AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals Questions and Answers

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft states that if an organization has a Microsoft 365 Copilot license and at least one user is assigned to a Copilot license, SharePoint administrators automatically get access to the SharePoint Advanced Management features required for Copilot deployment. Microsoft does not say that all users in the organization must have Microsoft 365 Copilot licenses for administrators to use SharePoint Advanced Management.

Statement 2 is Yes because Microsoft documents SharePoint Advanced Management features such as Restricted Content Discovery and Restricted SharePoint Search , which can limit whether content from specific SharePoint sites appears in Microsoft 365 Copilot and organization-wide search experiences.

Statement 3 is Yes because Microsoft explicitly states that organizations can purchase a standalone SharePoint Advanced Management license for each user in the organization. That means it is available even for organizations that do not have Microsoft 365 Copilot.

The correct selections are No, No, Yes . Microsoft states that in Microsoft 365 Copilot and Microsoft 365 Copilot Chat, prompts and responses aren’t used to train the underlying foundation models . Microsoft also documents that Copilot works within the Microsoft 365 service boundary and that data accessed through Microsoft Graph isn’t used to train foundation models . That makes statements 1 and 2 No .

Statement 3 is Yes because Microsoft documents that Microsoft 365 Copilot honors the same data protection, access control, and compliance capabilities that apply across Microsoft 365. Microsoft also states that Copilot only surfaces organizational data that users already have permission to access, including content retrieved through Microsoft Graph in services such as SharePoint, OneDrive, Exchange, and Teams.

To use Microsoft 365 Copilot Chat to reason over web data, you need a Microsoft 365 Copilot license. Answer: No

To use the Researcher agent in Microsoft 365 Copilot, you need a Microsoft 365 Copilot license. Answer: Yes

To add an agent in the Microsoft 365 Copilot app, you need a Microsoft 365 Copilot license. Answer: No

The correct selections are No, Yes, No . Microsoft documents that Microsoft 365 Copilot Chat is available at no additional cost for eligible Entra account users with qualifying Microsoft 365 licenses, and that it includes secure AI chat grounded in the web . That means a separate Microsoft 365 Copilot add-on license is not required just to use Copilot Chat over web data.

Statement 2 is Yes because Microsoft states that Researcher is part of the core default experience for Microsoft 365 Copilot licensed users . In other words, access to the Researcher agent requires the Microsoft 365 Copilot license.

Statement 3 is No because Microsoft documents that users can access agents and create them in the Microsoft 365 Copilot app through Copilot Chat, and Microsoft 365 service descriptions state that web-grounded agents are available at no extra cost for commercial users with a qualifying Microsoft 365 license. A Copilot add-on license is required for certain advanced capabilities, but not simply to add an agent in the app in general.

The correct answer is D. the Microsoft 365 admin center . Microsoft Learn states that users with a Microsoft 365 Copilot license can use Copilot capabilities, and Microsoft specifically points administrators to the Microsoft 365 admin center and its setup guidance to assign the required licenses to users. Microsoft also documents that the Researcher and Analyst agents were deployed to existing users with Microsoft 365 Copilot licenses and that administrators govern these agents through the Microsoft 365 admin center .

The other portals are not the primary place for this task. Microsoft Entra admin center focuses on identity and access, Microsoft Purview focuses on compliance and governance, and Microsoft Defender focuses on security operations and threat protection. None of those is the main admin experience Microsoft documents for assigning Microsoft 365 Copilot access and managing the availability of Researcher and Analyst. Because the goal is to enable a user to use Microsoft 365 Copilot and its Microsoft-provided agents, the correct administrative tool is the Microsoft 365 admin center .

Communications Compliance uses OCR (optical character recognition) and machine learning to detect offensive or risky text inside images , including those in SharePoint and OneDrive.

By default, Communications Compliance pseudonymizes user identities to reduce investigator bias. Admins can later deanonymize if needed.

It does not add disclaimers. It silently monitors communications and flags policy violations; disclaimers are handled by Exchange transport rules, not Communications Compliance.

time-bound role activation

The correct answer is time-bound role activation . Microsoft Learn explains that Microsoft Entra Privileged Identity Management (PIM) allows users to be made eligible for privileged roles and then activate those roles only when needed. Microsoft also states that once activated, the role is active for a preconfigured period of time , after which the privileged access expires automatically. This is the core just-in-time and time-limited access model that PIM is designed to provide. ( learn.microsoft.com )

The other options do not match Microsoft’s definition of PIM. It is not primarily described as providing restricted access to Microsoft 365 services , the lifecycle management of users , or the management of enterprise applications . Those areas relate more closely to other Microsoft Entra and Microsoft 365 governance capabilities. Microsoft specifically positions PIM as a service to manage, control, and monitor access to important resources by using eligible assignments , approval workflows , MFA if required , and temporary role activation . Therefore, the phrase that correctly completes the sentence is time-bound role activation . ( learn.microsoft.com )

You can use a Microsoft Entra security group to assign permissions to Microsoft Entra ID resources. Answer: Yes

You can use a Microsoft Entra security group to assign Microsoft 365 licenses. Answer: Yes

You can use a Microsoft Entra security group to assign permissions to Microsoft Exchange mailboxes. Answer: No

The correct answers are A and D because both tasks are supported directly in the Exchange admin center (EAC) . Microsoft Learn states that administrators can manage mail flow rules in Exchange Online from the EAC under Mail flow > Rules , which includes creating and managing transport rules for organizational email handling. Microsoft Learn also states that administrators can create shared mailboxes in the EAC under Recipients > Mailboxes , where a shared mailbox can be added and then delegated to users.

Option B is incorrect because adding a custom domain is normally done in the Microsoft 365 admin center , specifically on the Domains page. Although Exchange can later work with accepted domains and related mail flow settings, the act of adding and verifying a custom domain is not an Exchange admin center task. Option C is incorrect because license assignment is handled through Microsoft 365 or Microsoft Entra administrative tools, not the Exchange admin center.

The correct answer is D. single sign-on (SSO). Microsoft Entra single sign-on lets users sign in once with one set of credentials and then access assigned applications without signing in again. In this scenario, users authenticate to App1 automatically by using Microsoft Entra credentials, so the app is relying on the tenant identity provider rather than requiring separate app credentials. Multifactor authentication is an additional verification step, not the automatic reuse of an authenticated session. Password synchronization synchronizes password hashes between identity stores, and pass-through authentication validates credentials against on-premises Active Directory. Neither describes the user experience shown here. The key wording is “without manually entering their credentials,” which maps directly to SSO.

The correct answer is C. the code interpreter capability . Microsoft Learn states that the code interpreter capability for Microsoft 365 Copilot declarative agents allows the agent to generate and execute Python code to analyze data and generate visualizations . Microsoft’s agent schema documentation explicitly describes Code Interpreter as a capability used to solve complex math problems, analyze data, and generate visualizations. That directly matches the requirement to create charts and visualizations from a Microsoft Excel workbook .

Microsoft documentation also explains that code interpreter supports working with Excel files and is used for scenarios such as data analysis , statistical computations , and generating charts . This makes it the correct configuration for an agent that must reason over workbook data and produce chart-based outputs. By contrast, the image generator capability is for creating images, not for analyzing workbook data. The Scrum Assistant and Customer Insights Assistant options are templates, not the specific technical capability required to read data and build charts from an Excel workbook.

The correct answer is B. using a custom agent that is grounded in work data . Microsoft Learn states that agents that access shared tenant data , such as SharePoint or Graph Connector content, are billed based on metered consumption . Microsoft also describes pay-as-you-go for Microsoft 365 as applying to agents in Microsoft 365 Copilot Chat , where organizations pay only for the messages used instead of assigning a full Microsoft 365 Copilot license. That is exactly the scenario described in option B: a custom agent grounded in work data.

The other options are not the intended pay-as-you-go scenario. A Teams meeting recap and Copilot in Word are standard Microsoft 365 Copilot application experiences tied to licensed Copilot functionality, not metered agent consumption. Researcher is an advanced Microsoft 365 Copilot agent available as part of Microsoft 365 Copilot capabilities, not the documented example of pay-as-you-go replacing a Copilot license. Microsoft’s pay-as-you-go guidance centers on agent-based usage , especially agents grounded in organizational work data.

The correct answer is View all the users in the Microsoft Entra tenant . In the exhibit, John is assigned the Global Reader role. Microsoft documents that the Global Reader role is intended for users who need to view administrator features and settings in admin centers that a Global Administrator can view, but without edit permissions. That makes it appropriate for read-only visibility into tenant-wide directory and admin information, including users in Microsoft Entra.

The other answer choices are not supported by the Global Reader role. Microsoft distinguishes admin-center visibility from access to content in workloads such as SharePoint sites and Exchange mailboxes . Global Reader is a read-only administrative role, not a content access role for reading all documents or mailbox items. Likewise, performing eDiscovery of Microsoft 365 Copilot prompts requires Purview eDiscovery permissions or role group membership, not merely the Global Reader role. Microsoft documents eDiscovery permissions separately in Purview role groups.

Therefore, based on the assigned role shown, the valid completion is that John can view all the users in the Microsoft Entra tenant .

The correct answer is Activate the role. Microsoft Learn states that in Microsoft Entra Privileged Identity Management (PIM), when a user is made eligible for a Microsoft Entra role, they do not immediately have the permissions of that role. Microsoft specifically explains that eligible users must activate the role assignment before using the role. Only after activation does the user receive the permissions associated with that role for the approved time period.

That means if you are only eligible for the User Administrator role, you cannot create user accounts until you activate that role in PIM. The other options are incorrect because installing Microsoft Authenticator, requesting a license, or updating location information are not the universal prerequisite stated by Microsoft for using an eligible PIM role. Multifactor authentication can be required during activation depending on policy, but the core required action is still to activate the role first. Microsoft also notes that activation can involve entering a reason, selecting a duration, and completing any required approval or MFA steps.

The correct answer is C. the Microsoft 365 admin center . Microsoft Learn documents a specific Copilot image generation setting in the Microsoft 365 admin center under Copilot > Settings > Copilot actions > Copilot image generation . Microsoft states that when this scenario is allowed, users can ask Copilot to create, design, and edit images. When it is not allowed, Copilot does not generate images and instead responds with stock or brand images. This directly matches the requirement to prevent users from generating images by using Copilot.

The other options are incorrect because Microsoft does not document this control as being managed from Defender, Purview, or Entra for this scenario. Microsoft also separately notes that organizations can control access to Designer image generation through policy, but the admin experience for managing the Microsoft 365 Copilot scenario itself is explicitly surfaced in the Microsoft 365 admin center . Therefore, for an exam question focused on where an admin should go to disable image generation in Copilot, the best and documented answer is the Microsoft 365 admin center .

The correct answer is Microsoft Defender XDR . Microsoft Learn defines Microsoft Defender XDR as a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. That wording matches the sentence in the question almost exactly, which makes this the clearly correct choice.

The other options do not fit that definition. Microsoft Entra Conditional Access is Microsoft’s Zero Trust policy engine used to evaluate signals and enforce access policies, not a cross-domain threat detection and response suite. Microsoft Entra ID Protection focuses on detecting and responding to identity risks such as risky sign-ins and risky users. Microsoft Purview is Microsoft’s portfolio for data governance, data security, and compliance. None of those products is described by Microsoft as coordinating detection, prevention, investigation, and response across endpoints, identities, email, and applications in the same integrated XDR manner. Therefore, the only answer that correctly completes the sentence is Microsoft Defender XDR .

The correct selections are No, No, Yes . Microsoft states that for Microsoft 365 Copilot , customer prompts, responses, and Microsoft Graph grounding data aren’t used to train foundation models . Microsoft also explains that Copilot processes organizational data within the service boundary and applies the same commitments that protect Microsoft 365 customer data. That makes statements 1 and 2 No . Microsoft further documents that Microsoft 365 Copilot grounds responses using Microsoft Graph and only surfaces data that the user is permitted to access , so it respects existing identity, access, and permission controls in the tenant. That makes statement 3 Yes .

This behavior is a core part of Copilot’s enterprise design. Microsoft describes Copilot as inheriting your organization’s existing Microsoft 365 permissions model, including access controls on content in SharePoint, OneDrive, Exchange, Teams, and other Microsoft 365 services. So Copilot does not grant new access; it works within the permissions already assigned to the signed-in user.

The correct answer is C. the Microsoft 365 Copilot dashboard in Microsoft Viva Insights . Microsoft documents that the Microsoft Copilot Dashboard in Viva Insights provides detailed organizational reporting for Copilot usage and impact, including meeting-related metrics such as total meeting hours summarized or recapped , intelligent recap actions taken using Copilot , and summarize meeting actions taken using Copilot in Teams . Those metrics directly match the scenario in the question.

The other options are less suitable. The Microsoft 365 Apps usage report focuses on app usage generally, not detailed Copilot-in-Teams behavior. The Copilot readiness report is for readiness and deployment planning, not deep Teams usage metrics. The Microsoft 365 Copilot usage report in the admin center provides adoption information, but Microsoft’s detailed meeting-action and meeting-hours metrics are documented in the Viva Insights Copilot Dashboard . Therefore, for detailed Teams-specific Copilot reporting during a pilot, the best answer is the Microsoft 365 Copilot dashboard in Microsoft Viva Insights .

The correct answer is B. data loss prevention (DLP) policies . Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices . Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.

Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft’s documented solution is DLP policies .

The correct answer is D. the Analyst agent in Microsoft 365 Copilot . Microsoft Learn training for Microsoft 365 Copilot specifically distinguishes the Analyst agent as the tool for gathering insights from data and enhancing data presentations. Microsoft’s guidance also notes in the Researcher FAQ that when the task is spreadsheet-related , Analyst agent is better suited for Microsoft Excel related tasks . This makes Analyst the best choice for a quarterly sales reporting scenario that involves detecting performance trends , surfacing anomalies , and producing visual insights from multiple datasets.

The other options are less suitable. Researcher is intended for complex multi-step research and source-cited reports across web and work content, not specialized data analysis across files. Microsoft 365 Copilot Search is for finding information, not for deep quantitative analysis and anomaly summarization. Copilot in Excel is powerful for workbook-level analysis, but the question emphasizes broader insight generation across multiple files and asks for the best Copilot experience for trends, visuals, and anomaly summaries. Microsoft positions Analyst as the dedicated agent for that kind of data-analysis workflow.