This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Identify the appropriate security object to use in an organization (users and groups)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Microsoft 365 uses identities and group memberships to control access to resources, applications, and data. Two of the most important security objects in Microsoft Entra ID and Microsoft 365 are users and groups.

Understanding when to use users and groups is fundamental to administering Microsoft 365 and securing resources. Rather than assigning permissions individually to every person, administrators can use groups to simplify access management and improve security.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the purpose of users and groups, their differences, and common scenarios for using each object.

Understanding Security Objects

A security object represents an identity or a collection of identities that can receive permissions and access rights.

Common Microsoft 365 security objects include:

• Users
• Groups
• Service principals
• Devices

For the AB-900 exam, the focus is primarily on users and groups.

Users

A user represents an individual identity that can authenticate and access Microsoft 365 resources.

Examples include:

• Employees
• Contractors
• Students
• Administrators

Each user account contains information such as:

• Username (User Principal Name)
• Display name
• Email address
• Assigned licenses
• Group memberships
• Authentication settings

Types of User Accounts

Member Users

Member users belong to the organization’s Microsoft Entra tenant.

Examples:

• Employees
• IT administrators
• Internal staff

Member users typically receive:

• Microsoft 365 licenses
• Mailboxes
• Teams access
• SharePoint permissions

Guest Users

Guest users are external users invited into the organization through Microsoft Entra B2B collaboration.

Examples:

• Vendors
• Consultants
• Business partners

Guest users:

• Use their own credentials.
• Access only resources that have been shared with them.
• Typically do not require full Microsoft 365 licenses.

Why User Accounts Are Important

User accounts provide:

Authentication

Verifying identity during sign-in.

Authorization

Determining what resources users can access.

Auditing

Tracking activities performed by specific individuals.

Personalization

Providing personalized experiences across Microsoft 365.

Groups

A group is a collection of users that simplifies management.

Instead of assigning permissions individually to many users, administrators assign permissions to the group and then add users to that group.

Benefits include:

• Easier administration
• Consistent permissions
• Reduced errors
• Faster onboarding and offboarding

Why Groups Improve Security

Suppose 100 employees need access to a SharePoint site.

Without groups:

• Permissions must be assigned to 100 individual users.

With groups:

1. Create a group.
2. Assign permissions once.
3. Add users to the group.

This approach is:

• Easier to manage.
• More scalable.
• Less likely to produce permission mistakes.

Types of Groups in Microsoft 365

Security Groups

Security groups are used primarily for assigning permissions.

Common uses:

• SharePoint access
• Conditional Access targeting
• Application permissions
• Device management

Example:

Finance Security Group

Members automatically inherit permissions assigned to the group.

Microsoft 365 Groups

Microsoft 365 groups provide collaboration capabilities in addition to membership management.

They can automatically provide:

• Shared mailbox
• Shared calendar
• Teams workspace
• SharePoint site
• Planner resources

Example:

Marketing Team

Distribution Groups

Distribution groups are used mainly for email communication.

Purpose:

• Send one email to multiple recipients.

Examples:

• All Employees
• Human Resources
• Sales Department

Distribution groups do not provide collaboration resources like Teams or SharePoint sites.

Mail-Enabled Security Groups

These groups combine:

• Security permissions
• Email distribution capabilities

They are useful when a group needs both access permissions and email functionality.

Users vs Groups

When to Use Individual Users

Use user objects when:

• Assigning licenses.
• Managing authentication methods.
• Configuring MFA.
• Reviewing sign-in logs.
• Managing personal mailboxes.

Examples:

• Assigning a Microsoft 365 Copilot license.
• Resetting a password.
• Enabling MFA.

When to Use Groups

Use groups when:

• Granting access to resources.
• Assigning SharePoint permissions.
• Managing Teams membership.
• Applying Conditional Access policies.
• Organizing departments.

Examples:

• Finance team access to a SharePoint site.
• Sales department access to Teams channels.
• Applying a security policy to all administrators.

Group-Based Management

Microsoft Entra supports group-based administration.

Advantages include:

Simplified Administration

One change affects many users.

Reduced Errors

Permissions are applied consistently.

Faster Employee Onboarding

Adding a new employee to the correct groups automatically provides needed access.

Easier Offboarding

Removing users from groups quickly revokes access.

Dynamic Groups

Dynamic groups automatically add or remove users based on attributes.

Examples:

• Department = Sales
• Country = United States
• Job title = Manager

Benefits:

• Automation
• Reduced administrative effort
• Consistent membership

Groups and Conditional Access

Conditional Access policies often target:

• Users
• Groups

Example:

Require MFA for all members of the IT Administrators group.

This is more efficient than configuring each administrator individually.

Groups and Microsoft 365 Copilot

Groups help manage access to resources used by Microsoft 365 Copilot.

Examples:

• Teams membership
• SharePoint permissions
• Collaboration resources
• Departmental content access

Because Copilot respects existing permissions, group memberships indirectly influence what content users can access through Copilot.

Best Practices

Assign Permissions to Groups Instead of Individuals

This improves scalability and consistency.

Use Security Groups for Access Management

Avoid assigning permissions directly to users whenever possible.

Use Microsoft 365 Groups for Collaboration

These groups support Teams, SharePoint, and Outlook integration.

Follow Least Privilege

Provide only the permissions users require.

Review Group Membership Regularly

Remove unnecessary access and outdated memberships.

Exam Tips

Remember these AB-900 concepts:

• Users represent individual identities.
• Groups represent collections of users.
• Users authenticate; groups do not.
• Security groups manage permissions.
• Microsoft 365 groups support collaboration resources.
• Distribution groups are primarily used for email.
• Group-based management simplifies administration.
• Dynamic groups automate membership.
• Conditional Access policies can target groups.
• Microsoft 365 Copilot respects permissions inherited through groups.

Practice Exam Questions

Question 1

Which security object represents an individual identity in Microsoft 365?

A. Distribution group
B. Microsoft 365 group
C. User account
D. Shared mailbox

Correct Answer: C

Explanation: A user account represents an individual who can authenticate and access Microsoft 365 resources.

Question 2

What is the primary advantage of using groups instead of assigning permissions individually?

A. Groups eliminate authentication requirements.
B. Groups simplify administration and provide consistent access.
C. Groups automatically assign licenses.
D. Groups replace Microsoft Entra ID.

Correct Answer: B

Explanation: Groups allow administrators to manage permissions for multiple users at once.

Question 3

Which type of group is primarily used for email distribution?

A. Security group
B. Microsoft 365 group
C. Dynamic group
D. Distribution group

Correct Answer: D

Explanation: Distribution groups are designed mainly for sending email messages to multiple recipients.

Question 4

Which object can sign in to Microsoft 365?

A. User account
B. Security group
C. Distribution group
D. Microsoft 365 group

Correct Answer: A

Explanation: Users authenticate directly, while groups are collections of users and cannot sign in.

Question 5

Which group type automatically provides collaboration resources such as a shared mailbox and SharePoint site?

A. Security group
B. Distribution group
C. Mail-enabled security group
D. Microsoft 365 group

Correct Answer: D

Explanation: Microsoft 365 groups provide collaboration services including Teams and SharePoint.

Question 6

A company wants to grant SharePoint access to an entire department. Which approach is recommended?

A. Assign permissions to each employee individually.
B. Create a security group and assign permissions to the group.
C. Create separate user accounts for each site.
D. Use a distribution group only.

Correct Answer: B

Explanation: Security groups simplify access management and reduce administrative effort.

Question 7

What is a dynamic group?

A. A group used only for Teams meetings.
B. A group with manually maintained memberships.
C. A group that sends email externally.
D. A group whose membership is automatically managed based on user attributes.

Correct Answer: D

Explanation: Dynamic groups automatically update membership according to configured rules.

Question 8

Which object is typically assigned Microsoft 365 licenses?

A. Security groups
B. Distribution groups
C. User accounts
D. Shared calendars

Correct Answer: C

Explanation: Licenses are generally assigned to individual users.

Question 9

Which statement about guest users is correct?

A. Guest users must always have Microsoft 365 licenses.
B. Guest users are external users invited to collaborate with the organization.
C. Guest users replace security groups.
D. Guest users cannot access SharePoint resources.

Correct Answer: B

Explanation: Guest users are external identities that can be granted access to shared resources.

Question 10

How do groups influence Microsoft 365 Copilot?

A. Groups allow Copilot to bypass permissions.
B. Groups disable Conditional Access.
C. Groups determine resource permissions that Copilot respects.
D. Groups automatically generate Copilot prompts.

Correct Answer: C

Explanation: Copilot uses existing Microsoft 365 permissions, many of which are granted through group memberships.

Go to the AB-900 Exam Prep Hub main page