AB-900 exam tips: how to gain marks
The best AB-900 exam tips are about reading, not memorising: find the verb in each question, match it to the right tool, and do not lose time on any single item in a 45-minute exam. These tips cover the sitting itself. If you are still planning your preparation, start with the study plan.
Pace the 45 minutes
Microsoft does not publish the number of questions, so you cannot calculate an exact time per question in advance. Check the count on the first screen, divide, and set yourself checkpoints at a quarter, half and three quarters. Two rules keep you on schedule:
- If you cannot choose between two answers within a minute, pick one, mark it for review and move on.
- Leave a few minutes at the end for marked questions. Many feel easier the second time.
Yes/no statement series and case-style questions sometimes cannot be revisited once answered. Read the instructions on those screens before answering.
Find the verb
AB-900 questions almost always contain a verb that points to one tool.
| If the question asks you to | Think of |
|---|---|
| Classify or protect a file wherever it goes | Sensitivity label |
| Stop sensitive data leaving | DLP policy |
| Keep content for a period, then delete | Retention policy or label |
| Find where sensitive content is stored | Data Explorer |
| See what users did with sensitive content | Activity explorer |
| Detect a risky user | Insider Risk Management |
| Review message content against a policy | Communication Compliance |
| Discover AI use and risky prompts | DSPM for AI |
| Find content for a legal request | eDiscovery Content search |
| Measure regulatory compliance | Compliance Manager |
| Find overshared sites | Data access governance report |
| Limit a site to one group | Restricted access control |
Tell the identity tools apart
The core features domain repeats the same trap: several Entra ID features sound relevant, but only one answers the question.
- Why was this sign-in blocked? Sign-in logs, with the conditional access result.
- How secure is our identity setup overall? Identity Secure Score.
- Was this sign-in possibly not the real user? Risky sign-ins.
- Who changed this group or role? Audit logs.
- Admins should hold roles only when needed. Privileged Identity Management.
- Configure SSO for a SaaS app. Enterprise applications.
Remember Copilot’s one rule
Copilot only returns what the signed-in user can already access. Almost every question about Copilot showing something it should not is really a permissions or oversharing question. Answers that say Copilot bypassed permissions, trained on the file, or found it on the web are distractors.
Watch for licensing wording
- Everyone uses Copilot daily points to per-user monthly licences.
- Occasional use, or agents for unlicensed staff points to pay-as-you-go with a billing policy.
- Licences should follow team membership points to group-based licensing on a security or Microsoft 365 group.
Read the scenario, not the product name
Several distractors will be real Microsoft products that simply do not fit. A Teams policy cannot fix a SharePoint permission; Compliance Manager does not block anything; a retention label does not encrypt. If an answer is a genuine feature but acts on the wrong object, it is wrong.
Beware absolute words
Answers containing “always”, “never”, “all” or “automatically” deserve a second look. Copilot does not always see everything; DLP does not automatically encrypt; a label does not block all sharing. Fundamentals exams test whether you understand the boundaries of each feature, and absolutes usually cross them.
Multiple-answer questions
When a question asks for two or three answers, the number to choose is stated. Judge every option on its own against the requirement rather than hunting for a set that looks tidy. Two options that describe the same tool in different words usually mean neither is the full answer.
Never leave a question blank. A guess costs nothing that an empty answer would not.
On the day
- Book with a personal Microsoft account, not a work one, so your record survives a job change.
- For online proctoring, run the system test on the same computer and network the day before, and clear your desk completely.
- If English is not your first language and the exam is not offered in yours, request the extra 30 minutes before you book.
- Read the exam day guide for identification and check-in rules.
If you do not pass
The score report breaks results down by skill area. Take the weakest domain back to its guide — core features, data protection or Copilot and agents — and retake after the 24-hour wait. Most near-misses come from the data protection domain, because it is the largest and has the most look-alike tools.
For a final check before booking, take the 20-question practice test.