Free AB-900 sample questions with answers
Here are five free AB-900 sample questions covering all three skill areas, with the answer and the reasoning behind it. Try each one before opening the answer. These are original scenario questions written against the official skills outline, not questions from the real exam.
Question 1. A new marketing team of 25 people needs Microsoft 365 apps. People join and leave the team every month, and the admin wants licences to follow team membership without manual work. What should the admin do?
- A. Assign a licence to each user individually in the Microsoft 365 admin center
- B. Assign the licence to a security group that contains the team members
- C. Create a distribution group in the Exchange admin center and license it
- D. Add the users as members of the team’s SharePoint site
Show answer
Answer: B
Assigning a licence to a group means every member receives it and anyone removed from the group loses it, so licences follow membership automatically. Assigning licences one user at a time is exactly the manual work to avoid. A distribution group is for email delivery and cannot carry licences. A SharePoint site has no role in licensing.
Want more questions like this? Full AB-900 practice tests →
Question 2. A user reports that they are blocked when signing in from home but not from the office. MFA succeeds. You want to find out why the sign-in was blocked. Where should you look first?
- A. The sign-in logs in Microsoft Entra ID, checking the conditional access result
- B. Identity Secure Score in Microsoft Entra ID
- C. Microsoft Purview Compliance Manager
- D. The Teams admin center user settings
Show answer
Answer: A
The Entra ID sign-in logs show each sign-in attempt and, for conditional access, which policy applied and whether it granted or blocked access. That is the direct route to a location- or device-based block. Identity Secure Score gives posture recommendations, not per-sign-in detail. Compliance Manager assesses regulatory controls. The Teams admin center does not handle sign-in decisions.
Want more questions like this? Full AB-900 practice tests →
Question 3. After Microsoft 365 Copilot is rolled out, a sales representative asks Copilot about bonuses and receives a summary of a salary spreadsheet from HR. What is the most likely cause?
- A. Copilot ignores SharePoint permissions when summarising files
- B. The spreadsheet was used to train the Copilot language model
- C. Web search grounding retrieved the file from the internet
- D. The spreadsheet is overshared, so the user already had access to it
Show answer
Answer: D
Copilot only returns content the signed-in user already has permission to access. If the spreadsheet surfaced, the user could already open it, typically because of an overly broad sharing link or site permission. Copilot does not bypass permissions, Microsoft does not train foundation models on tenant data, and web grounding does not reach internal HR files.
Want more questions like this? Full AB-900 practice tests →
Question 4. Board documents must be encrypted so that only board members can open them, even if a file is emailed outside the company. Which Microsoft Purview feature meets this requirement?
- A. A retention label
- B. A Content search in eDiscovery
- C. A sensitivity label that applies encryption
- D. A Communication Compliance policy
Show answer
Answer: C
A sensitivity label with encryption protects the file itself, so the protection travels with it wherever it is copied or sent and only authorised users can open it. A retention label controls how long content is kept. A DLP policy can block or warn on sharing but does not encrypt the file. eDiscovery Content search finds content; it does not protect it.
Want more questions like this? Full AB-900 practice tests →
Question 5. A company does not want to buy Microsoft 365 Copilot licences for every employee yet, but wants staff to use an agent grounded on a SharePoint site and pay only for actual use. What should the admin set up?
- A. Assign a Microsoft 365 Copilot licence to all users
- B. Create a pay-as-you-go billing policy for the users who need the agent
- C. Remove all Copilot licences and allow agents in the Teams admin center
- D. Block the agent until every user is licensed
Show answer
Answer: B
A pay-as-you-go billing policy, linked to an Azure subscription in the Microsoft 365 admin center, charges for agent usage by users who do not have a Copilot licence. Assigning a licence to everyone is the per-user monthly model the company wants to avoid. Removing licences or blocking agents does not enable metered use.
Want more questions like this? Full AB-900 practice tests →
How did you do?
Questions 3 and 4 are the ones MS-900 would not have asked. If Copilot’s permission model or the difference between labels, DLP and retention slowed you down, spend time on the data protection guide, which covers the largest domain.
For a longer check, take the 20-question practice test.