Microsoft AB-900: Understanding Copilot Admin Foundations

Copilot administration begins with infrastructure that predates Copilot. If an administrator cannot explain the difference between a SharePoint site and a library, how a user gets a license, or why a Conditional Access policy affects sign-in, managing an AI-enabled Microsoft 365 environment becomes guesswork. Microsoft AB-900 establishes those foundations and connects them to Copilot and agent governance.

The exam is active as of October 8, 2026. Microsoft has announced an October 14, 2026 update to the English-language objectives, so candidates should check the current study guide against their intended exam date. A scheduled update must not be mistaken for an update already in force.

Know which service owns which object

Microsoft 365 includes several administrative boundaries. Users and groups have identities and licenses; Exchange manages mailboxes and distribution groups; SharePoint organizes sites, libraries, and documents; Teams adds collaboration spaces, channels, and related policies. A beginner may recognize all these names yet struggle to choose the right administrative place for a request.

Try this thought experiment: a team needs a shared mailbox, a private project document library, and access for a new contractor. These are not three settings in a single application. Identify the associated service, the identity being granted access, and the person authorized to approve that access. The exercise makes product definitions operational rather than purely descriptive.

Identity controls determine what AI can safely reach

AB-900 covers Microsoft Entra ID, authentication, multifactor authentication, single sign-on, Conditional Access, common sign-in troubleshooting, and the role of Privileged Identity Management. At this level, the expectation is to recognize the purpose and fit of a control, not to reproduce an expert’s complete tenant configuration from memory.

A useful scenario involves a contractor who can sign in to a project Teams space but should not retain access after the engagement ends. Authentication confirms identity; authorization determines permitted resources; lifecycle processes remove access when it is no longer needed. The ability to articulate those distinctions will help with both ordinary administration and AI-enabled search experiences.

Oversharing becomes an AI governance problem

Copilot can help users find and summarize organizational information that they are authorized to reach. That makes content hygiene essential. If a broadly accessible SharePoint site contains restricted information, the fundamental defect is the sharing decision. An administrator needs to know which governance tools support review, classification, retention, and data loss prevention.

Microsoft Purview appears in the AB-900 blueprint because Copilot administration is not just a switch that enables an application. Information protection, auditability, and policies governing sensitive material are part of providing a trustworthy service. Practice describing what you would inspect when someone reports that a Copilot answer included material that seemed too widely available.

Agents have their own administrative lifecycle

Compared with an ordinary document, an agent may have instructions, knowledge connections, sharing permissions, ownership, and access to external actions. Basic administrative tasks therefore include understanding how agents are made available, who can use them, and what oversight is appropriate. The current study objectives address administration and governance rather than requiring you to design a sophisticated multi-agent architecture.

Imagine an internal HR agent that answers policy questions. Who maintains the source policy? Can temporary staff access it? Who decides whether the agent can be shared to a wider group? What happens when the agent’s owner leaves the company? These questions expose why identity, data access, and administration must be understood together.

A compact plan for fundamentals revision

Build a service map for a fictional company: one row for core Microsoft 365 objects, one for the relevant admin centers, one for security principles, and one for Copilot and agent governance. Add everyday requests to the map and explain which controls apply. Microsoft currently groups the exam into core service features, data protection and governance, and basic Copilot-and-agent administration.

Keep the October 14 objective transition on your revision calendar. The principles of sound administration will remain useful even as particular features or exam emphasis change; the exact assessed details should come from the study guide effective on your exam date.