AB-900 Study Plan: How Long It Takes and How to Weight It

Give AB-900 two to three weeks at about an hour a day. The two official learning paths hold six hours and 45 minutes of reading, so the rest of your time is practice. Then weight the plan by the exam's own bands. Data protection and governance carries 35-40%, and the official modules give it the least reading of the three areas.

This article is about scheduling only. For the exam's format, scoring and audience, read our AB-900 exam guide. Whether the exam is hard is a separate question, and we answer it here. Coming from MS-900? We cover that separately.

Start from the three bands, not from the reading list

Microsoft's AB-900 study guide states its skills as of July 22, 2026 and splits them into three areas:

Exam area	Weight	Sub-bullets listed
Microsoft 365 core features and objects	30-35%	20
Data protection and governance, Copilot included	35-40%	19
Copilot and agent administration	25-30%	14

The weights are Microsoft's. The bullet counts are ours: we counted the sub-bullets printed under each area on that page. They are worth counting, because they show how wide an area is and not only how heavy. Area 2 is both.

One planning note from the same page: most questions cover features that are already generally available, and preview features appear only when they are widely used. So there is no reason to spend evenings on preview announcements.

The official reading is six hours and 45 minutes

Two learning paths are published for this exam, three modules each. Here they are with the minutes Microsoft states on each module:

Module	Minutes	Mainly serves
Explore Microsoft 365 security foundations	81	Area 1
Microsoft 365 core services and admin controls	63	Area 1
Protect and govern Microsoft 365 data	62	Area 2
Explore Microsoft 365 Copilot and agents	74	Area 3
Basic admin tasks for Copilot	55	Area 3
Basic admin tasks for Copilot agents	70	Area 3

That is 206 minutes in the Microsoft 365 administration path and 199 in the Copilot and agent administration path, so 405 minutes in total. Both paths ask for the same starting point: some working experience with Microsoft 365, and general IT knowledge.

The reading is not weighted the way the exam is

Now put the two tables side by side. This comparison is ours, not a Microsoft statement:

Exam area	Exam weight	Share of the official minutes
Microsoft 365 core features and objects	30-35%	144 min (36%)
Data protection and governance	35-40%	62 min (15%)
Copilot and agent administration	25-30%	199 min (49%)

Area 1 roughly matches. The other two do not. The heaviest area on the exam gets the smallest module in either path, while the lightest area gets almost half of the reading. That single mismatch is the reason most AB-900 plans need adjusting, and it is the reason this one is shaped the way it is.

There is a fair explanation for it. Much of the agent material is a step-by-step build: two units on creating a Chat agent, one on creating a SharePoint agent, one on testing and editing. Procedure reads fast. The Purview module is the opposite — a short survey that names a great many tools and then moves on.

How we would divide about 20 hours

Where the time goes	Hours
Area 1 — Microsoft 365 objects, identity, security	5
Area 2 — Purview, Copilot data, oversharing	7
Area 3 — Copilot and agent administration	5
Mixed practice and review	3

Area 2 gets seven hours against 62 minutes of official reading. That is deliberate. The reading introduces the tools; the exam asks you to pick between them, and that skill is built after the module, not during it.

A three-week shape

Week 1 — Microsoft 365 itself. The first two modules of the administration path. Learn which admin center owns which object: teams, channels and policies in the Teams admin center; sites, libraries and folders in SharePoint; mailboxes and distribution groups in Exchange. Then the identity half: Zero Trust principles, conditional access, SSO, Identity Secure Score, audit logs, PIM, and the difference between App registrations and Enterprise apps. The security module also covers threat protection and intelligence, and what Microsoft Defender XDR brings together. Aim to explain, without notes, how a license assigned to a group changes what a user can open.

Week 2 — data protection and governance. Read the 62-minute module, then build the thing it does not give you: a single table with one line per tool and the signal that tool reports. Eight of this area's sub-bullets each name a different one — Compliance Manager, Data Explorer, Insider Risk Management, DLP alerts, Communication Compliance violations, activity explorer, DSPM for AI, and Content search in eDiscovery. Do the same for the six Purview solutions named in a single bullet: Data Loss Prevention, Insider Risk Management, Information Protection, Communication Compliance, Data Lifecycle Management, and DSPM for AI. Finish with the SharePoint oversharing group: the data access governance report, and what SharePoint Advanced Management adds, restricted access control included. Re-read the module at the end of the week. It reads very differently the second time.

Week 3 — Copilot and agents, then review. How Copilot reaches data, what Microsoft Graph contributes to a response, and which permissions and controls limit what it can return. Then the administration itself: assigning licenses, the monthly model against pay-as-you-go, which features an admin can switch on or off, prompt management, agent access, agent approval, and monitoring an agent across its lifecycle. Use cases for Researcher, for Analyst and for custom agents are named in their own bullets, so learn them as three separate answers. Spend the last few days on mixed practice rather than on fresh material.

If you only have two weeks

Compress week 1 into two or three evenings, but only if you already administer Microsoft 365 daily. Keep week 2 at full length whatever else you cut. Cutting the Purview week to save time is cutting the largest part of the exam.

Use the free official material

The certification page carries a free practice assessment and a separate exam sandbox. The sandbox is the underused one. It lets you meet the question formats in the real interface before exam day. Then nothing about the screen is new to you, and your attention stays on the content. The exam itself runs 45 minutes. Neither the certification page nor the study guide states how many questions you will see, so plan your pace around the clock rather than around a count.

The last few days

Stop taking in new material about four days out. Spend that time on the choices the exam keeps asking you to make: authentication against authorization, a sensitivity label against a retention label, DLP against Insider Risk Management, the monthly Copilot license against pay-as-you-go, and Copilot against an agent. Those are the points that decide your score.

One thing we would not do is follow a "pass tomorrow" plan. AB-900 covers three admin surfaces: Microsoft 365, Purview, and Copilot and agents. A rushed pass through them leaves nothing you can use at work the following week.

Reading gets you one half of the preparation. Being asked gets you the other. Our AB-900 practice exams and study guide were written against this same July 2026 outline. Every question links the Microsoft Learn page behind it, so a wrong answer takes you straight to the page that settles it.

The schedule above is our opinion, formed while building AB-900 material from these same official modules. Independent study material. ciply.io is not affiliated with, endorsed by, or sponsored by Microsoft.