Microsoft 365 Certified: Copilot and Agent Administration Fundamentals (AB-900)
AB-900 AI and Data Foundations
For AB-900, AI foundations are practical Microsoft 365 foundations. Learn how Copilot and agents use organizational data, permissions, governance controls, and responsible AI principles before choosing an administrative action.
What This AB-900 Module Covers
The AB-900 study guide gives its greatest weighting to data protection and governance for Microsoft 365 and Copilot. It includes Microsoft Purview capabilities, classification, sensitivity labels, retention, the data-security implications of Copilot, Microsoft Graph, responsible AI, risk investigation, and SharePoint oversharing. This is an administration and decision-making scope, not a requirement to train an AI model.
The Four Questions Behind a Safe Answer
| Question | Why it matters in AB-900 | Examples to recognize |
|---|---|---|
| What data is relevant? | Copilot responses depend on organizational information and the context available to the user. | Files, emails, sites, libraries, and collaboration content. |
| Who is allowed to access it? | The study guide explicitly connects Copilot protection to permissions and controls in Microsoft 365, Purview, and Defender. | Users, groups, roles, authentication, Conditional Access, and site permissions. |
| How should it be protected and governed? | AB-900 assesses the use of Purview capabilities for information protection, DLP, classification, retention, and risk investigation. | Sensitivity labels, DLP, retention, activity review, Compliance Manager, and eDiscovery content search. |
| What could go wrong? | Oversharing, sensitive-data exposure, policy violations, and unsafe use are governance questions, not merely product questions. | Data access governance reports, SharePoint Advanced Management, Insider Risk Management, Communication Compliance, and DSPM for AI. |
Core Concepts in Plain Language
- Microsoft Graph: AB-900 expects you to understand that it influences Copilot responses. In a scenario, connect this to organizational data and the user's authorized access rather than treating Copilot as an isolated data store.
- Classification and sensitivity labels: classify and protect information according to the organization’s needs. On the exam, look for the data type, intended handling, and policy requirement.
- Retention: identify when information needs lifecycle treatment. Do not confuse keeping data for a defined period with giving every user broader access.
- DLP and risk signals: recognize when the requirement is to prevent or investigate inappropriate handling of sensitive information, rather than simply to create more content with AI.
- Responsible AI: apply the stated principle to the risk. AB-900 tests responsible AI in the context of Microsoft 365 and Copilot, so link the principle to appropriate governance, monitoring, or human action.
Read
Read the data-protection domain in the AB-900 study guide, then the official Microsoft Learn module Protect and govern Microsoft 365 data. As you read, make a two-sided note for every control: the risk it addresses and the evidence an administrator could review.
Scope
Classify each scenario as one primary concern: access, protection, governance, monitoring, investigation, or oversharing. Only after choosing the concern should you select a service. This ordering prevents a common AB-900 error, choosing a familiar tool before reading the actual requirement.
Drill
- A user can see information they should not see in a collaborative site. Identify the problem as access or oversharing, then compare the available SharePoint governance and reporting capabilities.
- A compliance team needs to locate content and review activity associated with a policy issue. Identify the monitoring or investigation requirement before naming the Purview capability.
- A team wants to enable Copilot. Explain how permissions, Microsoft Graph, and existing Microsoft 365 controls affect the safe answer.
Prove
You are ready to move on when you can read a data-risk prompt and state: what information is involved, who should be able to use it, which control category fits, and what signal confirms the control is working. In AB-900, a correct answer should meet the stated data and governance boundary, not merely sound like an AI feature.
Official AB-900 Learning Sources
- Microsoft Learn: Study guide for Exam AB-900 - Official July 22, 2026 objectives for Purview, Copilot data security, Microsoft Graph, responsible AI, risk investigation, and oversharing.
- Microsoft Learn: Protect and govern Microsoft 365 data - Self-paced module on Purview, classification, DLP, lifecycle management, oversharing, and Copilot data protection.
- Microsoft Learn: Explore Microsoft 365 administration - Official learning path containing the data-protection module.