1.2 Skills Measured and Study Plan

1.2 Skills Measured and Study Plan

The last official MS-900 contract is Skills measured as of April 30, 2025. Microsoft's study guide lists four domains, each with named skill groups and illustrative bullets. Those bullets show how Microsoft assessed the skill; related topics could still appear. Most questions covered generally available features; preview features could appear if they were commonly used.

This section names every domain, every official skill group, a 20–30 hour study plan biased toward the two large domains, the conceptual style of the items, the naming traps that still trip people, and how the later chapters of this guide map to the outline.

Why the weights should drive your calendar

Microsoft does not publish how many items sit in each domain on a given form. The percentage ranges are the only official weighting. A 20-hour plan that spends 10 hours on cloud service models and 2 hours on Teams, SharePoint, Intune, and Copilot is inverted. Describe Microsoft 365 apps and services is 45–50 percent of the outline. Describe security, compliance, privacy, and trust is 25–30 percent. Together they are roughly three-quarters of the exam. Cloud concepts (5–10%) and pricing, licensing, and support (10–15%) are required, but they cannot rescue a candidate who cannot tell Planner from Project, Intune from Autopilot, or Purview from Defender.

Domain 1 — Describe cloud concepts (5–10%)

This is the shortest domain, and it is still the vocabulary the rest of the exam assumes.

Different types of cloud services

You must describe Microsoft software as a service (SaaS), infrastructure as a service (IaaS), and platform as a service (PaaS) concepts and use cases, and you must describe the differences between Office 365 and Microsoft 365. Office 365 is not a synonym you can swap in for Microsoft 365 on this exam. Microsoft 365 is the broader bundle that adds Windows, device management, and security and compliance capabilities around the productivity apps.

Cloud, hybrid, or on-premises considerations

You describe public, private, and hybrid cloud models; compare costs and advantages of cloud, hybrid, and on-premises services; and describe hybrid work and flexible work. Hybrid cloud — where workloads run — is not the same sentence as hybrid work — where people sit. The exam likes both.

Chapters 2 and 3 of this guide cover this domain. Two or three focused hours are enough for most candidates if they can already explain SaaS versus IaaS in a staff-meeting sentence.

Domain 2 — Describe Microsoft 365 apps and services (45–50%)

This is the exam. Budget it like the exam.

Productivity solutions

Core Microsoft 365 Apps — Word, Excel, PowerPoint, and OneNote — plus the productivity benefits of Microsoft 365 Copilot and Microsoft 365 Copilot Chat, plus project-work tools: Microsoft Project, Planner, Bookings, Forms, Lists, To Do, and Loop. You need the job each tool does, not the ribbon. Project is portfolio and project management; Planner is lightweight team task boards; Loop is portable collaborative components.

Collaboration solutions

SharePoint, OneDrive, and Stream for content; Exchange and Outlook for mail and calendaring; Microsoft Teams and Teams Phone for chat, meetings, and voice; Copilot again, this time for collaboration; Microsoft Viva for employee experience; and extending Teams with Whiteboard, Planner, Power Apps, and Power Automate.

Device and cloud endpoint management

Microsoft Intune, co-management with Configuration Manager, Endpoint Analytics, Windows Autopilot, and Windows Autopatch. Compare Windows 365 and Azure Virtual Desktop. Describe Windows-as-a-Service (WaaS) deployment rings. Identify deployment and update channels for Microsoft 365 Apps. This is still conceptual: you choose Autopilot for zero-touch Windows provisioning; you do not walk through a hardware-hash import.

Administration capabilities

The Microsoft 365 admin center and its reports, the Microsoft 365 user portal, reports in the SharePoint, Teams, and Exchange admin centers, and the Microsoft Copilot dashboard. Fundamentals candidates describe what those portals surface. They are not asked to design a custom reporting workspace.

Chapters 4 through 9 teach this domain. A serious 20–30 hour plan puts about 10 to 14 hours here.

Domain 3 — Describe security, compliance, privacy, and trust (25–30%)

Identity and access management

Microsoft Entra ID — the current name; Azure Active Directory is the former name — for identity and access. Cloud identity, on-premises identity, and hybrid identity. How Microsoft uses multi-factor authentication (MFA), self-service password reset (SSPR), and Conditional Access to keep identities, access, and data secure.

Threat protection

Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and the Microsoft Defender portal. Microsoft Secure Score. How Microsoft 365 addresses common threats against endpoints, applications, and identities.

Trust, privacy, risk, and compliance

The Zero Trust model. Microsoft Purview compliance solutions such as insider risk, auditing, and eDiscovery. Purview Information Protection features such as sensitivity labels and data loss prevention (DLP). Data residency for regulatory compliance. Microsoft Priva.

Chapters 10 through 13 teach this domain. Plan about 6 to 8 hours. The naming is the trap: Entra versus Defender versus Purview versus Priva. If you still say "Azure AD Conditional Access in the Security and Compliance Center," you are answering with retired product names.

Domain 4 — Describe Microsoft 365 pricing, licensing, and support (10–15%)

Pricing and billing

Pricing models: enterprise agreements, cloud solution providers (CSP), and direct billing. Billing frequency and payment methods.

Licensing

License management. Base licensing versus add-on licensing. A base license unlocks a core suite; an add-on layers a capability such as a security or voice feature on top of that base.

Support

How to create a support request. Support options. Service-level agreements (SLAs) including service credits. Service health in the Microsoft 365 admin center or the Microsoft Entra admin center.

Chapters 14 and 15 teach this domain. Plan about 3 to 4 hours. Know which buying channel a mid-size customer would use, what an add-on is, and where an admin looks when Outlook is down.

A 20–30 hour study plan

Use the low end — about 20 hours — if you already live in Microsoft 365 every day. Use the high end — about 30 hours — if you are new to the suite or you keep mixing product families.

1. Hours 1–3 — Cloud concepts (Chapters 2–3). SaaS, PaaS, and IaaS with Microsoft examples. Office 365 versus Microsoft 365. Public, private, and hybrid. Hybrid work versus hybrid cloud. Stop when you can recommend a model without reciting a definition paragraph.
2. Hours 4–16 — Apps and services (Chapters 4–9). This is the long block on purpose. Cluster the work: productivity apps and Copilot; SharePoint, OneDrive, and Exchange; Teams, Viva, and extensibility; Intune, Autopilot, and Windows 365 versus Azure Virtual Desktop; Windows-as-a-Service and Apps channels; admin centers and the Copilot dashboard. After each cluster, answer the quizzes in those chapters before you move on.
3. Hours 17–24 — Security, compliance, privacy, and trust (Chapters 10–13). Entra identity stories first — cloud, on-premises, hybrid, MFA, SSPR, Conditional Access — then the Defender XDR family and Secure Score, then Zero Trust, Purview, sensitivity labels, DLP, data residency, and Priva.
4. Hours 25–28 — Pricing, licensing, and support (Chapters 14–15). Enterprise agreements versus CSP versus direct. Base versus add-on. Support request, SLA credits, service health.
5. Hours 29–30 — Mixed review. Take a mixed quiz set. Re-read every item you miss and name the domain it belongs to. If misses cluster in apps and services or security, spend the last hour there — not on cloud definitions you already know.

A 45-minute fundamentals clock with no Microsoft Learn pane rewards recognition speed. Practice answering in under a minute: this is a collaboration problem, so the stem wants Teams, SharePoint, or Exchange — not Intune.

Conceptual exam style, not configuration

MS-900 items describe a capability and ask you to choose it. They do not ask you to open the Microsoft Intune admin center, create a device compliance policy, and assign it to a group. That style belongs on administrator exams such as MS-102. MS-900 is also not a prerequisite for MS-102.

Train for stems like these:

• A company wants employees to chat, meet, and call from one app → Teams and Teams Phone, not "deploy a session border controller."
• A company wants new Windows devices to enroll with almost no IT touch → Windows Autopilot, not a twenty-step imaging runbook.
• A company wants cloud PCs assigned per user → Windows 365. A company wants multi-session desktops that IT pools on Azure → Azure Virtual Desktop.
• A company wants to reduce accidental sharing of credit-card numbers in email → data loss prevention in Microsoft Purview, not "turn on Secure Score."
• A company wants users to reset passwords without a help-desk ticket → SSPR, not a new licensing SKU.

If a practice question asks you for a PowerShell cmdlet, a JSON policy, or a click path, it is out of scope for this outline. Skip it.

Naming you must get right

Product names moved while MS-900 was still live. The April 30, 2025 outline already uses the current names. Study those names, and know the former names only so a stem does not confuse you.

• Microsoft 365 Copilot and Microsoft 365 Copilot Chat are named separately in the productivity and collaboration skill groups. Copilot is not merely a Word feature, and it is not the entire Microsoft 365 suite.
• Microsoft Entra ID is the identity service. Azure Active Directory is the former name. Use Entra ID as the primary term.
• Microsoft Purview is the compliance, information protection, eDiscovery, and DLP family. Do not dump every compliance task into Defender.
• Microsoft Defender XDR and the Defender workload products — Endpoint, Office 365, Identity, Cloud Apps — plus the Microsoft Defender portal are threat protection. Microsoft Secure Score is a measurement and improvement experience, not a firewall.
• Microsoft Priva is privacy risk and subject-rights work, not a Defender SKU.
• Office 365 versus Microsoft 365 is an official cloud-concepts bullet. Treat them as different product families.

How to use the rest of this guide

Fifteen chapters follow this introduction in outline order. Chapters 2 and 3 finish cloud concepts. Chapters 4 through 9 walk the four apps-and-services skill groups. Chapters 10 through 13 walk identity, threat protection, and Purview and Priva. Chapters 14 and 15 walk buying, licensing, support, SLAs, and service health. Each teaching section is built from one official skill group or a tightly clustered pair — the two Copilot bullets live together in Chapter 4. Read the section, work the quizzes, then move. Do not skip Chapters 4 through 9 because you already use Word. The exam weights that domain at nearly half the score.

AB-900 remains available if you want a current fundamentals badge with Copilot and agent administration. Use it as a possible next exam, not as a substitute title for this outline. Microsoft did not publish AB-900 as a one-to-one replacement for MS-900.

Realistic exam-style scenarios

Inverted calendar. Jordan blocks 25 hours and spends the first 12 on SaaS diagrams and public-versus-private cloud. Apps and security get a weekend. That plan studies 5–10 percent of the outline as if it were the whole exam. Rebuild the calendar so hours 4–24 are apps and security.

Admin-lab reflex. Priya practices creating Intune compliance policies and Conditional Access grants because that is how she learned administrator labs. On an MS-900-style stem she over-answers with configuration detail the item never asked. She should practice choosing Intune or Conditional Access, not building the policy.

Name lag. A recap deck still says Azure AD, Advanced Threat Protection, and Security and Compliance Center. The April 30, 2025 outline says Entra ID, Defender for Identity or Defender XDR, and Purview. Update the vocabulary before you memorize anything else.

AB-900 swap. A manager tells the team to just take AB-900 instead because it replaced MS-900. That is not what Microsoft published. AB-900 is a live, related fundamentals exam with a different skills outline — core Microsoft 365 objects, data protection for Copilot, and Copilot and agent administration. Recommend it as a current option, not as a renamed MS-900.