AB-900 Domains Explained With Examples

The short version

AB-900 has three domains: core Microsoft 365 features and objects (30-35%), data protection and governance (35-40%), and administering Copilot and agents (25-30%). The weightings come from Microsoft’s skills measured as of October 14, 2026. The examples and traps below are our own explanation, not vendor statements.

Domain 1: Identify the core features and objects of Microsoft 365 services (30-35%)

Core objects

Microsoft asks you to explain how license types affect access, explore organization settings in the Microsoft 365 admin center, and pick the right object in each admin center: mailboxes and distribution groups in Exchange, sites, libraries, and folders in SharePoint, and teams, channels, and policies in Teams. You also need the roles and permissions for SharePoint sites.

Typical traps: mixing up group types (a Microsoft 365 group, a security group, and a distribution group do different jobs) and picking the wrong admin center. Practice: for ten common tasks, say which admin center and which object you would open.

Security principles

Here you meet Zero Trust, authorization versus authentication, authentication methods, threat protection and intelligence, and Microsoft Defender XDR. Typical traps: confusing authentication (who are you) with authorization (what may you do), and treating Zero Trust as a product instead of a set of principles such as verify explicitly and least privilege access. Practice: match each Defender XDR component to the thing it watches.

Core security features

This covers Microsoft Entra ID, Conditional Access, single sign-on, users and groups as security objects, troubleshooting sign-ins (multifactor authentication, Conditional Access, risky sign-ins), Identity Secure Score, audit logs, Privileged Identity Management, and app registrations versus enterprise applications. Typical traps: Entra audit logs record directory changes, sign-in logs record authentication, and Microsoft Purview Audit records activity in services such as SharePoint. Practice: for each log or report, write one sentence about what it tells you.

Domain 2: Data protection and governance for Microsoft 365 and Copilot (35-40%)

Microsoft Purview

Microsoft lists Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, DSPM for AI, and Data Lifecycle Management, plus sensitivity label use cases, data classification, and retention. Typical traps: labels classify and protect, DLP prevents data leaving, retention keeps or deletes by time; the exam likes scenarios where two of these sound right. Practice: build a table of “need” versus “tool”.

Data security implications of Copilot

You should understand how Copilot accesses data, how Microsoft Graph influences its answers, how permissions and controls in Microsoft 365, Purview, and Defender protect against risk, and the responsible AI principles. The key idea is that Copilot works within what the signed-in user can already access. Typical traps: believing that a Copilot license grants new access, or that removing the license fixes an oversharing problem. Practice: explain in your own words why a badly shared file is a Copilot risk.

Data protection and governance risks

This sub-area is about tools for finding problems: Compliance Manager, Data Explorer, Insider Risk Management, DLP alerts, Communication Compliance policy violations, activity explorer, DSPM for AI, and Content search in eDiscovery. Typical traps: several tools look at similar data from different angles (a snapshot of content versus a history of user actions). Practice: for each tool, finish the sentence “I open this when I need to see…”.

Oversharing in SharePoint

Expect tools to troubleshoot oversharing, the data access governance report, and SharePoint Advanced Management, including restricted access control. Typical traps: fixing the symptom (Copilot) instead of the cause (permissions). Practice: walk through finding, reporting, and reducing broad sharing on one site.

Domain 3: Perform basic administrative tasks for Copilot and agents (25-30%)

Copilot and agent capabilities

Compare built-in capabilities of Copilot and agents, compare the monthly license model with pay-as-you-go (including SharePoint), identify which features can be switched on or off, and know the use cases for Researcher, Analyst, and custom agents. Typical traps: blurring a prebuilt agent with a Copilot feature such as a saved prompt. Practice: one-line use cases for each agent.

Copilot administration

Assign licenses, monitor and manage pay-as-you-go billing policies, monitor usage and adoption (Copilot Analytics and the Microsoft 365 admin center), and manage prompts: saving, sharing, scheduling, deleting. Typical traps: a billing policy that exists is not the same as one that is connected. Practice: locate each setting in the admin center.

Agent administration

Configure user access to agents, create an agent, understand the approval process, and monitor usage, operational insights, and lifecycle in the Microsoft 365 and Power Platform admin centers. Typical traps: forgetting who must approve and where the monitoring lives. Practice: trace an agent from creation to approval to monitoring.

How to spend your time

Split your hours roughly in line with the weightings: a bit more than a third on domain 2, a bit less than a third each on domains 1 and 3. Domain 2 carries the highest weighting and has the most look-alike tools. Our AB-900 practice tests report your score per study guide section, which helps you adjust.