The AB-900 exam, Microsoft 365 Certified: Copilot and Agent Administration Fundamentals, is Microsoft's entry level credential for supporting, securing, and governing an AI enabled Microsoft 365 tenant, current as of the July 22, 2026 skills update. It targets beginning IT pros who need to identify core Microsoft 365 objects and admin centers, apply Zero Trust and Microsoft Entra ID security principles, use Microsoft Purview to protect and govern the data that Copilot touches, and perform basic administrative tasks for Copilot licensing, prompts, and custom agents. The exam runs 45 minutes, requires a 700 out of 1000 passing score, and as a Fundamentals certification never expires. Most candidates underestimate the Purview layer, which carries the single largest exam weight: the real test isn't knowing that Purview protects data, it's knowing which specific tool (DLP, Insider Risk Management, Communication Compliance, DSPM for AI, or Compliance Manager) surfaces which specific risk, since the exam grades that exact mapping rather than generic data protection theory.
What This Cheat Sheet Covers
This topic spans 20 focused tables and 199 indexed concepts, 190 flashcards, 6 practice tests with 250 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Microsoft 365 Licensing and Tenant Configuration
Covers the AB-900 task Identify the core objects of Microsoft 365 services: how license types assigned to users and groups (including Copilot) gate access to Microsoft 365 features, and how the Microsoft 365 admin center's domain and organization settings configure the tenant itself.
| Concept | Example | Description | |
|---|---|---|---|
In Billing > Licenses, select a product, add a user, then toggle which apps and services they get before selecting Assign. | • A license must be assigned (directly or via a group) before a user can open its apps. &bull • Not the same as an admin role, which grants management permissions, not app access | ||
Assign the E5 license to the Sales-All security group; every current and future member gets it without per-user reassignment. | • License changes track group membership automatically once assigned (processing time varies, isn't instant). &bull • Doesn't support nested groups, only first-level members get licensed. &bull • Add a user to the new group before removing them from the old one to avoid a licensing gap | ||
On a user's Licenses row, deselect Yammer while keeping Exchange Online and Teams enabled from the same E3 license. | • A license (SKU) bundles individual service plans • an admin can turn any one off per user or group without removing the whole license | ||
Errors & Issues shows Conflicting services or license plans for a user; fix the conflict, then select Reprocess to retry. | • The Errors & Issues tab explains failed assignments (no licenses left, conflicting plans, an invalid usage location) • fix the cause, then Reprocess, don't reassign from scratch | ||
A Business Standard tenant buys the Microsoft 365 Copilot add-on, then assigns it to specific users from Billing > Licenses. | • A paid add-on layered on an eligible base plan (E3, E5, Business Standard, and others) • the base plan alone doesn't include full Copilot access | ||
Web-based Copilot Chat answers from the open internet at no cost; work-based chat that reads a user's own mail needs the paid Copilot license. | • Web-based chat is included free with any eligible subscription • work-based chat (grounded in the tenant's own content) needs the Microsoft 365 Copilot add-on license | ||
Add contoso.com under Settings > Domains, then verify ownership by adding the TXT record the wizard provides. | • Verified with a TXT record before any other DNS records are added. &bull • Add users and mailboxes in Microsoft 365 before pointing the domain's MX record there, to avoid a gap in incoming mail | ||
Settings > Org settings > Organization profile holds the tenant's name, address, and technical contact info. | Tenant-wide organization details and release preferences live here, separate from Domains (custom domain names) and Users (individual accounts) elsewhere in Settings. | ||
Set Targeted release for selected users under Organization profile > Release preferences so IT pros see new features first. | • Standard release (default) is the broad rollout • Targeted release opts specific users or the whole org into early access • switching back to Standard can drop features that haven't reached Standard release yet |