AB-900 Exam Guide 2026: Copilot and Agent Administration Fundamentals
Microsoft’s newest fundamentals exam is not the gentle introduction the label suggests. Here is what AB-900 actually tests, in the official weights, and how to prepare for a 45-minute paper that spans six admin centres.
On this page
Microsoft shipped AB-900 as a fundamentals exam, and a lot of people are booking it on that basis alone. That is a mistake worth catching early. The credential is Microsoft 365 Certified: Copilot and Agent Administration Fundamentals, and unlike the fundamentals exams you may have taken before, it is built around administering an AI-enabled tenant rather than describing what the products do.
This brief is built directly against the official skills-measured document as published on 22 July 2026. Microsoft revises these lists without much fanfare, so check the stamp at the top of this page against the study guide before you sit the exam.
What AB-900 actually certifies
The audience profile is explicit: you should already be familiar with Microsoft 365 core services, security, identity and access, data protection and governance, plus Microsoft 365 Copilot and agents. It also names the admin centres you are expected to know your way around — Microsoft 365, Exchange Online, SharePoint, Teams, Microsoft Entra and Microsoft Purview.
Read that list again. Six admin centres, in a 45-minute fundamentals exam. That scope is the single most important thing to understand about AB-900, and it is why candidates who prepare as though it were AI-900 with a Copilot skin tend to come out short.
AB-900 is not “what is Copilot?”. It is “your tenant now has Copilot and agents in it — can you keep it licensed, governed and not oversharing?”
Exam format at a glance
The exam is proctored and may include interactive components. Microsoft does not publish a fixed question count, which is normal for its fundamentals line — plan for a brisk pace rather than a specific number. At launch it is offered in English only; if you sit an exam in a language other than your first, you can request an additional 30 minutes.
On price, Microsoft states only that it is “based on the country or region in which the exam is proctored” and does not publish a single global figure on the certification page. Fundamentals exams are commonly USD $99, but published third-party figures for AB-900 disagree with each other, so treat the Pearson VUE checkout for your own country as the only authoritative number.
There is a free practice assessment on Microsoft Learn that mirrors the style and difficulty of the real questions, and an exam sandbox that lets you interact with the question types in the real interface before exam day. Both are free and both are underused. Work through the practice assessment until you are consistently clearing 85 percent.
The three domains and their weights
Three domains, and the distribution is where the surprise lives:
The domain most people assume is the core of the exam — actually administering Copilot and agents — is the smallest of the three. The largest is data protection and governance, which is fundamentally a Microsoft Purview domain.
Domain 1 — Core features and objects (30–35%)
Three clusters here. First, core objects: how license types assigned to users and groups affect feature access, org configuration in the Microsoft 365 admin center, mailboxes and distribution groups in Exchange, sites and libraries in SharePoint, and teams, channels and policies in the Teams admin center. Second, security principles: Zero Trust, authorisation, authentication methods, threat protection and Microsoft Defender XDR. Third, core security features: Microsoft Entra ID, conditional access, single sign-on, Identity Secure Score, audit logs, Privileged Identity Management, and the difference between app registrations and enterprise apps.
Domain 2 — Data protection and governance (35–40%)
The heavyweight. You need conceptual command of the Purview family: Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Security Posture Management (DSPM) for AI, and Data Lifecycle Management. Then sensitivity label use cases, data classification and retention.
It also asks something more interesting: how Copilot accesses data, how Microsoft Graph shapes Copilot responses, and how existing Microsoft 365, Purview and Defender permissions constrain what Copilot can surface. Plus responsible AI principles.
Finally, an entire sub-objective on oversharing in SharePoint — the tools to troubleshoot it, running a data access governance report, and SharePoint Advanced Management including restricted access control. Oversharing is the number-one practical failure mode of a Copilot rollout, and Microsoft has made it explicitly testable.
Candidates revise Copilot features and skim Purview. The weights say do the opposite. If your study time is limited, spend it on sensitivity labels, DLP, Insider Risk Management, DSPM for AI and SharePoint oversharing controls — that cluster alone is close to 40 percent of your score.
Domain 3 — Copilot and agent administration (25–30%)
Comparing built-in Copilot capabilities against agents, the monthly licence model versus pay-as-you-go (including for SharePoint), which Copilot features can be enabled or disabled, and use cases for Researcher, Analyst and custom agents. On the task side: assigning Copilot licences, monitoring pay-as-you-go billing policies, tracking usage through Copilot Analytics, managing prompts, configuring user access to agents, creating an agent, the agent approval process, and monitoring agent lifecycle across the Microsoft 365 and Power Platform admin centres.
We break this domain down objective by objective in a companion brief: AB-900 domain 3 deep dive.
Why “fundamentals” is misleading here
Microsoft's fundamentals line has trained everyone to expect a conceptual, definition-heavy exam you can pass on a weekend. AB-900 breaks that pattern in three ways.
| Expectation from other fundamentals | What AB-900 does instead |
|---|---|
| Product awareness — “what is this service?” | Administration — which admin centre, which object, which report |
| One product family in scope | Microsoft 365, Entra, Purview, Defender, Teams, SharePoint, Exchange, Power Platform |
| Generous time relative to scope | 45 minutes across that entire surface |
| The headline topic is the biggest domain | Copilot administration is the smallest domain at 25–30% |
None of this makes AB-900 an associate-level exam. The questions stay at a recognition and comprehension level rather than asking you to design a configuration. But the breadth is unusual, and breadth under time pressure is what catches people.
Who should take it — and who should skip it
Take it if you are a Microsoft 365 administrator, helpdesk lead or IT generalist whose tenant is switching Copilot on this year. The exam maps almost exactly onto the questions you will be asked in the first six months of a rollout: who gets a licence, what will Copilot surface that it should not, and how do we monitor agents people are building.
Take it if you are in a governance, risk or compliance seat and need enough Purview and Copilot literacy to hold your end of a rollout conversation.
Skip it if you are a developer building agents rather than administering them — that is closer to MB-820 territory. Skip it if you have no Microsoft 365 exposure at all; start with MS-900 and come back.
Where it sits against neighbouring exams
| Exam | Centre of gravity | Take it when |
|---|---|---|
| MS-900 | Microsoft 365 product and licensing awareness | You are new to the Microsoft 365 stack |
| AI-900 | Azure AI service concepts | You want AI literacy, not tenant administration |
| SC-900 | Security, compliance and identity concepts | You want the security-side vocabulary |
| AB-900 | Administering Copilot and agents in a live tenant | Your organisation is deploying Copilot now |
If you are weighing several of these, the certification comparison tool puts them side by side, and the roadmap tool shows what each one unlocks next.
A three-week study plan
Assumes six to eight hours a week and existing Microsoft 365 familiarity. If you are starting colder, stretch it to five weeks rather than cramming.
Two habits pay off disproportionately. First, whenever you learn a capability, force yourself to name which admin centre it lives in — a large share of questions resolve to exactly that. Second, keep a running list of the Purview products and write one plain sentence for each on what problem it solves; the exam leans hard on telling them apart.
Want a personalised schedule instead? The study-time calculator will size the plan against your actual weekly hours and starting experience.
Frequently Asked Questions
How long is the AB-900 exam?
You get 45 minutes. It is a proctored exam delivered through Pearson VUE, or through Certiport if you are a student or educator. A score of 700 or greater is required to pass.
Are there prerequisites for AB-900?
No formal prerequisites. Microsoft expects familiarity with Microsoft 365 core services and the admin centres for Exchange, SharePoint, Teams, Entra and Purview, plus some exposure to Copilot and agents.
Does the AB-900 certification expire?
No. AB-900 is a fundamentals certification, and fundamentals credentials do not expire. Microsoft's annual free renewal requirement applies to associate, expert and specialty certifications only.
Is AB-900 harder than MS-900 or AI-900?
Most candidates find it harder. MS-900 and AI-900 test product awareness, while AB-900 is administration-focused and its heaviest domain is data protection and governance at 35 to 40 percent.
Practise AB-900 Before You Book
500–1,000+ practice questions per exam with worked explanations, across Microsoft, AWS, GCP, AI and security certifications.
Browse All Exams
Practice Before You Book
500–1,000+ practice questions per exam with detailed explanations, across Azure, AWS, GCP, security, and AI certifications.