How hard is AB-900? Real difficulty and a plan for your background

First, Purview. The data protection and governance domain weighs 35–40% and lists many solutions: Information Protection, DLP, Insider Risk Management, Communication Compliance, DSPM for AI, Data Lifecycle Management, Compliance Manager, eDiscovery, activity explorer and data explorer. Questions ask which one is for what, and several sound interchangeable if you have only read about them.

Second, time. Forty-five minutes for an exam that mixes three areas means recognising the answer, not reasoning it out from scratch. Third, novelty: Copilot licensing versus pay-as-you-go, Researcher, Analyst, agent approval and lifecycle are topics from the past year that are not in many administrators' experience.

There are no labs or step-by-step configuration: it is an "identify" and "understand" exam, as the verbs in the study guide say. You do not need to know how to create a DLP policy, only to recognise when one is needed. The first domain (Microsoft 365 services and objects, basic security) is familiar ground for anyone who has managed users, groups and licences.

There is also a free official practice assessment on the certification page, which gives a faithful idea of the question style. And the study guide is short and concrete: if you can explain each bullet in one sentence and name the portal where it is done, you are close.

Microsoft 365 administrator (1–2 weeks): skip most of the first domain and spend your time on Purview and on administering Copilot and agents. Support or helpdesk (2–3 weeks): strengthen Entra (conditional access, MFA, risky sign-ins, PIM) and then Purview; the plan to pass AB-900 works as is. Security or compliance (1–2 weeks): you already have Purview; study the Exchange, SharePoint and Teams objects and the whole third domain.

From scratch (3–4 weeks): start with the Microsoft 365 map, what each service is and which portal manages it, with a trial tenant to see it. Then security and identity, then Purview, and finally Copilot and agents. In every case, a final week of timed questions. If you are a business rather than an IT profile, AB-730 may suit you better; we compare them in is AB-900 worth it?.

Three signals. One: you score above 80% twice in a row on 45-minute mock exams with new questions. Two: the data protection domain does not drop below 70%, because it is the heaviest. Three: given four Purview tools, you can say in one sentence what each is for.

Use Microsoft's practice assessment as a diagnosis and the AB-900 practice test for the daily work: tests by domain, an explanation on every question and statistics to see where you fail. To see the format first, here are five AB-900 questions explained.