AB-900 - Understand data protection and governance tasks for Microsoft 365 and Copilot (38% of the exam) - Section 2.4
Identify and monitor oversharing in SharePoint in Microsoft 365.
The tools that diagnose oversharing, running a data access governance report in SharePoint, and SharePoint Advanced Management including restricted access control. Revised in the 22 July 2026 outline update. Oversharing is the single biggest practical risk Copilot exposes, so this objective carries more weight in practice than its size suggests.
lock_openFree sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilotmedium
A governance lead is comparing SharePoint Advanced Management with the standard SharePoint admin center. Which statement best describes what SharePoint Advanced Management adds for controlling oversharing ahead of a Microsoft 365 Copilot deployment?
AIt provides advanced governance controls such as restricted access control, data access governance insights, and site access reviews for managing sharing at scale.check_circle Correct
BIt replaces sensitivity labels with its own classification engine that Copilot reads instead of Microsoft Purview labels.
CIt grants Copilot a dedicated permission model so it can index sites the signed-in user cannot open.
DIt automatically encrypts every document in the tenant at rest so that broad sharing no longer exposes content.
SharePoint Advanced Management adds governance controls like restricted access control, richer reporting, and site access reviews. SharePoint Advanced Management is a paid add-on that extends the standard admin center with policies and insights, including restricted access control and site access reviews, letting administrators manage sharing at scale rather than site by site.
Why A is correct: SharePoint Advanced Management is an add-on that layers governance controls including restricted access control policies, richer data access governance reporting, and site access reviews, which is exactly what large tenants use to curb oversharing before Copilot.
Why B is wrong: This is tempting because both touch data protection, but SharePoint Advanced Management does not classify content or replace Microsoft Purview sensitivity labels, so the statement is wrong.
Why C is wrong: This plays on the misconception that a governance add-on changes Copilot access, but Copilot always inherits the user's existing permissions and has no separate access model, so nothing can grant it wider reach.
Why D is wrong: Tenant-wide encryption sounds protective, but SharePoint Advanced Management does not blanket-encrypt content, and encryption would not stop an over-permissioned user from reading a file, so it does not address oversharing.
Exam traps in Understand data protection and governance tasks for Microsoft 365 and Copilot
Answers that look right on this material and are not. Each one is a distractor from a different question in the AB-900 bank for this domain.
Activity Explorer in the Microsoft Purview portal
errorWhy it is wrong: Tempting because it reports on data activity, but Activity Explorer shows label and DLP events over time rather than a per-site inventory of how each SharePoint site is shared.
A sensitivity label configured for encryption on the site
errorWhy it is wrong: Tempting because sensitivity labels protect content, but a site sensitivity label sets privacy and sharing defaults rather than restricting site access to one security group.
A Microsoft 365 Copilot exclusion setting, which stops Copilot from indexing the site while leaving the existing sharing links in place.
errorWhy it is wrong: This is the classic wrong fix: blocking Copilot leaves the underlying oversharing untouched, so users still reach the file directly, and Copilot has no per-site exclusion toggle because it only inherits existing permissions.