Free AB-900 Exam Flashcards

A Microsoft Entra role scoped to manage Microsoft 365 Copilot settings, usage policies, and configurations without full Global Administrator privileges. Follows least-privilege: use this role instead of Global Admin for day-to-day Copilot administration.

Per-user add-on licenses are assigned in the Microsoft 365 admin center under Active users > Licenses and apps. Only licensed users can access Copilot features in Word, Excel, PowerPoint, Outlook, Teams, and other integrated apps.

An admin-center report showing aggregated Copilot adoption: active users, feature-level usage (chat, email, meetings, documents), and trends across the licensed population. Used to measure ROI and identify departments needing training.

Gives organizational leaders visibility into Copilot adoption metrics, feature usage trends, and aggregated employee sentiment about Copilot helpfulness. Adoption analytics tool — not a DLP or forensic audit source.

An org-wide Copilot admin setting that controls whether Copilot can query Bing and public web content to supplement internal data. Regulated industries often disable it to keep responses strictly within governed organizational data.

Microsoft 365 Copilot is the built-in productivity assistant across M365 apps using the semantic index. Custom agents are organization-built AI assistants created in Copilot Studio with specific topics, knowledge sources, and actions — they require separate governance and approval.

An alternative to per-user monthly Copilot licenses where consumption is metered and billed based on actual usage. Admins manage billing policies in the Microsoft 365 admin center to control cost exposure for variable or pilot deployments.

Copilot retrieves organizational content through Microsoft Graph permissions — only data the signed-in user can already access. Copilot does not bypass SharePoint, OneDrive, or Exchange permissions; oversharing in source locations directly increases Copilot exposure risk.

Microsoft 365's pre-built index of organizational content that enables Copilot to ground responses in tenant data. Indexing respects existing permissions; admins cannot use the index to expose data users were not already authorized to see.

Microsoft's framework: fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. AB-900 admins apply these when governing Copilot deployment, prompt policies, and agent approval workflows.

A low-code platform for building, customizing, and deploying AI agents and copilots. Enables custom topics, knowledge sources, Power Automate actions, and multi-channel deployment (Teams, web, SharePoint) without deep coding expertise.

A modular conversation flow triggered by specific user intents. Contains trigger phrases that activate it and a sequence of nodes (messages, questions, actions) guiding the agent's response. Building blocks of custom agent logic.

Organizations can require admin approval before custom agents are published or made available to users. Prevents ungoverned agents from accessing organizational data or performing actions without security review.

End-to-end governance of custom agents: creation in Copilot Studio, security review, approval, deployment to channels, usage monitoring, and retirement. Monitored through Microsoft 365 admin center and Power Platform admin center.

Administrative hub for managing Copilot Studio agents, Dataverse environments, DLP policies for connectors, and tenant-level Power Platform settings. Critical for agent governance alongside the M365 admin center.

A deployment option that publishes a custom agent as a Teams app, making it available directly within Microsoft Teams channels and chats. Requires appropriate Teams app permission policies.

Data connections that ground agent responses: public websites, SharePoint sites, uploaded files, or Dataverse tables. Admins must verify sensitivity of connected sources because agents inherit access patterns of configured knowledge.

Security model based on 'never trust, always verify.' Core pillars: verify explicitly, use least-privilege access, and assume breach. Applied through Entra ID, Conditional Access, MFA, and continuous monitoring across M365 workloads.

Microsoft's cloud identity and access management service (formerly Azure AD). Manages users, groups, app registrations, Conditional Access policies, MFA, SSO, and admin roles across Microsoft 365 and Azure.

Entra ID policies that enforce access controls based on signals: user, location, device compliance, application, and risk level. Example: require MFA for all admin portal sign-ins or block legacy authentication protocols.

Entra ID service providing just-in-time, time-bound activation of privileged roles (Global Admin, Exchange Admin). Reduces standing admin access — admins must activate roles with justification and optional approval.

Authentication method allowing users to access multiple applications with one set of credentials. In M365, Entra ID federates with on-premises Active Directory or enables passwordless sign-in across cloud apps.

A percentage score in the Microsoft Entra admin center measuring your tenant's identity security posture against Microsoft best practices. Recommendations include enabling MFA, blocking legacy auth, and reducing global admin count.

Portal for managing SharePoint sites, site collections, sharing policies, storage quotas, and permissions. Critical for Copilot governance because overshared SharePoint content is a primary source of unintended AI data exposure.

Manages Teams policies: meeting settings, messaging policies, app permission policies, and guest access. Copilot in Teams meetings and chat inherits Teams data governance and retention settings configured here.

Manages mailboxes, distribution groups, mail flow rules, and mailbox permissions. Copilot in Outlook accesses email content the user can already read — mailbox delegation and shared mailbox permissions affect Copilot exposure.

Unified compliance and data governance platform spanning information protection, data loss prevention, insider risk, eDiscovery, audit, and DSPM for AI. The primary governance toolkit for AB-900's largest exam domain.

Classification tags applied to emails, documents, and Teams messages indicating confidentiality level (e.g., Public, Internal, Confidential). Can enforce encryption, watermarking, and access restrictions. Copilot respects label policies when generating content.

Purview policies that detect and block sharing of sensitive information (SSN, credit cards, health data) across Exchange, SharePoint, OneDrive, Teams, and Copilot interactions. Prevents accidental or intentional data exfiltration.

Purview solution detecting risky insider behaviors: data exfiltration, security policy violations, and intellectual property theft. Uses signals from M365 activity to identify users who may pose data security threats, including risky Copilot usage patterns.

Purview feature monitoring communications (email, Teams, Copilot interactions) for policy violations: harassment, threats, regulatory compliance issues. Uses ML classifiers and keyword policies to flag content for reviewer investigation.

Data Security Posture Management for AI in Microsoft Purview. Discovers AI activity across the organization, identifies sensitive data accessed by Copilot, and helps maintain security posture as AI adoption scales. Key AB-900 governance concept.

Purview policies defining how long content is kept before deletion or archival. Apply to Exchange, SharePoint, OneDrive, Teams, and Copilot-generated content. Balance compliance retention requirements against data minimization for AI exposure.

Process of identifying and labeling data by sensitivity and business impact. In Purview, auto-classification scanners detect sensitive info types in content. Foundation for applying DLP, retention, and sensitivity label policies.

When SharePoint sites or files have overly permissive sharing links ('Anyone' links) or excessive guest access. A major Copilot risk because Copilot can surface overshared content to users who should not see it. Managed via access governance reports and Advanced Management.

SharePoint reports showing who has access to sites and files, highlighting overshared content and inactive sharing links. Admins use these to remediate permissions before or after Copilot deployment.

Logs user and admin activity across M365 services including Copilot interactions. Enables forensic investigation of who accessed what data through AI tools. Audit log retention depends on licensing (standard vs premium).

Legal hold and content search across M365 for litigation and investigations. Can include Copilot-generated content and prompts in search scopes when organizations need to preserve or review AI-related communications.

Suite of capabilities for classifying and protecting sensitive data: sensitivity labels, label policies, encryption, rights management, and auto-labeling. Ensures Copilot operates within defined data protection boundaries.

Organizational policies controlling how employees use Copilot prompts: approved use cases, prohibited data types in prompts, and monitoring through Purview. Prevents users from pasting credentials, PII, or trade secrets into Copilot chat.

Requires two or more verification methods to sign in (password + phone app, FIDO key). Foundational Zero Trust control enforced via Entra Conditional Access. Should be required for all users, especially admins accessing Copilot governance tools.

Microsoft 365 admin center view showing current service status, active incidents, and planned maintenance for Exchange, SharePoint, Teams, and Copilot services. Not a usage analytics tool — monitors availability, not adoption.

Admin notification feed for planned M365 feature changes, deprecations, and updates. Copilot admins should monitor it for new Copilot capabilities, policy changes, and governance feature releases affecting their tenant.

Geographic location where Microsoft stores tenant data at rest. Copilot processing occurs within the tenant's data boundary; admins in regulated industries verify residency meets jurisdictional requirements before enabling AI features.

M365 feature requiring admin approval before Microsoft support engineers can access tenant content during a support request. Provides an additional data access control layer relevant to organizations deploying Copilot on sensitive data.

E5 includes advanced Purview capabilities (Insider Risk Management, Communication Compliance, advanced audit) needed for comprehensive Copilot governance. E3 provides basic DLP and sensitivity labels but lacks several AI governance tools tested on AB-900.

Copilot requires a qualifying base license (Microsoft 365 E3/E5, Business Standard/Premium, or Office 365 E3/E5) plus the Copilot add-on. Admins verify both licenses are assigned before users can access Copilot features.

Microsoft 365 admin center metric measuring overall productivity adoption across all workloads — not Copilot-specific. Distinct from the Copilot Usage Report, which tracks only Copilot feature adoption and active users.

Section managing third-party and custom app integrations with M365, including Copilot plugins and connectors. Admins control which external data sources and actions Copilot and agents can access through approved integrations.

Free online assessment on Microsoft Learn required yearly to maintain the Copilot and Agent Administration Fundamentals certification. Unlike older Dynamics fundamentals certs, AB-900 expires annually to keep knowledge current with rapidly evolving AI features.