Tag: Copilot

AB-900, Microsoft Certification

Assign Copilot licenses (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Perform basic administrative tasks for Copilot and agents (25–30%)
   --> Perform basic administrative tasks for Copilot
      --> Assign Copilot licenses

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Assigning Microsoft 365 Copilot licenses is a core administrative task that ensures users can access Copilot capabilities within supported Microsoft 365 apps. Licensing directly controls who can use Copilot features in apps such as Word, Excel, Outlook, Teams, and other Microsoft 365 services.

What is a Copilot license?

A Microsoft 365 Copilot license is a per-user add-on license that enables AI-powered assistance across Microsoft 365 applications. It works alongside required base licenses such as:

  • Microsoft 365 E3 or E5
  • Microsoft 365 Business Standard or Business Premium (depending on eligibility)

Without a Copilot license, users may still access Microsoft 365 apps but will not have Copilot capabilities embedded in those apps.

Prerequisites before assigning Copilot licenses

Before assigning licenses, an administrator must ensure:

  • The user has a supported Microsoft 365 base license
  • The organization has available Copilot licenses purchased through the Microsoft 365 admin center
  • The user is in a valid Microsoft Entra ID tenant
  • The required service plans for Copilot are enabled

Methods to assign Copilot licenses

1. Microsoft 365 admin center (most common method)

Admins can assign licenses manually:

Steps:

  • Navigate to the Microsoft 365 admin center
  • Go to Users > Active users
  • Select one or more users
  • Choose Licenses and apps
  • Enable Microsoft 365 Copilot
  • Save changes

This method is typically used for small or targeted assignments.

2. Group-based licensing via Microsoft Entra ID

For larger organizations, licenses are assigned through security groups:

Steps:

  • Create or select a Microsoft Entra security group
  • Assign Copilot license to the group
  • Add users to the group

Benefits:

  • Automated license assignment
  • Scalable for large organizations
  • Reduces administrative overhead

3. Microsoft 365 admin bulk assignment

Admins can:

  • Upload a CSV file of users
  • Assign Copilot licenses in bulk
  • Apply changes across many accounts at once

This is useful during onboarding or large-scale rollouts.

4. Microsoft Graph or PowerShell automation

Advanced administrators can use:

  • Microsoft Graph API
  • Microsoft Graph PowerShell SDK

This allows:

  • Automated provisioning
  • Integration with HR systems
  • Dynamic license assignment based on attributes

How Copilot licensing works across Microsoft 365 apps

Once assigned, the license enables Copilot features in:

  • Microsoft Word (content generation, rewriting, summarization)
  • Microsoft Excel (data analysis, formulas, insights)
  • Microsoft Outlook (email drafting and summarization)
  • Microsoft Teams (meeting summaries, chat assistance)
  • Microsoft Loop and other integrated apps

The license is tenant-aware and respects organizational data boundaries.

License assignment considerations

When assigning Copilot licenses, administrators should consider:

1. Data access permissions

Copilot does not grant new data access. It only uses what the user already has permission to view.

2. Cost and allocation strategy

Since Copilot is a premium add-on, organizations often:

  • Start with pilot groups
  • Expand based on usage metrics
  • Prioritize high-impact roles

3. Role-based rollout

Common rollout groups include:

  • Executives
  • Sales and marketing teams
  • Analysts and knowledge workers

Monitoring license usage

Admins can track:

  • Active Copilot users
  • License assignment status
  • Adoption metrics via Microsoft 365 admin center and usage reports

This helps optimize license distribution and ROI.

Common issues during license assignment

  • User lacks a required base Microsoft 365 license
  • Copilot service plan is not enabled
  • Delay in license propagation across services
  • User not signed out/in after assignment

Summary

Assigning Copilot licenses involves ensuring users have the correct Microsoft 365 base license, selecting an appropriate assignment method (manual, group-based, bulk, or automated), and monitoring adoption. Proper license management ensures controlled rollout, cost efficiency, and readiness for Copilot-enabled productivity across Microsoft 365 applications.

Practice Exam Questions (10)

1.

What is required before assigning a Microsoft 365 Copilot license to a user?

A. The user must have a Microsoft Teams phone system license
B. The user must have a supported Microsoft 365 base license
C. The user must be a global administrator
D. The user must install Copilot locally

Answer: B
Explanation: Copilot requires a base Microsoft 365 license such as E3 or E5.

2.

Which method is best for assigning Copilot licenses to a large group of users automatically?

A. Manual assignment in the admin center
B. CSV upload only
C. Group-based licensing in Microsoft Entra ID
D. Email-based activation requests

Answer: C
Explanation: Group-based licensing automates assignment at scale through Entra ID groups.

3.

Where can an administrator assign Copilot licenses directly to individual users?

A. Microsoft Defender portal
B. Microsoft 365 admin center
C. Azure DevOps
D. Power BI service

Answer: B
Explanation: User-level license assignment is performed in the Microsoft 365 admin center.

4.

What happens if a user does not have a Microsoft 365 Copilot license?

A. They lose access to Microsoft 365 apps entirely
B. They can still use apps but without Copilot features
C. They automatically receive a trial license
D. They can use Copilot through web search

Answer: B
Explanation: Copilot is an add-on; core apps still function without it.

5.

Which tool can be used for automated Copilot license assignment based on user attributes?

A. Microsoft Graph API
B. Microsoft Paint
C. Microsoft Forms only
D. SharePoint Designer

Answer: A
Explanation: Microsoft Graph enables automation and dynamic license management.

6.

What is a key benefit of group-based licensing?

A. It removes the need for Microsoft 365 licenses
B. It allows Copilot to bypass permissions
C. It enables scalable and automated license assignment
D. It disables admin control over users

Answer: C
Explanation: Group-based licensing simplifies large-scale management.

7.

Which of the following is NOT a valid method for assigning Copilot licenses?

A. Microsoft 365 admin center
B. Microsoft Entra group-based licensing
C. Bulk CSV upload
D. Direct assignment through Windows Registry edits

Answer: D
Explanation: Registry edits are not used for Microsoft 365 licensing.

8.

After assigning a Copilot license, what may users need to do?

A. Reinstall Microsoft 365 apps
B. Restart their device immediately
C. Sign out and sign back into Microsoft 365 apps
D. Change their password

Answer: C
Explanation: License changes often require sign-out/sign-in to take effect.

9.

What does a Copilot license enable in Microsoft 365 apps?

A. Access to encrypted storage only
B. AI-powered assistance features within supported apps
C. Additional storage space in OneDrive
D. Automatic data backup services

Answer: B
Explanation: Copilot provides AI assistance across Microsoft 365 apps.

10.

What is a recommended strategy when initially deploying Copilot licenses?

A. Assign to all users immediately
B. Disable Microsoft 365 security policies
C. Start with pilot groups before broad rollout
D. Assign only to guest users

Answer: C
Explanation: Pilot deployments help organizations manage cost and adoption effectively.

Go to the AB-900 Exam Prep Hub main page

AB-900, Agentic AI, AI, Generative AI, Microsoft Certification

Identify which Copilot features can be enabled or disabled (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Perform basic administrative tasks for Copilot and agents (25–30%)
   --> Understand features and capabilities of Copilot and agents
      --> Identify which Copilot features can be enabled or disabled

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the primary responsibilities of a Microsoft 365 Copilot administrator is understanding which Copilot features can be controlled through administrative settings. Organizations often have different security, compliance, and business requirements, so Microsoft provides administrators with the ability to enable or disable various Copilot capabilities at the tenant, service, and user levels.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand:

  • Which Copilot capabilities administrators can control
  • Where these controls are configured
  • Why organizations may enable or disable specific features
  • Which capabilities are always governed by Microsoft 365 permissions rather than simple on/off settings
  • How licensing affects feature availability

Why Organizations Control Copilot Features

Organizations don’t always want every AI capability immediately available to every employee.

Common reasons include:

  • Meeting regulatory requirements
  • Protecting sensitive information
  • Conducting pilot deployments
  • Managing licensing costs
  • Limiting access to experimental features
  • Preventing users from accessing external AI services
  • Reducing organizational risk

Microsoft allows administrators to gradually introduce Copilot while maintaining governance.

Administrative Control Layers

Copilot features can be managed through several layers.

Control LayerPurpose
LicensingDetermines who is entitled to use Copilot
Microsoft 365 Admin CenterEnables or disables Copilot services and manages user assignments
Microsoft Entra IDControls user and group access
Microsoft PurviewApplies compliance, DLP, retention, sensitivity labels, and governance
SharePoint Advanced ManagementControls content access and oversharing protection
Microsoft DefenderProtects against threats affecting Copilot-accessible content
Individual Microsoft 365 AppsMay provide application-specific Copilot settings

These controls work together rather than independently.

Features That Can Be Enabled or Disabled

Administrators can control several Copilot capabilities.

1. Microsoft 365 Copilot Licenses

The most fundamental control is license assignment.

Without a license:

  • Users cannot access Microsoft 365 Copilot.
  • Copilot chat within Microsoft 365 apps is unavailable.
  • AI-powered productivity experiences remain disabled.

Administrators assign or remove licenses through the Microsoft 365 Admin Center.

2. Copilot Chat Availability

Organizations can choose whether users have access to:

  • Microsoft 365 Copilot Chat
  • Enterprise data grounding
  • AI conversations within Microsoft 365

This allows phased deployments.

Example:

  • IT department enabled
  • Executive team enabled
  • Finance enabled later
  • Entire organization enabled after testing

3. Copilot in Individual Microsoft 365 Apps

Copilot experiences exist across multiple applications, including:

  • Word
  • Excel
  • PowerPoint
  • Outlook
  • Teams
  • OneNote

Organizations may decide when to introduce Copilot features within these workloads depending on readiness and licensing.

4. Intelligent Meeting Features

Some Teams AI features can be managed by administrators, including:

  • Intelligent meeting recap
  • AI-generated meeting summaries
  • Suggested action items
  • Meeting notes
  • Transcript availability

Organizations handling confidential meetings may choose to limit some AI-generated meeting experiences.

5. Plugins and Connectors

Administrators can manage:

  • Microsoft Graph connectors
  • Third-party plugins
  • Custom connectors
  • Agent access to external systems

Disabling unnecessary plugins reduces security risk.

6. Copilot Agents

Administrators can control:

  • Which agents are available
  • Who can create agents
  • Who can publish agents
  • Which departments can access specific agents

For example:

Human Resources might publish an HR Benefits Agent while Finance publishes an Expense Policy Agent.

7. Web Grounding

Some Copilot experiences include information from:

  • Microsoft Graph
  • Public web content
  • Organizational content

Organizations may configure which experiences are available depending on licensing and organizational policies.

Features That Cannot Simply Be “Turned Off”

Some Copilot behaviors are governed by Microsoft 365 security rather than feature switches.

Examples include:

Microsoft Graph Permissions

Copilot never ignores permissions.

If a user lacks permission to a file:

  • Copilot cannot retrieve it.
  • There is no setting that overrides SharePoint permissions.

SharePoint Permissions

Copilot always honors:

  • Site permissions
  • Folder permissions
  • File permissions
  • Restricted SharePoint sites

Administrators manage access by changing SharePoint permissions—not Copilot settings.

Microsoft Purview Policies

If Microsoft Purview blocks data through:

  • Sensitivity labels
  • DLP policies
  • Retention policies

Copilot follows those controls automatically.

Microsoft Defender Policies

Security policies continue protecting data regardless of Copilot.

Examples include:

  • Safe Links
  • Safe Attachments
  • Threat protection
  • Malware detection

Copilot cannot bypass Defender protections.

Enabling Copilot Through Licensing

Most Copilot functionality depends on licensing.

Typical process:

  1. Purchase licenses.
  2. Assign licenses.
  3. Configure organizational settings.
  4. Enable users or groups.
  5. Monitor adoption.
  6. Expand deployment gradually.

Removing the license immediately removes access.

Feature Rollout Strategies

Many organizations deploy Copilot in phases.

Example rollout:

PhaseUsers
PilotIT department
Early adoptersBusiness champions
Department rolloutHR, Finance, Sales
Enterprise rolloutEntire organization

This minimizes disruption and allows administrators to gather feedback.

Feature Controls for Copilot Agents

Agent administrators can typically control:

  • Agent publishing
  • Agent availability
  • Knowledge sources
  • Connector permissions
  • Agent sharing
  • Agent lifecycle
  • Agent retirement

These settings help prevent unauthorized AI experiences.

Managing Experimental Features

Microsoft periodically releases:

  • Preview capabilities
  • Experimental AI experiences
  • Early-access functionality

Organizations can often choose whether these features are available.

Many enterprises disable preview features until internal testing is complete.

Monitoring Enabled Features

Administrators should monitor:

  • License assignments
  • Usage reports
  • Adoption metrics
  • Agent activity
  • Security alerts
  • Compliance reports
  • AI interactions (where supported)

Monitoring helps determine whether enabled features are providing value while remaining compliant.

Best Practices

Microsoft recommends:

  • Start with a pilot group.
  • Assign licenses only to intended users.
  • Review SharePoint permissions before deployment.
  • Apply Microsoft Purview protection policies first.
  • Enable only required plugins.
  • Monitor adoption regularly.
  • Review security settings before enabling new AI capabilities.
  • Use least-privilege access.
  • Periodically review agent permissions.
  • Train users before broad rollout.

Exam Tips

For the AB-900 exam, remember these key points:

  • Licensing is the primary method of enabling Microsoft 365 Copilot.
  • Administrators can enable or disable access for users and groups.
  • Copilot always respects Microsoft Graph permissions.
  • Microsoft Purview protections continue to apply to Copilot.
  • SharePoint permissions cannot be bypassed by Copilot.
  • Administrators can manage plugins, connectors, and agents.
  • Many organizations use phased deployments.
  • Security and governance controls remain in effect regardless of Copilot features.

10 Practice Exam Questions

Question 1

What is the primary requirement for a user to access Microsoft 365 Copilot?

A. Membership in the Global Readers group

B. Assignment of an appropriate Microsoft 365 Copilot license

C. Creation of a Copilot agent

D. A Microsoft Teams Premium license

Correct Answer: B

Explanation: A Microsoft 365 Copilot license is required before users can access Copilot experiences.

Question 2

An administrator wants to introduce Copilot to only the IT department before rolling it out company-wide. What is the recommended approach?

A. Disable Microsoft Graph

B. Remove SharePoint permissions

C. Assign Copilot licenses only to the IT department

D. Create separate Microsoft 365 tenants

Correct Answer: C

Explanation: Administrators commonly pilot Copilot by assigning licenses only to selected users or groups.

Question 3

Which security principle does Microsoft 365 Copilot always follow?

A. It ignores file permissions for administrators.

B. It grants temporary access to files during conversations.

C. It respects existing Microsoft Graph and Microsoft 365 permissions.

D. It automatically shares documents across departments.

Correct Answer: C

Explanation: Copilot only accesses content the user already has permission to view.

Question 4

Which capability can administrators commonly control?

A. Whether users can access Copilot agents

B. Whether Copilot can ignore sensitivity labels

C. Whether Microsoft Graph indexes SharePoint

D. Whether SharePoint stores documents

Correct Answer: A

Explanation: Administrators can manage agent availability, publication, and access permissions.

Question 5

What happens if a user’s Microsoft 365 Copilot license is removed?

A. Existing AI conversations become public.

B. SharePoint permissions are deleted.

C. Copilot access is removed from that user.

D. Microsoft Graph stops indexing organizational content.

Correct Answer: C

Explanation: Removing the Copilot license removes the user’s entitlement to Copilot services.

Question 6

Which Microsoft technology automatically continues enforcing sensitivity labels when users work with Copilot?

A. Microsoft Defender for Endpoint

B. Microsoft Purview

C. Microsoft Intune

D. Microsoft Planner

Correct Answer: B

Explanation: Microsoft Purview applies data protection controls, including sensitivity labels, regardless of whether Copilot is used.

Question 7

Why might an organization disable certain Copilot plugins?

A. To reduce security risks from unnecessary external integrations

B. To increase Microsoft Graph indexing speed

C. To improve Outlook mailbox quotas

D. To eliminate SharePoint storage limits

Correct Answer: A

Explanation: Limiting plugins reduces the organization’s attack surface and helps maintain governance.

Question 8

Which feature continues protecting documents even after Copilot is enabled?

A. Microsoft Graph indexing

B. Microsoft Purview DLP policies

C. Copilot prompts

D. AI-generated summaries

Correct Answer: B

Explanation: Data Loss Prevention policies remain fully enforced when Copilot accesses organizational data.

Question 9

What is a common best practice when deploying Microsoft 365 Copilot?

A. Enable every Copilot feature for all employees immediately.

B. Remove SharePoint permissions before deployment.

C. Begin with a pilot deployment and expand gradually.

D. Disable Microsoft Purview during rollout.

Correct Answer: C

Explanation: A phased rollout allows administrators to validate security, governance, and user adoption before organization-wide deployment.

Question 10

Which statement about SharePoint permissions and Copilot is correct?

A. Copilot can temporarily bypass SharePoint permissions.

B. Copilot automatically grants access to related files.

C. Administrators can disable SharePoint permissions while keeping Copilot enabled.

D. Copilot only accesses SharePoint content the user is already authorized to view.

Correct Answer: D

Explanation: Copilot always honors existing SharePoint permissions and cannot access content beyond the user’s authorized access.

Go to the AB-900 Exam Prep Hub main page

AB-900, Agentic AI, AI, Generative AI, Microsoft Certification

Compare Copilot monthly license model to Pay-as-You-Go, including SharePoint (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Perform basic administrative tasks for Copilot and agents (25–30%)
   --> Understand features and capabilities of Copilot and agents
      --> Compare Copilot monthly license model to Pay-as-You-Go, including SharePoint

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Microsoft offers multiple licensing models for AI experiences across Microsoft 365. Understanding these licensing options is important for administrators who plan deployments, manage costs, and determine which AI capabilities are available to users.

For the AB-900 exam, you should understand the differences between:

  • Microsoft 365 Copilot monthly user licensing
  • Pay-as-you-go (consumption-based) licensing
  • SharePoint Copilot licensing
  • When each licensing model is appropriate

The exam focuses on understanding the concepts rather than memorizing pricing.

Why Multiple Licensing Models Exist

Organizations vary greatly in how employees use AI.

Some organizations:

  • Have employees who use AI all day.
  • Need AI integrated into Microsoft 365 apps.
  • Require predictable monthly costs.

Other organizations:

  • Use AI occasionally.
  • Need specialized agents.
  • Want to pay only when AI is used.

Microsoft therefore offers both subscription-based and consumption-based licensing.

Microsoft 365 Copilot Monthly License Model

The traditional Microsoft 365 Copilot license is assigned to individual users.

Each licensed user receives access to Copilot experiences across supported Microsoft 365 applications.

Examples include:

  • Word
  • Excel
  • PowerPoint
  • Outlook
  • Teams
  • OneNote
  • Microsoft 365 Chat

The license is:

  • Assigned per user
  • Monthly subscription
  • Predictable recurring cost

Characteristics of the Monthly License

The monthly model provides:

  • Full Microsoft 365 Copilot experience
  • Unlimited daily usage (subject to service limits)
  • Personalized AI assistance
  • Microsoft Graph integration
  • Cross-app experiences
  • Enterprise security and compliance

This model is best for employees who regularly use Copilot throughout their workday.

Typical Monthly License Scenario

A financial analyst uses Copilot every day to:

  • Analyze Excel workbooks
  • Draft reports
  • Summarize meetings
  • Create PowerPoint presentations
  • Search organizational knowledge

Because AI is used continuously, a monthly license provides predictable costs.

Benefits of Monthly Licensing

Advantages include:

  • Predictable budgeting
  • No need to monitor consumption
  • Continuous access
  • Simplified administration
  • Consistent user experience
  • Ideal for heavy users

Limitations of Monthly Licensing

Considerations include:

  • Fixed monthly cost regardless of usage
  • Not ideal for occasional users
  • Every user requires their own license
  • Organizations may over-license infrequent users

Pay-as-You-Go Licensing

Pay-as-you-go (PAYG) is a consumption-based licensing model.

Instead of paying for every user every month, organizations pay based on actual AI usage.

Think of it similarly to cloud computing services:

  • More usage = higher cost
  • Less usage = lower cost

Characteristics of Pay-as-You-Go

Pay-as-you-go provides:

  • Usage-based billing
  • Flexible scaling
  • No requirement for every user to have a monthly Copilot license
  • Cost based on AI requests or service consumption (depending on the service)

This model is especially useful for agents and certain AI scenarios.

Benefits of Pay-as-You-Go

Advantages include:

  • Lower upfront costs
  • Pay only for actual usage
  • Flexible deployment
  • Easy experimentation
  • Ideal for seasonal workloads
  • Good for occasional users

Limitations of Pay-as-You-Go

Potential drawbacks include:

  • Variable monthly costs
  • Budget forecasting is more difficult
  • Requires monitoring usage
  • Heavy usage may become more expensive than subscription licensing

Comparing Monthly Licensing and Pay-as-You-Go

Monthly LicensePay-as-You-Go
Fixed monthly costUsage-based cost
Licensed per userConsumption-based
Predictable budgetingVariable spending
Best for daily usersBest for occasional use
Continuous Copilot accessPay only when AI is used
Simpler cost managementRequires usage monitoring

Microsoft 365 Copilot Chat

Organizations should understand that Microsoft offers AI experiences beyond the traditional monthly Copilot license.

For example:

  • Microsoft 365 Copilot Chat is available to Microsoft 365 users.
  • Organizations can extend Copilot Chat with agents.
  • Some agent usage can be billed using pay-as-you-go licensing rather than requiring every user to have a full Copilot subscription.

This provides flexibility for organizations with mixed AI usage patterns.

SharePoint and Copilot

SharePoint includes AI capabilities that help users work with documents, sites, and organizational knowledge.

Examples include:

  • Summarizing documents
  • Answering questions about files
  • Generating page content
  • Assisting with document creation
  • Improving knowledge discovery

SharePoint Agents

One important capability is SharePoint agents.

A SharePoint agent can:

  • Be created from a SharePoint site or document library
  • Answer questions using approved SharePoint content
  • Help users locate organizational knowledge
  • Reduce the need to manually search documents

For example:

A Human Resources SharePoint site may contain:

  • Employee handbook
  • Benefits guide
  • Leave policies
  • Training documents

An HR SharePoint agent can answer employee questions using those documents.

SharePoint Pay-as-You-Go

Organizations can use SharePoint agents without assigning every user a full Microsoft 365 Copilot license.

Instead, administrators can configure consumption-based billing.

Benefits include:

  • Lower cost for occasional users
  • Easy pilot deployments
  • Department-specific AI
  • Flexible scaling

This makes SharePoint agents attractive for organizations wanting targeted AI experiences without licensing every employee.

Choosing the Right Licensing Model

Choose Monthly Licensing When

  • Employees use Copilot every day.
  • AI is integrated into daily workflows.
  • Predictable monthly budgeting is important.
  • Users need full Copilot functionality across Microsoft 365.

Examples:

  • Executives
  • Project managers
  • Analysts
  • Consultants
  • Sales professionals
  • Knowledge workers

Choose Pay-as-You-Go When

  • AI usage is occasional.
  • Organizations are testing AI.
  • Departments need specialized agents.
  • Seasonal usage is expected.
  • Budget flexibility is acceptable.

Examples:

  • HR help desk agent
  • Legal document agent
  • IT support chatbot
  • SharePoint knowledge assistant

Administrative Considerations

Administrators should evaluate:

  • Expected AI usage
  • Number of users
  • Cost predictability
  • Department requirements
  • Governance policies
  • Licensing strategy
  • Agent deployment plans

Security Remains the Same

Regardless of licensing model:

  • Microsoft Entra ID authentication is used.
  • Microsoft Graph permissions are enforced.
  • Microsoft Purview policies apply.
  • Data Loss Prevention (DLP) policies remain active.
  • Sensitivity labels continue protecting content.
  • Microsoft Defender protections remain in effect.

Licensing changes how organizations pay for AI—not how Microsoft secures organizational data.

Best Practices

Microsoft recommends that organizations:

  • License frequent users with Microsoft 365 Copilot subscriptions.
  • Use pay-as-you-go for occasional AI usage.
  • Monitor AI adoption and consumption.
  • Start with pilot deployments.
  • Evaluate SharePoint agents for departmental knowledge scenarios.
  • Review licensing regularly as adoption increases.

Exam Tips

For the AB-900 exam, remember these key points:

  • Microsoft 365 Copilot is commonly licensed per user with a monthly subscription.
  • Pay-as-you-go bills organizations based on AI usage.
  • Monthly licensing provides predictable costs.
  • Pay-as-you-go offers flexibility for occasional or specialized AI use.
  • SharePoint agents can be deployed using consumption-based licensing in supported scenarios.
  • Licensing affects billing—not security or permissions.
  • Microsoft Graph, Microsoft Purview, and Microsoft Entra ID protections apply regardless of licensing model.
  • Heavy AI users are generally better suited to monthly licensing.
  • Departmental or pilot AI deployments often benefit from pay-as-you-go.

Practice Exam Questions

Question 1

Which licensing model provides users with a predictable monthly cost for Microsoft 365 Copilot?

A. Pay-as-you-go
B. Monthly per-user license
C. Azure consumption credits
D. SharePoint storage licensing

Correct Answer: B

Explanation: A monthly per-user license provides continuous access to Microsoft 365 Copilot for a fixed monthly subscription.

Question 2

What is the primary advantage of the pay-as-you-go licensing model?

A. Users receive unlimited AI usage regardless of activity.
B. Organizations pay only for actual AI usage.
C. Every employee automatically receives Microsoft 365 Copilot.
D. It disables Microsoft Graph integration.

Correct Answer: B

Explanation: Pay-as-you-go charges based on consumption, making it suitable for occasional or specialized AI usage.

Question 3

Which type of user is generally the best candidate for a Microsoft 365 Copilot monthly license?

A. An employee who rarely uses Microsoft 365 applications
B. A seasonal contractor who accesses AI once a month
C. A knowledge worker who uses Copilot throughout the workday
D. A visitor with guest access to SharePoint

Correct Answer: C

Explanation: Heavy or daily users benefit from the predictable costs and continuous access provided by the monthly licensing model.

Question 4

An organization wants to deploy an HR SharePoint agent that employees will use occasionally. Which licensing model is often the better fit?

A. Monthly Copilot license for every employee
B. Windows Enterprise licensing
C. Exchange Online licensing
D. Pay-as-you-go

Correct Answer: D

Explanation: Pay-as-you-go is well suited for departmental agents with occasional usage, allowing organizations to pay based on consumption.

Question 5

Which statement about Microsoft 365 Copilot monthly licensing is correct?

A. It charges only when AI is used.
B. It is assigned to individual users as a subscription.
C. It replaces Microsoft Entra ID.
D. It is available only for SharePoint.

Correct Answer: B

Explanation: The traditional Microsoft 365 Copilot model is licensed per user through a recurring subscription.

Question 6

Which capability is commonly associated with SharePoint agents?

A. Managing Windows updates
B. Replacing Microsoft Graph
C. Answering questions using SharePoint content and document libraries
D. Creating Azure virtual machines

Correct Answer: C

Explanation: SharePoint agents are grounded in SharePoint content and help users locate and understand organizational knowledge.

Question 7

How do Microsoft Purview policies behave when an organization switches from monthly licensing to pay-as-you-go?

A. They are automatically disabled.
B. They apply only to SharePoint documents.
C. They require users to purchase additional licenses before functioning.
D. They continue to protect data regardless of the licensing model.

Correct Answer: D

Explanation: Security and compliance controls such as Microsoft Purview continue to protect data regardless of how AI services are licensed.

Question 8

Which licensing model generally provides the most predictable monthly budgeting?

A. Pay-as-you-go
B. Monthly per-user licensing
C. Azure Reserved Instances
D. SharePoint storage quotas

Correct Answer: B

Explanation: Monthly licensing offers a fixed recurring cost, simplifying budgeting and financial planning.

Question 9

What is a potential disadvantage of pay-as-you-go licensing?

A. It cannot be used with agents.
B. It prevents users from accessing SharePoint.
C. Monthly costs may vary depending on AI usage.
D. It disables Microsoft Graph permissions.

Correct Answer: C

Explanation: Consumption-based billing means costs fluctuate according to actual usage, making budgeting less predictable.

Question 10

Which statement best summarizes the difference between Microsoft 365 Copilot monthly licensing and pay-as-you-go?

A. Monthly licensing is subscription-based, while pay-as-you-go is consumption-based.
B. Monthly licensing does not include Microsoft Graph.
C. Pay-as-you-go removes Microsoft Purview protections.
D. Monthly licensing is only available for SharePoint.

Correct Answer: A

Explanation: The fundamental difference is the billing model: monthly licensing charges a fixed subscription per user, whereas pay-as-you-go charges based on actual AI service consumption.

Go to the AB-900 Exam Prep Hub main page

AB-900, Agentic AI, AI, Microsoft Certification

Compare the built-in capabilities of Copilot and agents (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Perform basic administrative tasks for Copilot and agents (25–30%)
   --> Understand features and capabilities of Copilot and agents
      --> Compare the built-in capabilities of Copilot and agents

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Microsoft 365 provides powerful AI capabilities through Microsoft 365 Copilot and agents. Although they are closely related, they serve different purposes.

A common misconception is that Copilot and agents are the same technology. In reality:

  • Microsoft 365 Copilot is the AI assistant that helps users work across Microsoft 365 applications.
  • Agents are specialized AI assistants designed to perform focused tasks, automate business processes, or provide expertise in specific domains.

Understanding the differences between Copilot and agents is an important objective on the AB-900 exam.

What is Microsoft 365 Copilot?

Microsoft 365 Copilot is Microsoft’s AI assistant integrated throughout Microsoft 365 applications.

It combines:

  • Large Language Models (LLMs)
  • Microsoft Graph
  • Microsoft 365 data
  • User permissions
  • Organizational knowledge

Copilot helps users complete everyday work faster while respecting existing security permissions.

Examples include:

  • Drafting emails
  • Summarizing meetings
  • Creating PowerPoint presentations
  • Analyzing Excel data
  • Writing Word documents
  • Answering natural language questions
  • Summarizing Teams chats

Copilot is designed to improve personal productivity across many different tasks.

What are Microsoft 365 Agents?

Agents are AI assistants created to perform specialized or repeatable business tasks.

Rather than serving as a general assistant, an agent focuses on a specific job.

Examples include:

  • HR policy assistant
  • IT help desk assistant
  • Sales proposal assistant
  • Customer service assistant
  • Legal document assistant
  • Procurement assistant
  • Finance assistant

Agents can:

  • Answer questions from approved knowledge sources
  • Follow business rules
  • Guide users through processes
  • Complete multi-step workflows
  • Connect to business systems

Comparing Copilot and Agents

Microsoft 365 CopilotMicrosoft 365 Agents
General-purpose AI assistantSpecialized AI assistant
Works across Microsoft 365Focuses on a specific business task
Assists individual productivityAssists business processes
Uses Microsoft Graph extensivelyCan use Graph plus additional knowledge sources
Available in Microsoft 365 appsCan be published inside Teams, Microsoft 365, SharePoint, and other experiences
Broad conversational abilitiesDomain-specific expertise

Built-in Capabilities of Microsoft 365 Copilot

Copilot includes many built-in features without requiring customization.

Content Creation

Copilot can:

  • Draft documents
  • Rewrite text
  • Summarize documents
  • Change writing tone
  • Generate presentations
  • Create outlines
  • Brainstorm ideas

Example:

“Create a proposal for a new customer.”

Meeting Intelligence

Within Microsoft Teams, Copilot can:

  • Summarize meetings
  • Capture decisions
  • List action items
  • Answer questions about the meeting
  • Identify unresolved issues

Example:

“What decisions were made during yesterday’s meeting?”

Email Assistance

In Outlook, Copilot can:

  • Draft responses
  • Summarize long email threads
  • Suggest follow-up actions
  • Improve writing style

Data Analysis

Within Excel, Copilot can:

  • Explain formulas
  • Generate charts
  • Analyze trends
  • Identify outliers
  • Create summaries

Example:

“Show quarterly sales trends.”

Knowledge Discovery

Copilot searches organizational knowledge using Microsoft Graph.

It can answer questions such as:

  • “What projects am I working on?”
  • “Summarize documents related to Project Apollo.”
  • “What files has my manager recently shared?”

Cross-Application Context

One major capability is connecting information across applications.

Example:

Copilot may combine information from:

  • Outlook
  • Teams
  • Word
  • OneDrive
  • SharePoint
  • Calendar

to answer a single prompt.

Built-in Capabilities of Agents

Agents focus on completing specialized work.

Task-Specific Expertise

An agent is trained or configured around one topic.

Examples:

HR Agent

  • Vacation policy
  • Benefits
  • Employee handbook

IT Agent

  • Password reset guidance
  • Software installation
  • Device troubleshooting

Finance Agent

  • Expense reimbursement
  • Budget approval
  • Procurement rules

Business Process Guidance

Agents can walk users through business procedures.

Example:

Instead of simply answering a question, an HR onboarding agent can:

  • Explain required forms
  • Guide new employees
  • Answer benefits questions
  • Provide training links

Knowledge Grounding

Agents can use approved organizational knowledge.

Examples include:

  • SharePoint libraries
  • Internal documents
  • Knowledge bases
  • Business manuals
  • Policies
  • FAQs

Unlike general internet chatbots, agents only answer from approved sources.

Workflow Automation

Agents can perform multiple steps automatically.

Example:

A travel request agent might:

  • Collect travel details
  • Validate policy
  • Request manager approval
  • Submit the request
  • Notify the employee

Connectors

Agents can connect to external business systems.

Examples:

  • Dynamics 365
  • ServiceNow
  • Salesforce
  • SAP
  • Workday
  • Microsoft Dataverse

This allows agents to retrieve business information securely.

Consistent Business Responses

Unlike free-form conversations, agents provide consistent answers based on organizational knowledge.

This reduces confusion and improves compliance.

Shared Capabilities

Both Copilot and agents share many AI features.

These include:

  • Natural language interaction
  • Context-aware conversations
  • AI-generated responses
  • Respect for Microsoft Entra ID permissions
  • Security trimming
  • Microsoft Graph integration (where applicable)
  • Use of Large Language Models
  • Support for Microsoft 365 security and compliance controls

Key Differences

Scope

Copilot

Broad productivity assistant.

Agent

Focused business assistant.

Purpose

Copilot

Helps users complete work.

Agent

Helps complete specific business processes.

Knowledge

Copilot

Uses Microsoft Graph plus organizational content.

Agent

Uses selected knowledge sources chosen by administrators or creators.

Customization

Copilot

Little customization required.

Agents

Often customized for departments or business scenarios.

Reusability

Copilot

Same assistant for everyone (subject to permissions).

Agents

Different agents can exist for different teams.

Examples:

  • Legal Agent
  • Sales Agent
  • Finance Agent
  • HR Agent

Copilot vs. Agent Example

A user asks:

“I need to prepare for a customer renewal.”

Copilot might:

  • Summarize recent emails
  • Review meeting notes
  • Draft a proposal
  • Create a PowerPoint

A Sales Agent might:

  • Retrieve CRM information
  • Check renewal status
  • Calculate discounts
  • Recommend pricing
  • Generate renewal documentation

Both assist the user—but in different ways.

Security

Both Copilot and agents follow Microsoft security principles.

They respect:

  • Microsoft Entra ID authentication
  • User permissions
  • Microsoft Graph security trimming
  • Microsoft Purview sensitivity labels
  • Data Loss Prevention (DLP) policies
  • Conditional Access policies
  • Compliance controls

Neither Copilot nor agents expose information users are not authorized to access.

Common Exam Tips

Remember these distinctions:

  • Copilot is a general-purpose AI assistant.
  • Agents are specialized assistants for business scenarios.
  • Copilot improves productivity across Microsoft 365.
  • Agents automate or simplify specific business tasks.
  • Both use natural language.
  • Both respect existing Microsoft 365 permissions.
  • Agents can connect to external business systems.
  • Multiple agents can exist within the same organization.
  • Copilot does not replace business applications—it works with them.
  • Administrators govern both using Microsoft 365 security and compliance controls.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft 365 Copilot?

A. Replace business applications
B. Provide a general AI assistant across Microsoft 365 applications
C. Manage Microsoft Entra ID users
D. Automatically configure SharePoint permissions

Correct Answer: B

Explanation: Microsoft 365 Copilot is a general-purpose AI assistant that enhances productivity across Microsoft 365 applications.

Question 2

Which scenario is best suited for a Microsoft 365 agent?

A. Creating a PowerPoint presentation from meeting notes
B. Summarizing an Outlook inbox
C. Guiding employees through HR onboarding procedures
D. Drafting a Word document

Correct Answer: C

Explanation: Agents are designed for specialized business tasks such as HR onboarding, IT support, or finance workflows.

Question 3

Which feature is shared by both Microsoft 365 Copilot and agents?

A. They ignore Microsoft Entra permissions.
B. They require internet searches for every response.
C. They automatically grant file access.
D. They support natural language conversations.

Correct Answer: D

Explanation: Both Copilot and agents use conversational AI, allowing users to interact using natural language.

Question 4

Which capability is unique to many business agents?

A. Creating Word documents
B. Summarizing Teams meetings
C. Performing specialized workflows using business systems
D. Rewriting email messages

Correct Answer: C

Explanation: Agents can automate specialized business workflows and connect with enterprise systems.

Question 5

Microsoft 365 Copilot primarily retrieves organizational information through:

A. Microsoft Graph
B. Azure Virtual Desktop
C. Windows Registry
D. Local device storage

Correct Answer: A

Explanation: Microsoft Graph provides Copilot with secure access to organizational data while respecting user permissions.

Question 6

Which statement best describes Microsoft 365 agents?

A. They replace Microsoft Graph.
B. They are designed for focused business scenarios and specialized tasks.
C. They only answer questions about Microsoft products.
D. They are available only in Outlook.

Correct Answer: B

Explanation: Agents are purpose-built AI assistants that support specific business processes or departmental functions.

Question 7

How do Copilot and agents protect organizational data?

A. They bypass file permissions for administrators.
B. They make all SharePoint content searchable.
C. They respect existing Microsoft 365 permissions and compliance controls.
D. They permanently copy data into AI models.

Correct Answer: C

Explanation: Both solutions honor Microsoft Entra ID permissions, Microsoft Graph security trimming, and Microsoft Purview governance policies.

Question 8

Which task would Microsoft 365 Copilot most likely perform?

A. Reset a user’s Active Directory password automatically.
B. Analyze an Excel workbook and explain sales trends.
C. Replace the organization’s CRM system.
D. Configure Conditional Access policies.

Correct Answer: B

Explanation: Copilot excels at productivity tasks such as analyzing Excel data and generating insights.

Question 9

An organization creates separate HR, Legal, and Finance AI assistants. These are examples of:

A. Microsoft Graph connectors
B. SharePoint hubs
C. Copilot prompts
D. Specialized agents

Correct Answer: D

Explanation: Organizations can build multiple specialized agents tailored to different departments and business functions.

Question 10

What is one of the biggest differences between Microsoft 365 Copilot and agents?

A. Copilot is a broad productivity assistant, while agents focus on specific business tasks.
B. Agents do not use AI.
C. Copilot ignores Microsoft 365 permissions.
D. Agents cannot access organizational knowledge.

Correct Answer: A

Explanation: Copilot provides broad productivity assistance across Microsoft 365, whereas agents are designed for specialized business scenarios and targeted workflows.

Go to the AB-900 Exam Prep Hub main page

AI, Microsoft Certification, AI Security, AB-900

Understand how Copilot uses permissions and other controls in Microsoft 365, Microsoft Purview, and Microsoft Defender to protect against risks (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand data security implications of Copilot
      --> Understand how Copilot uses permissions and other controls in Microsoft 365, Microsoft Purview, and Microsoft Defender to protect against risks

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important security concepts for the AB-900 exam is understanding how Microsoft 365 Copilot protects organizational data. Because Copilot can access and summarize information from across Microsoft 365, organizations must ensure that sensitive information remains protected and that users only receive information they are authorized to access.

Microsoft 365 Copilot does not operate independently of an organization’s security framework. Instead, it inherits and respects the security, compliance, governance, and protection controls already configured in Microsoft 365. These controls come primarily from:

  • Microsoft 365 permissions
  • Microsoft Entra ID
  • Microsoft Purview
  • Microsoft Defender
  • SharePoint and OneDrive security
  • Teams security controls

Together, these technologies ensure that Copilot delivers useful responses while minimizing the risk of unauthorized access, data leakage, compliance violations, and insider threats.

The Security Foundation of Copilot

Microsoft 365 Copilot is built on three key principles:

  1. Access only authorized data
  2. Respect existing security controls
  3. Apply compliance and governance policies automatically

Copilot does not create new permissions.

Instead, it uses the permissions already assigned to users and resources throughout Microsoft 365.

This means that if a user cannot access a file directly, they also cannot access that file through Copilot.

Permission Trimming: The Core Security Mechanism

The most important security concept related to Copilot is permission trimming.

Permission trimming ensures that Copilot only retrieves information the user is authorized to access.

When a user submits a prompt:

  1. Microsoft Graph searches organizational data.
  2. Existing permissions are evaluated.
  3. Unauthorized content is excluded.
  4. Only authorized information is sent to the large language model.

For example:

  • HR files are accessible only to HR employees.
  • Finance reports are accessible only to finance personnel.
  • Confidential legal documents remain restricted to legal teams.

If another employee asks Copilot about those documents, the information is not included in the response.

How Microsoft 365 Permissions Protect Data

Microsoft 365 permissions form the first layer of Copilot security.

Permissions are inherited from services such as:

  • SharePoint Online
  • OneDrive for Business
  • Microsoft Teams
  • Exchange Online
  • Microsoft Loop

Examples include:

SharePoint Permissions

Users can only access sites, libraries, folders, and files for which they have permissions.

OneDrive Permissions

Users can access their own files and content explicitly shared with them.

Teams Permissions

Copilot respects team membership and channel access.

Exchange Permissions

Emails and calendar data are only available to authorized users.

Because Copilot uses Microsoft Graph, these permissions are automatically enforced.

Role of Microsoft Entra ID

Microsoft Entra ID provides identity and access management for Microsoft 365.

Copilot relies on Entra ID to verify:

  • User identity
  • Group membership
  • Role assignments
  • Conditional Access policies
  • Authentication status

Entra ID ensures that only authenticated and authorized users can access Microsoft 365 resources.

Examples

A Conditional Access policy may require:

  • Multifactor authentication (MFA)
  • Compliant devices
  • Approved locations

If requirements are not met, users may be blocked from accessing Microsoft 365 resources and Copilot.

How Microsoft Purview Protects Data Used by Copilot

Microsoft Purview provides compliance, governance, and data protection controls.

Because Copilot works with organizational content, Purview protections automatically apply to data used by Copilot.

Sensitivity Labels

Sensitivity labels classify and protect content.

Common labels include:

  • Public
  • General
  • Confidential
  • Highly Confidential

Labels can enforce:

  • Encryption
  • Access restrictions
  • Watermarking
  • Content markings

If a document is protected by a sensitivity label, Copilot respects those protections.

Data Loss Prevention (DLP)

DLP policies help prevent sensitive information from being exposed.

Examples include:

  • Credit card numbers
  • Social Security numbers
  • Healthcare records
  • Financial information

DLP policies can:

  • Detect sensitive data
  • Block sharing
  • Generate alerts
  • Notify administrators

Copilot interactions remain subject to DLP protections.

Data Classification

Microsoft Purview can automatically classify content based on:

  • Sensitive information types
  • Trainable classifiers
  • Custom classifications

This classification helps organizations understand what information exists and where risks may be present.

Retention Policies

Retention policies ensure information is retained or deleted according to organizational requirements.

Copilot only works with content that remains available within Microsoft 365 according to retention settings.

Data Security Posture Management (DSPM) for AI

DSPM for AI helps organizations identify and reduce AI-related risks.

DSPM can:

  • Discover overshared content
  • Identify risky permissions
  • Detect exposure of sensitive data
  • Recommend remediation actions

This is especially important because Copilot may reveal risks that already exist due to improper permissions.

How Microsoft Defender Protects Copilot Environments

Microsoft Defender provides threat detection, prevention, and response capabilities.

Defender helps protect both the data Copilot accesses and the users interacting with Copilot.

Microsoft Defender XDR

Microsoft Defender XDR provides:

  • Cross-domain threat detection
  • Incident correlation
  • Security investigation
  • Automated response

It helps security teams identify attacks that may affect Copilot-accessible data.

Identity Protection

Microsoft Defender and Entra ID can detect:

  • Risky sign-ins
  • Credential theft
  • Impossible travel events
  • Suspicious account activity

Compromised identities can be blocked before attackers access Copilot.

Endpoint Protection

Microsoft Defender for Endpoint protects devices used to access Copilot.

It helps detect:

  • Malware
  • Ransomware
  • Unauthorized access attempts
  • Device compromise

Threat Intelligence

Microsoft Defender uses global threat intelligence to identify:

  • Known malicious actors
  • Emerging threats
  • Attack techniques

This helps reduce the likelihood that attackers gain access to sensitive organizational information.

Oversharing Risks and Copilot

Copilot does not create oversharing problems.

However, it can expose existing oversharing issues more efficiently.

For example:

If a confidential SharePoint folder has accidentally been shared with all employees:

  • Employees may not discover the folder manually.
  • Copilot may locate relevant content and summarize it.

Because of this, organizations should regularly review:

  • File permissions
  • Site permissions
  • Group memberships
  • Sharing settings

DSPM for AI helps identify these risks.

Security Controls Working Together

The protection of Copilot data relies on multiple layers:

Security LayerPurpose
Microsoft Entra IDIdentity verification and access control
Conditional AccessRestrict access based on risk and conditions
Microsoft 365 PermissionsControl resource access
Microsoft GraphApplies permission trimming
Microsoft PurviewGovernance, compliance, and data protection
Microsoft DefenderThreat detection and response
DSPM for AIAI-specific risk identification

These controls work together to create a secure AI environment.

Key Exam Tips

For the AB-900 exam, remember the following:

  • Copilot does not bypass existing permissions.
  • Permission trimming ensures users only see authorized content.
  • Microsoft Graph enforces access controls during data retrieval.
  • Microsoft Entra ID provides identity and access management.
  • Conditional Access can restrict Copilot access based on organizational policies.
  • Microsoft Purview protects data through sensitivity labels, DLP, classification, retention, and DSPM for AI.
  • Microsoft Defender protects identities, endpoints, and organizational resources from threats.
  • Copilot may reveal existing oversharing risks but does not create them.
  • DSPM for AI helps organizations identify and remediate AI-related data exposure risks.

Practice Exam Questions

Question 1

What security mechanism ensures that Copilot only retrieves information a user is authorized to access?

A. Endpoint isolation
B. Data retention
C. Data replication
D. Permission trimming

Answer: D

Explanation: Permission trimming evaluates a user’s permissions and excludes unauthorized content from Copilot responses.

Question 2

A user asks Copilot about a confidential HR document they do not have permission to view. What will happen?

A. Copilot summarizes the document anyway
B. Copilot requests administrator approval automatically
C. The document is excluded from the response due to permission trimming
D. The document is copied into the user’s OneDrive

Answer: C

Explanation: Copilot respects existing permissions and cannot retrieve content users are not authorized to access.

Question 3

Which Microsoft service provides the identity platform that Copilot relies on for authentication and authorization?

A. Microsoft Defender XDR
B. Microsoft Entra ID
C. Microsoft Purview Insider Risk Management
D. Microsoft Intune

Answer: B

Explanation: Microsoft Entra ID manages identities, authentication, authorization, and access controls for Microsoft 365 services.

Question 4

Which Microsoft Purview capability helps prevent sensitive information such as credit card numbers from being improperly shared?

A. Retention policies
B. Conditional Access
C. Privileged Identity Management
D. Data Loss Prevention (DLP)

Answer: D

Explanation: DLP policies detect and protect sensitive information by blocking or monitoring risky sharing activities.

Question 5

What is the primary purpose of sensitivity labels in Microsoft Purview?

A. Manage operating system updates
B. Monitor network performance
C. Classify and protect content based on sensitivity levels
D. Create backup copies of documents

Answer: C

Explanation: Sensitivity labels classify content and can apply protections such as encryption and access restrictions.

Question 6

Which Microsoft Purview solution helps organizations discover overshared content that may present AI-related risks?

A. Data Security Posture Management (DSPM) for AI
B. Microsoft Planner
C. Exchange Online Protection
D. Windows Defender Firewall

Answer: A

Explanation: DSPM for AI identifies sensitive data exposure risks and recommends remediation actions.

Question 7

How does Microsoft Defender help protect environments that use Copilot?

A. By creating user accounts automatically
B. By replacing Microsoft Entra ID permissions
C. By detecting threats, compromised identities, and suspicious activities
D. By bypassing DLP policies

Answer: C

Explanation: Microsoft Defender provides threat detection, investigation, and response capabilities that protect organizational resources.

Question 8

Which statement best describes the relationship between Copilot and oversharing?

A. Copilot automatically fixes overshared content
B. Copilot creates oversharing by default
C. Copilot ignores shared permissions entirely
D. Copilot may reveal existing oversharing issues because it can efficiently locate accessible content

Answer: D

Explanation: Copilot does not create oversharing problems but can make improperly shared content easier to discover.

Question 9

Which security control can require multifactor authentication before a user accesses Microsoft 365 resources and Copilot?

A. SharePoint version history
B. Conditional Access
C. Retention labels
D. Exchange journaling

Answer: B

Explanation: Conditional Access policies can require MFA, compliant devices, or other conditions before granting access.

Question 10

Which statement about Copilot security is correct?

A. Copilot has unrestricted access to all tenant data.
B. Copilot ignores Microsoft Purview protections.
C. Copilot only follows Microsoft Defender policies.
D. Copilot inherits existing Microsoft 365 permissions and compliance controls.

Answer: D

Explanation: Copilot respects permissions, security settings, compliance policies, and governance controls already configured within Microsoft 365.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, Microsoft Certification

Understand how Microsoft Graph influences Copilot responses (AB-900 Exam Prep)

 
This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
   --> Understand data security implications of Copilot
      --> Understand how Microsoft Graph influences Copilot responses

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important concepts for the AB-900 exam is understanding how Microsoft 365 Copilot generates responses. Many users assume that Copilot simply searches documents and emails. In reality, Microsoft 365 Copilot relies heavily on Microsoft Graph to provide personalized, context-aware, and permission-trimmed responses.

Understanding the relationship between Microsoft Graph and Copilot is essential because it explains why Copilot can provide relevant answers, summarize organizational information, and generate content based on a user’s work data while maintaining security boundaries.

What Is Microsoft Graph?

Microsoft Graph is Microsoft’s unified API and data layer that connects information across Microsoft 365 services.

It serves as a central gateway to organizational data stored in services such as:

  • Microsoft Outlook
  • Microsoft Teams
  • Microsoft SharePoint
  • Microsoft OneDrive
  • Microsoft Exchange Online
  • Microsoft Planner
  • Microsoft To Do
  • Microsoft Entra ID
  • Microsoft Loop
  • Microsoft Viva

Microsoft Graph not only stores references to data but also understands the relationships between people, files, meetings, emails, chats, and organizational activities.

Think of Microsoft Graph as the intelligence layer that helps Microsoft 365 understand:

  • Who users are
  • What content they can access
  • Which colleagues they work with
  • What meetings they attend
  • Which documents they frequently use
  • How information is connected across the organization

How Microsoft 365 Copilot Uses Microsoft Graph

Microsoft 365 Copilot combines:

  1. Large Language Models (LLMs)
  2. Microsoft Graph
  3. Microsoft 365 applications

When a user submits a prompt, Copilot does not rely solely on the LLM’s pre-trained knowledge.

Instead, Copilot uses Microsoft Graph to retrieve relevant organizational data and then grounds the LLM’s response using that data.

This process helps ensure responses are:

  • Relevant
  • Up-to-date
  • Personalized
  • Context-aware
  • Based on enterprise data

The Copilot Response Process

A simplified workflow looks like this:

Step 1: User Submits a Prompt

Example:

“Summarize the project status for the Contoso migration project.”

Step 2: Copilot Queries Microsoft Graph

Microsoft Graph searches organizational data that the user is permitted to access, including:

  • Project documents
  • Emails
  • Teams conversations
  • Meeting notes
  • SharePoint files

Step 3: Relevant Information Is Retrieved

Graph identifies content related to:

  • The project
  • Team members
  • Recent updates
  • Supporting documents

Step 4: Grounding Occurs

The retrieved business information is provided to the LLM.

This process is known as grounding.

Grounding helps ensure the response is based on actual organizational data rather than relying only on the model’s training data.

Step 5: Copilot Generates a Response

The LLM combines:

  • User prompt
  • Retrieved Graph data
  • Application context

to generate a final response.

What Is Grounding?

Grounding is one of the most important concepts for the AB-900 exam.

Grounding refers to supplying real organizational data from Microsoft Graph to the large language model before it generates a response.

Without grounding:

  • Responses could be generic
  • Information could be outdated
  • Answers would lack organizational context

With grounding:

  • Responses are more accurate
  • Responses are personalized
  • Responses reflect current business information

Why Microsoft Graph Improves Copilot Responses

Microsoft Graph helps Copilot provide responses that are:

Personalized

Different users receive different answers because they have access to different data.

Example:

A manager may receive a project summary containing budget information.

A team member may receive the same summary without budget details if they lack permission.

Context-Aware

Graph understands relationships between:

  • People
  • Teams
  • Projects
  • Meetings
  • Documents

Example:

When a user asks:

“What happened in yesterday’s meeting?”

Copilot can locate:

  • Meeting recordings
  • Meeting transcripts
  • Chat discussions
  • Shared files

and generate a summary.

Current

Unlike the LLM’s training data, Microsoft Graph accesses live Microsoft 365 information.

This allows Copilot to work with:

  • Today’s emails
  • Current documents
  • Recent chats
  • New meeting notes

Relevant

Graph helps prioritize information most closely related to the user’s work activities.

As a result, Copilot can identify content likely to be useful rather than searching randomly across the organization.

Microsoft Graph Connectors

Organizations often store information outside Microsoft 365.

Microsoft Graph Connectors allow external content to be indexed and accessed through Microsoft Graph.

Examples include:

  • ServiceNow
  • Salesforce
  • Confluence
  • Jira
  • File shares
  • Custom business systems

When properly configured, Copilot can use connected external data as part of its grounding process.

This expands the knowledge available to Copilot beyond Microsoft 365 content.

Security and Permission Trimming

A critical exam concept is that Microsoft Graph enforces existing permissions.

Copilot cannot bypass security controls.

This is called permission trimming.

When Graph retrieves data:

  • User permissions are evaluated.
  • Only accessible content is returned.
  • Unauthorized content is excluded.

As a result:

  • Copilot only sees what the user can see.
  • Users cannot retrieve restricted documents through Copilot.
  • Existing Microsoft 365 security controls remain in effect.

Examples of Microsoft Graph Influencing Copilot

Example 1: Meeting Summaries

Prompt:

“Summarize my meetings from this week.”

Graph provides:

  • Calendar events
  • Meeting transcripts
  • Chat messages
  • Shared files

Copilot generates a personalized summary.

Example 2: Document Creation

Prompt:

“Create a proposal using our latest marketing plan.”

Graph retrieves:

  • Marketing documents
  • Recent presentations
  • Strategy files

Copilot uses this information to draft the proposal.

Example 3: Team Updates

Prompt:

“What is the latest status of the migration project?”

Graph gathers:

  • Team conversations
  • Project files
  • Status reports
  • Meeting notes

Copilot generates an informed status summary.

Benefits of Microsoft Graph for Copilot

Microsoft Graph provides several advantages:

Better Accuracy

Responses are grounded in organizational data.

Personalization

Responses reflect the user’s work context.

Real-Time Information

Current business data can be used.

Security

Permission trimming protects sensitive information.

Cross-Application Insights

Information can be gathered from multiple Microsoft 365 services.

Key Exam Tips

For the AB-900 exam, remember:

  • Microsoft Graph is the data and relationship layer of Microsoft 365.
  • Copilot combines LLMs with Microsoft Graph data.
  • Grounding provides organizational data to improve response quality.
  • Microsoft Graph retrieves information from Microsoft 365 services.
  • Copilot respects existing permissions.
  • Permission trimming ensures users only receive data they are authorized to access.
  • Microsoft Graph Connectors can extend Copilot to external systems.
  • Microsoft Graph enables personalized and context-aware responses.

Practice Exam Questions

Question 1

What is the primary role of Microsoft Graph in Microsoft 365 Copilot?

A. Train large language models
B. Store Copilot prompts permanently
C. Provide organizational data and context for responses
D. Replace Microsoft Entra ID authentication

Answer: C

Explanation: Microsoft Graph provides organizational data and relationships that Copilot uses to generate personalized and grounded responses.

Question 2

What process occurs when Copilot uses organizational data to improve the accuracy of a response?

A. Classification
B. Grounding
C. Encryption
D. Federation

Answer: B

Explanation: Grounding is the process of supplying relevant organizational data from Microsoft Graph to the language model before generating a response.

Question 3

Which Microsoft 365 service helps Copilot understand relationships among people, files, meetings, and communications?

A. Microsoft Defender XDR
B. Microsoft Purview
C. Microsoft Intune
D. Microsoft Graph

Answer: D

Explanation: Microsoft Graph provides relationship intelligence across Microsoft 365 services and organizational data.

Question 4

A user asks Copilot to summarize a project. Which source is most likely retrieved through Microsoft Graph?

A. Public internet websites only
B. Operating system registry settings
C. Organizational emails, files, and chats the user can access
D. Device firmware information

Answer: C

Explanation: Microsoft Graph retrieves relevant Microsoft 365 content that the user is authorized to access.

Question 5

Why might two users receive different Copilot responses to the same prompt?

A. Microsoft Graph uses permission-trimmed access to data
B. Copilot randomly changes responses
C. Different users run different operating systems
D. Copilot ignores organizational security controls

Answer: A

Explanation: Responses depend on what data each user is authorized to access through Microsoft Graph.

Question 6

What is the benefit of grounding in Microsoft 365 Copilot?

A. Reduces storage requirements
B. Disables user permissions
C. Makes responses more relevant and based on current business data
D. Eliminates the need for Microsoft Graph

Answer: C

Explanation: Grounding helps ensure responses are accurate, contextual, and based on organizational information.

Question 7

Which statement best describes permission trimming?

A. Copilot grants temporary administrative access to users
B. Copilot can access all organizational content regardless of permissions
C. Permissions are evaluated only after a response is generated
D. Only content a user is authorized to access is available to Copilot

Answer: D

Explanation: Permission trimming ensures that Copilot only retrieves and uses data that the user already has permission to view.

Question 8

What can Microsoft Graph Connectors enable?

A. Replacement of Microsoft Entra ID
B. Access to external business data sources through Microsoft Graph
C. Automatic deletion of all external content
D. Disabling Microsoft 365 search

Answer: B

Explanation: Graph Connectors allow organizations to bring external content sources into Microsoft Graph for search and Copilot experiences.

Question 9

Which Microsoft Graph capability most directly helps Copilot create personalized responses?

A. Relationship awareness across users, documents, meetings, and activities
B. Operating system patch management
C. Network packet inspection
D. Hardware monitoring

Answer: A

Explanation: Microsoft Graph understands relationships among organizational resources and activities, enabling personalized responses.

Question 10

When a user submits a prompt to Microsoft 365 Copilot, what generally happens first?

A. Copilot immediately generates a response without retrieving data
B. The user’s device is scanned for malware
C. Microsoft Graph retrieves relevant authorized organizational information
D. All tenant data is copied into the language model

Answer: C

Explanation: Before generating a response, Copilot typically retrieves relevant data through Microsoft Graph to ground the response in current organizational context.

Go to the AB-900 Exam Prep Hub main page

AB-731, AI, AI Strategy, Microsoft Certification

Map business processes and use cases to Copilot (AB-731 Exam Prep)

 
This post is a part of the AB-731: AI Transformation Leader Exam Prep Hub.
This topic falls under these sections:
Identify benefits, capabilities, and opportunities for Microsoft’s AI apps and services (35–40%)
   --> Identify benefits and capabilities of Microsoft 365 Copilot and Microsoft Copilot
      --> Map business processes and use cases to Copilot

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important responsibilities of an AI Transformation Leader is identifying where AI can deliver measurable business value. Microsoft Copilot solutions are most effective when they are aligned with existing business processes and specific user needs.

Rather than implementing AI for its own sake, organizations should first understand their workflows, pain points, and desired outcomes. Once these are identified, leaders can map appropriate Microsoft Copilot capabilities to those scenarios.

For the AB-731 exam, you should understand:

  • How business processes relate to Copilot use cases.
  • Which departments benefit from Copilot solutions.
  • The difference between Microsoft Copilot and Microsoft 365 Copilot.
  • How Copilot improves productivity and collaboration.
  • Factors to consider when selecting Copilot scenarios.
  • Examples of common business use cases.

Understanding Business Processes

A business process is a sequence of activities performed to achieve a business objective.

Examples include:

  • Responding to customer inquiries.
  • Preparing financial reports.
  • Creating marketing campaigns.
  • Managing employee onboarding.
  • Conducting project meetings.
  • Producing sales proposals.

Business processes often contain repetitive, manual, or time-consuming tasks that are candidates for AI assistance.

Why Mapping Processes to Copilot Matters

Successful AI adoption focuses on business outcomes rather than technology alone.

Proper mapping helps organizations:

  • Increase productivity.
  • Reduce manual work.
  • Improve employee experiences.
  • Accelerate decision-making.
  • Enhance collaboration.
  • Generate faster returns on AI investments.

The goal is to identify tasks where Copilot augments human work rather than replaces people.

Microsoft Copilot vs. Microsoft 365 Copilot

Microsoft Copilot

Microsoft Copilot provides AI assistance across Microsoft products and services and can answer questions, generate content, and assist with everyday tasks.

Examples include:

  • Web research
  • Drafting content
  • Summarizing information
  • Brainstorming ideas

Microsoft 365 Copilot

Microsoft 365 Copilot integrates with organizational data and Microsoft 365 applications, including:

  • Word
  • Excel
  • PowerPoint
  • Outlook
  • Teams

It uses business context and user permissions to provide more personalized assistance.

Steps for Mapping Business Processes to Copilot

Step 1: Identify Business Goals

Examples:

  • Reduce administrative workload.
  • Improve customer satisfaction.
  • Increase employee productivity.
  • Accelerate document creation.

Step 2: Identify Pain Points

Examples:

  • Excessive time spent writing emails.
  • Meeting overload.
  • Difficulty locating information.
  • Repetitive reporting tasks.

Step 3: Analyze Existing Workflows

Determine:

  • Which tasks are repetitive?
  • Which tasks involve large amounts of information?
  • Which activities require content generation?
  • Which processes consume excessive employee time?

Step 4: Match Copilot Capabilities

Determine whether Copilot can:

  • Summarize.
  • Draft.
  • Analyze.
  • Organize.
  • Automate.
  • Retrieve information.

Step 5: Measure Business Value

Possible metrics include:

  • Time savings.
  • Reduced manual effort.
  • Increased employee satisfaction.
  • Faster response times.
  • Improved productivity.

Common Copilot Use Cases by Department

Executive Leadership

Executives often need:

  • Meeting summaries.
  • Strategic insights.
  • Email prioritization.
  • Presentation preparation.

Copilot value:

  • Saves time.
  • Accelerates decision-making.
  • Improves productivity.

Human Resources

HR teams perform tasks such as:

  • Writing job descriptions.
  • Employee onboarding.
  • Policy documentation.
  • Candidate communication.

Copilot value:

  • Faster document creation.
  • Consistent communication.
  • Reduced administrative effort.

Sales Teams

Sales professionals frequently:

  • Prepare proposals.
  • Write customer emails.
  • Review meeting notes.
  • Research opportunities.

Copilot value:

  • Faster proposal generation.
  • Improved customer engagement.
  • Increased selling time.

Marketing Teams

Marketing departments create:

  • Campaign content.
  • Social media posts.
  • Product descriptions.
  • Presentations.

Copilot value:

  • Faster content production.
  • Improved creativity.
  • Increased consistency.

Finance Departments

Finance teams work with:

  • Budgets.
  • Reports.
  • Forecasts.
  • Data analysis.

Copilot value:

  • Faster analysis.
  • Improved reporting.
  • Reduced manual effort.

Customer Service

Support teams often:

  • Answer repetitive questions.
  • Create responses.
  • Search documentation.
  • Summarize cases.

Copilot value:

  • Faster resolutions.
  • Improved customer experiences.
  • Reduced workload.

Project Management

Project managers frequently:

  • Schedule meetings.
  • Summarize discussions.
  • Track action items.
  • Produce status reports.

Copilot value:

  • Improved coordination.
  • Better visibility.
  • Less administrative work.

Microsoft 365 Application Scenarios

Word

Common uses:

  • Draft reports.
  • Rewrite content.
  • Summarize documents.
  • Create proposals.

Business Benefit

Faster document creation.

Excel

Common uses:

  • Analyze trends.
  • Generate formulas.
  • Create summaries.
  • Explore datasets.

Business Benefit

Improved data analysis.

PowerPoint

Common uses:

  • Build presentations.
  • Generate slides.
  • Summarize documents into decks.

Business Benefit

Reduced presentation preparation time.

Outlook

Common uses:

  • Draft emails.
  • Summarize conversations.
  • Prioritize messages.

Business Benefit

Improved communication efficiency.

Teams

Common uses:

  • Meeting summaries.
  • Action items.
  • Conversation recaps.

Business Benefit

Enhanced collaboration.

Characteristics of Good Copilot Use Cases

The best scenarios usually involve:

Repetitive Work

Examples:

  • Email responses.
  • Report generation.
  • Meeting notes.

Information Overload

Examples:

  • Long documents.
  • Large email chains.
  • Numerous meetings.

Content Creation

Examples:

  • Proposals.
  • Presentations.
  • Marketing content.

Knowledge Retrieval

Examples:

  • Finding policies.
  • Reviewing documents.
  • Locating project information.

Human Oversight

AI-generated outputs should still be reviewed by people.

Scenarios Less Suitable for Copilot

Copilot should not replace:

  • Final legal judgments.
  • Medical diagnoses.
  • Compliance decisions.
  • Sensitive approvals.
  • Tasks requiring specialized human expertise.

Copilot augments human work rather than eliminating accountability.

Measuring Success

Organizations can evaluate Copilot adoption using metrics such as:

  • Hours saved.
  • Employee satisfaction.
  • Increased productivity.
  • Reduced turnaround times.
  • Improved quality.
  • User adoption rates.

Successful AI projects focus on measurable business outcomes.

Example Mapping Table

Business NeedProcessCopilot CapabilityBenefit
Reduce email workloadCommunicationDrafting emailsTime savings
Improve meetingsCollaborationMeeting summariesBetter follow-up
Create reports fasterDocumentationContent generationIncreased productivity
Analyze dataReportingExcel assistanceFaster insights
Prepare presentationsCommunicationSlide generationReduced effort
Answer common questionsSupportKnowledge retrievalImproved service

Best Practices for AI Transformation Leaders

Start with Business Problems

Do not begin with technology. Begin with desired outcomes.

Target High-Value Processes

Focus on areas where productivity gains are measurable.

Pilot Before Scaling

Start with small deployments and expand based on results.

Maintain Human Oversight

People remain responsible for final decisions.

Measure ROI

Track whether Copilot delivers business value.

Encourage Adoption

Provide training and change management support.

Exam Tips

For the AB-731 exam, remember:

  • Copilot use cases should align with business processes.
  • Repetitive and information-heavy tasks are ideal candidates.
  • Microsoft 365 Copilot works within Microsoft 365 applications and organizational data.
  • Copilot enhances productivity rather than replacing employees.
  • Human review remains important.
  • Successful implementations focus on measurable business outcomes.
  • Different departments may use Copilot differently.

Practice Exam Questions

Question 1

A company wants to reduce the amount of time employees spend writing emails. Which Copilot use case best aligns with this requirement?

A. Generating meeting room reservations
B. Drafting email responses in Outlook
C. Replacing identity management systems
D. Managing network infrastructure

Answer: B

Explanation: Outlook Copilot can draft and summarize emails, reducing communication overhead.

Question 2

Which type of task is generally the best candidate for Copilot assistance?

A. Emergency medical diagnosis
B. Repetitive and information-heavy work
C. Final legal approval decisions
D. Physical equipment maintenance

Answer: B

Explanation: Copilot provides the greatest value when assisting with repetitive tasks and large amounts of information.

Question 3

A marketing department wants to create campaign content more quickly. Which Microsoft 365 application would provide the most direct Copilot support?

A. Defender
B. Entra ID
C. Word
D. Intune

Answer: C

Explanation: Word Copilot assists with content creation, rewriting, and drafting documents.

Question 4

Why should organizations map business processes before deploying Copilot?

A. To increase token consumption
B. To replace all employees
C. To eliminate governance requirements
D. To align AI capabilities with business outcomes

Answer: D

Explanation: AI projects are most successful when they address real business problems.

Question 5

Which department would most likely benefit from Copilot-generated meeting summaries and action items?

A. Facilities Management
B. Project Management
C. Manufacturing Operations
D. Physical Security

Answer: B

Explanation: Project managers frequently coordinate meetings and track follow-up activities.

Question 6

Which Microsoft 365 application is especially useful for creating presentations with Copilot?

A. PowerPoint
B. Outlook
C. Teams
D. OneNote

Answer: A

Explanation: PowerPoint Copilot can generate and organize presentation content.

Question 7

What is one important characteristic of a successful Copilot implementation?

A. Avoid measuring outcomes.
B. Eliminate human involvement.
C. Focus on measurable business value.
D. Replace existing business processes immediately.

Answer: C

Explanation: AI initiatives should be evaluated based on business impact and ROI.

Question 8

Which scenario demonstrates information overload where Copilot can add value?

A. Reviewing long email chains and meeting transcripts
B. Replacing firewall hardware
C. Installing operating systems
D. Repairing network cables

Answer: A

Explanation: Copilot excels at summarizing large amounts of information.

Question 9

Which statement best describes the purpose of Microsoft 365 Copilot?

A. It replaces human decision-making.
B. It integrates AI capabilities into Microsoft 365 applications and organizational data.
C. It functions only as an internet search engine.
D. It eliminates the need for collaboration tools.

Answer: B

Explanation: Microsoft 365 Copilot uses Microsoft 365 apps and enterprise context to assist users.

Question 10

Which approach should an AI Transformation Leader follow when introducing Copilot?

A. Begin with technology and determine business value later.
B. Deploy to every employee simultaneously.
C. Remove existing workflows before testing.
D. Start with high-value business problems and scale gradually.

Answer: D

Explanation: Starting with targeted business scenarios and expanding over time reduces risk and improves adoption.

Go to the AB-731 Exam Prep Hub main page

AI, AI Strategy, Analytics, Artificial Intelligence (AI), Data Careers, Data Education & Training, Data News, Data Strategy, Generative AI, Large Language Models (LLMs), Machine Learning (ML), Natural Language Processing (NLP), Uncategorized

The 20 Best AI Tools to Learn for 2026

Artificial intelligence is no longer a niche skill reserved for researchers and engineers—it has become a core capability across nearly every industry. From data analytics and software development to marketing, design, and everyday productivity, AI tools are reshaping how work gets done. As we move into 2026, the pace of innovation continues to accelerate, making it essential to understand not just what AI can do, but which tools are worth learning and why.

This article highlights 20 of the most important AI tools to learn for 2026, spanning general-purpose AI assistants, developer frameworks, creative platforms, automation tools, and autonomous agents. For each tool, you’ll find a clear description, common use cases, reasons it matters, cost considerations, learning paths, and an estimated difficulty level—helping you decide where to invest your time and energy in the rapidly evolving AI landscape. However, even if you don’t learn any of these tools, you should spend the time to learn one or more other AI tool(s) this year.

1. ChatGPT (OpenAI)

Description: A versatile large language model (LLM) that can write, research, code, summarize, and more. Often used for general assistance, content creation, dialogue systems, and prototypes.
Why It Matters: It’s the Swiss Army knife of AI — foundational in productivity, automation, and AI literacy.
Cost: Free tier; Plus/Pro tiers ~$20+/month with faster models and priority access.
How to Learn: Start by using the official tutorials, prompt engineering guides, and building integrations via the OpenAI API.
Difficulty: Beginner

2. Google Gemini / Gemini 3

Description: A multimodal AI from Google that handles text, image, and audio queries, and integrates deeply with Google Workspace. Latest versions push stronger reasoning and creative capabilities. Android Central
Why It Matters: Multimodal capabilities are becoming standard; integration across tools makes it essential for workflows.
Cost: Free tier with paid Pro/Ultra levels for advanced models.
How to Learn: Use Google AI Studio, experiment with prompts, and explore the API.
Difficulty: Beginner–Intermediate

3. Claude (Anthropic)

Description: A conversational AI with long-context handling and enhanced safety features. Excellent for deep reasoning, document analysis, and coding. DataNorth AI
Why It Matters: It’s optimized for enterprise and technical tasks where accuracy over verbosity is critical.
Cost: Free and subscription tiers (varies by use case).
How to Learn: Tutorials via Anthropic’s docs, hands-on in Claude UI/API, real projects like contract analysis.
Difficulty: Intermediate

4. Microsoft Copilot (365 + Dev)

Description: AI assistant built into Microsoft 365 apps and developer tools, helping automate reports, summaries, and code generation.
Why It Matters: It brings AI directly into everyday productivity tools at enterprise scale.
Cost: Included with M365 and GitHub subscriptions; Copilot versions vary by plan.
How to Learn: Microsoft Learn modules and real workflows inside Office apps.
Difficulty: Beginner

5. Adobe Firefly

Description: A generative AI suite focused on creative tasks, from text-to-image/video to editing workflows across Adobe products. Wikipedia
Why It Matters: Creative AI is now essential for design and branding work at scale.
Cost: Included in Adobe Creative Cloud subscriptions (varies).
How to Learn: Adobe tutorials + hands-on in Firefly Web and apps.
Difficulty: Beginner–Intermediate

6. TensorFlow

Description: Open-source deep learning framework from Google used to build and deploy neural networks. Wikipedia
Why It Matters: Core tool for anyone building machine learning models and production systems.
Cost: Free/open source.
How to Learn: TensorFlow courses, hands-on projects, and official tutorials.
Difficulty: Intermediate

7. PyTorch

Description: Another dominant open-source deep learning framework, favored for research and flexibility.
Why It Matters: Central for prototyping new models and customizing architectures.
Cost: Free.
How to Learn: Official tutorials, MOOCs, and community notebooks (e.g., Fast.ai).
Difficulty: Intermediate

8. Hugging Face Transformers

Description: A library of pre-trained models for language and multimodal tasks.
Why It Matters: Makes state-of-the-art models accessible with minimal coding.
Cost: Free; paid tiers for hosted inference.
How to Learn: Hugging Face courses, hands-on fine-tuning tasks.
Difficulty: Intermediate

9. LangChain

Description: Framework to build chain-based, context-aware LLM applications and agents.
Why It Matters: Foundation for building smart workflows and agent applications.
Cost: Free (open-source).
How to Learn: LangChain docs and project tutorials.
Difficulty: Intermediate–Advanced

10. Google Antigravity IDE

Description: AI-first coding environment where AI agents assist development workflows. Wikipedia
Why It Matters: Represents the next step in how developers interact with code — AI as partner.
Cost: Free preview; may move to paid models.
How to Learn: Experiment with projects, follow Google documentation.
Difficulty: Intermediate

11. Perplexity AI

Description: AI research assistant combining conversational AI with real-time web citations.
Why It Matters: Trusted research tool that avoids hallucinations by providing sources. The Case HQ
Cost: Free; Pro versions exist.
How to Learn: Use for query tasks, explore research workflows.
Difficulty: Beginner

12. Notion AI

Description: AI features embedded inside the Notion workspace for notes, automation, and content.
Why It Matters: Enhances organization and productivity in individual and team contexts.
Cost: Notion plans with AI add-ons.
How to Learn: In-app experimentation and productivity courses.
Difficulty: Beginner

13. Runway ML

Description: AI video and image creation/editing platform.
Why It Matters: Brings generative visuals to creators without deep technical skills.
Cost: Free tier with paid access to advanced models.
How to Learn: Runway tutorials and creative projects.
Difficulty: Beginner–Intermediate

14. Synthesia

Description: AI video generation with realistic avatars and multi-language support.
Why It Matters: Revolutionizes training and marketing video creation with low cost. The Case HQ
Cost: Subscription.
How to Learn: Platform tutorials, storytelling use cases.
Difficulty: Beginner

15. Otter.ai

Description: AI meeting transcription, summarization, and collaborative notes.
Why It Matters: Boosts productivity and meeting intelligence in remote/hybrid work. The Case HQ
Cost: Free + Pro tiers.
How to Learn: Use in real meetings; explore integrations.
Difficulty: Beginner

16. ElevenLabs

Description: High-quality voice synthesis and cloning for narration and media.
Why It Matters: Audio content creation is growing — podcasts, games, accessibility, and voice UX require this skill. TechRadar
Cost: Free + paid credits.
How to Learn: Experiment with voice models and APIs.
Difficulty: Beginner

17. Zapier / Make (Automation)

Description: Tools to connect apps and automate workflows with AI triggers.
Why It Matters: Saves time by automating repetitive tasks without code.
Cost: Free + paid plans.
How to Learn: Zapier/Make learning paths and real automation projects.
Difficulty: Beginner

18. MLflow

Description: Open-source ML lifecycle tool for tracking experiments and deploying models. Whizzbridge
Why It Matters: Essential for managing AI workflows in real projects.
Cost: Free.
How to Learn: Hands-on with ML projects and tutorials.
Difficulty: Intermediate

19. NotebookLM

Description: Research assistant for long-form documents and knowledge work.
Why It Matters: Ideal for digesting research papers, books, and technical documents. Reddit
Cost: Varies.
How to Learn: Use cases in academic and professional workflows.
Difficulty: Beginner

20. Manus (Autonomous Agent)

Description: A next-gen autonomous AI agent designed to reason, plan, and execute complex tasks independently. Wikipedia
Why It Matters: Represents the frontier of agentic AI — where models act with autonomy rather than just respond.
Cost: Web-based plans.
How to Learn: Experiment with agent workflows and task design.
Difficulty: Advanced

🧠 How to Get Started With Learning

1. Foundational Concepts:
Begin with basics: prompt engineering, AI ethics, and data fundamentals.

2. Hands-On Practice:
Explore tool documentation, build mini projects, and integrate APIs.

3. Structured Courses:
Platforms like Coursera, Udemy, and official provider academies offer guided paths.

4. Community & Projects:
Join GitHub projects, forums, and Discord groups focused on AI toolchains.

📊 Difficulty Levels (General)

LevelWhat It Means
BeginnerNo coding needed; great for general productivity/creators
IntermediateSome programming or technical concepts required
AdvancedDeep technical skills — frameworks, models, agents

Summary:
2026 will see AI tools become even more integrated into creativity, productivity, research, and automated workflows. Mastery over a mix of general-purpose assistants, developer frameworks, automation platforms, and creative AI gives you both breadth and depth in the evolving AI landscape. It’s going to be another exciting year.
Good luck on your data journey in 2026!