AB-900 study resources

The best AB-900 resources are free: Microsoft’s skills outline, the Microsoft 365, Entra, Purview and Copilot documentation on Microsoft Learn, the free practice assessment, and a trial tenant to click through. Add realistic practice questions to find your weakest domain. Be careful with older material: much of what is written about Microsoft 365 fundamentals was made for the retired MS-900 and misses Copilot, oversharing and DSPM for AI.

Start with the official material

The skills outline. Three domains, with data protection and governance the largest at 35–40%. It fits on two pages and names every tool the exam covers. Read it first and keep it open while you study. Make sure you are reading the version for October 14, 2026 onward, which Microsoft’s study guide already shows.

Microsoft Learn training. The AB-900 exam page links to self-paced learning paths and an instructor-led course option. Use them for structure, then go to the documentation for detail.

The documentation. The study guide points to the Microsoft 365, Microsoft 365 Copilot, Microsoft 365 admin center and Microsoft Purview documentation. For this exam, the most useful pages are:

• the Copilot data, privacy and security overview, which explains Graph grounding and permissions;
• the Purview overviews for sensitivity labels, DLP, retention, Insider Risk Management, Communication Compliance and DSPM for AI;
• the SharePoint Advanced Management and data access governance report pages;
• the Copilot and agent management pages of the Microsoft 365 admin center documentation;
• the Entra ID pages on conditional access, sign-in logs, Identity Secure Score and PIM.

The free practice assessment. Available on the certification page. Use it to learn Microsoft’s question style and to check yourself at the end.

The exam sandbox. Ten minutes in Microsoft’s demo shows the interface and question types. It contains no real content.

Exam Readiness Zone. The study guide links to Microsoft’s video series of exam preparation sessions; check whether an AB-900 episode is available.

Hands-on is the differentiator

AB-900 asks where you would look and what you would see. Five short exercises cover most of it:

1. Tour the admin centers. Microsoft 365, Exchange, SharePoint, Teams, Entra and Purview. List which objects each manages.
2. Licence by group. License a group, add and remove a user, and see what changes for them.
3. Read a sign-in. Create a report-only conditional access policy and read its result in the sign-in logs.
4. Label, block, keep. Create a sensitivity label, a DLP policy and a retention policy, and apply all three to the same test document. Then find it with Content search.
5. Walk through Copilot and agents. If you have a Copilot licence, create a simple agent and share it with a group. If not, walk through the admin center documentation for licences, billing policies, usage reports and agent approval.

Trial tenants may not include every feature, such as Insider Risk Management or SharePoint Advanced Management. Where you cannot click, read the documentation carefully instead.

Worth paying for

Practice tests written for AB-900, not adapted from MS-900. Their value is diagnosis: they show which domain is weakest while there is still time to fix it. The free 20-question test here is weighted like the real exam and is a good first check.

What to avoid

MS-900 courses and question banks. Cloud concepts, the app tour and support options are no longer in the outline, while Copilot data access, oversharing, DSPM for AI and agent administration are missing from them entirely. If a course spends an hour on IaaS versus SaaS and nothing on restricted access control, it was written for the old exam. See what changed from MS-900.

Out-of-date Copilot material. Copilot administration changes often. Check the date of anything you read, and prefer the current Microsoft Learn documentation when a blog post disagrees with it.

Braindumps. They break Microsoft’s exam agreement, risk revocation of every certification you hold, and do not help with scenario questions that describe a situation rather than recite a fact.

Memorising portal click paths. Menus move. The exam asks which tool or setting meets a requirement, not where a button is.

A sensible order

1. Read the skills outline once.
2. Work through the three domains with Microsoft Learn and the exercises above, following the four-week study plan.
3. Take the practice test and find your weakest domain.
4. Go back to that domain’s guide and documentation.
5. Take Microsoft’s practice assessment, then book once you score 80% or more on realistic questions twice in a row.

Is this the right exam?

If you administer or support a Microsoft 365 tenant, yes. If you build agents in Copilot Studio, AB-620 fits better. See is AB-900 worth it? for who benefits most.