AB-900 Cheat Sheet: Key Facts to Review

The short version

Use this sheet after you have studied, not instead of studying. It lists the exam facts, then for each of the three domains the ideas, look-alike pairs, and decision rules that matter most. It does not cover everything on the exam, and Microsoft’s study guide, which lists skills measured as of October 14, 2026, is the final authority.

Exam facts at a glance

Item	Fact
Exam	AB-900, Microsoft 365 Copilot and Agent Administration Fundamentals
Level	Beginner
Time	45 minutes
Passing score	700 on a scale of 1 to 1,000
Wrong answers	No penalty for guessing, according to Microsoft
Delivery	Proctored, via Pearson VUE (Certiport for students and educators)
Domains	Core features and objects 30-35%; data protection and governance 35-40%; Copilot and agent administration 25-30%
Retakes	24 hours, then 14 days; five attempts in 12 months
Expiry	Fundamentals certifications do not expire

Domain 1: core features and objects (30-35%)

Pick the right admin center

Object	Where you manage it
Mailboxes, distribution groups	Exchange admin center
Sites, libraries, folders	SharePoint admin center
Teams, channels, policies	Teams admin center
Domain names, organization settings, licenses	Microsoft 365 admin center

Easily confused pairs

Authentication is for proving who you are. Authorization is for deciding what you may do.
Zero Trust is a set of principles (verify explicitly, least privilege access, assume breach), not a product you buy.
Conditional Access is for deciding access based on conditions such as user, device, or location. MFA is for adding a second proof of identity. Conditional Access can require MFA.
App registrations are for the definition of an app in your directory. Enterprise applications are for its instance that users sign in to.
Entra audit logs are for directory changes. Sign-in logs are for authentication events. Microsoft Purview Audit is for activity in Microsoft 365 services.
Privileged Identity Management is for controlling and limiting elevated roles, so people hold them only when needed.
Identity Secure Score is for measuring identity security posture and suggesting improvements.

Decision rules

If the scenario is about who can sign in and under what conditions, think Entra ID and Conditional Access.
If the scenario is about alerts across email, endpoints, identities, and apps, think Microsoft Defender XDR.
If a license affects whether a feature appears for a user, check the license assignment first.
If the question asks where to see sign-in failures, start with sign-in logs, not audit logs.

Domain 2: data protection and governance (35-40%)

Easily confused pairs

Sensitivity labels are for classifying and protecting content. DLP is for stopping sensitive data from leaving or being shared. Retention is for keeping or deleting content over time.
Insider Risk Management is for spotting risky user behavior patterns. Communication Compliance is for finding policy violations in messages.
Compliance Manager is for assessing compliance posture and recommended actions. Data Explorer and activity explorer are for looking at data and user activity.
Content search in eDiscovery is for finding files and emails. DSPM for AI is for discovering and managing AI activity.
Information Protection and Data Lifecycle Management are the Purview areas behind labels and retention.

How Copilot and data fit together

Copilot works within what the signed-in user can already access.
Microsoft Graph is how Copilot reaches work data, and it influences responses.
A Copilot license does not grant new access.
If Copilot surfaces a file a person should not see, the cause is usually permissions, not Copilot.

Decision rules

If the need is “mark and protect this content”, think sensitivity label.
If the need is “block sharing of this pattern”, think DLP.
If the need is “keep this for a period” or “delete it after a period”, think retention.
If the scenario is oversharing in SharePoint, think the data access governance report and SharePoint Advanced Management, including restricted access control.
If you must pick between two plausible tools, find the one word in the question that decides: protect, prevent, retain, investigate, or report.

Domain 3: Copilot and agents (25-30%)

Monthly license versus pay-as-you-go: know the difference between a per-user license and usage-based billing, and that a pay-as-you-go billing policy must be set up and connected to work.
Researcher, Analyst, custom agents: know one use case for each.
Prompts: know that they can be saved, shared, scheduled, and deleted.
Usage and adoption: Copilot Analytics and the Microsoft 365 admin center show them.
Agents: user access, creation, an approval process, and monitoring in the Microsoft 365 admin center and the Power Platform admin center.

Decision rules

If the question is about who may use an agent, think access settings and approval.
If the question is about cost control for usage-based features, think billing policies.
If the question is about whether people actually use Copilot, think usage and adoption reports.

Common traps

Choosing a Copilot setting when the real problem is permissions.
Mixing up the three log types.
Treating labels, DLP, and retention as interchangeable.
Forgetting that a billing policy that exists may not be connected.
Spending time on one question and rushing the last ten.

Last-day checklist

Re-read the skills measured, and tick each bullet you can explain aloud.
Redo only the questions you got wrong in practice.
Check your ID, appointment time, and test environment rules in your Pearson VUE confirmation. The exam day guide has a general checklist.
Sleep. A tired mind mixes up look-alike tools.

More guides for AB-900

Next step

For the reasoning behind these points, read the domains explained page and check the exam format. To test yourself, use the AB-900 practice tests. Back to the overview.

Frequently asked questions

Is this everything on the exam?

No. The study guide can include related topics beyond its bullets.

Can I use notes in the exam?

Microsoft says no Learn access is allowed on fundamentals exams; check your appointment rules.

Try the AB-900 practice exams