Certification Exam Review and Guide: AB-900

I recently took the AB-900 exam for the Microsoft 365 Certified: Copilot and Agent Administration Fundamentals certification. To be honest, my motivation came from a desire for completeness more than expectations about the material. This was my 22^nd Microsoft certification exam, and prior to the new exams released this last year, I’d worked through every AI, Power Platform, and Fabric certification available, along with some in security, governance, and Azure. I had also previously completed the AB-100 (the architect certification from the same series) while it was still in beta.

From that perspective, I mistakenly believed the AB-900 would be more about validating my knowledge than learning. I was wrong: I ended up learning anyway, and I think most people will, too.

The technological landscape is changing rapidly, and Microsoft’s newest certifications increasingly interweave longstanding products like Defender and Purview with tools and concepts that have only recently emerged. Information becomes outdated quickly, and what someone knew a year ago isn’t enough anymore. Staying current requires constant, dedicated study.

Even so, no one can learn everything. If you’re considering this certification and wondering whether it’s for you, I hope this post helps you decide.

Below, I’ll discuss:

• Who the AB-900 is for
• What you can expect to learn while preparing for it
• What you need to know to pass

Is it for you?

Microsoft fundamentals exams have a reputation for offering high-level overviews of material, suitable for beginners or for managers who need to know about the technology without using it themselves. In that vein, I expected either a less complex version of the AB-100 or an AI-focused replacement for the recently retired MS-900. However, this exam occupies a slightly different space. It focuses on agentic administration rather than architecture and prioritizes governance and security over a raw overview of Microsoft 365.

To be clear, if you’re a beginner or someone looking for a broad overview of security, governance, and agents in Microsoft 365, you’ll get what you’re after. Nonetheless, the AB-900 is also heavily role-focused, built for Microsoft 365 administrators looking to handle the unique challenges of working in an agentic environment.

Further, the high-level overviews are also useful for IT professionals working in adjacent fields. Even if you never administer agents in an M365 tenant, understanding how agent governance operates and the kinds of decisions being made can offer valuable insights to anyone building, using, or deploying agents or debugging agentic processes.

As such, I would recommend this certification for:

• Beginners interested in the topic
• Business users whose roles touch on the technology
• Microsoft 365 administrators working with Copilot and agents
• IT professionals working in related areas

What can you learn?

The official study guide lists the specific topics and technologies in detail, but more broadly, studying for the AB-900 prepares you in three areas.

• Security and governance. From foundational principles like Zero Trust to specific offerings around defense and identity protection, studying for the exam provides a high-level view of security on the Microsoft 365 platform, including many aspects not directly related to agents.
• Agents in Microsoft 365. The exam materials will provide an overview of the types of agents currently available, instructions on accessing them, and general principles for choosing the right type for a given scenario.
• How to administer agents. This is where the AB-900 diverges from the usual expectations of fundamentals certification exams. Beyond describing concepts, the training material includes step-by-step walkthroughs of more foundational agent and administrative tasks. You’ll learn to create SharePoint and declarative Copilot Studio agents (the full agent-building experience is reserved for more advanced certifications), configure user access, approve agents, deploy licensing in stages across your organization, and understand the exact effects of many administrative options. Expect to walk away knowing how to perform tasks, not just which tools exist.

How can you pass?

Like other fundamentals exams, the AB-900 is not open-book. There is no Microsoft Learn link, so any specifics you need to know must be memorized before sitting the test. Fortunately, as with most fundamentals exams, there are fewer narrow details required to answer than in the more advanced exams. In some cases, knowing that Zero Trust is a principle rather than a specific service is enough to deduce the correct answer. Other questions depend on understanding the distinction between eDiscovery, information protection, and similar services in Purview. Others require remembering the purposes and distinctions among the monitoring dashboards across the M365 Admin Center, Viva Insights, Purview, or Defender.

In keeping with the task-oriented nature of the material, however, you should also expect some questions that require more specific knowledge. You could be asked to look at a menu and choose which sub-menu would contain the settings to achieve a certain goal, or even see the sub-menu and be asked which option you should modify. In other cases, you might be shown a configuration and asked to explain its effects.

Overall, try to enter the exam with a top-level understanding of the key concepts and tools, and familiarize yourself with the menus and dashboards mentioned in the study materials.

Summary:

The AB-900 is a fundamentals exam focused on security, governance, and administration in Microsoft 365 with a particular focus on agents. It provides a useful overview of the tools and instructions for basic tasks and is suitable for anyone wanting a high-level overview of those areas. Before taking the test, review the study guide and ensure you understand the topics involved, and take some time to walk through the associated menus and dashboards to familiarize yourself with their contents.