AB-900 prerequisites: what you need first
AB-900 does not require you to hold another certification first. The Microsoft study guide I checked lists no prerequisite exam; it gives an audience profile instead, and that profile is the real entry bar. It describes someone who is familiar with Microsoft 365 and its admin centers, so the exam is easiest if you have at least looked around a tenant as an administrator. This page explains what that means in practice and how to close the gaps before you start the study plan.
What Microsoft says
The audience profile says you “should be familiar with Microsoft 365”, including core services, security, identity and access, data protection and governance, plus Microsoft 365 Copilot and agents. It adds that you should know the admin centers for Exchange Online, SharePoint, Teams, Microsoft Entra and Microsoft Purview, and that you “need to have experience with AI-driven productivity tools and modern IT management practices”.
Two more expectations are concrete: being able to identify the roles of core objects such as users, groups, teams, sites and libraries, and understanding core security features such as authentication methods, conditional access policies and single sign-on. Microsoft’s change log marks the audience profile as unchanged in the October 14, 2026 update. No coding, scripting or Azure knowledge is mentioned.
The background that helps
Tenant objects and licences
A Microsoft 365 tenant is built from a handful of object types, and the first skill area asks which one you would configure for a given job. Know the difference between a user, a group, a Teams team, a SharePoint site and a document library, and that licences decide which features a person gets. If you have ever assigned a licence or created a shared mailbox, you have the intuition.
Identity and sign-in
Authentication proves who you are; authorisation decides what you may open. Be comfortable with multifactor authentication, single sign-on and the idea that a conditional access policy says “allow, but only if…”. The exam also touches Zero Trust principles at a conceptual level.
Permissions in SharePoint and Teams
Copilot can surface anything a user is allowed to open, so permissions are the heart of the exam. You should understand that a site can be shared widely by accident, and why that becomes a Copilot problem rather than just a filing problem.
Data protection vocabulary
You do not need Purview hands-on experience, but words like sensitivity label, retention, data loss prevention and eDiscovery should not be new. This is the largest skill area, so familiarity here pays off most.
Everyday Copilot use
The profile asks for experience with AI-driven productivity tools. Use Copilot in a real task for a week: summarising a thread, drafting a document, asking a question about a file. It makes the administration topics concrete.
What you do not need
| Not needed | Why |
|---|---|
| Another certification | The study guide names none as a requirement |
| Programming or scripting | The objectives are about choosing and interpreting admin tools |
| Azure experience | The exam is about Microsoft 365, not Azure resources |
| Global administrator rights | A free or trial tenant is enough to explore |
| Prior Copilot administration | The Copilot objectives are written for newcomers |
Self-check
If you can answer these without looking anything up, you can begin preparation:
- What is the difference between a Microsoft 365 group and a security group?
- Where would you go to see which sites exist in the tenant?
- Why is a sign-in with a password plus a phone approval stronger than a password alone?
- If a file is shared with “everyone in the company”, who could see it through Copilot?
- What problem does a sensitivity label solve that a folder permission does not?
Two or more blanks? Spend a few days on the free written course, whose first lessons cover tenant objects, where data lives and sign-in and access in the order the exam uses.
If you come from MS-900 or a user role
People who studied for the retired Microsoft 365 fundamentals exam already know the product vocabulary. What changes is the viewpoint: questions are written from an administrator’s seat, asking where to go and which report shows a problem. If you only used Microsoft 365 as an end user, allow extra time and click through the admin centers in a trial tenant. AB-900 versus MS-900 lists what moved.
Where it leads
AB-900 is a fundamentals exam, so nothing else on the site requires it. Read the exam format for the mechanics and is AB-900 hard? for how difficulty varies by background. The study plan fits in four weeks, and is it worth it? covers who benefits from the credential.