---|
| Add a custom domain | Microsoft 365 admin center |
| Licences follow team membership | Group-based licensing |
| One inbox, several users | Shared mailbox |
| Email to every member’s own inbox | Distribution group |
| Read-only access to a site | Visitors group |
| MFA only outside the office | Conditional access with named locations |
| Why was a sign-in blocked? | Entra sign-in logs |
| Who changed a role assignment? | Entra audit logs |
| Admin roles only when needed | Privileged Identity Management |
| SSO for a gallery SaaS app | Enterprise applications |
| One incident across email, identity and endpoint | Defender XDR |
| Encrypt a file wherever it goes | Sensitivity label with encryption |
| Block sensitive data being sent out | DLP policy |
| Keep for seven years, then delete | Retention policy or label |
| Where is sensitive data stored? | Data Explorer |
| What did users do with it? | Activity explorer |
| Departing user exfiltrating data | Insider Risk Management |
| Harassment in chats | Communication Compliance |
| AI use and sensitive prompts | DSPM for AI |
| Regulatory score and actions | Compliance Manager |
| Find emails for a legal case | eDiscovery Content search |
| Sites shared too broadly | Data access governance report |
| Limit a site to one group | Restricted access control (SAM) |
| Daily Copilot use in apps | Per-user monthly licence |
| Occasional or agent-only use | Pay-as-you-go billing policy |
| Research report from many sources | Researcher |
| Explain trends in spreadsheets | Analyst |
| Copilot adoption numbers | Usage reports, Copilot Analytics |
| Agent for one group only | Agent settings, Microsoft 365 admin center |
| Copilot Studio environments | Power Platform admin center |
Zero Trust
Verify explicitly. Use least-privilege access. Assume breach.
Responsible AI
Fairness, reliability and safety, privacy and security, inclusiveness, transparency, accountability.
Traps
- Copilot does not bypass permissions. It shows only what the user can already open; the fix is permissions, not Copilot.
- Labels protect, retention keeps, DLP blocks. They are not interchangeable.
- Data Explorer is where; activity explorer is what happened.
- Insider Risk is behaviour; Communication Compliance is message content.
- Distribution groups cannot carry licences.
- App registration defines an app; the enterprise application is where you assign users.
- Org-wide agents need approval before others can find them.
- MS-900 material covers topics that are gone and misses Copilot entirely.
Night-before checklist
- Name the three areas and which is largest
- One sentence each on labels, DLP and retention
- Why Copilot reveals oversharing, and three ways to reduce it
- Monthly licence versus pay-as-you-go, cold
- Check ID and proctoring rules; see exam day
Take the 20-question practice test and check your weakest area.