AB-900, Cybersecurity, Microsoft Certification, security June 27, 2026

Use the appropriate tools to review audit logs for user and admin activity (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Use the appropriate tools to review audit logs for user and admin activity

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Monitoring user and administrator actions is an essential part of Microsoft 365 security and governance. Organizations must be able to determine:

Who performed an action.
What action occurred.
When the activity occurred.
Which resource was affected.
Whether the activity was expected or suspicious.

Microsoft 365 provides several audit and logging tools that help administrators investigate security incidents, track administrative changes, support compliance requirements, and troubleshoot user issues.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the purpose of audit logs and know which tools are used to review user and administrator activity.

What Are Audit Logs?

Audit logs are records of activities performed within Microsoft 365 services.

They help organizations:

Detect suspicious behavior.
Investigate incidents.
Meet regulatory requirements.
Track administrative changes.
Support forensic investigations.
Verify user actions.

Audit logs provide visibility into activities occurring across Microsoft 365 environments.

Types of Activities Recorded

Microsoft 365 audit logs can capture actions such as:

User Activities

Signing in
Accessing files
Sharing documents
Creating Teams messages
Deleting files
Downloading content

Administrator Activities

Resetting passwords
Creating users
Assigning licenses
Modifying policies
Creating groups
Changing permissions

Service Activities

Mailbox operations
SharePoint changes
Teams events
Security configuration changes

Unified Audit Log

The primary audit tool in Microsoft 365 is the Unified Audit Log.

The Unified Audit Log collects events from multiple Microsoft 365 services, including:

Microsoft Entra ID
Exchange Online
SharePoint Online
OneDrive
Microsoft Teams
Microsoft Purview
Microsoft Defender
Power Platform services

Instead of reviewing separate logs for every service, administrators can search centrally.

Microsoft Purview Audit

The Unified Audit Log is accessed through Microsoft Purview.

Administrators can:

Search activities by user.
Search by date range.
Filter by workload.
Filter by activity type.
Export results.

This centralized approach simplifies investigations.

Common Search Filters

Administrators commonly filter audit logs by:

User

Example:

user1@contoso.com

Activity

Examples:

File deleted
Mailbox accessed
User added
Password reset

Date and Time

Investigations often focus on a specific period.

Workload

Examples:

SharePoint
Exchange
Teams
Entra ID

These filters narrow results and improve efficiency.

Microsoft Entra Sign-In Logs

Sign-in logs are separate from the Unified Audit Log and focus specifically on authentication activity.

Sign-in logs record:

Successful sign-ins
Failed sign-ins
IP addresses
Device information
Authentication methods used
Conditional Access results

Sign-in logs are commonly used to troubleshoot access issues and investigate suspicious login attempts.

Audit Logs vs Sign-In Logs

Students frequently confuse these two tools.

Sign-In Logs

Focus on:

Authentication attempts
MFA events
Conditional Access outcomes
Login locations

Audit Logs

Focus on:

User actions after authentication
Administrative changes
File access
Configuration modifications

Both are important, but they serve different purposes.

Examples of Audit Events

Exchange Online

Events may include:

Mailbox access
Email deletions
Mailbox permission changes

SharePoint Online

Events may include:

File creation
File downloads
File sharing

Microsoft Teams

Events may include:

Team creation
Channel creation
Membership changes

Microsoft Entra ID

Events may include:

User creation
Group modifications
Role assignments

Reviewing Administrator Activity

Audit logs help determine:

Which administrator made a change.
When the change occurred.
Which object was affected.

Examples include:

Password resets.
License assignments.
Group membership changes.
Conditional Access policy modifications.

This provides accountability and supports change tracking.

Reviewing User Activity

Audit logs can help answer questions such as:

Did a user delete a file?
Was a document downloaded?
Was information shared externally?
When did the action occur?

This information is valuable during investigations and compliance reviews.

Audit Logs and Microsoft 365 Copilot

Microsoft 365 Copilot relies on Microsoft 365 data sources.

Audit capabilities help organizations monitor:

User access to content.
Sharing activities.
Administrative changes affecting Copilot environments.
Compliance investigations involving AI-related workflows.

Copilot itself uses the same Microsoft 365 security and compliance framework.

Microsoft Defender XDR and Advanced Investigations

Microsoft Defender XDR can correlate events across:

Identities
Devices
Email
Applications

This provides a broader security perspective when investigating incidents.

While audit logs show individual events, Defender XDR helps connect related activities.

Retention of Audit Logs

Audit logs are retained for a specific period depending on:

Subscription level.
Licensing.
Service configuration.

Organizations with advanced compliance licensing may receive extended retention periods.

For AB-900, understand that retention periods can vary by license type.

Exporting Audit Results

Administrators can export audit results for:

Incident response.
Compliance reporting.
External investigations.
Long-term analysis.

Exported data can be reviewed using spreadsheets or SIEM solutions.

Best Practices

Review Logs Regularly

Continuous monitoring helps detect issues early.

Use Filters

Filtering speeds investigations.

Protect Administrator Accounts

Administrative actions should always be auditable.

Enable MFA

Secure accounts that have access to audit data.

Maintain Least Privilege

Limit who can access sensitive logs.

Retain Logs Appropriately

Ensure audit records meet organizational requirements.

Important Exam Tips

Remember these AB-900 concepts:

The Unified Audit Log is the primary Microsoft 365 audit tool.
Microsoft Purview provides access to audit searches.
Audit logs track actions performed after authentication.
Sign-in logs focus on authentication events.
Audit logs support investigations and compliance.
Administrator changes are recorded.
User activities can be searched and reviewed.
Microsoft 365 Copilot relies on the same audit and compliance framework.
Exporting logs supports reporting and analysis.
Retention periods vary by license.

Practice Exam Questions

Question 1

Which Microsoft 365 feature provides centralized auditing across multiple services?

A. Microsoft Planner
B. Windows Event Viewer
C. Unified Audit Log
D. Microsoft Lists

Correct Answer: C

Explanation: The Unified Audit Log aggregates events from multiple Microsoft 365 services into a single searchable location.

Question 2

Which portal is commonly used to access audit searches?

A. Exchange admin center
B. Teams admin center
C. Microsoft Purview
D. SharePoint admin center

Correct Answer: C

Explanation: Microsoft Purview provides access to auditing and compliance features, including audit searches.

Question 3

Which activity would typically appear in an audit log?

A. Administrator resets a user’s password.
B. Monitor brightness changes.
C. Printer toner replacement.
D. CPU temperature fluctuations.

Correct Answer: A

Explanation: Administrative actions such as password resets are recorded in audit logs.

Question 4

Which log type focuses primarily on authentication events?

A. Microsoft Entra sign-in logs
B. SharePoint recycle bin logs
C. Unified Audit Log
D. Exchange message trace logs

Correct Answer: A

Explanation: Sign-in logs capture authentication attempts, MFA information, and Conditional Access outcomes.

Question 5

Which Microsoft 365 service records file downloads and sharing activities?

A. SharePoint Online audit events
B. Windows Registry
C. BIOS settings
D. Active Directory Sites and Services

Correct Answer: A

Explanation: SharePoint audit events track document-related activities.

Question 6

An administrator wants to determine who changed a Conditional Access policy. Which tool should be used?

A. Windows Device Manager
B. Unified Audit Log
C. Outlook rules wizard
D. Microsoft Paint

Correct Answer: B

Explanation: Administrative changes are captured within Microsoft 365 audit records.

Question 7

What is a major difference between audit logs and sign-in logs?

A. Audit logs only store Exchange events.
B. Sign-in logs are used exclusively for Teams.
C. Audit logs track actions after authentication, while sign-in logs track authentication attempts.
D. Sign-in logs cannot be searched.

Correct Answer: C

Explanation: Sign-in logs focus on access attempts, while audit logs record actions performed after access is granted.

Question 8

Which filter can help narrow audit search results?

A. User name
B. Date range
C. Activity type
D. All of the above

Correct Answer: D

Explanation: Audit searches support multiple filters to improve investigation efficiency.

Question 9

Why are audit logs important for compliance investigations?

A. They increase internet bandwidth.
B. They provide records of user and administrator actions.
C. They automatically block attacks.
D. They create Conditional Access policies.

Correct Answer: B

Explanation: Audit records provide evidence of activities that occurred within Microsoft 365.

Question 10

Which statement about Microsoft 365 Copilot and auditing is correct?

A. Copilot bypasses audit logging.
B. Copilot disables Microsoft Purview.
C. Copilot uses a separate audit system unrelated to Microsoft 365.
D. Copilot operates within the existing Microsoft 365 compliance and auditing framework.

Correct Answer: D

Explanation: Microsoft 365 Copilot relies on the same security, compliance, and audit infrastructure used throughout Microsoft 365.

Go to the AB-900 Exam Prep Hub main page

AB-900, Cybersecurity, Microsoft Certification, security June 27, 2026

Interpret Identity Secure Score in Microsoft Entra ID (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Interpret Identity Secure Score in Microsoft Entra ID

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern organizations face increasing identity-related threats such as password attacks, credential theft, phishing, and unauthorized access attempts. To help organizations measure and improve their identity security posture, Microsoft provides Identity Secure Score within Microsoft Entra ID.

Identity Secure Score gives administrators a numerical representation of how well identity security best practices are being implemented. It also provides actionable recommendations that can strengthen security and reduce risk.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand:

What Identity Secure Score is.
Where it is located.
How scores are calculated.
What recommendations are provided.
How administrators can use the score to improve identity security.

What Is Identity Secure Score?

Identity Secure Score is a feature in Microsoft Entra ID that measures the effectiveness of an organization’s identity security controls.

It:

Evaluates current identity configurations.
Assigns points for implemented security controls.
Provides recommendations for improvements.
Helps organizations prioritize security actions.
Tracks progress over time.

Identity Secure Score focuses specifically on identity-related security rather than overall Microsoft 365 security.

Purpose of Identity Secure Score

The primary goals are to:

Reduce identity-based risks.
Encourage adoption of security best practices.
Provide visibility into security weaknesses.
Help administrators prioritize improvements.
Measure progress over time.

Identity Secure Score serves as both an assessment tool and a roadmap for improving identity security.

Where to Find Identity Secure Score

Identity Secure Score is available in the Microsoft Entra admin center.

Administrators can:

Open Microsoft Entra admin center.
Navigate to Protection.
Select Identity Secure Score.

The dashboard displays:

Current score
Maximum possible score
Percentage achieved
Improvement actions
Trends over time

How the Score Is Calculated

The score is based on the implementation of recommended identity security controls.

Examples include:

Enabling multifactor authentication (MFA)
Using Conditional Access policies
Eliminating legacy authentication
Protecting privileged accounts
Registering authentication methods
Using passwordless authentication

Each completed recommendation contributes points toward the overall score.

Example

Suppose an organization:

Enables MFA for administrators.
Disables legacy authentication.
Implements Conditional Access.

These completed actions increase the Identity Secure Score.

Understanding the Score

A higher score generally indicates stronger identity protection.

However:

Identity Secure Score is not a guarantee of security.
A lower score does not necessarily mean the organization is compromised.
The score should be viewed as guidance rather than a compliance requirement.

The goal is continuous improvement rather than achieving a perfect score.

Improvement Actions

Identity Secure Score provides recommendations called improvement actions.

Each action includes:

Description of the recommendation.
Security benefits.
Number of points available.
Current implementation status.
Links to documentation.

Administrators can prioritize actions with the greatest security impact.

Examples of Improvement Actions

Common recommendations include:

Enable MFA for Administrators

Protects highly privileged accounts from compromise.

Enable MFA for Users

Reduces risks associated with stolen passwords.

Require Authentication Method Registration

Ensures users can complete MFA challenges.

Block Legacy Authentication

Prevents older protocols that bypass modern security controls.

Use Conditional Access Policies

Provides risk-based access control.

Protect Privileged Roles

Adds additional protection to administrator accounts.

Score Categories

Recommendations are grouped into categories such as:

Identity Protection

Improves defenses against compromised identities.

Authentication

Strengthens user sign-in methods.

Privileged Access

Secures administrative accounts.

Access Control

Implements Conditional Access and related protections.

Device Security

Ensures devices meet required standards.

These categories help administrators focus on specific security areas.

Trending and Historical Views

Identity Secure Score tracks changes over time.

Administrators can:

Monitor improvements.
Measure progress after implementing controls.
Demonstrate security enhancements to leadership.
Identify periods when scores decreased.

Historical trends support long-term security planning.

Comparing with Similar Organizations

Microsoft may provide benchmark information showing how an organization’s score compares with similar tenants.

This allows organizations to:

Understand industry averages.
Identify areas needing attention.
Set realistic improvement goals.

These comparisons are informational and should not replace security requirements specific to the organization.

Relationship to Microsoft Secure Score

Students often confuse these two tools.

Identity Secure Score

Focuses specifically on:

Users
Authentication
Identity protection
Conditional Access
Privileged access

Microsoft Secure Score

Measures security across Microsoft 365 services, including:

Identity
Devices
Applications
Data
Email
Collaboration services

Identity Secure Score is therefore a subset of overall security improvement efforts.

Identity Secure Score and Microsoft 365 Copilot

Microsoft 365 Copilot relies on Microsoft Entra identities for access.

Weak identity controls can increase the risk of:

Unauthorized access to Copilot.
Exposure of sensitive organizational data.
Compromised accounts using AI tools improperly.

Improving Identity Secure Score indirectly strengthens the security posture of Microsoft 365 Copilot environments.

Best Practices

Enable Multifactor Authentication

MFA is one of the most valuable security controls.

Protect Administrator Accounts

Privileged users should have additional safeguards.

Eliminate Legacy Authentication

Older protocols often bypass modern protections.

Use Conditional Access

Apply adaptive access policies based on risk.

Review Recommendations Regularly

Identity threats evolve continuously.

Focus on High-Impact Actions First

Not all recommendations provide equal security value.

Important Exam Tips

For AB-900, remember:

Identity Secure Score is found in Microsoft Entra ID.
It measures identity security posture.
Scores increase when recommended controls are implemented.
Improvement actions provide guidance and point values.
Identity Secure Score is different from Microsoft Secure Score.
MFA and Conditional Access commonly improve the score.
The score helps prioritize security improvements.
Historical trends show progress over time.
A perfect score is not required.
Microsoft 365 Copilot security depends on strong identities.

Practice Exam Questions

Question 1

What is the primary purpose of Identity Secure Score?

A. Measure and improve identity security posture
B. Track SharePoint storage usage
C. Monitor Exchange mailbox size
D. Manage Teams channels

Correct Answer: A

Explanation: Identity Secure Score evaluates identity security controls and provides recommendations for improvement.

Question 2

Where can administrators access Identity Secure Score?

A. Teams admin center
B. Exchange admin center
C. Microsoft Entra admin center
D. SharePoint admin center

Correct Answer: C

Explanation: Identity Secure Score is located within the Microsoft Entra admin center under Protection.

Question 3

Which action would typically increase Identity Secure Score?

A. Deleting Teams channels
B. Enabling multifactor authentication
C. Creating additional mailboxes
D. Increasing OneDrive storage

Correct Answer: B

Explanation: MFA is a recommended identity security control and contributes points to the score.

Question 4

What does a higher Identity Secure Score generally indicate?

A. Increased mailbox capacity
B. Stronger identity security posture
C. More SharePoint sites
D. Better Teams performance

Correct Answer: B

Explanation: Higher scores reflect the implementation of more recommended identity protections.

Question 5

Which information is provided with an improvement action?

A. Available point value and security benefit
B. Teams meeting recordings
C. Exchange message traces
D. OneDrive storage quotas

Correct Answer: A

Explanation: Improvement actions include descriptions, benefits, and associated points.

Question 6

Which recommendation commonly appears in Identity Secure Score?

A. Increase mailbox size limits
B. Add Teams emojis
C. Disable legacy authentication
D. Create more SharePoint libraries

Correct Answer: C

Explanation: Legacy authentication is a common attack vector, and disabling it improves security.

Question 7

What is one benefit of historical trend information?

A. It increases license counts automatically.
B. It allows organizations to track security improvements over time.
C. It creates Conditional Access policies automatically.
D. It backs up SharePoint sites.

Correct Answer: B

Explanation: Historical trends help administrators measure progress and evaluate changes.

Question 8

How does Identity Secure Score differ from Microsoft Secure Score?

A. Identity Secure Score measures device storage.
B. Microsoft Secure Score only evaluates Exchange Online.
C. Identity Secure Score focuses specifically on identity security controls.
D. Microsoft Secure Score only applies to Copilot.

Correct Answer: C

Explanation: Identity Secure Score concentrates on authentication and identity protection, while Microsoft Secure Score covers broader Microsoft 365 security.

Question 9

Which statement about a perfect Identity Secure Score is correct?

A. It guarantees the organization cannot be compromised.
B. It is legally required for Microsoft 365 tenants.
C. It automatically enables all security features.
D. It is not required; continuous improvement is the goal.

Correct Answer: D

Explanation: Secure Score is intended as guidance and a tool for ongoing security enhancement.

Question 10

Why is Identity Secure Score important for Microsoft 365 Copilot?

A. Copilot stores Secure Score values inside Word documents.
B. Copilot uses Microsoft Entra identities for access to organizational data.
C. Copilot disables Conditional Access policies.
D. Copilot replaces Microsoft Entra authentication.

Correct Answer: B

Explanation: Strong identity controls help protect Copilot and the data it can access.

Go to the AB-900 Exam Prep Hub main page

AB-900, Cybersecurity, Microsoft Certification, security June 27, 2026

Identify the appropriate tools to troubleshoot common sign-in issues (multifactor authentication [MFA], conditional access, and risky sign-ins) (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
–> Identify the core security features of Microsoft 365 services
–> Identify the appropriate tools to troubleshoot common sign-in issues (multifactor authentication [MFA], conditional access, and risky sign-ins)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub’s main page below the exam topics section.

Introduction

Identity security is one of the foundations of Microsoft 365. Users depend on secure and reliable access to services such as Outlook, Teams, SharePoint, OneDrive, and Microsoft 365 Copilot. When users cannot sign in, administrators must determine the cause and resolve the issue quickly.

Microsoft provides several tools within Microsoft Entra, Microsoft 365, and Microsoft Defender to diagnose and troubleshoot sign-in problems related to:

Multi-Factor Authentication (MFA)
Conditional Access policies
Risky sign-ins
Identity Protection alerts
Account lockouts
Authentication failures

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand which tools are used to investigate and resolve these common issues.

Common Causes of Sign-In Problems

Users may experience sign-in failures because of:

Incorrect passwords
Expired credentials
Multi-Factor Authentication failures
Conditional Access policies
Blocked locations
Device compliance requirements
Risky sign-ins detected by Microsoft Entra
Account lockouts
Disabled user accounts

Troubleshooting begins by identifying which security control is preventing access.

Microsoft Entra Admin Center

The Microsoft Entra admin center is the primary location for troubleshooting identity-related problems.

Administrators can:

View users and groups.
Reset passwords.
Review authentication methods.
Investigate sign-in activity.
Examine Conditional Access policies.
Review risky users and risky sign-ins.

Many sign-in investigations begin here.

Sign-In Logs

One of the most important troubleshooting tools is the Sign-In Logs page in Microsoft Entra.

Sign-in logs provide information such as:

User account involved
Time of sign-in attempt
Success or failure status
IP address
Location
Device information
Authentication method used
Applications being accessed
Conditional Access results

Example

A user reports they cannot access Teams.

The sign-in log may show:

Failure reason: Conditional Access policy requires a compliant device.

This immediately points administrators toward the root cause.

Authentication Methods

Administrators can review a user’s configured authentication methods.

Examples include:

Microsoft Authenticator app
SMS verification
Phone calls
FIDO2 security keys
Passkeys

Problems may occur if:

A user changes phones.
The Authenticator app is deleted.
Authentication methods are not registered.

Administrators can help users re-register their methods if necessary.

Troubleshooting Multi-Factor Authentication (MFA)

MFA issues commonly involve:

Missing Registration

The user never enrolled in MFA.

Lost Device

The user replaced or lost their phone.

Notification Problems

Push notifications are not being received.

Incorrect Verification Method

The user is attempting to use an outdated authentication method.

Blocked Authentication

Security policies may prevent certain authentication methods.

Authentication Methods Policy

Administrators can review authentication method policies to verify:

Which methods are allowed.
Which users are targeted.
Whether a method has been disabled.

If SMS authentication has been disabled, users relying on text messages may be unable to complete MFA.

Conditional Access Troubleshooting

Conditional Access policies are a common source of access problems.

Examples include:

Requiring MFA
Blocking certain countries
Requiring compliant devices
Restricting specific applications

A user may have valid credentials but still be denied access because a policy condition is not satisfied.

Conditional Access Insights

The Conditional Access tab in sign-in logs helps administrators understand:

Which policies were evaluated.
Which policies applied.
Why access was granted or denied.

Example

The log may indicate:

Access blocked because device is not compliant.

This allows administrators to identify the exact policy causing the issue.

What-If Tool

The Conditional Access What-If tool allows administrators to simulate access scenarios.

Administrators can test:

User identity
Device platform
Location
Application

The tool predicts which policies would apply without affecting production users.

This is extremely helpful when diagnosing policy conflicts.

Risky Sign-Ins

Microsoft Entra Identity Protection analyzes sign-in behavior and detects suspicious activity.

Examples include:

Impossible travel
Anonymous IP addresses
Malware-linked addresses
Unfamiliar locations

A sign-in may be blocked even when the password is correct.

Risky Users

A user may be flagged as risky because:

Credentials were leaked.
Suspicious activity was detected.
Malware activity was associated with the account.

Risk levels include:

Low
Medium
High

Administrators can review and remediate risky users.

Identity Protection Dashboard

The Identity Protection dashboard helps administrators investigate:

Risky users
Risky sign-ins
Risk detections

Administrators can:

Confirm compromise.
Dismiss false positives.
Require password resets.
Restore access.

Password Reset Tools

Users who forget passwords can use:

Self-Service Password Reset (SSPR)

Allows users to reset passwords without contacting IT.

Benefits include:

Faster recovery
Reduced help desk workload
Improved productivity

Administrators can also manually reset passwords when necessary.

Account Status

Administrators should verify whether:

The account is enabled.
The user license is assigned.
The account has been deleted.
Sign-in is blocked.

Sometimes the simplest explanation is the correct one.

Device Compliance Issues

Conditional Access often integrates with Microsoft Intune.

Users may be blocked because:

Device encryption is disabled.
Operating systems are outdated.
Antivirus requirements are unmet.
Devices are unmanaged.

Administrators can review compliance status in Intune.

Common Troubleshooting Workflow

Step 1: Verify User Account

Is the account active?
Is the correct license assigned?

Step 2: Review Sign-In Logs

Determine why authentication failed.

Step 3: Check MFA

Verify authentication methods.

Step 4: Review Conditional Access

Identify policies that blocked access.

Step 5: Review Risk Detections

Investigate risky users or risky sign-ins.

Step 6: Remediate

Reset password.
Re-register MFA.
Update device compliance.
Modify policy if appropriate.

Microsoft 365 Copilot Sign-In Issues

Microsoft 365 Copilot uses the same identity infrastructure as Microsoft 365.

Therefore, problems involving:

MFA
Conditional Access
User permissions
Risky sign-ins

can also affect access to Copilot.

Copilot does not bypass Microsoft Entra security controls.

Best Practices

Enable Self-Service Password Reset

Reduce support calls and improve user productivity.

Require MFA

Protect accounts from password theft.

Review Sign-In Logs First

They often reveal the root cause quickly.

Test Policies Before Deployment

Use the What-If tool to avoid accidental lockouts.

Monitor Risk Detections

Respond quickly to compromised accounts.

Apply Least Privilege

Avoid overly broad permissions and exceptions.

Exam Tips

Remember these AB-900 concepts:

The Microsoft Entra admin center is the primary identity troubleshooting portal.
Sign-in logs provide detailed authentication information.
MFA problems often involve authentication methods.
Conditional Access policies can block otherwise valid sign-ins.
The What-If tool simulates policy results.
Risky sign-ins are detected by Identity Protection.
Risky users may require password resets.
Self-Service Password Reset helps users recover accounts.
Device compliance can affect access.
Microsoft 365 Copilot relies on the same identity controls as Microsoft 365.

Practice Exam Questions

Question 1

A user reports they cannot access Microsoft Teams even though their password is correct. Which tool should an administrator review first?

A. Microsoft Planner
B. SharePoint recycle bin
C. Exchange message trace
D. Sign-in logs in Microsoft Entra

Correct Answer: D

Explanation: Sign-in logs provide details about authentication attempts and often reveal the reason access failed.

Question 2

Which Microsoft portal is the primary location for investigating identity-related sign-in problems?

A. SharePoint admin center
B. Microsoft Entra admin center
C. Teams admin center
D. Exchange admin center

Correct Answer: B

Explanation: Microsoft Entra provides identity management and troubleshooting capabilities.

Question 3

A user receives an MFA prompt but no longer has their old phone. Which area should an administrator review?

A. Distribution groups
B. Shared mailboxes
C. Authentication methods
D. Mail flow rules

Correct Answer: C

Explanation: Authentication methods determine which MFA options are available to users.

Question 4

Which feature allows administrators to simulate how Conditional Access policies would affect a user?

A. Risk detections dashboard
B. Sign-in diagnostics
C. Password reset portal
D. Conditional Access What-If tool

Correct Answer: D

Explanation: The What-If tool predicts policy outcomes without affecting users.

Question 5

Which Microsoft capability identifies suspicious activities such as impossible travel?

A. Exchange Online Protection
B. Microsoft Lists
C. Identity Protection
D. SharePoint Syntex

Correct Answer: C

Explanation: Identity Protection analyzes sign-in behavior and detects potential compromises.

Question 6

A sign-in log shows that access was denied because the device is not compliant. Which Microsoft service commonly provides compliance information?

A. Microsoft Intune
B. Outlook
C. Planner
D. Word

Correct Answer: A

Explanation: Intune manages devices and reports compliance status used by Conditional Access.

Question 7

Which feature allows users to reset their own passwords without contacting IT?

A. Password Protection
B. Self-Service Password Reset (SSPR)
C. Secure Score
D. Message Encryption

Correct Answer: B

Explanation: SSPR enables users to recover access independently.

Question 8

Which information can administrators view in sign-in logs?

A. Printer serial numbers
B. Monitor resolutions
C. CPU temperatures
D. Authentication success or failure details

Correct Answer: D

Explanation: Sign-in logs contain information about sign-in attempts and their outcomes.

Question 9

Which type of event may cause Microsoft Entra to classify a sign-in as risky?

A. Impossible travel between locations
B. A full mailbox
C. Duplicate Teams channels
D. Deleted SharePoint folders

Correct Answer: A

Explanation: Impossible travel is one of the risk signals analyzed by Identity Protection.

Question 10

How are Microsoft 365 Copilot sign-in problems typically investigated?

A. Copilot uses a separate identity system.
B. Copilot bypasses Conditional Access.
C. Copilot relies on the same Microsoft Entra identity controls as Microsoft 365.
D. Copilot does not use MFA.

Correct Answer: C

Explanation: Copilot uses the same authentication and security infrastructure as other Microsoft 365 services.

Go to the AB-900 Exam Prep Hub main page

AB-900, Cybersecurity, Microsoft Certification, security June 27, 2026

Identify the appropriate security object to use in an organization (users and groups) (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Identify the appropriate security object to use in an organization (users and groups)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Microsoft 365 uses identities and group memberships to control access to resources, applications, and data. Two of the most important security objects in Microsoft Entra ID and Microsoft 365 are users and groups.

Understanding when to use users and groups is fundamental to administering Microsoft 365 and securing resources. Rather than assigning permissions individually to every person, administrators can use groups to simplify access management and improve security.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the purpose of users and groups, their differences, and common scenarios for using each object.

Understanding Security Objects

A security object represents an identity or a collection of identities that can receive permissions and access rights.

Common Microsoft 365 security objects include:

Users
Groups
Service principals
Devices

For the AB-900 exam, the focus is primarily on users and groups.

Users

A user represents an individual identity that can authenticate and access Microsoft 365 resources.

Examples include:

Employees
Contractors
Students
Administrators

Each user account contains information such as:

Username (User Principal Name)
Display name
Email address
Assigned licenses
Group memberships
Authentication settings

Types of User Accounts

Member Users

Member users belong to the organization’s Microsoft Entra tenant.

Examples:

Employees
IT administrators
Internal staff

Member users typically receive:

Microsoft 365 licenses
Mailboxes
Teams access
SharePoint permissions

Guest Users

Guest users are external users invited into the organization through Microsoft Entra B2B collaboration.

Examples:

Vendors
Consultants
Business partners

Guest users:

Use their own credentials.
Access only resources that have been shared with them.
Typically do not require full Microsoft 365 licenses.

Why User Accounts Are Important

User accounts provide:

Authentication

Verifying identity during sign-in.

Authorization

Determining what resources users can access.

Auditing

Tracking activities performed by specific individuals.

Personalization

Providing personalized experiences across Microsoft 365.

Groups

A group is a collection of users that simplifies management.

Instead of assigning permissions individually to many users, administrators assign permissions to the group and then add users to that group.

Benefits include:

Easier administration
Consistent permissions
Reduced errors
Faster onboarding and offboarding

Why Groups Improve Security

Suppose 100 employees need access to a SharePoint site.

Without groups:

Permissions must be assigned to 100 individual users.

With groups:

Create a group.
Assign permissions once.
Add users to the group.

This approach is:

Easier to manage.
More scalable.
Less likely to produce permission mistakes.

Types of Groups in Microsoft 365

Security Groups

Security groups are used primarily for assigning permissions.

Common uses:

SharePoint access
Conditional Access targeting
Application permissions
Device management

Example:

Finance Security Group

Members automatically inherit permissions assigned to the group.

Microsoft 365 Groups

Microsoft 365 groups provide collaboration capabilities in addition to membership management.

They can automatically provide:

Shared mailbox
Shared calendar
Teams workspace
SharePoint site
Planner resources

Example:

Marketing Team

Distribution Groups

Distribution groups are used mainly for email communication.

Purpose:

Send one email to multiple recipients.

Examples:

All Employees
Human Resources
Sales Department

Distribution groups do not provide collaboration resources like Teams or SharePoint sites.

Mail-Enabled Security Groups

These groups combine:

Security permissions
Email distribution capabilities

They are useful when a group needs both access permissions and email functionality.

Users vs Groups

Users	Groups
Represent individuals	Represent collections of users
Authenticate directly	Do not sign in
Receive licenses	Usually do not receive licenses
Have personal settings	Share common permissions
Used for identity	Used for access management

When to Use Individual Users

Use user objects when:

Assigning licenses.
Managing authentication methods.
Configuring MFA.
Reviewing sign-in logs.
Managing personal mailboxes.

Examples:

Assigning a Microsoft 365 Copilot license.
Resetting a password.
Enabling MFA.

When to Use Groups

Use groups when:

Granting access to resources.
Assigning SharePoint permissions.
Managing Teams membership.
Applying Conditional Access policies.
Organizing departments.

Examples:

Finance team access to a SharePoint site.
Sales department access to Teams channels.
Applying a security policy to all administrators.

Group-Based Management

Microsoft Entra supports group-based administration.

Advantages include:

Simplified Administration

One change affects many users.

Reduced Errors

Permissions are applied consistently.

Faster Employee Onboarding

Adding a new employee to the correct groups automatically provides needed access.

Easier Offboarding

Removing users from groups quickly revokes access.

Dynamic Groups

Dynamic groups automatically add or remove users based on attributes.

Examples:

Department = Sales
Country = United States
Job title = Manager

Benefits:

Automation
Reduced administrative effort
Consistent membership

Groups and Conditional Access

Conditional Access policies often target:

Users
Groups

Example:

Require MFA for all members of the IT Administrators group.

This is more efficient than configuring each administrator individually.

Groups and Microsoft 365 Copilot

Groups help manage access to resources used by Microsoft 365 Copilot.

Examples:

Teams membership
SharePoint permissions
Collaboration resources
Departmental content access

Because Copilot respects existing permissions, group memberships indirectly influence what content users can access through Copilot.

Best Practices

Assign Permissions to Groups Instead of Individuals

This improves scalability and consistency.

Use Security Groups for Access Management

Avoid assigning permissions directly to users whenever possible.

Use Microsoft 365 Groups for Collaboration

These groups support Teams, SharePoint, and Outlook integration.

Follow Least Privilege

Provide only the permissions users require.

Review Group Membership Regularly

Remove unnecessary access and outdated memberships.

Exam Tips

Remember these AB-900 concepts:

Users represent individual identities.
Groups represent collections of users.
Users authenticate; groups do not.
Security groups manage permissions.
Microsoft 365 groups support collaboration resources.
Distribution groups are primarily used for email.
Group-based management simplifies administration.
Dynamic groups automate membership.
Conditional Access policies can target groups.
Microsoft 365 Copilot respects permissions inherited through groups.

Practice Exam Questions

Question 1

Which security object represents an individual identity in Microsoft 365?

A. Distribution group
B. Microsoft 365 group
C. User account
D. Shared mailbox

Correct Answer: C

Explanation: A user account represents an individual who can authenticate and access Microsoft 365 resources.

Question 2

What is the primary advantage of using groups instead of assigning permissions individually?

A. Groups eliminate authentication requirements.
B. Groups simplify administration and provide consistent access.
C. Groups automatically assign licenses.
D. Groups replace Microsoft Entra ID.

Correct Answer: B

Explanation: Groups allow administrators to manage permissions for multiple users at once.

Question 3

Which type of group is primarily used for email distribution?

A. Security group
B. Microsoft 365 group
C. Dynamic group
D. Distribution group

Correct Answer: D

Explanation: Distribution groups are designed mainly for sending email messages to multiple recipients.

Question 4

Which object can sign in to Microsoft 365?

A. User account
B. Security group
C. Distribution group
D. Microsoft 365 group

Correct Answer: A

Explanation: Users authenticate directly, while groups are collections of users and cannot sign in.

Question 5

Which group type automatically provides collaboration resources such as a shared mailbox and SharePoint site?

A. Security group
B. Distribution group
C. Mail-enabled security group
D. Microsoft 365 group

Correct Answer: D

Explanation: Microsoft 365 groups provide collaboration services including Teams and SharePoint.

Question 6

A company wants to grant SharePoint access to an entire department. Which approach is recommended?

A. Assign permissions to each employee individually.
B. Create a security group and assign permissions to the group.
C. Create separate user accounts for each site.
D. Use a distribution group only.

Correct Answer: B

Explanation: Security groups simplify access management and reduce administrative effort.

Question 7

What is a dynamic group?

A. A group used only for Teams meetings.
B. A group with manually maintained memberships.
C. A group that sends email externally.
D. A group whose membership is automatically managed based on user attributes.

Correct Answer: D

Explanation: Dynamic groups automatically update membership according to configured rules.

Question 8

Which object is typically assigned Microsoft 365 licenses?

A. Security groups
B. Distribution groups
C. User accounts
D. Shared calendars

Correct Answer: C

Explanation: Licenses are generally assigned to individual users.

Question 9

Which statement about guest users is correct?

A. Guest users must always have Microsoft 365 licenses.
B. Guest users are external users invited to collaborate with the organization.
C. Guest users replace security groups.
D. Guest users cannot access SharePoint resources.

Correct Answer: B

Explanation: Guest users are external identities that can be granted access to shared resources.

Question 10

How do groups influence Microsoft 365 Copilot?

A. Groups allow Copilot to bypass permissions.
B. Groups disable Conditional Access.
C. Groups determine resource permissions that Copilot respects.
D. Groups automatically generate Copilot prompts.

Correct Answer: C

Explanation: Copilot uses existing Microsoft 365 permissions, many of which are granted through group memberships.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification June 27, 2026

Understand the purpose and benefits of Single Sign-On (SSO) (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Understand the purpose and benefits of SSO

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern organizations use many applications and services, including Microsoft 365, Teams, SharePoint, Exchange Online, and third-party cloud applications. Without a centralized authentication system, users would need to maintain separate usernames and passwords for every application they use.

Single Sign-On (SSO) simplifies the user experience and improves security by allowing users to authenticate once and then access multiple applications without repeatedly signing in.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding the purpose and benefits of SSO is an important identity and security concept.

What Is Single Sign-On (SSO)?

Single Sign-On (SSO) is an authentication capability that allows users to sign in one time and gain access to multiple applications and services without entering credentials again for each application.

Instead of managing separate accounts for every service, users rely on a single identity managed through Microsoft Entra ID.

Example

A user signs in once and can then access:

Outlook
Microsoft Teams
SharePoint Online
OneDrive
Microsoft 365 Copilot
Third-party applications integrated with Microsoft Entra

SSO improves both convenience and security.

Why SSO Is Important

Without SSO, users often:

Maintain many passwords.
Reuse passwords across applications.
Forget credentials.
Require frequent password resets.

SSO addresses these challenges by providing a centralized authentication experience.

How Single Sign-On Works

The SSO process generally follows these steps:

Step 1: User Signs In

The user authenticates with Microsoft Entra ID.

Step 2: Identity Is Verified

Microsoft Entra confirms the user’s identity.

Step 3: Authentication Token Is Issued

A secure token is generated.

Step 4: Applications Trust the Token

Integrated applications accept the token and grant access without requiring another sign-in.

This process allows users to move seamlessly between applications.

SSO and Microsoft Entra ID

Microsoft Entra ID serves as the identity provider for Microsoft 365.

It provides:

Authentication
Authorization
Identity management
Access policies

Because Microsoft 365 services trust Microsoft Entra ID, users can access multiple services after a single sign-in.

Applications That Support SSO

SSO can be used with:

Microsoft 365 Applications

Examples:

Outlook
Teams
SharePoint Online
OneDrive
Word
Excel
PowerPoint

Third-Party Applications

Examples:

Salesforce
ServiceNow
Workday
Thousands of SaaS applications

Custom Applications

Organizations can integrate internally developed applications with Microsoft Entra.

Benefits of Single Sign-On

Improved User Experience

Users sign in once instead of repeatedly entering passwords.

Benefits include:

Less frustration.
Faster access to applications.
Improved productivity.

Reduced Password Fatigue

Managing many passwords can be difficult.

SSO reduces:

Forgotten passwords.
Password reuse.
User frustration.

Fewer Help Desk Requests

Password resets are one of the most common support issues.

SSO reduces:

Password-related tickets.
Administrative overhead.
Support costs.

Increased Productivity

Employees spend less time signing in and more time working.

Users can move easily between:

Teams
Outlook
SharePoint
Copilot

without repeated authentication prompts.

Improved Security

Although SSO simplifies access, security can actually improve because organizations can enforce:

Multi-Factor Authentication (MFA)
Conditional Access
Identity Protection
Centralized authentication policies

Centralized Access Management

Administrators can manage identities from one location instead of configuring authentication separately for every application.

Benefits include:

Easier administration.
Consistent security controls.
Faster onboarding and offboarding.

SSO and Multi-Factor Authentication

SSO does not replace MFA.

Instead, they work together.

Example:

User signs in once.
User completes MFA.
Access is granted to multiple applications.

This provides:

Convenience
Strong security

SSO and Conditional Access

Conditional Access policies can still apply even when SSO is used.

Examples:

Require MFA outside the corporate network.
Block risky sign-ins.
Require compliant devices.

SSO and Conditional Access complement each other.

SSO and Zero Trust

Single Sign-On supports Zero Trust when combined with modern security controls.

Verify Explicitly

Authentication still occurs before access is granted.

Use Least Privileged Access

Permissions are still enforced.

Assume Breach

Additional controls such as MFA and Conditional Access continue to evaluate risk.

SSO Does Not Mean Unlimited Access

A common misconception is that SSO gives users access to everything.

This is incorrect.

SSO:

Simplifies authentication.

Authorization still determines:

Which applications users can access.
What permissions they have.
Which resources they can view.

Users only receive access to resources they are authorized to use.

SSO and Microsoft 365 Copilot

Microsoft 365 Copilot relies on Microsoft Entra identities and benefits from SSO.

After users authenticate, they can move between:

Outlook
Teams
SharePoint
Word
Copilot experiences

without repeatedly entering credentials.

Copilot still respects existing permissions and security controls.

SSO vs Multiple Sign-Ins

Without SSO	With SSO
Multiple passwords	One identity
Repeated sign-ins	Single sign-in
Higher password fatigue	Better user experience
More password reset requests	Fewer support calls
Greater password reuse risk	Improved security

Best Practices

Enable Multi-Factor Authentication

SSO should be combined with MFA for stronger security.

Use Conditional Access

Evaluate sign-in risk and device compliance.

Follow Least Privilege

Users should only access necessary resources.

Centralize Identity Management

Use Microsoft Entra ID to manage users and applications.

Educate Users

Help users understand the difference between authentication and authorization.

Exam Tips

Remember these AB-900 concepts:

SSO stands for Single Sign-On.
SSO allows one sign-in to access multiple applications.
Microsoft Entra ID provides SSO for Microsoft 365.
SSO improves productivity and user experience.
SSO reduces password fatigue and help desk requests.
SSO does not replace authorization.
MFA and Conditional Access continue to function with SSO.
SSO supports Zero Trust when combined with additional security controls.
Microsoft 365 Copilot benefits from SSO.
Users only access resources they are authorized to use.

Practice Exam Questions

Question 1

What is the primary purpose of Single Sign-On (SSO)?

A. Encrypt documents automatically
B. Allow one authentication event to provide access to multiple applications
C. Replace authorization controls
D. Eliminate passwords completely

Correct Answer: B

Explanation: SSO enables users to authenticate once and access multiple applications without repeatedly entering credentials.

Question 2

Which Microsoft service provides Single Sign-On capabilities for Microsoft 365?

A. Microsoft Entra ID
B. Exchange Online
C. Microsoft Defender XDR
D. Microsoft Purview

Correct Answer: A

Explanation: Microsoft Entra ID acts as the identity provider for Microsoft 365 applications.

Question 3

Which problem does SSO help reduce?

A. SharePoint storage limitations
B. Teams meeting duration limits
C. Password fatigue
D. Mailbox quotas

Correct Answer: C

Explanation: Users no longer need to remember numerous passwords for different applications.

Question 4

What typically decreases when organizations implement SSO?

A. File version history
B. Help desk password reset requests
C. Device compliance policies
D. Multi-Factor Authentication

Correct Answer: B

Explanation: Fewer passwords usually lead to fewer password-related support requests.

Question 5

Which security control commonly works together with SSO?

A. Multi-Factor Authentication
B. Shared mailboxes
C. Distribution lists
D. Public folders

Correct Answer: A

Explanation: MFA strengthens security while maintaining the convenience of SSO.

Question 6

Does SSO automatically grant users access to every application?

A. Yes, if they know their password.
B. Yes, after one successful sign-in.
C. No, authorization and permissions still determine access.
D. No, unless Teams is installed.

Correct Answer: C

Explanation: SSO simplifies authentication but does not bypass authorization.

Question 7

Which statement best describes the relationship between SSO and Conditional Access?

A. SSO disables Conditional Access.
B. Conditional Access only works without SSO.
C. SSO replaces Conditional Access.
D. SSO and Conditional Access work together to secure access.

Correct Answer: D

Explanation: Conditional Access policies continue to evaluate users and devices even when SSO is used.

Question 8

Which benefit of SSO improves employee productivity?

A. Automatic mailbox backups
B. Elimination of file permissions
C. Reduced repeated sign-ins
D. Increased SharePoint storage

Correct Answer: C

Explanation: Users spend less time authenticating and more time working.

Question 9

Which Microsoft 365 services can benefit from SSO?

A. Outlook only
B. Teams only
C. SharePoint only
D. Outlook, Teams, SharePoint, and other Microsoft 365 applications

Correct Answer: D

Explanation: SSO supports access across multiple Microsoft 365 services.

Question 10

How does Microsoft 365 Copilot use Single Sign-On?

A. Copilot bypasses Microsoft Entra authentication.
B. Copilot requires separate credentials from Microsoft 365.
C. Copilot benefits from the same sign-in experience used by Microsoft 365 services.
D. Copilot disables Multi-Factor Authentication.

Correct Answer: C

Explanation: Copilot relies on Microsoft Entra identities and participates in the same SSO experience as other Microsoft 365 applications.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification June 27, 2026

Understand conditional access policies (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Understand conditional access policies

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern organizations must secure access to Microsoft 365 resources while still allowing users to work from anywhere and on many different devices. Traditional security models that rely only on usernames and passwords are no longer sufficient.

Conditional Access is one of the most important security features in Microsoft Entra. It helps organizations make intelligent access decisions based on various conditions and risk signals.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand what Conditional Access is, how policies work, and the common controls used to protect Microsoft 365 resources.

What Is Conditional Access?

Conditional Access is a feature of Microsoft Entra ID that evaluates signals and applies access controls before allowing users to access resources.

It is often described as:

“If this condition exists, then perform this action.”

Examples:

If a user signs in from outside the company network, require Multi-Factor Authentication.
If a device is not compliant, block access.
If a sign-in is considered high risk, deny access.

Conditional Access supports Microsoft’s Zero Trust security strategy.

Why Conditional Access Is Important

Conditional Access helps organizations:

Strengthen identity security.
Reduce unauthorized access.
Protect sensitive information.
Enable secure remote work.
Support compliance requirements.
Apply adaptive security controls.

Instead of trusting every sign-in automatically, Conditional Access evaluates each access request individually.

How Conditional Access Works

A Conditional Access policy generally contains three components:

1. Assignments (Who and What?)

Defines:

Users or groups
Applications
Conditions

2. Conditions (When?)

Conditions determine when the policy applies.

Examples:

Location
Device platform
Sign-in risk
User risk
Client applications

3. Access Controls (What Happens?)

Controls determine the action taken.

Examples:

Require MFA
Require a compliant device
Require password change
Block access

Common Components of a Conditional Access Policy

Users and Groups

Policies can target:

All users
Specific users
Security groups
Administrative accounts

Organizations often apply stricter policies to privileged users.

Cloud Apps and Resources

Policies can protect:

Microsoft 365 applications
Teams
Exchange Online
SharePoint Online
Custom applications

Different applications can have different requirements.

Conditions Used by Conditional Access

Location

Policies can evaluate where users are signing in from.

Examples:

Trusted corporate locations
External networks
Specific countries or regions

Example:

			
If sign-in occurs outside the corporate network,
require MFA.

Device Platform

Policies can apply to:

Windows
macOS
iOS
Android

Organizations may choose to treat platforms differently.

Device State

Conditional Access can determine whether devices are:

Compliant
Hybrid joined
Managed

Organizations can block unmanaged devices.

Sign-In Risk

Microsoft evaluates sign-ins for suspicious activity.

Examples:

Impossible travel
Unusual locations
Anonymous IP addresses

Higher-risk sign-ins may trigger additional controls.

User Risk

User risk reflects the likelihood that a user’s account has been compromised.

Examples:

Leaked credentials
Suspicious behavior

Organizations can require password changes or block access for risky users.

Access Controls

After evaluating conditions, Conditional Access applies controls.

Require Multi-Factor Authentication

One of the most common controls.

Example:

Require MFA for all administrator accounts.

Benefits:

Stronger identity protection.
Reduced credential theft.

Require Device Compliance

Users must use devices that meet organizational standards.

Examples:

Encryption enabled
Antivirus installed
Latest updates applied

This often integrates with Microsoft Intune.

Require Hybrid Microsoft Entra Joined Devices

Ensures access is granted only to approved organizational devices.

Require Password Change

Used when a user account is considered compromised.

Block Access

The most restrictive control.

Examples:

Block high-risk users.
Block unsupported devices.
Block access from certain locations.

Named Locations

Named locations allow administrators to define trusted locations.

Examples:

Corporate offices
Specific IP address ranges

Trusted locations can reduce unnecessary MFA prompts while maintaining security.

Conditional Access and Multi-Factor Authentication

Conditional Access frequently works together with MFA.

Examples:

Scenario 1

User signs in from home.

Result:

Require MFA.

Scenario 2

User signs in from a trusted office.

Result:

Allow access without additional prompts.

This creates a balance between security and user convenience.

Conditional Access and Device Compliance

Organizations often require devices to be:

Managed by Intune.
Encrypted.
Updated.
Secure.

If devices fail compliance requirements, access may be denied.

Conditional Access and Zero Trust

Conditional Access directly supports all three Zero Trust principles.

Verify Explicitly

Evaluate identity, device, location, and risk.

Use Least Privileged Access

Restrict access when necessary.

Assume Breach

Continuously evaluate security signals.

Conditional Access and Microsoft 365 Copilot

Microsoft 365 Copilot uses the same identity and access controls that protect Microsoft 365.

Conditional Access policies can affect access to:

Microsoft Teams
SharePoint Online
Exchange Online
OneDrive
Copilot experiences

Copilot does not bypass Conditional Access requirements.

Best Practices

Enable MFA for All Users

MFA is one of the strongest protections available.

Protect Administrator Accounts

Apply stricter controls to privileged users.

Require Compliant Devices

Reduce risks from unmanaged devices.

Use Trusted Locations Carefully

Avoid creating unnecessary exceptions.

Follow the Principle of Least Privilege

Grant only necessary access.

Benefits of Conditional Access

Organizations gain:

Adaptive Security

Policies adjust based on risk and conditions.

Improved User Experience

Security requirements appear only when necessary.

Stronger Identity Protection

Compromised accounts are easier to detect and control.

Support for Remote Work

Users can work securely from anywhere.

Zero Trust Alignment

Every access request is evaluated individually.

Exam Tips

Remember these key AB-900 concepts:

Conditional Access is part of Microsoft Entra.
Policies use an if-then approach.
Conditions include location, device state, sign-in risk, and user risk.
Access controls include requiring MFA, requiring compliant devices, and blocking access.
Conditional Access works closely with Intune and Microsoft Entra ID.
Named locations define trusted networks.
Conditional Access supports Zero Trust principles.
Microsoft 365 Copilot respects Conditional Access policies.
Administrator accounts typically receive stricter protections.
Conditional Access improves both security and usability.

Practice Exam Questions

Question 1

What is the primary purpose of Conditional Access?

A. Increase mailbox quotas
B. Automatically create Teams channels
C. Apply access decisions based on conditions and risk signals
D. Replace Microsoft Defender

Correct Answer: C

Explanation: Conditional Access evaluates various signals and determines whether access should be allowed, restricted, or blocked.

Question 2

Conditional Access is a feature of which Microsoft service?

A. Microsoft Entra ID
B. Exchange Online
C. Microsoft Purview
D. SharePoint Online

Correct Answer: A

Explanation: Conditional Access is provided through Microsoft Entra ID and is used to secure access to resources.

Question 3

Which statement best describes how Conditional Access works?

A. Use an “if condition, then action” model.
B. Always allow access.
C. Disable all external connections.
D. Eliminate authentication requirements.

Correct Answer: A

Explanation: Conditional Access evaluates conditions and applies controls accordingly.

Question 4

Which condition can be evaluated by Conditional Access?

A. Printer model
B. Monitor size
C. Mouse type
D. Sign-in risk

Correct Answer: D

Explanation: Sign-in risk is one of the security signals used when evaluating access requests.

Question 5

Which access control commonly works with Conditional Access to strengthen security?

A. Shared mailboxes
B. Multi-Factor Authentication
C. Distribution lists
D. Document versioning

Correct Answer: B

Explanation: MFA is frequently required through Conditional Access policies.

Question 6

What is the purpose of named locations?

A. Define trusted networks and IP ranges
B. Store SharePoint documents
C. Create Teams channels
D. Manage email retention

Correct Answer: A

Explanation: Named locations identify trusted locations that can influence policy behavior.

Question 7

Which Microsoft solution often works with Conditional Access to evaluate device compliance?

A. Microsoft Lists
B. Microsoft Planner
C. Microsoft Intune
D. Microsoft Forms

Correct Answer: C

Explanation: Intune provides device management and compliance information used by Conditional Access.

Question 8

Which action represents the most restrictive access control?

A. Require MFA
B. Require password change
C. Require compliant device
D. Block access

Correct Answer: D

Explanation: Blocking access completely prevents users from reaching resources.

Question 9

Which Zero Trust principle is most directly supported by Conditional Access?

A. Verify Explicitly
B. Trust Internal Networks
C. Open Access First
D. Eliminate Authentication

Correct Answer: A

Explanation: Conditional Access evaluates multiple signals before granting access, which aligns with Verify Explicitly.

Question 10

How does Microsoft 365 Copilot interact with Conditional Access policies?

A. Copilot bypasses policies.
B. Copilot disables MFA requirements.
C. Copilot ignores device compliance rules.
D. Copilot follows the same Conditional Access requirements as Microsoft 365 resources.

Correct Answer: D

Explanation: Copilot inherits existing identity and access controls and does not bypass security policies.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification June 27, 2026

Understand features and capabilities of Microsoft Entra (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Understand features and capabilities of Microsoft Entra

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Identity is the foundation of security in Microsoft 365. Before users can access email, Teams, SharePoint, Microsoft 365 Copilot, or other services, their identities must be verified and managed securely.

Microsoft Entra is Microsoft’s family of identity and access solutions that helps organizations secure users, applications, devices, and external identities. Microsoft Entra provides authentication, authorization, identity governance, and access management capabilities that support modern security strategies such as Zero Trust.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding the major capabilities of Microsoft Entra is essential.

What Is Microsoft Entra?

Microsoft Entra is Microsoft’s identity and access product family.

It helps organizations:

Manage identities.
Authenticate users.
Control access to resources.
Protect against identity-based attacks.
Support Zero Trust security.

Microsoft Entra enables secure access to:

Microsoft 365
Microsoft Teams
SharePoint Online
Exchange Online
Third-party applications
Custom applications

Microsoft Entra ID

The core component of Microsoft Entra is Microsoft Entra ID (formerly Azure Active Directory).

Microsoft Entra ID is a cloud-based identity and access management service that provides:

User accounts
Group management
Authentication services
Authorization capabilities
Single Sign-On (SSO)
Multi-Factor Authentication (MFA)

Microsoft 365 relies on Microsoft Entra ID to manage identities.

Identity and Access Management (IAM)

Identity and Access Management (IAM) ensures that:

The correct users are identified.
Appropriate access is granted.
Access can be controlled and monitored.

IAM helps organizations maintain security while enabling productivity.

Authentication

Authentication verifies identity.

It answers:

Who are you?

Microsoft Entra supports multiple authentication methods, including:

Passwords
Microsoft Authenticator
SMS verification
Voice calls
FIDO2 security keys
Windows Hello for Business

Authentication occurs before authorization.

Authorization

Authorization determines what authenticated users are allowed to access.

It answers:

What are you allowed to do?

Examples include:

Accessing SharePoint sites.
Reading Exchange mailboxes.
Managing Teams settings.

Authorization is commonly controlled through:

Roles
Permissions
Policies

Single Sign-On (SSO)

Single Sign-On allows users to sign in once and access multiple applications without re-entering credentials.

Benefits include:

Improved user experience.
Reduced password fatigue.
Fewer password reset requests.
Increased productivity.

Users can access Microsoft 365 applications with one identity.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication requires more than one authentication factor.

Examples:

Password
Microsoft Authenticator approval

Benefits include:

Stronger security.
Reduced credential theft risk.
Better protection against phishing attacks.

MFA is one of Microsoft’s most important security recommendations.

Conditional Access

Conditional Access uses signals to determine whether access should be allowed.

Signals may include:

User identity
Device status
Location
Application being accessed
Risk level

Examples:

Require MFA outside the corporate network.
Block high-risk sign-ins.
Require compliant devices.

Conditional Access supports the Zero Trust principle of Verify Explicitly.

Role-Based Access Control (RBAC)

Microsoft Entra uses Role-Based Access Control to assign administrative privileges.

Examples of built-in roles include:

Global Administrator
User Administrator
Security Administrator
Exchange Administrator

RBAC follows the principle of least privilege by granting only the permissions required.

Groups

Groups simplify administration by allowing permissions and licenses to be assigned to multiple users simultaneously.

Types of groups include:

Security Groups

Used to assign permissions and policies.

Microsoft 365 Groups

Provide collaboration resources such as:

Outlook mailbox
Teams workspace
SharePoint site

Groups help reduce administrative effort.

Self-Service Capabilities

Microsoft Entra supports self-service features such as:

Self-Service Password Reset (SSPR)

Users can reset forgotten passwords without administrator assistance.

Benefits:

Reduced help desk workload.
Faster account recovery.

Self-Service Group Management

Users can manage group membership when permitted.

Device Identity and Management Integration

Microsoft Entra can recognize devices and work with Microsoft Intune.

This allows organizations to:

Register devices.
Evaluate compliance.
Control access based on device health.

Examples:

Require managed devices.
Block noncompliant devices.

External Identities

Organizations often collaborate with external users.

Microsoft Entra supports:

Guest users
Business partners
Contractors

External identities allow secure collaboration while maintaining administrative control.

Identity Protection

Microsoft Entra helps detect identity-related threats such as:

Credential theft
Suspicious sign-ins
Impossible travel scenarios
Password spray attacks

Identity protection helps organizations respond to risks quickly.

Identity Governance

Identity governance helps organizations manage:

Access reviews
Lifecycle management
Least privilege practices

Governance helps ensure users retain only the access they need.

Passwordless Authentication

Microsoft Entra supports passwordless sign-in methods including:

Microsoft Authenticator
Windows Hello for Business
FIDO2 security keys

Benefits include:

Improved user experience.
Reduced phishing risks.
Stronger security.

Microsoft Entra and Zero Trust

Microsoft Entra supports all three Zero Trust principles.

Verify Explicitly

Evaluate identity and access conditions.

Use Least Privileged Access

Grant only necessary permissions.

Assume Breach

Continuously monitor identity risks.

Microsoft Entra and Microsoft 365 Copilot

Microsoft 365 Copilot relies on Microsoft Entra identities.

Entra controls:

User authentication.
Authorization.
Access policies.
Group memberships.
Security controls.

Copilot inherits existing permissions and does not grant access to content users are not already authorized to view.

Benefits of Microsoft Entra

Organizations benefit from:

Centralized Identity Management

Manage users from a single platform.

Improved Security

Protect against identity attacks.

Better User Experience

Single Sign-On reduces friction.

Reduced Administrative Effort

Groups and self-service capabilities simplify management.

Support for Zero Trust

Access decisions are based on multiple signals.

Best Practices

Enable Multi-Factor Authentication

Protect identities against compromise.

Use Least Privilege

Assign only required permissions.

Implement Conditional Access

Strengthen access decisions.

Use Self-Service Password Reset

Reduce support costs.

Review Administrative Roles Regularly

Limit excessive privileges.

Exam Tips

Remember these key AB-900 concepts:

Microsoft Entra is Microsoft’s identity and access family.
Microsoft Entra ID was formerly Azure Active Directory.
Authentication verifies identity.
Authorization determines access.
Single Sign-On provides one login for multiple applications.
Multi-Factor Authentication improves security.
Conditional Access evaluates multiple signals.
RBAC controls administrative privileges.
Self-Service Password Reset reduces help desk workload.
Microsoft 365 Copilot relies on Microsoft Entra identities and permissions.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Entra?

A. Replace Microsoft Teams meetings
B. Manage identity and access to resources
C. Increase SharePoint storage capacity
D. Provide email hosting

Correct Answer: B

Explanation: Microsoft Entra provides identity and access management capabilities for users, applications, and devices.

Question 2

What was Microsoft Entra ID previously called?

A. Microsoft Intune
B. Azure Active Directory
C. Exchange Online
D. Microsoft Purview

Correct Answer: B

Explanation: Microsoft Entra ID is the new name for Azure Active Directory.

Question 3

Which capability allows users to sign in once and access multiple applications?

A. Multi-Factor Authentication
B. Conditional Access
C. Single Sign-On
D. Identity Governance

Correct Answer: C

Explanation: Single Sign-On improves user experience by reducing repeated sign-ins.

Question 4

Which Microsoft Entra feature allows users to reset forgotten passwords without administrator assistance?

A. Self-Service Password Reset
B. Privileged Identity Management
C. Role-Based Access Control
D. Conditional Access

Correct Answer: A

Explanation: Self-Service Password Reset reduces support requests and speeds account recovery.

Question 5

Which capability uses factors such as location and device compliance when making access decisions?

A. Dynamic Distribution Groups
B. Microsoft Lists
C. Conditional Access
D. Shared Mailboxes

Correct Answer: C

Explanation: Conditional Access evaluates various signals before granting access.

Question 6

What does authentication determine?

A. What permissions users have
B. Who the user is
C. Which Teams channel is created
D. Which files are deleted

Correct Answer: B

Explanation: Authentication verifies a user’s identity.

Question 7

Which principle is supported by Role-Based Access Control (RBAC)?

A. Maximum privilege
B. Open access
C. Unlimited permissions
D. Least privilege

Correct Answer: D

Explanation: RBAC grants only the permissions necessary to perform assigned tasks.

Question 8

Which authentication method strengthens security by requiring multiple verification factors?

A. Single Sign-On
B. Multi-Factor Authentication
C. Shared mailbox access
D. Version history

Correct Answer: B

Explanation: MFA provides stronger identity protection than passwords alone.

Question 9

What type of group provides collaboration resources such as Teams, Outlook mailboxes, and SharePoint sites?

A. Security group
B. Distribution list
C. Microsoft 365 group
D. Mail contact

Correct Answer: C

Explanation: Microsoft 365 groups provide shared collaboration resources.

Question 10

How does Microsoft 365 Copilot use Microsoft Entra?

A. It bypasses user permissions.
B. It replaces authentication requirements.
C. It creates anonymous access.
D. It relies on Entra identities and existing permissions.

Correct Answer: D

Explanation: Copilot respects existing identities, permissions, and security controls managed by Microsoft Entra.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Cybersecurity, Data Security, Microsoft Certification June 27, 2026

Understand features and capabilities of Microsoft Defender XDR (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand features and capabilities of Microsoft Defender XDR

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Organizations today face attacks that target multiple areas simultaneously, including identities, email, endpoints, cloud applications, and collaboration platforms. Security teams need a unified way to detect, investigate, and respond to these threats.

Microsoft Defender XDR (Extended Detection and Response) is Microsoft’s integrated security platform that correlates signals across multiple security services to provide comprehensive threat protection.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the purpose, components, and key capabilities of Microsoft Defender XDR.

What Is Microsoft Defender XDR?

Microsoft Defender XDR is a security platform that:

Collects signals from multiple Microsoft security solutions.
Correlates related events.
Detects attacks across domains.
Automates investigations.
Supports incident response.

The “XDR” in Defender XDR stands for:

Extended Detection and Response

Unlike isolated security tools, Defender XDR provides a unified view of attacks across the organization.

Why Defender XDR Is Important

Traditional security tools often work independently.

For example:

Email security detects phishing.
Endpoint security detects malware.
Identity security detects suspicious sign-ins.

Without correlation, security teams may miss the fact that these events are part of the same attack.

Defender XDR connects these signals and presents them as a single incident.

Components of Microsoft Defender XDR

Defender XDR integrates several Microsoft Defender products.

Microsoft Defender for Office 365

Protects:

Exchange Online
Outlook
Microsoft Teams
SharePoint Online
OneDrive

Focus areas:

Phishing protection
Safe Links
Safe Attachments
Business email compromise protection

Microsoft Defender for Endpoint

Protects:

Windows devices
macOS devices
Mobile devices

Capabilities include:

Endpoint detection
Vulnerability management
Device monitoring
Automated remediation

Microsoft Defender for Identity

Protects user identities by monitoring:

Authentication activity
Suspicious sign-ins
Credential attacks
Lateral movement attempts

Microsoft Defender for Cloud Apps

Provides visibility into:

SaaS applications
Cloud usage
Shadow IT
Risky behavior

Unified Incident Management

One of Defender XDR’s most important capabilities is incident correlation.

Example

A phishing email causes:

Credential theft.
Suspicious sign-in activity.
Malware installation.

Instead of producing three unrelated alerts, Defender XDR groups them into a single incident.

Benefits include:

Faster investigations.
Better understanding of attacks.
Reduced alert fatigue.

Alerts vs. Incidents

Alert

A single security event.

Examples:

Malware detected.
Suspicious email.
Risky sign-in.

Incident

A collection of related alerts representing an attack.

Security analysts typically investigate incidents rather than individual alerts.

Cross-Domain Visibility

Defender XDR provides visibility across:

Domain	Examples
Identities	User accounts and sign-ins
Endpoints	Computers and devices
Email	Exchange and Outlook
Collaboration	Teams and SharePoint
Applications	Cloud apps and services

This broad visibility helps identify complex attacks.

Automated Investigation and Response (AIR)

Defender XDR can automatically:

Detect suspicious activity.
Investigate evidence.
Recommend actions.
Perform remediation.

Examples include:

Isolating compromised devices.
Blocking malicious files.
Removing phishing emails.

Automation reduces the workload on security teams.

Attack Story and Incident Timeline

Defender XDR presents attacks visually through timelines.

Administrators can see:

When the attack started.
Which users were affected.
Which devices were involved.
How the attack progressed.

This helps security teams understand attack paths quickly.

Threat Intelligence

Microsoft Defender XDR uses Microsoft’s global threat intelligence network.

Microsoft analyzes trillions of signals from:

Microsoft 365
Azure
Windows
Identity systems
Cloud services

Threat intelligence helps identify:

Emerging threats
Known malicious actors
Attack patterns
Indicators of compromise

Threat Hunting

Security analysts can proactively search for threats using advanced hunting capabilities.

Threat hunting allows teams to:

Search large datasets.
Investigate suspicious activity.
Discover hidden threats.
Validate security concerns.

Rather than waiting for alerts, analysts actively look for attacks.

Automated Attack Disruption

Defender XDR can automatically interrupt attacks in progress.

Examples include:

Disabling compromised accounts.
Isolating devices.
Preventing lateral movement.

This capability helps reduce the impact of attacks before they spread.

Security Recommendations

Defender XDR provides recommendations that help organizations improve security posture.

Examples:

Enable Multi-Factor Authentication.
Reduce unnecessary permissions.
Update vulnerable devices.
Strengthen configurations.

These recommendations support Zero Trust principles.

Defender XDR and Zero Trust

Defender XDR supports all three Zero Trust principles.

Verify Explicitly

Analyze identities and sign-in behavior.

Use Least Privileged Access

Reduce attacker opportunities.

Assume Breach

Continuously monitor for suspicious activity.

Defender XDR and Microsoft 365 Copilot

Microsoft 365 Copilot benefits from the existing security protections provided by Defender XDR.

Defender XDR helps secure:

Emails
Teams conversations
SharePoint files
User identities
Devices

Copilot itself does not bypass security controls and continues to respect existing permissions.

Benefits of Microsoft Defender XDR

Organizations gain:

Unified Security Visibility

Multiple security signals appear in one platform.

Faster Detection

Threats are identified earlier.

Reduced Alert Fatigue

Related alerts are grouped into incidents.

Automated Response

Remediation can occur automatically.

Improved Security Operations

Security teams spend less time correlating events manually.

Best Practices

Enable Multi-Factor Authentication

Protect identities.

Review Incidents Regularly

Prioritize investigations.

Use Automated Investigation

Reduce manual effort.

Follow Security Recommendations

Improve overall posture.

Implement Zero Trust

Assume attacks can occur and prepare accordingly.

Exam Tips

Remember these AB-900 concepts:

XDR stands for Extended Detection and Response.
Defender XDR combines signals across multiple domains.
Alerts represent individual events.
Incidents group related alerts together.
Defender XDR integrates several Defender products.
Automated Investigation and Response (AIR) reduces manual work.
Threat intelligence helps identify emerging attacks.
Advanced hunting enables proactive investigations.
Automated attack disruption can stop attacks in progress.
Defender XDR supports Microsoft’s Zero Trust strategy.

Practice Exam Questions

Question 1

What does the “XDR” in Microsoft Defender XDR stand for?

A. Expanded Directory Routing
B. External Device Recovery
C. Exchange Data Replication
D. Extended Detection and Response

Correct Answer: D

Explanation: XDR stands for Extended Detection and Response and provides integrated threat protection across multiple domains.

Question 2

What is the primary purpose of Microsoft Defender XDR?

A. Increase mailbox sizes
B. Provide unified detection and response across security domains
C. Replace Microsoft Teams
D. Create SharePoint sites

Correct Answer: B

Explanation: Defender XDR correlates signals from multiple services to improve threat detection and response.

Question 3

Which Microsoft Defender product focuses on email and collaboration protection?

A. Defender for Endpoint
B. Defender for Identity
C. Defender for Office 365
D. Defender for Cloud Apps

Correct Answer: C

Explanation: Defender for Office 365 protects Exchange Online, Outlook, Teams, and related collaboration services.

Question 4

What is an incident in Microsoft Defender XDR?

A. A single sign-in attempt
B. A licensing error
C. A mailbox migration task
D. A collection of related security alerts

Correct Answer: D

Explanation: Incidents combine multiple related alerts into a single investigation.

Question 5

Which Defender component primarily protects devices?

A. Defender for Cloud Apps
B. Defender for Endpoint
C. Defender for Identity
D. Defender for Office 365

Correct Answer: B

Explanation: Defender for Endpoint provides security for computers and devices.

Question 6

What is the benefit of Automated Investigation and Response (AIR)?

A. Eliminates user accounts
B. Removes all security policies
C. Automates threat analysis and remediation
D. Replaces authentication

Correct Answer: C

Explanation: AIR helps detect, investigate, and respond to threats automatically.

Question 7

Which capability allows analysts to proactively search for hidden threats?

A. Safe Links
B. Threat hunting
C. Shared mailboxes
D. Distribution groups

Correct Answer: B

Explanation: Threat hunting enables analysts to investigate suspicious activity beyond standard alerts.

Question 8

Which Defender component focuses on identity-based attacks?

A. Defender for Identity
B. Defender for Endpoint
C. Defender for Office 365
D. Defender for Cloud Apps

Correct Answer: A

Explanation: Defender for Identity monitors authentication activity and suspicious account behavior.

Question 9

How does Defender XDR help reduce alert fatigue?

A. By deleting alerts automatically
B. By disabling auditing
C. By grouping related alerts into incidents
D. By preventing administrators from viewing alerts

Correct Answer: C

Explanation: Incident correlation allows analysts to investigate attacks more efficiently.

Question 10

Which Microsoft security principle is supported by Defender XDR’s continuous monitoring?

A. Trust Internal Networks
B. Assume Breach
C. Open Collaboration First
D. Disable Authentication

Correct Answer: B

Explanation: Continuous monitoring aligns with the Zero Trust principle of assuming that breaches can occur and detecting them quickly.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Data Security, Microsoft Certification June 27, 2026

Understand threat protection and intelligence (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand threat protection and intelligence

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Cyber threats continue to evolve in complexity and frequency. Organizations using Microsoft 365 must protect users, devices, identities, applications, and data from attacks such as phishing, malware, ransomware, and business email compromise.

Threat protection and threat intelligence are key components of Microsoft 365 security. They help organizations:

Detect threats.
Prevent attacks.
Investigate suspicious activity.
Respond to incidents.
Learn from global threat intelligence.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding these concepts is essential because Microsoft 365 security capabilities are designed around proactive threat defense.

What Is Threat Protection?

Threat protection refers to the technologies and processes used to:

Prevent attacks.
Detect malicious activity.
Respond to incidents.
Minimize the impact of security events.

Threat protection helps secure:

User identities
Email systems
Devices
Applications
Data

Common Cyber Threats

Organizations face many types of attacks.

Phishing

Attackers send deceptive emails designed to trick users into:

Revealing passwords
Clicking malicious links
Downloading malware

Phishing is one of the most common attack methods.

Malware

Malicious software can:

Damage systems
Steal information
Monitor activity
Spread to other devices

Examples include:

Viruses
Worms
Trojans

Ransomware

Ransomware encrypts files and demands payment for their recovery.

Consequences include:

Data loss
Business interruption
Financial damage

Business Email Compromise (BEC)

Attackers impersonate executives or trusted contacts to convince employees to:

Transfer money
Reveal information
Approve fraudulent transactions

Credential Theft

Attackers attempt to steal usernames and passwords through:

Phishing
Password spraying
Brute-force attacks

What Is Threat Intelligence?

Threat intelligence is information gathered about cyber threats and attacker behavior.

Threat intelligence helps organizations:

Understand current attack trends.
Identify malicious actors.
Detect suspicious activity.
Improve security defenses.

Microsoft collects signals from billions of sources worldwide to build its threat intelligence capabilities.

Microsoft Security Signals

Microsoft analyzes signals from:

Microsoft 365
Azure
Windows devices
Email traffic
Authentication events
Cloud applications

These signals help identify emerging threats and provide organizations with actionable insights.

Microsoft Defender

Microsoft Defender is Microsoft’s threat protection platform.

It provides security across:

Email
Endpoints
Identities
Applications
Cloud workloads

Microsoft Defender helps organizations:

Prevent attacks.
Detect threats.
Investigate incidents.
Automate responses.

Microsoft Defender for Office 365

Microsoft Defender for Office 365 protects:

Exchange Online
Outlook
Microsoft Teams
SharePoint Online
OneDrive

Its primary focus is protecting users from email-based attacks.

Safe Links

Safe Links examines URLs in messages and documents.

Benefits:

Blocks malicious websites.
Protects against phishing attacks.
Evaluates links when users click them.

Safe Attachments

Safe Attachments analyzes files before users open them.

Suspicious files are:

Isolated
Scanned
Blocked if malicious

This helps prevent malware infections.

Anti-Phishing Protection

Anti-phishing policies help identify:

Spoofed senders
Impersonation attempts
Suspicious domains

These protections reduce credential theft risks.

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint protects devices such as:

Windows computers
macOS devices
Mobile devices

Capabilities include:

Threat detection
Vulnerability management
Device monitoring
Automated investigation

Microsoft Defender for Identity

Defender for Identity monitors identity-related threats.

Examples include:

Password attacks
Suspicious sign-ins
Lateral movement attempts

It helps protect user identities and privileged accounts.

Microsoft Defender for Cloud Apps

Defender for Cloud Apps helps organizations:

Monitor cloud applications.
Detect risky behavior.
Discover shadow IT.
Protect sensitive information.

Automated Investigation and Response (AIR)

Microsoft security solutions can automatically:

Detect suspicious activity.
Investigate the event.
Recommend or perform remediation actions.

Automation reduces response times and improves efficiency.

Threat Detection and Alerts

Security systems continuously monitor activity.

Alerts may be generated for:

Unusual sign-ins
Malware detections
Excessive file downloads
Phishing attempts

Administrators can investigate alerts and determine appropriate actions.

Security Incidents

Multiple related alerts may be grouped into an incident.

An incident provides:

A timeline of events.
Affected users.
Devices involved.
Recommended remediation steps.

Grouping alerts simplifies investigations.

Threat Hunting

Threat hunting is the proactive search for hidden threats within an environment.

Rather than waiting for alerts, analysts actively look for:

Suspicious activity
Abnormal behavior
Potential compromise indicators

Threat Protection and Zero Trust

Threat protection supports all Zero Trust principles.

Verify Explicitly

Analyze identity and access signals.

Use Least Privileged Access

Limit attacker capabilities.

Assume Breach

Continuously monitor and investigate suspicious activity.

Threat Protection and Microsoft 365 Copilot

Microsoft 365 Copilot inherits Microsoft 365 security protections.

Copilot itself does not:

Bypass security controls.
Override permissions.
Expose unauthorized content.

Threat protection mechanisms continue to protect:

Emails
Files
Teams conversations
SharePoint content

Benefits of Threat Intelligence

Threat intelligence helps organizations:

Detect Attacks Earlier

Identify malicious activity before damage occurs.

Improve Security Decisions

Use real-world intelligence to strengthen defenses.

Respond Faster

Automated investigation reduces response times.

Reduce Risk

Continuous monitoring improves overall security posture.

Best Practices

Enable Multi-Factor Authentication

Protect accounts from credential theft.

Use Microsoft Defender Solutions

Implement layered protection.

Educate Users About Phishing

Human awareness remains important.

Review Security Alerts Regularly

Investigate suspicious activity promptly.

Keep Systems Updated

Reduce vulnerabilities attackers can exploit.

Exam Tips

Remember these key AB-900 concepts:

Threat protection prevents, detects, and responds to attacks.
Threat intelligence provides information about emerging threats.
Phishing attacks target users through deceptive communications.
Ransomware encrypts files and demands payment.
Microsoft Defender provides integrated threat protection.
Safe Links protects against malicious URLs.
Safe Attachments protects against harmful files.
Alerts identify suspicious activity.
Multiple alerts may be grouped into incidents.
Threat protection supports Microsoft’s Zero Trust strategy.

Practice Exam Questions

Question 1

What is the primary purpose of threat protection?

A. Increase mailbox storage quotas
B. Prevent, detect, and respond to cyber threats
C. Create SharePoint sites automatically
D. Manage software licenses

Correct Answer: B

Explanation: Threat protection helps organizations identify and respond to attacks while minimizing their impact.

Question 2

Which attack attempts to trick users into revealing credentials or clicking malicious links?

A. Phishing
B. Compression attacks
C. Data deduplication
D. Versioning

Correct Answer: A

Explanation: Phishing uses deceptive communications to steal information or deliver malware.

Question 3

What is ransomware designed to do?

A. Improve email performance
B. Increase authentication speed
C. Encrypt files and demand payment
D. Create backup copies automatically

Correct Answer: C

Explanation: Ransomware locks data and attempts to extort victims for recovery access.

Question 4

What is threat intelligence?

A. A type of file storage
B. A SharePoint permission model
C. A Teams collaboration feature
D. Information about threats and attacker behavior

Correct Answer: D

Explanation: Threat intelligence helps organizations understand current threats and improve defenses.

Question 5

Which Microsoft security solution provides broad threat protection across identities, devices, and applications?

A. Microsoft Defender
B. Microsoft Lists
C. Microsoft Forms
D. Microsoft Planner

Correct Answer: A

Explanation: Microsoft Defender is Microsoft’s integrated security platform.

Question 6

Which Microsoft Defender for Office 365 feature evaluates URLs when users click them?

A. Safe Attachments
B. Conditional Access
C. Safe Links
D. Windows Hello

Correct Answer: C

Explanation: Safe Links checks URLs to protect users from malicious websites.

Question 7

Which feature analyzes files before users open them?

A. Safe Attachments
B. RBAC
C. External Access
D. Dynamic Groups

Correct Answer: A

Explanation: Safe Attachments helps prevent malware infections by scanning files before delivery.

Question 8

What can happen when several related security alerts are detected?

A. They are deleted automatically.
B. They are combined into a security incident.
C. They are converted into Teams messages only.
D. They are ignored after 24 hours.

Correct Answer: B

Explanation: Grouping alerts into incidents provides a broader view of attacks.

Question 9

What is the purpose of threat hunting?

A. Increasing mailbox sizes
B. Managing distribution lists
C. Proactively searching for hidden threats
D. Assigning user licenses

Correct Answer: C

Explanation: Threat hunting involves actively investigating environments for suspicious activity.

Question 10

Which Microsoft Defender for Office 365 capability helps identify impersonation and spoofing attempts?

A. Safe Attachments
B. Device Compliance Policies
C. SharePoint Permissions
D. Anti-Phishing Protection

Correct Answer: D

Explanation: Anti-phishing policies help detect impersonation attacks and suspicious senders.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Data Security, Microsoft Certification June 27, 2026

Understand authentication methods (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand authentication methods

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Authentication is one of the foundational security concepts in Microsoft 365. Before users can access email, files, Teams conversations, or Microsoft 365 Copilot experiences, the system must first verify their identity.

Authentication answers the question:

“Who are you?”

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, it is important to understand the various authentication methods available in Microsoft 365 and how they help secure organizational resources.

What Is Authentication?

Authentication is the process of verifying a user’s identity before granting access to Microsoft 365 resources.

When users sign in, Microsoft Entra ID (formerly Azure Active Directory) validates their credentials and determines whether they are who they claim to be.

Authentication occurs before authorization.

Example

User enters credentials.
Microsoft verifies identity.
Authorization determines what resources the user can access.

Authentication vs. Authorization

Although closely related, these are different concepts.

Authentication	Authorization
Verifies identity	Determines access rights
Answers “Who are you?”	Answers “What can you do?”
Occurs first	Occurs second
Uses credentials and identity factors	Uses permissions and policies

Why Authentication Is Important

Authentication helps organizations:

Prevent unauthorized access.
Protect sensitive data.
Reduce credential theft risks.
Support Zero Trust security.
Enable secure remote work.

Without authentication, Microsoft 365 resources would be exposed to anyone.

Authentication Factors

Authentication methods are based on one or more factors.

Something You Know

Examples:

Passwords
PINs
Security questions

Something You Have

Examples:

Smartphone
Hardware token
Security key

Something You Are

Examples:

Fingerprint
Facial recognition
Biometrics

Using multiple factors increases security.

Single-Factor Authentication (SFA)

Single-factor authentication requires only one credential.

Typically:

Username + Password

Advantages:

Simple
Familiar

Disadvantages:

Vulnerable to phishing attacks.
Password theft can lead to account compromise.

Because passwords alone are risky, organizations increasingly use stronger authentication methods.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) requires two or more authentication factors.

Example:

User enters a password.
User approves a request in Microsoft Authenticator.

Benefits include:

Stronger protection against compromised passwords.
Reduced account takeover risk.
Improved compliance.

Microsoft strongly recommends MFA for all users.

Common MFA Methods in Microsoft 365

Microsoft 365 supports several MFA options.

Microsoft Authenticator App

Users receive:

Push notifications
Number matching prompts
Verification approvals

Advantages:

Secure
Convenient
Widely recommended by Microsoft

Text Message (SMS)

Users receive a verification code by text.

Advantages:

Easy to use.

Limitations:

Less secure than app-based authentication.
Vulnerable to SIM-swapping attacks.

Voice Calls

Users receive an automated phone call with verification instructions.

This method is supported but is generally less secure than app-based options.

Hardware Security Keys

Physical devices such as FIDO2 security keys provide strong authentication.

Benefits:

Resistant to phishing attacks.
Passwordless capability.
Strong protection for privileged accounts.

Passwordless Authentication

Passwordless authentication eliminates traditional passwords.

Instead, users authenticate through:

Microsoft Authenticator
FIDO2 security keys
Windows Hello for Business

Benefits include:

Reduced phishing risk.
Improved user experience.
Fewer password-related support requests.

Passwordless authentication is a key part of Microsoft’s security strategy.

Windows Hello for Business

Windows Hello for Business uses:

Facial recognition
Fingerprint recognition
PINs

Because biometric information remains on the device, this method provides strong security and convenience.

FIDO2 Security Keys

FIDO2 keys are physical authentication devices.

Examples include:

USB keys
NFC keys

Benefits:

Passwordless sign-in.
Protection against phishing.
Strong authentication for administrators.

Certificate-Based Authentication

Certificate-based authentication uses digital certificates to verify identity.

Organizations commonly use this method for:

Highly secure environments
Smart cards
Specialized devices

Legacy Authentication

Legacy authentication uses older protocols that often rely only on usernames and passwords.

Examples include:

POP3
IMAP
SMTP AUTH (certain scenarios)

These methods do not support modern security controls like MFA.

Because of their security risks, organizations are encouraged to disable legacy authentication whenever possible.

Adaptive Authentication and Conditional Access

Microsoft Entra Conditional Access can require additional authentication based on risk factors.

Examples:

Require MFA outside the corporate network.
Block risky sign-ins.
Require compliant devices.

This supports the Zero Trust principle of Verify Explicitly.

Password Policies

Strong passwords remain important.

Best practices include:

Long passwords or passphrases.
Avoiding reused passwords.
Avoiding predictable information.
Enabling MFA.

Microsoft recommends focusing on password quality rather than forcing frequent password changes.

Authentication in Zero Trust

Authentication supports Zero Trust by:

Verifying Identity Continuously

Access requests are evaluated using multiple signals.

Reducing Credential Risks

MFA strengthens security.

Supporting Least Privilege

Only verified users receive access.

Authentication and Microsoft 365 Copilot

Microsoft 365 Copilot relies on existing Microsoft 365 identities.

Users must authenticate before accessing:

Outlook
Teams
SharePoint
Word
Copilot experiences

Copilot itself does not bypass authentication requirements.

Best Practices

Enable Multi-Factor Authentication

MFA is one of the most effective security controls.

Adopt Passwordless Authentication

Reduce reliance on passwords.

Use Microsoft Authenticator

Prefer app-based verification over SMS.

Disable Legacy Authentication

Reduce exposure to credential attacks.

Protect Administrator Accounts

Use stronger authentication methods for privileged users.

Exam Tips

Remember these key AB-900 concepts:

Authentication verifies identity.
Authentication occurs before authorization.
Single-factor authentication usually relies on passwords.
MFA uses multiple authentication factors.
Microsoft Authenticator is a recommended MFA method.
Passwordless authentication improves security.
Windows Hello for Business supports biometric authentication.
FIDO2 security keys provide phishing-resistant authentication.
Legacy authentication is less secure because it often does not support MFA.
Conditional Access can require additional authentication based on risk.

Practice Exam Questions

Question 1

What question does authentication answer?

A. Who is the user?
B. How much storage is available?
C. What resources can the user access?
D. Which files should be encrypted?

Correct Answer: A

Explanation: Authentication verifies identity and determines whether the user is who they claim to be.

Question 2

Which process occurs before authorization?

A. Authentication
B. Auditing
C. Encryption
D. Data classification

Correct Answer: A

Explanation: Users must first prove their identity before permissions are evaluated.

Question 3

Which example represents multi-factor authentication?

A. Username only
B. Password only
C. PIN only
D. Password and Microsoft Authenticator approval

Correct Answer: D

Explanation: MFA requires multiple authentication factors rather than relying on a single credential.

Question 4

Which authentication factor category includes a fingerprint?

A. Something you know
B. Something you have
C. Something you own
D. Something you are

Correct Answer: D

Explanation: Biometrics are considered “something you are.”

Question 5

Which Microsoft solution provides app-based MFA approvals?

A. Microsoft Authenticator
B. Exchange Online
C. SharePoint Online
D. Microsoft Purview

Correct Answer: A

Explanation: Microsoft Authenticator supports push notifications and secure MFA verification.

Question 6

What is a major advantage of passwordless authentication?

A. Increased mailbox size
B. Reduced phishing risks
C. Automatic role assignments
D. Elimination of permissions

Correct Answer: B

Explanation: Removing passwords helps reduce common attack methods such as phishing.

Question 7

Which authentication method uses facial recognition or fingerprints?

A. FIDO2
B. SMS verification
C. Voice call authentication
D. Windows Hello for Business

Correct Answer: D

Explanation: Windows Hello for Business supports biometric authentication and PIN-based sign-in.

Question 8

Why are legacy authentication protocols considered less secure?

A. They consume more storage.
B. They disable file sharing.
C. They often do not support modern protections such as MFA.
D. They prevent Teams meetings.

Correct Answer: C

Explanation: Legacy authentication protocols typically rely only on usernames and passwords.

Question 9

Which technology can require additional authentication based on risk conditions?

A. Conditional Access
B. Distribution groups
C. Shared mailboxes
D. Version history

Correct Answer: A

Explanation: Conditional Access evaluates signals and can require MFA or block access.

Question 10

Which authentication method provides phishing-resistant, passwordless sign-in through a physical device?

A. SMS codes
B. Security questions
C. Voice calls
D. FIDO2 security keys

Correct Answer: D

Explanation: FIDO2 keys provide strong passwordless authentication and resist phishing attacks.

Go to the AB-900 Exam Prep Hub main page

Exam Prep Hubs available on The Data Community

Exam Prep Hub for AI-900: Microsoft Azure AI Fundamentals

Exam Prep Hub for PL-300: Microsoft Power BI Data Analyst

Exam Prep Hub for DP-600: Implementing Analytics Solutions Using Microsoft Fabric

Introduction

What Are Audit Logs?

Types of Activities Recorded

User Activities

Administrator Activities

Service Activities

Unified Audit Log

Microsoft Purview Audit

Common Search Filters

User

Activity

Date and Time

Workload

Microsoft Entra Sign-In Logs

Audit Logs vs Sign-In Logs

Sign-In Logs

Audit Logs

Examples of Audit Events

Exchange Online

SharePoint Online

Microsoft Teams

Microsoft Entra ID

Reviewing Administrator Activity

Reviewing User Activity

Audit Logs and Microsoft 365 Copilot

Microsoft Defender XDR and Advanced Investigations

Retention of Audit Logs

Exporting Audit Results

Best Practices

Review Logs Regularly

Use Filters

Protect Administrator Accounts

Enable MFA

Maintain Least Privilege

Retain Logs Appropriately

Important Exam Tips

Practice Exam Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Introduction

What Is Identity Secure Score?

Purpose of Identity Secure Score

Where to Find Identity Secure Score

How the Score Is Calculated

Example

Understanding the Score

Improvement Actions

Examples of Improvement Actions

Enable MFA for Administrators

Enable MFA for Users

Require Authentication Method Registration

Block Legacy Authentication

Use Conditional Access Policies

Protect Privileged Roles

Score Categories

Identity Protection

Authentication

Privileged Access

Access Control

Device Security

Trending and Historical Views

Comparing with Similar Organizations

Relationship to Microsoft Secure Score

Identity Secure Score

Microsoft Secure Score

Identity Secure Score and Microsoft 365 Copilot

Best Practices

Enable Multifactor Authentication