Microsoft 365 Copilot AB-900 Copilot Data Access Microsoft Graph And Grounding Practice Test

 

Skills 2.2 • 20 original questions

This Microsoft AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals practice test focuses on copilot data access microsoft graph and grounding through original scenario-based questions aligned to the Skills measured as of July 22, 2026. Use the full ExamSnap AB-900 collection for broader practice across all current skill areas. For broader exam preparation, review the Microsoft AB-900 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

Consolidated Messenger is preparing a data protection review. The team needs to understand the relationship between existing Microsoft 365 permissions and Copilot grounding. What should the SharePoint administrator choose? The decision must address the stated requirement rather than a different Microsoft 365 control.

1. Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
2. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
3. Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
4. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
5. Run the appropriate Data access governance report from the SharePoint admin center

Correct answer: D

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

B: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

C: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

D: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

E: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 2

A support case at Woodgrove Bank says administrators must explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response. Which option is the best fit? The team will validate the result immediately after the change.

1. Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
2. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
3. Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
4. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
5. Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement

Correct answer: D

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

B: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

C: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

D: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

E: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 3

For a licensing change at Wide World Importers, which Microsoft 365 approach correctly addresses the need to ensure Copilot does not grant a user access to content they could not already access? No unrelated tenant settings should be changed.

1. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
2. Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks
3. Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
4. Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
5. Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data

Correct answer: A

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

B: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

C: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

D: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

E: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 4

A new administrator at Southridge Video asks which Microsoft 365 feature is intended to understand why Microsoft 365 context can improve a work-grounded answer. What is the best answer? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

1. Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
2. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
3. Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
4. Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted
5. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content

Correct answer: B

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

B: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

C: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

D: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

E: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 5

Fabrikam has validated the surrounding services. The remaining requirement is to explain why two users can receive different work-grounded Copilot answers to the same prompt. Which choice is correct? The choice should follow normal Microsoft 365 administrative practice.

1. Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
2. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
3. Use SharePoint data access governance and related sharing or permissions reports to identify overshared sites and content
4. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
5. Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data

Correct answer: B

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

B: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

C: Data access governance reports reveal broad permissions and sharing activity so administrators can focus remediation on the highest-risk sites. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

D: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

E: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 6

An administrator reviewing tenant cleanup for Wingtip Toys must identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships. Which Microsoft 365 control or object should be used? The administrator must choose the Microsoft 365 feature that matches the stated goal.

1. Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
2. Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted
3. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
4. Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
5. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content

Correct answer: C

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

B: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

C: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

D: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

E: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 7

A design review at VanArsdel identifies one specific goal: understand the relationship between existing Microsoft 365 permissions and Copilot grounding. Which option best matches that goal? The team needs a direct administrative answer, not a broad redesign.

1. Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
2. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
3. Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks
4. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
5. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access

Correct answer: D

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

B: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

C: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

D: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

E: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 8

A new administrator at Bellows College asks which Microsoft 365 feature is intended to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response. What is the best answer? The administrator wants an action that is easy to audit later.

1. Use Microsoft Purview Insider Risk Management to identify and investigate potentially risky user activity
2. Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
3. Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
4. Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
5. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access

Correct answer: E

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: Insider Risk Management correlates configured indicators and user activity to surface potential insider-risk cases for review. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

B: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

C: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

D: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

E: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 9

While handling a new-user onboarding, the SharePoint administrator needs to ensure Copilot does not grant a user access to content they could not already access. Which answer most directly addresses the stated need? The solution should preserve least privilege and existing governance where possible.

1. Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks
2. Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
3. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
4. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
5. Use Microsoft Purview Communication Compliance to review policy violations in supported communications

Correct answer: C

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

B: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

C: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

D: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

E: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 10

During a oversharing investigation at Coho Winery, the Microsoft 365 administrator must understand why Microsoft 365 context can improve a work-grounded answer. Which Microsoft 365 action or concept most directly satisfies the requirement? The team wants the smallest change that directly addresses the requirement.

1. Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
2. Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
3. Use Microsoft Purview Insider Risk Management to identify and investigate potentially risky user activity
4. Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted
5. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access

Correct answer: E

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

B: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

C: Insider Risk Management correlates configured indicators and user activity to surface potential insider-risk cases for review. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

D: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

E: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 11

Humongous Insurance is preparing a service desk escalation. The team needs to explain why two users can receive different work-grounded Copilot answers to the same prompt. What should the security administrator choose? The decision must address the stated requirement rather than a different Microsoft 365 control.

1. Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
2. Run the appropriate Data access governance report from the SharePoint admin center
3. Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted
4. Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
5. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access

Correct answer: E

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

B: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

C: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

D: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

E: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 12

A new administrator at Adventure Works asks which Microsoft 365 feature is intended to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships. What is the best answer? The team will validate the result immediately after the change.

1. Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
2. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
3. Use Microsoft Purview Insider Risk Management to identify and investigate potentially risky user activity
4. Run the appropriate Data access governance report from the SharePoint admin center
5. Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action

Correct answer: B

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

B: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

C: Insider Risk Management correlates configured indicators and user activity to surface potential insider-risk cases for review. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

D: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

E: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 13

For a security review at Blue Yonder Airlines, which Microsoft 365 approach correctly addresses the need to understand the relationship between existing Microsoft 365 permissions and Copilot grounding? No unrelated tenant settings should be changed.

1. Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
2. Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears
3. Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot
4. Use Microsoft Purview Communication Compliance to review policy violations in supported communications
5. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access

Correct answer: E

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

B: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

C: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

D: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

E: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 14

The compliance administrator at Relecloud is asked to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response. What is the most appropriate next step? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

1. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
2. Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot
3. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
4. Run the appropriate Data access governance report from the SharePoint admin center
5. Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions

Correct answer: A

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

B: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

C: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

D: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

E: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 15

Lamna Healthcare has validated the surrounding services. The remaining requirement is to ensure Copilot does not grant a user access to content they could not already access. Which choice is correct? The choice should follow normal Microsoft 365 administrative practice.

1. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
2. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
3. Use SharePoint data access governance and related sharing or permissions reports to identify overshared sites and content
4. Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
5. Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot

Correct answer: A

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

B: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

C: Data access governance reports reveal broad permissions and sharing activity so administrators can focus remediation on the highest-risk sites. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

D: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

E: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to ensure Copilot does not grant a user access to content they could not already access.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 16

A new administrator at Proseware asks which Microsoft 365 feature is intended to understand why Microsoft 365 context can improve a work-grounded answer. What is the best answer? The administrator must choose the Microsoft 365 feature that matches the stated goal.

1. Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot
2. Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks
3. Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
4. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
5. Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement

Correct answer: D

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

B: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

C: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

D: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

E: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand why Microsoft 365 context can improve a work-grounded answer.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 17

A design review at Lucerne Publishing identifies one specific goal: explain why two users can receive different work-grounded Copilot answers to the same prompt. Which option best matches that goal? The team needs a direct administrative answer, not a broad redesign.

1. Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
2. Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
3. Use Microsoft Purview Insider Risk Management to identify and investigate potentially risky user activity
4. Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
5. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access

Correct answer: E

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

B: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

C: Insider Risk Management correlates configured indicators and user activity to surface potential insider-risk cases for review. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

D: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why two users can receive different work-grounded Copilot answers to the same prompt.

E: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 18

The IT team at City Power & Light wants to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships. Which Microsoft 365 capability should it use? The administrator wants an action that is easy to audit later.

1. Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks
2. Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
3. Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
4. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
5. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access

Correct answer: E

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

B: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

C: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

D: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the service layer that connects Copilot to relevant Microsoft 365 work data and relationships.

E: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.

Question 19

While handling a governance workshop, the security administrator needs to understand the relationship between existing Microsoft 365 permissions and Copilot grounding. Which answer most directly addresses the stated need? The solution should preserve least privilege and existing governance where possible.

1. Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
2. Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot
3. Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
4. Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
5. Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content

Correct answer: D

Why: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

Option review:

A: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

B: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

C: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

D: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This directly addresses the stated requirement.

E: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to understand the relationship between existing Microsoft 365 permissions and Copilot grounding.

Learning point: Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access. Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content.

Question 20

A new administrator at Fourth Coffee asks which Microsoft 365 feature is intended to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response. What is the best answer? The team wants the smallest change that directly addresses the requirement.

1. Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
2. Run the appropriate Data access governance report from the SharePoint admin center
3. Use SharePoint data access governance and related sharing or permissions reports to identify overshared sites and content
4. Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
5. Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement

Correct answer: D

Why: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

Option review:

A: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

B: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

C: Data access governance reports reveal broad permissions and sharing activity so administrators can focus remediation on the highest-risk sites. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

D: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This directly addresses the stated requirement.

E: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain how work context such as mail, files, meetings, and chats can contribute to a Copilot response.

Learning point: Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access. Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context.