Author: thedatacommunity

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification

Understand conditional access policies (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Understand conditional access policies

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern organizations must secure access to Microsoft 365 resources while still allowing users to work from anywhere and on many different devices. Traditional security models that rely only on usernames and passwords are no longer sufficient.

Conditional Access is one of the most important security features in Microsoft Entra. It helps organizations make intelligent access decisions based on various conditions and risk signals.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand what Conditional Access is, how policies work, and the common controls used to protect Microsoft 365 resources.

What Is Conditional Access?

Conditional Access is a feature of Microsoft Entra ID that evaluates signals and applies access controls before allowing users to access resources.

It is often described as:

“If this condition exists, then perform this action.”

Examples:

  • If a user signs in from outside the company network, require Multi-Factor Authentication.
  • If a device is not compliant, block access.
  • If a sign-in is considered high risk, deny access.

Conditional Access supports Microsoft’s Zero Trust security strategy.

Why Conditional Access Is Important

Conditional Access helps organizations:

  • Strengthen identity security.
  • Reduce unauthorized access.
  • Protect sensitive information.
  • Enable secure remote work.
  • Support compliance requirements.
  • Apply adaptive security controls.

Instead of trusting every sign-in automatically, Conditional Access evaluates each access request individually.

How Conditional Access Works

A Conditional Access policy generally contains three components:

1. Assignments (Who and What?)

Defines:

  • Users or groups
  • Applications
  • Conditions

2. Conditions (When?)

Conditions determine when the policy applies.

Examples:

  • Location
  • Device platform
  • Sign-in risk
  • User risk
  • Client applications

3. Access Controls (What Happens?)

Controls determine the action taken.

Examples:

  • Require MFA
  • Require a compliant device
  • Require password change
  • Block access

Common Components of a Conditional Access Policy

Users and Groups

Policies can target:

  • All users
  • Specific users
  • Security groups
  • Administrative accounts

Organizations often apply stricter policies to privileged users.

Cloud Apps and Resources

Policies can protect:

  • Microsoft 365 applications
  • Teams
  • Exchange Online
  • SharePoint Online
  • Custom applications

Different applications can have different requirements.

Conditions Used by Conditional Access

Location

Policies can evaluate where users are signing in from.

Examples:

  • Trusted corporate locations
  • External networks
  • Specific countries or regions

Example:

If sign-in occurs outside the corporate network,
require MFA.

Device Platform

Policies can apply to:

  • Windows
  • macOS
  • iOS
  • Android

Organizations may choose to treat platforms differently.

Device State

Conditional Access can determine whether devices are:

  • Compliant
  • Hybrid joined
  • Managed

Organizations can block unmanaged devices.

Sign-In Risk

Microsoft evaluates sign-ins for suspicious activity.

Examples:

  • Impossible travel
  • Unusual locations
  • Anonymous IP addresses

Higher-risk sign-ins may trigger additional controls.

User Risk

User risk reflects the likelihood that a user’s account has been compromised.

Examples:

  • Leaked credentials
  • Suspicious behavior

Organizations can require password changes or block access for risky users.

Access Controls

After evaluating conditions, Conditional Access applies controls.

Require Multi-Factor Authentication

One of the most common controls.

Example:

Require MFA for all administrator accounts.

Benefits:

  • Stronger identity protection.
  • Reduced credential theft.

Require Device Compliance

Users must use devices that meet organizational standards.

Examples:

  • Encryption enabled
  • Antivirus installed
  • Latest updates applied

This often integrates with Microsoft Intune.

Require Hybrid Microsoft Entra Joined Devices

Ensures access is granted only to approved organizational devices.

Require Password Change

Used when a user account is considered compromised.

Block Access

The most restrictive control.

Examples:

  • Block high-risk users.
  • Block unsupported devices.
  • Block access from certain locations.

Named Locations

Named locations allow administrators to define trusted locations.

Examples:

  • Corporate offices
  • Specific IP address ranges

Trusted locations can reduce unnecessary MFA prompts while maintaining security.

Conditional Access and Multi-Factor Authentication

Conditional Access frequently works together with MFA.

Examples:

Scenario 1

User signs in from home.

Result:

  • Require MFA.

Scenario 2

User signs in from a trusted office.

Result:

  • Allow access without additional prompts.

This creates a balance between security and user convenience.

Conditional Access and Device Compliance

Organizations often require devices to be:

  • Managed by Intune.
  • Encrypted.
  • Updated.
  • Secure.

If devices fail compliance requirements, access may be denied.

Conditional Access and Zero Trust

Conditional Access directly supports all three Zero Trust principles.

Verify Explicitly

Evaluate identity, device, location, and risk.

Use Least Privileged Access

Restrict access when necessary.

Assume Breach

Continuously evaluate security signals.

Conditional Access and Microsoft 365 Copilot

Microsoft 365 Copilot uses the same identity and access controls that protect Microsoft 365.

Conditional Access policies can affect access to:

  • Microsoft Teams
  • SharePoint Online
  • Exchange Online
  • OneDrive
  • Copilot experiences

Copilot does not bypass Conditional Access requirements.

Best Practices

Enable MFA for All Users

MFA is one of the strongest protections available.

Protect Administrator Accounts

Apply stricter controls to privileged users.

Require Compliant Devices

Reduce risks from unmanaged devices.

Use Trusted Locations Carefully

Avoid creating unnecessary exceptions.

Follow the Principle of Least Privilege

Grant only necessary access.

Benefits of Conditional Access

Organizations gain:

Adaptive Security

Policies adjust based on risk and conditions.

Improved User Experience

Security requirements appear only when necessary.

Stronger Identity Protection

Compromised accounts are easier to detect and control.

Support for Remote Work

Users can work securely from anywhere.

Zero Trust Alignment

Every access request is evaluated individually.

Exam Tips

Remember these key AB-900 concepts:

  • Conditional Access is part of Microsoft Entra.
  • Policies use an if-then approach.
  • Conditions include location, device state, sign-in risk, and user risk.
  • Access controls include requiring MFA, requiring compliant devices, and blocking access.
  • Conditional Access works closely with Intune and Microsoft Entra ID.
  • Named locations define trusted networks.
  • Conditional Access supports Zero Trust principles.
  • Microsoft 365 Copilot respects Conditional Access policies.
  • Administrator accounts typically receive stricter protections.
  • Conditional Access improves both security and usability.

Practice Exam Questions

Question 1

What is the primary purpose of Conditional Access?

A. Increase mailbox quotas
B. Automatically create Teams channels
C. Apply access decisions based on conditions and risk signals
D. Replace Microsoft Defender

Correct Answer: C

Explanation: Conditional Access evaluates various signals and determines whether access should be allowed, restricted, or blocked.

Question 2

Conditional Access is a feature of which Microsoft service?

A. Microsoft Entra ID
B. Exchange Online
C. Microsoft Purview
D. SharePoint Online

Correct Answer: A

Explanation: Conditional Access is provided through Microsoft Entra ID and is used to secure access to resources.

Question 3

Which statement best describes how Conditional Access works?

A. Use an “if condition, then action” model.
B. Always allow access.
C. Disable all external connections.
D. Eliminate authentication requirements.

Correct Answer: A

Explanation: Conditional Access evaluates conditions and applies controls accordingly.

Question 4

Which condition can be evaluated by Conditional Access?

A. Printer model
B. Monitor size
C. Mouse type
D. Sign-in risk

Correct Answer: D

Explanation: Sign-in risk is one of the security signals used when evaluating access requests.

Question 5

Which access control commonly works with Conditional Access to strengthen security?

A. Shared mailboxes
B. Multi-Factor Authentication
C. Distribution lists
D. Document versioning

Correct Answer: B

Explanation: MFA is frequently required through Conditional Access policies.

Question 6

What is the purpose of named locations?

A. Define trusted networks and IP ranges
B. Store SharePoint documents
C. Create Teams channels
D. Manage email retention

Correct Answer: A

Explanation: Named locations identify trusted locations that can influence policy behavior.

Question 7

Which Microsoft solution often works with Conditional Access to evaluate device compliance?

A. Microsoft Lists
B. Microsoft Planner
C. Microsoft Intune
D. Microsoft Forms

Correct Answer: C

Explanation: Intune provides device management and compliance information used by Conditional Access.

Question 8

Which action represents the most restrictive access control?

A. Require MFA
B. Require password change
C. Require compliant device
D. Block access

Correct Answer: D

Explanation: Blocking access completely prevents users from reaching resources.

Question 9

Which Zero Trust principle is most directly supported by Conditional Access?

A. Verify Explicitly
B. Trust Internal Networks
C. Open Access First
D. Eliminate Authentication

Correct Answer: A

Explanation: Conditional Access evaluates multiple signals before granting access, which aligns with Verify Explicitly.

Question 10

How does Microsoft 365 Copilot interact with Conditional Access policies?

A. Copilot bypasses policies.
B. Copilot disables MFA requirements.
C. Copilot ignores device compliance rules.
D. Copilot follows the same Conditional Access requirements as Microsoft 365 resources.

Correct Answer: D

Explanation: Copilot inherits existing identity and access controls and does not bypass security policies.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification

Understand features and capabilities of Microsoft Entra (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Understand features and capabilities of Microsoft Entra

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Identity is the foundation of security in Microsoft 365. Before users can access email, Teams, SharePoint, Microsoft 365 Copilot, or other services, their identities must be verified and managed securely.

Microsoft Entra is Microsoft’s family of identity and access solutions that helps organizations secure users, applications, devices, and external identities. Microsoft Entra provides authentication, authorization, identity governance, and access management capabilities that support modern security strategies such as Zero Trust.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding the major capabilities of Microsoft Entra is essential.

What Is Microsoft Entra?

Microsoft Entra is Microsoft’s identity and access product family.

It helps organizations:

  • Manage identities.
  • Authenticate users.
  • Control access to resources.
  • Protect against identity-based attacks.
  • Support Zero Trust security.

Microsoft Entra enables secure access to:

  • Microsoft 365
  • Microsoft Teams
  • SharePoint Online
  • Exchange Online
  • Third-party applications
  • Custom applications

Microsoft Entra ID

The core component of Microsoft Entra is Microsoft Entra ID (formerly Azure Active Directory).

Microsoft Entra ID is a cloud-based identity and access management service that provides:

  • User accounts
  • Group management
  • Authentication services
  • Authorization capabilities
  • Single Sign-On (SSO)
  • Multi-Factor Authentication (MFA)

Microsoft 365 relies on Microsoft Entra ID to manage identities.

Identity and Access Management (IAM)

Identity and Access Management (IAM) ensures that:

  • The correct users are identified.
  • Appropriate access is granted.
  • Access can be controlled and monitored.

IAM helps organizations maintain security while enabling productivity.

Authentication

Authentication verifies identity.

It answers:

Who are you?

Microsoft Entra supports multiple authentication methods, including:

  • Passwords
  • Microsoft Authenticator
  • SMS verification
  • Voice calls
  • FIDO2 security keys
  • Windows Hello for Business

Authentication occurs before authorization.

Authorization

Authorization determines what authenticated users are allowed to access.

It answers:

What are you allowed to do?

Examples include:

  • Accessing SharePoint sites.
  • Reading Exchange mailboxes.
  • Managing Teams settings.

Authorization is commonly controlled through:

  • Roles
  • Permissions
  • Policies

Single Sign-On (SSO)

Single Sign-On allows users to sign in once and access multiple applications without re-entering credentials.

Benefits include:

  • Improved user experience.
  • Reduced password fatigue.
  • Fewer password reset requests.
  • Increased productivity.

Users can access Microsoft 365 applications with one identity.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication requires more than one authentication factor.

Examples:

  1. Password
  2. Microsoft Authenticator approval

Benefits include:

  • Stronger security.
  • Reduced credential theft risk.
  • Better protection against phishing attacks.

MFA is one of Microsoft’s most important security recommendations.

Conditional Access

Conditional Access uses signals to determine whether access should be allowed.

Signals may include:

  • User identity
  • Device status
  • Location
  • Application being accessed
  • Risk level

Examples:

  • Require MFA outside the corporate network.
  • Block high-risk sign-ins.
  • Require compliant devices.

Conditional Access supports the Zero Trust principle of Verify Explicitly.

Role-Based Access Control (RBAC)

Microsoft Entra uses Role-Based Access Control to assign administrative privileges.

Examples of built-in roles include:

  • Global Administrator
  • User Administrator
  • Security Administrator
  • Exchange Administrator

RBAC follows the principle of least privilege by granting only the permissions required.

Groups

Groups simplify administration by allowing permissions and licenses to be assigned to multiple users simultaneously.

Types of groups include:

Security Groups

Used to assign permissions and policies.

Microsoft 365 Groups

Provide collaboration resources such as:

  • Outlook mailbox
  • Teams workspace
  • SharePoint site

Groups help reduce administrative effort.

Self-Service Capabilities

Microsoft Entra supports self-service features such as:

Self-Service Password Reset (SSPR)

Users can reset forgotten passwords without administrator assistance.

Benefits:

  • Reduced help desk workload.
  • Faster account recovery.

Self-Service Group Management

Users can manage group membership when permitted.

Device Identity and Management Integration

Microsoft Entra can recognize devices and work with Microsoft Intune.

This allows organizations to:

  • Register devices.
  • Evaluate compliance.
  • Control access based on device health.

Examples:

  • Require managed devices.
  • Block noncompliant devices.

External Identities

Organizations often collaborate with external users.

Microsoft Entra supports:

  • Guest users
  • Business partners
  • Contractors

External identities allow secure collaboration while maintaining administrative control.

Identity Protection

Microsoft Entra helps detect identity-related threats such as:

  • Credential theft
  • Suspicious sign-ins
  • Impossible travel scenarios
  • Password spray attacks

Identity protection helps organizations respond to risks quickly.

Identity Governance

Identity governance helps organizations manage:

  • Access reviews
  • Lifecycle management
  • Least privilege practices

Governance helps ensure users retain only the access they need.

Passwordless Authentication

Microsoft Entra supports passwordless sign-in methods including:

  • Microsoft Authenticator
  • Windows Hello for Business
  • FIDO2 security keys

Benefits include:

  • Improved user experience.
  • Reduced phishing risks.
  • Stronger security.

Microsoft Entra and Zero Trust

Microsoft Entra supports all three Zero Trust principles.

Verify Explicitly

Evaluate identity and access conditions.

Use Least Privileged Access

Grant only necessary permissions.

Assume Breach

Continuously monitor identity risks.

Microsoft Entra and Microsoft 365 Copilot

Microsoft 365 Copilot relies on Microsoft Entra identities.

Entra controls:

  • User authentication.
  • Authorization.
  • Access policies.
  • Group memberships.
  • Security controls.

Copilot inherits existing permissions and does not grant access to content users are not already authorized to view.

Benefits of Microsoft Entra

Organizations benefit from:

Centralized Identity Management

Manage users from a single platform.

Improved Security

Protect against identity attacks.

Better User Experience

Single Sign-On reduces friction.

Reduced Administrative Effort

Groups and self-service capabilities simplify management.

Support for Zero Trust

Access decisions are based on multiple signals.

Best Practices

Enable Multi-Factor Authentication

Protect identities against compromise.

Use Least Privilege

Assign only required permissions.

Implement Conditional Access

Strengthen access decisions.

Use Self-Service Password Reset

Reduce support costs.

Review Administrative Roles Regularly

Limit excessive privileges.

Exam Tips

Remember these key AB-900 concepts:

  • Microsoft Entra is Microsoft’s identity and access family.
  • Microsoft Entra ID was formerly Azure Active Directory.
  • Authentication verifies identity.
  • Authorization determines access.
  • Single Sign-On provides one login for multiple applications.
  • Multi-Factor Authentication improves security.
  • Conditional Access evaluates multiple signals.
  • RBAC controls administrative privileges.
  • Self-Service Password Reset reduces help desk workload.
  • Microsoft 365 Copilot relies on Microsoft Entra identities and permissions.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Entra?

A. Replace Microsoft Teams meetings
B. Manage identity and access to resources
C. Increase SharePoint storage capacity
D. Provide email hosting

Correct Answer: B

Explanation: Microsoft Entra provides identity and access management capabilities for users, applications, and devices.

Question 2

What was Microsoft Entra ID previously called?

A. Microsoft Intune
B. Azure Active Directory
C. Exchange Online
D. Microsoft Purview

Correct Answer: B

Explanation: Microsoft Entra ID is the new name for Azure Active Directory.

Question 3

Which capability allows users to sign in once and access multiple applications?

A. Multi-Factor Authentication
B. Conditional Access
C. Single Sign-On
D. Identity Governance

Correct Answer: C

Explanation: Single Sign-On improves user experience by reducing repeated sign-ins.

Question 4

Which Microsoft Entra feature allows users to reset forgotten passwords without administrator assistance?

A. Self-Service Password Reset
B. Privileged Identity Management
C. Role-Based Access Control
D. Conditional Access

Correct Answer: A

Explanation: Self-Service Password Reset reduces support requests and speeds account recovery.

Question 5

Which capability uses factors such as location and device compliance when making access decisions?

A. Dynamic Distribution Groups
B. Microsoft Lists
C. Conditional Access
D. Shared Mailboxes

Correct Answer: C

Explanation: Conditional Access evaluates various signals before granting access.

Question 6

What does authentication determine?

A. What permissions users have
B. Who the user is
C. Which Teams channel is created
D. Which files are deleted

Correct Answer: B

Explanation: Authentication verifies a user’s identity.

Question 7

Which principle is supported by Role-Based Access Control (RBAC)?

A. Maximum privilege
B. Open access
C. Unlimited permissions
D. Least privilege

Correct Answer: D

Explanation: RBAC grants only the permissions necessary to perform assigned tasks.

Question 8

Which authentication method strengthens security by requiring multiple verification factors?

A. Single Sign-On
B. Multi-Factor Authentication
C. Shared mailbox access
D. Version history

Correct Answer: B

Explanation: MFA provides stronger identity protection than passwords alone.

Question 9

What type of group provides collaboration resources such as Teams, Outlook mailboxes, and SharePoint sites?

A. Security group
B. Distribution list
C. Microsoft 365 group
D. Mail contact

Correct Answer: C

Explanation: Microsoft 365 groups provide shared collaboration resources.

Question 10

How does Microsoft 365 Copilot use Microsoft Entra?

A. It bypasses user permissions.
B. It replaces authentication requirements.
C. It creates anonymous access.
D. It relies on Entra identities and existing permissions.

Correct Answer: D

Explanation: Copilot respects existing identities, permissions, and security controls managed by Microsoft Entra.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Cybersecurity, Data Security, Microsoft Certification

Understand features and capabilities of Microsoft Defender XDR (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand features and capabilities of Microsoft Defender XDR

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Organizations today face attacks that target multiple areas simultaneously, including identities, email, endpoints, cloud applications, and collaboration platforms. Security teams need a unified way to detect, investigate, and respond to these threats.

Microsoft Defender XDR (Extended Detection and Response) is Microsoft’s integrated security platform that correlates signals across multiple security services to provide comprehensive threat protection.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the purpose, components, and key capabilities of Microsoft Defender XDR.

What Is Microsoft Defender XDR?

Microsoft Defender XDR is a security platform that:

  • Collects signals from multiple Microsoft security solutions.
  • Correlates related events.
  • Detects attacks across domains.
  • Automates investigations.
  • Supports incident response.

The “XDR” in Defender XDR stands for:

Extended Detection and Response

Unlike isolated security tools, Defender XDR provides a unified view of attacks across the organization.

Why Defender XDR Is Important

Traditional security tools often work independently.

For example:

  • Email security detects phishing.
  • Endpoint security detects malware.
  • Identity security detects suspicious sign-ins.

Without correlation, security teams may miss the fact that these events are part of the same attack.

Defender XDR connects these signals and presents them as a single incident.

Components of Microsoft Defender XDR

Defender XDR integrates several Microsoft Defender products.

Microsoft Defender for Office 365

Protects:

  • Exchange Online
  • Outlook
  • Microsoft Teams
  • SharePoint Online
  • OneDrive

Focus areas:

  • Phishing protection
  • Safe Links
  • Safe Attachments
  • Business email compromise protection

Microsoft Defender for Endpoint

Protects:

  • Windows devices
  • macOS devices
  • Mobile devices

Capabilities include:

  • Endpoint detection
  • Vulnerability management
  • Device monitoring
  • Automated remediation

Microsoft Defender for Identity

Protects user identities by monitoring:

  • Authentication activity
  • Suspicious sign-ins
  • Credential attacks
  • Lateral movement attempts

Microsoft Defender for Cloud Apps

Provides visibility into:

  • SaaS applications
  • Cloud usage
  • Shadow IT
  • Risky behavior

Unified Incident Management

One of Defender XDR’s most important capabilities is incident correlation.

Example

A phishing email causes:

  1. Credential theft.
  2. Suspicious sign-in activity.
  3. Malware installation.

Instead of producing three unrelated alerts, Defender XDR groups them into a single incident.

Benefits include:

  • Faster investigations.
  • Better understanding of attacks.
  • Reduced alert fatigue.

Alerts vs. Incidents

Alert

A single security event.

Examples:

  • Malware detected.
  • Suspicious email.
  • Risky sign-in.

Incident

A collection of related alerts representing an attack.

Security analysts typically investigate incidents rather than individual alerts.

Cross-Domain Visibility

Defender XDR provides visibility across:

DomainExamples
IdentitiesUser accounts and sign-ins
EndpointsComputers and devices
EmailExchange and Outlook
CollaborationTeams and SharePoint
ApplicationsCloud apps and services

This broad visibility helps identify complex attacks.

Automated Investigation and Response (AIR)

Defender XDR can automatically:

  1. Detect suspicious activity.
  2. Investigate evidence.
  3. Recommend actions.
  4. Perform remediation.

Examples include:

  • Isolating compromised devices.
  • Blocking malicious files.
  • Removing phishing emails.

Automation reduces the workload on security teams.

Attack Story and Incident Timeline

Defender XDR presents attacks visually through timelines.

Administrators can see:

  • When the attack started.
  • Which users were affected.
  • Which devices were involved.
  • How the attack progressed.

This helps security teams understand attack paths quickly.

Threat Intelligence

Microsoft Defender XDR uses Microsoft’s global threat intelligence network.

Microsoft analyzes trillions of signals from:

  • Microsoft 365
  • Azure
  • Windows
  • Identity systems
  • Cloud services

Threat intelligence helps identify:

  • Emerging threats
  • Known malicious actors
  • Attack patterns
  • Indicators of compromise

Threat Hunting

Security analysts can proactively search for threats using advanced hunting capabilities.

Threat hunting allows teams to:

  • Search large datasets.
  • Investigate suspicious activity.
  • Discover hidden threats.
  • Validate security concerns.

Rather than waiting for alerts, analysts actively look for attacks.

Automated Attack Disruption

Defender XDR can automatically interrupt attacks in progress.

Examples include:

  • Disabling compromised accounts.
  • Isolating devices.
  • Preventing lateral movement.

This capability helps reduce the impact of attacks before they spread.

Security Recommendations

Defender XDR provides recommendations that help organizations improve security posture.

Examples:

  • Enable Multi-Factor Authentication.
  • Reduce unnecessary permissions.
  • Update vulnerable devices.
  • Strengthen configurations.

These recommendations support Zero Trust principles.

Defender XDR and Zero Trust

Defender XDR supports all three Zero Trust principles.

Verify Explicitly

Analyze identities and sign-in behavior.

Use Least Privileged Access

Reduce attacker opportunities.

Assume Breach

Continuously monitor for suspicious activity.

Defender XDR and Microsoft 365 Copilot

Microsoft 365 Copilot benefits from the existing security protections provided by Defender XDR.

Defender XDR helps secure:

  • Emails
  • Teams conversations
  • SharePoint files
  • User identities
  • Devices

Copilot itself does not bypass security controls and continues to respect existing permissions.

Benefits of Microsoft Defender XDR

Organizations gain:

Unified Security Visibility

Multiple security signals appear in one platform.

Faster Detection

Threats are identified earlier.

Reduced Alert Fatigue

Related alerts are grouped into incidents.

Automated Response

Remediation can occur automatically.

Improved Security Operations

Security teams spend less time correlating events manually.

Best Practices

Enable Multi-Factor Authentication

Protect identities.

Review Incidents Regularly

Prioritize investigations.

Use Automated Investigation

Reduce manual effort.

Follow Security Recommendations

Improve overall posture.

Implement Zero Trust

Assume attacks can occur and prepare accordingly.

Exam Tips

Remember these AB-900 concepts:

  • XDR stands for Extended Detection and Response.
  • Defender XDR combines signals across multiple domains.
  • Alerts represent individual events.
  • Incidents group related alerts together.
  • Defender XDR integrates several Defender products.
  • Automated Investigation and Response (AIR) reduces manual work.
  • Threat intelligence helps identify emerging attacks.
  • Advanced hunting enables proactive investigations.
  • Automated attack disruption can stop attacks in progress.
  • Defender XDR supports Microsoft’s Zero Trust strategy.

Practice Exam Questions

Question 1

What does the “XDR” in Microsoft Defender XDR stand for?

A. Expanded Directory Routing
B. External Device Recovery
C. Exchange Data Replication
D. Extended Detection and Response

Correct Answer: D

Explanation: XDR stands for Extended Detection and Response and provides integrated threat protection across multiple domains.

Question 2

What is the primary purpose of Microsoft Defender XDR?

A. Increase mailbox sizes
B. Provide unified detection and response across security domains
C. Replace Microsoft Teams
D. Create SharePoint sites

Correct Answer: B

Explanation: Defender XDR correlates signals from multiple services to improve threat detection and response.

Question 3

Which Microsoft Defender product focuses on email and collaboration protection?

A. Defender for Endpoint
B. Defender for Identity
C. Defender for Office 365
D. Defender for Cloud Apps

Correct Answer: C

Explanation: Defender for Office 365 protects Exchange Online, Outlook, Teams, and related collaboration services.

Question 4

What is an incident in Microsoft Defender XDR?

A. A single sign-in attempt
B. A licensing error
C. A mailbox migration task
D. A collection of related security alerts

Correct Answer: D

Explanation: Incidents combine multiple related alerts into a single investigation.

Question 5

Which Defender component primarily protects devices?

A. Defender for Cloud Apps
B. Defender for Endpoint
C. Defender for Identity
D. Defender for Office 365

Correct Answer: B

Explanation: Defender for Endpoint provides security for computers and devices.

Question 6

What is the benefit of Automated Investigation and Response (AIR)?

A. Eliminates user accounts
B. Removes all security policies
C. Automates threat analysis and remediation
D. Replaces authentication

Correct Answer: C

Explanation: AIR helps detect, investigate, and respond to threats automatically.

Question 7

Which capability allows analysts to proactively search for hidden threats?

A. Safe Links
B. Threat hunting
C. Shared mailboxes
D. Distribution groups

Correct Answer: B

Explanation: Threat hunting enables analysts to investigate suspicious activity beyond standard alerts.

Question 8

Which Defender component focuses on identity-based attacks?

A. Defender for Identity
B. Defender for Endpoint
C. Defender for Office 365
D. Defender for Cloud Apps

Correct Answer: A

Explanation: Defender for Identity monitors authentication activity and suspicious account behavior.

Question 9

How does Defender XDR help reduce alert fatigue?

A. By deleting alerts automatically
B. By disabling auditing
C. By grouping related alerts into incidents
D. By preventing administrators from viewing alerts

Correct Answer: C

Explanation: Incident correlation allows analysts to investigate attacks more efficiently.

Question 10

Which Microsoft security principle is supported by Defender XDR’s continuous monitoring?

A. Trust Internal Networks
B. Assume Breach
C. Open Collaboration First
D. Disable Authentication

Correct Answer: B

Explanation: Continuous monitoring aligns with the Zero Trust principle of assuming that breaches can occur and detecting them quickly.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Data Security, Microsoft Certification

Understand threat protection and intelligence (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand threat protection and intelligence

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Cyber threats continue to evolve in complexity and frequency. Organizations using Microsoft 365 must protect users, devices, identities, applications, and data from attacks such as phishing, malware, ransomware, and business email compromise.

Threat protection and threat intelligence are key components of Microsoft 365 security. They help organizations:

  • Detect threats.
  • Prevent attacks.
  • Investigate suspicious activity.
  • Respond to incidents.
  • Learn from global threat intelligence.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding these concepts is essential because Microsoft 365 security capabilities are designed around proactive threat defense.

What Is Threat Protection?

Threat protection refers to the technologies and processes used to:

  • Prevent attacks.
  • Detect malicious activity.
  • Respond to incidents.
  • Minimize the impact of security events.

Threat protection helps secure:

  • User identities
  • Email systems
  • Devices
  • Applications
  • Data

Common Cyber Threats

Organizations face many types of attacks.

Phishing

Attackers send deceptive emails designed to trick users into:

  • Revealing passwords
  • Clicking malicious links
  • Downloading malware

Phishing is one of the most common attack methods.

Malware

Malicious software can:

  • Damage systems
  • Steal information
  • Monitor activity
  • Spread to other devices

Examples include:

  • Viruses
  • Worms
  • Trojans

Ransomware

Ransomware encrypts files and demands payment for their recovery.

Consequences include:

  • Data loss
  • Business interruption
  • Financial damage

Business Email Compromise (BEC)

Attackers impersonate executives or trusted contacts to convince employees to:

  • Transfer money
  • Reveal information
  • Approve fraudulent transactions

Credential Theft

Attackers attempt to steal usernames and passwords through:

  • Phishing
  • Password spraying
  • Brute-force attacks

What Is Threat Intelligence?

Threat intelligence is information gathered about cyber threats and attacker behavior.

Threat intelligence helps organizations:

  • Understand current attack trends.
  • Identify malicious actors.
  • Detect suspicious activity.
  • Improve security defenses.

Microsoft collects signals from billions of sources worldwide to build its threat intelligence capabilities.

Microsoft Security Signals

Microsoft analyzes signals from:

  • Microsoft 365
  • Azure
  • Windows devices
  • Email traffic
  • Authentication events
  • Cloud applications

These signals help identify emerging threats and provide organizations with actionable insights.

Microsoft Defender

Microsoft Defender is Microsoft’s threat protection platform.

It provides security across:

  • Email
  • Endpoints
  • Identities
  • Applications
  • Cloud workloads

Microsoft Defender helps organizations:

  • Prevent attacks.
  • Detect threats.
  • Investigate incidents.
  • Automate responses.

Microsoft Defender for Office 365

Microsoft Defender for Office 365 protects:

  • Exchange Online
  • Outlook
  • Microsoft Teams
  • SharePoint Online
  • OneDrive

Its primary focus is protecting users from email-based attacks.

Safe Links

Safe Links examines URLs in messages and documents.

Benefits:

  • Blocks malicious websites.
  • Protects against phishing attacks.
  • Evaluates links when users click them.

Safe Attachments

Safe Attachments analyzes files before users open them.

Suspicious files are:

  • Isolated
  • Scanned
  • Blocked if malicious

This helps prevent malware infections.

Anti-Phishing Protection

Anti-phishing policies help identify:

  • Spoofed senders
  • Impersonation attempts
  • Suspicious domains

These protections reduce credential theft risks.

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint protects devices such as:

  • Windows computers
  • macOS devices
  • Mobile devices

Capabilities include:

  • Threat detection
  • Vulnerability management
  • Device monitoring
  • Automated investigation

Microsoft Defender for Identity

Defender for Identity monitors identity-related threats.

Examples include:

  • Password attacks
  • Suspicious sign-ins
  • Lateral movement attempts

It helps protect user identities and privileged accounts.

Microsoft Defender for Cloud Apps

Defender for Cloud Apps helps organizations:

  • Monitor cloud applications.
  • Detect risky behavior.
  • Discover shadow IT.
  • Protect sensitive information.

Automated Investigation and Response (AIR)

Microsoft security solutions can automatically:

  1. Detect suspicious activity.
  2. Investigate the event.
  3. Recommend or perform remediation actions.

Automation reduces response times and improves efficiency.

Threat Detection and Alerts

Security systems continuously monitor activity.

Alerts may be generated for:

  • Unusual sign-ins
  • Malware detections
  • Excessive file downloads
  • Phishing attempts

Administrators can investigate alerts and determine appropriate actions.

Security Incidents

Multiple related alerts may be grouped into an incident.

An incident provides:

  • A timeline of events.
  • Affected users.
  • Devices involved.
  • Recommended remediation steps.

Grouping alerts simplifies investigations.

Threat Hunting

Threat hunting is the proactive search for hidden threats within an environment.

Rather than waiting for alerts, analysts actively look for:

  • Suspicious activity
  • Abnormal behavior
  • Potential compromise indicators

Threat Protection and Zero Trust

Threat protection supports all Zero Trust principles.

Verify Explicitly

Analyze identity and access signals.

Use Least Privileged Access

Limit attacker capabilities.

Assume Breach

Continuously monitor and investigate suspicious activity.

Threat Protection and Microsoft 365 Copilot

Microsoft 365 Copilot inherits Microsoft 365 security protections.

Copilot itself does not:

  • Bypass security controls.
  • Override permissions.
  • Expose unauthorized content.

Threat protection mechanisms continue to protect:

  • Emails
  • Files
  • Teams conversations
  • SharePoint content

Benefits of Threat Intelligence

Threat intelligence helps organizations:

Detect Attacks Earlier

Identify malicious activity before damage occurs.

Improve Security Decisions

Use real-world intelligence to strengthen defenses.

Respond Faster

Automated investigation reduces response times.

Reduce Risk

Continuous monitoring improves overall security posture.

Best Practices

Enable Multi-Factor Authentication

Protect accounts from credential theft.

Use Microsoft Defender Solutions

Implement layered protection.

Educate Users About Phishing

Human awareness remains important.

Review Security Alerts Regularly

Investigate suspicious activity promptly.

Keep Systems Updated

Reduce vulnerabilities attackers can exploit.

Exam Tips

Remember these key AB-900 concepts:

  • Threat protection prevents, detects, and responds to attacks.
  • Threat intelligence provides information about emerging threats.
  • Phishing attacks target users through deceptive communications.
  • Ransomware encrypts files and demands payment.
  • Microsoft Defender provides integrated threat protection.
  • Safe Links protects against malicious URLs.
  • Safe Attachments protects against harmful files.
  • Alerts identify suspicious activity.
  • Multiple alerts may be grouped into incidents.
  • Threat protection supports Microsoft’s Zero Trust strategy.

Practice Exam Questions

Question 1

What is the primary purpose of threat protection?

A. Increase mailbox storage quotas
B. Prevent, detect, and respond to cyber threats
C. Create SharePoint sites automatically
D. Manage software licenses

Correct Answer: B

Explanation: Threat protection helps organizations identify and respond to attacks while minimizing their impact.

Question 2

Which attack attempts to trick users into revealing credentials or clicking malicious links?

A. Phishing
B. Compression attacks
C. Data deduplication
D. Versioning

Correct Answer: A

Explanation: Phishing uses deceptive communications to steal information or deliver malware.

Question 3

What is ransomware designed to do?

A. Improve email performance
B. Increase authentication speed
C. Encrypt files and demand payment
D. Create backup copies automatically

Correct Answer: C

Explanation: Ransomware locks data and attempts to extort victims for recovery access.

Question 4

What is threat intelligence?

A. A type of file storage
B. A SharePoint permission model
C. A Teams collaboration feature
D. Information about threats and attacker behavior

Correct Answer: D

Explanation: Threat intelligence helps organizations understand current threats and improve defenses.

Question 5

Which Microsoft security solution provides broad threat protection across identities, devices, and applications?

A. Microsoft Defender
B. Microsoft Lists
C. Microsoft Forms
D. Microsoft Planner

Correct Answer: A

Explanation: Microsoft Defender is Microsoft’s integrated security platform.

Question 6

Which Microsoft Defender for Office 365 feature evaluates URLs when users click them?

A. Safe Attachments
B. Conditional Access
C. Safe Links
D. Windows Hello

Correct Answer: C

Explanation: Safe Links checks URLs to protect users from malicious websites.

Question 7

Which feature analyzes files before users open them?

A. Safe Attachments
B. RBAC
C. External Access
D. Dynamic Groups

Correct Answer: A

Explanation: Safe Attachments helps prevent malware infections by scanning files before delivery.

Question 8

What can happen when several related security alerts are detected?

A. They are deleted automatically.
B. They are combined into a security incident.
C. They are converted into Teams messages only.
D. They are ignored after 24 hours.

Correct Answer: B

Explanation: Grouping alerts into incidents provides a broader view of attacks.

Question 9

What is the purpose of threat hunting?

A. Increasing mailbox sizes
B. Managing distribution lists
C. Proactively searching for hidden threats
D. Assigning user licenses

Correct Answer: C

Explanation: Threat hunting involves actively investigating environments for suspicious activity.

Question 10

Which Microsoft Defender for Office 365 capability helps identify impersonation and spoofing attempts?

A. Safe Attachments
B. Device Compliance Policies
C. SharePoint Permissions
D. Anti-Phishing Protection

Correct Answer: D

Explanation: Anti-phishing policies help detect impersonation attacks and suspicious senders.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Data Security, Microsoft Certification

Understand authentication methods (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand authentication methods

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Authentication is one of the foundational security concepts in Microsoft 365. Before users can access email, files, Teams conversations, or Microsoft 365 Copilot experiences, the system must first verify their identity.

Authentication answers the question:

“Who are you?”

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, it is important to understand the various authentication methods available in Microsoft 365 and how they help secure organizational resources.

What Is Authentication?

Authentication is the process of verifying a user’s identity before granting access to Microsoft 365 resources.

When users sign in, Microsoft Entra ID (formerly Azure Active Directory) validates their credentials and determines whether they are who they claim to be.

Authentication occurs before authorization.

Example

  1. User enters credentials.
  2. Microsoft verifies identity.
  3. Authorization determines what resources the user can access.

Authentication vs. Authorization

Although closely related, these are different concepts.

AuthenticationAuthorization
Verifies identityDetermines access rights
Answers “Who are you?”Answers “What can you do?”
Occurs firstOccurs second
Uses credentials and identity factorsUses permissions and policies

Why Authentication Is Important

Authentication helps organizations:

  • Prevent unauthorized access.
  • Protect sensitive data.
  • Reduce credential theft risks.
  • Support Zero Trust security.
  • Enable secure remote work.

Without authentication, Microsoft 365 resources would be exposed to anyone.

Authentication Factors

Authentication methods are based on one or more factors.

Something You Know

Examples:

  • Passwords
  • PINs
  • Security questions

Something You Have

Examples:

  • Smartphone
  • Hardware token
  • Security key

Something You Are

Examples:

  • Fingerprint
  • Facial recognition
  • Biometrics

Using multiple factors increases security.

Single-Factor Authentication (SFA)

Single-factor authentication requires only one credential.

Typically:

Username + Password

Advantages:

  • Simple
  • Familiar

Disadvantages:

  • Vulnerable to phishing attacks.
  • Password theft can lead to account compromise.

Because passwords alone are risky, organizations increasingly use stronger authentication methods.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) requires two or more authentication factors.

Example:

  1. User enters a password.
  2. User approves a request in Microsoft Authenticator.

Benefits include:

  • Stronger protection against compromised passwords.
  • Reduced account takeover risk.
  • Improved compliance.

Microsoft strongly recommends MFA for all users.

Common MFA Methods in Microsoft 365

Microsoft 365 supports several MFA options.

Microsoft Authenticator App

Users receive:

  • Push notifications
  • Number matching prompts
  • Verification approvals

Advantages:

  • Secure
  • Convenient
  • Widely recommended by Microsoft

Text Message (SMS)

Users receive a verification code by text.

Advantages:

  • Easy to use.

Limitations:

  • Less secure than app-based authentication.
  • Vulnerable to SIM-swapping attacks.

Voice Calls

Users receive an automated phone call with verification instructions.

This method is supported but is generally less secure than app-based options.

Hardware Security Keys

Physical devices such as FIDO2 security keys provide strong authentication.

Benefits:

  • Resistant to phishing attacks.
  • Passwordless capability.
  • Strong protection for privileged accounts.

Passwordless Authentication

Passwordless authentication eliminates traditional passwords.

Instead, users authenticate through:

  • Microsoft Authenticator
  • FIDO2 security keys
  • Windows Hello for Business

Benefits include:

  • Reduced phishing risk.
  • Improved user experience.
  • Fewer password-related support requests.

Passwordless authentication is a key part of Microsoft’s security strategy.

Windows Hello for Business

Windows Hello for Business uses:

  • Facial recognition
  • Fingerprint recognition
  • PINs

Because biometric information remains on the device, this method provides strong security and convenience.

FIDO2 Security Keys

FIDO2 keys are physical authentication devices.

Examples include:

  • USB keys
  • NFC keys

Benefits:

  • Passwordless sign-in.
  • Protection against phishing.
  • Strong authentication for administrators.

Certificate-Based Authentication

Certificate-based authentication uses digital certificates to verify identity.

Organizations commonly use this method for:

  • Highly secure environments
  • Smart cards
  • Specialized devices

Legacy Authentication

Legacy authentication uses older protocols that often rely only on usernames and passwords.

Examples include:

  • POP3
  • IMAP
  • SMTP AUTH (certain scenarios)

These methods do not support modern security controls like MFA.

Because of their security risks, organizations are encouraged to disable legacy authentication whenever possible.

Adaptive Authentication and Conditional Access

Microsoft Entra Conditional Access can require additional authentication based on risk factors.

Examples:

  • Require MFA outside the corporate network.
  • Block risky sign-ins.
  • Require compliant devices.

This supports the Zero Trust principle of Verify Explicitly.

Password Policies

Strong passwords remain important.

Best practices include:

  • Long passwords or passphrases.
  • Avoiding reused passwords.
  • Avoiding predictable information.
  • Enabling MFA.

Microsoft recommends focusing on password quality rather than forcing frequent password changes.

Authentication in Zero Trust

Authentication supports Zero Trust by:

Verifying Identity Continuously

Access requests are evaluated using multiple signals.

Reducing Credential Risks

MFA strengthens security.

Supporting Least Privilege

Only verified users receive access.

Authentication and Microsoft 365 Copilot

Microsoft 365 Copilot relies on existing Microsoft 365 identities.

Users must authenticate before accessing:

  • Outlook
  • Teams
  • SharePoint
  • Word
  • Copilot experiences

Copilot itself does not bypass authentication requirements.

Best Practices

Enable Multi-Factor Authentication

MFA is one of the most effective security controls.

Adopt Passwordless Authentication

Reduce reliance on passwords.

Use Microsoft Authenticator

Prefer app-based verification over SMS.

Disable Legacy Authentication

Reduce exposure to credential attacks.

Protect Administrator Accounts

Use stronger authentication methods for privileged users.

Exam Tips

Remember these key AB-900 concepts:

  • Authentication verifies identity.
  • Authentication occurs before authorization.
  • Single-factor authentication usually relies on passwords.
  • MFA uses multiple authentication factors.
  • Microsoft Authenticator is a recommended MFA method.
  • Passwordless authentication improves security.
  • Windows Hello for Business supports biometric authentication.
  • FIDO2 security keys provide phishing-resistant authentication.
  • Legacy authentication is less secure because it often does not support MFA.
  • Conditional Access can require additional authentication based on risk.

Practice Exam Questions

Question 1

What question does authentication answer?

A. Who is the user?
B. How much storage is available?
C. What resources can the user access?
D. Which files should be encrypted?

Correct Answer: A

Explanation: Authentication verifies identity and determines whether the user is who they claim to be.

Question 2

Which process occurs before authorization?

A. Authentication
B. Auditing
C. Encryption
D. Data classification

Correct Answer: A

Explanation: Users must first prove their identity before permissions are evaluated.

Question 3

Which example represents multi-factor authentication?

A. Username only
B. Password only
C. PIN only
D. Password and Microsoft Authenticator approval

Correct Answer: D

Explanation: MFA requires multiple authentication factors rather than relying on a single credential.

Question 4

Which authentication factor category includes a fingerprint?

A. Something you know
B. Something you have
C. Something you own
D. Something you are

Correct Answer: D

Explanation: Biometrics are considered “something you are.”

Question 5

Which Microsoft solution provides app-based MFA approvals?

A. Microsoft Authenticator
B. Exchange Online
C. SharePoint Online
D. Microsoft Purview

Correct Answer: A

Explanation: Microsoft Authenticator supports push notifications and secure MFA verification.

Question 6

What is a major advantage of passwordless authentication?

A. Increased mailbox size
B. Reduced phishing risks
C. Automatic role assignments
D. Elimination of permissions

Correct Answer: B

Explanation: Removing passwords helps reduce common attack methods such as phishing.

Question 7

Which authentication method uses facial recognition or fingerprints?

A. FIDO2
B. SMS verification
C. Voice call authentication
D. Windows Hello for Business

Correct Answer: D

Explanation: Windows Hello for Business supports biometric authentication and PIN-based sign-in.

Question 8

Why are legacy authentication protocols considered less secure?

A. They consume more storage.
B. They disable file sharing.
C. They often do not support modern protections such as MFA.
D. They prevent Teams meetings.

Correct Answer: C

Explanation: Legacy authentication protocols typically rely only on usernames and passwords.

Question 9

Which technology can require additional authentication based on risk conditions?

A. Conditional Access
B. Distribution groups
C. Shared mailboxes
D. Version history

Correct Answer: A

Explanation: Conditional Access evaluates signals and can require MFA or block access.

Question 10

Which authentication method provides phishing-resistant, passwordless sign-in through a physical device?

A. SMS codes
B. Security questions
C. Voice calls
D. FIDO2 security keys

Correct Answer: D

Explanation: FIDO2 keys provide strong passwordless authentication and resist phishing attacks.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Data Security, Microsoft Certification

Understand Authorization (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand Authorization

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

In Microsoft 365 security, protecting resources involves two closely related concepts:

  • Authentication
  • Authorization

Although these terms are often confused, they serve different purposes.

  • Authentication answers the question: “Who are you?”
  • Authorization answers the question: “What are you allowed to do?”

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding authorization is important because Microsoft 365 relies heavily on permissions, roles, and policies to determine what users can access.

What Is Authorization?

Authorization is the process of determining whether an authenticated user has permission to access a resource or perform an action.

Examples of resources include:

  • Email messages
  • SharePoint sites
  • Teams channels
  • Files and folders
  • Applications
  • Administrative settings

Authorization occurs after authentication.

Authentication vs. Authorization

These concepts work together but perform different functions.

AuthenticationAuthorization
Verifies identityDetermines access rights
Answers “Who are you?”Answers “What can you do?”
Usually requires credentialsUses permissions and policies
Happens firstHappens second

Example

  1. A user signs in with their Microsoft 365 account.
  2. Microsoft verifies their identity (authentication).
  3. Microsoft checks whether they are allowed to access a file (authorization).

Real-World Example

Imagine entering an office building.

Authentication

Showing your employee badge proves who you are.

Authorization

Your badge determines:

  • Which floors you may enter.
  • Which rooms you can access.
  • Whether you can enter the server room.

Not every employee receives the same level of access.

Why Authorization Is Important

Authorization helps organizations:

  • Protect sensitive information.
  • Limit insider threats.
  • Enforce security policies.
  • Support compliance requirements.
  • Implement the Zero Trust model.

Without authorization controls, every authenticated user would have unrestricted access to organizational data.

Authorization in Microsoft 365

Microsoft 365 uses authorization to control access to:

SharePoint

  • Sites
  • Libraries
  • Files
  • Folders

Microsoft Teams

  • Teams
  • Channels
  • Meetings

Exchange Online

  • Mailboxes
  • Distribution groups
  • Shared mailboxes

Copilot Experiences

  • Documents
  • Emails
  • Teams conversations
  • Knowledge sources

Permissions

Permissions are the primary mechanism used to implement authorization.

Permissions define what actions users can perform.

Examples include:

  • Read
  • Edit
  • Create
  • Delete
  • Full Control

Different users may receive different permissions for the same resource.

Role-Based Access Control (RBAC)

Microsoft 365 uses Role-Based Access Control (RBAC) to assign permissions according to job responsibilities.

Instead of assigning permissions individually to every user, permissions are grouped into roles.

Examples include:

RolePurpose
Global AdministratorManage the entire Microsoft 365 tenant
User AdministratorManage user accounts
SharePoint AdministratorManage SharePoint Online
Teams AdministratorManage Microsoft Teams
Exchange AdministratorManage Exchange Online

RBAC simplifies administration and supports the principle of least privilege.

Least Privilege and Authorization

Authorization supports the Zero Trust principle of Least Privileged Access.

Users should receive only the permissions necessary to perform their work.

Example:

  • HR employees can access HR documents.
  • Finance employees can access financial reports.
  • Marketing employees cannot view payroll files.

Restricting access reduces the impact of compromised accounts.

Group-Based Authorization

Permissions are often assigned through groups rather than individual users.

Examples:

  • Microsoft 365 Groups
  • Security Groups
  • SharePoint Groups

Benefits include:

  • Easier administration
  • Consistent access
  • Reduced errors
  • Simplified onboarding

When a user joins a group, they inherit the group’s permissions.

SharePoint Authorization

SharePoint permissions determine who can:

  • View documents
  • Edit content
  • Upload files
  • Manage sites

Common permission levels include:

Permission LevelCapabilities
ReadView content
EditModify content
Full ControlManage settings and permissions

A user without permission cannot access the content even if they know the file location.

Teams Authorization

Microsoft Teams uses authorization to determine:

  • Team membership
  • Channel access
  • Meeting permissions
  • App availability

For example:

  • Members of a team can participate in discussions.
  • Users outside the team cannot access conversations.
  • Private channels restrict access to selected members.

Exchange Online Authorization

Authorization determines access to:

  • Mailboxes
  • Shared mailboxes
  • Calendars
  • Distribution groups

Example:

An executive assistant may be granted permission to manage another user’s mailbox.

Conditional Access and Authorization

Conditional Access can add requirements before access is granted.

Examples include:

  • Requiring Multi-Factor Authentication (MFA)
  • Blocking risky sign-ins
  • Restricting access from unmanaged devices

Conditional Access combines identity signals with authorization decisions.

Administrative Roles

Administrative roles provide authorization for management tasks.

Examples:

Global Administrator

Can manage nearly every Microsoft 365 service.

Teams Administrator

Can manage Teams settings but not Exchange settings.

SharePoint Administrator

Can manage SharePoint but not user licensing.

This separation helps implement least privilege.

Authorization and Microsoft 365 Copilot

Microsoft 365 Copilot relies entirely on existing authorization controls.

Copilot:

  • Does not bypass permissions.
  • Cannot expose restricted information.
  • Only retrieves content users are already authorized to access.

Example

Suppose:

  • Alice has access to Finance documents.
  • Bob does not.

If Bob asks Copilot for salary reports, Copilot cannot retrieve them because Bob lacks authorization.

Authorization in Zero Trust

Authorization supports all three Zero Trust principles:

Verify Explicitly

Access decisions consider identity and context.

Use Least Privileged Access

Users receive only necessary permissions.

Assume Breach

Limiting permissions reduces the impact of attacks.

Best Practices

Assign Roles Carefully

Avoid excessive privileges.

Use Groups Instead of Individual Permissions

Simplify management.

Follow Least Privilege

Grant only required access.

Review Permissions Regularly

Remove outdated permissions.

Use MFA and Conditional Access

Strengthen authorization decisions.

Exam Tips

Remember these key AB-900 concepts:

  • Authentication verifies identity.
  • Authorization determines access rights.
  • Authorization occurs after authentication.
  • Permissions define what users can do.
  • RBAC assigns permissions through roles.
  • Least privilege limits unnecessary access.
  • Groups simplify permission management.
  • Conditional Access can influence authorization decisions.
  • Microsoft 365 Copilot respects existing permissions.
  • Users cannot access resources without authorization.

Practice Exam Questions

Question 1

Which question does authorization answer?

A. Where is the data stored?
B. Which password should be used?
C. What resources is the user allowed to access?
D. Is the device encrypted?

Correct Answer: C

Explanation: Authorization determines what actions an authenticated user is permitted to perform.

Question 2

Which process occurs first in Microsoft 365?

A. Authorization
B. Authentication
C. Auditing
D. Encryption

Correct Answer: B

Explanation: Users must first prove their identity before access rights can be evaluated.

Question 3

What is the primary purpose of Role-Based Access Control (RBAC)?

A. Encrypt files automatically
B. Create mailboxes
C. Assign permissions according to job responsibilities
D. Replace authentication

Correct Answer: C

Explanation: RBAC groups permissions into roles that align with organizational responsibilities.

Question 4

Which Microsoft 365 principle is directly supported by limiting permissions to only what users need?

A. External collaboration
B. Shared responsibility
C. Multi-tenancy
D. Least privilege

Correct Answer: D

Explanation: Least privilege minimizes unnecessary access and reduces security risks.

Question 5

A user signs in successfully but cannot open a SharePoint file. What is the most likely reason?

A. Authentication failed.
B. The user lacks authorization to the file.
C. The file was encrypted.
D. The device lacks internet access.

Correct Answer: B

Explanation: Successful authentication does not guarantee permission to access resources.

Question 6

Which mechanism is commonly used to simplify authorization management?

A. Distribution lists
B. Version history
C. Group-based permissions
D. Mail flow rules

Correct Answer: C

Explanation: Assigning permissions to groups is easier and more consistent than assigning permissions individually.

Question 7

Which Microsoft 365 administrative role can manage SharePoint Online but does not automatically manage Teams or Exchange?

A. Global Administrator
B. SharePoint Administrator
C. User Administrator
D. Billing Administrator

Correct Answer: B

Explanation: SharePoint Administrators are responsible specifically for SharePoint services.

Question 8

How does Microsoft 365 Copilot use authorization?

A. It ignores permissions to improve productivity.
B. It temporarily grants access to hidden documents.
C. It bypasses SharePoint security.
D. It only retrieves information users are already authorized to access.

Correct Answer: D

Explanation: Copilot honors existing Microsoft 365 permissions and security boundaries.

Question 9

Which statement best describes authentication and authorization?

A. They are the same process.
B. Authorization occurs before authentication.
C. Authentication verifies identity, and authorization determines access.
D. Authentication controls permissions.

Correct Answer: C

Explanation: Authentication confirms who the user is, while authorization determines what they may access.

Question 10

Which Microsoft capability can require additional conditions, such as MFA, before granting access?

A. Distribution groups
B. Conditional Access
C. Version history
D. Shared mailboxes

Correct Answer: B

Explanation: Conditional Access evaluates signals and can impose additional requirements before authorization is granted.

Go to the AB-900 Exam Prep Hub main page

AB-900, Microsoft Certification

Explain the core Zero Trust principles (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Explain the core Zero Trust principles

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern organizations face increasingly sophisticated cyber threats. Traditional security models assumed that users and devices inside the corporate network could automatically be trusted. However, with cloud computing, remote work, mobile devices, and AI-powered services, this approach is no longer sufficient.

Zero Trust is Microsoft’s modern security strategy that assumes no user, device, application, or network should be automatically trusted. Instead, every access request must be verified before access is granted.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding the core Zero Trust principles is essential because Microsoft 365 security capabilities are built around this model.

What Is Zero Trust?

Zero Trust is a security model based on the idea:

“Never trust, always verify.”

Instead of assuming that users inside the network are trustworthy, Zero Trust continuously validates:

  • Identity
  • Device health
  • Location
  • Risk level
  • Access requirements

The goal is to minimize unauthorized access and reduce the impact of security breaches.

Why Traditional Security Models Are Insufficient

Older security models relied on a network perimeter.

Example:

Outside Network = Untrusted
Inside Network = Trusted

This approach becomes ineffective when:

  • Users work remotely.
  • Data resides in the cloud.
  • Devices connect from multiple locations.
  • Attackers compromise user credentials.

Zero Trust assumes that threats can exist both inside and outside the organization.

The Three Core Zero Trust Principles

Microsoft defines three fundamental Zero Trust principles:

  1. Verify Explicitly
  2. Use Least Privileged Access
  3. Assume Breach

These principles work together to strengthen security.

Principle 1: Verify Explicitly

“Always authenticate and authorize based on all available data.”

Every access request should be evaluated using multiple signals.

Examples include:

  • User identity
  • Device status
  • Location
  • Application being accessed
  • User risk level
  • Data sensitivity

Access is granted only after verification.

Multi-Factor Authentication (MFA)

MFA is one example of explicit verification.

Instead of relying only on passwords, users provide additional evidence such as:

  • Authenticator app approval
  • Text message code
  • Hardware token
  • Biometrics

MFA significantly reduces the risk of compromised credentials.

Conditional Access

Microsoft Entra Conditional Access evaluates signals before granting access.

Examples:

  • Require MFA outside the corporate network.
  • Block high-risk sign-ins.
  • Restrict access from unmanaged devices.

Conditional Access supports the Verify Explicitly principle.

Principle 2: Use Least Privileged Access

“Grant only the minimum access necessary.”

Users should receive only the permissions required to perform their work.

Least privilege reduces the potential damage caused by:

  • Human error
  • Compromised accounts
  • Insider threats

Examples of Least Privilege

Example 1

A finance employee receives access only to finance documents.

Example 2

An HR employee cannot view confidential engineering files.

Example 3

Most users do not receive administrator privileges.

Role-Based Access Control (RBAC)

RBAC assigns permissions according to job roles.

Examples:

RoleTypical Permissions
Global AdministratorFull tenant administration
User AdministratorUser management only
SharePoint AdministratorSharePoint administration only
Teams AdministratorTeams administration only

RBAC prevents excessive permissions.

Just-In-Time (JIT) Access

Administrative access can be granted temporarily when needed.

Benefits include:

  • Reduced attack surface.
  • Lower risk of privileged account abuse.
  • Improved auditing.

Principle 3: Assume Breach

“Operate as though an attacker is already present.”

Zero Trust assumes that security incidents may occur despite preventive measures.

Organizations should:

  • Limit the spread of attacks.
  • Detect suspicious activity quickly.
  • Respond rapidly to incidents.

Segmentation

Resources are divided into smaller areas.

Examples:

  • HR data separated from Finance data.
  • Department-specific SharePoint sites.
  • Restricted Teams channels.

Segmentation prevents attackers from moving freely across the environment.

Monitoring and Logging

Continuous monitoring helps detect:

  • Unusual sign-ins.
  • Excessive file downloads.
  • Suspicious device behavior.

Microsoft security solutions analyze these signals to identify threats.

Incident Response

Organizations should have plans for:

  • Investigating attacks.
  • Containing compromised accounts.
  • Recovering services.
  • Restoring operations.

Zero Trust focuses not only on prevention but also on resilience.

Zero Trust Pillars

Microsoft extends Zero Trust across several areas:

Identities

Verify users and administrators.

Devices

Ensure devices meet security requirements.

Applications

Protect access to applications.

Data

Secure sensitive information.

Infrastructure

Protect servers and workloads.

Networks

Secure communication paths.

These pillars work together to provide layered protection.

Zero Trust in Microsoft 365

Microsoft 365 incorporates Zero Trust through features such as:

  • Microsoft Entra ID
  • Multi-Factor Authentication (MFA)
  • Conditional Access
  • Microsoft Defender
  • Microsoft Purview
  • Role-Based Access Control
  • Data Loss Prevention (DLP)

These capabilities help organizations implement Zero Trust without building custom solutions.

Zero Trust and Microsoft 365 Copilot

Microsoft 365 Copilot follows Zero Trust principles.

Copilot:

  • Uses existing permissions.
  • Does not bypass security.
  • Only accesses data users are already authorized to view.
  • Respects SharePoint, Teams, and Exchange permissions.

For example:

If a user cannot access an HR document, Copilot cannot retrieve or summarize that document for them.

Benefits of Zero Trust

Organizations implementing Zero Trust gain:

Improved Security

Reduced risk of unauthorized access.

Better Protection Against Credential Theft

MFA and Conditional Access strengthen identity security.

Reduced Attack Surface

Least privilege minimizes exposure.

Faster Threat Detection

Continuous monitoring identifies suspicious activity.

Support for Remote Work

Security is based on identity and context rather than location.

Best Practices

Enable Multi-Factor Authentication

MFA is one of the most effective security controls.

Assign Administrative Roles Carefully

Avoid excessive privileges.

Review Permissions Regularly

Remove unnecessary access.

Monitor Sign-In Activity

Identify abnormal behavior.

Assume Breaches Can Occur

Prepare response plans before incidents happen.

Exam Tips

Remember these AB-900 concepts:

  • Zero Trust means “Never trust, always verify.”
  • Microsoft defines three core principles:
    • Verify Explicitly
    • Use Least Privileged Access
    • Assume Breach
  • MFA supports explicit verification.
  • Role-Based Access Control supports least privilege.
  • Segmentation supports the Assume Breach principle.
  • Conditional Access evaluates signals before granting access.
  • Zero Trust applies to identities, devices, applications, and data.
  • Microsoft 365 Copilot respects existing permissions and security controls.

Practice Exam Questions

Question 1

Which phrase best summarizes the Zero Trust security model?

A. Trust internal users automatically
B. Never trust, always verify
C. Secure only external users
D. Block all remote access

Correct Answer: B

Explanation: Zero Trust assumes that no user or device should be automatically trusted and that every access request should be verified.

Question 2

Which of the following is one of Microsoft’s three core Zero Trust principles?

A. Enable Open Access
B. Trust the Network
C. Assume Breach
D. Ignore Insider Threats

Correct Answer: C

Explanation: Assume Breach is one of the three core principles alongside Verify Explicitly and Use Least Privileged Access.

Question 3

Which Microsoft capability is commonly used to support the Verify Explicitly principle?

A. Document version history
B. SharePoint communication sites
C. Multi-Factor Authentication (MFA)
D. Exchange distribution groups

Correct Answer: C

Explanation: MFA requires additional forms of verification beyond passwords and supports explicit verification.

Question 4

What is the goal of the Least Privileged Access principle?

A. Give users administrator rights by default.
B. Grant only the access users need to perform their jobs.
C. Allow unrestricted file access.
D. Eliminate authentication requirements.

Correct Answer: B

Explanation: Least privilege minimizes risk by limiting permissions to what is necessary.

Question 5

Which concept helps implement least privilege by assigning permissions according to job responsibilities?

A. External sharing
B. Dynamic distribution groups
C. Role-Based Access Control (RBAC)
D. Site collections

Correct Answer: C

Explanation: RBAC assigns permissions based on roles rather than giving broad access to everyone.

Question 6

Under the Assume Breach principle, organizations should operate as though:

A. No attacks are possible.
B. Security controls are unnecessary.
C. Internal networks are always trusted.
D. Attackers may already be present.

Correct Answer: D

Explanation: Zero Trust assumes breaches can occur and focuses on limiting their impact.

Question 7

Which technology evaluates user and device conditions before granting access?

A. Conditional Access
B. Version history
C. Distribution lists
D. Mail contacts

Correct Answer: A

Explanation: Conditional Access uses signals such as device health and location to determine access requirements.

Question 8

How does Microsoft 365 Copilot align with Zero Trust principles?

A. It bypasses SharePoint permissions.
B. It grants temporary administrator rights.
C. It accesses only information users are already authorized to view.
D. It ignores role assignments.

Correct Answer: C

Explanation: Copilot respects existing permissions and cannot expose unauthorized information.

Question 9

Which activity supports the Assume Breach principle?

A. Disabling authentication
B. Continuous monitoring and logging
C. Sharing all documents publicly
D. Removing security policies

Correct Answer: B

Explanation: Monitoring helps organizations detect and respond to suspicious behavior.

Question 10

Which core Zero Trust principle is directly supported by Role-Based Access Control?

A. Verify Explicitly
B. Assume Breach
C. Encrypt Everything
D. Use Least Privileged Access

Correct Answer: D

Explanation: RBAC limits permissions according to job roles, supporting least privilege.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, Microsoft Certification

Identify the appropriate objects to configure by using the Teams Admin Center (teams, channels, and policies) (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core objects of Microsoft 365 services
      --> Identify the appropriate objects to configure by using the Teams Admin Center (teams, channels, and policies)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Microsoft Teams is the primary collaboration platform in Microsoft 365. It combines chat, meetings, calling, file sharing, and application integration into a single workspace.

The Teams admin center is the centralized portal used by administrators to manage Microsoft Teams across the organization. For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, administrators should understand the major Teams objects they manage:

  • Teams
  • Channels
  • Policies

These objects control how users collaborate and how Teams experiences are delivered throughout the organization.

What Is the Teams Admin Center?

The Teams admin center is a web-based portal used to manage Microsoft Teams services.

Administrators can:

  • Manage teams and users.
  • Configure meetings and calling.
  • Apply policies.
  • Monitor usage.
  • Manage devices.
  • Configure external access.
  • Troubleshoot Teams services.

The Teams admin center focuses specifically on collaboration and communication services.

Understanding the Teams Structure

Microsoft Teams uses a hierarchy similar to the following:

Team
   ↓
Channel
      ↓
Conversations and Files

Understanding this hierarchy is essential for the AB-900 exam.

What Is a Team?

A team is a collaborative workspace for a group of users.

A team can contain:

  • Members
  • Owners
  • Channels
  • Conversations
  • Shared files
  • Apps
  • Tabs

Teams are often created for:

  • Departments
  • Projects
  • Committees
  • Business units

Examples:

  • Finance Team
  • Marketing Team
  • HR Team

Team Owners

Team Owners manage the team.

Owners can:

  • Add and remove members.
  • Create channels.
  • Configure settings.
  • Manage apps.
  • Delete channels.

A team can have multiple owners.

Team Members

Members are regular participants within the team.

Members can:

  • Participate in conversations.
  • Upload files.
  • Collaborate with others.
  • Access shared resources.

Members have fewer permissions than owners.

Team Files and SharePoint Integration

Files shared in Teams are stored in SharePoint Online.

This means:

  • Teams provides the collaboration interface.
  • SharePoint provides the storage.

For example:

Marketing Team
      ↓
General Channel
      ↓
Files
      ↓
Stored in SharePoint

This integration is important because Microsoft 365 Copilot may use information stored in SharePoint.

Team Types

Private Teams

Only approved members can join.

Characteristics:

  • Membership is controlled.
  • Team content is visible only to members.
  • Most organizations use private teams.

Public Teams

Anyone in the organization can join.

Characteristics:

  • Easier discovery.
  • Suitable for communities or open collaboration.

Org-Wide Teams

Automatically include nearly all users in the organization.

These teams simplify organization-wide communication.

What Is a Channel?

A channel is a subdivision within a team that organizes conversations and files.

Examples:

Inside the Marketing Team:

  • General
  • Campaigns
  • Budget
  • Events

Channels help separate discussions by topic.

Standard Channels

A standard channel is visible to all team members.

Characteristics:

  • Shared by the entire team.
  • Most commonly used channel type.
  • Inherits team membership.

Example:

Marketing Team
    → General

Private Channels

A private channel restricts access to selected members within the team.

Characteristics:

  • Separate membership.
  • Limited visibility.
  • Used for confidential discussions.

Example:

Marketing Team
    → Leadership Channel

Only approved users can access the channel.

Shared Channels

Shared channels allow collaboration with people:

  • Outside the team.
  • Potentially outside the organization.

Benefits include:

  • Reduced team sprawl.
  • Easier collaboration with partners.
  • Targeted access.

Channel Conversations

Each channel contains:

  • Posts
  • Replies
  • Mentions
  • Shared files

Conversations remain organized within their specific channels.

Teams Policies

Policies control how Teams features are available to users.

Policies allow administrators to:

  • Enable or disable features.
  • Apply different settings to different users.
  • Standardize collaboration experiences.

Policies are one of the most important concepts for the AB-900 exam.

Meeting Policies

Meeting policies determine:

  • Recording permissions.
  • Screen sharing capabilities.
  • Meeting chat behavior.
  • Participant settings.

Example:

Executives may receive different meeting settings than general employees.

Messaging Policies

Messaging policies control:

  • Chat availability.
  • Message deletion.
  • Editing messages.
  • Priority notifications.

Organizations can customize communication experiences for different groups.

App Permission Policies

These policies determine which Teams apps users can access.

Administrators can:

  • Allow apps.
  • Block apps.
  • Restrict third-party applications.

This helps organizations maintain security and governance.

App Setup Policies

App setup policies control:

  • Which apps are pinned.
  • Default app layouts.
  • User experience within Teams.

These policies help standardize Teams across the organization.

Calling Policies

Calling policies determine:

  • Calling features.
  • Voicemail capabilities.
  • Call forwarding settings.

These are primarily used in organizations that use Teams Phone.

External Access and Guest Access

Administrators can configure collaboration with people outside the organization.

External Access

Allows communication with users in other organizations.

Guest Access

Allows external users to become members of teams.

These settings are configured within the Teams admin center.

Policy Assignment

Policies can be assigned:

Globally

All users receive the policy.

Individually

Specific users receive unique settings.

By Group

A group of users receives the same configuration.

This flexibility helps organizations support different business requirements.

Microsoft 365 Groups and Teams

Every team is backed by a Microsoft 365 Group.

The group provides:

  • Membership management.
  • Shared resources.
  • Integration with SharePoint and Outlook.

Because of this relationship, changes to group membership affect Teams access.

Why Teams Objects Matter for Microsoft 365 Copilot

Microsoft 365 Copilot can use information from:

  • Teams chats
  • Meetings
  • Files
  • Conversations

Copilot only accesses content users are already authorized to view.

Well-structured teams and channels improve collaboration and help Copilot provide more relevant results.

Best Practices

Create Teams for Long-Term Collaboration

Avoid creating unnecessary teams.

Use Channels to Organize Topics

Separate conversations logically.

Limit Private Channels

Too many private channels increase complexity.

Use Policies for Governance

Policies provide consistent user experiences.

Review External Access Settings

Balance collaboration with security.

Exam Tips

Remember these key AB-900 concepts:

  • Teams are top-level collaboration workspaces.
  • Channels organize conversations inside teams.
  • Standard channels are visible to all team members.
  • Private channels have separate membership.
  • Shared channels enable broader collaboration.
  • Teams files are stored in SharePoint Online.
  • Teams are backed by Microsoft 365 Groups.
  • Policies control Teams functionality.
  • Policies can be assigned globally or to selected users.
  • Microsoft 365 Copilot respects existing Teams permissions.

Practice Exam Questions

Question 1

Which object serves as the top-level collaboration workspace in Microsoft Teams?

A. Channel
B. Team
C. Policy
D. Chat

Correct Answer: B

Explanation: A team is the primary container that holds channels, members, files, and conversations.

Question 2

What is the primary purpose of a channel in Microsoft Teams?

A. Store user licenses
B. Manage mailboxes
C. Organize conversations and files within a team
D. Replace SharePoint sites

Correct Answer: C

Explanation: Channels separate discussions and files into logical categories inside a team.

Question 3

Which type of channel is accessible to all members of a team?

A. Private channel
B. Shared channel
C. Guest channel
D. Standard channel

Correct Answer: D

Explanation: Standard channels inherit membership from the parent team and are visible to all team members.

Question 4

Where are files shared in Teams typically stored?

A. Exchange Online
B. OneDrive Personal Vault
C. Microsoft Entra ID
D. SharePoint Online

Correct Answer: D

Explanation: SharePoint Online provides the underlying storage for Teams files.

Question 5

Which role can add and remove members from a team?

A. Team Owner
B. Team Visitor
C. Guest User
D. External User

Correct Answer: A

Explanation: Team Owners manage membership and settings for the team.

Question 6

Which policy type controls whether users can edit or delete chat messages?

A. Meeting policy
B. Calling policy
C. Messaging policy
D. App setup policy

Correct Answer: C

Explanation: Messaging policies govern chat-related features and behaviors.

Question 7

What distinguishes a private channel from a standard channel?

A. Private channels use different licenses.
B. Private channels have separate membership and restricted visibility.
C. Private channels cannot contain files.
D. Private channels are visible to everyone.

Correct Answer: B

Explanation: Private channels allow only selected members within a team to participate.

Question 8

What is the purpose of app permission policies?

A. Assign mailbox quotas
B. Configure SharePoint storage
C. Control which Teams apps users may access
D. Create channels automatically

Correct Answer: C

Explanation: App permission policies allow administrators to permit or block applications.

Question 9

Every Microsoft Team is backed by which Microsoft 365 object?

A. Exchange mailbox
B. Distribution group
C. Dynamic group
D. Microsoft 365 Group

Correct Answer: D

Explanation: Microsoft 365 Groups provide the membership foundation for Teams.

Question 10

How can Teams policies be assigned?

A. Only globally
B. Only individually
C. Globally, individually, or through groups
D. Only through PowerShell

Correct Answer: C

Explanation: Teams policies provide flexible assignment methods to support different organizational requirements.

Go to the AB-900 Exam Prep Hub main page

AB-900, Microsoft Certification

Identify the appropriate roles and permissions for sites in SharePoint in Microsoft 365 (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core objects of Microsoft 365 services
      --> Identify the appropriate roles and permissions for sites in SharePoint in Microsoft 365

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Security and collaboration are two of the most important aspects of SharePoint Online. Organizations need users to easily access and share information while ensuring that sensitive content remains protected.

SharePoint permissions and roles determine who can:

  • View information.
  • Edit documents.
  • Create content.
  • Manage sites.
  • Share files with others.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the common SharePoint roles, permission levels, inheritance concepts, and how permissions affect access to information used by Microsoft 365 services and Microsoft 365 Copilot.

Why Permissions Matter

SharePoint sites often contain:

  • Policies
  • Financial reports
  • Project documents
  • Human resources files
  • Meeting materials

Permissions ensure that users can only access information they are authorized to see.

This principle is known as least privilege, which means users should receive only the access necessary to perform their jobs.

SharePoint Security Model

SharePoint security is based on:

  1. Users
  2. Groups
  3. Roles
  4. Permission levels

Access is granted through permission assignments rather than by storing permissions directly on every file.

Understanding SharePoint Roles

A role defines what a user is allowed to do within a site.

Common roles include:

  • Site Owners
  • Site Members
  • Site Visitors

These roles are typically implemented through SharePoint groups.

Site Owners

Site Owners have the highest level of permissions on a site.

Owners can:

  • Add or remove users.
  • Change permissions.
  • Create libraries and lists.
  • Modify site settings.
  • Manage content.

Owners are responsible for maintaining and administering the site.

Example

The manager of a department may be assigned as a Site Owner.

Site Members

Site Members are contributors to the site.

Members can typically:

  • Create files.
  • Upload documents.
  • Edit existing content.
  • Delete content they have permission to manage.

Members help maintain and collaborate on information.

Example

Employees working on a project may be Members of the project site.

Site Visitors

Site Visitors generally have read-only access.

Visitors can:

  • View pages.
  • Open documents.
  • Read information.

Visitors cannot:

  • Modify files.
  • Upload documents.
  • Change settings.

Example

Executives reviewing reports may be assigned Visitor access.

Default Permission Levels

SharePoint provides several built-in permission levels.

Full Control

Allows users to:

  • Manage permissions.
  • Configure settings.
  • Create content.
  • Delete content.

Typically assigned to Site Owners.

Edit

Allows users to:

  • Add content.
  • Modify content.
  • Delete content.

Commonly assigned to Members.

Read

Allows users to:

  • View documents.
  • Open pages.
  • Download files.

Usually assigned to Visitors.

Contribute

Allows users to:

  • Add and edit content.

Contribute permissions are similar to Edit permissions but provide fewer management capabilities.

SharePoint Groups

Permissions are commonly assigned through groups rather than individual users.

Examples:

GroupTypical Permission
Site OwnersFull Control
Site MembersEdit
Site VisitorsRead

Using groups simplifies administration and improves consistency.

Permission Inheritance

SharePoint objects inherit permissions from their parent object.

Example:

Site
   ↓
Library
      ↓
Folder
         ↓
File

By default:

  • Libraries inherit from sites.
  • Folders inherit from libraries.
  • Files inherit from folders.

This inheritance model simplifies permission management.

Breaking Permission Inheritance

Administrators can stop an object from inheriting permissions.

For example:

A Human Resources library may require unique permissions that differ from the rest of the site.

Benefits include:

  • Protecting confidential information.
  • Restricting access to sensitive content.
  • Supporting departmental separation.

However, excessive unique permissions can increase administrative complexity.

Library-Level Permissions

Document libraries may have permissions that differ from the parent site.

Example:

Finance Site

Libraries:

  • Budgets
  • Payroll
  • Policies

The Payroll library may only be accessible to HR personnel.

Folder-Level Permissions

Folders can also have unique permissions.

Example:

Projects Library
     ↓
Project Alpha Folder

Only members of Project Alpha may receive access.

While possible, Microsoft generally recommends avoiding excessive folder-level permissions because they can become difficult to manage.

File-Level Permissions

Individual files can have unique permissions.

Example:

A confidential contract document may only be accessible to executives.

File-level permissions provide flexibility but should be used sparingly.

Sharing vs Permissions

Users often confuse sharing with permissions.

Permissions

Determine who has access.

Sharing

Provides a method to grant access.

When a user shares a file, SharePoint updates the permissions accordingly.

Internal Sharing

Internal sharing allows employees within the organization to access content.

This is the most common sharing scenario.

External Sharing

Organizations may allow collaboration with:

  • Customers
  • Vendors
  • Partners
  • Contractors

External users can receive access to:

  • Sites
  • Libraries
  • Files
  • Folders

Administrators can control external sharing settings in the SharePoint admin center.

Microsoft 365 Groups and Permissions

Many Team Sites are associated with Microsoft 365 Groups.

Membership in the Microsoft 365 Group automatically grants access to the connected:

  • SharePoint site
  • Outlook group
  • Teams workspace
  • Shared resources

This simplifies collaboration management.

SharePoint Admin Roles vs Site Roles

It is important to distinguish between:

SharePoint Administrator

A Microsoft 365 administrative role that manages SharePoint across the tenant.

Site Owner

A site-level role that manages one specific site.

SharePoint Administrators have broader authority than Site Owners.

How Permissions Affect Microsoft 365 Copilot

Microsoft 365 Copilot respects existing SharePoint permissions.

Copilot:

  • Does not bypass security.
  • Cannot reveal information users are not authorized to access.
  • Uses the same permissions already configured in Microsoft 365.

For example:

If User A cannot access a confidential HR folder, Copilot cannot retrieve content from that folder for User A.

Best Practices

Use Groups Instead of Individual Users

Group-based permissions are easier to maintain.

Apply Least Privilege

Grant only the access required.

Minimize Unique Permissions

Too many exceptions create complexity.

Periodically Review Access

Remove unnecessary permissions when roles change.

Use Owners Carefully

Only trusted individuals should receive Full Control.

Exam Tips

Remember these key AB-900 concepts:

  • Site Owners usually have Full Control.
  • Site Members typically have Edit permissions.
  • Site Visitors generally have Read permissions.
  • Permissions are usually assigned through groups.
  • Objects inherit permissions from parent objects.
  • Libraries, folders, and files can have unique permissions.
  • Sharing grants access by modifying permissions.
  • SharePoint Administrators manage the service tenant-wide.
  • Site Owners manage individual sites.
  • Microsoft 365 Copilot respects SharePoint security permissions.

Practice Exam Questions

Question 1

Which SharePoint role normally has Full Control permissions?

A. Site Visitors
B. Site Members
C. Site Owners
D. External Users

Correct Answer: C

Explanation: Site Owners have the highest level of permissions and can manage settings, content, and permissions.

Question 2

Which permission level allows users to view documents without modifying them?

A. Read
B. Edit
C. Full Control
D. Contribute

Correct Answer: A

Explanation: Read permissions allow users to view content while preventing modifications.

Question 3

What is the primary advantage of assigning permissions through SharePoint groups?

A. Increased storage capacity
B. Simplified administration and consistency
C. Faster document uploads
D. Automatic licensing

Correct Answer: B

Explanation: Groups allow administrators to manage permissions efficiently without assigning access individually.

Question 4

By default, what happens to permissions on a newly created document library?

A. Permissions are disabled.
B. Full Control is granted to everyone.
C. The library receives random permissions.
D. The library inherits permissions from the parent site.

Correct Answer: D

Explanation: SharePoint uses inheritance by default so child objects receive permissions from parent objects.

Question 5

A department wants a confidential library accessible only to HR staff. What should be done?

A. Delete the parent site.
B. Convert the site to OneDrive.
C. Break permission inheritance for the library.
D. Disable version history.

Correct Answer: C

Explanation: Unique permissions can be applied by stopping inheritance from the parent site.

Question 6

Which role typically allows users to create and edit documents?

A. Site Visitors
B. Site Members
C. External Guests
D. Auditors

Correct Answer: B

Explanation: Members commonly receive Edit permissions that allow collaboration.

Question 7

Which statement about Microsoft 365 Copilot and SharePoint permissions is true?

A. Copilot bypasses security settings.
B. Copilot ignores file permissions.
C. Copilot grants temporary access to restricted files.
D. Copilot respects existing permissions.

Correct Answer: D

Explanation: Copilot can only access information users are already authorized to see.

Question 8

What is the difference between sharing and permissions?

A. Sharing grants access by modifying permissions.
B. Permissions are only used in OneDrive.
C. Sharing removes security settings.
D. Permissions are unrelated to sharing.

Correct Answer: A

Explanation: Sharing is a mechanism that changes permissions to allow access.

Question 9

Which object normally inherits permissions from a document library?

A. Microsoft Entra group
B. Mailbox
C. Folder
D. Exchange distribution group

Correct Answer: C

Explanation: Folders inherit permissions from their parent library unless inheritance is broken.

Question 10

Which statement correctly distinguishes a SharePoint Administrator from a Site Owner?

A. Site Owners manage the entire Microsoft 365 tenant.
B. SharePoint Administrators manage SharePoint across the organization, while Site Owners manage individual sites.
C. Site Owners automatically become Global Administrators.
D. SharePoint Administrators only manage a single site.

Correct Answer: B

Explanation: SharePoint Administrators have tenant-wide SharePoint authority, whereas Site Owners are responsible for specific sites only.

Go to the AB-900 Exam Prep Hub main page

AB-900, Microsoft Certification

Identify the appropriate objects to configure by using the SharePoint in Microsoft 365 Admin Center (sites, libraries, and folders) (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core objects of Microsoft 365 services
      --> Identify the appropriate objects to configure by using the SharePoint in Microsoft 365 Admin Center (sites, libraries, and folders)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

SharePoint Online is Microsoft’s cloud-based collaboration and content management platform included with Microsoft 365. It enables organizations to store, organize, share, and manage information securely.

The SharePoint admin center allows administrators to configure and manage SharePoint resources across the organization. For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, it is important to understand the key SharePoint objects:

  • Sites
  • Document libraries
  • Folders

These objects form the structure used to organize files and collaboration content throughout Microsoft 365.

What Is SharePoint Online?

SharePoint Online is a service that provides:

  • Document storage
  • Team collaboration
  • Content management
  • Intranet sites
  • File sharing
  • Integration with Microsoft Teams and OneDrive

SharePoint acts as the underlying storage platform for many Microsoft 365 services.

For example:

  • Files shared in Teams are stored in SharePoint.
  • Documents used by Microsoft 365 Copilot may reside in SharePoint.
  • Organizational knowledge can be maintained through SharePoint sites.

The SharePoint Admin Center

The SharePoint admin center provides centralized administration for SharePoint Online.

Administrators can:

  • Create and manage sites.
  • Configure sharing settings.
  • Monitor storage usage.
  • Restore deleted sites.
  • Manage permissions.
  • Configure policies.
  • Control external access.

The SharePoint admin center focuses on organization-wide management rather than individual file management.

Understanding the SharePoint Hierarchy

SharePoint content is organized in a hierarchy:

Site
   ↓
Document Library
      ↓
Folders
         ↓
Files

Understanding this structure is essential for the AB-900 exam.

SharePoint Sites

A site is the top-level container used to organize information and collaboration resources.

Sites can contain:

  • Document libraries
  • Lists
  • Pages
  • News posts
  • Permissions
  • Folders and files

Think of a site as a workspace for a team, department, or project.

Types of SharePoint Sites

Team Sites

Team sites support collaboration among groups of users.

Typical uses include:

  • Project teams
  • Departments
  • Committees

Features include:

  • Shared documents
  • Group calendars
  • Microsoft 365 Group integration
  • Teams integration

Example:

Finance Team Site

Communication Sites

Communication sites are designed for broadcasting information to larger audiences.

Examples include:

  • Company news portals
  • HR announcements
  • Corporate intranets

Communication sites emphasize publishing rather than collaboration.

Site Permissions

Each site has permissions that determine who can:

  • View content.
  • Edit files.
  • Manage settings.
  • Share information.

Permission management helps organizations secure information while enabling collaboration.

Site Storage

Sites consume storage from the organization’s SharePoint storage pool.

Administrators can monitor:

  • Storage usage
  • Growth trends
  • Available capacity

Storage management helps ensure sufficient space for users and workloads.

Document Libraries

A document library is a collection used to store and organize files within a SharePoint site.

Libraries can contain:

  • Documents
  • Spreadsheets
  • Presentations
  • PDFs
  • Images
  • Folders

A site may contain multiple libraries.

Example:

Finance Site

Libraries:

  • Budgets
  • Reports
  • Policies

Benefits of Document Libraries

Document libraries provide:

Centralized Storage

Files are stored in one location.

Version History

Multiple versions of documents can be maintained.

Metadata Support

Documents can include descriptive information.

Searchability

Users can quickly locate files.

Permissions

Libraries can have access controls.

Default Documents Library

Most SharePoint sites contain a default library called:

Documents

Users commonly upload files into this library when collaborating through Teams or SharePoint.

Library Permissions

Libraries can inherit permissions from the parent site or have unique permissions assigned.

This allows organizations to:

  • Restrict sensitive content.
  • Separate departments.
  • Protect confidential documents.

Folders

Folders are used within document libraries to further organize files.

Example:

Finance Site
   → Reports Library
        → 2025 Folder
             → Q1 Folder
                  → Budget.xlsx

Folders provide familiar file organization similar to Windows File Explorer.

Benefits of Folders

Folders help users:

  • Group related files.
  • Simplify navigation.
  • Organize projects.
  • Separate years, departments, or topics.

Files

Files are the actual content stored inside folders or libraries.

Examples:

  • Word documents
  • Excel workbooks
  • PowerPoint presentations
  • PDFs
  • Images

Files stored in SharePoint support:

  • Collaboration
  • Co-authoring
  • Search
  • Version history

Version History

SharePoint maintains previous versions of files.

Benefits include:

  • Recovering accidental changes.
  • Viewing historical versions.
  • Tracking modifications.
  • Supporting collaboration.

Versioning is especially valuable when multiple users edit documents.

Integration with Microsoft Teams

Many Teams channels store files inside SharePoint document libraries.

Example:

Marketing Team
     ↓
General Channel
     ↓
Files Tab
     ↓
SharePoint Library

Although users may interact through Teams, the underlying storage is SharePoint.

Integration with OneDrive

OneDrive uses SharePoint technology behind the scenes.

Differences include:

ServicePurpose
OneDrivePersonal file storage
SharePointTeam and organizational storage

External Sharing

Administrators can configure whether users can share:

  • Sites
  • Libraries
  • Files
  • Folders

External sharing enables collaboration with:

  • Customers
  • Vendors
  • Partners

Organizations often balance collaboration with security requirements.

Why SharePoint Objects Matter for Microsoft 365 Copilot

Microsoft 365 Copilot can reference content stored in SharePoint.

Examples include:

  • Policies
  • Meeting documents
  • Reports
  • Project files

Copilot only accesses information users already have permission to view.

Well-organized sites, libraries, and folders improve search quality and help Copilot provide more relevant responses.

SharePoint Admin Center Tasks

Administrators commonly:

Manage Sites

  • Create sites.
  • Delete sites.
  • Restore sites.

Configure Sharing

  • Internal sharing
  • External sharing

Monitor Storage

  • View usage
  • Allocate capacity

Manage Policies

  • Access controls
  • Site settings

Best Practices

Create Sites for Teams and Departments

Separate content logically.

Use Libraries for Major Categories

Avoid storing everything in a single library.

Use Folders Carefully

Too many nested folders can make navigation difficult.

Apply Appropriate Permissions

Protect sensitive content.

Maintain Consistent Naming Standards

Improve usability and search effectiveness.

Exam Tips

Remember these AB-900 concepts:

  • A site is the top-level SharePoint container.
  • Sites contain document libraries.
  • Libraries contain folders and files.
  • Team sites support collaboration.
  • Communication sites support publishing information.
  • SharePoint underlies file storage for Microsoft Teams.
  • OneDrive is intended for personal storage.
  • Version history helps recover previous file versions.
  • Permissions control access to sites, libraries, folders, and files.
  • Microsoft 365 Copilot respects existing SharePoint permissions.

Practice Exam Questions

Question 1

Which SharePoint object acts as the top-level container for collaboration resources?

A. Folder
B. Site
C. Document library
D. File

Correct Answer: B

Explanation: A site is the primary container that holds libraries, pages, lists, and permissions.

Question 2

Which SharePoint object directly stores files?

A. Team channel
B. Site collection
C. Document library
D. News page

Correct Answer: C

Explanation: Document libraries are collections designed specifically to store and organize files.

Question 3

A company wants to publish organization-wide news and announcements. Which type of SharePoint site is most appropriate?

A. Team site
B. Project site
C. Communication site
D. Personal site

Correct Answer: C

Explanation: Communication sites are optimized for sharing information with large audiences.

Question 4

What is the purpose of folders within a SharePoint library?

A. Create Microsoft 365 Groups
B. Assign licenses
C. Replace sites
D. Organize files into smaller categories

Correct Answer: D

Explanation: Folders provide additional organization within document libraries.

Question 5

Which statement about Microsoft Teams file storage is true?

A. Teams files are stored in Exchange Online.
B. Teams files are stored in OneNote.
C. Teams files are stored in SharePoint Online.
D. Teams files are stored only on local devices.

Correct Answer: C

Explanation: SharePoint Online serves as the underlying storage platform for Teams files.

Question 6

Which feature allows users to restore previous versions of a document?

A. Retention labels
B. Site templates
C. External sharing
D. Version history

Correct Answer: D

Explanation: Version history maintains older copies of files and supports recovery.

Question 7

What is the primary purpose of OneDrive?

A. Organizational intranet publishing
B. Team collaboration storage
C. Personal file storage
D. Email management

Correct Answer: C

Explanation: OneDrive is intended for individual users and personal work files.

Question 8

A SharePoint library can have its own permissions that differ from the parent site. What does this provide?

A. Independent security for specific content
B. Automatic licensing
C. Increased mailbox capacity
D. Dynamic distribution capabilities

Correct Answer: A

Explanation: Unique permissions allow administrators to protect sensitive libraries separately from the overall site.

Question 9

Which object is directly above folders in the SharePoint hierarchy?

A. Files
B. Lists
C. Pages
D. Document libraries

Correct Answer: D

Explanation: Libraries contain folders, which in turn contain files.

Question 10

Why are well-organized SharePoint sites beneficial for Microsoft 365 Copilot?

A. They bypass permissions.
B. They improve content discovery and relevance.
C. They automatically increase storage quotas.
D. They eliminate version history.

Correct Answer: B

Explanation: Organized SharePoint content helps Copilot retrieve more useful information while respecting user permissions.

Go to the AB-900 Exam Prep Hub main page