ExamSprintLab

AB-900 study plan: pass in 4 weeks

Updated September 28, 2026

Four weeks at five to six hours a week is realistic for AB-900 if you already use Microsoft 365 at work and have seen at least one admin center. Spend the first week on the tenant itself, the second on data protection, the third on Copilot and agents, and the fourth on review. If you have never administered Microsoft 365, allow six weeks and spend the extra time in weeks one and two.

Before you start

  • Read the official skills outline once. It is short, and it names every tool the exam can ask about.
  • Get a tenant you can administer. A Microsoft 365 trial tenant, or a developer tenant if you qualify for one, gives you the admin centers to click through. Some features, such as Copilot itself, Insider Risk Management and SharePoint Advanced Management, need licences a trial may not include; where you cannot click through them, read the documentation and watch the admin center walkthroughs on Microsoft Learn.
  • Take Microsoft’s free practice assessment once, cold, to see how questions are worded. Do not worry about the score yet.

Week 1: core features and objects (30–35%)

Goal: know which admin center owns which object, and how identity keeps the tenant safe.

  • Microsoft 365 admin center: domains, org settings, users, groups and licence assignment. Understand that a licence decides which services a user can reach, and that licensing a group applies to everyone in it.
  • Exchange admin center: user and shared mailboxes, distribution groups, mail-enabled security groups.
  • SharePoint admin center: sites, libraries and folders; site owners, members and visitors; where sharing settings live.
  • Teams admin center: teams, standard, private and shared channels, and policies for meetings, messaging and apps.
  • Security principles: Zero Trust, authentication versus authorisation, authentication methods, threat intelligence, and what Defender XDR brings together.
  • Entra ID: conditional access, SSO, users versus groups, sign-in logs and risky sign-ins, Identity Secure Score, audit logs, Privileged Identity Management, app registrations versus enterprise applications.

Lab: create three users, a security group and a Microsoft 365 group. License the group, then check which apps each user sees. Build a report-only conditional access policy requiring MFA and read its results in the sign-in logs.

Week 2: data protection and governance (35–40%)

Goal: match every Purview tool to the problem it solves. This is the largest domain, so it gets the most hours.

  • Information Protection: sensitivity labels for files, emails, sites and teams; encryption and content marking; how Copilot respects labels.
  • Classification: sensitive information types and trainable classifiers; Data Explorer for where sensitive content sits; activity explorer for what users did with it.
  • DLP: policies, policy tips, alerts, and how DLP can stop sensitive content being processed by Copilot.
  • Retention: retention policies versus retention labels, retain versus delete.
  • Insider Risk Management and Communication Compliance: risky user activity versus inappropriate messages.
  • DSPM for AI: discovering AI use and sensitive data in prompts.
  • Compliance Manager and eDiscovery Content search.
  • Oversharing: data access governance reports, SharePoint Advanced Management and restricted access control.

Lab: publish a sensitivity label and a DLP policy for a built-in sensitive information type, then save a document containing a matching test number and watch the policy tip and the alert. Run a Content search for that document.

Week 3: Copilot and agent administration (25–30%)

Goal: be able to explain Copilot’s licensing and data model to a manager, and manage an agent from request to retirement.

  • How Copilot reaches data: Microsoft Graph grounding, the user’s own permissions, and why oversharing becomes visible through Copilot.
  • Responsible AI: fairness, reliability and safety, privacy and security, inclusiveness, transparency, accountability.
  • Licensing: the per-user monthly Microsoft 365 Copilot licence versus pay-as-you-go, including SharePoint agents, and billing policies.
  • Features: which Copilot features an admin can turn on or off; use cases for Researcher, Analyst and custom agents.
  • Administration: assigning Copilot licences, usage reports and Copilot Analytics, and saving, sharing, scheduling and deleting prompts.
  • Agents: creating one, controlling who can use it, the approval process, and monitoring usage and lifecycle in the Microsoft 365 admin center and the Power Platform admin center.

Lab: if you have access, build a simple agent grounded on one SharePoint site and share it with a group. Otherwise walk through the Agents and Copilot pages of the admin center documentation and write down what each setting controls.

Week 4: review

If you held MS-900

Shorten week one to a few evenings; the admin centers and Zero Trust are familiar. Spend the time you save on week two. See what changed from MS-900.

How to know you are ready

  • You can name the right Purview tool for a problem in one sentence: find it, label it, block it, keep it, investigate it.
  • You can explain why Copilot showed a user a file they should not have seen, and three ways to stop it.
  • You score 80% or more on realistic practice questions twice in a row, on different sets.

Then book it. See the exam format for the mechanics and the exam day guide for the day itself.