CertifyDeckAB-900 has three connected domains. The central idea is how Microsoft 365 identity and permissions determine the data available to Copilot, followed by how that usage is governed.
Microsoft 365 services and objects (30–35%)
This includes licensing, organization settings, mailboxes and distribution groups, SharePoint sites and libraries, and Teams teams, channels and policies. You also select appropriate roles and permissions.
Security covers Zero Trust, authentication and authorization, Defender XDR, Entra ID, Conditional Access, SSO, sign-in troubleshooting, Identity Secure Score, audit, PIM, app registrations and enterprise applications.
Data protection and governance (35–40%)
The largest domain spans Information Protection, DLP, Insider Risk Management, Communication Compliance, DSPM for AI, Data Lifecycle Management, labels, classification and retention.
It also tests how Copilot accesses data through Microsoft Graph and existing permissions; Compliance Manager, Data Explorer, Activity explorer and eDiscovery; and SharePoint oversharing controls.
Copilot and agent administration (25–30%)
Compare Copilot and agents, monthly licenses and pay-as-you-go, controllable features, and use cases for Researcher, Analyst and custom agents.
Tasks include assigning licenses, managing billing, reviewing adoption, managing prompts, and configuring agent access, creation, approval, usage, operational insights and lifecycle.
Turn the outline into decisions
Convert every objective into a decision: which object, portal, report or least-privilege control meets the requirement. That is closer to exam reasoning than memorizing isolated definitions.
Use the AB-900 study guide and begin with domain practice. Recheck the official outline date shortly before the exam because products and terminology can change.
Frequently asked questions
Which AB-900 domain has the greatest weight?
Data protection and governance for Microsoft 365 and Copilot, weighted at 35–40%.
Does AB-900 include Microsoft Purview?
Yes. It includes information protection, DLP, insider risk, communication compliance, retention, eDiscovery and DSPM for AI.
Does AB-900 include creating agents?
It includes basic creation and administration, access, approval and monitoring rather than advanced agent development.