Microsoft AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals Exam Practice Test

The correct answer is adding a public DNS record . Microsoft documents that when you add a custom domain to Microsoft 365, you must first prove ownership of that domain before Microsoft 365 can use it for services such as Exchange Online, SharePoint, and user sign-ins. The standard verification method described by Microsoft is to add a DNS record at your domain registrar or DNS hosting provider. Microsoft commonly uses a TXT record for verification, although in some cases an MX record can also be used depending on the setup flow. This is why “adding a public DNS record” is the right completion for the sentence.

The other choices are not the standard Microsoft 365 domain verification process. Microsoft’s admin guidance does not use confirming your business address , uploading a certificate , or uploading a webpage as the normal method for proving ownership of a domain in Microsoft 365. Domain verification is specifically tied to DNS because DNS is the authoritative public system used to prove control over the domain name.

The correct selections are The Microsoft 365 admin center and A billing policy . Microsoft documents that Microsoft 365 Copilot pay-as-you-go is administered in the Microsoft 365 admin center , specifically under Copilot > Billing & usage , where admins create and manage billing policies . Microsoft explains that a billing policy defines the billing infrastructure for pay-as-you-go, including the Azure subscription and the set of users covered by that policy. That user scoping is what allows organizations to separate usage and spending by groups such as departments.

Microsoft also documents that billing policies support budgets , spending views , and monitoring current expenses for services linked to the policy. This supports the requirement for greater visibility into Copilot usage costs and forecasting departmental spending. By assigning different departments to different billing policies, the organization can track Copilot costs by department. The other listed features do not fit: auto-claim policy is unrelated to cost tracking, and Copilot connector is for external data grounding, not billing segmentation.

The correct answer is accountability . Microsoft’s Responsible AI framework is built on six principles: fairness , reliability and safety , privacy and security , inclusiveness , transparency , and accountability . Microsoft describes accountability as the principle that people who design and deploy AI systems must remain responsible for how those systems operate and for the impacts they create. A key part of that principle is ensuring there is human oversight so humans remain in control of decisions and system behavior.

The other options do not match the wording in the sentence as closely. Transparency focuses on helping people understand how AI systems work and why they produce certain outcomes. Privacy and security is about protecting data and securing systems. Reliability and safety is about dependable and safe operation. Inclusiveness is about designing AI that empowers and includes people broadly. The principle tied to oversight, responsibility, and keeping humans in control is accountability .

The correct answer is B. the Microsoft 365 admin center . Microsoft documents that administrators assign product licenses to users from the Microsoft 365 admin center , including on the Active users page where you can open a user account and manage Licenses and apps . Microsoft also documents license assignment workflows there for both direct assignment and group-based licensing scenarios. That makes the Microsoft 365 admin center the standard administrative portal for giving a user access to Microsoft 365 services and features.

The other options are incorrect for this task. The Microsoft Purview portal is used for compliance, governance, data protection, eDiscovery, audit, and related Purview solutions, not for assigning Microsoft 365 product licenses. The Microsoft Teams admin center is used to manage Teams settings, policies, devices, voice, and collaboration features, but it is not the central portal for assigning tenant product licenses to users.

Therefore, when the requirement is simply to assign a license to a user in a Microsoft 365 subscription, Microsoft’s documented answer is the Microsoft 365 admin center .

The correct answer is Microsoft 365 Copilot . Microsoft Learn states that Restricted SharePoint Search (RSS) gives organizations time to review and correct permissions on SharePoint sites, and then add only those reviewed sites to an allowed list that Copilot can access . That means RSS is specifically about restricting Copilot’s access to SharePoint content, not blocking administrators, guest users, or Microsoft Purview eDiscovery from those sites.

This distinction is important. Microsoft explains that users can still access SharePoint content based on their normal permissions, while RSS limits what Microsoft 365 Copilot can use as grounding data until site permissions are reviewed and approved. So the feature helps reduce oversharing risk in Copilot without removing a user’s direct ability to find or open content they already have permission to access in SharePoint. In other words, the restriction is placed on Copilot’s searchable grounding scope , not on the user’s own SharePoint permissions. That is why the sentence is correctly completed with Microsoft 365 Copilot .

The correct answer is D. a sensitivity label policy . In Microsoft Purview, creating a sensitivity label by itself does not make it available to users. Microsoft Learn states that after you create sensitivity labels, you must publish them by creating a label policy so that users and groups can see and apply those labels in Microsoft 365 apps and services. Publishing controls which labels are available and to whom they are shown. This is why a sensitivity label policy is required to ensure that users can apply Label1 to files.

The other options do not meet the requirement. Auto-labeling policies apply labels automatically when content matches conditions, but they are not the primary mechanism for simply making a label available for user selection. A trainable classifier is used to identify content categories, not to publish a label. A retention label policy publishes retention labels for records and lifecycle purposes, which is different from sensitivity labeling for classification and protection. Therefore, the correct Microsoft-documented method to let users apply Label1 to files is to publish it using a sensitivity label policy .

Microsoft Defender for Office 365 provides protection from phishing and malware attacks. Answer: Yes

Microsoft Defender for Identity monitors identities in Active Directory domains. Answer: Yes

Microsoft Defender Vulnerability Management provides protection for software as a service (SaaS) applications. Answer: No

The correct selections are Yes, Yes, No . Microsoft documents that Microsoft Defender for Office 365 protects email and collaboration workloads from threats such as phishing and malware , including zero-day malware and business email compromise scenarios. That makes statement 1 Yes .

Statement 2 is also Yes because Microsoft states that Microsoft Defender for Identity monitors identity signals from on-premises Active Directory and related identity infrastructure to detect suspicious activity and identity-based attacks. Microsoft further describes monitoring information generated from your organization’s Active Directory, network, and event activities.

Statement 3 is No because Microsoft Defender Vulnerability Management is focused on discovering and prioritizing vulnerabilities across devices and assets such as Windows, macOS, Linux, mobile platforms, and network devices. Microsoft’s SaaS application protection offering is Microsoft Defender for Cloud Apps , not Defender Vulnerability Management.

The correct answer is are NOT assigned a Microsoft 365 Copilot license. Microsoft’s official reporting guidance explains that the Copilot credits report is used to manage metered consumption costs for Microsoft 365 Copilot Chat. The purpose of this report is to show credit consumption tied to pay-as-you-go billing policies, including metrics such as total credits used and credits used per user, per agent, and per billing policy. Microsoft’s Copilot analytics documentation further defines these credit-related metrics around Copilot Chat users, which are users with a Microsoft 365 license but without a Microsoft 365 Copilot license who consume credits while using agents.

Because licensed Microsoft 365 Copilot users are generally covered by their Copilot entitlement for included agent usage, the credits report is intended to track the metered agent usage scenario for users who are not assigned a Microsoft 365 Copilot license and who interact with work-grounded agents in Microsoft 365 Copilot Chat. That is why this option correctly completes the sentence.

The correct answer is D. From the Finance site, configure permissions . Microsoft states that Microsoft 365 Copilot honors existing Microsoft 365 permissions and only grounds responses in content that the signed-in user is already allowed to access. That means if users are getting Finance-site content in Copilot responses, those users likely still have permission to that SharePoint content. The direct fix is to review and correct the site, library, folder, or file permissions on the Finance site so only the intended users retain access.

The other options do not directly solve this requirement. Information Barriers are designed for communication and collaboration segmentation scenarios, not for ordinary site-level oversharing remediation. A Defender data connector is unrelated to SharePoint permission enforcement. Conditional Access controls sign-in and session access conditions, but it does not selectively remove Copilot grounding from one SharePoint site for users who still have site permissions. Because Copilot uses SharePoint and Microsoft Graph permissions as its boundary, the Microsoft-documented corrective action is to fix the Finance site permissions .

The correct answers are C and D . Microsoft Learn explains that agents created with Agent Builder in Microsoft 365 Copilot allow you to define specific instructions that extend Microsoft 365 Copilot for a business scenario. Microsoft also documents that you can add knowledge sources such as specific public websites and SharePoint content so the agent can reason over targeted information instead of relying only on the default chat experience. Those two capabilities directly match the needs in options C and D.

Option A is incorrect because grouping chats is a Copilot notebook scenario, not the reason to build an agent. Option B is incorrect in the context of creating an agent in the Microsoft 365 Copilot app . Agent Builder supports declarative agents with instructions, knowledge, and capabilities, but Microsoft Learn describes custom AI model control as part of custom engine agents built with tools such as Copilot Studio, SDKs, or Foundry, not as a standard Agent Builder feature in the Microsoft 365 Copilot app. Therefore, when the task is specifically to create an agent in the app, the valid reasons are custom instructions and reasoning over a specific website .

In Microsoft 365 Copilot, you should use the Researcher agent to perform multi-step reasoning over unstructured data.

The correct answer is the Researcher agent . Microsoft describes Researcher in Microsoft 365 Copilot as an agent for complex, multi-step research that can reason across information sources and synthesize findings into structured outputs. That aligns with the phrase multi-step reasoning in the question. Microsoft’s guidance also contrasts Researcher with Analyst , which is aimed more at data analysis and spreadsheet-oriented tasks.

The other options are less suitable. Chat is general-purpose and not the specialized tool Microsoft positions for deeper multi-step research workflows. A notebook is used to organize materials and chats, not as the main reasoning engine for this scenario. The Analyst agent is better suited to structured data analysis, trends, and calculations rather than broad reasoning over unstructured data such as documents, notes, and mixed content. Based on Microsoft’s product positioning, the best fit for multi-step reasoning over unstructured information is the Researcher agent .

The correct answer is B. data loss prevention (DLP) policies . Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices . Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.

Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft’s documented solution is DLP policies .

The correct answer is D. an app registration . Microsoft Learn states that to delegate identity and access management functions to Microsoft Entra ID , an application must be registered with a Microsoft Entra tenant . When you register an application, you create its identity configuration in Microsoft Entra, and a corresponding service principal is created so the application can authenticate and integrate with the tenant. This is the standard Microsoft mechanism for allowing a third-party cloud service or app to authenticate to Microsoft Entra.

The other options do not provide the app identity required for authentication. Multifactor authentication (MFA) strengthens user sign-ins, but it does not onboard a third-party service as an application identity in Entra. Conditional Access enforces access policies after authentication and authorization decisions are being made; it does not create the application identity itself. A Microsoft 365 Copilot connector is used to bring external data into Microsoft 365 experiences, not to let a third-party cloud service authenticate to Microsoft Entra. Therefore, the correct configuration is an app registration .

The correct answer is Require multifactor authentication for administrative roles . In the exhibit, each recommendation shows its available Secure Score points . The listed values are 1/1 for Use least privileged administrative roles , 8/8 for Do not expire passwords , 0.73/8 for Enable policy to block legacy authentication , and 0/10 for Require multifactor authentication for administrative roles . Because 10 points is the highest value among the options shown, resolving that recommendation would improve the Identity Secure Score the most.

Microsoft Learn explains that Identity Secure Score in Microsoft Entra is based on Microsoft security recommendations, and each recommendation contributes a specific number of points depending on its impact and implementation state. Recommendations related to administrator protection are especially important because privileged accounts are high-value attack targets. Microsoft also emphasizes multifactor authentication for admin roles as a core identity security best practice. Therefore, both from the screenshot and from Microsoft’s identity guidance, the recommendation with the greatest score improvement is Require multifactor authentication for administrative roles .

provide control over how users can access cloud apps.

The correct answer is provide control over how users can access cloud apps . Microsoft Learn defines Microsoft Entra Conditional Access as the Zero Trust policy engine that uses if-then logic to make access decisions. Microsoft states that Conditional Access policies determine who can access resources, what resources they can access, and under what conditions . These policies can require actions such as multifactor authentication, compliant devices, or other controls before allowing access to applications and services like Microsoft 365. That means Conditional Access is specifically used to control how users access cloud apps .

The other options are incorrect. Conditional Access policies are not configured by using the Microsoft Defender portal ; they are managed in the Microsoft Entra admin center . They are also not applied only to on-premises resources , because Microsoft documents Conditional Access primarily for cloud identities, cloud apps, and cloud-connected resources. Finally, Conditional Access does not require a Microsoft Exchange mailbox. It can be applied broadly across many Microsoft and third-party cloud applications integrated with Microsoft Entra.

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft documents that Agent Builder in Microsoft 365 Copilot is included with the Microsoft 365 Copilot license , and agents built with that feature are part of that licensed experience. Microsoft also states that the capability is enabled by default in Microsoft 365 Copilot licensed tenants . While Copilot Chat users with qualifying Microsoft 365 licenses can access web-grounded chat experiences, creating Microsoft 365 Copilot agents in the app is documented under the Copilot-licensed Agent Builder experience, not as an E5-only entitlement.

Statement 2 is Yes because Microsoft states that Researcher and Analyst were deployed to users with Microsoft 365 Copilot licenses . Statement 3 is Yes because Microsoft says users can build agents in Agent Builder by using natural language or manually .

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft documents tenant controls for web search on or off , but not a general Microsoft 365 Copilot setting to block only selected websites for normal Copilot responses. Microsoft also says it doesn’t recommend or support managing Copilot through selective URL or domain blocking at the network level. Website allow/block lists shown in Microsoft documentation apply to Researcher with Computer Use virtual-device settings, not to standard Microsoft 365 Copilot web grounding overall.

Statement 2 is Yes because Microsoft provides the Allow web search in Copilot policy in Cloud Policy service and in the Microsoft 365 admin center, which can disable web search for Microsoft 365 Copilot and Copilot Chat.

Statement 3 is Yes because Microsoft states that admins can block Researcher and Analyst , and agent governance includes a Block action. Microsoft also notes that for Researcher and Analyst, user scoping isn’t edited through the usual panel; availability is managed by blocking the selected agent at the tenant level.

The correct answer is eDiscovery . In Microsoft Purview, eDiscovery is the solution used to search for content and export copies of that content from Microsoft 365 locations such as SharePoint and OneDrive. Microsoft Learn states that when you export search results from eDiscovery, copies of native Office documents and other documents are exported . That directly matches the requirement to provide HR with a copy of files .

By contrast, Audit is primarily used to investigate user and admin activity records and can export those audit records to CSV , but it does not export the actual files themselves. Audit would help identify that User1 modified files, but the question asks for copies of the recent files modified by User1 , which is an eDiscovery content search and export scenario rather than an activity-log reporting scenario.

So, among the Microsoft Purview solutions shown, the appropriate selection is eDiscovery because it is the Purview tool designed to find and export the actual content items HR wants to receive.

The correct selections are No, No, Yes . Microsoft states that in Microsoft 365 Copilot and Microsoft 365 Copilot Chat, prompts and responses aren’t used to train the underlying foundation models . Microsoft also documents that Copilot works within the Microsoft 365 service boundary and that data accessed through Microsoft Graph isn’t used to train foundation models . That makes statements 1 and 2 No .

Statement 3 is Yes because Microsoft documents that Microsoft 365 Copilot honors the same data protection, access control, and compliance capabilities that apply across Microsoft 365. Microsoft also states that Copilot only surfaces organizational data that users already have permission to access, including content retrieved through Microsoft Graph in services such as SharePoint, OneDrive, Exchange, and Teams.