Is AB-900 hard? Exam difficulty explained
AB-900 is an easy-to-moderate exam: easier than any associate exam, but harder than the old MS-900 and harder than its “fundamentals” label suggests. Nothing in it goes deep, and there is no scripting or configuration from memory. The difficulty comes from breadth and similarity — a long list of Purview and Entra tools that sound alike — and from Copilot administration, which changes faster than most study material.
What makes it hard
Many tools that sound alike
The data protection domain is worth 35–40% and names more than a dozen tools. Several pairs are easy to confuse:
- sensitivity labels and retention labels;
- Data Explorer and activity explorer;
- Insider Risk Management and Communication Compliance;
- DLP alerts and Insider Risk alerts;
- Compliance Manager and Identity Secure Score.
Each pair shares a vocabulary but answers a different question. Candidates who learned the tools as a list, rather than by the problem each solves, lose most of their marks here.
It assumes you have seen the admin centers
The audience profile expects familiarity with the Microsoft 365, Exchange, SharePoint, Teams, Entra and Purview admin centers. Questions are written from an admin’s point of view: where would you go, what would you check, which report shows this. Reading about Microsoft 365 as a user is not enough.
Copilot administration moves quickly
Billing options, agent management and usage reporting change often, and Microsoft updates the English exam on October 14, 2026. Study material written even a few months ago may describe settings that have moved or been renamed. The exam also allows questions on commonly used preview features.
Forty-five minutes
The exam is short. You cannot afford to deliberate for several minutes on a question, so recognition has to be quick.
What makes it easier
- No depth. You identify, understand and compare. You are not asked to write PowerShell, build a policy step by step or troubleshoot a complex configuration.
- One core idea. Copilot only returns what a user can already access. Understand that and a large share of the Copilot questions answer themselves.
- A free practice assessment exists on Microsoft Learn, so you can see Microsoft’s question style before booking.
- No renewal. Fundamentals certifications do not expire, so there is no yearly assessment after you pass.
How hard for whom
| Your background | Expected difficulty | Realistic preparation |
|---|---|---|
| Microsoft 365 admin with Purview experience | Easy | 1–2 weeks, mostly on Copilot and agents |
| Microsoft 365 or Teams admin without compliance work | Moderate | 3–4 weeks, mostly on data protection |
| Held MS-900, no admin experience | Moderate | 4 weeks, with time in a test tenant |
| Security or identity specialist | Easy to moderate | 2–3 weeks; strong on Entra, weaker on Copilot licensing |
| Business user or project manager rolling out Copilot | Moderate to hard | 5–6 weeks; the admin centers are new |
| New to IT | Hard | 6 weeks or more, starting with basic Microsoft 365 administration |
Common reasons people fail
- Studying Copilot and skipping Purview. The largest domain is data protection, not Copilot.
- Learning tools as a list. Match each tool to a problem instead.
- Relying on MS-900 material. Cloud concepts and app tours are gone; oversharing and DSPM for AI are new.
- Never opening an admin center. Questions ask where to look; without having looked, you guess.
- Using out-of-date Copilot material. Check that anything you read reflects the current outline.
How to make it easier
Set up a trial tenant and spend an evening in each admin center. Create a label, a DLP policy and a retention policy and watch them act on the same document. Read the Copilot admin documentation with the outline beside you. The four-week study plan puts that in order, and the exam tips cover the distinctions that decide the most marks.
Before booking, take the free 20-question practice test. If you score below 14, go back to the domain guide for your weakest area.