AB-900 practice questions
Microsoft · AB-900 · 200 questions
Original practice questions for Exam AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals, covering Microsoft 365 core features and objects, data protection and governance for Microsoft 365 and Copilot, and basic administrative tasks for Copilot and agents — framed in civic and municipal scenarios such as city AI pilots, public-health records, permitting chatbots, and 311 resident services. Content is original practice material aligned to the official exam domains and is not a brain-dump of actual exam questions.
This course contains the use of artificial intelligence.
About the AB-900 exam
- Time allowed
- 45 minutes
- Passing score
- 700 (scaled, 1-1000)
- Languages
- English, Arabic (Saudi Arabia), Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Indonesian, Italian, Portuguese (Brazil), Russian, Spanish
- Format
- Proctored exam through Pearson VUE (or Certiport for students and educators); may include interactive components
Schedule this exam The certification this earns
Exam details published by the vendor, checked 22 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Browse by Domain
Study specific topics at your own pace.
Identify the core features and objects of Microsoft 365 services · 67 questions
- A city clerk reports that some clerks cannot open Copilot in Word after recent group license changes. What most directly controls whether those clerks get Copilot feature access?
- A county public-health department must license seasonal permitting staff for Microsoft 365 features. Why might the admin prefer group-based license assignment over assigning licenses user by user?
- A municipal permitting office needs parks.city.gov shown as an accepted domain for org email and services. Where should the admin add and manage that domain name?
- A 311 resident-services desk wants a public-facing permitting mailbox on a verified city domain. What should the admin confirm in Microsoft 365 admin center before relying on that address?
- A transit authority needs a shared mailbox so overnight emergency-management staff can send and receive from one common address. Which admin center is the correct place to create that mailbox object?
- A water utility needs bookable room mailboxes for city hearing rooms so staff can reserve space from Outlook. Where should those room mailbox objects be created?
- An emergency-management office wants a distribution group that emails all building inspectors who are on call. Which admin center is used to create that distribution group object?
- A housing authority admin must decide where a mail-enabled distribution group for case notifications should be managed. Which statement is correct?
- A public library system needs a new SharePoint site to hold capital-projects document sets. Which admin center should be used to provision and govern that site object at the service level?
- A parks and recreation department wants a SharePoint site dedicated to permit plan sets. Which action matches the correct Microsoft 365 object and admin center?
- A municipal courts office wants inspection photos stored in SharePoint with controlled folders under a document library. Which admin center is associated with governing those site content containers?
- A fire department IT lead is organizing confidential case notes in SharePoint and must choose an appropriate content structure. What is an accurate characterization of libraries and folders?
- A police records bureau will invite outside engineering reviewers to a SharePoint site. Which SharePoint site role best fits reviewers who should read content but not change site settings or edit files?
- A city open-data portal team must give a vendor consultant access to one SharePoint site with least privilege. Which choice best aligns with SharePoint site roles?
- A school district IT team is creating a Team with channels for snow-emergency coordination. Which admin center is the primary place to administer Teams and channel objects at the service level?
- County IT shared services needs to govern channels on a city project Team. Which admin center should they use for Teams and channel administration?
- A port authority wants a Teams messaging policy that tightens chat and channel messaging controls for courts staff. Where are Teams messaging and related collaboration policies administered?
- Airport operations IT needs a Teams meeting policy for closed executive sessions. Which statement is correct?
- A wastewater treatment plant ops lead must decide how to grant Copilot access to a set of plant engineers. Which Microsoft 365 directory approach best scales for scoping access?
- City council support staff want a Microsoft 365 group to back a cross-department green-team collaboration workspace. What is the main advantage of choosing a group object for access scoping?
- A public works department reviews Microsoft 365 admin center organization settings that affect how themes and apps behave on shared kiosk PCs. What should administrators understand about these org settings?
- An elections office needs to rename an existing user mailbox display name used for absentee-ballot inquiries. Which admin center is the correct match for that mailbox object change?
- An animal control admin applies Zero Trust thinking before trusting a remote planner's laptop on the city tenant. Which Zero Trust principle is illustrated by always verifying the user and device rather than trusting the network location?
- A building inspections unit applies Zero Trust to seasonal parks staff accounts. Which practice best reflects the least-privilege principle?
- A social services casework office uses the Zero Trust "assume breach" mindset when reviewing lateral movement risks in the city Microsoft 365 tenant. What does that principle emphasize?
- A municipal HR and payroll team wants clerks to prove who they are before anyone grants SharePoint edit rights on employee files. Which distinction best describes that separation?
- A city attorney's office notes that a privileged admin completed MFA successfully yet still could not elevate into a sensitive role. What does that outcome illustrate?
- A planning and zoning office teaches clerks that signing in successfully is not the same as being allowed to change a permit site. Which statement is correct?
- A stormwater management team wants stronger proof of identity for privileged emergency-operations accounts than ordinary passwords. Which approach best matches that goal?
- A municipal call center evaluates passwordless sign-in for library public-desk shared devices used by rotating clerks. What should the team weigh carefully?
- A county assessor's office needs MFA options that still work for field inspectors who often have limited cell signal. What should the identity plan emphasize?
- A public hospital district IT team sees a phishing wave hitting permitting staff and wants broader context than a single mailbox alert. Which concept should guide them?
- A city clerk asks how threat protection helps reduce malware risk for clerks working in Outlook. Which explanation is most accurate at fundamentals level?
- A county public-health department wants to relate citywide threat intelligence to Defender alerts affecting finance staff. What is the sound fundamentals approach?
- A municipal permitting office wants a protection family that correlates signals across endpoints and email rather than treating each alert in isolation. Which choice fits at describe depth?
- A 311 resident-services desk receives a suspicious file shared in Teams and wants an investigation path aligned to Microsoft Defender XDR concepts. What should they emphasize?
- A transit authority leader wants a plain description of Microsoft Defender XDR without a full SOC playbook. Which statement is appropriate?
- A water utility needs a cloud identity plane for municipal staff signing into Microsoft 365 and related cloud apps. Which service fits that role?
- An emergency-management office wants fundamentals-level awareness of Microsoft Entra ID for a city that still has some on-premises identities. Which capability framing is correct?
- A housing authority must let outside counsel review selected case materials through guest access. Which Microsoft Entra ID concept should the team map first?
- A public library system wants housing case SharePoint sites reachable only from devices that meet compliance requirements. Which control's purpose fits?
- A parks and recreation department explains why Conditional Access matters for remote city council briefings on Microsoft 365. Which purpose statement is best?
- A municipal courts IT team wants to stop legacy authentication paths that weaken protection for permitting mailboxes. Which control purpose aligns?
- A fire department IT lead wants staff to hop across Teams, SharePoint, and line-of-business apps without constant password re-entry. Which benefit are they seeking?
- A police records bureau cites an identity benefit when onboarding seasonal parks employees who must use several Microsoft 365 apps quickly. Which benefit fits?
- A city open-data portal team wants smoother sign-in experiences for 311 agents who switch among multiple Microsoft 365 apps during a shift. What should they highlight?
- A school district IT team wants Conditional Access to target building inspectors as a cohort rather than editing each account one by one. Which security object choice fits?
- A county IT shared-services team prefers scalable Conditional Access and license-related targeting for a Copilot pilot instead of endless one-off user exceptions. What should they choose?
- A port authority is selecting the right security object for a small Copilot pilot cohort that will change membership over the next quarter. Which choice is most appropriate?
- An airport operations IT helper assists a permitting clerk who is locked out after losing an MFA device during peak permit season. What troubleshooting focus fits?
- A wastewater treatment plant operator enters the correct password but still cannot finish sign-in. Which troubleshooting focus fits?
- City council support staff see field tablets that never completed MFA registration, so clerks cannot satisfy MFA at sign-in. What troubleshooting path fits?
- A public works clerk gets a block message that cites Conditional Access when opening email from a noncompliant laptop. What should IT investigate first?
- An elections office guest planner cannot open Teams, and sign-in details point to a Conditional Access policy. Which troubleshooting approach fits?
- An animal control admin is denied access from an unusual location, and the block references Conditional Access. What conclusion fits?
- A building inspections finance clerk traveling abroad triggers a risky sign-in flag. Which review focus fits?
- A social services casework office wants visibility when privileged city admins show risky sign-ins. Which approach fits?
- Municipal HR and payroll want a prioritized identity improvement backlog before expanding Copilot. Which Microsoft Entra concept fits?
- A city attorney's office wants Identity Secure Score treated as actionable guidance, not a vanity number. Which use fits?
- Planning and zoning staff need to review who changed permissions on a courts SharePoint site after a suspicious update. Which tool concept fits?
- Stormwater management needs to inspect which admin recently changed license assignments for seasonal crews. Which review approach fits?
- A municipal call center wants Global Administrator rights available when needed without leaving them standing forever. Which concept fits?
- A county assessor's office needs just-in-time elevation for a privileged role during a weekend outage. Which capability fits?
- A public hospital district IT team needs a custom integration that reads hearing-room calendar data through Microsoft identity. Which Entra concept fits?
- A city clerk explains how a custom municipal app should appear as an identity object before it requests Graph permissions. Which object fits?
- A county public-health department manages SSO for a third-party permitting portal that staff reach with Microsoft identities. Which Entra concept fits?
- A municipal permitting office asks how a SaaS vendor integration typically appears for identity and access management in Microsoft Entra ID. Which answer fits?
Understand data protection and governance tasks for Microsoft 365 and Copilot · 77 questions
- A 311 resident-services desk needs to classify and protect council executive packets with Microsoft Purview capabilities. Which family fits?
- A transit authority wants the Microsoft Purview family associated with labeling and protecting sensitive documents. Which choice fits?
- A water utility wants public-health attachments protected with classification and protection before they enter email workflows. Which Purview focus fits?
- An emergency-management office wants to reduce accidental Social Security number leakage from benefits case email. Which Purview capability fits?
- A housing authority sees inspectors emailing unredacted resident IDs and wants a Purview control that can warn or block that sharing. Which capability fits?
- A public library system explains Purview capabilities that can block or warn when staff try to exfiltrate sensitive patron data. Which capability fits?
- Parks and recreation leaders want signals when staff mass-download resident files shortly before leaving city employment. Which Purview capability fits?
- Municipal courts IT suspects a departing clerk may be stealing case files and wants the Purview capability aimed at insider data-theft risk. Which choice fits?
- A fire department IT lead reviews Teams chats among crews for harassment and other policy risks. Which Microsoft Purview capability fits that communication-risk review?
- A police records bureau needs to identify policy violations when staff share inappropriate content in Microsoft 365 channels. Which Purview feature should the bureau identify?
- A city open-data portal team wants visibility into where AI experiences interact with municipal sensitive data. Which Purview capability should the team use?
- A school district IT office is auditing how Copilot and agents may expose district data. Which Microsoft Purview family should it identify for AI data-security posture?
- A county IT shared-services team needs retention and deletion lifecycle concepts applied to old permit archives in Microsoft 365. Which Purview capability fits?
- A port authority must keep certain operational records for the period the legal schedule requires. Which Purview capability should administrators identify?
- An airport operations IT team needs executive closed-session minutes marked as highly confidential in Microsoft 365. Which Purview use case fits?
- Wastewater treatment plant operations wants labeled process documents so external sharing of sensitive content is constrained. What sensitivity-label outcome should they seek?
- City council support staff must treat resident PII differently from public park maps in Microsoft 365. Which Purview concept should guide that distinction?
- A public works department wants Purview help finding unmarked sensitive fields in municipal datasets. Which concept should the department apply?
- An elections office must keep election records for the legally required retention period in Microsoft 365. Which Purview concept applies?
- An animal control administrator needs deleted case items to remain discoverable when policy still requires retention. Which retention outcome matches that need?
- A building inspections unit learns how Microsoft 365 Copilot decides which inspection files to surface. What access rule should staff understand?
- A social services casework office asks why overshared SharePoint case files become visible to many staff through Copilot. What explanation fits?
- Municipal HR/payroll tests whether a clerk without access to a restricted benefits library still sees those files in Copilot. What result should they expect?
- A city attorney's office wants a clear map of what Copilot can reach for each attorney. What should that map be based on?
- Planning and zoning managers worry that Copilot might be a backdoor past folder ACLs on sealed variance files. What should IT emphasize?
- Stormwater management staff want a fundamentals-level picture of what influences Copilot grounding across Microsoft 365. Which fabric should they identify?
- A municipal call center explains why mail and files shape Copilot answers for agents. Which influence should the explanation highlight?
- A county assessor's office connects Graph permissions reality to what a transit planner sees in Copilot. What connection is correct?
- Public hospital district IT must explain Graph's influence on Copilot without writing Graph API code. What fundamentals statement fits?
- A city clerk relates Copilot meeting and email summaries to underlying Microsoft 365 connectivity. Which influence should the clerk identify?
- A county public-health department wants layered controls that reduce Copilot risk around sensitive case content. Which control combination fits AB-900 fundamentals?
- A municipal permitting office explains layered protections against Copilot misuse of sensitive permit packets. What should the explanation emphasize?
- A 311 resident-services desk tightens library permissions on sealed complaint files and wants to know the Copilot effect. What should administrators expect?
- A transit authority maps which control families govern Copilot data risk in Microsoft 365. What should that map emphasize?
- A water utility applies responsible AI expectations to a permitting chatbot. Which principle set should leaders emphasize?
- An emergency-management office documents accountability for Copilot outputs used in public notices. What practice matches responsible AI?
- A housing authority rejects opaque AI advice for benefit eligibility without human review. Which responsible AI stance is that?
- A public library system maps responsible AI principles to municipal AI governance policy. What should that mapping support?
- A parks and recreation department uses Compliance Manager to see improvement actions for a privacy framework. What does Compliance Manager help identify?
- Municipal courts identify compliance risks and recommendations before a Copilot go-live. Which Purview experience supports that review?
- A fire department IT lead presents Compliance Manager scores to the risk committee. What do those scores help communicate?
- A police records bureau distinguishes Compliance Manager from Identity Secure Score. What difference should staff understand?
- A city open-data portal team uses Data Explorer to locate unmarked SSNs across municipal repositories. What capability are they using?
- School district IT identifies sensitive information sprawl before enabling Copilot broadly. Which Purview capability supports that discovery?
- County IT shared services explains Data Explorer as a discovery lens for sensitive content. What should that explanation emphasize?
- A port authority prioritizes libraries found via Data Explorer for labeling first. Why is that a sound governance step?
- Airport operations IT triages an Insider Risk alert about unusual downloads of resident files. What is Insider Risk Management designed to help identify?
- Wastewater treatment plant ops distinguishes insider risk signals from malware detections. What should they understand about Insider Risk Management?
- City council support staff escalates insider risk findings involving a departing systems admin. Which Purview capability surfaces that class of risk?
- A public works department explains what Insider Risk Management is designed to surface. Which description is accurate?
- An elections office responds when a clerk emails a spreadsheet of taxpayer IDs and a Purview alert appears. What should staff recognize?
- An animal control admin identifies and acknowledges Purview DLP alerts in the compliance workflow. What skill does that exercise?
- A building inspections unit studies why Copilot prompt content might relate to DLP concepts. What fundamentals idea should they keep?
- A social services casework office distinguishes DLP alerts from Communication Compliance conduct alerts. What distinction is correct?
- Municipal HR/payroll reviews a Communication Compliance policy violation in a crew Teams chat. What are they identifying?
- A city attorney's office identifies harassment or threat language flagged for supervisor review. Which Purview capability produces that class of finding?
- Planning and zoning explains Communication Compliance violations versus DLP sensitive-data hits. Which contrast is accurate?
- Stormwater management uses activity explorer to see labeling and DLP match activities by user. What does activity explorer help identify?
- A municipal call center needs to identify which staff recently performed labeling or protection activities on highly sensitive classified files. Which Purview experience surfaces those user activities?
- A county assessor's office explains activity explorer to auditors as a Purview reporting surface. What should that explanation emphasize?
- A public hospital district IT team discovers AI experiences interacting with confidential case libraries and wants to manage that posture. Which Purview capability is designed for discovering and managing AI activity?
- A city clerk wants to review AI application posture findings before expanding custom agents into more departments. What should the clerk use DSPM for AI to do?
- A county public-health department needs to identify which AI experiences interact with municipal sensitive sites. Which capability supports discovering that AI activity?
- A municipal permitting office must locate emails and files related to a public-records request topic across Microsoft 365. Which Purview eDiscovery capability should they use?
- A 311 resident-services desk needs one Purview search that can find relevant files across Exchange mailboxes and SharePoint libraries. Which capability fits?
- A transit authority expects that legal holds may follow an investigation and needs to search relevant Microsoft 365 content first. What should administrators understand about Content search?
- A water utility needs tools that reveal broadly shared links on a planning SharePoint site so oversharing can be fixed. What should administrators look for?
- An emergency-management office finds that everyone in the tenant can open a confidential folder and must troubleshoot the cause. Which approach aligns with AB-900 oversharing guidance?
- A housing authority hears surprising Copilot answers about sealed case files and wants to investigate oversharing before blaming Copilot itself. What should staff do first?
- A public library system teaches staff that oversharing often precedes surprising Copilot answers. What should that teaching emphasize?
- A parks and recreation department wants a SharePoint report on data access governance for the permits site collection. What should they run?
- Municipal courts want to find sites with too many Everyone links before a Copilot expansion. Which SharePoint reporting approach fits?
- A fire department IT lead must explain the purpose of SharePoint data access governance reports to leadership. Which explanation is accurate?
- A police records bureau prioritizes remediation from data access governance output before enabling Copilot widely. Why is that a sound sequence?
- A city open-data portal team considers SharePoint Advanced Management restricted access control for sensitive HR sites. What capability are they evaluating?
- School district IT needs SharePoint Advanced Management capabilities that help limit oversharing on sensitive libraries. Which description is accurate?
- County IT shared services explains restricted access control as a SharePoint Advanced Management-related governance feature. What should staff understand?
Perform basic administrative tasks for Copilot and agents · 56 questions
- A port authority compares built-in Microsoft 365 Copilot chat help with a custom permitting agent that can call line-of-business actions. What contrast should leaders draw?
- Airport operations IT needs drafting help in Word for a safety bulletin but also evaluates an agent that would call municipal APIs for live gate status. How should they compare the options?
- Wastewater treatment plant ops explains agents as extensible assistants beyond built-in Copilot skills. Which statement best captures that idea?
- City council support staff needs help drafting a briefing and does not require custom tool use or line-of-business actions. What should they choose?
- A public works department compares monthly Copilot licenses with pay-as-you-go for a short municipal AI pilot. What should the comparison emphasize?
- An elections office evaluates pay-as-you-go, including SharePoint scenarios, for bursty seasonal staff who may not need year-round Copilot seats. Which rationale is sound?
- An animal control admin explains when a city might prefer monthly Copilot subscription licenses over metered pay-as-you-go. Which rationale fits?
- A building inspections unit maps Copilot billing-model choice to budget-office constraints for a short pilot versus year-round supervisors. What should the comparison emphasize?
- A social services casework office needs to turn off a Copilot experience that is not approved for public-facing kiosks. What capability should admins use?
- Municipal HR / payroll wants to know which Copilot experiences administrators can toggle for the city tenant. Which statement is accurate?
- A city attorney's office wants Copilot in Teams meetings available first only for department leadership. How should that intent be framed at fundamentals depth?
- Planning and zoning reviews Copilot feature controls before a school-district expansion. What should they verify first?
- Stormwater management needs deep, multi-source research help for a long policy comparison brief. Which Copilot capability fits best?
- A municipal call center identifies when staff should use Researcher for multi-source municipal policy synthesis. Which scenario fits?
- A county assessor's office needs grounded long-form investigation help rather than a quick rewrite. What should staff pick?
- Public hospital district IT contrasts Researcher with quick Copilot chat for a one-line rewrite of a short notice. Which contrast is sound?
- A city clerk wants help exploring a CSV of 311 ticket volumes for operational insights. Which Copilot capability fits best?
- A county public-health department identifies Analyst use cases for municipal data exploration. Which scenario fits Analyst?
- A municipal permitting office needs reasoning over tabular operational data rather than a multi-source policy research brief. What should staff choose?
- A 311 resident-services desk designs an assistant that answers permit status from approved knowledge and may call tailored actions. Which option fits?
- A transit authority needs a city API tool that built-in Copilot does not provide. Which use case applies?
- A water utility scopes a parks FAQ assistant that must answer only from curated municipal content. What should they build?
- An emergency-management office must grant Copilot to the first cohort of permitting supervisors. What basic admin task applies?
- A housing authority wants to grant Copilot to library staff using group-based licensing concepts. Which approach is sound?
- A public library system sees Copilot unavailable for some clerks and wonders whether to blame feature toggles first. What should admins verify early?
- Parks and recreation must remove Copilot access from departed seasonal workers promptly. Which admin action fits?
- Municipal courts plan Copilot license assignment waves aligned to training completion. Why is that approach sound?
- Fire department IT must keep a Copilot pay-as-you-go pilot from overrunning budget. What should they monitor and manage?
- A police records bureau manages metered Copilot usage for SharePoint-heavy scenarios. Which admin focus is appropriate?
- A city open-data portal team wants guardrails on pay-as-you-go before opening Copilot access citywide. What should they do?
- School district IT and finance disagree about who owns Copilot pay-as-you-go billing policy decisions. Which fundamentals framing is correct?
- County IT shared services wants staff to treat pay-as-you-go policy monitoring as a routine Copilot admin duty. Which statement is correct?
- After Copilot go-live, a port authority needs to watch adoption trends for municipal staff. Where should admins look for usage and adoption insights?
- Airport operations IT wants to see which municipal departments actually use Copilot after rollout. Which approach matches fundamentals guidance?
- Wastewater treatment plant ops must justify the next Copilot licensing wave to municipal finance. Which evidence best supports the request?
- City council support staff see low Copilot adoption in public works after licenses were assigned. What should they do next?
- Public works wants staff to reuse a vetted prompt for drafting standard public-meeting summaries. Which prompt management action fits?
- An elections office built a vetted prompt gallery and wants housing caseworkers to use the same approved wording. Which action is appropriate?
- Animal control needs a recurring prompt-driven briefing for emergency ops leadership each morning. Which prompt capability should the admin use?
- Building inspections still has saved prompts that reference retired fee schedules. What should admins do?
- Social services is publishing a new permitting status agent and must control who can use it. Which admin task comes first?
- Municipal HR/payroll built an agent that should only be invoked by trained 311 agents. Which access approach is correct?
- The city attorney's office insists on access configuration before an agent goes citywide. Why is that guidance sound for AB-900 fundamentals?
- Planning and zoning is reviewing guest access rules for an internal staff-only agent. Which statement is correct?
- Stormwater management needs a parks FAQ agent grounded only on approved SharePoint content. Which create-an-agent approach fits?
- A municipal call center wants its first agent to answer after-hours trash collection questions. What should makers do?
- A county assessor's office asks whether creating an agent is part of basic Copilot and agent administration. Which answer is correct?
- Public hospital district IT is creating an agent and must limit risky answers. Which create-time practice is appropriate?
- A city clerk built an agent and wants it available to all staff. What must happen first?
- County public-health leaders ask why agents need review before wide use in the city tenant. Which explanation is best?
- A municipal permitting office finished building a new agent. What should it do before staff rely on it in production?
- A 311 resident-services desk has both draft agents and approved production agents. How should staff treat them?
- After launch, a transit authority needs to watch how its new agent is performing. Which admin practice fits?
- A water utility needs to review whether municipal agents are still active, unused, or otherwise mid-lifecycle. Where should admins look conceptually?
- Emergency-management needs operational monitoring awareness for agents beyond Microsoft 365 admin center alone. Which additional admin center concept is in scope?
- A housing authority finds an unused agent that still has broad access. What should admins do as part of lifecycle monitoring?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by Microsoft.