AB-900 Exam Map and Audience

Quick Answer: The AB-900 exam has 40-60 questions, 60 minutes, and requires 700/1000 to pass. Three domains: Core M365 Features (30-35%), Data Protection and Governance (35-40%), and Copilot/Agent Administration (25-30%). The credential is Microsoft 365 Certified: Copilot and Agent Administration Fundamentals and requires annual renewal via a free online assessment.

The Microsoft 365 Copilot and Agent Administration Fundamentals (AB-900) exam validates foundational knowledge for supporting and protecting an AI-enabled Microsoft 365 environment. Unlike broad fundamentals exams that survey every workload at a high level, AB-900 expects you to connect core Microsoft 365 services, security controls, Purview governance, and Copilot administration into practical scenarios an IT administrator or security-minded business professional would face when deploying AI productivity tools.

Exam Format at a Glance

Domain Breakdown

On the Exam: Data Protection and Governance (35-40%) is the heaviest domain, but Domain 1 still represents roughly one-third of scored content. You cannot pass by studying Purview alone — you must know how Exchange mailboxes, SharePoint permissions, Entra Conditional Access, and Microsoft Graph permissions shape what Copilot can surface.

How AB-900 Differs from MS-900

MS-900 is an excellent prerequisite, but AB-900 goes deeper on the intersection of Microsoft 365 services and AI governance. Expect scenario questions that ask which admin center, policy, or role solves a Copilot-related exposure problem.

Question Types and Scoring

AB-900 uses multiple-choice questions and interactive components (drag-and-drop, multi-select, or scenario-based items depending on the exam form). Scoring is scaled from 1 to 1,000 with a fixed pass mark of 700. Because items are weighted, 700 does not equal exactly 70% raw-correct answers. You receive a pass/fail result on screen immediately, and a domain-level score report appears in your Microsoft Learn profile so you know which areas to restudy if you fail.

On the Exam: AB-900 tests what each tool does and when to use it — not hands-on portal clicks or PowerShell syntax. A candidate who understands admin center purposes, Entra security controls, and how Copilot inherits user permissions can pass without configuring a live tenant, though sandbox practice makes concepts stick faster.

Who Should Take AB-900

The exam targets professionals who support AI-enabled Microsoft 365 tenants:

• Microsoft 365 administrators preparing for Copilot rollout and ongoing governance.
• Security and compliance analysts responsible for Purview policies that constrain AI data access.
• IT managers and team leads who must understand licensing, adoption metrics, and risk exposure.
• Help desk and support staff escalating Copilot permission or access issues.
• MS-900 holders who want a Copilot-specific fundamentals credential on their profile.

Microsoft recommends familiarity with Microsoft 365 admin centers (Exchange Online, SharePoint, Teams, Entra, Purview), core security concepts such as Zero Trust and Conditional Access, and AI-driven productivity tools. No formal prerequisites are required.

Registration and Renewal

1. Sign in at Microsoft Learn with your Microsoft account and open the AB-900 certification page.
2. Click Schedule exam, which hands off to Pearson VUE.
3. Choose a test center or online proctoring, pick a date, and pay $99 USD.

Unlike older Dynamics 365 fundamentals certifications that never expire, AB-900 requires annual renewal through a free online assessment on Microsoft Learn. This keeps your knowledge current as Copilot features, Purview governance tools, and agent capabilities evolve rapidly.

Worked Scenario: Mapping a Question to a Domain

A stem asks: "A compliance officer needs to identify SharePoint sites with 'Anyone' sharing links that could expose data to Copilot users who should not see it. Which tool should the administrator use first?"

Walk the keywords. "SharePoint," "Anyone links," and "Copilot exposure" point to oversharing governance — Domain 2 (Purview/SharePoint access governance). But if the stem instead asks which admin center manages sharing policies at the tenant level, the answer shifts to the SharePoint admin center — Domain 1. AB-900 routinely tests whether you can distinguish the admin center (where policies are configured) from the Purview report (where risk is discovered).

What AB-900 Does and Does Not Test

DOES test: licensing effects on feature access, purpose of each M365 admin center, Entra authentication controls, Zero Trust principles, how Microsoft Graph permissions scope Copilot data access, Purview governance capabilities, Copilot licensing and agent lifecycle.

Does NOT test: writing Copilot Studio code, advanced Power Platform development, detailed eDiscovery legal workflows, or exact Purview policy JSON configuration — it tests foundational administration decisions an AI-enabled tenant requires.