AB-900 Sample Questions Answers

The correct answer is C. Microsoft Graph . Microsoft documents that Microsoft 365 Copilot combines large language models with content and context from the Microsoft Graph to generate grounded responses. Microsoft Graph provides access to organizational data and signals across Microsoft 365 services, including SharePoint , OneDrive , Exchange , Teams , calendars, chats, files, and other work content. When SharePoint data is relevant to the prompt and the user already has permission to access it, Copilot uses Microsoft Graph as the layer that retrieves and grounds that corporate data for the response.

The other options are incorrect for this question. Microsoft Intune is used for endpoint and device management. Microsoft Defender is used for threat protection and security operations. Microsoft Purview provides compliance, governance, data protection, and risk management capabilities. While Copilot honors Purview protections and Microsoft 365 permissions, the specific service it uses to access and ground responses in SharePoint-based corporate data is Microsoft Graph . Therefore, the correct answer is Microsoft Graph .

The correct answer is Microsoft SharePoint sites . Microsoft Learn documents that Microsoft Purview sensitivity labels for containers can be applied to Microsoft Teams, Microsoft 365 groups, and SharePoint sites . These labels can control settings such as privacy, external sharing, and unmanaged device access for the labeled site. That is the official Microsoft feature that matches the sentence in the question.

The other options are not the best match for this item. Microsoft 365 Copilot conversations are not the standard object to which admins directly apply a sensitivity label in the way this question is asking. Copilot can honor labels on source content and may display label context in responses, but the selectable resource here is not “Copilot conversations.” Azure Blob Storage is also not the intended answer in the Microsoft 365 Copilot and Agent Admin context for Purview sensitivity labels.

So for this hotspot, the sentence is correctly completed with Microsoft SharePoint sites , because Microsoft explicitly supports applying Purview sensitivity labels to SharePoint sites as a container-level labeling capability.

time-bound role activation

The correct answer is time-bound role activation . Microsoft Learn explains that Microsoft Entra Privileged Identity Management (PIM) allows users to be made eligible for privileged roles and then activate those roles only when needed. Microsoft also states that once activated, the role is active for a preconfigured period of time , after which the privileged access expires automatically. This is the core just-in-time and time-limited access model that PIM is designed to provide. ( learn.microsoft.com )

The other options do not match Microsoft’s definition of PIM. It is not primarily described as providing restricted access to Microsoft 365 services , the lifecycle management of users , or the management of enterprise applications . Those areas relate more closely to other Microsoft Entra and Microsoft 365 governance capabilities. Microsoft specifically positions PIM as a service to manage, control, and monitor access to important resources by using eligible assignments , approval workflows , MFA if required , and temporary role activation . Therefore, the phrase that correctly completes the sentence is time-bound role activation . ( learn.microsoft.com )

The correct selections are Information Protection and Data Loss Prevention . Microsoft documents that Microsoft Purview Information Protection helps organizations discover, classify, protect, and govern sensitive information wherever it lives or travels . Microsoft also describes Information Protection as the Purview solution for data classification, sensitivity labels, and encryption , including scenarios across Microsoft 365, on-premises repositories, cloud stores, and even third-party apps through supported extensions. That makes it the correct choice for the requirement to discover and classify sensitive data across multiple platforms .

For the second requirement, Microsoft states that Microsoft Purview Data Loss Prevention (DLP) helps prevent the unintentional sharing of sensitive items and can block users from prohibited activities , including inappropriate external sharing through services such as SharePoint, OneDrive, Teams, and email. Microsoft specifically documents DLP scenarios for preventing sensitive items from being shared with external users , which matches the requirement to block users from sharing intellectual property externally.

The correct answer is eDiscovery . In Microsoft Purview, eDiscovery is the solution used to search for content and export copies of that content from Microsoft 365 locations such as SharePoint and OneDrive. Microsoft Learn states that when you export search results from eDiscovery, copies of native Office documents and other documents are exported . That directly matches the requirement to provide HR with a copy of files .

By contrast, Audit is primarily used to investigate user and admin activity records and can export those audit records to CSV , but it does not export the actual files themselves. Audit would help identify that User1 modified files, but the question asks for copies of the recent files modified by User1 , which is an eDiscovery content search and export scenario rather than an activity-log reporting scenario.

So, among the Microsoft Purview solutions shown, the appropriate selection is eDiscovery because it is the Purview tool designed to find and export the actual content items HR wants to receive.

The correct answers are A and D . Microsoft documents that with group-based licensing , licenses assigned to a group are automatically inherited by the group’s members. Therefore, if User1 is added to Group1 , User1 can receive the Microsoft 365 E3 license through group membership. Microsoft also documents that licenses can be assigned directly to individual users , so assigning a Microsoft 365 E3 license straight to User1 is also a complete solution.

Options B and C are incorrect because Conditional Access controls how users access cloud resources after sign-in; it does not grant product entitlements or service licenses. Microsoft licensing guidance separates access-policy controls from actual license assignment. In this scenario, the issue is lack of license entitlement, not access conditions. As a result, the valid solutions are either to make User1 a member of the licensed group or to assign the license directly to User1. Microsoft also notes that group-based licensing assignment can fail if required user properties such as usage location are missing, but among the available answer choices, the two complete license-granting actions are Add User1 to Group1 and Assign a license to User1 .

The correct selections are No, Yes, No . Statement 1 is No because Microsoft 365 Copilot is a work service that requires users to sign in with a work or school account . Microsoft documentation for setup and use consistently describes licensing and access in the context of signed-in organizational users, not anonymous access. Statement 2 is Yes because Microsoft documents that administrators can manage self-service purchases and trials in the Microsoft 365 admin center , including allowing or blocking eligible products for self-service acquisition. That means admins can allow self-service purchasing where the product is eligible. Statement 3 is No because Microsoft explicitly states that assigning Microsoft 365 Copilot licenses to cross-tenant users, including guests , isn’t supported.

The correct answer is C. Microsoft Defender for Endpoint . Microsoft documents that Defender for Endpoint is the Microsoft security solution for endpoint devices , including Windows 11 , and that it lets security teams investigate incidents, alerts, affected devices, files, processes, and remediation actions in the Microsoft Defender portal. Microsoft’s investigation guidance specifically describes using Defender for Endpoint to review alerts and investigate affected devices from the devices list, alerts queue, and incident views.

The other options do not match this requirement. Microsoft Entra ID Protection is for risky users and risky sign-ins, not device incident investigation. Microsoft Purview Insider Risk Management focuses on risky user behavior such as data theft or exfiltration, not endpoint security alerts from Windows devices. Microsoft Defender for Identity monitors on-premises and hybrid identity signals from Active Directory environments, not Windows 11 endpoint incidents. For security incidents and alerts raised from organization-managed Windows 11 devices, Microsoft’s documented solution is Microsoft Defender for Endpoint .

provide control over how users can access cloud apps.

The correct answer is provide control over how users can access cloud apps . Microsoft Learn defines Microsoft Entra Conditional Access as the Zero Trust policy engine that uses if-then logic to make access decisions. Microsoft states that Conditional Access policies determine who can access resources, what resources they can access, and under what conditions . These policies can require actions such as multifactor authentication, compliant devices, or other controls before allowing access to applications and services like Microsoft 365. That means Conditional Access is specifically used to control how users access cloud apps .

The other options are incorrect. Conditional Access policies are not configured by using the Microsoft Defender portal ; they are managed in the Microsoft Entra admin center . They are also not applied only to on-premises resources , because Microsoft documents Conditional Access primarily for cloud identities, cloud apps, and cloud-connected resources. Finally, Conditional Access does not require a Microsoft Exchange mailbox. It can be applied broadly across many Microsoft and third-party cloud applications integrated with Microsoft Entra.

The correct answer is D. From the Finance site, configure permissions . Microsoft states that Microsoft 365 Copilot honors existing Microsoft 365 permissions and only grounds responses in content that the signed-in user is already allowed to access. That means if users are getting Finance-site content in Copilot responses, those users likely still have permission to that SharePoint content. The direct fix is to review and correct the site, library, folder, or file permissions on the Finance site so only the intended users retain access.

The other options do not directly solve this requirement. Information Barriers are designed for communication and collaboration segmentation scenarios, not for ordinary site-level oversharing remediation. A Defender data connector is unrelated to SharePoint permission enforcement. Conditional Access controls sign-in and session access conditions, but it does not selectively remove Copilot grounding from one SharePoint site for users who still have site permissions. Because Copilot uses SharePoint and Microsoft Graph permissions as its boundary, the Microsoft-documented corrective action is to fix the Finance site permissions .

The correct answer is A. the Microsoft Defender portal . Microsoft documents that phishing investigation and analysis for email threats is handled in Microsoft Defender for Office 365 through the Microsoft Defender portal . Microsoft’s phishing investigation guidance and email security reporting both point admins to Defender capabilities such as Threat Explorer , campaign views , and phish reports to understand the scope, affected users, and impact of phishing attacks.

The other options are not the primary investigation tool for this scenario. The Microsoft 365 admin center is mainly for tenant administration and usage reporting, not detailed phishing impact investigation. The Microsoft Entra admin center focuses on identity and access management, not email threat analysis. The Exchange admin center manages mail flow and Exchange settings, but Microsoft’s current phishing investigation workflows are centered in the Microsoft Defender portal , where security analysts can review detections, remediation actions, and affected recipients.

So, to review the impact of a phishing incident that targeted email users, the Microsoft-documented choice is the Microsoft Defender portal .

The correct answer is Microsoft Graph . Microsoft documents that Microsoft 365 Copilot accesses organizational content and context through Microsoft Graph . Microsoft Graph provides the user’s work context, including items such as emails, chats, meetings, files, contacts, and calendar data , along with relationship and activity signals that help Copilot ground and rank responses. Microsoft also explains that Copilot combines organizational content with the user’s working context, such as recent chat conversations, email exchanges on a topic, and the meeting the user is currently in. Those are exactly the kinds of signals described in the question, including collaboration history and document relevance.

The other options do not fit this sentence. Microsoft Copilot Studio is used to build and customize copilots and agents. Microsoft Purview is for compliance, governance, and data protection. Microsoft Viva Insights provides workplace analytics and insights, but it is not the core service described by Microsoft as supplying the contextual signals that ground Microsoft 365 Copilot responses. Therefore, the only option that correctly completes the sentence is Microsoft Graph .

The correct answers are A and D because both tasks are supported directly in the Exchange admin center (EAC) . Microsoft Learn states that administrators can manage mail flow rules in Exchange Online from the EAC under Mail flow > Rules , which includes creating and managing transport rules for organizational email handling. Microsoft Learn also states that administrators can create shared mailboxes in the EAC under Recipients > Mailboxes , where a shared mailbox can be added and then delegated to users.

Option B is incorrect because adding a custom domain is normally done in the Microsoft 365 admin center , specifically on the Domains page. Although Exchange can later work with accepted domains and related mail flow settings, the act of adding and verifying a custom domain is not an Exchange admin center task. Option C is incorrect because license assignment is handled through Microsoft 365 or Microsoft Entra administrative tools, not the Exchange admin center.

From the SharePoint admin center, you can create a site .

The correct answer is site . Microsoft documents that in the SharePoint admin center , administrators can go to Active sites and select Create to create a new SharePoint site, such as a team site or communication site . Microsoft also describes site creation as one of the key tasks available to users with the SharePoint Administrator role.

The other options do not fit this sentence. A server is not something you create from the SharePoint admin center in Microsoft 365, because SharePoint Online is a Microsoft-managed cloud service. A user is typically created in the Microsoft 365 admin center or Microsoft Entra admin center, not in the SharePoint admin center. A role is also assigned through Microsoft 365 or Microsoft Entra administrative experiences, not created from the SharePoint admin center as the primary task described here.

So the sentence is correctly completed as: From the SharePoint admin center, you can create a site.

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft states that if an organization has a Microsoft 365 Copilot license and at least one user is assigned to a Copilot license, SharePoint administrators automatically get access to the SharePoint Advanced Management features required for Copilot deployment. Microsoft does not say that all users in the organization must have Microsoft 365 Copilot licenses for administrators to use SharePoint Advanced Management.

Statement 2 is Yes because Microsoft documents SharePoint Advanced Management features such as Restricted Content Discovery and Restricted SharePoint Search , which can limit whether content from specific SharePoint sites appears in Microsoft 365 Copilot and organization-wide search experiences.

Statement 3 is Yes because Microsoft explicitly states that organizations can purchase a standalone SharePoint Advanced Management license for each user in the organization. That means it is available even for organizations that do not have Microsoft 365 Copilot.

The correct answers are C and D . Microsoft Learn explains that agents created with Agent Builder in Microsoft 365 Copilot allow you to define specific instructions that extend Microsoft 365 Copilot for a business scenario. Microsoft also documents that you can add knowledge sources such as specific public websites and SharePoint content so the agent can reason over targeted information instead of relying only on the default chat experience. Those two capabilities directly match the needs in options C and D.

Option A is incorrect because grouping chats is a Copilot notebook scenario, not the reason to build an agent. Option B is incorrect in the context of creating an agent in the Microsoft 365 Copilot app . Agent Builder supports declarative agents with instructions, knowledge, and capabilities, but Microsoft Learn describes custom AI model control as part of custom engine agents built with tools such as Copilot Studio, SDKs, or Foundry, not as a standard Agent Builder feature in the Microsoft 365 Copilot app. Therefore, when the task is specifically to create an agent in the app, the valid reasons are custom instructions and reasoning over a specific website .

A Communication Compliance policy can detect inappropriate text in Microsoft Teams messages. Answer: Yes

A Communication Compliance policy can detect offensive language in Microsoft 365 Copilot prompts. Answer: Yes

A Communication Compliance policy can be used to retain email messages for 10 years. Answer: No

The correct selections are Yes, Yes, No . Microsoft documents that Microsoft Purview Communication Compliance can detect potentially inappropriate messages in supported communication channels, including Microsoft Teams and email . Microsoft also states that reviewers can investigate communications in Microsoft 365 Copilot and Microsoft 365 Copilot Chat , which means Communication Compliance policies can evaluate Copilot prompts and responses for risky or offensive content.

This makes statement 1 Yes , because inappropriate text in Teams messages is a standard Communication Compliance scenario. Statement 2 is also Yes , because Microsoft explicitly includes Microsoft 365 Copilot and Microsoft 365 Copilot Chat among the supported communication sources for policy review and investigation.

Statement 3 is No because retaining email for a fixed period such as 10 years is handled by Microsoft Purview Data Lifecycle Management through retention policies or retention labels, not by Communication Compliance. Communication Compliance is for monitoring and investigating risky communications, not for long-term retention enforcement.

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft’s recommended identity security best practices.

Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.