Microsoft 365 Copilot and Agent Administration Fundamentals (AB-900) — Practice Questions and Mock Exam

The AB-900 exam, Microsoft 365 Copilot and Agent Administration Fundamentals, validates foundational knowledge of supporting, securing, and protecting an AI-enabled Microsoft 365 environment. It is built for administrators and IT professionals who work with Microsoft 365 core services, security, identity and access, data protection and governance, and with Microsoft 365 Copilot and agents.

The exam is organized into three areas: identifying the core features and objects of Microsoft 365 services (30-35%), understanding data protection and governance tasks for Microsoft 365 and Copilot (35-40%), and performing basic administrative tasks for Copilot and agents (25-30%). The heaviest weighting sits on data protection and governance, reflecting how much Copilot administration depends on Microsoft Purview and controlling how Copilot accesses organizational data.

Data protection and governance is the heaviest domain at 35–40%, testing how Microsoft Purview's sensitivity labels, DLP, Insider Risk Management, and retention tools apply to Copilot, plus how Copilot inherits Microsoft Graph permissions and where SharePoint oversharing becomes a Copilot exposure risk. Core Microsoft 365 features and security fundamentals (licensing, admin centers, Zero Trust, Entra ID, conditional access) follow at 30–35%. Basic Copilot and agent administration (licensing, usage monitoring, agent access and approval) closes the blueprint at 25–30%.

The weighting reflects the exam's concern: an administrator who can turn Copilot on is less useful than one who understands what data it can reach and how to govern that access.

AB-900 draws 40–60 questions in a 45-minute window, weighted toward multiple-choice with a meaningful share of multiple-response, drag-and-drop, and dropdown-selection items. A score of 700 or higher on a 1000-point scale is required to pass. Most questions cover generally available Microsoft 365 and Copilot features; preview capabilities appear only where they're already in common use.

Every domain of the AB-900 exam has enough questions in the pool to practice it in depth. A mock exam asks 50 questions in one sitting, on the same 45-minute clock as the real thing.

How long you'll need depends on how much hands-on experience you bring. The rest is set by the vendor: how the exam is delivered, how soon you can retake it, and how long the credential stays valid.

AB-900 runs through Pearson VUE, either online with a remote proctor or at a test center; students and educators can also take it through Certiport. As a Fundamentals-level certification, it does not expire and carries no renewal requirement.

Candidates most often lose points where Microsoft 365 governance concepts overlap. The biggest trap is treating Microsoft Purview capabilities as interchangeable: sensitivity labels (Information Protection), Data Loss Prevention, Insider Risk Management, and retention each solve a different problem, and the exam probes which one fits a scenario. A second common miss is how Copilot accesses data: Copilot honors existing Microsoft 365 permissions and Microsoft Graph, so oversharing in SharePoint becomes a Copilot data-exposure risk, not a separate Copilot setting. Finally, candidates confuse the two Copilot commercial models, per-user monthly licensing versus usage-based billing, and mix up where agents get administered, the M365 admin center versus the Power Platform admin console.