Free Practice Questions for the Microsoft 365 Certified: Copilot and Agent Administration Fundamentals AB-900 Exam (2026 Updated)

The correct selections are No, Yes, No . Microsoft defines Zero Trust as a security strategy and explicitly states that it isn’t a product or a service . Instead, it is an approach based on principles such as verify explicitly , use least privilege access , and assume breach . That makes statement 2 true.

Statement 1 is false because Zero Trust does not require an Azure subscription. Microsoft provides Zero Trust guidance across many environments, including Microsoft 365, Copilot, Azure, and hybrid scenarios. It is a strategy that can be implemented with different technologies and is not dependent on owning Azure specifically.

Statement 3 is also false because there is no single switch in the Microsoft 365 admin center to “enable Zero Trust” for an organization. Microsoft’s documentation presents Zero Trust as a set of policies, configurations, and deployment steps across services such as Microsoft Entra, Intune, Defender, and Microsoft 365 workloads, not as one admin-center toggle.

Top of Form

Bottom of Form

The correct answer is Microsoft Defender XDR . Microsoft Learn defines Microsoft Defender XDR as a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. That wording matches the sentence in the question almost exactly, which makes this the clearly correct choice.

The other options do not fit that definition. Microsoft Entra Conditional Access is Microsoft’s Zero Trust policy engine used to evaluate signals and enforce access policies, not a cross-domain threat detection and response suite. Microsoft Entra ID Protection focuses on detecting and responding to identity risks such as risky sign-ins and risky users. Microsoft Purview is Microsoft’s portfolio for data governance, data security, and compliance. None of those products is described by Microsoft as coordinating detection, prevention, investigation, and response across endpoints, identities, email, and applications in the same integrated XDR manner. Therefore, the only answer that correctly completes the sentence is Microsoft Defender XDR .

The correct answer is Connectors . Microsoft documents that Microsoft 365 Copilot connectors are used to bring external, line-of-business data into Microsoft 365 Copilot so users can search, reason over, and act on content from non-Microsoft systems. Microsoft also states that admins must enable and configure Copilot connectors in the Microsoft 365 admin center , and once configured, those connectors can be selected as knowledge sources for custom agents. This directly matches the requirement to let users use an external system as a knowledge source for custom Microsoft 365 Copilot agents.

This is why the hotspot in the Copilot area should be set to Connectors , not Overview, Agents, Search, Billing & usage, or Settings. Overview provides status information, Agents is for agent management, Search is for Microsoft Search experiences, and Billing & usage is for metering and consumption tracking. The specific admin feature that enables external enterprise data sources for agent grounding is Connectors . Microsoft further explains that configured connectors can expose external knowledge securely and respect source-level permissions when used in agent scenarios.

The correct answer is are NOT assigned a Microsoft 365 Copilot license. Microsoft’s official reporting guidance explains that the Copilot credits report is used to manage metered consumption costs for Microsoft 365 Copilot Chat. The purpose of this report is to show credit consumption tied to pay-as-you-go billing policies, including metrics such as total credits used and credits used per user, per agent, and per billing policy. Microsoft’s Copilot analytics documentation further defines these credit-related metrics around Copilot Chat users, which are users with a Microsoft 365 license but without a Microsoft 365 Copilot license who consume credits while using agents.

Because licensed Microsoft 365 Copilot users are generally covered by their Copilot entitlement for included agent usage, the credits report is intended to track the metered agent usage scenario for users who are not assigned a Microsoft 365 Copilot license and who interact with work-grounded agents in Microsoft 365 Copilot Chat. That is why this option correctly completes the sentence.

provide control over how users can access cloud apps.

The correct answer is provide control over how users can access cloud apps . Microsoft Learn defines Microsoft Entra Conditional Access as the Zero Trust policy engine that uses if-then logic to make access decisions. Microsoft states that Conditional Access policies determine who can access resources, what resources they can access, and under what conditions . These policies can require actions such as multifactor authentication, compliant devices, or other controls before allowing access to applications and services like Microsoft 365. That means Conditional Access is specifically used to control how users access cloud apps .

The other options are incorrect. Conditional Access policies are not configured by using the Microsoft Defender portal ; they are managed in the Microsoft Entra admin center . They are also not applied only to on-premises resources , because Microsoft documents Conditional Access primarily for cloud identities, cloud apps, and cloud-connected resources. Finally, Conditional Access does not require a Microsoft Exchange mailbox. It can be applied broadly across many Microsoft and third-party cloud applications integrated with Microsoft Entra.

The correct answer is B. the Microsoft Defender portal. Microsoft Purview DLP policies can generate alerts when rule conditions are matched. Microsoft states that DLP alerts can be investigated and managed in both Microsoft Defender XDR and the Microsoft Purview portal, but the Defender XDR dashboard is the recommended location for investigating and managing DLP alerts. That fits the requirement to view alert details and understand how the alert relates to other alerts, because Defender provides the incident and alert investigation experience. Microsoft Intune is used for endpoint and app management. Microsoft Entra is used for identity and access administration. The Microsoft 365 admin center is used for tenant administration and reporting, not DLP alert correlation.

The correct answer is A. Data access governance in the SharePoint admin center . Microsoft Learn documents Data access governance reports in the SharePoint admin center as the reporting solution used to understand data exposure, including permission structure and sharing link activity . Microsoft specifically states that the site permissions snapshot report provides visibility across SharePoint and OneDrive sites , helping administrators understand current permissions exposure, and that separate reports are created for SharePoint and OneDrive . Microsoft also documents sharing links activity reports as part of Data access governance for monitoring link-sharing activity, and notes that OneDrive support is available through PowerShell for those reports. Together, this is the Microsoft reporting capability aligned with permissions and active sharing links for OneDrive content.

The other options do not fit this requirement. Microsoft 365 admin center reports focus mainly on usage and activity reporting, not detailed permissions and sharing-link governance. Defender Audit is for security investigation activity, and Purview eDiscovery is for legal and investigative content search, not for generating OneDrive permissions and sharing-link governance reports. Therefore, the best Microsoft-documented answer is Data access governance in the SharePoint admin center .

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft documents tenant controls for web search on or off , but not a general Microsoft 365 Copilot setting to block only selected websites for normal Copilot responses. Microsoft also says it doesn’t recommend or support managing Copilot through selective URL or domain blocking at the network level. Website allow/block lists shown in Microsoft documentation apply to Researcher with Computer Use virtual-device settings, not to standard Microsoft 365 Copilot web grounding overall.

Statement 2 is Yes because Microsoft provides the Allow web search in Copilot policy in Cloud Policy service and in the Microsoft 365 admin center, which can disable web search for Microsoft 365 Copilot and Copilot Chat.

Statement 3 is Yes because Microsoft states that admins can block Researcher and Analyst , and agent governance includes a Block action. Microsoft also notes that for Researcher and Analyst, user scoping isn’t edited through the usual panel; availability is managed by blocking the selected agent at the tenant level.

The correct answer is B. Data explorer. Microsoft Learn states that Data explorer in Microsoft Purview shows a current snapshot of items that have been classified as a sensitive information type in your organization. Microsoft’s sensitive information type documentation specifically lists examples such as social security numbers and credit card numbers, which means Data explorer is the appropriate portal feature for identifying files and emails that contain those data types. Data explorer is designed to help administrators see where sensitive data exists across supported Microsoft 365 locations.

The other options are less appropriate for this task. Information Protection reports focus more broadly on label and protection reporting. Information Protection policies are for configuring classification and protection behavior, not for finding existing files and emails containing SSNs or credit card numbers. Activity explorer is primarily used to review user and policy-related activities, such as label changes or DLP events, rather than to provide the direct sensitive-data inventory view requested here. Since the question asks to identify the files and emails containing specific sensitive information types, Microsoft’s documented answer is Data explorer.

The correct answer is D. single sign-on (SSO). Microsoft Entra single sign-on lets users sign in once with one set of credentials and then access assigned applications without signing in again. In this scenario, users authenticate to App1 automatically by using Microsoft Entra credentials, so the app is relying on the tenant identity provider rather than requiring separate app credentials. Multifactor authentication is an additional verification step, not the automatic reuse of an authenticated session. Password synchronization synchronizes password hashes between identity stores, and pass-through authentication validates credentials against on-premises Active Directory. Neither describes the user experience shown here. The key wording is “without manually entering their credentials,” which maps directly to SSO.

The correct answer is Microsoft 365 Copilot . Microsoft Learn states that Restricted SharePoint Search (RSS) gives organizations time to review and correct permissions on SharePoint sites, and then add only those reviewed sites to an allowed list that Copilot can access . That means RSS is specifically about restricting Copilot’s access to SharePoint content, not blocking administrators, guest users, or Microsoft Purview eDiscovery from those sites.

This distinction is important. Microsoft explains that users can still access SharePoint content based on their normal permissions, while RSS limits what Microsoft 365 Copilot can use as grounding data until site permissions are reviewed and approved. So the feature helps reduce oversharing risk in Copilot without removing a user’s direct ability to find or open content they already have permission to access in SharePoint. In other words, the restriction is placed on Copilot’s searchable grounding scope , not on the user’s own SharePoint permissions. That is why the sentence is correctly completed with Microsoft 365 Copilot .

The correct answer is adding a public DNS record . Microsoft documents that when you add a custom domain to Microsoft 365, you must first prove ownership of that domain before Microsoft 365 can use it for services such as Exchange Online, SharePoint, and user sign-ins. The standard verification method described by Microsoft is to add a DNS record at your domain registrar or DNS hosting provider. Microsoft commonly uses a TXT record for verification, although in some cases an MX record can also be used depending on the setup flow. This is why “adding a public DNS record” is the right completion for the sentence.

The other choices are not the standard Microsoft 365 domain verification process. Microsoft’s admin guidance does not use confirming your business address , uploading a certificate , or uploading a webpage as the normal method for proving ownership of a domain in Microsoft 365. Domain verification is specifically tied to DNS because DNS is the authoritative public system used to prove control over the domain name.

The correct answer is View all the users in the Microsoft Entra tenant . In the exhibit, John is assigned the Global Reader role. Microsoft documents that the Global Reader role is intended for users who need to view administrator features and settings in admin centers that a Global Administrator can view, but without edit permissions. That makes it appropriate for read-only visibility into tenant-wide directory and admin information, including users in Microsoft Entra.

The other answer choices are not supported by the Global Reader role. Microsoft distinguishes admin-center visibility from access to content in workloads such as SharePoint sites and Exchange mailboxes . Global Reader is a read-only administrative role, not a content access role for reading all documents or mailbox items. Likewise, performing eDiscovery of Microsoft 365 Copilot prompts requires Purview eDiscovery permissions or role group membership, not merely the Global Reader role. Microsoft documents eDiscovery permissions separately in Purview role groups.

Therefore, based on the assigned role shown, the valid completion is that John can view all the users in the Microsoft Entra tenant .

The correct answer is A . Microsoft Learn defines Zero Trust as a security strategy built on the principles verify explicitly , use least privilege access , and assume breach . Microsoft also summarizes Zero Trust as a model that assumes breach and verifies every request , rather than trusting users, devices, or traffic simply because they originate from inside the corporate network. This is the key reason option A is correct. Under Zero Trust, every access request should be evaluated continuously using available signals such as identity, device state, location, service, and risk.

Option B is incorrect because improving user experience is not the defining principle of Zero Trust. Option C is incorrect because Zero Trust requires ongoing review and adjustment of permissions, especially through least privilege and risk-based access. Option D is incorrect because Zero Trust explicitly rejects implicit trust based on network location. Microsoft states that organizations should reduce reliance on the traditional idea that anything on the internal network is automatically safe or trustworthy.

The correct answer is B. the Microsoft Purview DSPM for AI solution . Microsoft documents that Data Security Posture Management for AI (DSPM for AI) in Microsoft Purview provides a central place to secure data for AI apps and proactively monitor AI use , including Copilots and agents . Microsoft also states that DSPM for AI helps organizations identify where sensitive content is used in AI interactions , review Copilot prompts and responses , analyze usage patterns , assess exposure and oversharing risks, and get recommendations for protections such as sensitivity labels and DLP policy coverage.

The other options do not fit this requirement. Microsoft Viva Insights focuses on productivity and work-pattern analytics, not sensitive-data protection in Copilot interactions. Microsoft Security Copilot is a security assistant for analysts, not the Purview governance solution that analyzes sensitive content use in Copilot and recommends data protections. Insider Risk Management is for identifying risky user behavior, not for broad AI interaction posture analysis and protection recommendations. Microsoft specifically positions DSPM for AI as the “front door” for discovering, monitoring, and protecting AI-related data usage in Microsoft 365 Copilot.

The correct selections are The Microsoft 365 admin center and A billing policy . Microsoft documents that Microsoft 365 Copilot pay-as-you-go is administered in the Microsoft 365 admin center , specifically under Copilot > Billing & usage , where admins create and manage billing policies . Microsoft explains that a billing policy defines the billing infrastructure for pay-as-you-go, including the Azure subscription and the set of users covered by that policy. That user scoping is what allows organizations to separate usage and spending by groups such as departments.

Microsoft also documents that billing policies support budgets , spending views , and monitoring current expenses for services linked to the policy. This supports the requirement for greater visibility into Copilot usage costs and forecasting departmental spending. By assigning different departments to different billing policies, the organization can track Copilot costs by department. The other listed features do not fit: auto-claim policy is unrelated to cost tracking, and Copilot connector is for external data grounding, not billing segmentation.

The correct answer is D. the Analyst agent in Microsoft 365 Copilot . Microsoft Learn training for Microsoft 365 Copilot specifically distinguishes the Analyst agent as the tool for gathering insights from data and enhancing data presentations. Microsoft’s guidance also notes in the Researcher FAQ that when the task is spreadsheet-related , Analyst agent is better suited for Microsoft Excel related tasks . This makes Analyst the best choice for a quarterly sales reporting scenario that involves detecting performance trends , surfacing anomalies , and producing visual insights from multiple datasets.

The other options are less suitable. Researcher is intended for complex multi-step research and source-cited reports across web and work content, not specialized data analysis across files. Microsoft 365 Copilot Search is for finding information, not for deep quantitative analysis and anomaly summarization. Copilot in Excel is powerful for workbook-level analysis, but the question emphasizes broader insight generation across multiple files and asks for the best Copilot experience for trends, visuals, and anomaly summaries. Microsoft positions Analyst as the dedicated agent for that kind of data-analysis workflow.

The correct answer is Microsoft SharePoint sites . Microsoft Learn documents that Microsoft Purview sensitivity labels for containers can be applied to Microsoft Teams, Microsoft 365 groups, and SharePoint sites . These labels can control settings such as privacy, external sharing, and unmanaged device access for the labeled site. That is the official Microsoft feature that matches the sentence in the question.

The other options are not the best match for this item. Microsoft 365 Copilot conversations are not the standard object to which admins directly apply a sensitivity label in the way this question is asking. Copilot can honor labels on source content and may display label context in responses, but the selectable resource here is not “Copilot conversations.” Azure Blob Storage is also not the intended answer in the Microsoft 365 Copilot and Agent Admin context for Purview sensitivity labels.

So for this hotspot, the sentence is correctly completed with Microsoft SharePoint sites , because Microsoft explicitly supports applying Purview sensitivity labels to SharePoint sites as a container-level labeling capability.

time-bound role activation

The correct answer is time-bound role activation . Microsoft Learn explains that Microsoft Entra Privileged Identity Management (PIM) allows users to be made eligible for privileged roles and then activate those roles only when needed. Microsoft also states that once activated, the role is active for a preconfigured period of time , after which the privileged access expires automatically. This is the core just-in-time and time-limited access model that PIM is designed to provide. ( learn.microsoft.com )

The other options do not match Microsoft’s definition of PIM. It is not primarily described as providing restricted access to Microsoft 365 services , the lifecycle management of users , or the management of enterprise applications . Those areas relate more closely to other Microsoft Entra and Microsoft 365 governance capabilities. Microsoft specifically positions PIM as a service to manage, control, and monitor access to important resources by using eligible assignments , approval workflows , MFA if required , and temporary role activation . Therefore, the phrase that correctly completes the sentence is time-bound role activation . ( learn.microsoft.com )