The AB-730 exam certifies that you can put Microsoft 365 Copilot and its agents (like Researcher and Analyst) to real business use without writing a line of code. It tests three areas: understanding what generative AI inside Microsoft 365 can and cannot safely do, running prompts and conversations day to day, and turning that output into finished documents, summaries, and meeting notes. The exam is a 45 minute proctored assessment through Pearson VUE. The trap most candidates hit is treating Copilot like a search engine instead of a grounded collaborator, so this sheet leans hard on data protection, response grounding, and the exact verbs (save, schedule, share) Microsoft expects a candidate to know cold.
What This Cheat Sheet Covers
This topic spans 10 focused tables and 86 indexed concepts, 78 flashcards, 3 practice tests with 115 questions. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Copilot Data Privacy, Security & Response Grounding
Microsoft Certified: AI Business Professional (AB-730), Understand generative AI fundamentals, Understand generative AI capabilities across Microsoft 365 experiences: how Copilot keeps organizational data private and secure through permission scoped access, and how context, your files, web content, and the app you're in, shapes what Copilot grounds a response in.
| Concept | Example | Description | |
|---|---|---|---|
A user with no SharePoint access to a payroll file gets zero payroll detail from Copilot, even after that file appears in the tenant's search index. | • Copilot only surfaces Microsoft Graph content (files, chats, email) the signed in user already has permission to view • it never grants tenant wide visibility or new access • Not to be confused with indexing, which only affects discoverability | ||
Prompting "Summarize this document" while a Word file is open grounds the answer in that file's real content, not a generic response. | The step that combines a prompt with content Copilot can access (files, chats, emails, and optionally the web) so the LLM reasons over specific, relevant context rather than the prompt alone. | ||
A confidential merger memo processed by Copilot never resurfaces as training data the model later draws on for a different tenant's prompt. | • Prompts, responses, and Graph data used by Copilot are never used to train the underlying foundation LLMs • this applies by default to every tenant, with no separate purchase required | ||
The tenant level index maps an approved expense report's content, but a user without file access still gets no results for it from Copilot. | • An always on, organization wide vector index built from Microsoft Graph content that improves grounding relevance • it does not create new access rights and still enforces role based access control | ||
A regulated tenant relies on Copilot honoring the same Data Protection Addendum commitments already covering its other Microsoft 365 content, with no new contract to sign. | The contractual and technical commitments, under the Data Protection Addendum and Product Terms, that keep Copilot activity inside the existing Microsoft 365 service boundary and compliance posture. | ||
Asking Copilot to compare an internal strategy memo to a competitor's public stance sends only a short query like "Fabrikam clean energy policy" to Bing, never the memo. | A toggleable feature where Copilot sends a short, generated search query, never the full prompt or a whole document, to Bing to ground a response in current public information. | ||
A user opens My Account, reviews last week's Copilot prompts, and deletes the entire history in one action. | • The stored, encrypted record of a user's prompts and Copilot's responses, viewable and deletable by that user in My Account. • Never used to train foundation LLMs; admins can separately apply retention policies. | ||
A device already blocked from Outlook by a Conditional Access policy is blocked from Copilot the same way, with no separate rule needed. | Copilot authenticates through the tenant's existing Microsoft Entra ID, so Conditional Access policies and MFA requirements already configured apply to Copilot automatically. | ||
Pasting a SharePoint folder's URL into a prompt narrows Copilot's answer to files in that folder instead of the whole tenant index. | Referencing a specific library, folder, or document in a prompt scopes grounding to that location, adding its column metadata as a signal alongside file content to sharpen relevance. |