3.6 Admin Exam Scenarios and Review
Key Takeaways
- AB-900 Domain 3 (25-30%) tests licensing models, adoption reporting, prompt governance, agent lifecycle, and permission/grounding concepts together in scenario questions.
- Match admin tasks to consoles: license assignment (M365 admin center), agent governance (M365 + Power Platform admin centers), compliance (Purview), Teams policies (Teams admin center).
- Copilot Administrator is the least-privilege role for Copilot settings; Global Administrator is broader than necessary for daily Copilot admin.
- Pay-as-you-go requires an Azure subscription link; monthly per-user licenses suit steady adoption; Researcher/Analyst agents are included with Copilot license.
- AB-900 requires annual renewal via a free online assessment on Microsoft Learn to maintain the certification.
Quick Answer: Domain 3 scenario questions on AB-900 combine licensing, adoption reporting, prompt governance, agent lifecycle, and permissions/grounding. Route each task to the right console: M365 admin center for licenses and approvals, Power Platform admin center for Copilot Studio governance, Purview for compliance logging, Teams admin center for app permission policies.
How Domain 3 Scenarios Are Written
AB-900 presents short administrative scenarios — a paragraph describing an organization's Copilot rollout problem — followed by a single-best-answer or multiple-answer question. The skill is mapping symptoms to admin actions and consoles, not memorizing portal click paths. Microsoft builds distractors from real features used in the wrong context (Purview for license assignment, Adoption Score for Copilot usage, conditional access for agent approval).
Domain 3 is 25–30% of your score, but scenarios often pull in Domain 2 governance concepts (DLP, oversharing, prompt logging) and Domain 1 identity basics (least privilege, Entra roles). Treat this chapter as the integration layer.
Admin Console Routing Cheat Sheet
| Task | Primary Console |
|---|---|
| Assign Copilot licenses | Microsoft 365 admin center |
| Configure pay-as-you-go billing | Microsoft 365 admin center |
| Toggle web grounding | Microsoft 365 admin center (Copilot settings) |
| Monitor Copilot active users | M365 admin center — Copilot Usage Report |
| View employee Copilot sentiment | Viva Insights — Copilot Dashboard |
| Approve/reject custom agents | Microsoft 365 admin center |
| Manage Copilot Studio environments | Power Platform admin center |
| Configure connector DLP for agents | Power Platform admin center |
| Log/review Copilot prompts | Microsoft Purview — Audit / AI Hub |
| Scan Copilot for harassment/PII | Purview — Communication Compliance |
| Control Teams agent availability | Teams admin center — app permission policies |
| Manage Entra admin roles (Copilot Admin) | Microsoft Entra admin center |
Scenario Pattern 1: Licensing and Cost
Stem signals: pilot, fluctuating usage, avoid seat commitment, Azure subscription mentioned, Copilot Credits.
Answer direction: Pay-as-you-go billing with linked Azure subscription. Fixed monthly per-user licenses suit steady org-wide deployment.
Trap: Reversing which model needs Azure (pay-as-you-go needs it; monthly per-user does not).
Scenario Pattern 2: Low Adoption
Stem signals: licensed users not using Copilot, ROI question, department comparison, training need.
Answer direction: Copilot Analytics and Copilot Usage Report — not Adoption Score (all M365), not Service Health (uptime), not transport rules.
Follow-up action: Assign licenses to intended users, then monitor — not delete SharePoint sites or disable Entra ID.
Scenario Pattern 3: Ungoverned Agent Publication
Stem signals: maker published agent to all users, no security review, sensitive data in agent knowledge.
Answer direction: Agent approval process + scope access via Entra groups and Teams app permission policies + review knowledge source permissions.
Trap: Retention labels or conditional access as substitutes for approval workflow.
Scenario Pattern 4: Data Exposure Through Copilot
Stem signals: user sees confidential data in Copilot response, overshared SharePoint link, unintended audience.
Answer direction: Remediate source permissions and run Data Access Governance reports — Copilot does not bypass Graph permissions.
Trap: Disabling Copilot entirely instead of fixing oversharing; assuming Copilot creates new permission grants.
Scenario Pattern 5: Compliance Investigation
Stem signals: audit Copilot interactions, forensic review, regulatory retention, harassment in prompts.
Answer direction: Purview Audit (prompt logging), AI Hub (centralized AI visibility), Communication Compliance (policy violations).
Trap: Copilot Dashboard (adoption/sentiment) or Copilot Usage Report (active user counts) for forensic needs.
Role and Least Privilege
| Role | Scope |
|---|---|
| Copilot Administrator | Copilot settings, policies, org toggles — preferred for daily Copilot admin |
| Global Administrator | Full tenant control — broader than necessary |
| Compliance Administrator | Purview DLP, retention, eDiscovery — not Copilot license assignment |
| Teams Administrator | Teams policies including app permissions — not Copilot billing |
Built-in vs Custom: Quick Decision Tree
Is the ask about Word/Excel/Outlook/Teams embedded AI?
→ Built-in Microsoft 365 Copilot (monthly license or pay-as-you-go)
Is the ask about a purpose-built bot for one department?
→ Custom agent in Copilot Studio + approval + channel deployment
Is the ask about Microsoft-built Researcher/Analyst reasoning agents?
→ Included with Copilot license (pay-as-you-go does not apply)
Domain 3 Rapid-Fire Facts
- Passing score: 700/1000 scaled; 40–60 questions, 60 minutes, $99 USD
- Renewal: Annual free online assessment on Microsoft Learn
- Prerequisite licenses: E3/E5, Business Standard/Premium, or Office 365 E3/E5 before Copilot add-on
- User prompt actions: Save, share, schedule, delete
- Agent lifecycle consoles: M365 admin center + Power Platform admin center
- Copilot Studio: Topics, knowledge sources, actions, generative answers, multi-channel deploy
- Grounding: Graph retrieval into LLM context; permissions inherited from source data
Final Review Checklist
Before exam day, confirm you can answer without hesitation:
- Monthly license vs pay-as-you-go — cost model, Azure prerequisite, best-fit scenario
- Where to assign Copilot licenses and purchase new seats
- Copilot Usage Report vs Adoption Score vs Service Health vs Copilot Dashboard
- Prompt logging vs user prompt management vs AI Hub vs Communication Compliance
- Copilot Studio components: topics, actions, knowledge sources, deployment channels
- Agent approval workflow before org-wide publication
- M365 + Power Platform admin centers for agent lifecycle
- Grounding definition and permission inheritance rule
- Teams app permission policies for Copilot Studio agents
- Copilot Administrator vs Global Administrator for least privilege
Time Management on AB-900
With 40–60 questions in 60 minutes, budget roughly 1–1.5 minutes per question. Domain 3 scenarios often run longer — flag and return. Read the last line of the stem first (it states the actual ask). Eliminate distractors from the wrong domain (Purview answer for a licensing question) before guessing.
On the Exam: The AB-900 tests foundational administration concepts, not portal click-path memorization. When two answers seem plausible, choose the one that follows least privilege, existing permission boundaries, and Microsoft's named tool for the specific job.
An administrator wants to ensure that only approved agents appear for users in the organization. Which approach supports this?
Which tool would an administrator use to manage governance settings specifically for agents created with Copilot Studio?
An administrator must monitor agent usage and operational insights and manage the agent lifecycle across deployment. Which combination of consoles supports these tasks?
Which Microsoft Entra role should be used for day-to-day Copilot settings management following least-privilege principles?
You've completed this section
Continue exploring other exams