AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals

Exam Overview

AB-900 (Microsoft 365 Copilot and Agent Administration Fundamentals) validates that you can plan, deploy, and govern Microsoft 365 Copilot and AI agents inside a real organization. It is aimed at administrators, IT generalists, and operations staff who work daily with the Microsoft 365 admin center, SharePoint, Teams, and Copilot Studio, and who are expected to roll AI out safely rather than just turn it on.

Exam Domains

• Planning and preparing the tenant for Copilot: licensing, prerequisites, and data readiness
• Deploying and configuring Copilot experiences across Microsoft 365 apps
• Creating, publishing, and managing agents with Agent Builder, SharePoint agents, and Copilot Studio
• Security, compliance, and governance: permissions, sensitivity labels, DLP, and auditing
• Monitoring usage, adoption, health, and feedback for Copilot and agents

Key Concepts & Common Difficulties

• Oversharing and permission hygiene: Copilot only surfaces content a user can already reach, so apparent "data leaks" are almost always pre-existing SharePoint or OneDrive sharing problems. Learn to run sharing reports and site access reviews before rollout, not after.
• Licensing and readiness: candidates confuse base Microsoft 365 licenses, Copilot add-on licenses, and metered agent consumption. Map each capability to the license that enables it and verify tenant prerequisites before designing a deployment.
• Agent types and build surfaces: Agent Builder, SharePoint agents, and Copilot Studio overlap heavily. Know which tool fits which scenario, how an agent is published into Teams or SharePoint, and who owns it after publishing.
• Governance controls: restricted agent creation, approval workflows, and environment policies are often missed because they live in the admin center and the Copilot Control System rather than in the authoring app itself.
• Reading adoption data: usage reporting is frequently skimmed. Understand which report answers which question, what an active-usage metric does and does not prove, and what follow-up action to recommend.

Study Strategy

• Confirm prerequisites first: comfortable navigation of the Microsoft 365 admin center, basic Entra ID users, groups and roles, and the SharePoint permission model.
• Study in dependency order: licensing and readiness, then Copilot deployment and app experiences, then agents, then security and compliance, then monitoring and adoption.
• Reinforce everything in a hands-on trial tenant: assign licenses, tighten a SharePoint site's permissions, build and publish a simple agent, and review the available reports.
• Use Microsoft Learn modules and the official exam outline as your spine, and take notes per domain rather than per product.
• Practice scenario questions by asking "which option protects data and follows least privilege?" before selecting an answer.
• On exam day, read each scenario for the role and the constraint, eliminate any option that bypasses governance, and flag long multi-step items to revisit.