Free Microsoft AB-900 Practice Test | 70+ Questions Copilot & Agents

Microsoft AB-900 Practice Test

The Microsoft AB-900 practice test helps learners prepare for the Microsoft 365 Copilot and Agent Administration Fundamentals exam through focused, exam-aligned review. It is designed for students, new administrators, support professionals, and business technology users who want to understand Microsoft 365 services, security, data governance, Copilot, and agents without getting lost in overly complex explanations. You can Practise smarter across leading IT certifications while using this page as a clear guide to the knowledge areas that deserve the most attention.

AB-900 is a fundamentals-level exam, but that does not mean preparation should be based only on memorizing product names. Microsoft expects candidates to understand why common Microsoft 365 objects, security controls, governance tools, Copilot features, and agent administration tasks are used. A useful practice test should therefore ask students to connect a short workplace situation with the most suitable Microsoft feature or administrative action.

This guide follows the official Microsoft Learn study guide for Exam AB-900. Microsoft identifies the certification as Microsoft 365 Copilot and Agent Administration Fundamentals and lists three weighted skill domains. The explanations below turn those official domains into a practical, student-friendly preparation structure. Because Microsoft can update exam objectives as services change, candidates should compare their study plan with the latest official study guide before taking the live exam.

What Is the Microsoft AB-900 Practice Test?

A Microsoft AB-900 practice test is a study assessment that checks whether you can recognize and apply the foundational concepts listed in the official exam outline. It should help you answer questions such as:

• Which Microsoft 365 admin center is appropriate for a particular task?
• How do users, groups, teams, SharePoint sites, libraries, and mailboxes differ?
• What is the purpose of multifactor authentication, Conditional Access, and single sign-on?
• How does Microsoft Purview help protect and govern organizational data?
• How does Microsoft 365 Copilot access information while respecting permissions?
• What basic tasks are involved in licensing, monitoring, approving, and managing Copilot and agents?

The purpose is not to copy live exam questions. A responsible practice test uses original, exam-style scenarios to strengthen understanding. It should explain why an answer is suitable and why the alternatives do not fit the situation. This turns every question into a short lesson instead of a simple score.

AB-900 learners often come from different backgrounds. Some may already use Teams and SharePoint but have little experience with Microsoft Entra or Purview. Others may understand identity and security but be new to Copilot administration. A well-structured assessment makes these differences visible so each learner can spend more time on weak topics.

Official Microsoft AB-900 Exam Domains

The official Microsoft study guide lists the following skills measured as of October 14, 2026. The percentage ranges show the approximate emphasis of each domain, not a guaranteed number of questions in a particular test session.

These ranges are important when planning practice sessions. Data protection and governance has the largest weighting, but all three areas are substantial. Ignoring any one domain can create a serious knowledge gap. The best plan gives every domain regular attention while assigning slightly more study and review time to the 35–40% section.

Domain 1: Identify the Core Features and Objects of Microsoft 365 Services — 30–35%

This domain checks whether you understand the basic building blocks of a Microsoft 365 environment and the security principles that protect them. Practice questions may describe a user, group, mailbox, site, team, policy, or sign-in problem and ask you to identify the most appropriate object, admin center, or control.

Microsoft 365 objects and administrative locations

Start by learning how licenses affect access to Microsoft 365 features. A user may exist in the organization but still need the correct license for a service. Group-based licensing can help administrators assign access consistently to multiple users. Practice scenarios should help you distinguish between creating an identity, assigning a license, and granting access to a specific resource.

You should also know the general purpose of the main administrative portals:

• The Microsoft 365 admin center supports organization-level settings, users, licenses, domains, and broad service management.
• The Exchange admin center is used for objects such as mailboxes and distribution groups.
• The SharePoint admin center supports sites and settings related to SharePoint content. Within sites, candidates should understand libraries, folders, roles, and permissions.
• The Teams admin center supports teams-related configuration, policies, and other controls for Microsoft Teams.
• The Microsoft Entra admin center supports identity, access, authentication, applications, and related security tasks.
• The Microsoft Purview portal brings together data protection, compliance, risk, governance, and investigation capabilities.

Do not study these as isolated definitions. Ask what an administrator is trying to manage. If the task concerns a distribution group, think Exchange. If it concerns a site library or site access, think SharePoint. If it concerns authentication or Conditional Access, think Microsoft Entra.

Security principles and controls

Microsoft includes Zero Trust principles in this domain. At a foundation level, Zero Trust means that access should not be trusted automatically simply because a request comes from inside an organization. Access decisions should verify identities and devices, use the minimum necessary privileges, and assume that a breach may occur.

Candidates should understand the difference between authentication and authorization. Authentication confirms who a person or service is. Authorization determines what that identity can access or do. This distinction appears in many security scenarios, so it should become automatic during practice.

Other important topics include:

• Authentication methods and multifactor authentication
• Conditional Access policies
• Single sign-on
• Users and groups as security objects
• Risky sign-ins and common sign-in troubleshooting
• Microsoft Defender XDR capabilities
• Threat protection and threat intelligence
• Identity Secure Score in Microsoft Entra ID
• Audit logs for user and administrator activity
• Privileged Identity Management
• App registrations and enterprise applications

Practice questions in this area should test purpose and selection. For example, a scenario might ask which feature helps provide time-limited privileged access or which tool helps investigate a failed sign-in. The goal is to choose the right capability based on the requirement, not simply recognize a familiar product name.

Domain 2: Understand Data Protection and Governance Tasks for Microsoft 365 and Copilot — 35–40%

This is the largest AB-900 domain. It focuses on Microsoft Purview, the data security implications of Copilot, compliance and governance risks, and oversharing in SharePoint. Learners should be able to connect a risk—such as sensitive data exposure, inappropriate communication, excessive access, or improper retention—with the Microsoft capability designed to address it.

Microsoft Purview capabilities

Microsoft Purview includes several solutions, and their names can seem similar at first. Study each one by its main purpose:

• Information Protection supports data discovery, classification, labeling, and protection.
• Data Loss Prevention (DLP) helps identify and prevent inappropriate sharing or use of sensitive information.
• Insider Risk Management helps organizations identify and investigate risky activities involving people with legitimate access.
• Communication Compliance helps identify messages that may violate organizational or regulatory policies.
• Data Security Posture Management for AI helps organizations discover and manage risks associated with AI use and data exposure.
• Data Lifecycle Management supports retention and deletion across the information lifecycle.

Sensitivity labels are particularly important. Candidates should understand that labels can classify and protect content according to its sensitivity. Data classification provides the context needed to recognize sensitive information, while retention controls how long content should be kept or when it can be deleted.

When reviewing practice answers, state the requirement in plain language before selecting a solution. “Prevent sensitive data from being shared inappropriately” points toward DLP. “Keep records for a required period” points toward retention. “Find concerning user activity” may point toward Insider Risk Management. This simple method reduces confusion between products.

How Copilot accesses and protects data

Microsoft 365 Copilot uses organizational data to provide relevant responses, but it works within the user’s existing permissions and Microsoft 365 controls. Candidates should understand the role of Microsoft Graph in grounding Copilot responses with organizational context. They should also recognize that Copilot can reveal existing access problems more quickly if users already have access to information they should not see.

This is why permission management, data classification, DLP, Microsoft Defender, Microsoft Purview, and SharePoint governance remain essential. Copilot is not a substitute for sound information governance. Practice scenarios may ask what should be reviewed when Copilot returns overly broad information. The strongest answer often involves correcting underlying permissions, sharing settings, or data governance controls.

Responsible AI principles also belong in this domain. At a foundation level, learners should understand that AI should be used in ways that support fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. These ideas help administrators evaluate AI use beyond simple feature enablement.

Identifying protection and governance risks

The official outline expects candidates to recognize several tools used to discover, monitor, and respond to risks:

• Microsoft Purview Compliance Manager for compliance risks and recommendations
• Data Explorer for finding sensitive information
• Insider Risk Management for risky user activity
• DLP alerts for possible data-loss events
• Communication Compliance for policy violations in communications
• Activity explorer for reported user activities
• DSPM for AI for discovering and managing AI-related activity
• Content search in Microsoft Purview eDiscovery for locating files and emails

Focus on the outcome each tool provides. A good practice question includes a short business need, enough context to choose one tool, and answer explanations that clarify the difference between related services.

Oversharing in SharePoint

Oversharing happens when users can access more content than their role requires or when content is shared too broadly. This is highly relevant to Copilot because Copilot can surface information that a user is already permitted to access.

Candidates should know that administrators can use data access governance reports in SharePoint to investigate access patterns and possible oversharing. They should also understand the role of SharePoint Advanced Management, including restricted access control. The learning objective is not advanced SharePoint engineering. It is recognizing how access governance helps reduce unnecessary exposure.

As you work through Discover mock exams for Microsoft professionals, separate governance questions into three steps: identify the sensitive content, identify who can reach it, and select the control that reduces risk without blocking legitimate work.

A Stronger Preparation Experience for AB-900 Learners

Effective practice should show more than a final percentage. It should help you understand what to do next. A useful AB-900 preparation experience can provide:

• Questions organized around the three official Microsoft domains
• Clear explanations written for beginners
• Scenario-based items that reflect workplace decisions
• A balanced mix of concept recognition and practical selection
• Review of correct, incorrect, and guessed answers
• Domain-level results that reveal weak areas
• Repeated practice without depending on memorized answer order
• A simple way to track improvement across study sessions

The most valuable part is the explanation. If you answer incorrectly, first identify whether the problem came from a missing concept, confusion between similar tools, or reading the scenario too quickly. Then write one short correction in your own words. This creates a reusable study note and makes the next question easier.

How to Use an AB-900 Practice Test Effectively

Begin with a diagnostic attempt before doing extensive review. Take a mixed set of questions under light time pressure and mark every item you guessed. Your score gives one signal, but guessed answers matter too. A correct guess may still reveal a weak concept.

Next, sort missed and uncertain questions by official domain. A simple review table can help:

After reviewing a weak topic, take a shorter targeted quiz. Do not immediately repeat the same full assessment. New scenarios are more useful because they test whether you learned the idea rather than memorized a response.

Use official Microsoft Learn material to confirm every unclear feature. Explore learning tools designed for exam candidates as part of a broader routine, but keep the official Microsoft study guide and documentation as your source of truth for objectives and product behavior.

Domain 3: Perform Basic Administrative Tasks for Copilot and Agents — 25–30%

This domain covers the capabilities of Copilot and agents plus the basic tasks used to administer them. It is practical, but the word “basic” matters: candidates should understand the purpose and sequence of common actions without needing deep development knowledge.

Copilot and agent capabilities

Be prepared to compare the built-in capabilities of Copilot with agents created for more focused purposes. Copilot supports broad productivity experiences across Microsoft 365, while an agent can be configured around a particular set of instructions, knowledge, actions, or business needs.

The outline also mentions licensing and consumption choices. Candidates should understand the general difference between a monthly Copilot license and pay-as-you-go usage, including SharePoint-related scenarios. Questions may ask which model better matches a described need, so focus on whether access is assigned as a recurring user entitlement or measured through consumption.

You should know that some Copilot features can be enabled or disabled by administrators. You should also recognize common uses for Researcher, Analyst, and custom agents. Researcher is suited to gathering and synthesizing information, Analyst supports data-focused reasoning and analysis, and custom agents can be designed for a specific process or knowledge area.

Basic Copilot administration

Important tasks include assigning Copilot licenses, managing pay-as-you-go billing policies, and monitoring usage and adoption. Microsoft 365 administrators can use reporting and analytics capabilities, including Copilot Analytics and the Microsoft 365 admin center, to understand how Copilot is being adopted.

The official outline also includes prompt management. Candidates should understand common actions such as saving, sharing, scheduling, and deleting prompts. Practice questions may present a collaboration or governance need and ask which prompt-management action fits it.

Basic agent administration

Agent questions may cover how users receive access, how an agent is created, and how approval works. Think of this as a simple lifecycle:

1. Identify the business purpose and intended users.
2. Create or configure the agent.
3. Apply the appropriate access and approval process.
4. Monitor usage and operational information.
5. Manage the agent through its ongoing lifecycle.

Monitoring may involve both the Microsoft 365 admin center and the Microsoft Power Platform admin center. Learners should recognize that usage, operational insights, access, and lifecycle information can support safe administration after an agent is published.

A Student-Friendly Study Plan

A four-stage plan keeps preparation manageable.

Stage 1: Build the Microsoft 365 foundation

Review users, groups, licenses, mailboxes, sites, libraries, teams, channels, and policies. Connect each object to its typical admin center. Then review authentication, authorization, MFA, Conditional Access, SSO, audit logs, PIM, and applications.

Stage 2: Learn governance by business need

Create a one-page map of Purview capabilities. On the left, write a risk such as data leakage, inappropriate messages, insider activity, excessive retention, or AI data exposure. On the right, write the relevant Microsoft Purview capability. Add sensitivity labels, data classification, retention, eDiscovery, and SharePoint oversharing.

Stage 3: Review Copilot and agent administration

Study how Copilot uses Microsoft Graph and respects permissions. Review licensing, pay-as-you-go billing, analytics, prompts, agent creation, access, approval, monitoring, and lifecycle management. Keep each concept tied to a short scenario.

Stage 4: Measure and correct

Take mixed practice tests, review every uncertain answer, and return to Microsoft documentation for topics you cannot explain. Continue until your results are stable across new question sets rather than relying on one high score.

Common Mistakes to Avoid

One common mistake is treating every Microsoft 365 admin center as interchangeable. They are connected, but each has a clear focus. Read the object or service named in the scenario before choosing an answer.

Another mistake is learning Purview product names without understanding outcomes. Build associations between risks and controls. DLP is not the same as retention, Communication Compliance is not the same as Insider Risk Management, and eDiscovery serves a different purpose from routine activity reporting.

Candidates also sometimes assume Copilot bypasses access controls. A better understanding is that Copilot works with the permissions and protections in the environment. Existing oversharing can therefore create risk, making SharePoint access governance and Microsoft Purview especially important.

Finally, do not judge readiness only by a percentage. Look for repeated weaknesses, slow decisions, and correct guesses. True readiness means you can explain why the selected feature fits the requirement.

Frequently Asked Questions

What does Microsoft AB-900 cover?

AB-900 covers core Microsoft 365 services and security, data protection and governance for Microsoft 365 and Copilot, and basic administration of Copilot and agents.

Which AB-900 domain has the greatest weight?

“Understand data protection and governance tasks for Microsoft 365 and Copilot” carries the largest official range at 35–40%.

Is AB-900 suitable for beginners?

Yes. It is a fundamentals exam, but learners should still be familiar with Microsoft 365 admin centers, core objects, security concepts, Purview, Copilot, and agents. Practical exposure makes scenario questions easier to understand.

Should I memorize every Microsoft product feature?

No. Focus first on the purpose of each service, the problem it solves, and the admin task it supports. Use the official outline to limit your study scope.

How should I review an incorrect practice answer?

Identify the domain, restate the scenario’s requirement, explain why the correct option fits, and note why your selected option does not. Then confirm the concept in Microsoft Learn documentation.

Are practice tests enough on their own?

Practice tests are best used with official Microsoft Learn resources and light hands-on exploration. Questions reveal gaps, while documentation and product experience help you close them.

How often should I take a practice test?

Use a full assessment for diagnosis, shorter domain quizzes during study, and another mixed assessment after reviewing weak areas. This approach reduces memorization and makes progress easier to measure.

Where can I verify the latest AB-900 domains?

Use Microsoft’s official Study guide for Exam AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals. Microsoft notes that the listed topics illustrate how skills are assessed and that related topics may also appear, so always check the current guide close to your planned exam date.