Category: AI Security

AB-620, Agentic AI, AI, AI Governance, AI Security, Microsoft Certification

Configure and monitor computer use for an agent (AB-620 Exam Prep)

 
This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Integrate and extend agents in Copilot Studio (40–45%)
   --> Add tools to agents
      --> Configure and monitor computer use for an agent

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Many organizations still rely on legacy applications that do not expose REST APIs, Microsoft Power Platform connectors, or Model Context Protocol (MCP) servers. Employees may need to interact with desktop applications, web portals, or line-of-business systems that require clicking buttons, typing into forms, navigating menus, and downloading files.

Computer Use enables AI agents to perform these user interface (UI) interactions by observing and manipulating an application’s graphical interface, much like a human user would.

Rather than integrating through APIs, the agent interacts directly with the application’s user interface.

This capability expands the types of business processes that Copilot Studio agents can automate.

What is Computer Use?

Computer Use is an AI capability that allows an agent to:

  • Observe the user interface
  • Identify interface elements
  • Move the mouse
  • Click buttons
  • Enter text
  • Select menu options
  • Scroll pages
  • Navigate applications
  • Execute repetitive workflows

Instead of calling an API, the agent completes tasks by interacting with the application’s visual interface.

Why Computer Use Exists

Many enterprise applications:

  • have no API
  • expose limited APIs
  • use legacy technologies
  • require manual interaction
  • contain proprietary interfaces

Examples include:

  • Legacy ERP systems
  • Internal HR portals
  • Desktop accounting software
  • Government websites
  • Vendor portals
  • Older Windows applications

Computer Use provides automation where traditional integrations are unavailable or impractical.

Computer Use vs. API Integration

Computer UseAPI Integration
Interacts with UIInteracts with services
Uses mouse and keyboard actionsUses HTTP requests
Suitable for legacy systemsSuitable for modern systems
More susceptible to UI changesGenerally more stable
May execute more slowlyUsually faster
Requires visible interfaceWorks without a user interface

Exam Tip: Microsoft recommends using APIs, connectors, or MCP servers when available. Computer Use is typically used when no suitable programmatic interface exists.

Typical Computer Use Architecture

User Request
↓
Copilot Studio Agent
↓
Computer Use Tool
↓
AI analyzes screen
↓
Identifies UI elements
↓
Executes mouse/keyboard actions
↓
Application responds
↓
Agent verifies results
↓
Response returned to user

Common Business Scenarios

Computer Use is valuable in situations where employees currently perform repetitive manual tasks.

Invoice Processing

An agent can:

  • Open an accounting application
  • Enter invoice data
  • Select suppliers
  • Save records
  • Confirm successful submission

Employee Onboarding

The agent can:

  • Open HR software
  • Create employee records
  • Complete forms
  • Assign departments
  • Generate confirmation numbers

Customer Support

The agent may:

  • Open a CRM system
  • Search for customers
  • Update account information
  • Create service tickets
  • Retrieve order history

Data Entry

Computer Use can automate:

  • Copying information between systems
  • Completing repetitive forms
  • Updating spreadsheets
  • Entering records into legacy databases

Web Portal Automation

Examples include:

  • Vendor portals
  • Government portals
  • Insurance websites
  • Banking systems
  • Regulatory reporting portals

Computer Use Workflow

A typical execution follows these steps:

  1. The user submits a request.
  2. The agent determines that Computer Use is required.
  3. The application launches (if necessary).
  4. The AI observes the current screen.
  5. UI elements are identified.
  6. The agent performs actions.
  7. The application responds.
  8. The agent validates the result.
  9. The workflow continues or finishes.
  10. A response is returned to the user.

How the Agent Understands the Screen

Unlike API integrations, Computer Use relies on visual understanding.

The AI analyzes:

  • Buttons
  • Text boxes
  • Menus
  • Tables
  • Checkboxes
  • Drop-down lists
  • Icons
  • Dialog boxes
  • Navigation controls

This allows it to interact with applications even when source code or APIs are unavailable.

Typical User Actions

A Computer Use agent may perform actions such as:

  • Click
  • Double-click
  • Right-click
  • Type text
  • Press keyboard shortcuts
  • Scroll
  • Select menu items
  • Drag objects
  • Navigate windows
  • Confirm dialog boxes
  • Upload files
  • Download files

Configuring Computer Use

Configuration generally involves:

  • Enabling the Computer Use capability
  • Selecting or configuring the target environment
  • Defining the workflow
  • Specifying execution permissions
  • Testing interactions
  • Publishing the agent

Administrators should verify that the environment meets all prerequisites before deployment.

Designing Reliable Automations

Because UI-based automation depends on visual elements, reliability is critical.

Good designs:

  • Follow predictable navigation paths
  • Minimize unnecessary clicks
  • Use consistent workflows
  • Verify intermediate results
  • Handle unexpected dialogs
  • Include recovery logic

Reliable automation reduces failures caused by interface changes.

Authentication Considerations

Many applications require authentication before automation can begin.

Possible authentication methods include:

  • Microsoft Entra ID
  • Organizational credentials
  • Multi-factor authentication (where supported)
  • Session-based authentication
  • Single Sign-On (SSO)

Organizations should follow their security policies when storing or accessing credentials. Avoid embedding usernames, passwords, or secrets directly within agent logic.

Permissions

The agent should operate using the principle of least privilege.

Grant only the permissions necessary to complete the intended tasks.

Examples:

  • Read-only access when updates are unnecessary
  • Department-specific permissions
  • Limited application roles
  • Restricted administrative privileges

Limiting permissions reduces security risks.

Security Considerations

Computer Use interacts directly with enterprise applications, making security especially important.

Administrators should consider:

  • Authentication
  • Authorization
  • Audit logging
  • Data protection
  • Session management
  • Access reviews
  • Conditional access policies
  • Secure credential storage

Sensitive Data Handling

Computer Use workflows may encounter:

  • Personally identifiable information (PII)
  • Financial records
  • Medical information
  • Customer data
  • Employee records

Organizations should:

  • Follow compliance requirements
  • Minimize unnecessary data exposure
  • Log actions appropriately
  • Restrict access to sensitive workflows
  • Monitor privileged automations

Common Limitations

Computer Use is powerful but has limitations.

Examples include:

UI Changes

If a button moves or is renamed, automation may fail.

Dynamic Pages

Pages that change frequently can reduce reliability.

Pop-up Windows

Unexpected dialogs may interrupt execution.

Performance Delays

Slow applications may require waiting or retry logic.

Unsupported Controls

Some proprietary interface components may be difficult to automate consistently.

When NOT to Use Computer Use

Avoid Computer Use when:

  • A REST API is available.
  • A Microsoft Power Platform connector exists.
  • An MCP server provides direct integration.
  • A supported enterprise connector is available.
  • A direct database integration is appropriate.

API-based integrations are generally more reliable, scalable, and maintainable than UI automation.

Best Practices

Prefer Native Integrations

Use:

  • Connectors
  • APIs
  • MCP
  • Power Automate

before choosing Computer Use.

Keep Workflows Simple

Smaller workflows are easier to maintain and troubleshoot.

Validate Each Step

Confirm that each action succeeds before proceeding.

Handle Unexpected Screens

Prepare for:

  • Error messages
  • Session timeouts
  • Login prompts
  • Confirmation dialogs

Use Stable Interfaces

Applications with consistent layouts produce more reliable automations.

Test Regularly

Retest automations after:

  • Application upgrades
  • UI redesigns
  • Security updates
  • Browser updates
  • Operating system updates

Common Enterprise Use Cases

Organizations commonly use Computer Use for:

  • HR onboarding
  • Invoice entry
  • Insurance claims
  • CRM updates
  • Legacy ERP automation
  • Procurement workflows
  • Compliance reporting
  • Financial reconciliation
  • Customer service operations
  • Data migration between systems

Common Exam Mistakes

Candidates often assume that Computer Use is the preferred integration method.

Remember:

  • Computer Use is not the first choice.
  • APIs and connectors should be used whenever available.
  • Computer Use fills the gap when direct integrations are unavailable.

Another common mistake is assuming Computer Use is immune to application changes. Because it relies on the user interface, modifications to screens, layouts, or controls can affect automation reliability.

AB-620 Exam Tips

Remember these key points:

  • Computer Use automates interactions through an application’s graphical interface.
  • It is intended primarily for systems without suitable APIs or connectors.
  • UI automation is generally more fragile than API-based integrations.
  • Secure authentication and least-privilege access are essential.
  • Validate each interaction to improve reliability.
  • Design workflows to tolerate delays and unexpected dialogs.
  • Monitor and maintain automations as application interfaces evolve.

Quick Orientation Summary

In the topics above, we explored the fundamentals of Computer Use in Microsoft Copilot Studio, including its purpose, architecture, configuration process, execution model, and how it differs from API-based automation. The topics below focus on monitoring, governance, security, optimization, troubleshooting.

Monitoring Computer Use Sessions

Unlike API tools, Computer Use performs visual interactions with applications. Because of this, monitoring becomes especially important.

Administrators should monitor:

  • Session success rates
  • Failed execution steps
  • Time required to complete tasks
  • Screen recognition failures
  • Authentication failures
  • Unexpected application behavior
  • Agent execution history
  • Resource consumption
  • Retry frequency

Monitoring enables organizations to:

  • Detect broken workflows
  • Identify application UI changes
  • Improve reliability
  • Measure automation performance
  • Support compliance audits

Execution Logs

Each Computer Use execution produces detailed logs.

Typical information includes:

  • Workflow start time
  • Workflow completion time
  • Individual action history
  • Screens visited
  • Click locations
  • Typed text
  • Variables used
  • Error messages
  • Retry attempts
  • Completion status

These logs assist with:

  • Troubleshooting
  • Performance tuning
  • Security investigations
  • Compliance reporting

Screenshots and Visual Evidence

Many implementations capture screenshots throughout execution.

Screenshots help identify:

  • Missing buttons
  • Incorrect pages
  • Unexpected pop-ups
  • Login failures
  • Permission issues
  • Validation errors
  • UI redesigns

Visual evidence greatly reduces troubleshooting time.

Performance Metrics

Useful metrics include:

Success Rate

Percentage of successful executions.

Example:

  • 98 successful runs
  • 2 failed runs

Success rate:

98%

Average Completion Time

Tracks workflow efficiency.

Example:

  • Average runtime: 22 seconds

If runtime suddenly increases:

  • Network latency
  • Slow applications
  • UI delays
  • Infrastructure issues

may be responsible.

Retry Frequency

Measures how often automation must repeat actions.

High retry counts often indicate:

  • Unstable interfaces
  • Slow page loading
  • Timing problems
  • UI recognition issues

Failure Categories

Failures should be categorized.

Examples include:

  • Authentication failures
  • Missing elements
  • Timeout errors
  • Permission issues
  • Application crashes
  • Network failures
  • Validation errors

This helps prioritize improvements.

Alerts and Notifications

Organizations often configure alerts for:

  • Multiple workflow failures
  • Authentication problems
  • High error rates
  • Excessive execution time
  • Agent unavailability
  • Service interruptions

Early alerts reduce downtime.

Security Best Practices

Computer Use automation may interact with sensitive enterprise applications.

Recommended practices include:

Principle of Least Privilege

Grant only the permissions required.

Avoid:

  • Global Administrator
  • System Administrator

unless absolutely necessary.

Secure Credential Storage

Never hardcode:

  • passwords
  • API keys
  • connection strings

Instead use:

  • secure connections
  • credential vaults
  • managed identities where applicable

Data Protection

Protect:

  • customer records
  • financial data
  • HR information
  • healthcare information

Avoid displaying unnecessary sensitive information during automated sessions.

Network Security

Protect communication through:

  • HTTPS
  • encrypted connections
  • VPNs
  • private networking
  • firewall policies

Audit Logging

Maintain complete audit trails showing:

  • who started automation
  • when it ran
  • what actions occurred
  • whether it succeeded
  • data accessed

Governance Considerations

Large organizations should establish governance policies.

Examples include:

Approved Automation Catalog

Document:

  • automation purpose
  • owner
  • business unit
  • data sources
  • permissions
  • dependencies

Change Management

Whenever an application UI changes:

  • test automation
  • validate workflows
  • update selectors
  • redeploy safely

Never assume automation continues working after software upgrades.

Environment Separation

Maintain separate environments:

  • Development
  • Test
  • Production

This prevents accidental production disruptions.

Version Control

Maintain versions of:

  • Topics
  • Flows
  • Computer Use configurations
  • Prompt changes
  • Connectors

Versioning simplifies rollback.

Optimizing Computer Use

Optimization improves reliability.

Recommendations include:

Prefer Stable UI Elements

Avoid selecting:

  • moving icons
  • temporary banners
  • advertisements
  • notifications

Instead select:

  • permanent buttons
  • labeled controls
  • predictable navigation

Reduce Unnecessary Clicks

Instead of:

Home
→ Menu
→ Settings
→ Reports
→ Monthly

navigate directly when possible.

Fewer actions reduce failure risk.

Wait for Application Readiness

Do not click immediately after loading.

Allow sufficient time for:

  • pages
  • dialogs
  • data grids
  • forms

to finish loading.

Validate Before Continuing

Verify:

  • page loaded
  • expected button exists
  • confirmation displayed

before moving to the next step.

Handle Exceptions

Good automation plans for:

  • pop-up windows
  • invalid input
  • unavailable services
  • expired sessions
  • disconnected networks

Graceful recovery greatly improves reliability.

Common Troubleshooting Scenarios

Problem

Button cannot be found.

Possible causes:

  • UI changed
  • page not loaded
  • screen resolution changed
  • localization differences

Possible solutions:

  • retrain selector
  • increase wait time
  • verify application version

Problem

Automation clicks wrong location.

Possible causes:

  • window resized
  • scaling changed
  • UI redesign

Possible solutions:

  • use stable visual anchors
  • update automation
  • standardize display settings

Problem

Workflow times out.

Possible causes:

  • slow network
  • server delays
  • large reports
  • authentication latency

Possible solutions:

  • increase timeout
  • optimize workflow
  • improve infrastructure

Problem

Authentication repeatedly fails.

Possible causes:

  • expired credentials
  • password changes
  • MFA requirements
  • permission changes

Possible solutions:

  • update credentials
  • review authentication policies
  • validate permissions

Computer Use vs Traditional Automation

FeatureComputer UseAPI Automation
Works without APIsYesNo
Uses screen interactionYesNo
Faster executionUsually NoYes
More reliableLowerHigher
Sensitive to UI changesYesNo
Easier for legacy systemsYesSometimes
Structured responsesLimitedExcellent
PerformanceModerateHigh

More AB-620 Exam Tips

Remember these key points:

  • Computer Use automates graphical user interfaces.
  • It should generally be used only when APIs or connectors are unavailable or impractical.
  • UI changes can break automation.
  • Monitoring execution logs is essential for troubleshooting.
  • Apply least-privilege access.
  • Separate development, testing, and production environments.
  • Validate screen state before performing actions.
  • Use retries and exception handling to improve reliability.
  • Maintain audit logs for governance and compliance.
  • Prefer API-based automation when possible for performance and reliability.

AB-620 Practice Exam Questions

Question 1

A company must automate a legacy desktop application that provides no APIs or connectors. Which capability is the best choice?

A. Azure AI Search

B. Computer Use

C. Adaptive Cards

D. Generative Answers

Answer: B

Explanation:
Computer Use enables an agent to interact directly with a graphical user interface, making it suitable for legacy applications that lack APIs or connectors.

Question 2

Which monitoring metric is most useful for identifying whether an application’s interface has recently changed?

A. Number of licensed users

B. Storage capacity

C. Sudden increase in failed element recognition

D. Number of environments

Answer: C

Explanation:
A sudden rise in element recognition failures often indicates that the application’s user interface has changed, causing automation to fail.

Question 3

An administrator wants to minimize security risks when configuring Computer Use. What is the recommended approach?

A. Assign Global Administrator permissions to every automation account.

B. Store passwords directly in topics.

C. Disable audit logging.

D. Grant only the permissions required for the automation.

Answer: D

Explanation:
Following the principle of least privilege reduces security risks by limiting permissions to only those necessary for the automation.

Question 4

A workflow repeatedly fails because pages have not completely loaded before the next click occurs. Which change would most likely resolve the issue?

A. Reduce timeout values.

B. Disable logging.

C. Add waits or validation that the page has fully loaded before continuing.

D. Increase screen resolution.

Answer: C

Explanation:
Adding waits or verifying that a page is fully loaded helps prevent actions from occurring before the interface is ready.

Question 5

Which scenario is the strongest candidate for Computer Use?

A. Reading information from a well-documented REST API.

B. Querying Azure SQL Database through a connector.

C. Automating a Windows desktop application with no automation interface.

D. Calling a Power Automate flow.

Answer: C

Explanation:
Computer Use is designed for interacting with applications through their graphical interface when APIs or connectors are unavailable.

Question 6

What is the primary reason organizations maintain execution logs for Computer Use sessions?

A. To increase processor speed.

B. To improve internet bandwidth.

C. To provide troubleshooting, auditing, and compliance information.

D. To replace application backups.

Answer: C

Explanation:
Execution logs provide a record of actions, errors, timings, and outcomes that support troubleshooting, auditing, and regulatory compliance.

Question 7

Which practice improves the reliability of Computer Use automations?

A. Clicking elements immediately after opening every page.

B. Selecting temporary notification banners as navigation points.

C. Avoiding validation of page state.

D. Using stable interface elements and reducing unnecessary navigation.

Answer: D

Explanation:
Stable UI elements are less likely to change, and minimizing navigation reduces opportunities for failures.

Question 8

A company deploys Computer Use automations directly into production without testing. What is the greatest risk?

A. Faster execution.

B. Increased automation reliability.

C. Unexpected failures affecting production users.

D. Reduced logging information.

Answer: C

Explanation:
Skipping testing increases the likelihood that defects or UI incompatibilities will disrupt production processes.

Question 9

Which event is most likely to require updates to a Computer Use automation?

A. Increasing storage capacity.

B. A redesign of the target application’s user interface.

C. Adding another Microsoft 365 user.

D. Renaming a Dataverse table unrelated to the workflow.

Answer: B

Explanation:
Computer Use relies on visual interface elements. UI redesigns often require selectors or interaction logic to be updated.

Question 10

Why is API-based automation generally preferred over Computer Use when both options are available?

A. APIs require more manual interaction.

B. APIs always display a graphical interface.

C. APIs are typically faster, more reliable, and less affected by UI changes.

D. APIs cannot return structured data.

Answer: C

Explanation:
API-based automation communicates directly with backend services, avoiding screen interactions and making it more efficient and resilient than UI automation.

Go to the AB-620 Exam Prep Hub main page

AB-620, AI, AI Governance, AI Security, Microsoft Certification

Evaluate security and governance considerations (AB-620 Exam Prep)

 
This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Plan and configure agent solutions (30–35%)
   --> Plan an agent solution
      --> Evaluate security and governance considerations

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Security and governance are foundational elements of every enterprise AI solution. While an AI agent may provide intelligent responses and automate business processes, it must also protect organizational data, enforce access controls, comply with regulations, and operate within established governance policies.

In Microsoft Copilot Studio, evaluating security and governance considerations occurs during the planning phase—before the first topic, tool, or integration is built. Architects must assess how the agent will authenticate users, access enterprise systems, handle sensitive data, comply with organizational policies, and be monitored throughout its lifecycle.

For the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio exam, you should understand how security and governance influence solution architecture, integration planning, deployment, monitoring, compliance, and Responsible AI practices.

Understanding Security and Governance

Although closely related, security and governance serve different purposes.

Security

Security focuses on protecting:

  • Users
  • Data
  • Applications
  • Enterprise systems
  • AI agents
  • Infrastructure

Security objectives include:

  • Preventing unauthorized access
  • Protecting sensitive information
  • Maintaining confidentiality
  • Preserving data integrity
  • Ensuring system availability

Governance

Governance establishes the policies, standards, and processes that define how AI solutions are developed, deployed, managed, and monitored.

Governance includes:

  • Organizational policies
  • Compliance requirements
  • Approval processes
  • Data management
  • Lifecycle management
  • Auditability
  • Risk management

Security protects the solution, while governance ensures the solution is managed responsibly.

Why Security and Governance Matter

Poor security or governance can lead to:

  • Data breaches
  • Unauthorized access
  • Compliance violations
  • Data leakage
  • Regulatory penalties
  • AI misuse
  • Reputational damage
  • Financial losses

Proper planning reduces these risks while increasing user trust.

The Shared Responsibility Model

Many Copilot Studio solutions rely on Microsoft cloud services.

Security responsibilities are shared.

Microsoft is responsible for securing:

  • Physical infrastructure
  • Cloud platform
  • Network infrastructure
  • Core cloud services

Organizations remain responsible for:

  • Identity management
  • User permissions
  • Data protection
  • Agent configuration
  • Governance policies
  • Regulatory compliance

Understanding this shared responsibility is important when planning enterprise AI solutions.

Identity and Access Management

Identity is the foundation of enterprise security.

Planning should include:

  • Microsoft Entra ID authentication
  • Single Sign-On (SSO)
  • Multi-Factor Authentication (MFA)
  • Role-Based Access Control (RBAC)
  • Least privilege
  • Conditional Access

Proper identity management ensures that only authorized users and services can access the AI agent and connected systems.

Authentication vs. Authorization

These concepts are frequently tested.

Authentication

Authentication answers:

Who are you?

Examples include:

  • Microsoft Entra ID
  • OAuth 2.0
  • Multi-Factor Authentication

Authorization

Authorization answers:

What are you allowed to do?

Examples include:

  • Viewing customer records
  • Updating support tickets
  • Accessing HR information

Authentication verifies identity, while authorization determines permissions.

Least Privilege Principle

One of the most important security concepts is the principle of least privilege.

Agents should receive only the permissions necessary to perform their intended functions.

Example:

Instead of granting an HR agent full administrative access to employee records, grant permission only to view leave balances if that is all the agent requires.

Benefits include:

  • Reduced attack surface
  • Improved compliance
  • Better auditing
  • Lower risk of accidental changes

Role-Based Access Control (RBAC)

RBAC simplifies authorization by assigning permissions to roles instead of individual users.

Examples of roles:

  • HR Manager
  • Sales Representative
  • IT Administrator
  • Customer Support Agent

RBAC provides:

  • Consistent permissions
  • Easier administration
  • Improved scalability
  • Better security

Data Protection

Enterprise AI agents frequently access sensitive organizational data.

Examples include:

  • Personally Identifiable Information (PII)
  • Financial information
  • Customer records
  • Intellectual property
  • Employee information
  • Confidential business documents

Protection methods include:

  • Encryption
  • Authentication
  • Authorization
  • Secure APIs
  • Data Loss Prevention (DLP)
  • Data classification

Data Loss Prevention (DLP)

Power Platform Data Loss Prevention policies help organizations control how data moves between connectors and services.

DLP policies classify connectors into groups such as:

  • Business
  • Non-business
  • Blocked

For example, an organization may allow Microsoft 365 and Dynamics 365 connectors to share data while preventing business data from being sent to consumer cloud storage services.

DLP policies help prevent accidental or unauthorized data exfiltration.

Microsoft Entra ID

Most enterprise Copilot Studio deployments rely on Microsoft Entra ID for:

  • User authentication
  • Application authentication
  • Single Sign-On
  • Conditional Access
  • Identity governance

Planning identity integration with Microsoft Entra ID improves security and simplifies user management.

Conditional Access

Conditional Access enables organizations to apply security policies based on specific conditions.

Policies may evaluate:

  • User identity
  • Device compliance
  • Geographic location
  • Risk level
  • Network location
  • Application

Examples include:

  • Require MFA for external users.
  • Block access from untrusted devices.
  • Restrict access outside approved countries.

Conditional Access strengthens security without changing application logic.

Secure Enterprise Integrations

When integrating with enterprise systems, architects should evaluate:

  • Authentication method
  • Authorization model
  • API security
  • Connector security
  • Encryption
  • Audit logging
  • Error handling

Whenever possible:

  • Use built-in connectors.
  • Prefer OAuth over API keys.
  • Avoid hardcoded credentials.
  • Use managed identities where supported.

Environment Security

Copilot Studio solutions are commonly deployed across multiple environments.

Examples:

  • Development
  • Test
  • Production

Each environment should have:

  • Appropriate access controls
  • Separate permissions
  • Controlled deployments
  • Environment-specific configurations

Production environments should have stricter controls than development environments.

Governance of AI Agents

Governance establishes how AI agents are managed throughout their lifecycle.

Governance areas include:

  • Naming standards
  • Environment strategy
  • Version management
  • Deployment approvals
  • Change management
  • Monitoring
  • Documentation
  • Ownership

Clear governance reduces operational risks and improves maintainability.

Application Lifecycle Management (ALM)

Security and governance should be integrated into ALM.

ALM includes:

  • Source control
  • Version control
  • Testing
  • Deployment
  • Monitoring
  • Rollback
  • Continuous improvement

Changes should be tested before deployment into production.

Responsible AI Governance

Responsible AI is an important part of governance.

Organizations should establish policies for:

  • Acceptable AI use
  • Human oversight
  • Transparency
  • Bias evaluation
  • Hallucination monitoring
  • Sensitive data handling
  • Incident response

Responsible AI policies should align with organizational governance frameworks.

Audit Logging

Audit logs record important activities performed by users, administrators, and AI agents.

Examples include:

  • Authentication events
  • Permission changes
  • Connector usage
  • Agent configuration changes
  • Tool execution
  • Deployment activities

Audit logs support:

  • Compliance
  • Security investigations
  • Operational monitoring
  • Forensic analysis

Monitoring and Alerting

Security planning should include continuous monitoring.

Monitor:

  • Failed sign-in attempts
  • Unauthorized access attempts
  • Connector failures
  • API failures
  • Conversation failures
  • Prompt injection attempts
  • Unusual usage patterns

Alerts enable administrators to respond quickly to potential security incidents.

Compliance Considerations

Many organizations must comply with regulatory requirements.

Examples include:

  • GDPR
  • HIPAA (where applicable)
  • SOC 2
  • ISO 27001
  • Industry-specific regulations
  • Internal corporate policies

Compliance requirements often influence:

  • Data residency
  • Retention policies
  • Encryption
  • Audit logging
  • Access controls

Risk Assessment

Before deployment, organizations should evaluate potential risks.

Common risks include:

  • Unauthorized data access
  • Data leakage
  • Hallucinations
  • Prompt injection attacks
  • API vulnerabilities
  • Misconfigured permissions
  • Excessive privileges
  • Third-party integration risks

Risk assessments help prioritize security controls.

Common Security and Governance Mistakes

Avoid these common mistakes:

  • Granting excessive permissions
  • Using shared administrator accounts
  • Ignoring DLP policies
  • Hardcoding credentials
  • Skipping security testing
  • Deploying directly to production
  • Ignoring audit logs
  • Failing to monitor AI behavior
  • Allowing unrestricted connector usage
  • Not documenting governance policies

Best Practices

When evaluating security and governance:

  • Use Microsoft Entra ID for identity management.
  • Enable Multi-Factor Authentication.
  • Apply Role-Based Access Control.
  • Follow the principle of least privilege.
  • Protect sensitive data using encryption and DLP policies.
  • Use built-in connectors whenever possible.
  • Separate development, test, and production environments.
  • Monitor authentication and security events continuously.
  • Maintain audit logs.
  • Establish clear governance policies before deployment.
  • Integrate Responsible AI into governance planning.
  • Conduct regular security reviews.

Exam Tips

For the AB-620 exam, remember these key points:

  • Security protects systems and data; governance defines how solutions are managed.
  • Authentication verifies identity; authorization determines permissions.
  • Microsoft Entra ID is the primary identity provider for Microsoft cloud services.
  • Least privilege is a core security principle.
  • RBAC simplifies permission management.
  • DLP policies control how data moves between connectors.
  • Conditional Access applies security policies based on contextual factors.
  • Governance includes ALM, version control, monitoring, ownership, and compliance.
  • Audit logging is essential for compliance and investigations.
  • Responsible AI is an important component of AI governance.

Practice Exam Questions

Question 1

An organization wants to ensure that its AI agent has only the minimum permissions required to update support ticket statuses and cannot modify unrelated customer data. Which security principle should be applied?

A. Defense in depth

B. Zero Trust

C. Least privilege

D. Separation of duties

Correct Answer: C

Explanation: The principle of least privilege grants only the permissions necessary to perform required tasks, reducing the attack surface and minimizing the risk of unauthorized or accidental actions.

Question 2

Which Power Platform feature helps prevent sensitive business data from being transferred between approved business connectors and unapproved consumer services?

A. Role-Based Access Control (RBAC)

B. Data Loss Prevention (DLP) policies

C. Microsoft Defender for Cloud

D. Azure Key Vault

Correct Answer: B

Explanation: DLP policies classify connectors into business, non-business, and blocked groups to control how data can move between services and help prevent data leakage.

Question 3

An organization requires users connecting from unmanaged devices to complete additional verification before accessing an AI agent. Which capability should be used?

A. Application Lifecycle Management

B. Audit logging

C. Environment variables

D. Conditional Access

Correct Answer: D

Explanation: Conditional Access evaluates contextual signals such as device compliance, user location, and risk to enforce security requirements like Multi-Factor Authentication.

Question 4

Which statement correctly distinguishes authentication from authorization?

A. Authentication determines permissions, while authorization verifies identity.

B. Authentication verifies identity, while authorization determines permitted actions.

C. Authentication encrypts data, while authorization monitors usage.

D. Authentication creates audit logs, while authorization validates APIs.

Correct Answer: B

Explanation: Authentication confirms who the user or application is. Authorization determines which resources and operations that authenticated identity is allowed to access.

Question 5

What is the primary purpose of audit logging in an enterprise AI solution?

A. To improve conversation quality

B. To automatically update connectors

C. To record significant activities for monitoring, compliance, and investigations

D. To eliminate the need for authentication

Correct Answer: C

Explanation: Audit logs capture important events such as sign-ins, configuration changes, deployments, and tool usage, supporting compliance, operational monitoring, and security investigations.

Question 6

Which Microsoft cloud service is most commonly used as the identity provider for enterprise Copilot Studio solutions?

A. Azure AI Search

B. Microsoft Entra ID

C. Microsoft Defender for Endpoint

D. Power BI

Correct Answer: B

Explanation: Microsoft Entra ID provides authentication, Single Sign-On, Conditional Access, identity governance, and application identity management for Microsoft cloud services.

Question 7

A company assigns permissions based on job functions such as HR Manager, Sales Representative, and Customer Support Agent. Which access control model is being used?

A. Mandatory Access Control (MAC)

B. Attribute-Based Access Control (ABAC)

C. Role-Based Access Control (RBAC)

D. Discretionary Access Control (DAC)

Correct Answer: C

Explanation: RBAC assigns permissions to roles rather than individual users, simplifying administration and ensuring consistent security across the organization.

Question 8

Which governance practice best reduces the risk of introducing untested changes into a production AI agent?

A. Performing all development directly in production

B. Disabling version control

C. Allowing unrestricted deployments by all users

D. Using separate development, test, and production environments with a structured ALM process

Correct Answer: D

Explanation: Separating environments and following Application Lifecycle Management (ALM) practices ensures that changes are tested, reviewed, and approved before reaching production.

Question 9

During integration planning, which authentication approach is generally preferred over API keys because it provides temporary access tokens and more granular authorization?

A. Basic Authentication

B. OAuth 2.0

C. Anonymous access

D. Shared service accounts

Correct Answer: B

Explanation: OAuth 2.0 uses short-lived access tokens instead of passwords or long-lived API keys, providing stronger security and fine-grained authorization capabilities.

Question 10

Which activity is an important governance responsibility after an AI agent has been deployed?

A. Permanently disabling monitoring to improve performance

B. Allowing unrestricted administrator access

C. Removing audit logs after deployment

D. Continuously monitoring security events, usage patterns, and compliance

Correct Answer: D

Explanation: Governance continues after deployment through ongoing monitoring, auditing, compliance reviews, and operational oversight to ensure the AI solution remains secure, reliable, and compliant.

Go to the AB-620 Exam Prep Hub main page

AB-900, Agentic AI, AI Governance, AI Security, Microsoft Certification

Identify how to configure user access to agents (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Perform basic administrative tasks for Copilot and agents (25–30%)
   --> Perform basic administrative tasks for agents
      --> Identify how to configure user access to agents

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

In Microsoft 365 Copilot, agents are specialized AI assistants designed to perform focused tasks such as answering domain-specific questions, retrieving organizational knowledge, or executing workflows. Because agents can access organizational data and systems, controlling who can use them and under what conditions is a critical administrative responsibility.

Configuring user access ensures that the right users can interact with the right agents while maintaining security, compliance, and least-privilege principles.

1. What “agent access” means

User access to agents determines:

  • Which users can discover an agent
  • Which users can interact with or run an agent
  • Whether an agent is available organization-wide or restricted to specific groups
  • Whether external or guest users can use agents (if allowed)

Access is typically controlled through a combination of:

  • Microsoft 365 identity and access controls
  • Entra ID (Azure AD) group membership
  • Copilot and agent-specific policies

2. Key methods to configure access to agents

A. Assigning access via Microsoft Entra ID groups

One of the most common approaches is group-based access control.

Administrators can:

  • Assign an agent to specific security groups or Microsoft 365 groups
  • Restrict usage to departments (e.g., HR, Finance, IT)
  • Manage access at scale without assigning users individually

Benefits:

  • Scalable management
  • Easier onboarding/offboarding
  • Centralized governance

B. Tenant-wide vs scoped availability

Agents can be configured as:

1. Tenant-wide agents

  • Available to all licensed users in the organization
  • Used for general productivity scenarios (e.g., company policy assistant)

2. Scoped agents

  • Limited to specific users or groups
  • Used for sensitive or department-specific data (e.g., HR policy agent)

C. Role-based access control (RBAC)

Some agent administration actions require specific roles in Microsoft 365 or Entra ID:

  • Global Administrator
  • AI Administrator / Copilot Administrator
  • Service-specific admin roles

RBAC ensures:

  • Only authorized admins can publish or modify agents
  • Governance over agent deployment lifecycle

D. Conditional Access policies

Conditional Access can indirectly control agent usage by enforcing:

  • Device compliance requirements
  • Multi-factor authentication (MFA)
  • Location-based restrictions
  • Risk-based sign-in rules

This ensures that even if a user has access to an agent, they must meet security requirements before using it.

E. Application and permission scopes

Agents may require access to:

  • Microsoft 365 data (SharePoint, Outlook, Teams)
  • External connectors or APIs
  • Graph permissions

Administrators control:

  • What data the agent can access
  • Whether consent is required
  • Whether permissions are user-delegated or app-level

3. Lifecycle considerations for agent access

Provisioning

  • Define target audience (group or tenant-wide)
  • Assign initial permissions
  • Validate compliance requirements

Modification

  • Update group membership to change access
  • Adjust policies as organizational needs evolve

Deprovisioning

  • Remove users or groups when no longer needed
  • Disable or retire the agent if required
  • Ensure data access is revoked appropriately

4. Governance best practices

To securely manage agent access:

  • Use least privilege access (only necessary users/groups)
  • Prefer group-based assignment over individual assignment
  • Regularly review agent usage and permissions
  • Restrict sensitive agents to controlled departments
  • Monitor access logs for unusual activity
  • Align with Microsoft Purview policies where applicable

5. Common use cases

  • HR agent accessible only to HR staff
  • IT helpdesk agent available to all employees
  • Finance reporting agent restricted to finance team
  • Executive summary agent limited to leadership group

6. Key exam takeaway

For AB-900, remember:

  • Agent access is primarily controlled through Entra ID groups, roles, and policies
  • Access can be tenant-wide or scoped
  • Security is enforced through RBAC and Conditional Access
  • Governance ensures agents are only available to the appropriate users

Practice Exam Questions (10)

1.

What is the most common method used to manage user access to Microsoft 365 agents at scale?

A. Individual user assignment
B. Local device policies
C. Entra ID group-based assignment
D. DNS configuration

Answer: C
Explanation: Entra ID group-based assignment is the scalable and recommended way to manage agent access.

2.

Which configuration limits an agent to only HR department users?

A. Tenant-wide publishing
B. Scoped group assignment
C. Public sharing link
D. Guest user activation

Answer: B
Explanation: Scoped assignment using groups restricts access to specific departments like HR.

3.

Which role is typically required to manage Copilot or agent deployment settings?

A. SharePoint Site Owner
B. Global Administrator
C. Teams Guest User
D. Exchange Recipient User

Answer: B
Explanation: Global Administrators (or similar privileged roles) manage high-level agent deployment settings.

4.

What is the purpose of Conditional Access in relation to agent usage?

A. To increase storage capacity
B. To control data indexing speed
C. To enforce security requirements before access
D. To create new agents automatically

Answer: C
Explanation: Conditional Access ensures users meet security conditions like MFA or device compliance.

5.

What happens when a user is removed from an Entra ID group assigned to an agent?

A. They retain permanent access
B. Their access is automatically revoked
C. The agent is deleted
D. The entire tenant loses access

Answer: B
Explanation: Group membership changes immediately affect access to assigned resources, including agents.

6.

Which access model makes an agent available to all licensed users in a tenant?

A. Scoped access
B. Tenant-wide access
C. External sharing mode
D. Device-based access

Answer: B
Explanation: Tenant-wide access allows all licensed users to use the agent.

7.

Which control helps restrict what data an agent can access?

A. Network firewall rules
B. Permission scopes and Graph permissions
C. Printer access policies
D. Windows registry settings

Answer: B
Explanation: Permission scopes define what data and services an agent can access.

8.

What is a key benefit of using group-based access for agents?

A. It disables auditing
B. It simplifies scalable management
C. It removes the need for authentication
D. It bypasses licensing requirements

Answer: B
Explanation: Group-based access simplifies administration, especially in large organizations.

9.

Which scenario best describes proper agent governance?

A. All users can create unrestricted agents
B. Agents are available without authentication
C. Sensitive agents are limited to specific departments
D. Agents bypass compliance policies

Answer: C
Explanation: Sensitive agents should be restricted to appropriate departments for security and compliance.

10.

What is a recommended best practice when configuring access to agents?

A. Assign access individually to each user
B. Use least privilege access principles
C. Allow anonymous access by default
D. Disable group usage entirely

Answer: B
Explanation: Least privilege ensures users only get the access they need, improving security and governance.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Governance, AI Security, Data Governance, Data Security, Microsoft Certification

Understand features and capabilities of SharePoint Advanced Management, including restricted site access (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify and monitor oversharing in SharePoint in Microsoft 365
      --> Understand features and capabilities of SharePoint Advanced Management, including restricted site access

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations increasingly rely on Microsoft 365, SharePoint Online, Microsoft Teams, and Microsoft 365 Copilot, protecting organizational data has become more important than ever. While collaboration is essential, unrestricted sharing can expose confidential information to unintended users.

To help organizations better govern SharePoint content, Microsoft offers SharePoint Advanced Management (SAM), a collection of advanced governance, reporting, security, and lifecycle management capabilities designed to improve the security of SharePoint and OneDrive environments.

One of its most important features is Restricted Site Access, which allows administrators to temporarily limit access to specific SharePoint sites that may contain highly sensitive or potentially overshared information.

For the AB-900 exam, you should understand the purpose of SharePoint Advanced Management, its major capabilities, and how Restricted Site Access helps reduce data exposure.

What is SharePoint Advanced Management?

SharePoint Advanced Management is a set of administrative capabilities that extends the standard SharePoint Online administration experience.

Its goals include:

  • Improving governance
  • Reducing oversharing
  • Enhancing visibility into permissions
  • Strengthening data protection
  • Supporting Microsoft 365 Copilot readiness
  • Helping organizations adopt Zero Trust security principles

Rather than replacing Microsoft Purview or Microsoft Defender, SharePoint Advanced Management complements these services by focusing specifically on SharePoint and OneDrive administration.

Why SharePoint Advanced Management Is Important

Organizations often have:

  • Thousands of SharePoint sites
  • Millions of documents
  • Numerous external users
  • Complex permission structures
  • Years of accumulated sharing links

As these environments grow, administrators face challenges such as:

  • Overshared files
  • Forgotten external sharing
  • Stale permissions
  • Sensitive documents accessible by too many users
  • Inactive or abandoned sites

SharePoint Advanced Management provides tools to identify and address these issues before they become security incidents.

Key Capabilities of SharePoint Advanced Management

SharePoint Advanced Management includes several capabilities designed to improve governance.

1. Data Access Governance Reporting

Administrators can:

  • Identify overshared sites
  • Review sharing activity
  • Analyze permission configurations
  • Discover external access
  • Locate high-risk collaboration sites

These reports provide visibility into who can access organizational content.

2. Site Lifecycle Management

Organizations frequently create project sites that remain active long after projects end.

SharePoint Advanced Management helps administrators:

  • Identify inactive sites
  • Review site ownership
  • Archive or delete unused sites
  • Reduce unnecessary content exposure

Proper lifecycle management reduces security risks while improving overall governance.

3. Oversharing Insights

Administrators can identify:

  • Sites shared broadly
  • Anonymous sharing links
  • Guest access
  • Sensitive sites with excessive permissions
  • Large-scale permission inheritance issues

These insights are particularly valuable before deploying Microsoft 365 Copilot.

4. Site Ownership Management

SharePoint sites require responsible owners.

Advanced Management helps administrators identify:

  • Sites without owners
  • Inactive owners
  • Ownership inconsistencies

Proper ownership improves accountability and ensures permissions are reviewed regularly.

5. Sharing Governance

Administrators can evaluate:

  • External sharing
  • Anonymous links
  • Organization-wide access
  • Sharing policies
  • Guest permissions

This helps organizations reduce unnecessary collaboration risks.

6. Restricted Site Access

One of the most important SharePoint Advanced Management capabilities is Restricted Site Access.

What is Restricted Site Access?

Restricted Site Access allows administrators to temporarily limit access to a SharePoint site.

When enabled:

  • Most users lose access to the site.
  • Only designated administrators or approved users can access the content.
  • Copilot and Microsoft Search continue to respect the updated permissions because they always honor Microsoft 365 security trimming.

This feature is useful when a site contains highly sensitive information or requires investigation.

Why Use Restricted Site Access?

Organizations may need to immediately reduce access when:

  • Sensitive information has been overshared.
  • A security investigation is underway.
  • Legal or regulatory reviews are occurring.
  • Confidential merger or acquisition documents are stored.
  • Human Resources investigations are active.
  • Executive leadership documents require additional protection.
  • Sensitive intellectual property is being reviewed.

Rather than deleting the site, administrators can quickly restrict access while remediation occurs.

How Restricted Site Access Works

The feature temporarily changes access behavior by allowing only explicitly authorized users to access the site.

Typical workflow:

  1. Administrator identifies a high-risk site.
  2. Restricted Site Access is enabled.
  3. Only approved users retain access.
  4. Administrators investigate permissions.
  5. Oversharing issues are corrected.
  6. Normal access is restored when appropriate.

Benefits of Restricted Site Access

Organizations gain several advantages:

Rapid Risk Reduction

Potential data exposure is reduced immediately.

Supports Investigations

Investigators can examine permissions without widespread user access.

Improves Governance

Administrators gain time to review sharing settings before reopening access.

Protects Sensitive Information

Highly confidential documents remain accessible only to authorized personnel.

Supports Compliance

Temporary restrictions can assist with legal, regulatory, or internal compliance reviews.

Relationship with Microsoft 365 Copilot

Microsoft 365 Copilot respects Microsoft 365 permissions.

If a site becomes restricted:

  • Copilot cannot retrieve information from that site for users who no longer have permission.
  • Microsoft Search also honors the updated permissions.
  • Other Microsoft 365 services continue using the same security model.

Restricted Site Access therefore reduces the likelihood that Copilot will surface sensitive content from that site.

Relationship with Microsoft Purview

SharePoint Advanced Management and Microsoft Purview work together.

Microsoft Purview focuses on:

  • Data classification
  • Sensitivity labels
  • Data Loss Prevention (DLP)
  • Insider Risk Management
  • Data Lifecycle Management
  • Compliance

SharePoint Advanced Management focuses on:

  • Site governance
  • Permissions
  • Oversharing
  • Site administration
  • Access analysis
  • Restricted Site Access

Together they provide comprehensive protection for Microsoft 365 data.

Relationship with Microsoft Defender

Microsoft Defender identifies threats such as:

  • Compromised accounts
  • Suspicious user activity
  • Malware
  • Phishing attacks

If Defender identifies suspicious activity involving a SharePoint site, administrators may choose to enable Restricted Site Access while investigating the incident.

Best Practices

Microsoft recommends the following practices:

  • Regularly review Data Access Governance reports.
  • Minimize broad “Everyone” permissions.
  • Review external sharing frequently.
  • Assign active site owners.
  • Archive inactive sites.
  • Apply sensitivity labels to sensitive content.
  • Use Restricted Site Access only when necessary.
  • Review restricted sites periodically and restore normal access when appropriate.
  • Combine SharePoint Advanced Management with Microsoft Purview and Microsoft Defender for layered protection.
  • Follow the principle of least privilege.

Exam Tips

Remember these key points for the AB-900 exam:

  • SharePoint Advanced Management focuses on governance and security for SharePoint and OneDrive.
  • It helps identify and remediate oversharing.
  • Restricted Site Access temporarily limits access to sensitive SharePoint sites.
  • Copilot always respects SharePoint permissions, including restricted sites.
  • Restricted Site Access is useful during investigations or when sensitive information has been overshared.
  • SharePoint Advanced Management complements Microsoft Purview rather than replacing it.
  • Proper site ownership and lifecycle management reduce long-term security risks.

Practice Exam Questions

Question 1

Which primary problem does SharePoint Advanced Management help organizations address?

A. Windows operating system updates

B. Oversharing and governance of SharePoint content

C. SQL Server performance tuning

D. Microsoft Teams meeting scheduling

Correct Answer: B

Explanation: SharePoint Advanced Management provides governance tools that help identify oversharing, manage permissions, and improve the security of SharePoint and OneDrive environments.

Question 2

What is the purpose of Restricted Site Access?

A. Permanently delete SharePoint sites

B. Encrypt every document within a site

C. Temporarily limit access to a SharePoint site for authorized users only

D. Automatically archive inactive sites

Correct Answer: C

Explanation: Restricted Site Access allows administrators to temporarily restrict access to a site while investigating or protecting sensitive information.

Question 3

Why is SharePoint Advanced Management valuable before deploying Microsoft 365 Copilot?

A. It increases Copilot response speed.

B. It upgrades Microsoft Graph.

C. It removes all external users automatically.

D. It helps identify overshared content that Copilot could otherwise access based on existing permissions.

Correct Answer: D

Explanation: Since Copilot honors existing permissions, reducing oversharing before deployment helps minimize the risk of exposing sensitive information.

Question 4

Which capability is included in SharePoint Advanced Management?

A. Azure virtual machine backup

B. Microsoft Intune device enrollment

C. Data Access Governance reporting

D. Windows Server patch management

Correct Answer: C

Explanation: Data Access Governance reporting is a core capability that helps administrators analyze permissions and identify overshared content.

Question 5

What happens when Restricted Site Access is enabled?

A. Microsoft 365 Copilot ignores the restriction.

B. Only approved users and administrators retain access to the site.

C. All SharePoint sites become read-only.

D. External sharing is permanently disabled across the tenant.

Correct Answer: B

Explanation: Restricted Site Access limits access to authorized users, and Copilot continues to respect those permissions.

Question 6

Which Microsoft service primarily complements SharePoint Advanced Management by classifying and protecting sensitive information?

A. Microsoft Purview

B. Microsoft Paint

C. Windows Defender Firewall

D. Microsoft Project

Correct Answer: A

Explanation: Microsoft Purview provides data classification, labeling, DLP, and compliance capabilities that complement SharePoint governance features.

Question 7

Which scenario is an appropriate use case for Restricted Site Access?

A. Scheduling recurring Teams meetings

B. Updating Microsoft 365 licenses

C. Protecting a SharePoint site containing confidential merger documents during negotiations

D. Increasing SharePoint storage capacity

Correct Answer: C

Explanation: Restricting access to highly confidential content during sensitive business activities helps reduce the risk of accidental exposure.

Question 8

Which governance activity helps reduce long-term security risks in SharePoint?

A. Creating additional anonymous sharing links

B. Allowing all users full control of every site

C. Disabling Microsoft Search

D. Reviewing inactive sites and assigning active site owners

Correct Answer: D

Explanation: Proper site ownership and lifecycle management reduce abandoned sites and improve ongoing governance.

Question 9

How does Microsoft 365 Copilot interact with a site that has Restricted Site Access enabled?

A. Copilot bypasses the restriction for administrators only.

B. Copilot ignores SharePoint permissions.

C. Copilot respects the updated permissions and cannot retrieve content for unauthorized users.

D. Copilot copies restricted files into Microsoft Graph.

Correct Answer: C

Explanation: Copilot always honors Microsoft 365 permissions. If a user cannot access a restricted site, Copilot cannot use its content in responses for that user.

Question 10

Which statement best describes SharePoint Advanced Management?

A. It replaces Microsoft Purview entirely.

B. It is focused on SharePoint and OneDrive governance, permissions, lifecycle management, and oversharing protection.

C. It functions as an antivirus solution.

D. It manages Microsoft Entra ID authentication policies.

Correct Answer: B

Explanation: SharePoint Advanced Management provides advanced governance capabilities for SharePoint and OneDrive, including oversharing detection, site lifecycle management, permission analysis, and Restricted Site Access.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Governance, AI Security, Data Governance, Microsoft Certification, security

Run a data access governance report in SharePoint (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify and monitor oversharing in SharePoint in Microsoft 365
      --> Run a data access governance report in SharePoint

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

That is an excellent next topic for the AB-900 exam because it combines SharePoint governance, Microsoft Purview, and Copilot data security. Although the feature continues to evolve, the exam focuses on understanding what the report is, when to use it, and what problems it helps administrators solve, rather than memorizing every UI step.

Why Data Access Governance Matters

One of the largest security challenges in Microsoft 365 is oversharing. Over time, organizations accumulate millions of files, thousands of SharePoint sites, and numerous Microsoft Teams workspaces. Permissions often become increasingly complex as users:

  • Share files externally
  • Create anonymous sharing links
  • Grant access to “Everyone”
  • Add guests to Teams
  • Break inheritance on folders
  • Forget to remove temporary permissions

As organizations adopt Microsoft 365 Copilot, overshared content becomes an even greater concern because Copilot can surface information that a user already has permission to access—even if that access was unintentionally granted.

Microsoft provides Data Access Governance (DAG) capabilities in SharePoint to help administrators discover, understand, and remediate excessive access before it becomes a security issue.

What is Data Access Governance?

Data Access Governance is a collection of reporting and analysis capabilities within SharePoint Advanced Management that helps administrators answer questions such as:

  • Which sites are accessible by everyone?
  • Which files are overshared?
  • Which sites have external users?
  • Which sites contain highly sensitive information?
  • Which permissions may expose confidential content?
  • Which sites should be reviewed?

Rather than examining permissions one site at a time, administrators receive organization-wide visibility.

Primary Goals of Data Access Governance

Data Access Governance helps organizations:

  • Discover overshared sites
  • Review permissions
  • Reduce excessive access
  • Identify high-risk collaboration
  • Improve Microsoft 365 security posture
  • Prepare for Microsoft 365 Copilot deployment
  • Reduce accidental data exposure
  • Support compliance initiatives

Why It Is Important for Microsoft 365 Copilot

Microsoft 365 Copilot never ignores permissions.

Instead, it retrieves content using the same security model that governs Microsoft 365.

If a user has permission to open a document manually, Copilot can potentially reference that document when generating responses.

For example:

Suppose Human Resources accidentally grants the entire company read access to salary spreadsheets.

Without Copilot:

  • Most employees may never discover the files.

With Copilot:

A user might ask:

“Summarize employee compensation data.”

Because the files are already accessible, Copilot could retrieve them.

The problem is not Copilot—it is the underlying permissions.

Data Access Governance helps identify these permission problems before they become security risks.

What the Data Access Governance Report Shows

The report provides administrators with visibility into SharePoint permissions and sharing configurations across the tenant.

Common information includes:

  • Site owners
  • Site sensitivity
  • External sharing status
  • Number of members
  • Anonymous links
  • Organization-wide access
  • Guest access
  • Sharing activity
  • Permission inheritance
  • Access patterns
  • High-risk sites
  • Overshared content indicators

Rather than searching manually, administrators can prioritize the highest-risk locations.

Types of Oversharing That Can Be Identified

The report can identify situations such as:

Organization-wide access

Sites accessible by:

  • Everyone
  • Everyone except external users
  • Large security groups

These sites often expose more content than intended.

Anonymous Links

Files shared through links that require no authentication.

These links may remain active long after they are needed.

Guest Access

Sites containing:

  • External users
  • Partner accounts
  • Vendor accounts

Administrators can verify whether guest access is still appropriate.

Excessive Sharing

Examples include:

  • Large numbers of shared files
  • Broad sharing permissions
  • Public document libraries
  • Open collaboration spaces

Sensitive Sites

The report can identify sites that contain:

  • Financial information
  • HR records
  • Legal documents
  • Intellectual property
  • Customer information

Combined with Microsoft Purview sensitivity labels, administrators gain better visibility into where important information resides.

Typical Workflow

Administrators generally follow this process:

Step 1

Open SharePoint administration tools.

Step 2

Generate or review a Data Access Governance report.

Step 3

Review identified risks.

Examples:

  • Overshared sites
  • External sharing
  • Everyone permissions
  • Sensitive content

Step 4

Investigate high-risk sites.

Questions include:

  • Does this access need to exist?
  • Are guests still required?
  • Is inheritance broken?
  • Should permissions be reduced?

Step 5

Take corrective action.

Possible actions include:

  • Remove permissions
  • Restrict sharing
  • Apply sensitivity labels
  • Disable anonymous links
  • Reduce guest access
  • Educate site owners

Step 6

Run reports regularly to verify improvements.

Relationship with Microsoft Purview

Data Access Governance works alongside Microsoft Purview.

Purview answers questions such as:

  • What sensitive data exists?
  • How is it classified?
  • Which labels are applied?
  • Are DLP policies triggered?

SharePoint Data Access Governance answers:

  • Who can access the data?
  • Is the data overshared?
  • Which sites expose information?
  • Which permissions should be reviewed?

Together they provide both:

  • Content awareness
  • Permission awareness

Relationship with Microsoft 365 Copilot

Data Access Governance helps administrators prepare for Copilot by reducing permission-related risks.

Benefits include:

  • Finding overshared SharePoint sites
  • Identifying unnecessary permissions
  • Reducing broad access
  • Reviewing guest sharing
  • Protecting confidential information
  • Improving search security
  • Supporting Zero Trust principles

Best Practices

Microsoft recommends that organizations:

  • Review sharing reports regularly.
  • Audit external access periodically.
  • Minimize “Everyone” permissions.
  • Remove unused guest accounts.
  • Apply sensitivity labels to important sites.
  • Use Microsoft Purview DLP alongside SharePoint governance.
  • Educate site owners on responsible sharing.
  • Review high-risk collaboration sites before deploying Copilot broadly.
  • Follow the principle of least privilege.
  • Continuously monitor permission changes.

Common Exam Tips

Remember these key points:

  • Data Access Governance focuses on permissions and access, not document content.
  • It helps identify oversharing across SharePoint.
  • It is especially valuable before deploying Microsoft 365 Copilot.
  • Copilot respects existing Microsoft 365 permissions.
  • Oversharing is a permissions problem, not a Copilot problem.
  • Reports help administrators prioritize high-risk sites for remediation.
  • Data Access Governance complements Microsoft Purview rather than replacing it.

Practice Exam Questions

Question 1

Why would an administrator run a Data Access Governance report in SharePoint?

A. To update SharePoint servers

B. To identify overshared sites and permission risks

C. To encrypt all documents automatically

D. To generate Microsoft 365 licenses

Correct Answer: B

Explanation: Data Access Governance helps administrators identify sites with excessive permissions, external sharing, and other access-related risks.

Question 2

Which issue is Data Access Governance primarily designed to identify?

A. SQL database corruption

B. Printer failures

C. Oversharing of SharePoint content

D. Network latency

Correct Answer: C

Explanation: The primary purpose is to detect oversharing and excessive permissions across SharePoint.

Question 3

Why is Data Access Governance especially important before deploying Microsoft 365 Copilot?

A. Copilot automatically changes permissions.

B. Copilot ignores SharePoint security.

C. Copilot copies all SharePoint files.

D. Copilot can reference content users already have permission to access.

Correct Answer: D

Explanation: Copilot honors existing permissions. Overshared content may therefore appear in Copilot responses if users already have legitimate access.

Question 4

Which type of access represents a potential oversharing risk?

A. Anonymous sharing links

B. Azure subscription ownership

C. Exchange mailbox size

D. Microsoft Teams background images

Correct Answer: A

Explanation: Anonymous links allow access without authentication and should be reviewed carefully.

Question 5

What question does Data Access Governance primarily help answer?

A. Which users have excessive access to SharePoint content?

B. Which Windows updates are missing?

C. Which devices need antivirus software?

D. Which Microsoft 365 licenses should be purchased?

Correct Answer: A

Explanation: Data Access Governance focuses on permissions, sharing, and access to SharePoint content.

Question 6

Which Microsoft 365 principle is supported by regularly reviewing Data Access Governance reports?

A. Unlimited collaboration

B. Least privilege

C. Maximum storage allocation

D. Unlimited guest access

Correct Answer: B

Explanation: Regular reviews help ensure users have only the permissions necessary to perform their work.

Question 7

Which type of SharePoint site would likely appear as higher risk in a Data Access Governance report?

A. A private HR site with restricted access

B. A site shared with only one administrator

C. A site containing sensitive files that is accessible to everyone

D. A newly created empty site

Correct Answer: C

Explanation: Sensitive information combined with broad permissions represents a significant oversharing risk.

Question 8

How does Data Access Governance complement Microsoft Purview?

A. Both products only classify documents.

B. Data Access Governance focuses on permissions, while Purview focuses on data protection and governance.

C. They perform identical functions.

D. Purview replaces SharePoint permissions.

Correct Answer: B

Explanation: Purview governs and protects data, while Data Access Governance helps administrators understand who has access to that data.

Question 9

Which action should an administrator consider after identifying an overshared SharePoint site?

A. Delete all documents immediately.

B. Disable Microsoft 365 Copilot.

C. Purchase additional SharePoint storage.

D. Review and reduce unnecessary permissions.

Correct Answer: D

Explanation: The appropriate response is to evaluate existing permissions and remove excessive or unnecessary access while maintaining business needs.

Question 10

Which statement about Microsoft 365 Copilot and Data Access Governance is true?

A. Data Access Governance prevents all Copilot responses.

B. Copilot bypasses SharePoint permissions when generating answers.

C. Data Access Governance helps reduce the risk of Copilot surfacing overshared information by identifying excessive permissions.

D. Copilot encrypts all SharePoint documents before using them.

Correct Answer: C

Explanation: By identifying and remediating overshared permissions, Data Access Governance helps ensure Copilot only surfaces information that users are appropriately authorized to access.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Governance, AI Security, Microsoft Certification, security

Discover and manage AI activity by using DSPM for AI (Part 2) (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Discover and manage AI activity by using DSPM for AI

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

In Part 1, you learned how Microsoft Purview Data Security Posture Management (DSPM) for AI helps organizations discover AI activity, identify sensitive data exposure, detect oversharing, and provide visibility into how AI interacts with Microsoft 365 data.

This section (Part 2) focuses on how DSPM for AI helps administrators manage AI-related risks, integrates with other Microsoft security and compliance services, and supports secure AI adoption.

Security Recommendations Generated by DSPM for AI

One of DSPM for AI’s most valuable capabilities is providing actionable security recommendations rather than simply identifying problems.

After analyzing an organization’s AI environment, DSPM highlights areas that should be improved to reduce the likelihood of accidental data exposure or compliance violations.

Examples of recommendations include:

  • Reduce excessive SharePoint permissions.
  • Apply sensitivity labels to unclassified confidential files.
  • Configure Data Loss Prevention (DLP) policies.
  • Limit external sharing.
  • Protect highly confidential document libraries.
  • Enable auditing for AI-related activities.
  • Improve data governance before expanding AI deployments.

These recommendations help administrators prioritize improvements based on potential business impact and security risk.

Risk Prioritization

Not every security finding represents the same level of risk.

DSPM helps prioritize remediation efforts by evaluating factors such as:

  • Amount of sensitive data exposed
  • Number of users with access
  • Business importance of the data
  • Existing protection mechanisms
  • AI usage patterns
  • Permission inheritance
  • Regulatory implications

This enables administrators to address the highest-risk issues first.

For example:

RiskPriority
Public access to executive financial reportsHigh
Sensitive HR documents lacking labelsHigh
Marketing presentations shared internallyMedium
Public training documentsLow

Discovering AI-Related Data Exposure

Organizations often ask:

“If we enable Microsoft 365 Copilot today, what sensitive information could users potentially discover?”

DSPM helps answer this question.

It analyzes:

  • Existing permissions
  • Data classifications
  • Sharing configurations
  • Microsoft Graph relationships
  • Collaboration patterns

This provides insight into which sensitive data could become more discoverable through AI-assisted searches and summaries.

Remember:

Copilot does not bypass security permissions. It only accesses information that the signed-in user is already authorized to access. DSPM helps identify situations where those permissions may already be too broad.

Remediation Recommendations

After identifying risks, DSPM recommends remediation steps.

Common recommendations include:

Reduce Oversharing

Examples include:

  • Remove unnecessary SharePoint permissions.
  • Restrict Microsoft Teams membership.
  • Remove Everyone access.
  • Limit guest sharing.

Improve Data Classification

Examples include:

  • Apply sensitivity labels.
  • Enable automatic labeling.
  • Use trainable classifiers.
  • Configure sensitive information types.

Better classification improves downstream protections across Microsoft Purview.

Strengthen Data Protection Policies

DSPM may recommend:

  • Creating DLP policies
  • Encrypting confidential documents
  • Restricting downloads
  • Blocking external sharing
  • Applying retention labels

Review AI Access

Administrators may decide to:

  • Limit AI rollout to selected departments
  • Review permissions before enabling Copilot broadly
  • Reduce access to legacy repositories
  • Remove stale user accounts

Integration with Microsoft Purview

DSPM for AI does not operate as an isolated product.

Instead, it complements several Microsoft Purview solutions.

Understanding these relationships is important for the AB-900 exam.

Microsoft Purview Information Protection

Information Protection classifies and protects data.

DSPM benefits from these classifications.

For example:

A document labeled:

  • Highly Confidential
  • Internal Only
  • Financial
  • Legal

helps DSPM understand the sensitivity of AI-accessible content.

Without labels, DSPM has less context when evaluating risk.

Microsoft Purview Data Loss Prevention (DLP)

DLP prevents sensitive information from being shared inappropriately.

DSPM identifies potential risks.

DLP helps enforce policies to prevent those risks from becoming incidents.

Example workflow:

  1. DSPM discovers sensitive payroll files.
  2. DLP prevents external sharing.
  3. Organization reduces AI-related exposure.

Microsoft Purview Insider Risk Management

DSPM identifies risky data exposure.

Insider Risk Management identifies risky user behavior.

Together they help answer two different questions:

DSPM asks:

“What sensitive data could AI access?”

Insider Risk asks:

“Is someone attempting to misuse sensitive data?”

These products complement one another.

Microsoft Purview Activity Explorer

Activity Explorer provides visibility into user interactions with sensitive information.

DSPM can use Activity Explorer insights to better understand:

  • Sensitive file access
  • Label usage
  • DLP events
  • Data movement

Administrators gain a clearer understanding of how protected information is being used across Microsoft 365.

Microsoft Purview Compliance Manager

Compliance Manager focuses on regulatory compliance.

DSPM focuses on AI data governance.

Together they help organizations:

  • Reduce compliance risk
  • Improve governance
  • Meet regulatory requirements
  • Protect sensitive information used by AI

Microsoft Defender

Microsoft Defender protects identities, endpoints, applications, and cloud resources.

DSPM complements Defender by focusing specifically on AI-related data risks.

Examples:

Microsoft Defender detects:

  • Malware
  • Credential theft
  • Phishing
  • Device compromise

DSPM identifies:

  • Overshared files
  • AI exposure
  • Sensitive data visibility
  • Permission risks

AI Governance Dashboard

DSPM provides dashboards that help administrators understand their organization’s AI posture.

Typical dashboard information includes:

  • AI adoption trends
  • Sensitive data exposure
  • High-risk repositories
  • Oversharing statistics
  • AI application inventory
  • Policy recommendations
  • Governance posture

Rather than investigating individual files, administrators receive a broad organizational view.

Discovering AI Applications

DSPM helps organizations understand:

  • Which AI tools are in use
  • Which departments use them
  • Adoption trends
  • AI usage over time

Examples include:

  • Microsoft 365 Copilot
  • Microsoft Copilot Chat
  • Supported third-party AI services

This visibility helps organizations establish AI governance policies.

Investigating AI Risks

Administrators typically investigate findings by asking questions such as:

  • Which sensitive files are accessible?
  • Who has access?
  • Why do they have access?
  • Is the data properly labeled?
  • Are permissions appropriate?
  • Is the data externally shared?
  • Should additional protection be applied?

DSPM helps surface this information so administrators can make informed decisions.

Typical Investigation Workflow

A simplified investigation might follow these steps:

Step 1

DSPM identifies an overshared SharePoint site.

↓

Step 2

Administrator reviews permissions.

↓

Step 3

Sensitive files are discovered.

↓

Step 4

Sensitivity labels are applied.

↓

Step 5

Permissions are reduced.

↓

Step 6

DLP policies are enabled.

↓

Step 7

Risk is reduced before broader Copilot deployment.

Best Practices

Organizations implementing Microsoft 365 Copilot should follow several best practices.

Review Permissions Before AI Rollout

Avoid enabling Copilot before understanding existing permissions.

Classify Sensitive Data

Use Microsoft Purview Information Protection to classify important documents.

Apply Least Privilege

Users should only have access to information required for their job.

Reduce Oversharing

Review:

  • SharePoint permissions
  • Teams memberships
  • OneDrive sharing
  • External sharing

Enable DLP

Prevent accidental sharing of confidential information.

Monitor AI Adoption

Understand:

  • Who uses AI
  • Which departments use AI
  • What information AI accesses

Regularly Review Recommendations

DSPM continuously evaluates the environment.

Administrators should regularly review new recommendations as data, permissions, and AI usage evolve.

Licensing Considerations

For the AB-900 exam, you are not expected to memorize licensing details, as licensing can change over time.

However, you should understand these general principles:

  • DSPM for AI is part of the Microsoft Purview family.
  • Advanced governance and AI security capabilities may require appropriate Microsoft licensing.
  • Organizations should verify current licensing requirements before deployment.

Common Exam Scenarios

You may encounter questions like:

Scenario 1

An organization wants to know whether Microsoft 365 Copilot could expose confidential HR documents because of existing permissions.

Relevant technology:

Microsoft Purview DSPM for AI

Scenario 2

Administrators want recommendations to reduce AI-related data exposure before deploying Copilot.

Relevant technology:

Microsoft Purview DSPM for AI

Scenario 3

Security administrators want visibility into AI adoption across Microsoft 365.

Relevant technology:

Microsoft Purview DSPM for AI

Scenario 4

Administrators want to identify overshared SharePoint sites that AI could access.

Relevant technology:

Microsoft Purview DSPM for AI

Scenario 5

An organization wants to understand where sensitive information may be exposed through AI.

Relevant technology:

Microsoft Purview DSPM for AI

Common Misconceptions

Misconception 1

DSPM blocks AI prompts.

Incorrect.

DSPM primarily discovers, assesses, and helps reduce AI-related data risks. It is not a prompt-filtering or AI-blocking solution.

Misconception 2

Copilot ignores permissions.

Incorrect.

Copilot always respects the signed-in user’s existing Microsoft 365 permissions.

Misconception 3

DSPM replaces Microsoft Purview DLP.

Incorrect.

DSPM identifies risks, while DLP enforces policies that help prevent inappropriate sharing of sensitive data.

Misconception 4

DSPM replaces Microsoft Defender.

Incorrect.

Defender focuses on threats and attacks, whereas DSPM focuses on AI-related data exposure and governance.

Misconception 5

DSPM automatically fixes security issues.

Incorrect.

DSPM provides visibility, recommendations, and guidance. Administrators remain responsible for implementing changes such as adjusting permissions, applying labels, or configuring policies.

AB-900 Exam Tips

Focus on these key concepts:

  • Microsoft Purview DSPM for AI is an AI governance and visibility solution.
  • It helps organizations discover AI usage, identify sensitive data exposure, and reduce AI-related risks.
  • DSPM does not bypass or modify Microsoft 365 permissions.
  • It works alongside Information Protection, DLP, Insider Risk Management, Activity Explorer, Compliance Manager, and Microsoft Defender.
  • One of its primary goals is to identify oversharing before it becomes a business risk.
  • DSPM provides recommendations, not automatic remediation.
  • It supports organizations throughout the AI adoption lifecycle by helping them continuously improve their security posture.

Chapter Summary

Microsoft Purview DSPM for AI enables organizations to adopt AI confidently by providing visibility into how AI interacts with organizational data. It discovers AI usage, inventories AI applications, identifies oversharing, evaluates sensitive data exposure, and recommends actions to strengthen governance.

Rather than replacing existing Microsoft Purview or Microsoft Defender capabilities, DSPM for AI enhances them by adding AI-specific insights. It integrates with Information Protection, Data Loss Prevention, Insider Risk Management, Activity Explorer, Compliance Manager, and Microsoft Defender to create a comprehensive approach to AI governance.

For the AB-900 exam, remember that DSPM for AI is fundamentally about discovering, assessing, and managing AI-related data risks. It helps administrators understand where AI could expose sensitive information due to existing permissions and governance gaps, enabling organizations to improve their security posture before and during Microsoft 365 Copilot deployment.

Practice Exam Questions

Question 1

A company plans to deploy Microsoft 365 Copilot across all departments. Before deployment, administrators want to determine whether confidential documents are overly accessible due to existing SharePoint permissions.

Which Microsoft solution should they use?

A. Microsoft Entra Domain Services

B. Microsoft Defender for Endpoint

C. Microsoft Intune

D. Microsoft Purview Data Security Posture Management (DSPM) for AI

Correct Answer: D

Explanation

Microsoft Purview DSPM for AI helps organizations discover overshared content, evaluate AI-related data exposure, and identify permission risks before deploying AI solutions such as Microsoft 365 Copilot.

  • A is correct because DSPM for AI analyzes permissions and identifies AI-related security risks.
  • B is incorrect because Defender for Endpoint protects devices.
  • C is incorrect because Intune manages devices and applications.
  • D is incorrect because Entra Domain Services provides managed domain services rather than AI governance.

Question 2

An administrator wants to understand which departments are actively using Microsoft 365 Copilot and other approved AI applications.

Which capability best addresses this requirement?

A. Microsoft Purview Information Protection

B. Microsoft Purview DSPM for AI

C. Microsoft Defender for Cloud Apps

D. Microsoft Entra Conditional Access

Correct Answer: B

Explanation

DSPM for AI provides visibility into AI adoption, AI application inventory, and usage trends across the organization.

  • B is correct because DSPM for AI discovers AI activity and AI adoption.
  • A classifies and protects data.
  • C monitors cloud applications but is not specifically designed for AI governance.
  • D controls authentication conditions.

Question 3

Which statement best describes how Microsoft 365 Copilot accesses organizational data?

A. It bypasses Microsoft 365 permissions when generating responses.

B. It can access all documents stored in Microsoft 365 regardless of permissions.

C. It only accesses content the signed-in user is already authorized to access.

D. It only accesses files created after Copilot was enabled.

Correct Answer: C

Explanation

Copilot respects existing Microsoft 365 permissions. It never bypasses authorization.

  • C is correct because Copilot only retrieves content the current user can already access.
  • A and B incorrectly imply that Copilot ignores permissions.
  • D is incorrect because file creation date is irrelevant.

Question 4

What is the primary purpose of Microsoft Purview DSPM for AI?

A. Prevent all AI-generated responses

B. Replace Microsoft Defender

C. Automatically encrypt all Microsoft 365 data

D. Discover AI activity and identify AI-related data risks

Correct Answer: D

Explanation

DSPM for AI provides visibility into AI usage and helps identify governance and security risks.

  • D is correct because discovering AI activity and assessing AI-related risks are its primary objectives.
  • A, B, and C describe capabilities DSPM does not provide.

Question 5

An organization discovers that hundreds of employees can access executive financial reports because of inherited SharePoint permissions.

What type of risk has DSPM for AI identified?

A. Malware infection

B. Oversharing

C. Identity synchronization failure

D. Device compliance failure

Correct Answer: B

Explanation

Oversharing occurs when users have broader access to information than intended.

  • B is correct because excessive permissions increase AI-related exposure.
  • A, C, and D are unrelated to data governance.

Question 6

Which Microsoft technology provides much of the contextual relationship information that helps DSPM for AI understand user access to Microsoft 365 content?

A. Microsoft SQL Server

B. Microsoft Defender XDR

C. Microsoft Graph

D. Azure Kubernetes Service

Correct Answer: C

Explanation

Microsoft Graph provides relationships between users, files, emails, Teams, SharePoint, and other Microsoft 365 resources.

  • C is correct because DSPM uses Microsoft Graph signals to understand data access.
  • The remaining options do not provide organizational relationship data.

Question 7

Which Microsoft Purview solution works alongside DSPM for AI by preventing inappropriate sharing of sensitive information?

A. Microsoft Purview Data Loss Prevention (DLP)

B. Microsoft Entra ID Protection

C. Microsoft Intune

D. Windows Autopilot

Correct Answer: A

Explanation

DLP enforces policies that prevent sensitive information from being shared improperly.

  • A is correct because DLP complements DSPM by enforcing protection policies.
  • B, C, and D serve different purposes.

Question 8

An administrator wants recommendations for reducing AI-related security risks before expanding Microsoft 365 Copilot deployment.

What should they use?

A. Microsoft Defender Antivirus

B. Microsoft Purview DSPM for AI

C. Exchange Online Protection

D. Microsoft Entra Connect

Correct Answer: B

Explanation

DSPM for AI evaluates AI-related risks and recommends improvements such as reducing oversharing, improving data classification, and strengthening governance.

  • B is correct because providing security recommendations is one of its core capabilities.
  • The other products address different areas of Microsoft security.

Question 9

Which action would most effectively reduce AI-related data exposure identified by DSPM for AI?

A. Disable Microsoft Teams

B. Increase mailbox quotas

C. Review permissions and apply sensitivity labels to confidential data

D. Upgrade Windows devices

Correct Answer: C

Explanation

Reducing excessive permissions and properly classifying sensitive information significantly reduces AI-related exposure.

  • C is correct because both permission management and data classification are recommended remediation actions.
  • A, B, and D do not directly address AI governance.

Question 10

Which statement best summarizes Microsoft’s approach to AI governance with DSPM for AI?

A. DSPM automatically blocks all AI interactions involving confidential information.

B. DSPM replaces Microsoft Purview Information Protection.

C. DSPM eliminates the need for Microsoft Defender.

D. DSPM provides visibility, identifies risks, and recommends actions that help organizations securely adopt AI.

Correct Answer: D

Explanation

Microsoft Purview DSPM for AI is designed to improve organizational AI security posture by discovering AI usage, identifying risks, and recommending governance improvements.

  • D is correct because it accurately reflects the purpose of DSPM for AI.
  • A is incorrect because DSPM is primarily a discovery and governance solution rather than an AI-blocking mechanism.
  • B is incorrect because Information Protection remains responsible for classifying and protecting data.
  • C is incorrect because Microsoft Defender continues to provide threat protection and complements, rather than is replaced by, DSPM for AI.

Key Takeaways for the AB-900 Exam

After studying this topic, you should be able to:

  • Explain the purpose of Microsoft Purview DSPM for AI.
  • Describe how DSPM for AI helps organizations discover and govern AI activity.
  • Understand that Microsoft 365 Copilot always respects existing user permissions.
  • Explain the concept of oversharing and why it is a significant AI-related risk.
  • Describe how Microsoft Graph provides context that enables DSPM for AI to evaluate data access.
  • Identify how DSPM for AI integrates with Microsoft Purview Information Protection, Data Loss Prevention (DLP), Insider Risk Management, Activity Explorer, Compliance Manager, and Microsoft Defender.
  • Recognize that DSPM for AI provides visibility, risk assessment, and recommendations, but administrators remain responsible for implementing remediation actions.
  • Apply DSPM for AI concepts to common AB-900 scenario-based questions involving Microsoft 365 Copilot deployments and AI governance.

These concepts form an important part of the “Identify data protection and governance risks for Microsoft 365 and Copilot” objective and are frequently tested through scenario-based questions that assess your understanding of secure AI adoption and governance.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Governance, AI Security, Data Security, Microsoft Certification

Discover and Manage AI activity by using DSPM for AI (Part 1) (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Discover and Manage AI activity by using DSPM for AI

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations increasingly adopt AI-powered tools such as Microsoft 365 Copilot, administrators face a new challenge: understanding how AI accesses, processes, and exposes organizational data. Traditional security tools focus on protecting users, devices, and data, but AI introduces new considerations. AI assistants can summarize documents, answer questions, generate reports, and analyze data from across an organization’s Microsoft 365 environment. If permissions are overly broad or sensitive information is poorly governed, AI can unintentionally surface information to users who already have access but should not necessarily see it in a summarized or easily discoverable form.

To address these challenges, Microsoft introduced Microsoft Purview Data Security Posture Management (DSPM) for AI, a solution designed to help organizations discover AI usage, identify potential security risks, understand data exposure, and strengthen governance before and during AI adoption.

For the AB-900 exam, you are not expected to configure DSPM for AI. Instead, you should understand:

  • What DSPM for AI is
  • Why organizations use it
  • How it discovers AI activity
  • How it helps identify risks
  • How it integrates with Microsoft Purview
  • The types of recommendations it provides

What Is Microsoft Purview DSPM for AI?

Microsoft Purview DSPM for AI is a governance and security solution that provides visibility into how artificial intelligence applications interact with organizational data.

Rather than preventing AI usage, DSPM for AI helps administrators answer important questions such as:

  • Which AI applications are employees using?
  • What sensitive information is being accessed?
  • Are AI tools exposing confidential content?
  • Are permissions overly broad?
  • Are Microsoft 365 Copilot users accessing highly sensitive data?
  • Where should security controls be strengthened?

Think of DSPM for AI as a risk discovery and governance solution specifically designed for AI workloads.

What Does “Data Security Posture Management” Mean?

The term Data Security Posture Management (DSPM) refers to continuously evaluating an organization’s data environment to identify security weaknesses before they become incidents.

DSPM focuses on questions such as:

  • Where is sensitive data stored?
  • Who has access?
  • Is the data properly classified?
  • Are security policies protecting it?
  • Could AI expose it more easily?

When AI is introduced, DSPM expands these questions to include:

  • Which AI tools are interacting with company data?
  • Which users are using AI?
  • What content is AI accessing?
  • Could AI reveal confidential information?
  • Are there oversharing risks?

Rather than reacting after a breach occurs, DSPM promotes proactive risk management.

Why Organizations Need DSPM for AI

Many organizations begin using AI before fully understanding their existing data environment.

Common issues include:

  • Excessive file permissions
  • Sensitive documents shared too broadly
  • Unlabeled confidential data
  • Legacy SharePoint permissions
  • Public Teams channels
  • Old collaboration sites
  • Inactive security policies

Without visibility into these issues, AI may legally retrieve information based on existing permissions—even though administrators were unaware those permissions existed.

DSPM for AI helps organizations discover these weaknesses before they become security problems.

Core Capabilities of DSPM for AI

Microsoft Purview DSPM for AI provides several major capabilities.

1. Discover AI Usage

DSPM identifies where AI is being used throughout the organization.

Examples include:

  • Microsoft 365 Copilot
  • Microsoft Copilot Chat
  • AI-enabled Microsoft services
  • Supported third-party AI applications

Administrators gain visibility into:

  • AI adoption
  • AI usage trends
  • Departments using AI
  • Types of AI interactions

This helps organizations understand how quickly AI is being adopted.

2. Discover Sensitive Data Exposure

DSPM evaluates whether AI has access to sensitive organizational data.

Examples include:

  • Financial reports
  • HR records
  • Customer information
  • Legal documents
  • Intellectual property
  • Healthcare information
  • Personally identifiable information (PII)

The solution identifies locations where sensitive information may be accessible through AI.

3. Identify Oversharing Risks

One of the most important concepts for the AB-900 exam is oversharing.

Oversharing occurs when users have legitimate permissions to data that administrators did not intend them to have.

For example:

  • A confidential SharePoint library inherits incorrect permissions.
  • Hundreds of employees can read executive documents.
  • Microsoft 365 Copilot can summarize those documents for anyone with existing access.

The problem is not Copilot.

The problem is the underlying permissions.

DSPM helps identify these situations.

4. Inventory AI Applications

Organizations often have many AI applications in use.

DSPM helps administrators discover:

  • Approved AI tools
  • Newly adopted AI tools
  • Shadow AI applications
  • AI usage across departments

This visibility supports governance decisions.

5. Monitor AI Interactions

DSPM can provide insights into how AI interacts with organizational content.

Examples include:

  • Documents accessed
  • Sensitive data locations
  • AI usage frequency
  • Common AI workflows
  • Business units using AI

Administrators gain a better understanding of AI usage patterns without reading users’ private prompts or monitoring employee productivity.

How DSPM for AI Discovers AI Activity

DSPM analyzes signals across Microsoft 365 services to understand AI usage.

These signals may include:

  • User activity
  • Data access
  • File classifications
  • Permissions
  • Labels
  • Microsoft Graph relationships
  • Microsoft Purview metadata

Rather than simply counting AI prompts, DSPM builds a broader picture of how AI interacts with organizational data.

Microsoft Graph’s Role

One important concept for the AB-900 exam is understanding the relationship between Microsoft Graph and DSPM.

Microsoft Graph acts as the intelligence layer connecting Microsoft 365 services.

DSPM uses Microsoft Graph signals to understand:

  • Which files users can access
  • Collaboration relationships
  • SharePoint permissions
  • Teams memberships
  • OneDrive access
  • Email relationships
  • Microsoft 365 activity

This allows DSPM to identify situations where AI could expose sensitive information because users already possess excessive permissions.

Data Sources Evaluated by DSPM

DSPM evaluates multiple Microsoft 365 services.

Examples include:

SharePoint Online

  • Sensitive document libraries
  • Overshared sites
  • Confidential folders
  • File permissions

OneDrive

  • Shared personal files
  • External sharing
  • Sensitive documents
  • Personal work data

Microsoft Teams

  • Shared files
  • Team memberships
  • Collaboration spaces
  • Shared conversations

Exchange Online

  • Email data
  • Mailbox access
  • Shared mailboxes
  • Sensitive communications

Microsoft 365 Copilot

DSPM evaluates how Copilot interacts with organizational data by examining:

  • Available permissions
  • Data sources
  • Sensitive information exposure
  • Governance controls

Types of Risks DSPM Can Identify

DSPM helps identify a variety of AI-related risks.

Overshared Content

Examples include:

  • Everyone can access HR documents.
  • Finance reports are visible to the entire company.
  • Sensitive SharePoint sites inherit incorrect permissions.

Sensitive Information Exposure

Examples include:

  • Credit card numbers
  • Passport numbers
  • Social Security numbers
  • Customer records
  • Healthcare data
  • Intellectual property

Excessive Permissions

Users frequently accumulate permissions over time.

DSPM identifies situations where users have access to more information than necessary.

This supports the principle of least privilege.

Unclassified Sensitive Data

Organizations often possess sensitive information that has never been classified.

DSPM can identify repositories containing:

  • Unlabeled confidential documents
  • Sensitive spreadsheets
  • Legal contracts
  • Financial reports

This allows administrators to apply Microsoft Purview Information Protection labels.

Shadow AI

Shadow AI refers to employees using AI tools that have not been approved by the organization.

Examples might include:

  • Public AI chat services
  • AI writing assistants
  • AI coding assistants
  • AI document summarizers

DSPM helps organizations understand where unmanaged AI usage exists so appropriate governance decisions can be made.

Key Exam Tips

For the AB-900 exam, remember these important points:

  • DSPM for AI is primarily a visibility and governance solution, not an AI blocking solution.
  • It helps organizations discover, understand, and reduce AI-related risks.
  • It identifies oversharing, sensitive data exposure, and permission issues.
  • DSPM works closely with other Microsoft Purview solutions to improve an organization’s overall AI security posture.
  • Microsoft Graph provides much of the contextual information that enables DSPM to evaluate AI data access and potential risks.
  • The goal is not to restrict productive AI use, but to ensure that AI operates within an organization’s existing security, compliance, and governance framework.

Go to Part 2 of this topic.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Data Governance, Data Security, Microsoft Certification, security

Identify policy violations generated by Communication Compliance (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify policy violations generated by Communication Compliance

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand how Microsoft Purview Communication Compliance helps organizations detect, investigate, and respond to inappropriate communications that may violate corporate policies, legal requirements, or regulatory standards. You should also understand how administrators review policy matches, investigate alerts, and take appropriate remediation actions.

What is Microsoft Purview Communication Compliance?

Microsoft Purview Communication Compliance is a Microsoft Purview solution that helps organizations detect and investigate inappropriate or risky communications across Microsoft 365 services.

Rather than preventing users from communicating, Communication Compliance monitors communications and alerts authorized reviewers when messages match organizational policies.

It helps organizations detect communications involving:

  • Harassment
  • Discrimination
  • Offensive language
  • Threats
  • Confidential information sharing
  • Regulatory violations
  • Inappropriate behavior
  • Insider risks

Communication Compliance is designed to reduce legal, compliance, and reputational risks while helping organizations meet industry regulations.

Why Communication Compliance Is Important

Organizations communicate constantly using:

  • Microsoft Teams chats
  • Teams channel messages
  • Outlook emails
  • Viva Engage (Yammer)
  • Third-party communication platforms (through supported connectors)

Without monitoring, inappropriate communications may:

  • Create hostile work environments
  • Lead to lawsuits
  • Violate government regulations
  • Expose confidential information
  • Damage an organization’s reputation

Communication Compliance provides visibility into these risks.

What Are Policy Violations?

A policy violation occurs when a communication matches conditions defined within a Communication Compliance policy.

Examples include:

  • Use of offensive language
  • Bullying or harassment
  • Sharing confidential customer information
  • Threatening another employee
  • Insider trading discussions
  • Regulatory compliance violations
  • Sharing protected intellectual property

A policy violation does not automatically mean misconduct occurred.

Instead, it means the communication requires human review.

How Communication Compliance Works

The workflow follows several stages.

Step 1: Create a Policy

Administrators create policies that define:

  • Users or groups to monitor
  • Communication locations
  • Types of violations
  • Detection conditions
  • Review workflow

Step 2: Monitor Communications

Communication Compliance continuously analyzes supported communications.

Examples include:

  • Teams messages
  • Emails
  • Viva Engage posts

Content is evaluated against policy conditions.

Step 3: Generate Alerts

If content matches a policy:

  • An alert is generated.
  • The alert appears in the Communication Compliance dashboard.
  • Reviewers receive notification.

Step 4: Human Review

Authorized reviewers investigate:

  • Original message
  • Conversation context
  • Users involved
  • Severity
  • Previous incidents

Reviewers determine whether the communication truly violated policy.

Step 5: Resolution

Reviewers choose an appropriate action, such as:

  • Resolve as compliant
  • Confirm violation
  • Escalate investigation
  • Notify HR
  • Notify legal
  • Train employee
  • Document findings

Common Types of Policy Violations

Harassment

Detects communications containing:

  • Insults
  • Bullying
  • Abusive language
  • Threats

Example:

“You’re completely useless and should quit.”

Discrimination

Detects language involving:

  • Race
  • Gender
  • Religion
  • Disability
  • Age
  • Protected characteristics

Offensive Language

Identifies:

  • Profanity
  • Hate speech
  • Offensive expressions

Sensitive Information Sharing

Detects messages containing:

  • Credit card numbers
  • Social Security numbers
  • Customer information
  • Financial records
  • Medical information

Regulatory Compliance Violations

Organizations in regulated industries monitor communications involving:

  • Insider trading
  • Market manipulation
  • Financial misconduct
  • Unauthorized disclosures

Confidential Information

Detects unauthorized sharing of:

  • Trade secrets
  • Product designs
  • Internal reports
  • Source code
  • Financial forecasts

Policy Alerts

A Communication Compliance alert contains information such as:

  • Policy name
  • Date and time
  • Severity
  • User involved
  • Communication type
  • Matched rule
  • Review status

Alerts help reviewers prioritize investigations.

Alert Severity

Organizations often classify alerts as:

Low

Minor language concerns.

Example:

A mildly inappropriate joke.

Medium

Behavior that may violate company policy.

Example:

Repeated offensive language.

High

Serious compliance concern.

Example:

Threats of violence or disclosure of confidential data.

Reviewing Policy Violations

Authorized reviewers access the Communication Compliance portal.

During review they can examine:

  • Conversation history
  • Message participants
  • Attachments
  • Policy triggered
  • Matching keywords
  • Previous incidents
  • Related alerts

Context is important because individual messages may appear harmless without surrounding conversation.

Investigation Workflow

A typical investigation includes:

  1. Open the alert.
  2. Review message details.
  3. Examine conversation context.
  4. Determine whether policy was actually violated.
  5. Assign a review outcome.
  6. Document findings.
  7. Close or escalate the case.

Possible Review Outcomes

Reviewers may classify alerts as:

  • No violation
  • Violation confirmed
  • Needs escalation
  • False positive
  • Resolved

These outcomes help improve future policy effectiveness.

False Positives

Not every alert represents an actual violation.

Examples include:

  • Educational discussions
  • Medical terminology
  • Technical documentation
  • Quoted material
  • Sarcasm
  • Context misunderstood by automated analysis

Human review remains essential.

Improving Detection Accuracy

Organizations can improve policy effectiveness by:

  • Updating keyword dictionaries
  • Using machine learning classifiers
  • Adjusting policy thresholds
  • Creating separate policies for departments
  • Reviewing false positives
  • Refining monitored user groups

Who Reviews Violations?

Communication Compliance uses role-based access control.

Typical reviewers include:

  • Compliance administrators
  • Compliance officers
  • Human Resources
  • Legal teams
  • Risk investigators

Only authorized personnel can review sensitive communications.

Privacy Considerations

Communication Compliance is designed with privacy controls.

Organizations can:

  • Limit reviewer access
  • Use pseudonymization (where supported)
  • Restrict investigations
  • Audit reviewer actions
  • Follow regional privacy laws

Integration with Other Microsoft Security Solutions

Communication Compliance works alongside several Microsoft security solutions.

Microsoft Purview Insider Risk Management

Communication Compliance findings may support insider risk investigations involving suspicious employee behavior.

Microsoft Purview Data Loss Prevention (DLP)

DLP prevents unauthorized sharing of sensitive information, while Communication Compliance reviews the content and context of communications.

Microsoft Purview Information Protection

Sensitivity labels applied to documents help reviewers understand the sensitivity of shared information.

Microsoft Defender

Security incidents and user risk signals can complement Communication Compliance investigations.

Communication Compliance and Microsoft 365 Copilot

As organizations adopt Microsoft 365 Copilot, Communication Compliance remains important because users increasingly collaborate through Teams, Outlook, and other Microsoft 365 services that Copilot can reference based on existing permissions.

If inappropriate communications occur, Communication Compliance can:

  • Detect policy violations
  • Assist investigations
  • Support regulatory compliance
  • Help protect organizational reputation
  • Complement broader Microsoft Purview governance capabilities

Best Practices

For the AB-900 exam, remember these best practices:

  • Monitor communications using clearly defined policies.
  • Review alerts promptly.
  • Always investigate message context before making decisions.
  • Use authorized reviewers only.
  • Tune policies to reduce false positives.
  • Protect employee privacy while maintaining compliance.
  • Integrate Communication Compliance with broader Microsoft Purview governance.

AB-900 Exam Tips

Remember these key points:

  • Communication Compliance monitors communications—it does not block them.
  • Policy violations generate alerts, not automatic disciplinary actions.
  • Human reviewers determine whether a true violation occurred.
  • Context matters when reviewing communications.
  • Communication Compliance supports compliance, legal, HR, and risk management teams.
  • Alerts can detect harassment, discrimination, offensive language, regulatory violations, and sensitive information sharing.
  • Communication Compliance works together with Insider Risk Management, DLP, Information Protection, and Microsoft Defender.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview Communication Compliance?

A. Encrypt all Microsoft Teams messages

B. Detect and investigate communications that may violate organizational policies

C. Prevent users from sending emails

D. Back up Microsoft 365 communications

Correct Answer: B

Explanation: Communication Compliance monitors supported communications and generates alerts when messages match configured compliance policies.

Question 2

A Communication Compliance alert indicates that a Teams message matched a harassment policy. What should happen next?

A. The user account is automatically disabled.

B. The message is permanently deleted.

C. An authorized reviewer investigates the communication.

D. The policy is automatically removed.

Correct Answer: C

Explanation: Communication Compliance generates alerts for human review rather than taking automatic disciplinary actions.

Question 3

Which type of communication can Microsoft Purview Communication Compliance monitor?

A. BIOS startup messages

B. Local Windows Event Logs

C. Microsoft Teams chats

D. Printer configuration files

Correct Answer: C

Explanation: Teams chats are one of the primary communication sources monitored by Communication Compliance.

Question 4

Why is conversation context important when reviewing alerts?

A. It determines network bandwidth.

B. It identifies device drivers.

C. It encrypts communications.

D. It helps reviewers determine whether a message truly violates policy.

Correct Answer: D

Explanation: Individual messages may appear inappropriate when viewed alone but may be acceptable within the full conversation.

Question 5

Which activity is an example of a Communication Compliance policy violation?

A. Updating Windows patches

B. Sharing vacation schedules

C. Sending offensive or harassing messages to coworkers

D. Resetting a forgotten password

Correct Answer: C

Explanation: Offensive or harassing communications are common scenarios monitored by Communication Compliance.

Question 6

Who should review Communication Compliance alerts?

A. Any employee

B. Only authorized compliance reviewers

C. External customers

D. Guest users

Correct Answer: B

Explanation: Access to Communication Compliance investigations is limited through role-based access control.

Question 7

What is a false positive in Communication Compliance?

A. A communication incorrectly identified as violating policy

B. A deleted user account

C. An expired Microsoft 365 license

D. A successful malware scan

Correct Answer: A

Explanation: False positives occur when automated detection flags communications that are ultimately determined not to violate policy.

Question 8

Which Microsoft Purview solution focuses primarily on preventing sensitive information from leaving the organization?

A. Communication Compliance

B. Insider Risk Management

C. Data Loss Prevention (DLP)

D. Compliance Manager

Correct Answer: C

Explanation: DLP is designed to detect and prevent unauthorized sharing of sensitive information, while Communication Compliance focuses on reviewing communications.

Question 9

What does a Communication Compliance alert indicate?

A. A confirmed policy violation requiring disciplinary action

B. A communication matched a configured policy and should be reviewed

C. The user’s account has been compromised

D. Microsoft 365 licensing has expired

Correct Answer: B

Explanation: Alerts indicate potential policy matches that require investigation; they are not proof of wrongdoing.

Question 10

Which statement best describes Microsoft Purview Communication Compliance?

A. It replaces antivirus software.

B. It automatically blocks every risky message.

C. It permanently archives all Microsoft 365 files.

D. It helps organizations identify, investigate, and respond to inappropriate communications.

Correct Answer: D

Explanation: Communication Compliance helps organizations manage communication-related compliance risks through monitoring, alerting, investigation, and response.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Microsoft Certification, security

Identify risks by using Microsoft Purview Insider Risk Management (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify risks by using Microsoft Purview Insider Risk Management

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Microsoft Purview Insider Risk Management (IRM) helps organizations detect, investigate, and respond to insider risks before they result in significant business damage. Unlike external cyberattacks, insider risks originate from individuals who already have authorized access to organizational resources. These individuals may intentionally misuse data or unintentionally expose sensitive information through careless actions.

For the AB-900 exam, you should understand:

  • What Insider Risk Management is
  • The types of risks it helps identify
  • The components used to detect insider risks
  • How risk indicators and policies work
  • How investigations are performed
  • How Insider Risk Management integrates with other Microsoft 365 security solutions
  • Common use cases

What Is Microsoft Purview Insider Risk Management?

Microsoft Purview Insider Risk Management is a Microsoft Purview solution that uses machine learning, analytics, user activity signals, and built-in privacy protections to identify potentially risky user behavior.

Its purpose is not to assume users are malicious. Instead, it identifies behaviors that could indicate:

  • Data theft
  • Intellectual property loss
  • Security violations
  • Compliance violations
  • Accidental data exposure
  • Policy violations

The solution helps security, compliance, HR, and legal teams investigate suspicious activities while respecting employee privacy.

What Is an Insider Risk?

An insider risk is any situation where someone with legitimate access to organizational systems creates risk for the organization.

Examples include:

  • An employee downloading thousands of confidential files before resigning
  • A contractor copying customer information to a USB drive
  • A user emailing sensitive documents to a personal email account
  • An employee sharing confidential information through unauthorized cloud storage
  • A user repeatedly accessing data unrelated to their job responsibilities

Not every insider risk is malicious.

Many incidents are accidental.

Examples include:

  • Sending confidential files to the wrong recipient
  • Uploading sensitive documents to public cloud storage
  • Accidentally sharing confidential Teams files

Types of Insider Risks

Microsoft categorizes insider risks into several common scenarios.

Data Theft

Occurs when users attempt to remove valuable organizational information.

Examples include:

  • Downloading confidential files
  • Copying files to USB devices
  • Printing sensitive documents
  • Emailing proprietary information externally

Data Leakage

Sensitive information leaves the organization unintentionally.

Examples include:

  • Uploading files to personal cloud storage
  • Sending confidential documents externally
  • Sharing protected files publicly

Security Policy Violations

Users violate established organizational security rules.

Examples include:

  • Disabling security controls
  • Using unauthorized applications
  • Circumventing compliance policies

Compliance Violations

Employees violate legal or regulatory requirements.

Examples include:

  • Sharing regulated financial records
  • Mishandling healthcare information
  • Improperly accessing customer records

Departing Employee Risks

A common scenario involves employees preparing to leave the organization.

Potential indicators include:

  • Large file downloads
  • Increased file copying
  • Unusual external sharing
  • Mass printing
  • Accessing previously unused repositories

How Insider Risk Management Works

Insider Risk Management follows a multi-stage process.

Step 1: Collect Activity Signals

Microsoft collects activity information from supported Microsoft 365 services.

Examples include:

  • SharePoint Online
  • OneDrive
  • Exchange Online
  • Microsoft Teams
  • Microsoft Defender
  • Microsoft Entra ID
  • Endpoint activity
  • Microsoft Defender for Endpoint

Step 2: Analyze User Activity

Machine learning compares current activity against:

  • Normal behavior
  • Organizational policies
  • Risk indicators
  • User context

This reduces false positives.

Step 3: Generate Risk Alerts

If suspicious behavior exceeds configured thresholds:

  • An alert is created.
  • The alert receives a severity level.
  • Investigators can review supporting evidence.

Step 4: Investigate

Compliance administrators review:

  • Timeline of events
  • User activities
  • File operations
  • Email actions
  • Device activities
  • Related alerts

Step 5: Respond

Possible actions include:

  • Escalating investigations
  • Assigning cases
  • Collecting evidence
  • Alerting management
  • Applying additional protections
  • Closing false positives

Risk Indicators

Risk indicators are behaviors that contribute to a user’s overall risk score.

Examples include:

File Activities

  • Downloading files
  • Deleting files
  • Printing documents
  • Copying files
  • Uploading files

Email Activities

  • Sending attachments externally
  • Forwarding confidential emails
  • Mass emailing sensitive information

Device Activities

  • USB device usage
  • File transfers
  • Printing
  • Local file copying

Collaboration Activities

  • Sharing Teams files externally
  • Creating anonymous sharing links
  • Public document sharing

User Behavior

Examples include:

  • Working unusual hours
  • Accessing unusual locations
  • Accessing excessive numbers of files
  • Sudden changes in behavior

Insider Risk Policies

Policies determine:

  • Which users are monitored
  • What behaviors are evaluated
  • Alert thresholds
  • Investigation rules

Policies are based on templates.

Common templates include:

  • Data leaks
  • Data theft
  • Security policy violations
  • Departing employees
  • Risky browser usage
  • Priority user monitoring

Policies allow organizations to customize detection based on their business needs.

Risk Scores

Each user activity contributes to a risk score.

Higher scores indicate more concerning activity.

Factors influencing scores include:

  • Number of risky actions
  • Severity of activities
  • Frequency
  • Historical behavior
  • Machine learning analysis

Risk scores help investigators prioritize the most serious incidents.

Alerts

When policy thresholds are exceeded, alerts are created.

Alerts typically include:

  • User involved
  • Policy triggered
  • Activity timeline
  • Risk level
  • Supporting evidence
  • Recommended investigation steps

Alert severity may include:

  • Low
  • Medium
  • High

Cases

Investigators can promote alerts into investigation cases.

Cases centralize:

  • Evidence
  • User activity
  • Timeline
  • Notes
  • Investigation status
  • Assigned investigators

This allows multiple reviewers to collaborate.

Privacy by Design

Microsoft designed Insider Risk Management with employee privacy in mind.

Privacy protections include:

  • Role-based access control
  • User pseudonymization (where supported)
  • Audit logging
  • Configurable privacy settings
  • Limited investigator access

Organizations control who can view personally identifiable information.

Integration with Microsoft 365 Services

Insider Risk Management integrates with many Microsoft security solutions.

Microsoft Purview Data Loss Prevention (DLP)

Provides sensitivity information about protected files.

Example:

A user emailing a document containing credit card numbers may trigger both DLP and Insider Risk Management.

Microsoft Purview Information Protection

Sensitivity labels provide additional context.

Example:

Downloading dozens of “Highly Confidential” documents creates greater risk than downloading public documents.

Microsoft Defender

Endpoint signals include:

  • USB usage
  • File copying
  • Application activity
  • Device events

These signals improve risk detection.

Microsoft Entra ID

Identity information provides context, including:

  • User identity
  • Sign-in behavior
  • Account changes
  • Risk signals

Microsoft 365 Audit Logs

User activities across Microsoft 365 workloads provide evidence for investigations.

AI and Machine Learning

Machine learning helps reduce false positives by:

  • Understanding normal behavior
  • Detecting unusual activity
  • Correlating multiple signals
  • Prioritizing serious incidents

This allows investigators to focus on the highest-risk alerts.

Common Use Cases

Protecting Intellectual Property

Identify employees copying engineering documents before leaving the company.

Detecting Insider Data Theft

Identify users downloading large numbers of confidential files.

Monitoring High-Risk Users

Monitor executives or privileged administrators who have access to sensitive information.

Investigating Data Leaks

Determine how confidential information left the organization.

Supporting HR Investigations

Provide evidence when investigating employee misconduct.

Benefits of Insider Risk Management

Organizations benefit by:

  • Detecting insider threats early
  • Protecting confidential information
  • Reducing compliance violations
  • Improving investigations
  • Prioritizing high-risk incidents
  • Using AI to reduce false positives
  • Integrating with Microsoft Purview and Microsoft Defender
  • Supporting regulatory compliance
  • Protecting intellectual property
  • Providing centralized case management

Exam Tips

For the AB-900 exam, remember these key points:

  • Insider Risk Management focuses on user behavior, not external attackers.
  • It detects both malicious and accidental risky activities.
  • Policies determine what activities are monitored.
  • Machine learning helps reduce false positives.
  • Alerts can be promoted into investigation cases.
  • Insider Risk Management integrates with DLP, Information Protection, Microsoft Defender, Microsoft Entra ID, and Microsoft 365 audit logs.
  • Risk scores help prioritize investigations.
  • Privacy protections are built into the solution.

10 Practice Exam Questions

Question 1

An employee uploads several confidential engineering documents to a personal cloud storage account shortly before resigning.

Which Microsoft Purview solution is specifically designed to investigate this type of behavior?

A. Microsoft Purview eDiscovery

B. Microsoft Purview Insider Risk Management

C. Microsoft Defender for Cloud Apps

D. Microsoft Intune

Correct Answer: B

Explanation: Insider Risk Management is specifically designed to identify potentially risky insider behavior such as data theft, data leakage, and activities performed by departing employees.

Question 2

Which activity is most likely to increase a user’s insider risk score?

A. Viewing the company homepage

B. Logging into Microsoft Teams during normal working hours

C. Downloading hundreds of confidential files before leaving the company

D. Changing a desktop wallpaper

Correct Answer: C

Explanation: Large-scale downloads of sensitive information—especially by departing employees—are common indicators of insider risk.

Question 3

What is the primary purpose of Insider Risk Management policies?

A. Encrypt all Microsoft 365 data

B. Replace antivirus software

C. Control Microsoft licensing

D. Define which users, activities, and risk indicators should be monitored

Correct Answer: D

Explanation: Policies specify monitored users, monitored activities, thresholds, and investigation settings.

Question 4

Which Microsoft technology helps Insider Risk Management reduce false positives?

A. Static firewall rules

B. Manual investigations only

C. Machine learning and behavioral analytics

D. Network packet inspection

Correct Answer: C

Explanation: Machine learning evaluates user behavior patterns and distinguishes normal activity from potentially risky behavior.

Question 5

What happens after Insider Risk Management determines that user activity exceeds a configured policy threshold?

A. The user account is automatically deleted.

B. The organization’s Microsoft 365 subscription is suspended.

C. All user devices are immediately wiped.

D. An insider risk alert is generated for investigation.

Correct Answer: D

Explanation: Alerts are created when monitored activities exceed policy thresholds and can later be investigated or promoted into cases.

Question 6

Which Microsoft solution provides endpoint signals such as USB usage and local file copying to Insider Risk Management?

A. Microsoft Defender for Endpoint

B. Microsoft Outlook

C. Microsoft Planner

D. Microsoft Bookings

Correct Answer: A

Explanation: Microsoft Defender for Endpoint supplies valuable endpoint telemetry that strengthens insider risk detection.

Question 7

Which statement best describes Microsoft’s approach to employee privacy within Insider Risk Management?

A. Every administrator automatically sees all employee information.

B. Employee privacy protections such as role-based access and pseudonymization are built into the solution.

C. All investigations are anonymous and cannot identify users.

D. Privacy settings cannot be customized.

Correct Answer: B

Explanation: Insider Risk Management incorporates privacy-by-design principles, including role-based access, pseudonymization where supported, and configurable privacy controls.

Question 8

Which scenario is an example of an accidental insider risk?

A. A hacker exploits an internet-facing server.

B. An attacker launches a ransomware attack.

C. An employee mistakenly emails confidential information to the wrong external recipient.

D. A distributed denial-of-service (DDoS) attack targets a website.

Correct Answer: C

Explanation: Insider risks include accidental actions, such as unintentionally sharing sensitive information with unauthorized recipients.

Question 9

What information helps investigators prioritize which alerts should be reviewed first?

A. The user’s mailbox size

B. Microsoft licensing level

C. The user’s department name

D. The insider risk score and alert severity

Correct Answer: D

Explanation: Risk scores and alert severity help investigators focus on the most significant potential threats first.

Question 10

Which Microsoft Purview capability most directly complements Insider Risk Management by identifying and protecting sensitive content through labeling?

A. Microsoft Purview Information Protection

B. Microsoft Exchange Online Protection

C. Microsoft Intune

D. Windows Firewall

Correct Answer: A

Explanation: Microsoft Purview Information Protection classifies and labels sensitive information. Those labels provide valuable context that Insider Risk Management can use when assessing the risk associated with user activities.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Governance, AI Security, Microsoft Certification

Identify compliance risks and recommendations by using Microsoft Purview Compliance Manager (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Identify data protection and governance risks for Microsoft 365 and Copilot
      --> Identify compliance risks and recommendations by using Microsoft Purview Compliance Manager

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Organizations today face increasing regulatory and compliance requirements related to data privacy, security, records management, and governance. Regulations such as GDPR, HIPAA, ISO 27001, NIST, PCI DSS, and many others require organizations to implement controls that protect sensitive information and demonstrate compliance.

Microsoft Purview Compliance Manager is a solution within Microsoft Purview that helps organizations assess, manage, and improve their compliance posture. It provides a risk-based approach to compliance by measuring how well an organization has implemented controls and by offering actionable recommendations to reduce compliance risks.

For the AB-900 exam, you should understand the purpose of Compliance Manager, how it identifies compliance risks, how compliance scores are calculated, and how organizations can use recommendations to improve their compliance posture.

What Is Microsoft Purview Compliance Manager?

Microsoft Purview Compliance Manager is a compliance management solution that helps organizations:

  • Assess compliance risks
  • Monitor compliance status
  • Track implementation of compliance controls
  • Improve regulatory compliance
  • Generate evidence for audits
  • Prioritize remediation efforts

Compliance Manager translates complex regulatory requirements into manageable improvement actions that administrators can implement within Microsoft 365.

Rather than simply reporting compliance status, Compliance Manager helps organizations actively improve compliance through continuous assessment and risk reduction.

Why Compliance Manager Is Important

Organizations must comply with numerous regulations and standards. Managing compliance manually can be difficult because:

  • Regulations frequently change
  • Multiple frameworks may apply simultaneously
  • Compliance controls span many systems
  • Evidence collection can be time-consuming
  • Auditors require documentation

Compliance Manager helps centralize compliance activities and provides visibility into compliance readiness.

Benefits include:

  • Reduced compliance risk
  • Improved governance
  • Simplified audit preparation
  • Better visibility into regulatory requirements
  • Continuous compliance monitoring
  • Prioritized remediation efforts

Understanding Compliance Risk

Compliance risk refers to the possibility that an organization fails to meet legal, regulatory, or internal policy requirements.

Examples include:

  • Improper handling of personal data
  • Missing security controls
  • Lack of retention policies
  • Inadequate access controls
  • Failure to encrypt sensitive information
  • Insufficient auditing and monitoring

Compliance Manager helps identify these risks by comparing organizational practices against compliance requirements.

Compliance Score

One of the most important concepts in Compliance Manager is the Compliance Score.

The Compliance Score is a measurement that reflects the organization’s progress toward meeting selected compliance requirements.

The score:

  • Is risk-based
  • Measures completed controls
  • Helps prioritize work
  • Changes as actions are completed

A higher score generally indicates that more compliance controls have been implemented.

However, the score does not guarantee compliance with a regulation. It serves as a management tool for tracking progress and reducing risk.

How Compliance Score Is Calculated

Compliance Manager assigns points to improvement actions.

Points are awarded when actions are completed.

Examples of actions include:

  • Enabling multifactor authentication
  • Configuring retention policies
  • Applying sensitivity labels
  • Enabling audit logging
  • Implementing access controls

Higher-risk controls typically receive more points because they contribute more significantly to risk reduction.

Assessments in Compliance Manager

An assessment measures compliance against a specific regulation, standard, or framework.

Examples include:

  • GDPR
  • ISO 27001
  • NIST
  • HIPAA
  • PCI DSS
  • Microsoft Data Protection Baseline

Each assessment contains:

  • Control objectives
  • Improvement actions
  • Testing guidance
  • Documentation requirements
  • Compliance status tracking

Organizations can use multiple assessments simultaneously.

Types of Controls

Compliance Manager evaluates different types of controls.

Microsoft-Managed Controls

These controls are implemented and managed by Microsoft.

Examples include:

  • Physical datacenter security
  • Infrastructure protections
  • Platform-level safeguards

Microsoft provides evidence showing how these controls are implemented.

Customer-Managed Controls

These controls are the responsibility of the organization.

Examples include:

  • MFA configuration
  • Retention policies
  • Access management
  • User training
  • Data classification

Administrators must implement and document these controls.

Shared Controls

Shared controls involve responsibilities divided between Microsoft and the customer.

Examples include:

  • Identity management
  • Security monitoring
  • Data protection configurations

Both parties contribute to compliance.

Improvement Actions

Improvement actions are recommendations that help organizations reduce compliance risk.

An improvement action typically includes:

  • Description of the requirement
  • Implementation guidance
  • Testing procedures
  • Documentation requirements
  • Risk impact

Examples include:

  • Enable multifactor authentication
  • Configure audit logging
  • Apply sensitivity labels
  • Restrict external sharing
  • Implement retention policies
  • Enable Data Loss Prevention policies

Completing improvement actions increases the compliance score.

Recommendations in Compliance Manager

Compliance Manager provides actionable recommendations that help organizations improve compliance.

Recommendations may involve:

Identity Security

Examples:

  • Enable MFA
  • Implement Conditional Access
  • Review privileged accounts
  • Use least-privilege access

Data Protection

Examples:

  • Configure sensitivity labels
  • Encrypt sensitive content
  • Implement DLP policies
  • Protect confidential information

Monitoring and Auditing

Examples:

  • Enable auditing
  • Review activity logs
  • Investigate suspicious behavior
  • Maintain audit records

Information Governance

Examples:

  • Create retention policies
  • Define retention labels
  • Manage records
  • Implement deletion schedules

Testing and Evidence Collection

Compliance Manager supports audit preparation through evidence collection.

Organizations can:

  • Upload documentation
  • Store screenshots
  • Attach policy documents
  • Record test results
  • Maintain audit evidence

This makes audits easier because evidence is stored alongside compliance controls.

Regulatory Templates

Compliance Manager includes built-in templates for many regulations and standards.

Examples include:

  • GDPR
  • HIPAA
  • ISO 27001
  • NIST CSF
  • SOC 2
  • PCI DSS

Templates reduce the effort required to build compliance programs from scratch.

Monitoring Compliance Over Time

Compliance is not a one-time activity.

Compliance Manager supports continuous monitoring by:

  • Tracking score changes
  • Updating assessment status
  • Identifying new risks
  • Monitoring action completion
  • Highlighting outstanding requirements

Organizations can regularly review their compliance posture and address gaps.

Compliance Manager and Microsoft 365 Copilot

As organizations adopt Microsoft 365 Copilot, governance and compliance become increasingly important.

Compliance Manager can help organizations:

  • Evaluate data protection readiness
  • Review access controls
  • Verify sensitivity label deployment
  • Assess retention policies
  • Confirm audit logging is enabled
  • Measure compliance maturity

These controls help ensure Copilot operates within established governance and compliance frameworks.

Key Exam Tips

For the AB-900 exam, remember:

  • Compliance Manager helps assess and improve compliance posture.
  • Compliance Score measures progress toward implementing controls.
  • Improvement actions provide recommendations for reducing risk.
  • Assessments measure compliance against regulations and standards.
  • Controls may be Microsoft-managed, customer-managed, or shared.
  • Compliance Manager supports evidence collection and audit readiness.
  • A higher Compliance Score indicates improved compliance posture but does not guarantee regulatory compliance.
  • Compliance Manager helps organizations identify and prioritize compliance risks.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Purview Compliance Manager?

A. Create SharePoint sites automatically

B. Assess and improve an organization’s compliance posture

C. Replace Microsoft Defender

D. Manage Windows updates

Answer: B

Explanation: Compliance Manager helps organizations assess compliance risks, track controls, and improve compliance posture through assessments and recommendations.

Question 2

What does the Compliance Score primarily represent?

A. The number of licensed users

B. The percentage of completed support tickets

C. Progress toward implementing compliance controls

D. The amount of storage consumed

Answer: C

Explanation: Compliance Score measures the organization’s progress in implementing controls that reduce compliance risk.

Question 3

Which type of control is managed entirely by Microsoft?

A. Customer-managed control

B. Shared control

C. Administrative control

D. Microsoft-managed control

Answer: D

Explanation: Microsoft-managed controls are implemented and maintained by Microsoft, such as datacenter security and infrastructure protections.

Question 4

An administrator wants to increase the organization’s Compliance Score. What should they do?

A. Purchase more Microsoft licenses

B. Increase mailbox storage limits

C. Complete improvement actions

D. Delete old assessments

Answer: C

Explanation: Improvement actions contribute points to the Compliance Score and help reduce compliance risk.

Question 5

Which feature helps organizations prepare for audits?

A. Microsoft Forms

B. Evidence collection and documentation storage

C. Viva Engage

D. Power Automate approvals

Answer: B

Explanation: Compliance Manager allows organizations to upload documentation, screenshots, and evidence needed for audits.

Question 6

Which of the following is an example of a customer-managed control?

A. Physical datacenter security

B. Network backbone management

C. Global infrastructure redundancy

D. Configuring multifactor authentication

Answer: D

Explanation: Customers are responsible for implementing controls such as MFA, retention policies, and access controls.

Question 7

What is an assessment in Compliance Manager?

A. A financial audit report

B. A measurement of compliance against a regulation or standard

C. A SharePoint permission review

D. A Microsoft support case

Answer: B

Explanation: Assessments evaluate compliance requirements associated with regulations, standards, or frameworks.

Question 8

Which compliance framework could be evaluated using Compliance Manager?

A. HIPAA

B. DHCP

C. SMTP

D. DNS

Answer: A

Explanation: Compliance Manager includes templates and assessments for frameworks such as HIPAA, GDPR, ISO 27001, and NIST.

Question 9

What is the purpose of improvement actions?

A. To reduce compliance risk and guide remediation efforts

B. To create Teams channels automatically

C. To increase internet bandwidth

D. To manage printer deployments

Answer: A

Explanation: Improvement actions provide guidance for implementing controls that reduce compliance risk and improve compliance posture.

Question 10

Which statement about Compliance Score is correct?

A. A perfect score guarantees regulatory compliance.

B. The score measures storage utilization.

C. The score reflects progress toward implementing compliance controls but does not guarantee compliance.

D. The score only applies to Microsoft-managed controls.

Answer: C

Explanation: Compliance Score is a risk-based measurement of implemented controls and progress, but it does not guarantee compliance with any specific regulation.

Exam Summary

Microsoft Purview Compliance Manager is a risk-based compliance management solution that helps organizations assess regulatory requirements, identify compliance gaps, implement recommended controls, collect audit evidence, and continuously improve compliance posture. Understanding Compliance Score, assessments, improvement actions, and risk reduction recommendations is essential for success on the AB-900 exam and for administering Microsoft 365 and Copilot environments responsibly.

Go to the AB-900 Exam Prep Hub main page