AB-900 study scenarios by background
The name suggests a Copilot exam, but the largest AB-900 domain is data protection and governance at 35 to 40 percent, ahead of core Microsoft 365 features (30 to 35 percent) and Copilot and agent administration (25 to 30 percent). The exam lasts 45 minutes with a passing score of 700. The three profiles below show how that weighting shifts study time for an experienced admin, a former MS-900 candidate and a newcomer.
Example profiles, not real people. The profiles below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.
The Teams or Exchange administrator
Starting point. This candidate runs mailboxes, groups, sites or Teams policies every day. The first domain is largely familiar, including licensing, the admin centers and sharing settings.
Where the time goes. Into Microsoft Purview: sensitivity labels, DLP, retention, Insider Risk Management, Communication Compliance, DSPM for AI, Compliance Manager, Data Explorer, activity explorer and eDiscovery Content search. Then oversharing in SharePoint, data access governance reports and SharePoint Advanced Management with restricted access control. Core security still deserves attention: PIM, Identity Secure Score and app registrations versus enterprise applications.
The trap. Assuming the admin background covers compliance. Purview questions describe a problem and ask which tool finds, labels, blocks, keeps or investigates it, and mixing up the tools is the usual way to lose marks.
Suggested order. Data protection first, then Copilot and agents, then a skim of core features and security.
Planning assumption. Four weeks at five to six hours is 20 to 24 hours. This profile might shorten week one to a few evenings, so a reasonable planning assumption is 10 to 12 hours on data protection, slightly above its weight.
The candidate coming from MS-900
Starting point. This candidate studied or held Microsoft 365 Fundamentals (MS-900, retired on March 31, 2026) and knows the apps, cloud concepts and licensing at a describe level.
Where the time goes. Cloud concepts are no longer tested as a topic, and the exam moves from describing to identifying, monitoring and performing. Per the study plan, week one shrinks to a few evenings, and the saved time goes into Purview and the Copilot administration tasks, such as assigning licences, pay-as-you-go billing policies, usage and adoption reports, prompts, and agent approval and lifecycle.
The trap. Studying at the old depth. The MS-900 comparison shows that compliance and security deepened, so recognising a product name is not enough; you must pick the right object or tool for a task.
Suggested order. Data protection, Copilot and agents, then core features with the October 14, 2026 identity items.
Planning assumption. About 16 to 20 hours, built from four weeks with a shortened first week. By weights, roughly 7 to 10 hours of that go to data protection.
The newcomer who has never administered a tenant
Starting point. This candidate works in support, finance or operations and knows Microsoft 365 as a user, but has not opened an admin center.
Where the time goes. First into core objects, because everything else depends on them: users, groups, licences, mailboxes, sites and policies. Without that, Purview and oversharing questions will not make sense. Then data protection, then Copilot and agents.
The trap. Two traps. One is spending most of the time on Copilot because of the name. The other is practising in a trial tenant that lacks the licences for Copilot, Insider Risk Management and SharePoint Advanced Management, so some features have to be learned from documentation and walkthroughs.
Suggested order. Core features and identity, data protection, Copilot and agents, then review.
Planning assumption. The study plan says six weeks at five to six hours, about 30 to 36 hours, with the extra time in the first two weeks.
AB-900 profiles side by side
| Profile | Front-loaded domains | Main risk |
|---|---|---|
| Teams or Exchange admin | Data protection and governance | Assuming day-to-day admin covers compliance tools |
| MS-900 background | Data protection, Copilot administration | Studying at describe depth |
| Newcomer to administration | Core features, then data protection | Time spent on Copilot, and no licensed lab |
How to check which AB-900 profile fits before booking
Read the exam format for the three weights and the October 14, 2026 update. Take Microsoft’s free practice assessment and the free sample questions cold, then sort the misses by domain. Misses in Purview suggest the first plan, misses in admin centers or sign-in tools the third. Follow the four-week study plan, use the practice test as the readiness check, and use the MS-900 comparison if your background is the second profile. If you also want the practitioner exam on Copilot use, see AB-730.
These hour counts are planning assumptions, not guidance from Microsoft, and they do not guarantee a pass.