Examworthyexamworthy.comMicrosoft 365 Certified: Copilot and Agent Administration Fundamentals cheat sheet
Microsoft
Free to share. Examworthy is not affiliated with or endorsed by Microsoft; AB-900 and related marks belong to their respective owners.
At a glance
Format: Multiple choice and multiple response, at a Pearson VUE testing center or online proctored
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
AB-900 is a recognition exam built on one governing idea: Copilot only surfaces what a user could already access, so control the data and the permissions and you control Copilot.
Spot the trap
Tempting wrong answers, and why they failTempting but wrong
Copilot has a dedicated service identity with tenant-wide read access so it can reason over every document in the organisation.
Why it fails
Tempting because Copilot can seem to know everything, but it holds no elevated tenant-wide identity. It always operates within the requesting user's permissions.
Understand data protection and governance tasks for Microsoft 365 and Copilot
Tempting but wrong
Shared mailboxes and mail flow rules are configured in the Microsoft 365 admin center.
Why it fails
Tempting because that centre handles tenant-wide users, licences, and billing and links out to specialist centres. But shared mailboxes and mail flow rules are configured in the dedicated Exchange admin center.
Identify the core features and objects of Microsoft 365 services
Tempting but wrong
The Microsoft 365 Copilot per-user monthly licence is the best fit for employees who only occasionally use an agent.
Why it fails
The per-user licence is the headline Copilot offer, so it is tempting, but it charges a flat fee per assigned user regardless of usage. That is the opposite of paying only for occasional consumption.
Perform basic administrative tasks for Copilot and agents
Tempting but wrong
Copilot can read any file whose sensitivity label is lower than the user's clearance level, regardless of sharing permissions.
Why it fails
Sensitivity labels influence protection and usage rights, but access is decided by the user's file permissions, not by a clearance comparison, so this is wrong.
Understand data protection and governance tasks for Microsoft 365 and Copilot
Tempting but wrong
Email retention means you set up shared mailboxes and transport rules in the Microsoft Purview portal.
Why it fails
Tempting because Purview governs compliance, retention labels, and data protection, which sounds related to email retention. But it does not create mailboxes or set transport rules.
Identify the core features and objects of Microsoft 365 services
Tempting but wrong
A Microsoft Entra ID P2 subscription includes and meters Copilot agent usage as part of its identity governance features.
Why it fails
Entra ID P2 covers identity protection and governance such as Privileged Identity Management. It does not include or meter Copilot agent consumption, so it cannot fulfil the billing requirement.
Perform basic administrative tasks for Copilot and agents
Tempting but wrong
The semantic index is a separate copy of all tenant files moved into the Copilot service so responses are generated without touching Microsoft 365 data.
Why it fails
Tempting as an efficiency story, but the semantic index does not export a parallel data store outside the tenant boundary. Grounding data stays within Microsoft 365.
Understand data protection and governance tasks for Microsoft 365 and Copilot
Tempting but wrong
Conditional access policies can assign product licences to a group's members.
Why it fails
Tempting because conditional access also targets groups. But it governs the conditions under which users may sign in; it does not assign product licences.
Identify the core features and objects of Microsoft 365 services
Key terms
Exam-day rules
- Read the need first, then the options. AB-900 questions are short and usually name the exact job, so identify what is required before you weigh any admin centre or capability.
- Beat the close-pair traps on scope and stage. When two tools overlap, ask which object each governs and whether the requirement is to prevent or to detect; a detective tool is wrong when the task was to prevent.
- Treat every Copilot exposure question as an oversharing question. Copilot only surfaces what the user could already access, so the fix is a SharePoint permissions or restricted access control change, not a Copilot setting.
- Use current product names. Azure AD is Microsoft Entra ID, Azure Information Protection is Microsoft Purview Information Protection, and the Compliance Center is the Microsoft Purview portal; a retired name signals a wrong option.
- Know which admin centre owns the task, especially for agents. Agent administration is split between the Microsoft 365 admin center and the Power Platform admin center, and many items turn on that split.
Revision schedule
- Day 1Map the current outline and book a date
- Week 1Learn the admin-centre map and identity basics
- Week 2Master the Copilot permissions model
- Weeks 2 to 3Separate the Purview capabilities by job
- Week 3Cover Copilot and agent administration