AB-900 Study Guide: Microsoft 365 Copilot and Agent Administration Fundamentals

AB-900 is the exam for Microsoft 365 Certified: Copilot and Agent Administration Fundamentals, Microsoft’s entry-level certification for admins who support, secure and protect an AI-enabled Microsoft 365 environment, including Microsoft 365 Copilot and agents. It costs $99 in the US, runs 45 minutes, needs a 700 to pass, and, like every Microsoft fundamentals certification, never expires.

Microsoft updates the English exam on October 14, 2026 and calls the change minor. This guide uses the October 14 outline: the three skill areas and their weights, what each one covers, a 2-week study plan, safe ways to get hands-on practice, and how AB-900 fits with Microsoft’s other Copilot and AI certifications.

AB-900 at a glance

Checked against Microsoft Learn’s Copilot and Agent Administration Fundamentals certification page and AB-900 study guide on October 6, 2026.

Outside the US, Microsoft’s exam pricing data lists AB-900 at £64 in the UK, €76 in Germany, ₹3,691 in India, ¥12,180 in Japan and US$84 in Australia and Canada, before tax. See what AI certifications really cost for the full picture.

What changes on October 14, 2026

Microsoft’s certification page says the English version of AB-900 will be updated on October 14, 2026, and the study guide now shows “Skills measured as of October 14, 2026.” The change log is short:

• The audience profile: no change.
• “Identify the core features and objects of Microsoft 365 services” (skill area 1): no change at the skill-area level.
• “Identify the core security features of Microsoft 365 services” (a group inside skill area 1): minor change.
• Skill areas 2 and 3 do not appear in the change log.

What that means for you: study the October 14 outline whichever date you test, because it is the only outline Microsoft now publishes and the change it describes is minor. If you take AB-900 in a language other than English, Microsoft says localized versions are updated about eight weeks after the English one, so your version may pick up the change later. If your language is not offered, you can request an extra 30 minutes.

One naming note: Microsoft’s Copilot data, privacy and security documentation now says Microsoft 365 Copilot is now named Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat, with the older names still appearing during the transition. The exam title and outline use the older names, so expect to see both while you study.

Who AB-900 is for

Microsoft’s audience profile describes someone who is familiar with Microsoft 365 core services, security, identity and access, data protection and governance, plus Microsoft 365 Copilot and agents. You should know your way around the admin centers for Exchange Online, SharePoint, Microsoft Teams, Microsoft Entra and Microsoft Purview, and be able to identify core objects such as users, groups, teams, sites and libraries. Microsoft’s February 2026 launch post called it an entry-level certification proving you can configure, secure and support AI-powered Microsoft 365 environments.

In practice, it fits:

• Help desk staff and junior Microsoft 365 admins who are being handed Copilot.
• Experienced admins who want a quick, structured pass over Purview, oversharing and agent administration before a rollout. Our Copilot readiness checklist covers the same ground from the project side.
• Security and compliance staff who are new to how Copilot uses data.

If you use Copilot but do not administer it, Microsoft’s AB-730 (AI Business Professional) is the better match. Our Microsoft AI certifications guide maps every option.

The three AB-900 skill areas and their weights

Microsoft notes that the bullets under each skill illustrate how it is assessed, that related topics may be covered, and that most questions cover generally available features (Preview features can appear if they are commonly used). Look at the verbs, too: most bullets start with identify, understand, explain or compare. You need to know what each tool is for and where it lives more than how to run a large deployment.

Skill area 1: Core features and objects of Microsoft 365 services (30–35%)

What the published outline lists:

• Core objects: how license types assigned to users and groups affect access to features; organization settings and domain names in the Microsoft 365 admin center; mailboxes and distribution groups in the Exchange admin center; sites, libraries, folders and site roles and permissions in the SharePoint admin center; and teams, channels and policies in the Teams admin center.
• Security principles: Zero Trust, authorization, authentication methods, threat protection and intelligence, and the features and capabilities of Microsoft Defender XDR.
• Core security features (the group with the October 14 minor change): Microsoft Entra ID, conditional access policies, single sign-on (SSO), choosing the right security object (users and groups), the tools for troubleshooting sign-in issues (MFA, conditional access and risky sign-ins), Identity Secure Score, reviewing audit logs for user and admin activity, Privileged Identity Management (PIM), and app registrations versus enterprise applications.

How to study it: build a one-page map with each admin center in a column and the objects it manages underneath. Then write one plain sentence for each security idea: what Zero Trust means, how authentication differs from authorization, what PIM is for, and how an app registration differs from an enterprise application. Finally, practice matching a sign-in problem (an MFA failure, a conditional access block, a risky sign-in) to the place you would look first. Our piece on identity as your AI control plane explains why this matters so much once Copilot is switched on.

Skill area 2: Data protection and governance for Microsoft 365 and Copilot (35–40%)

The heaviest skill area, and the one that most separates AB-900 from a general Microsoft 365 exam.

What the published outline lists:

• Microsoft Purview: the features and capabilities of Information Protection, Data Loss Prevention (DLP), Insider Risk Management, Communication Compliance, Data Security Posture Management (DSPM) for AI and Data Lifecycle Management; use cases for sensitivity labels; data classification; and retention.
• Data security implications of Copilot: how Copilot accesses data, how Microsoft Graph influences its responses, how Copilot uses permissions and other controls in Microsoft 365, Purview and Defender to protect against risks, and responsible AI principles.
• Finding risks: Compliance Manager for compliance risks, Data Explorer for sensitive information, Insider Risk Management, DLP alerts, Communication Compliance policy violations, activity explorer, DSPM for AI to discover and manage AI activity, and Content search in eDiscovery.
• Oversharing in SharePoint: the tools for troubleshooting oversharing, running a data access governance report, and SharePoint Advanced Management features, including restricted access control.

How to study it: start with one idea from Microsoft’s Copilot privacy documentation: Copilot only surfaces organizational data that the individual user already has at least view permission to, and it honors the usage rights on content encrypted with Purview Information Protection, for example through sensitivity labels. Copilot does not create new access, but it can make existing over-broad access much easier to stumble on. That is why oversharing, labels and DLP sit in the same skill area as Copilot.

Then make a table of the Purview tools in the outline with one row each: what it finds or prevents, and one example scenario. If you can say “a user pasted customer data into a prompt: which tool shows me that?” and answer it, you are ready. Our guides to fixing SharePoint oversharing before Copilot and sensitivity labels and DLP before AI walk through the same tools in a real rollout.

Skill area 3: Basic administrative tasks for Copilot and agents (25–30%)

What the published outline lists:

• Copilot and agent capabilities: comparing the built-in capabilities of Copilot and agents, comparing the monthly Copilot license model with pay-as-you-go (including SharePoint), knowing which Copilot features can be turned on or off, and use cases for Researcher, Analyst and custom agents.
• Copilot administration: assigning Copilot licenses, monitoring and managing pay-as-you-go billing policies, monitoring usage and adoption with Copilot Analytics and the Microsoft 365 admin center, and managing prompts (saving, sharing, scheduling and deleting).
• Agent administration: configuring user access to agents, creating an agent, the approval process for agents, and monitoring agents (usage, operational insights and lifecycle) in the Microsoft 365 admin center and the Power Platform admin center.

How to study it: the Explore Microsoft 365 Copilot and agent administration learning path has three modules that line up with these three groups almost one to one. Learn the licensing models as concepts (a monthly per-user license versus pay-as-you-go billing) rather than memorizing prices, which change. Microsoft’s privacy documentation also notes that admins choose which agents are allowed in the Integrated apps section of the Microsoft 365 admin center, and that users can only use agents their admin allows. Know where agent approval and monitoring happen, and which admin center you would open for each task. Our article on logging what your AI assistants do covers why usage monitoring matters after launch.

A 2-week AB-900 study plan

About an hour a day is enough for most people with some Microsoft 365 admin exposure. If the admin centers are new to you, stretch it to three weeks by doubling the time for skill areas 1 and 2.

Prefer a plan built around your own calendar? The free AI certification study plan generator makes one.

Hands-on practice without touching production

AB-900 leans on recognition more than deep configuration, but a few bullets are hands-on tasks (assigning Copilot licenses, creating an agent, running a data access governance report), and clicking through the real screens makes everything stick. Some safe ways to get that practice:

1. Use a test tenant if you have one. If your IT team keeps a non-production Microsoft 365 tenant, ask to use it. Ask before you change anything, and never experiment with conditional access, DLP or retention policies in production.
2. Do read-only tours. If you cannot change settings, ask whether you can get a read-only admin role so you can at least see where things live. Open each admin center in the outline and find the objects from skill area 1.
3. Walk the Copilot admin pages. Find where licenses are assigned, where usage and adoption reports live, and where agents are allowed, approved and monitored.
4. Tour Purview. Open DSPM for AI, activity explorer, Compliance Manager and the DLP alerts page and write down what each one shows you.
5. Quiz yourself with an AI assistant. Paste one skill area from the published outline into Copilot or another assistant and ask for original practice questions with explanations. Check every answer against Microsoft Learn, because AI-written questions can be wrong.

One trap to avoid: the free Microsoft 365 E5 developer sandbox is not an exam lab. Microsoft’s Developer Program FAQ says the subscription is for application development only and that using it for anything else violates the license agreement, and eligibility is limited to specific paths such as qualifying Visual Studio subscriptions.

Skip any site selling leaked AB-900 questions. Those are dumps, and they teach you answers instead of skills. HOW TO // AI does not have an AB-900 practice bank yet; for the AI certifications we do cover, our free practice exams are on AI Exam Prep →

Free official prep resources

• AB-900 study guide: the full October 14 outline, the change log, and links to Microsoft 365, Copilot, admin center and Purview documentation.
• Practice Assessment: free on the certification page. Microsoft describes it as an overview of the style, wording and difficulty of the questions; it is not a copy of the exam.
• Exam sandbox: a demo of the Microsoft exam interface and question types.
• Course AB-900T00-A: Introduction to Microsoft 365 and AI administration: a 1-day instructor-led course for beginning IT pros and novice admins. The self-paced version is two learning paths: Explore Microsoft 365 administration and Explore Microsoft 365 Copilot and agent administration, three modules each.
• Exam Readiness Zone: Microsoft’s exam-prep video series, linked from the study guide.

What exam day looks like

• 45 minutes, proctored, with possible interactive components. Plan for about 65 minutes in the seat, including instructions and the candidate agreement.
• No Microsoft Learn during the exam. Microsoft allows Learn access on associate and expert exams, not on fundamentals exams.
• Breaks: five minutes of break time are built in, the clock keeps running while you are away, and you cannot go back to questions you saw before the break.
• Use a personal Microsoft account to register. Microsoft warns that exam records tied to a work or school account are lost if you leave that organization.
• Retakes: 24 hours after a first fail, then 14 days between attempts, up to five attempts in 12 months, and you pay for each one (Microsoft’s retake policy).

Source for the timing, break and Learn-access rules: Microsoft’s exam duration and exam experience page.

How AB-900 fits with Microsoft’s other Copilot and AI certifications

AB-900 and MS-900. Microsoft retired Microsoft 365 Fundamentals (MS-900) on March 31, 2026. Its June 2026 credentials roundup lists no recommended new certification for MS-900, though Microsoft’s partner blog names Copilot and Agent Administration Fundamentals as a planned alternative for partners. So AB-900 is not a like-for-like replacement: it is built around Copilot, agents and the identity, security and data protection work behind them. Our guide to retired Microsoft AI certifications tracks what replaced what.

Where to go next. For admins, the natural step up is AB-650, the associate-level Microsoft 365 and AI Services Administrator certification. It was still labeled beta on Microsoft Learn on October 6, 2026, and Microsoft lists it as the recommended successor to MS-102. Note that AB-730 has a bigger English update coming on October 20, 2026, moving from three skill areas to four. If you want to understand the AI itself rather than administer it, AI-901 (Azure AI Fundamentals) is the companion fundamentals exam. For the developer side of Copilot, GitHub’s GH-300 exam covers GitHub Copilot.

More context: AI certifications for beginners, the best AI certifications for IT pros, which AI certification your IT team should get first, and the full AI certification index →

After you pass

There is no renewal to schedule. Microsoft’s renewal FAQ says renewal does not apply to fundamentals certifications because they do not expire. The product moves fast, though, and Microsoft keeps updating the outline, so plan to revisit the study guide when you take on a bigger Copilot project. Our guide to which AI certifications expire compares the rules across vendors.

HOW TO // AI is not affiliated with or endorsed by Microsoft. AB-900, Microsoft 365, Microsoft 365 Copilot, Microsoft Copilot, Microsoft Purview and Microsoft Entra are trademarks of Microsoft Corporation; we reference them descriptively. All content is original and based on Microsoft’s published study guide. Check the official certification page before you book.

Keep exploring: GitHub Copilot (GH-300) study guide

Related guides

• Microsoft AI Certifications in 2026: The New Path, Explained
• GitHub Copilot Certification (GH-300): Study Guide and 3-Week Plan
• Azure AI Fundamentals (AI-901) Study Guide & Cheat Sheet
• Generative AI Certifications in 2026: The Real Gen AI Exams Compared