The short version
Most beginners need roughly 20 to 40 hours in total, spread over four to eight weeks. That is a rough range, not a rule: people who already administer Microsoft 365 need less, and people new to the admin centers need more. Spend your time in proportion to the weightings, and give the data protection domain the most.
Before you start
- Open the Microsoft Learn AB-900 study guide and keep it beside you. It lists every skill the exam can test.
- Get hands-on if you can. A trial or demo tenant lets you click through the Microsoft 365 admin center, Microsoft Entra, and Microsoft Purview. If you cannot, watch walkthroughs and read the admin center documentation.
- Take one practice set cold, before studying. Your per-domain result tells you where to start. Do not worry about the score.
The 4-week plan (about 8 to 10 hours a week)
This plan suits you if you already know the basics of Microsoft 365 administration.
| Week | Focus | What to do |
|---|---|---|
| 1 | Core objects and security | Licenses, the Microsoft 365, Exchange, SharePoint, and Teams admin centers. Zero Trust, authentication methods, Conditional Access, single sign-on, PIM. |
| 2 | Purview and Copilot data access | Sensitivity labels, DLP, retention, classification, Insider Risk Management, Communication Compliance. How Copilot reaches data through Microsoft Graph and permissions. |
| 3 | Oversharing and administration | Data access governance reports, restricted access control, Compliance Manager, activity explorer, eDiscovery. Then licenses, pay-as-you-go, usage reports, prompts, and agents. |
| 4 | Practice and gaps | Take timed practice sets, review every miss, and reread the study guide bullets behind your weakest domain. |
The 8-week plan (about 4 to 5 hours a week)
This plan suits you if you are new to the admin centers or study around a job.
| Week | Focus |
|---|---|
| 1 | Microsoft 365 objects: users, groups, licenses, mailboxes, sites, teams, channels. Explore each admin center. |
| 2 | Identity and security principles: Zero Trust, authentication and authorization, Microsoft Entra ID, Conditional Access, single sign-on, Identity Secure Score. |
| 3 | Threat protection and monitoring: Microsoft Defender XDR, PIM, app registrations, sign-in troubleshooting, audit logs. Take your first domain quiz. |
| 4 | Microsoft Purview part 1: sensitivity labels, classification, retention, data loss prevention. |
| 5 | Microsoft Purview part 2: Insider Risk, Communication Compliance, DSPM for AI, Compliance Manager, eDiscovery. Copilot data security and responsible AI principles. |
| 6 | SharePoint oversharing and Copilot administration: governance reports, restricted access control, features you can switch on or off, Researcher, Analyst, license and billing models. |
| 7 | Agents and prompts: user access, creating agents, the approval process, monitoring. Full practice set, then review. |
| 8 | Second pass over weak areas, a final timed set, and rest. |
How to use practice exams
Use them as a mirror, not as the main lesson. Take the first set cold, study for a week or two, then retake a different set and compare the per-domain results. Read the explanation for every question, including the ones you got right, because a lucky guess looks like knowledge in the score. When you miss a question, name the exact rule you were missing and look it up in the documentation. Our AB-900 practice tests progress from single-concept questions to timed sets. For habits that work across exams, see how to study for IT certification exams.
The last 3 days
- Three days out: one full timed set. Sort your misses into “did not know” and “misread”. Fix the first group with the documentation.
- Two days out: review short notes only: look-alike features, admin roles, and the purpose of each Purview tool. No new topics.
- The day before: a light skim, check your booking, ID, and test setup, and sleep. The exam day guide has a checklist.
- Exam day: read each question for the requirement that decides the answer, answer every question, and manage your 45 minutes.
More guides for AB-900
- AB-900 Exam Format, Scoring and Retakes
- Is the AB-900 Exam Hard? An Honest Look
- AB-900 Prerequisites: What to Know First
- AB-900 Renewal and Retakes Explained
- Is AB-900 Worth It? An Honest Look
- AB-900 Cheat Sheet: Key Facts to Review
- AB-900 vs AI-901: Which Exam First?
Next step
See what the exam really asks in domains explained, then try the sample questions.
Frequently asked questions
Can I pass AB-900 with a 2-week plan?
It is possible if you already administer Microsoft 365 daily, but a rushed plan leaves less room for the Purview and Copilot details. Judge by your practice results, not the calendar.
Which domain should I study first?
Start with the core Microsoft 365 objects and security, because the other two domains build on them.
Do I need a paid tenant?
No. Documentation and walkthroughs cover most of the exam. A trial tenant helps if one is available to you.