AB-900 Exam Guide: What Copilot and Agent Administration Fundamentals Covers, Format, and How to Pass

AB-900 is Microsoft's entry certification for running Copilot and agents inside Microsoft 365. It is a 45-minute proctored exam, currently offered in English only. It is built on three skill areas: Microsoft 365 core objects, data protection and governance, and Copilot and agent administration. You pass at 700, and the certification does not expire.

What AB-900 covers

Microsoft dates the current outline to July 22, 2026. Below are the three skill areas and their weightings. The names are written exactly as Microsoft publishes them on the study guide:

Skill area	Weight	In plain terms
Identify the core features and objects of Microsoft 365 services	30–35%	the estate: services, admin centers, identity, security basics
Understand data protection and governance tasks for Microsoft 365 and Copilot	35–40%	Purview, oversharing, and what Copilot may touch
Perform basic administrative tasks for Copilot and agents	25–30%	licensing, billing, usage, and the agent lifecycle

Look at where the weight sits. The biggest block is the middle one at 35–40%, and it is mostly Microsoft Purview — not Copilot. The smallest is the last one at 25–30%, which is the only area with Copilot and agents in its title. An exam named after Copilot spends most of its marks elsewhere. That surprises people, and it should change how you split your study time.

Area one is the Microsoft 365 groundwork. Objects, and which admin center owns them: mailboxes and distribution groups belong to the Exchange admin center; sites, libraries and folders to the SharePoint admin center; teams, channels and policies to the Teams admin center; domain names and org settings to the Microsoft 365 admin center. Add the roles and permissions used on SharePoint sites, plus the way license types reach users and groups. Then a security block: Zero Trust principles, authorization, authentication methods, threat protection and intelligence, Microsoft Defender XDR, Microsoft Entra ID, conditional access policies, single sign-on (SSO), Identity Secure Score, audit logs, Privileged Identity Management (PIM), App registrations and Enterprise apps, and the tools for common sign-in problems.

Area two is data protection and governance. This is the Microsoft Purview area, and the blueprint names six Purview solutions outright: Data Lifecycle Management, Data Security Posture Management (DSPM) for AI, Communication Compliance, Insider Risk Management, Data Loss Prevention (DLP) and Information Protection. Around them sit sensitivity labels, data classification and retention. Then the Copilot half: how Copilot reaches data, how Microsoft Graph shapes its responses, which permissions and controls across Microsoft 365, Microsoft Purview and Microsoft Defender limit what it can return, and responsible AI principles. After that comes the risk work, which is largely one tool per job — Compliance Manager for compliance risks, Data Explorer for sensitive information, activity explorer for user activity, Content search in Microsoft Purview eDiscovery for files and email, DLP alerts, policy violations from Communication Compliance, Insider Risk Management, and DSPM for AI for AI activity. The area closes on oversharing in SharePoint: the troubleshooting tools, a data access governance report, and SharePoint Advanced Management, with restricted access control inside it.

Area three is the administration itself. Which capabilities are built into Copilot and which into agents; the monthly license model set against pay-as-you-go, SharePoint included; which Copilot features an admin can turn on or off; and use cases for Researcher, Analyst and custom agents. Then the routine tasks: assigning Copilot licenses, managing pay-as-you-go billing policies, following usage and adoption in the Microsoft 365 admin center and in Copilot Analytics, and prompt management — deleting, scheduling, sharing and saving. Agents get their own group: user access to agents, creating one, the approval process, and monitoring that covers usage, operational insights and the agent lifecycle across two admin centers, Microsoft 365 and Microsoft Power Platform.

Two notes on the study guide are worth reading before you plan. Microsoft describes the sub-bullets as illustrations of how each skill gets assessed, and says related topics can appear too. Read the list as the shape of the exam, not its full contents. Second, most of what you are asked about is generally available; Preview features can appear, but only where they are already commonly used.

Microsoft also publishes a change log beside the outline, comparing the current skills measured against the previous version. If you started studying before 22 July 2026, open it and check which groups moved.

Format, score, and the 45 minutes

You get 45 minutes. The exam is proctored, and Microsoft warns that interactive components may be part of it. The certification page puts it at Beginner level and tags it to the Administrator role.

You pass at 700. Microsoft reports technical exam scores on a scale running from 1 to 1,000, and the detail people miss is on the scoring page: the score is scaled. 700 does not mean 70% of the questions answered correctly. The bar reflects both the skills being measured and how hard your particular set of questions was.

Three more scoring facts change how you should answer. Guessing costs nothing — a wrong answer earns no point, and nothing is taken away. Multi-part questions usually award a point for each correct component, so a partly right answer is still worth something. And some items are unscored trial questions that Microsoft is still evaluating. You cannot tell which, so treat every question as if it counts.

Microsoft publishes no question count. Plenty of sites state one confidently. We would rather tell you it is unpublished than invent it. You have 45 minutes, and the sensible planning assumption is that you will not have long per question.

The exam is currently listed in English only. The study guide carries a general policy that matters if English is not your first language. When an exam is not offered in the language you prefer, you can request an extra 30 minutes. Booking goes through Pearson VUE, and students and educators book through Certiport instead. Price is set by the country or region where the exam is proctored. Microsoft also recommends booking with a personal Microsoft account rather than a work or school one. Exam records held against an organizational account are lost if you leave that organization. If you fail, you can retake after 24 hours.

Who AB-900 is for, and what you need first

Microsoft lists no required exam or certification. What the certification page gives instead is an audience profile — the background it assumes you arrive with. It expects familiarity with Microsoft 365: core services, identity and access, governance, data protection and security, and with Copilot and agents themselves. It expects you to recognize the admin centers behind Microsoft Purview, Microsoft Entra, Microsoft Teams, SharePoint in Microsoft 365 and Exchange Online. It expects you to name the core objects — libraries, sites, teams, groups and users — and to know the core security features: single sign-on (SSO), conditional access policies and authentication methods. It also names modern IT management practices, and experience with AI-driven productivity tools.

MS-900 was retired in March 2026; AB-900 is the new Microsoft 365 Fundamentals-family credential. We cover what that means for anyone part-way through MS-900 study in a separate article.

Read as a whole, that audience profile describes someone who already works inside a Microsoft 365 tenant. The next point is our reading rather than Microsoft's wording. AB-900 is gentler on a helpdesk or IT-support background than on a complete newcomer, because it assumes the vocabulary of admin centers instead of teaching it.

Does it expire?

No. Microsoft's renewal page states plainly that fundamentals certifications do not expire. Associate, expert and specialty certifications are the ones on an annual cycle. They renew through a free, unproctored, open-book assessment taken inside a six-month window, which adds another year. AB-900 sits outside that cycle. Pass it once and it stays.

How to prepare

Microsoft's free training on Microsoft Learn arrives as two learning paths, three modules each. Explore Microsoft 365 administration is the groundwork: security foundations, then core services and their admin controls, then data protection and governance. Explore Microsoft 365 Copilot and agent administration is the AI half: what Copilot and agents are, then the admin tasks for each. Both paths are rated Beginner. Both expect the same starting point: functional experience with Microsoft 365 services at a basic level, and general IT practices you already understand well.

The certification page carries two more free things. A practice assessment shows the style, wording and difficulty you should expect. An exam sandbox puts you in the real interface with the real question types before exam day. Both cost nothing, and both are current material.

Practice questions help most in the space between modules: the choices the exam actually asks you to make. Which Purview tool answers which signal. A sensitivity label against a retention policy. Copilot's monthly license against pay-as-you-go. An agent's approval step against its access configuration. Those are decisions, and reading about a decision is not the same as being asked to make one.

Our AB-900 practice exams and study guide were written against the July 22, 2026 outline, with every question tied to the Microsoft Learn unit that supports it. No dumps, ever.

Is it worth it?

Our honest answer depends on why you want it. As proof of deep skill, no fundamentals certification is that, and we will not pretend otherwise. Its real use is different. It is a structured way to learn what an administrator has to control before an organization turns Copilot on across its tenant, and that control question is now a real job rather than a future one. The certification does not expire and it is one of the cheaper ones to take. It also gives you the vocabulary to discuss Purview policy sensibly with the people who already own it.

If you want a schedule rather than a verdict, we wrote an AB-900 study plan and an honest look at how hard it is.

Independent study material. ciply.io is not affiliated with, endorsed by, or sponsored by Microsoft.