Tag: Microsoft Certification

Plan channels and deployment (AB-620 Exam Prep)

This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Plan and configure agent solutions (30–35%)
   --> Plan an agent solution
      --> Plan channels and deployment


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the final planning activities before building an AI agent is determining where users will interact with the agent and how the solution will be deployed. Even the most intelligent AI agent will not deliver business value if it is deployed to the wrong audience, through the wrong communication channels, or without proper governance.

In Microsoft Copilot Studio, channels are the communication platforms through which users interact with an agent, while deployment is the process of publishing, distributing, updating, and managing the agent across those channels.

For the AB-620 exam, you should understand how to:

  • Select the appropriate communication channels
  • Determine deployment strategies
  • Plan environments and lifecycle management
  • Consider authentication and security requirements
  • Plan for scalability and governance
  • Choose deployment approaches that align with business requirements

Planning these elements before implementation helps ensure that the agent reaches the intended users while remaining secure, manageable, and maintainable.


What Are Channels?

A channel is the interface through which users communicate with a Copilot Studio agent.

Examples include:

  • Microsoft Teams
  • Microsoft 365 Copilot
  • Web sites
  • Mobile applications
  • Custom applications
  • Omnichannel for Customer Service
  • Direct Line API
  • Custom integrations

Different channels serve different business needs and user experiences.


Why Channel Planning Is Important

Selecting the correct channel affects:

  • User adoption
  • Accessibility
  • Security
  • Authentication
  • User experience
  • Integration requirements
  • Deployment complexity
  • Maintenance

Choosing the wrong channel may result in poor usability, unnecessary development work, or security challenges.


Factors to Consider When Selecting Channels

When planning deployment channels, consider the following questions:

  • Who are the users?
  • Where do they already work?
  • What devices do they use?
  • Do they need authentication?
  • Is the audience internal or external?
  • Will users interact through text, voice, or both?
  • Does the channel support required features?
  • Are compliance requirements met?

These questions guide architects toward the most appropriate deployment strategy.


Common Deployment Channels

Microsoft Teams

Microsoft Teams is one of the most common deployment targets for Copilot Studio agents.

Typical scenarios include:

  • Employee self-service
  • IT help desk
  • HR support
  • Finance assistance
  • Internal knowledge search
  • Project management

Advantages include:

  • Integrated authentication with Microsoft Entra ID
  • Familiar user experience
  • Easy access for employees
  • Integration with Microsoft 365 services

Teams is generally the preferred channel for internal organizational agents.


Microsoft 365 Copilot

Organizations can integrate agents with Microsoft 365 Copilot to extend user capabilities across Microsoft applications.

Users may interact with agents while working in:

  • Outlook
  • Word
  • Excel
  • PowerPoint
  • Teams

Benefits include:

  • Seamless productivity workflows
  • Context-aware assistance
  • Access to Microsoft Graph data (subject to permissions)
  • Consistent user experience

Websites

Agents can be embedded into public or private websites.

Common uses include:

  • Customer support
  • Product information
  • FAQs
  • Sales assistance
  • Appointment scheduling

Website deployment is ideal for customer-facing solutions.


Mobile Applications

Organizations may embed agents into mobile apps.

Example scenarios:

  • Banking
  • Healthcare
  • Retail
  • Travel
  • Field service

Benefits include:

  • Convenient mobile access
  • Personalized experiences
  • Integration with mobile app functionality

Custom Applications

Organizations often integrate Copilot Studio agents into existing business applications.

Examples include:

  • ERP systems
  • CRM systems
  • Employee portals
  • Partner portals
  • Internal dashboards

This approach creates a unified experience without requiring users to switch applications.


Omnichannel for Customer Service

Customer service organizations often deploy agents through Omnichannel.

Benefits include:

  • Live agent handoff
  • Customer service routing
  • Persistent conversations
  • Integration with Dynamics 365 Customer Service

Direct Line API

The Direct Line API allows developers to integrate Copilot Studio agents into custom applications.

Advantages include:

  • Flexible deployment
  • Custom user interfaces
  • Mobile integration
  • Enterprise application integration

This option is best suited for organizations requiring customized experiences.


Internal vs. External Deployment

One of the first planning decisions is identifying the intended audience.

Internal Deployment

Internal users include:

  • Employees
  • Contractors
  • Business partners

Characteristics:

  • Microsoft Entra ID authentication
  • Enterprise security policies
  • Internal business systems
  • Sensitive organizational data

Examples:

  • HR assistant
  • IT help desk
  • Finance support

External Deployment

External users include:

  • Customers
  • Vendors
  • Citizens
  • Website visitors

Characteristics:

  • Public accessibility
  • Customer authentication (if required)
  • Strong security controls
  • High scalability

Examples:

  • Customer support
  • Product assistant
  • Service request agent

Authentication Considerations

Deployment planning should consider authentication requirements.

Examples:

Internal agents often use:

  • Microsoft Entra ID
  • Single Sign-On

Customer-facing agents may use:

  • Customer identity providers
  • OAuth
  • Anonymous access (when appropriate)

Authentication requirements often influence channel selection.


Deployment Environments

Copilot Studio solutions typically move through multiple environments during their lifecycle.

Common environments include:

Development

Purpose:

  • Build features
  • Experiment
  • Initial testing

Test

Purpose:

  • Functional testing
  • Integration testing
  • User acceptance testing (UAT)

Production

Purpose:

  • Live users
  • Business operations
  • Stable deployments

Separating environments reduces the risk of introducing untested changes into production.


Solution Lifecycle Management (ALM)

Deployment planning should include Application Lifecycle Management (ALM).

ALM includes:

  • Source control
  • Version management
  • Testing
  • Deployment
  • Rollback
  • Monitoring
  • Continuous improvement

A structured ALM process improves quality and reduces deployment risks.


Publishing an Agent

Before users can access an agent, it must be published.

Publishing typically includes:

  • Validating configuration
  • Saving changes
  • Publishing the latest version
  • Making updates available to deployment channels

Publishing does not automatically make every change visible until the updated version is deployed.


Version Management

Organizations should maintain multiple versions of their agents.

Benefits include:

  • Safe updates
  • Rollback capability
  • Controlled releases
  • Easier troubleshooting

Versioning is especially important for enterprise solutions with large user bases.


Environment Variables

Environment variables allow deployment configurations to change between environments without modifying the agent.

Examples:

  • API URLs
  • Database connections
  • Authentication endpoints
  • Service identifiers

Using environment variables simplifies deployments across development, testing, and production.


Security Considerations

Deployment planning should address:

  • Authentication
  • Authorization
  • Least privilege
  • Data protection
  • Conditional Access
  • Compliance
  • Data Loss Prevention (DLP)
  • Secure connectors

Security should be considered before deployment rather than after deployment.


Scalability Planning

Deployment planning should consider future growth.

Questions include:

  • How many users will access the agent?
  • Will usage spike during business hours?
  • Will multiple regions be supported?
  • How many enterprise integrations are involved?
  • Will additional channels be added later?

Planning for scalability helps prevent future redesigns.


User Experience Considerations

Choose channels based on how users naturally work.

Examples:

Employees:

  • Microsoft Teams
  • Microsoft 365

Customers:

  • Company website
  • Mobile application

Developers:

  • Custom applications
  • Direct Line API

A familiar interface increases adoption.


Monitoring After Deployment

Deployment planning should include monitoring.

Monitor:

  • Usage statistics
  • Conversation success rates
  • Escalations
  • Failed authentications
  • Connector failures
  • API errors
  • User satisfaction
  • Performance metrics

Monitoring provides insight into how the agent performs in production and supports continuous improvement.


Governance Considerations

Enterprise deployments should follow governance policies.

These include:

  • Environment management
  • Connector governance
  • DLP policies
  • Identity management
  • Approval processes
  • Version control
  • Compliance requirements

Proper governance ensures that deployments remain secure and manageable over time.


Common Deployment Mistakes

Avoid these common mistakes:

  • Deploying directly to production without testing
  • Using production for development
  • Ignoring authentication requirements
  • Choosing channels unfamiliar to users
  • Failing to plan for scalability
  • Publishing without user acceptance testing
  • Ignoring governance policies
  • Deploying with excessive permissions
  • Not monitoring post-deployment performance

Best Practices

When planning channels and deployment:

  • Choose channels based on user needs and business scenarios.
  • Use Microsoft Teams for many internal employee solutions.
  • Use websites or mobile apps for customer-facing experiences.
  • Separate development, test, and production environments.
  • Implement a structured ALM process.
  • Use environment variables to simplify deployments.
  • Plan authentication before deployment.
  • Apply least-privilege security.
  • Monitor deployments continuously.
  • Plan for future scalability and expansion.

Exam Tips

For the AB-620 exam, remember the following:

  • A channel is where users interact with an AI agent.
  • Microsoft Teams is commonly used for internal employee-facing agents.
  • Websites and mobile applications are common channels for customer-facing agents.
  • Direct Line API enables integration into custom applications.
  • Separate development, test, and production environments.
  • Publishing makes updated agent versions available for deployment.
  • ALM includes version control, testing, deployment, and monitoring.
  • Environment variables simplify deployments across environments.
  • Authentication requirements often influence channel selection.
  • Governance and monitoring are essential components of deployment planning.

Practice Exam Questions

Question 1

A company wants employees to access an HR assistant without leaving their daily collaboration platform. Which deployment channel is the most appropriate?

A. Public website

B. Microsoft Teams

C. Direct Line API

D. Mobile banking application

Correct Answer: B

Explanation: Microsoft Teams is the preferred deployment channel for many internal employee-facing agents because employees already use Teams for daily collaboration and authentication is integrated with Microsoft Entra ID.


Question 2

Which deployment approach best supports safe testing before an AI agent is made available to production users?

A. Develop and publish directly to production

B. Use only a single production environment

C. Use separate development, test, and production environments

D. Allow users to test new features in production before validation

Correct Answer: C

Explanation: Separate environments allow developers to build, test, validate, and approve changes before they reach production users, reducing deployment risk.


Question 3

An organization wants to integrate a Copilot Studio agent into a custom-built enterprise application with its own user interface. Which deployment option is most appropriate?

A. Microsoft Teams

B. Microsoft 365 Copilot

C. Omnichannel for Customer Service

D. Direct Line API

Correct Answer: D

Explanation: The Direct Line API enables developers to embed Copilot Studio agents into custom applications while maintaining complete control over the user experience.


Question 4

Which factor should be considered first when selecting deployment channels for an AI agent?

A. The preferred programming language of the development team

B. The color scheme of the organization’s website

C. The storage size of the deployment package

D. The users who will interact with the agent and where they work

Correct Answer: D

Explanation: Channel selection should be driven by business requirements and user needs, including where users work and how they prefer to access the agent.


Question 5

What is the primary purpose of publishing an agent in Copilot Studio?

A. To permanently archive the current version

B. To enable the latest validated version for deployment to configured channels

C. To delete previous versions of the agent

D. To automatically create a backup of all enterprise systems

Correct Answer: B

Explanation: Publishing makes the latest approved version of the agent available for deployment and use through its configured channels.


Question 6

Which deployment scenario is most appropriate for a customer support chatbot available to anyone visiting a company’s public website?

A. Microsoft Teams deployment

B. Internal employee portal

C. Website deployment

D. Microsoft Outlook add-in

Correct Answer: C

Explanation: Public websites are commonly used for customer-facing AI agents that provide product information, FAQs, and customer support.


Question 7

Why are environment variables recommended when planning deployments across development, test, and production environments?

A. They eliminate the need for authentication.

B. They allow environment-specific settings, such as API endpoints, without modifying the agent.

C. They automatically publish new agent versions.

D. They replace version control systems.

Correct Answer: B

Explanation: Environment variables store configuration values that differ between environments, making deployments easier and reducing the need to modify application logic.


Question 8

Which activity is part of Application Lifecycle Management (ALM)?

A. Limiting conversations to one deployment channel

B. Removing authentication requirements

C. Disabling monitoring after deployment

D. Managing version control, testing, deployment, and updates

Correct Answer: D

Explanation: ALM encompasses the processes required to develop, test, deploy, maintain, and improve applications throughout their lifecycle.


Question 9

Which consideration is most important when selecting a deployment channel for an internal finance agent that accesses sensitive company information?

A. Entertainment features available on the platform

B. Number of emojis supported

C. Authentication, authorization, and enterprise security integration

D. The number of background themes available

Correct Answer: C

Explanation: Internal agents that access sensitive data must support strong authentication, authorization, and enterprise security controls to protect organizational information.


Question 10

After deploying an AI agent to production, which practice best supports continuous improvement?

A. Prevent users from submitting feedback.

B. Disable logging to improve performance.

C. Republish the agent every day regardless of changes.

D. Monitor usage, failures, user satisfaction, and performance metrics.

Correct Answer: D

Explanation: Monitoring production usage and operational metrics helps identify issues, measure adoption, optimize performance, and guide future enhancements to the agent.


Go to the AB-620 Exam Prep Hub main page

Plan identity strategy (AB-620 Exam Prep)

This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Plan and configure agent solutions (30–35%)
   --> Plan an agent solution
      --> Plan identity strategy


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important planning activities when designing an AI agent is determining how the agent and its users will be identified, authenticated, and authorized. An effective identity strategy ensures that agents securely access enterprise resources while protecting sensitive organizational data.

In Microsoft Copilot Studio, an identity strategy defines:

  • How users sign in
  • How the agent authenticates to external systems
  • What permissions users and agents receive
  • How identities are managed across enterprise applications
  • How security policies are enforced
  • How compliance requirements are met

Identity planning is closely related to security planning. Before integrating an agent with Microsoft 365, Dynamics 365, SharePoint, Azure AI Search, REST APIs, or other enterprise systems, architects must determine how identities will be established and trusted.

For the AB-620 exam, you should understand the principles of identity management, authentication methods, authorization models, Microsoft Entra ID, delegated versus application permissions, service principals, managed identities, and least-privilege access.


Why an Identity Strategy Is Important

Without a well-designed identity strategy, an AI agent could:

  • Access unauthorized information
  • Perform actions it should not perform
  • Expose sensitive data
  • Violate compliance requirements
  • Create security vulnerabilities
  • Fail to authenticate with enterprise systems

A properly planned identity strategy ensures:

  • Secure user authentication
  • Secure system authentication
  • Appropriate authorization
  • Protection of enterprise resources
  • Regulatory compliance
  • Consistent user experiences

Identity should be planned before any integrations are implemented.


Key Identity Concepts

Understanding several core identity concepts is essential.

Identity

An identity represents a person, application, service, or device.

Examples include:

  • Employee
  • Customer
  • Administrator
  • AI agent
  • Service account
  • Application

Every identity has unique characteristics that distinguish it from others.


Authentication

Authentication answers the question:

Who are you?

Authentication verifies the identity of a user or application before granting access.

Common authentication methods include:

  • Username and password
  • Multi-factor authentication (MFA)
  • OAuth 2.0
  • OpenID Connect
  • Microsoft Entra ID sign-in
  • Certificate-based authentication

Successful authentication establishes trust.


Authorization

Authorization answers the question:

What are you allowed to do?

After authentication, authorization determines which resources the identity can access.

Examples:

  • View customer records
  • Create support tickets
  • Modify invoices
  • Delete files
  • Approve purchase requests

Authentication occurs first; authorization occurs second.


Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service.

It provides:

  • User authentication
  • Single Sign-On (SSO)
  • Conditional Access
  • Identity governance
  • Application registration
  • OAuth authorization
  • Enterprise identity management

Most enterprise Copilot Studio solutions use Microsoft Entra ID as their identity provider.


Single Sign-On (SSO)

Single Sign-On allows users to authenticate once and access multiple applications without repeatedly entering credentials.

Benefits include:

  • Better user experience
  • Reduced password fatigue
  • Improved security
  • Simplified administration

Example:

A user signs into Microsoft 365 and can then access a Copilot Studio agent, SharePoint, Outlook, and Dynamics 365 without additional sign-ins.


Multi-Factor Authentication (MFA)

MFA requires users to provide two or more forms of verification.

Examples include:

  • Password
  • Mobile authentication app
  • Text message
  • Hardware token
  • Biometric verification

MFA significantly reduces the risk of compromised credentials.

Organizations commonly require MFA for AI agents accessing sensitive business systems.


Delegated Permissions

Delegated permissions allow an application or agent to perform actions on behalf of a signed-in user.

The agent can only perform actions that the user is already authorized to perform.

Example:

An employee asks:

“Show me my support tickets.”

The agent retrieves only that employee’s tickets because it uses the employee’s delegated permissions.

Advantages:

  • User-specific security
  • Respects existing permissions
  • Simplifies auditing

Application Permissions

Application permissions allow an application to access resources independently of a signed-in user.

The application acts using its own identity.

Example:

A scheduled AI process updates inventory overnight.

No user is signed in.

The application authenticates using its own credentials.

Application permissions are common for background services and automation.


Service Principals

A service principal is the security identity created for an application within Microsoft Entra ID.

Rather than using a user account, applications authenticate using their own service principal.

Benefits include:

  • Secure application identity
  • Better auditing
  • Easier permission management
  • Reduced reliance on user accounts

Many enterprise integrations use service principals.


Managed Identities

Managed identities provide Azure services with automatically managed identities in Microsoft Entra ID.

Advantages include:

  • No password management
  • No stored credentials
  • Automatic credential rotation
  • Simplified security

Managed identities are recommended for Azure-hosted services whenever supported.


OAuth 2.0

OAuth 2.0 is the primary authorization framework used by many Microsoft services and external APIs.

Rather than sharing passwords, OAuth issues access tokens.

Typical OAuth flow:

  1. User signs in.
  2. Identity provider authenticates the user.
  3. An access token is issued.
  4. The agent presents the token to the target service.
  5. The service validates the token and authorizes access.

OAuth improves security by avoiding direct password sharing.


Access Tokens

An access token is a temporary credential issued after successful authentication.

Tokens contain information such as:

  • User identity
  • Application identity
  • Granted permissions (scopes)
  • Expiration time

Because tokens expire, they reduce the risk associated with stolen credentials.


Identity Providers

An identity provider (IdP) authenticates users and applications.

Examples include:

  • Microsoft Entra ID
  • Active Directory Federation Services (AD FS)
  • External OAuth providers
  • OpenID Connect providers

The identity provider establishes trust between the user and enterprise applications.


Planning Authentication for Enterprise Integrations

Every enterprise integration requires an authentication strategy.

Examples:

SystemTypical Authentication Method
Microsoft 365Microsoft Entra ID
Dynamics 365Microsoft Entra ID
SharePointMicrosoft Entra ID
Azure AI SearchMicrosoft Entra ID or API key
REST APIsOAuth, API key, or certificate
Custom applicationsOAuth or custom authentication

Architects should choose authentication methods supported by both Copilot Studio and the target system.


API Keys

Some external systems authenticate using API keys.

Advantages:

  • Simple implementation
  • Common with third-party APIs

Disadvantages:

  • Harder to rotate securely
  • Less granular permissions
  • Must be protected carefully

Whenever possible, OAuth is generally preferred over API keys because it provides stronger security and more flexible authorization.


Conditional Access

Conditional Access allows organizations to apply security policies based on specific conditions.

Policies may evaluate:

  • User identity
  • Device compliance
  • Geographic location
  • Risk level
  • Application
  • Network location

Examples:

  • Require MFA outside the corporate network.
  • Block access from high-risk countries.
  • Require managed devices for sensitive applications.

Conditional Access enhances security without changing application logic.


Least Privilege Principle

One of the most important identity planning principles is least privilege.

Grant only the permissions necessary to perform required tasks.

For example:

Instead of allowing an agent to modify every customer record, grant permission only to update support case statuses if that is all the agent requires.

Benefits include:

  • Reduced attack surface
  • Lower risk of accidental changes
  • Improved compliance
  • Easier auditing

Role-Based Access Control (RBAC)

RBAC assigns permissions based on roles instead of individual users.

Examples of roles:

  • Sales Representative
  • HR Manager
  • Finance Administrator
  • Customer Service Agent

The AI agent inherits permissions associated with the user’s assigned role.

RBAC simplifies administration and supports consistent security.


Identity for Multi-Agent Solutions

In multi-agent architectures, each agent may have its own identity and permissions.

Example:

  • HR agent accesses HR systems only.
  • Finance agent accesses accounting systems only.
  • IT agent accesses service management systems only.

Separating identities improves:

  • Security
  • Auditing
  • Governance
  • Maintainability

Avoid using one highly privileged identity for every agent.


Identity and Enterprise Knowledge

When agents retrieve enterprise knowledge from sources such as SharePoint or Azure AI Search, identity determines which documents users can access.

For example:

An HR employee may see personnel policies, while a sales employee sees only sales documentation.

Identity-aware retrieval helps ensure that users receive only the information they are authorized to access.


Compliance Considerations

Identity strategies often support compliance with organizational and regulatory requirements.

Examples include:

  • Audit logging
  • User accountability
  • Access reviews
  • Data protection
  • Separation of duties
  • Identity governance

Strong identity management helps organizations satisfy security and compliance standards.


Common Identity Planning Mistakes

Avoid these common mistakes:

  • Using shared user accounts for applications
  • Granting excessive permissions
  • Ignoring MFA requirements
  • Hardcoding credentials in applications
  • Failing to rotate API keys
  • Choosing application permissions when delegated permissions are sufficient
  • Forgetting Conditional Access requirements
  • Not documenting identity architecture
  • Giving every agent identical permissions

Best Practices

When planning an identity strategy:

  • Use Microsoft Entra ID whenever possible.
  • Enable Single Sign-On for a seamless user experience.
  • Require Multi-Factor Authentication for sensitive resources.
  • Prefer delegated permissions for user-driven interactions.
  • Use application permissions only when necessary.
  • Use managed identities for Azure-hosted services.
  • Apply the principle of least privilege.
  • Implement Role-Based Access Control.
  • Use OAuth instead of API keys whenever supported.
  • Separate identities for different agents and services.
  • Monitor authentication failures and access logs regularly.

Exam Tips

For the AB-620 exam, remember these key points:

  • Authentication verifies identity; authorization determines permissions.
  • Microsoft Entra ID is the primary identity provider for Microsoft cloud services.
  • Single Sign-On improves both usability and security.
  • MFA adds an additional layer of protection.
  • Delegated permissions operate on behalf of a signed-in user.
  • Application permissions allow applications to act independently.
  • Managed identities eliminate the need to manage credentials for Azure services.
  • Service principals represent applications in Microsoft Entra ID.
  • OAuth is generally preferred over API keys.
  • Always apply the principle of least privilege.

Practice Exam Questions

Question 1

A company wants its AI agent to access Microsoft 365 resources using the identity of the signed-in employee. Which permission model should be used?

A. Application permissions

B. Delegated permissions

C. Anonymous access

D. API key authentication

Correct Answer: B

Explanation: Delegated permissions allow the AI agent to perform actions on behalf of the signed-in user and respect that user’s existing permissions.


Question 2

What is the primary purpose of authentication?

A. Determine which resources a user can modify

B. Encrypt all enterprise data

C. Verify the identity of a user or application

D. Record audit logs

Correct Answer: C

Explanation: Authentication establishes who the user or application is before access decisions are made. Authorization determines what the authenticated identity can access.


Question 3

An Azure-hosted service needs to authenticate to Azure resources without storing passwords or secrets. Which identity solution is recommended?

A. Managed identity

B. API key

C. Shared service account

D. Username and password

Correct Answer: A

Explanation: Managed identities automatically manage credentials for Azure services, eliminating the need to store or rotate secrets.


Question 4

Which Microsoft service is the primary identity provider for Microsoft cloud applications and Copilot Studio integrations?

A. Azure AI Search

B. Microsoft Defender for Cloud

C. Microsoft Dataverse

D. Microsoft Entra ID

Correct Answer: D

Explanation: Microsoft Entra ID provides authentication, authorization, Single Sign-On, Conditional Access, and identity management for Microsoft cloud services.


Question 5

A background process updates inventory records every night without any user interaction. Which permission model is most appropriate?

A. Delegated permissions

B. Anonymous authentication

C. Application permissions

D. Guest user permissions

Correct Answer: C

Explanation: Application permissions allow applications to operate independently of a signed-in user, making them appropriate for scheduled or automated processes.


Question 6

Which security principle recommends granting only the permissions required to perform a specific task?

A. Defense in depth

B. Separation of duties

C. Zero Trust

D. Least privilege

Correct Answer: D

Explanation: The principle of least privilege minimizes security risks by limiting permissions to only those necessary for the required operations.


Question 7

Which authentication mechanism is generally preferred over API keys because it provides temporary access tokens and granular authorization?

A. Basic Authentication

B. OAuth 2.0

C. NTLM

D. Windows Authentication

Correct Answer: B

Explanation: OAuth 2.0 issues temporary access tokens instead of sharing passwords and supports fine-grained authorization scopes.


Question 8

What is the primary benefit of Single Sign-On (SSO)?

A. It permanently stores user credentials in every application.

B. It replaces authorization policies.

C. It allows users to authenticate once and access multiple trusted applications.

D. It eliminates the need for user identities.

Correct Answer: C

Explanation: Single Sign-On improves user experience and security by allowing one authentication session to provide access to multiple authorized applications.


Question 9

What is the purpose of a service principal in Microsoft Entra ID?

A. It represents an application or service as a security identity.

B. It stores enterprise knowledge for AI agents.

C. It replaces Conditional Access policies.

D. It creates Power Automate workflows.

Correct Answer: A

Explanation: A service principal is the identity used by an application or service to authenticate and access resources securely in Microsoft Entra ID.


Question 10

An organization requires users connecting from unmanaged devices to complete additional verification before accessing sensitive AI agents. Which capability addresses this requirement?

A. Role-Based Access Control

B. Managed identities

C. Conditional Access

D. Delegated permissions

Correct Answer: C

Explanation: Conditional Access evaluates conditions such as device compliance, location, and risk level to enforce security requirements like Multi-Factor Authentication before granting access.


Go to the AB-620 Exam Prep Hub main page

Plan integration with enterprise systems (AB-620 Exam Prep)

This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Plan and configure agent solutions (30–35%)
   --> Plan an agent solution
      --> Plan integration with enterprise systems


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern AI agents are most valuable when they can interact with enterprise systems rather than simply answer questions. In Microsoft Copilot Studio, enterprise integration enables agents to retrieve business data, perform actions, automate workflows, and collaborate with existing applications across an organization.

For the AB-620 exam, you should understand how to plan an integration strategy before building the agent. The exam focuses less on memorizing specific connectors and more on selecting the appropriate integration approach based on business requirements, security, scalability, maintainability, governance, and user experience.

Planning enterprise integration involves determining:

  • Which systems the agent must access
  • Whether the agent should read data, perform actions, or both
  • Which integration technology is most appropriate
  • How authentication and authorization will work
  • How enterprise knowledge should be grounded
  • How the solution will be governed and monitored

A well-designed integration strategy produces secure, scalable, maintainable AI solutions.


Why Enterprise Integration Matters

Without enterprise integration, an AI agent typically provides only general conversational capabilities.

Enterprise integration enables an agent to:

  • Retrieve customer information
  • Create support tickets
  • Update CRM records
  • Access ERP data
  • Search internal documentation
  • Submit approvals
  • Trigger workflows
  • Query databases
  • Interact with line-of-business applications
  • Coordinate work between multiple AI agents

The agent becomes an active participant in business processes rather than a passive chatbot.


Enterprise Systems Commonly Integrated

Organizations often connect Copilot Studio agents to:

Microsoft 365

Examples include:

  • Outlook
  • Teams
  • SharePoint
  • OneDrive
  • Planner

Example:

A user asks:

“Schedule a meeting with the finance team.”

The agent retrieves calendars and creates the meeting.


Dynamics 365

Examples include:

  • Customer Service
  • Sales
  • Finance
  • Field Service

Example:

“Show open opportunities for Contoso.”

The agent retrieves CRM data.


Power Platform

Including:

  • Power Automate
  • Power Apps
  • Dataverse

Example:

The agent launches an approval workflow using Power Automate.


External SaaS Applications

Examples include:

  • Salesforce
  • ServiceNow
  • Workday
  • SAP
  • Oracle
  • Jira
  • Zendesk

These are often accessed through connectors or REST APIs.


Custom Applications

Organizations frequently have internal systems.

Integration methods include:

  • REST APIs
  • Custom connectors
  • MCP servers
  • Azure services

Databases

Examples include:

  • Azure SQL
  • SQL Server
  • Oracle
  • PostgreSQL

Agents typically access these through APIs or Power Automate rather than direct database queries.


Types of Enterprise Integration

Integration generally falls into three categories.

1. Read Data

The agent retrieves information.

Examples:

  • Product inventory
  • Employee directory
  • HR policies
  • Customer orders
  • Knowledge articles

These operations are generally lower risk.


2. Perform Actions

The agent updates external systems.

Examples:

  • Create a support case
  • Approve a request
  • Submit an expense report
  • Update a customer record
  • Send an email

These operations require stronger security controls.


3. Hybrid

Most enterprise agents both:

  • Retrieve information
  • Perform actions

Example:

User:

“Book vacation for next Friday.”

The agent:

  • Checks vacation balance
  • Verifies manager
  • Submits leave request
  • Sends confirmation

Integration Options in Copilot Studio

Several technologies are available.

Understanding when to use each one is an important exam objective.


Power Platform Connectors

Best for:

  • Standard business systems

Examples:

  • SharePoint
  • Outlook
  • Dynamics 365
  • SQL
  • Salesforce

Advantages:

  • Low-code
  • Easy authentication
  • Microsoft-managed
  • Hundreds of built-in connectors

Use connectors whenever an existing connector meets business requirements.


Power Automate Flows

Best for:

  • Multi-step automation

Example:

Agent receives:

“Create a new employee.”

Power Automate then:

  • Creates HR record
  • Creates Microsoft account
  • Assigns licenses
  • Sends welcome email
  • Notifies manager

Flows are ideal for orchestrating multiple systems.


REST API Tools

Best for:

  • Custom applications
  • Systems without connectors

Advantages:

  • Flexible
  • Supports nearly any web service
  • Supports standard HTTP operations

Requires:

  • API endpoint
  • Authentication
  • Request definitions

Custom Connectors

Best when:

  • REST APIs are reused frequently

Advantages:

  • Encapsulates API logic
  • Easier maintenance
  • Reusable across Power Platform

Model Context Protocol (MCP)

MCP provides a standardized way for AI agents to interact with external tools and services.

Benefits include:

  • Standardized communication
  • Tool discovery
  • Rich AI interactions
  • Cross-platform interoperability

MCP reduces the need for custom integrations between agents and enterprise systems.


Azure AI Search

Azure AI Search is commonly used for:

  • Enterprise knowledge retrieval
  • Retrieval-Augmented Generation (RAG)
  • Grounding AI responses

Instead of simply searching documents, the agent retrieves relevant content before generating a response.


Selecting the Correct Integration Method

When planning an integration, ask:

Is a built-in connector available?

If yes:

Use the connector.

If no:

Consider:

  • REST API
  • Custom connector
  • MCP

Is business logic required?

If yes:

Power Automate is often the best choice.


Does the agent need enterprise knowledge?

Use:

  • SharePoint
  • Azure AI Search
  • Knowledge connectors

Does the system expose APIs?

REST APIs are often the preferred integration.


Will multiple agents share tools?

Consider:

  • MCP
  • Shared connectors
  • Reusable APIs

Authentication Planning

Authentication determines how the agent proves its identity.

Common approaches include:

  • Microsoft Entra ID
  • OAuth
  • API keys
  • Service principals
  • Managed identities

The exam focuses on choosing appropriate authentication methods rather than configuration details.


Authorization Planning

Authentication answers:

Who are you?

Authorization answers:

What are you allowed to do?

Examples:

  • HR agent can view employee records.
  • Sales agent cannot modify payroll.
  • Managers approve leave.
  • Employees submit requests.

Least privilege is a core security principle.


Data Governance Considerations

Enterprise integration must align with organizational governance.

Consider:

  • Data residency
  • Compliance
  • Data classification
  • Data loss prevention (DLP)
  • Audit logging
  • Connector governance
  • Environment strategy

Sensitive data should only be accessible through approved integrations.


Error Handling Strategy

Enterprise systems occasionally fail.

Examples:

  • API unavailable
  • Authentication expired
  • Timeout
  • Network issues
  • Invalid data

A good integration strategy includes:

  • Retry logic
  • User-friendly error messages
  • Logging
  • Monitoring
  • Graceful failure

Performance Planning

Enterprise integrations introduce latency.

Good planning includes:

  • Minimize API calls
  • Cache data where appropriate
  • Avoid unnecessary requests
  • Use asynchronous workflows
  • Optimize search indexes

Fast responses improve user experience.


Scalability Considerations

Consider future growth.

Questions include:

  • How many users?
  • How many API calls?
  • Peak workloads?
  • Multiple regions?
  • Future integrations?

A scalable architecture minimizes redesign later.


Multi-Agent Integration

Large organizations increasingly use multiple specialized agents.

Examples:

  • HR Agent
  • IT Agent
  • Finance Agent
  • Sales Agent

Instead of one agent doing everything, specialized child or connected agents collaborate.

Benefits include:

  • Better maintainability
  • Separation of responsibilities
  • Easier governance
  • Improved scalability

Enterprise Knowledge Integration

Many agents primarily answer questions using organizational knowledge.

Knowledge sources include:

  • SharePoint
  • Dataverse
  • Websites
  • Azure AI Search
  • Files
  • Microsoft Graph

Good grounding reduces hallucinations and improves response accuracy.


Monitoring Enterprise Integrations

Planning includes monitoring:

  • Failed API calls
  • Authentication failures
  • Response times
  • Flow failures
  • Connector usage
  • User activity

Monitoring helps maintain reliability and identify opportunities for optimization.


Common Planning Mistakes

Avoid these common mistakes:

  • Choosing REST APIs when a connector already exists
  • Giving excessive permissions
  • Ignoring governance policies
  • Forgetting authentication requirements
  • Integrating directly with databases unnecessarily
  • Not planning for failures
  • Creating one oversized agent instead of multiple specialized agents
  • Ignoring future scalability

Exam Tips

Remember these principles:

  • Prefer built-in connectors before custom integrations.
  • Use Power Automate for business workflows and orchestration.
  • Use REST APIs when no connector exists.
  • Use custom connectors for reusable APIs.
  • Use MCP for standardized tool integration and cross-platform scenarios.
  • Use Azure AI Search for grounding enterprise knowledge.
  • Follow least privilege security.
  • Plan for governance, monitoring, and scalability from the beginning.
  • Separate authentication from authorization.
  • Choose the simplest integration that satisfies business requirements.

10 Practice Exam Questions

Question 1

A company wants an AI agent to create approval requests, notify managers, and update multiple business systems in sequence. Which integration option is most appropriate?

A. Azure AI Search

B. Power Automate

C. Direct SQL queries

D. Adaptive Cards

Correct Answer: B

Explanation: Power Automate is designed to orchestrate multi-step workflows across multiple systems, making it the ideal solution for approval processes and sequential business actions.


Question 2

An organization already has a Microsoft-supported connector for its CRM system. During solution planning, what should be recommended?

A. Build a custom REST API

B. Use Model Context Protocol (MCP)

C. Use the built-in connector

D. Build a custom connector

Correct Answer: C

Explanation: Built-in connectors are the preferred option because they are supported, easier to configure, and require less maintenance than custom integrations.


Question 3

An agent needs to retrieve information from a proprietary internal application that exposes REST endpoints but has no existing Power Platform connector. What is the best integration approach?

A. Azure AI Search

B. Adaptive Cards

C. REST API tool

D. Dataverse

Correct Answer: C

Explanation: REST API tools are appropriate when integrating with applications that expose web APIs but do not have existing connectors.


Question 4

Which principle should guide permission assignment when integrating an AI agent with enterprise systems?

A. Grant full administrative access

B. Allow anonymous access whenever possible

C. Share one account across all users

D. Apply the principle of least privilege

Correct Answer: D

Explanation: Least privilege ensures the agent has only the permissions necessary to perform its intended tasks, reducing security risks.


Question 5

An organization wants AI-generated answers to reference internal company documentation stored across multiple repositories while minimizing hallucinations. Which technology best supports this requirement?

A. Azure AI Search

B. Power Automate

C. Microsoft Teams

D. Adaptive Cards

Correct Answer: A

Explanation: Azure AI Search enables retrieval-augmented generation (RAG), grounding responses in trusted enterprise content.


Question 6

What is the primary purpose of authentication in an enterprise integration strategy?

A. Determine what data users can modify

B. Verify the identity of the caller

C. Optimize API performance

D. Format responses consistently

Correct Answer: B

Explanation: Authentication verifies identity, while authorization determines what actions or resources the authenticated identity may access.


Question 7

A solution architect expects multiple AI agents across different platforms to share common enterprise tools using a standardized communication protocol. Which technology best fits this requirement?

A. Power BI

B. Power Automate

C. Model Context Protocol (MCP)

D. SharePoint lists

Correct Answer: C

Explanation: MCP provides a standardized way for AI agents to discover and use tools across platforms, promoting interoperability and reuse.


Question 8

During planning, which consideration most directly supports long-term maintainability of enterprise integrations?

A. Selecting the integration method that requires the most custom code

B. Ignoring governance because it can be added later

C. Allowing every connector in every environment

D. Choosing reusable connectors and standardized integration patterns

Correct Answer: D

Explanation: Reusable connectors and standardized integration approaches simplify maintenance, governance, and future enhancements.


Question 9

An AI agent primarily needs to retrieve customer order information without modifying records. Which type of enterprise integration is being planned?

A. Read-only integration

B. Action-oriented integration

C. Workflow orchestration

D. Hybrid integration

Correct Answer: A

Explanation: Read-only integrations focus on retrieving information without performing updates or transactions.


Question 10

When planning enterprise integrations, why should architects include monitoring and logging?

A. To replace authentication

B. To eliminate API latency

C. To detect failures, troubleshoot issues, and improve reliability

D. To reduce the number of enterprise systems

Correct Answer: C

Explanation: Monitoring and logging help identify authentication problems, failed API calls, performance issues, and other operational concerns, enabling proactive maintenance and continuous improvement.


Go to the AB-620 Exam Prep Hub main page

AB-620 Practice Exam #1 (30 questions)

This practice exam is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.

Question 1 (Single Answer)

A company wants to build a Copilot Studio agent that consistently answers HR policy questions by referencing the latest employee handbook stored in SharePoint.

Which approach should you recommend?

A. Create multiple topics containing every policy manually.

B. Configure generative answers with SharePoint as a knowledge source.

C. Build a Power Automate flow that returns random policy documents.

D. Store all policies in Adaptive Cards.

Answer: B

Explanation:
Generative Answers is designed to retrieve information from trusted knowledge sources such as SharePoint, websites, Dataverse, and Azure AI Search. This reduces maintenance while ensuring responses stay current.


Question 2 (Multiple Answer)

You are designing topics for an enterprise support agent.

Which TWO principles help create maintainable conversations?

A. Use reusable topics whenever possible.

B. Place every business process into one large topic.

C. Use clear trigger phrases.

D. Create duplicate topics for every department.

Answers: A, C

Explanation:
Reusable topics reduce maintenance, while well-written trigger phrases improve topic selection. Large monolithic topics and unnecessary duplication reduce maintainability.


Question 3 (Scenario-Based)

A customer asks:

“I forgot my password.”

The agent should first verify the user’s identity before initiating a password reset.

Which Copilot Studio capability best supports this design?

A. Adaptive Cards

B. Conversation boosting

C. Authentication-aware conversation flow

D. Generative answers

Answer: C

Explanation:
Sensitive actions should include authentication or identity verification before execution.


Question 4 (Fill in the Blank)

Adaptive Cards primarily allow agents to present ________ user experiences inside conversations.

A. static PDF

B. structured and interactive

C. audio-only

D. encrypted

Answer: B

Explanation:
Adaptive Cards provide structured interactive interfaces including buttons, forms, images, and inputs.


Question 5 (Match the Answers)

Match each capability with its primary purpose.

CapabilityPurpose
1. Adaptive CardA. Search enterprise knowledge
2. Azure AI SearchB. Interactive response
3. TopicC. Conversation workflow
4. Connector ToolD. Invoke external system

Answer

  • 1 → B
  • 2 → A
  • 3 → C
  • 4 → D

Explanation:
Each component serves a different role within Copilot Studio.


Question 6 (Single Answer)

Which feature allows an agent to call Microsoft 365, Dynamics 365, or Salesforce without custom REST development?

A. Azure AI Search

B. Connector Tools

C. Generative Answers

D. Child Agents

Answer: B

Explanation:
Connector Tools leverage Power Platform connectors for external system integration.


Question 7 (Multiple Answer)

Which TWO situations are ideal for using Generative Answers?

A. Frequently changing documentation

B. Employee knowledge bases

C. Fixed mathematical calculations

D. Static greeting messages

Answers: A, B

Explanation:
Generative Answers excels with dynamic knowledge repositories.


Question 8 (Scenario)

An organization has separate Finance, HR, and IT agents.

Users should interact with a single entry point while requests are automatically routed.

What should you recommend?

A. Adaptive Cards

B. Connected Agents

C. Static Topics

D. Conversation Boosting

Answer: B

Explanation:
Connected Agents enable seamless delegation between specialized agents.


Question 9 (Single Answer)

Which statement best describes Child Agents?

A. They permanently replace parent agents.

B. They specialize in delegated tasks.

C. They store enterprise knowledge.

D. They generate Adaptive Cards.

Answer: B

Explanation:
Child Agents perform specialized work delegated by a parent agent.


Question 10 (Multiple Answer)

Which TWO benefits does Azure AI Search provide?

A. Semantic search

B. Vector search

C. Topic authoring

D. Power Automate execution

Answers: A, B

Explanation:
Azure AI Search provides modern semantic and vector retrieval capabilities.


Question 11 (Single Answer)

A REST API requires OAuth authentication.

Which Copilot Studio capability is most appropriate?

A. Adaptive Card

B. REST API Tool

C. Topic Trigger

D. Conversation History

Answer: B

Explanation:
REST API Tools support authenticated API calls.


Question 12 (Scenario)

A customer wants product recommendations displayed as images with action buttons.

Which feature should you use?

A. Adaptive Cards

B. Trigger phrases

C. Child Agents

D. Azure AI Search

Answer: A

Explanation:
Adaptive Cards provide interactive UI elements.


Question 13 (Single Answer)

Which design principle improves topic reuse?

A. Create one topic for every user

B. Build modular topics

C. Duplicate topics by department

D. Embed every API directly into each topic

Answer: B


Question 14 (Multiple Answer)

Which TWO capabilities help integrate enterprise systems?

A. REST API Tools

B. Connectors

C. Adaptive Cards

D. Azure Monitor

Answers: A, B

Explanation:
REST APIs and Connectors integrate business systems.


Question 15 (Scenario)

An organization wants several independent agents developed by different teams to communicate securely.

Which capability best supports this?

A. Agent2Agent Protocol

B. Trigger phrases

C. Adaptive Cards

D. Conversation Boosting

Answer: A

Explanation:
Agent2Agent enables interoperable multi-agent communication.


Question 16 (Single Answer)

Which knowledge source is optimized for enterprise-scale indexing?

A. Excel

B. Azure AI Search

C. Outlook

D. Teams Chat

Answer: B


Question 17 (Match)

Match the integration method.

ItemPurpose
1 REST API ToolA External REST service
2 ConnectorB Microsoft/third-party service
3 Azure AI SearchC Enterprise search
4 MCPD External AI tool

Answer

  • 1 → A
  • 2 → B
  • 3 → C
  • 4 → D

Question 18 (Single Answer)

What is the main advantage of using connectors instead of custom code?

A. Lower maintenance

B. Higher latency

C. Less security

D. More manual work

Answer: A


Question 19 (Scenario)

An agent frequently receives questions outside its expertise.

What should you configure?

A. Child Agent delegation

B. Longer greeting

C. Adaptive Cards

D. Multiple trigger phrases only

Answer: A


Question 20 (Multiple Answer)

Which TWO activities are part of testing an agent?

A. Validate topic routing

B. Test connector responses

C. Redesign Azure regions

D. Replace SharePoint

Answers: A, B


Question 21 (Single Answer)

Which metric most directly measures successful conversations?

A. CPU utilization

B. Resolution rate

C. Azure subscription count

D. Tenant size

Answer: B


Question 22 (Scenario)

Users report inconsistent answers after new documents were uploaded.

What should you investigate first?

A. Knowledge source indexing

B. Adaptive Card colors

C. Conversation greeting

D. Trigger phrase capitalization

Answer: A


Question 23 (Fill in the Blank)

The ________ protocol enables standardized communication among compatible AI agents.

A. REST

B. MCP

C. HTTPS

D. XML

Answer: B


Question 24 (Single Answer)

What is the primary purpose of MCP?

A. Store Dataverse records

B. Standardize communication with external tools and services

C. Replace Adaptive Cards

D. Build Power BI dashboards

Answer: B


Question 25 (Scenario)

A retail company has inventory stored in SAP.

The agent must retrieve live inventory during conversations.

Which solution is most appropriate?

A. Manual topics

B. REST API Tool

C. Adaptive Card only

D. Generative Answers only

Answer: B


Question 26 (Multiple Answer)

Which TWO practices improve enterprise agent governance?

A. Monitor conversation analytics

B. Regularly validate knowledge sources

C. Disable testing

D. Ignore failed API calls

Answers: A, B


Question 27 (Single Answer)

Why should child agents be designed around specialized business capabilities?

A. Easier maintenance and reuse

B. Larger conversations

C. More trigger phrases

D. Fewer APIs

Answer: A


Question 28 (Scenario)

A healthcare organization must ensure only authenticated users can retrieve patient information.

What should be implemented?

A. Anonymous conversations

B. Authentication before protected actions

C. Public websites

D. Conversation boosting only

Answer: B


Question 29 (Single Answer)

Which capability allows users to submit structured information directly inside a conversation?

A. Adaptive Cards

B. Azure AI Search

C. Trigger phrases

D. Topics

Answer: A


Question 30 (Multiple Answer)

Which TWO activities should occur before publishing an updated production agent?

A. Validate conversation paths

B. Test integrations

C. Delete analytics history

D. Disable monitoring

Answers: A, B


Go to the AB-620 Exam Prep Hub main page

Exam Prep Hub for AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals

Welcome to the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub!

Welcome to the one-stop hub with information for preparing for the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals certification exam. The content for this exam helps prepare you to “understand Microsoft 365 services, admin tools, core objects, core security features, and modern AI-driven IT management practices”.
Upon successful completion of the exam, you earn the Microsoft 365 Certified: Copilot and Agent Administration Fundamentals certification.

This hub provides information directly here (topic-by-topic as outlined in the official study guide), links to a number of external resources, tips for preparing for the exam, practice tests, and section questions to help you prepare. Bookmark this page and use it as a guide to ensure that you are fully covering all relevant topics for the AB-900 exam and making use of as many of the resources available as possible.


Audience profile (from Microsoft’s site)

As a candidate for this Microsoft Certification, you should be familiar with Microsoft 365, including core services, security, identity and access, data protection, and governance, along with Microsoft 365 Copilot and agents.
Additionally, you should be familiar with the admin centers used to access Microsoft 365 workloads, such as Exchange Online, SharePoint in Microsoft 365, Microsoft Teams, Microsoft Entra, and Microsoft Purview. You need to have experience with AI-driven productivity tools and modern IT management practices.
You must be able to identify the roles of the core features and objects available in Microsoft 365, such as users, groups, teams, sites, and libraries. Plus, you should understand the core security features of Microsoft 365, such as authentication methods, conditional access policies, and single sign-on (SSO).

Skills at a glance (as specified in the official study guide)

  • Identify the core features and objects of Microsoft 365 services (30–35%)
  • Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
  • Perform basic administrative tasks for Copilot and agents (25–30%)

Topic-by-Topic Exam Content

[click a topic link to access the content and practice questions for that topic]

Identify the core features and objects of Microsoft 365 services (30–35%)

Identify the core objects of Microsoft 365 services

Understand the Microsoft 365 security principles

Identify the core security features of Microsoft 365 services

Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)

Understand Microsoft Purview

Understand data security implications of Copilot

Identify data protection and governance risks for Microsoft 365 and Copilot

Identify and monitor oversharing in SharePoint in Microsoft 365

Perform basic administrative tasks for Copilot and agents (25–30%)

Understand features and capabilities of Copilot and agents

Perform basic administrative tasks for Copilot

Perform basic administrative tasks for agents


AB-900 Practice Exams


Important AB-900 Resources

Link to the free, comprehensive, self-paced course on Microsoft Learn: Introduction to Microsoft 365 and AI administration

https://learn.microsoft.com/en-us/training/courses/ab-900t00

This course has two learning paths:

(1) The first learning path is: Explore Microsoft 365 administration, located at this URL:
https://learn.microsoft.com/en-us/training/paths/explore-microsoft-365-administration

This learning path has 3 modules, located at the below URLs:

(2) The second learning path is: Explore Microsoft 365 Copilot and agent administration, located at this URL:
https://learn.microsoft.com/en-us/training/paths/explore-microsoft-365-copilot-agent-administration

This learning path has 3 modules, located at the below URLs:

Link to the certification page:

Link to the study guide:


YouTube resources:

Courses: There are several highly rated courses for AB-900 on Udemy:

Check out the previews of each course to decide which trainer is best for you. And a tip for you … if your timeline allows it, wait for the occasional Udemy sale and buy your course(s) then.


Good luck to you passing the AB-900 Exam!
However, the more preparation you have, the less luck you will need. 🙂

Visit this post to see the list of all the certification preparation hubs available on The Data Community.

AB-900 Practice Exam #4

AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Practice Exam

This practice exam is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.


Question 1 (Single Answer)

Which service is responsible for identity and access management in Microsoft 365?

A. Microsoft Defender
B. Microsoft Entra ID
C. Microsoft Purview
D. Microsoft Fabric

Correct Answer: B

Explanation

Microsoft Entra ID manages authentication, authorization, and identity lifecycle for Microsoft 365 users.


Question 2 (Multiple Answer)

Which THREE are core Microsoft 365 collaboration workloads used by Copilot?

A. SharePoint Online
B. Exchange Online
C. Microsoft Teams
D. Windows Registry
E. BIOS firmware

Correct Answers

✅ A
✅ B
✅ C

Explanation

Copilot uses Microsoft 365 workloads including SharePoint, Exchange, and Teams via Microsoft Graph.


Question 3 (Single Answer)

Which Microsoft service provides unified data access for Microsoft 365 Copilot?

A. Microsoft Graph
B. Microsoft Sentinel
C. Microsoft Defender
D. Azure DevOps

Correct Answer: A


Question 4 (Fill in the Blank)

Copilot respects existing Microsoft 365 __________ when retrieving data.

A. licenses
B. permissions
C. storage limits
D. device profiles

Correct Answer: B


Question 5 (Scenario)

An organization wants to measure Copilot adoption and usage trends across departments.

A. Microsoft Intune
B. Copilot Analytics
C. Azure Monitor
D. Exchange Admin Center

Correct Answer: B


Question 6 (Single Answer)

Which tool identifies overshared SharePoint sites?

A. Microsoft Defender XDR
B. SharePoint Data Access Governance Reports
C. Microsoft Entra ID
D. Azure Policy

Correct Answer: B


Question 7 (Multiple Answer)

Which TWO help reduce AI-related data exposure risks?

A. Microsoft Purview DSPM for AI
B. SharePoint Advanced Management
C. Windows Update
D. Microsoft Word Editor

Correct Answers

✅ A
✅ B


Question 8 (Single Answer)

Which feature allows restricting Copilot access to sensitive SharePoint sites?

A. Restricted Site Access
B. Site Templates
C. Teams Channels
D. OneDrive Sync

Correct Answer: A


Question 9 (Scenario)

A compliance team needs to search across emails and Teams messages for legal investigation.

A. Content Search
B. Microsoft Defender Firewall
C. Azure Monitor
D. Intune Compliance

Correct Answer: A


Question 10 (Single Answer)

Which model allows organizations to pay only for Copilot usage?

A. Per-device licensing
B. Pay-as-you-go
C. Volume licensing only
D. OEM licensing

Correct Answer: B


Question 11 (Multiple Answer)

Which THREE are valid Copilot data sources?

A. SharePoint
B. Exchange
C. Teams
D. Linux Kernel
E. VMware BIOS

Correct Answers

✅ A
✅ B
✅ C


Question 12 (Single Answer)

Which service handles compliance and governance?

A. Microsoft Entra ID
B. Microsoft Purview
C. Microsoft Defender
D. Microsoft Intune

Correct Answer: B


Question 13 (Scenario)

A user should only access Copilot content they are allowed to see.

A. Permissions
B. Licenses
C. Network speed
D. Storage quota

Correct Answer: A


Question 14 (Matching)

Match service to purpose:

  1. Entra ID
  2. Purview
  3. Defender

A. Identity
B. Compliance
C. Security

Correct Matching

1 → A
2 → B
3 → C


Question 15 (Single Answer)

Which tool provides Copilot adoption insights?

A. Copilot Analytics
B. Azure Firewall
C. Intune
D. Sentinel

Correct Answer: A


Question 16 (Scenario)

You want to build an HR assistant using internal documents.

A. Custom agent
B. Windows Copilot
C. PowerPoint Designer
D. Exchange Rules

Correct Answer: A


Question 17 (Multiple Answer)

Which THREE describe agent monitoring capabilities?

A. Usage metrics
B. Lifecycle tracking
C. Operational insights
D. BIOS updates
E. Disk formatting

Correct Answers

✅ A
✅ B
✅ C


Question 18 (Single Answer)

Which feature allows saving reusable prompts?

A. Prompt management
B. Intune profiles
C. Defender rules
D. Azure tags

Correct Answer: A


Question 19 (Scenario)

You want to ensure HR data is not used in Copilot responses until reviewed.

A. Restricted Site Access
B. Windows Firewall
C. Teams Policies
D. Azure VMs

Correct Answer: A


Question 20 (Single Answer)

Which Copilot agent performs advanced data analysis?

A. Analyst
B. Designer
C. Writer
D. Translator

Correct Answer: A


Question 21 (Multiple Answer)

Which are Copilot governance tools?

A. Data Access Governance Reports
B. DSPM for AI
C. BIOS manager
D. Windows registry editor

Correct Answers

✅ A
✅ B


Question 22 (Single Answer)

Copilot uses Microsoft ________ to access organizational data.

A. Graph
B. Sentinel
C. Intune
D. Fabric

Correct Answer: A


Question 23 (Scenario)

You want to monitor agent usage and lifecycle.

A. Microsoft 365 admin center
B. Excel
C. Word
D. Outlook

Correct Answer: A


Question 24 (Multiple Answer)

Which TWO admin centers manage agents?

A. Microsoft 365 admin center
B. Power Platform admin center
C. Azure DevOps
D. Windows Admin Center

Correct Answers

✅ A
✅ B


Question 25 (Single Answer)

Which Copilot capability is used for deep research?

A. Researcher
B. Analyst
C. Designer
D. Editor

Correct Answer: A


Question 26 (Fill in the Blank)

Copilot is built on Microsoft ________.

A. Graph
B. Azure DevOps
C. Sentinel
D. SQL Server

Correct Answer: A


Question 27 (Scenario)

You want to restrict Copilot costs based on usage.

A. Pay-as-you-go billing
B. Intune policies
C. Defender policies
D. BIOS settings

Correct Answer: A


Question 28 (Single Answer)

Which tool manages identity?

A. Entra ID
B. Purview
C. Defender
D. Copilot Analytics

Correct Answer: A


Question 29 (Multiple Answer)

Which THREE are Copilot benefits?

A. Productivity improvement
B. Data insights
C. Automated BIOS updates
D. Content generation

Correct Answers

✅ A
✅ B
✅ D


Question 30 (Single Answer)

Copilot agents are best described as:

A. Security tools
B. Identity providers
C. Task-specific AI assistants
D. Hardware devices

Correct Answer: C


Go to the AB-900 Exam Prep Hub main page

AB-900 Practice Exam #3

AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Practice Exam

This practice exam is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.


Question 1 (Scenario-Based Single Answer)

A company plans to deploy Microsoft 365 Copilot to all employees. Before assigning licenses, the IT department wants to verify that users have the required Microsoft 365 subscription.

Which action should the administrator perform first?

A. Enable Microsoft Defender for all users.

B. Verify that users have an eligible Microsoft 365 base license.

C. Create a custom agent for each department.

D. Configure Microsoft Purview retention labels.

Correct Answer: B

Explanation

Microsoft 365 Copilot requires users to have an eligible Microsoft 365 subscription (such as Microsoft 365 E3 or E5, or other qualifying plans) before a Copilot license can be assigned.

  • A improves security but is not a licensing prerequisite.
  • C is unrelated to licensing.
  • D governs data but does not determine Copilot eligibility.

Question 2 (Multiple Answer)

Which THREE Microsoft 365 workloads commonly provide organizational data that Microsoft 365 Copilot can use to generate responses?

A. SharePoint Online

B. Exchange Online

C. Microsoft Teams

D. Windows Registry

E. Azure Virtual Machines

Choose THREE answers.

Correct Answers

A

B

C

Explanation

Microsoft 365 Copilot works across Microsoft Graph and retrieves information from workloads such as:

  • SharePoint Online
  • Exchange Online
  • Microsoft Teams
  • OneDrive (not listed)

Windows Registry and Azure Virtual Machines are not Microsoft 365 content sources for Copilot.


Question 3 (Single Answer)

Which Microsoft service is primarily responsible for storing and managing user identities used by Microsoft 365?

A. Microsoft Defender XDR

B. Microsoft Purview

C. Microsoft Entra ID

D. Microsoft Intune

Correct Answer: C

Explanation

Microsoft Entra ID provides identity, authentication, authorization, and access management for Microsoft 365 users.

The other services perform security, governance, or device management functions.


Question 4 (Fill in the Blank)

Complete the sentence.

Microsoft 365 Copilot uses Microsoft __________ to securely retrieve organizational information across Microsoft 365 services.

A. Defender

B. Graph

C. Fabric

D. Power BI

Correct Answer: B

Explanation

Microsoft Graph provides a unified API and data layer that enables Microsoft 365 Copilot to access emails, meetings, files, chats, calendars, and other Microsoft 365 data while respecting existing permissions.


Question 5 (Scenario-Based Single Answer)

An administrator wants to identify users who have begun using Microsoft 365 Copilot but are rarely returning after their first week.

Which solution provides this information?

A. Microsoft Intune

B. Microsoft Defender

C. Copilot Analytics

D. Exchange Admin Center

Correct Answer: C

Explanation

Copilot Analytics provides insights into user adoption, repeat usage, engagement trends, and feature utilization.

The remaining tools do not provide Copilot adoption analytics.


Question 6 (Matching)

Match each Microsoft solution with its primary purpose.

Microsoft SolutionPurpose
1. Microsoft PurviewA. Identity management
2. Microsoft Entra IDB. Compliance and governance
3. Microsoft Defender XDRC. Threat detection and response

Correct Matching

  • 1 → B
  • 2 → A
  • 3 → C

Explanation

Each Microsoft solution has a specialized role:

  • Microsoft Purview manages compliance and governance.
  • Microsoft Entra ID manages identities.
  • Microsoft Defender XDR provides security monitoring and response.

Question 7 (Scenario-Based Multiple Answer)

A company wants to reduce the risk of Microsoft 365 Copilot exposing overshared files after deployment.

Which TWO actions should administrators take?

A. Review SharePoint permissions.

B. Run SharePoint Data Access Governance Reports.

C. Disable Microsoft Teams.

D. Use Microsoft Purview DSPM for AI to identify risks.

E. Delete Microsoft Graph.

Choose TWO answers.

Correct Answers

B

D

Explanation

SharePoint Data Access Governance Reports identify overshared content, while Microsoft Purview DSPM for AI identifies AI-related exposure risks and recommends remediation.

Reviewing SharePoint permissions is a useful administrative practice, but these two tools are specifically designed for discovering and assessing oversharing risks.


Question 8 (Single Answer)

Which statement correctly describes Microsoft 365 Copilot?

A. It ignores Microsoft 365 permissions when generating responses.

B. It only searches internet content.

C. It respects existing Microsoft 365 permissions and organizational policies.

D. It automatically grants access to restricted SharePoint sites.

Correct Answer: C

Explanation

Microsoft 365 Copilot always respects Microsoft 365 permissions and compliance controls. It cannot retrieve information users are not authorized to access.

The other statements are incorrect.


Question 9 (Scenario-Based Single Answer)

An organization is investigating the accidental sharing of confidential project documents.

Which Microsoft Purview feature should administrators use to locate those files across Exchange, SharePoint, and OneDrive?

A. Content Search

B. Microsoft Defender Antivirus

C. Azure Cost Management

D. Windows Event Viewer

Correct Answer: A

Explanation

Content Search allows investigators to search across Microsoft 365 workloads for emails, documents, Teams messages, and other content during investigations.

The remaining tools are unrelated.


Question 10 (Multiple Answer)

Which THREE capabilities are available in SharePoint Advanced Management?

A. Restricted Site Access

B. Data Access Governance Reports

C. Oversharing insights

D. Windows Update management

E. BIOS configuration

Choose THREE answers.

Correct Answers

A

B

C

Explanation

SharePoint Advanced Management provides capabilities that help organizations secure SharePoint content before and after deploying Microsoft 365 Copilot, including:

  • Restricted Site Access
  • Data Access Governance Reports
  • Oversharing insights and governance capabilities

Windows Update management and BIOS configuration are unrelated.


Question 11 (Scenario-Based Single Answer)

A compliance officer needs to locate all emails and Teams messages related to a legal investigation across Microsoft 365.

Which tool should be used?

A. Microsoft Purview Content Search
B. Microsoft Defender for Endpoint
C. Microsoft Entra ID sign-in logs
D. Microsoft Intune compliance policies

Correct Answer: A

Explanation

Microsoft Purview Content Search allows administrators to search across Exchange, SharePoint, OneDrive, and Teams for investigation and compliance purposes.

Other options are unrelated to content discovery.


Question 12 (Multiple Answer)

Which THREE capabilities are part of Microsoft Purview Data Loss Prevention (DLP)?

A. Detect sensitive information in emails and documents
B. Block or restrict sharing of sensitive data
C. Automatically increase Copilot licensing
D. Apply policies across Microsoft 365 workloads
E. Replace Microsoft Entra ID authentication

Choose THREE answers.

Correct Answers

A
B
D

Explanation

DLP helps:

  • Identify sensitive data
  • Prevent accidental sharing
  • Apply policies across Microsoft 365 services

It does not manage licensing or identity.


Question 13 (Single Answer)

Which Microsoft service enforces identity-based access control for Microsoft 365 Copilot users?

A. Microsoft Defender
B. Microsoft Entra ID
C. Microsoft Purview
D. Microsoft Fabric

Correct Answer: B

Explanation

Microsoft Entra ID manages authentication and authorization, ensuring users only access resources they are permitted to use, including Copilot.


Question 14 (Fill in the Blank)

Microsoft 365 Copilot relies on Microsoft __________ to access organizational data securely.

A. Graph
B. Sentinel
C. Intune
D. Power Automate

Correct Answer: A

Explanation

Microsoft Graph is the API layer that connects Copilot to Microsoft 365 data while enforcing permissions and security controls.


Question 15 (Scenario-Based Single Answer)

A company wants to ensure that confidential HR documents are not included in Copilot responses until they are reviewed.

Which solution should they use?

A. SharePoint Restricted Site Access
B. Microsoft Teams Channels
C. Windows Firewall
D. Azure DevOps Pipelines

Correct Answer: A

Explanation

Restricted Site Access in SharePoint Advanced Management can temporarily block Copilot and search indexing from accessing sensitive sites.


Question 16 (Matching)

Match each Copilot-related feature with its purpose.

FeaturePurpose
1. Copilot AnalyticsA. Build custom business assistants
2. Custom AgentsB. Measure adoption and usage
3. Prompt ManagementC. Save and reuse prompts

Correct Matching

  • 1 → B
  • 2 → A
  • 3 → C

Question 17 (Multiple Answer)

Which TWO actions can administrators perform in Copilot prompt management?

A. Save prompts
B. Share prompts
C. Encrypt Azure VMs
D. Delete prompts
E. Disable Microsoft Graph

Correct Answers

A
B

Explanation

Prompt management allows users to save and share prompts for reuse and productivity. Deletion may be available depending on configuration, but encryption and Graph changes are unrelated.


Question 18 (Scenario-Based Single Answer)

An organization wants to understand whether employees are using Copilot effectively and frequently returning to it after initial adoption.

Which tool should they use?

A. Microsoft Entra ID logs
B. Copilot Analytics
C. Azure Monitor
D. Microsoft Defender for Cloud

Correct Answer: B

Explanation

Copilot Analytics provides adoption, engagement, and retention metrics for Microsoft 365 Copilot usage.


Question 19 (Single Answer)

Which of the following best describes a custom agent in Microsoft 365 Copilot?

A. A tool that replaces Microsoft Teams
B. A browser extension for Edge
C. A specialized assistant built for organizational tasks and data sources
D. A security policy enforcement engine

Correct Answer: C

Explanation

Custom agents extend Copilot by providing tailored assistance based on organizational data, workflows, and knowledge sources.


Question 20 (Scenario-Based Multiple Answer)

An organization is preparing to deploy Microsoft 365 Copilot and wants to reduce data exposure risks in SharePoint.

Which TWO actions should the administrator take?

A. Run SharePoint Data Access Governance Reports
B. Enable Restricted Site Access
C. Disable Microsoft Entra ID
D. Remove Microsoft Purview policies
E. Turn off Microsoft Teams

Choose TWO answers.

Correct Answers

A
B

Explanation

To reduce oversharing risk:

  • Governance Reports identify risky sites
  • Restricted Site Access limits Copilot and search access to sensitive sites

Disabling identity or collaboration services is not appropriate.


Question 21 (Scenario-Based Single Answer)

A company wants to deploy Microsoft 365 Copilot but only pay for usage instead of assigning full user licenses.

Which billing model should they consider?

A. Pay-as-you-go
B. Per-device licensing
C. Free trial licensing only
D. Windows Enterprise licensing

Correct Answer: A

Explanation

Pay-as-you-go allows organizations to be billed based on usage rather than assigning full Copilot licenses to every user.

Other options are not valid Copilot billing models.


Question 22 (Single Answer)

Which requirement must be met before a user can be assigned a Microsoft 365 Copilot license?

A. They must be a SharePoint administrator
B. They must have an eligible Microsoft 365 base license
C. They must install Microsoft Edge extensions
D. They must disable Multi-Factor Authentication

Correct Answer: B

Explanation

Copilot requires a qualifying Microsoft 365 subscription (such as E3 or E5) before a Copilot license can be assigned.


Question 23 (Scenario-Based Multiple Answer)

An organization wants to monitor the health, usage, and lifecycle of agents deployed in Microsoft 365.

Which TWO admin centers should they use?

A. Microsoft 365 admin center
B. Microsoft Power Platform admin center
C. Azure DevOps admin center
D. Microsoft Word desktop app
E. Windows Control Panel

Choose TWO answers.

Correct Answers

A
B

Explanation

  • Microsoft 365 admin center provides tenant-level monitoring and management of Copilot and agents.
  • Power Platform admin center provides insights into agent lifecycle, usage, and governance for built agents.

Question 24 (Single Answer)

Which Copilot feature is designed to perform in-depth research across enterprise and web sources to produce structured insights?

A. Analyst
B. Designer
C. Outlook Copilot
D. Windows Recall

Correct Answer: A

Explanation

The Analyst agent is designed for advanced data analysis and structured insights.


Question 25 (Fill in the Blank)

Microsoft 365 Copilot agents are managed throughout their __________ lifecycle.

A. hardware
B. billing
C. application
D. email

Correct Answer: C

Explanation

Agents follow an application lifecycle: creation, deployment, monitoring, updating, and retirement.


Question 26 (Matching)

Match each Copilot capability with its description.

CapabilityDescription
1. ResearcherA. Builds structured insights from data analysis
2. AnalystB. Performs deep research across enterprise data
3. Pay-as-you-goC. Usage-based billing model

Correct Matching

  • 1 → B
  • 2 → A
  • 3 → C

Question 27 (Scenario-Based Single Answer)

A company wants to allow employees to use Copilot without assigning full licenses to everyone, but still wants to track usage costs.

What should they configure?

A. Microsoft Entra Domain Services
B. Pay-as-you-go billing for Copilot
C. Windows Autopilot
D. Microsoft Defender ATP

Correct Answer: B

Explanation

Pay-as-you-go enables usage-based billing, allowing organizations to track and control costs without assigning full licenses to all users.


Question 28 (Multiple Answer)

Which THREE actions are part of managing Microsoft 365 Copilot agents?

A. Monitor usage analytics
B. Manage lifecycle stages
C. Assign physical hardware
D. Control access permissions
E. Delete Microsoft Graph

Correct Answers

A
B
D

Explanation

Agent management includes:

  • Monitoring usage
  • Managing lifecycle (create, publish, update, retire)
  • Controlling access permissions

Hardware management and Graph deletion are unrelated.


Question 29 (Scenario-Based Single Answer)

An administrator wants to review which employees are actively using Copilot and how often they interact with it across departments.

Which tool provides this visibility?

A. Microsoft Intune
B. Copilot Analytics
C. Azure Key Vault
D. Microsoft Defender Firewall

Correct Answer: B

Explanation

Copilot Analytics provides adoption, usage frequency, and engagement metrics across departments and users.


Question 30 (Single Answer)

Which statement best describes Microsoft 365 Copilot agents?

A. They replace Microsoft Entra ID authentication
B. They are hardware devices installed on user machines
C. They extend Copilot with task-specific and organizational knowledge capabilities
D. They are only used for security monitoring

Correct Answer: C

Explanation

Copilot agents extend Copilot functionality by providing specialized, task-oriented capabilities based on organizational data and workflows.


Go to the AB-900 Exam Prep Hub main page

AB-900 Practice Exam #2

AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Practice Exam

This practice exam is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.


Question 1 (Single Answer)

A company plans to deploy Microsoft 365 Copilot to 300 employees. Before deployment, administrators want to reduce the possibility that Copilot will surface documents that were unintentionally shared with a broad audience.

Which action should administrators perform FIRST?

A. Increase mailbox storage quotas.

B. Run SharePoint Advanced Management reports to identify oversharing.

C. Assign Copilot licenses to all users.

D. Enable Microsoft Defender for Endpoint.

Correct Answer

B

Explanation

SharePoint Advanced Management provides reports that identify overshared sites and content. Reviewing and correcting permissions before deployment reduces the risk of Copilot surfacing sensitive information to users who already have access.

  • A is unrelated.
  • C deploys Copilot before addressing governance concerns.
  • D improves endpoint security but does not address oversharing.

Question 2 (Multiple Response)

Which THREE Microsoft 365 services commonly provide organizational data that Microsoft 365 Copilot can use through Microsoft Graph?

(Choose three.)

A. SharePoint Online

B. Exchange Online

C. Microsoft Teams

D. Azure Kubernetes Service

Correct Answers

A, B, and C

Explanation

Microsoft Graph connects Microsoft 365 services, including:

  • SharePoint Online
  • Exchange Online
  • Microsoft Teams
  • Outlook
  • OneDrive
  • Calendar

Azure Kubernetes Service is an Azure infrastructure service and is not a Microsoft 365 productivity workload used as a primary grounding source.


Question 3 (Scenario)

A compliance administrator wants to investigate whether users have recently used Microsoft 365 Copilot to access files containing credit card numbers.

Which Microsoft Purview capability is MOST appropriate?

A. Activity Explorer

B. Microsoft Defender XDR

C. Microsoft Intune

D. Azure Monitor

Correct Answer

A

Explanation

Activity Explorer helps administrators investigate user activities involving sensitive information, including Copilot interactions when supported by Microsoft Purview auditing and compliance features.

The remaining services focus on endpoint management, security operations, or Azure monitoring.


Question 4 (Best Answer)

An organization wants to find every document and email related to “Project Orion” across Exchange Online, SharePoint Online, and OneDrive.

Which Microsoft Purview feature should be used?

A. Data Loss Prevention

B. Activity Explorer

C. Content Search (eDiscovery)

D. Communication Compliance

Correct Answer

C

Explanation

Content Search enables administrators to search across Microsoft 365 workloads for emails, files, Teams messages, and other supported content.

Activity Explorer monitors activities rather than searching stored content.


Question 5 (Matching)

Match each administrative tool with its primary purpose.

ToolPurpose
1. Copilot AnalyticsA. Discover AI-related risks
2. DSPM for AIB. Measure Copilot adoption
3. Microsoft 365 Admin CenterC. Assign licenses and manage users

Choose the correct answer.

A.

1-B

2-A

3-C

B.

1-A

2-C

3-B

C.

1-C

2-B

3-A

D.

1-B

2-C

3-A

Correct Answer

A

Explanation

  • Copilot Analytics measures adoption and usage.
  • DSPM for AI identifies AI-related security and governance risks.
  • Microsoft 365 Admin Center manages users, licenses, and Microsoft 365 services.

Question 6 (Scenario)

An organization wants a conversational assistant that answers only Human Resources questions using approved HR documentation.

Which solution best satisfies this requirement?

A. Microsoft Purview eDiscovery

B. Exchange Online

C. Custom agent

D. Microsoft Defender for Cloud Apps

Correct Answer

C

Explanation

A custom agent can be configured with:

  • Specific instructions
  • Approved knowledge sources
  • Department-specific behaviors
  • Controlled user access

This makes it ideal for HR, Finance, Legal, or IT support scenarios.


Question 7 (Multiple Response)

Which TWO statements correctly describe Microsoft 365 Copilot licensing?

(Choose two.)

A. Copilot licenses are assigned to individual users.

B. Some Copilot services support pay-as-you-go billing.

C. Every Copilot capability requires monthly licensing.

D. Copilot licensing automatically grants Global Administrator permissions.

Correct Answers

A and B

Explanation

Microsoft supports:

  • Per-user licensing for Microsoft 365 Copilot.
  • Consumption-based (pay-as-you-go) billing for certain Copilot experiences and services.

Licensing never grants administrative permissions.


Question 8 (Scenario)

An administrator wants to understand how frequently employees are using Copilot in Word, Excel, Outlook, and Teams.

Which tool provides this information?

A. Microsoft Defender Portal

B. Copilot Analytics

C. Exchange Admin Center

D. Microsoft Intune

Correct Answer

B

Explanation

Copilot Analytics provides reporting on:

  • Active users
  • Adoption trends
  • Usage by application
  • Organizational engagement
  • Return on investment insights

Question 9 (Fill in the Blank)

Microsoft 365 Copilot retrieves organizational context through the __________ while respecting existing security permissions.

A. Azure Virtual Network

B. Windows Registry

C. Microsoft Graph

D. SQL Server Agent

Correct Answer

C

Explanation

Microsoft Graph securely connects Microsoft 365 applications and organizational data. Copilot uses Microsoft Graph to retrieve business context while honoring existing permissions.


Question 10 (Scenario-Based Case Study)

A company has completed a pilot deployment of Microsoft 365 Copilot. Administrators notice that some employees rarely use Copilot while others use it daily.

Management asks the IT department to identify:

  • adoption trends,
  • frequently used Microsoft 365 applications,
  • active users,
  • opportunities to improve adoption.

Which solution BEST meets these requirements?

A. Microsoft Purview Audit

B. Microsoft Defender XDR

C. Microsoft Entra ID

D. Copilot Analytics

Correct Answer

D

Explanation

Copilot Analytics is specifically designed to provide insights into:

  • Adoption rates
  • User engagement
  • Application usage
  • Organizational trends
  • Opportunities to increase Copilot adoption

The other services are designed for auditing, security, or identity management rather than adoption reporting.


Question 11 (Single Answer)

A Microsoft 365 administrator wants to determine whether users are actively using Microsoft 365 Copilot after licenses have been assigned.

Which tool provides adoption and usage metrics specifically for Copilot?

A. Microsoft Entra admin center

B. Copilot Analytics

C. Azure Monitor

D. Microsoft Defender XDR

Correct Answer: B

Explanation

Copilot Analytics provides adoption metrics, usage trends, active users, feature usage, and business insights for Microsoft 365 Copilot.

  • A is incorrect because Entra manages identities.
  • C monitors Azure resources.
  • D focuses on security incidents.

Question 12 (Multiple Answer)

A company wants to reduce oversharing before deploying Microsoft 365 Copilot.

Which TWO tools specifically help identify oversharing?

A. SharePoint Data Access Governance Reports

B. SharePoint Advanced Management

C. Microsoft Word Editor

D. Microsoft Purview DSPM for AI

E. Windows Event Viewer

Choose TWO answers.

Correct Answers:

A

D

Explanation

Data Access Governance Reports identify sites with excessive permissions, while DSPM for AI identifies AI-related exposure risks and recommends remediation.

  • B helps administer SharePoint but isn’t specifically an oversharing discovery tool by itself.
  • C and E are unrelated.

Question 13 (Scenario)

A legal department needs to locate every email discussing a confidential acquisition during the last six months.

Which Microsoft Purview feature should the administrator use?

A. Insider Risk Management

B. Communication Compliance

C. Content Search

D. Data Loss Prevention

Correct Answer: C

Explanation

Content Search allows administrators to search Exchange mailboxes, SharePoint, OneDrive, and Teams content for investigations and legal discovery.

The other solutions perform different governance functions.


Question 14 (Fill in the Blank)

Complete the sentence.

Microsoft 365 Copilot only returns information that a user is already __________ to access.

A. configured

B. licensed

C. authorized

D. synchronized

Correct Answer: C

Explanation

Copilot honors existing Microsoft 365 permissions. Users only receive information they are already authorized to access.


Question 15 (Match the Answers)

Match each Microsoft 365 service with its primary purpose.

ServicePurpose
1. Microsoft Entra IDA. Data governance and compliance
2. Microsoft PurviewB. Identity and authentication
3. Microsoft DefenderC. Threat protection

Correct Matching

  • 1 → B
  • 2 → A
  • 3 → C

Explanation

  • Microsoft Entra manages identities.
  • Microsoft Purview manages governance and compliance.
  • Microsoft Defender protects against threats.

Question 16 (Single Answer)

Which administrator is most likely responsible for configuring Microsoft 365 Copilot licenses?

A. SharePoint Site Owner

B. Exchange User

C. Global Administrator

D. Power BI Viewer

Correct Answer: C

Explanation

Global Administrators (or other appropriately delegated licensing administrators) can assign Copilot licenses.

The remaining roles cannot generally assign organization-wide licenses.


Question 17 (Scenario)

A company wants to monitor which departments are adopting Copilot most rapidly.

Which report would best meet this requirement?

A. Azure Cost Management

B. Copilot Analytics Adoption Report

C. Windows Performance Monitor

D. Exchange Queue Report

Correct Answer: B

Explanation

Copilot Analytics includes organizational adoption trends broken down by departments and user groups.

The other reports are unrelated.


Question 18 (Multiple Answer)

Which actions can administrators perform when managing Microsoft 365 Copilot prompts?

A. Save prompts

B. Share prompts

C. Schedule prompts

D. Permanently modify Microsoft Graph

E. Delete prompts

Choose THREE answers.

Correct Answers

A

B

E

Explanation

Users can:

  • Save prompts
  • Share prompts
  • Delete prompts

While Microsoft continues to expand prompt management capabilities, scheduling depends on the experience and scenario and is not a universal prompt-management capability tested at the AB-900 level.

Modifying Microsoft Graph is unrelated.


Question 19 (Scenario)

An organization wants sensitive SharePoint sites to be inaccessible to Microsoft 365 Copilot until additional review has been completed.

Which SharePoint Advanced Management capability supports this goal?

A. Restricted Site Access

B. Anonymous Sharing

C. Site Templates

D. Version History

Correct Answer: A

Explanation

Restricted Site Access allows administrators to temporarily exclude selected SharePoint sites from organizational search and Copilot experiences while permissions or content are reviewed.


Question 20 (Single Answer)

Which statement correctly describes custom agents?

A. They permanently replace Microsoft 365 Copilot.

B. They only answer questions using internet data.

C. They are designed to automate and assist with organization-specific business scenarios.

D. They require every user to have Global Administrator permissions.

Correct Answer: C

Explanation

Custom agents extend Copilot by providing specialized knowledge, workflows, and automation tailored to an organization’s processes.

  • They do not replace Copilot.
  • They are not limited to internet data.
  • Users do not need Global Administrator permissions to use them.

Question 21 (Scenario-Based Single Answer)

A company plans to deploy Microsoft 365 Copilot to its Finance department. Before enabling Copilot, administrators want to identify SharePoint sites that contain excessive permissions which could expose confidential financial data.

Which Microsoft capability should they use first?

A. Microsoft Defender XDR

B. SharePoint Data Access Governance Reports

C. Microsoft Intune

D. Exchange Online Message Trace

Correct Answer: B

Explanation

Data Access Governance Reports help administrators identify overshared SharePoint sites by analyzing permissions, external sharing, and potentially excessive access. This allows organizations to remediate permissions before enabling Microsoft 365 Copilot.

  • A focuses on threat detection.
  • C manages devices.
  • D tracks email delivery.

Question 22 (Multiple Answer)

Which THREE statements correctly describe Microsoft Purview Data Security Posture Management (DSPM) for AI?

A. It identifies AI-related data exposure risks.

B. It helps discover AI activity across Microsoft 365.

C. It replaces Microsoft Defender Antivirus.

D. It provides recommendations to reduce AI-related risks.

E. It creates Microsoft 365 licenses.

Choose THREE answers.

Correct Answers

A

B

D

Explanation

DSPM for AI helps organizations:

  • Discover AI usage.
  • Identify AI-related security risks.
  • Recommend remediation actions.

It does not replace endpoint protection or manage licensing.


Question 23 (Single Answer)

Which Microsoft 365 administrator role typically has the permissions required to manage Microsoft 365 Copilot settings across the tenant?

A. SharePoint Visitor

B. Billing Reader

C. Global Administrator

D. Teams Meeting Organizer

Correct Answer: C

Explanation

Global Administrators have broad permissions to configure Microsoft 365 services, including Microsoft 365 Copilot administration.

The remaining roles have much more limited permissions.


Question 24 (Scenario-Based Single Answer)

An administrator wants to review the number of active Copilot users, adoption trends, and feature usage across the organization.

Which tool should they use?

A. Microsoft Entra Admin Center

B. Azure Monitor

C. Microsoft Defender Portal

D. Copilot Analytics

Correct Answer: D

Explanation

Copilot Analytics provides insights into:

  • Adoption
  • Active users
  • Feature usage
  • Organizational trends
  • Business value indicators

The other tools serve different purposes.


Question 25 (Match the Answers)

Match each Microsoft technology with its primary purpose.

TechnologyPurpose
1. Microsoft Purview Content SearchA. Discover content during investigations
2. SharePoint Advanced ManagementB. Reduce oversharing risks
3. Copilot AnalyticsC. Measure Copilot adoption

Correct Matching

  • 1 → A
  • 2 → B
  • 3 → C

Explanation

Each solution addresses a different administrative responsibility:

  • Content Search supports investigations.
  • SharePoint Advanced Management helps reduce oversharing.
  • Copilot Analytics measures adoption.

Question 26 (Scenario-Based Multiple Answer)

A company plans to publish a custom agent for Human Resources.

Which TWO activities should occur before broad deployment?

A. Verify organizational approval requirements.

B. Validate the agent’s knowledge sources.

C. Disable Microsoft Entra ID.

D. Remove Microsoft Purview compliance policies.

E. Delete SharePoint permissions.

Choose TWO answers.

Correct Answers

A

B

Explanation

Before deployment, administrators should:

  • Complete any approval process.
  • Verify that the agent uses accurate and authorized knowledge sources.

The remaining options reduce security or are unrelated.


Question 27 (Fill in the Blank)

Microsoft 365 Copilot respects existing __________ when retrieving organizational information.

A. passwords

B. licenses

C. permissions

D. storage quotas

Correct Answer: C

Explanation

Copilot never bypasses Microsoft 365 permissions. Users only receive information they already have permission to access.


Question 28 (Scenario-Based Single Answer)

An organization wants to create an AI assistant that answers internal Human Resources questions using approved HR documentation.

Which solution best meets this requirement?

A. Create a custom agent

B. Enable Windows Copilot

C. Deploy Microsoft Defender

D. Configure Microsoft Intune

Correct Answer: A

Explanation

A custom agent can be built using approved HR documents as its knowledge source, allowing employees to receive accurate answers tailored to organizational policies.

The remaining options do not provide organization-specific conversational AI.


Question 29 (Multiple Answer)

Which THREE activities can administrators perform while monitoring Microsoft 365 agents?

A. Review usage statistics.

B. Monitor operational insights.

C. Track the agent lifecycle.

D. Install Windows updates.

E. Replace Microsoft Graph.

Choose THREE answers.

Correct Answers

A

B

C

Explanation

Administrators can monitor:

  • Usage
  • Operational health
  • Lifecycle status

These capabilities are available through the Microsoft 365 admin center and, for applicable agents, the Microsoft Power Platform admin center.

Windows updates and Microsoft Graph replacement are unrelated.


Question 30 (Scenario-Based Single Answer)

A company has completed a pilot deployment of Microsoft 365 Copilot. Management asks the administrator to determine whether employee adoption is increasing and whether users are regularly interacting with Copilot.

Which solution provides the most appropriate information?

A. Microsoft Defender Secure Score

B. Azure Cost Management

C. Exchange Online Mail Flow Reports

D. Copilot Analytics

Correct Answer: D

Explanation

Copilot Analytics is specifically designed to measure:

  • User adoption
  • Active users
  • Usage frequency
  • Feature utilization
  • Organizational trends

The other reporting tools focus on security, cloud spending, or email traffic rather than Copilot adoption.


Go to the AB-900 Exam Prep Hub main page

AB-900 Practice Exam #1

AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Practice Exam

This practice exam is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.


Question 1 (Single Answer)

A company is preparing to deploy Microsoft 365 Copilot. The IT administrator wants to ensure Copilot can generate responses using organizational documents stored in Microsoft 365 while still respecting existing security permissions.

Which statement is correct?

A. Copilot ignores Microsoft 365 permissions and searches all tenant data.

B. Copilot only accesses documents that have sensitivity labels.

C. Copilot only returns information the signed-in user already has permission to access.

D. Copilot automatically grants temporary access to files needed to answer prompts.

Correct Answer

C

Explanation

Microsoft 365 Copilot honors existing Microsoft 365 security, identity, and permission models. Users only receive information they are already authorized to access.

  • A is incorrect because Copilot never bypasses permissions.
  • B is incorrect because permissions—not sensitivity labels alone—determine access.
  • D is incorrect because Copilot does not modify permissions.

Question 2 (Multiple Answer)

Which TWO Microsoft 365 services commonly provide grounding data for Microsoft 365 Copilot?

(Choose two.)

A. SharePoint Online

B. Exchange Online

C. Azure DevOps

D. Windows Registry

Correct Answers

A and B

Explanation

Microsoft 365 Copilot retrieves business context from Microsoft Graph, which includes services such as:

  • SharePoint Online
  • Exchange Online
  • Teams
  • OneDrive
  • Outlook
  • Calendar

Azure DevOps is not a core Microsoft 365 workload for Copilot grounding, and the Windows Registry is unrelated.


Question 3 (Scenario)

A compliance administrator wants to determine whether employees are using Copilot to summarize documents that contain sensitive information.

Which Microsoft Purview feature provides visibility into these AI interactions?

A. eDiscovery Content Search

B. Data Loss Prevention

C. Activity Explorer

D. SharePoint Version History

Correct Answer

C

Explanation

Microsoft Purview Activity Explorer displays user activities involving sensitive information, including activities related to Microsoft 365 Copilot and AI usage.

  • eDiscovery searches stored content.
  • DLP protects sensitive information.
  • Version History tracks document revisions.

Question 4 (Fill in the Blank)

Complete the following sentence.

Microsoft 365 Copilot retrieves organizational context primarily through the __________.

A. Azure Resource Manager

B. Microsoft Graph

C. Microsoft Defender Portal

D. Azure Key Vault

Correct Answer

B

Explanation

Microsoft Graph securely connects Microsoft 365 workloads and provides Copilot with organizational context while respecting user permissions.


Question 5 (Matching)

Match each Microsoft Purview capability with its primary purpose.

CapabilityPurpose
1. Activity ExplorerA. Investigate files and emails
2. Content SearchB. Monitor sensitive activities
3. DSPM for AIC. Identify AI-related risks

Choose the correct mapping.

A.
1-B
2-A
3-C

B.
1-C
2-B
3-A

C.
1-A
2-C
3-B

D.
1-B
2-C
3-A

Correct Answer

A

Explanation

  • Activity Explorer monitors user activities.
  • Content Search locates emails and files.
  • DSPM for AI identifies AI-related security and data risks.

Question 6 (Scenario)

An organization recently enabled Microsoft 365 Copilot. Leadership is concerned that employees may unintentionally expose confidential documents because SharePoint permissions were configured too broadly years ago.

Which Microsoft solution is specifically designed to identify oversharing risks?

A. Exchange Admin Center

B. Azure Cost Management

C. Microsoft Teams Admin Center

D. SharePoint Advanced Management

Correct Answer

D

Explanation

SharePoint Advanced Management provides reports and tools that help identify overshared content and manage site permissions before or after deploying Copilot.

The other options do not analyze SharePoint oversharing.


Question 7 (Multiple Answer)

Which TWO statements about Microsoft 365 Copilot licensing are true?

(Choose two.)

A. Copilot can be licensed through a per-user monthly subscription.

B. Some Copilot capabilities also support pay-as-you-go billing.

C. Every Copilot feature requires a pay-as-you-go model.

D. SharePoint agents cannot use pay-as-you-go billing.

Correct Answers

A and B

Explanation

Microsoft supports both:

  • Per-user monthly licensing
  • Pay-as-you-go consumption for certain Copilot experiences, including some SharePoint-related capabilities

The remaining statements are incorrect.


Question 8 (Best Answer)

Which administrative portal is primarily used to assign Microsoft 365 Copilot licenses?

A. Microsoft Entra Admin Center

B. Microsoft 365 Admin Center

C. Azure Portal

D. Microsoft Purview Portal

Correct Answer

B

Explanation

Administrators assign Microsoft 365 Copilot licenses through the Microsoft 365 Admin Center under Users > Active Users > Licenses and Apps.

Although Microsoft Entra manages identities, license assignment is typically performed in the Microsoft 365 Admin Center.


Question 9 (Scenario)

A company wants an AI assistant that answers HR questions using only company HR policies and employee handbooks.

Which solution best fits this requirement?

A. Microsoft Defender

B. Microsoft Purview eDiscovery

C. A custom Copilot agent

D. SharePoint Document Library

Correct Answer

C

Explanation

Custom agents can be configured with specialized knowledge sources and instructions, making them ideal for department-specific assistants such as HR, Finance, or IT Help Desk.

The other options are not conversational AI assistants.


Question 10 (Ordering)

A Microsoft 365 administrator wants to investigate a possible data exposure involving Copilot.

Arrange the following actions in the most logical order.

  1. Review Activity Explorer.
  2. Identify unusual AI-related activity.
  3. Review permissions on affected SharePoint sites.
  4. Apply appropriate permission corrections.

A.
1 → 2 → 3 → 4

B.
2 → 1 → 4 → 3

C.
3 → 2 → 1 → 4

D.
1 → 3 → 2 → 4

Correct Answer

A

Explanation

A logical investigation sequence is:

  1. Open Activity Explorer.
  2. Identify suspicious or unusual AI activity.
  3. Review the permissions on the affected content.
  4. Correct any oversharing or permission issues.

This workflow reflects recommended practices when investigating potential oversharing risks in Microsoft 365.


Question 11 (Single Answer)

An administrator wants to locate all emails and SharePoint documents that contain a specific project name as part of an internal investigation.

Which Microsoft Purview feature should the administrator use?

A. Activity Explorer

B. Content Search (eDiscovery)

C. Data Loss Prevention

D. Microsoft Defender XDR

Correct Answer

B

Explanation

Content Search in Microsoft Purview eDiscovery allows administrators to search across Exchange Online mailboxes, SharePoint Online sites, OneDrive accounts, and Microsoft Teams content.

  • A monitors activities but does not perform comprehensive content searches.
  • C prevents data leakage rather than locating historical content.
  • D focuses on security threats rather than content discovery.

Question 12 (Multiple Answer)

Which TWO capabilities are provided by Microsoft Purview Data Security Posture Management (DSPM) for AI?

(Choose two.)

A. Discover AI applications used within the organization

B. Identify AI-related data exposure risks

C. Automatically assign Microsoft 365 licenses

D. Replace Microsoft Entra ID authentication

Correct Answers

A and B

Explanation

DSPM for AI helps organizations:

  • Discover AI applications and services.
  • Identify AI-related security and governance risks.
  • Assess sensitive data exposure.
  • Improve AI governance.

It does not manage licensing or identity services.


Question 13 (Scenario)

A company recently enabled Microsoft 365 Copilot. Management wants to know how frequently employees are using Copilot and which Microsoft 365 applications have the highest adoption.

Which solution should the administrator use?

A. Microsoft Purview Audit

B. Microsoft Entra ID

C. Copilot Analytics

D. SharePoint Admin Center

Correct Answer

C

Explanation

Copilot Analytics provides insights into:

  • Adoption trends
  • Active users
  • Usage by Microsoft 365 application
  • Organizational engagement

The other tools serve different purposes.


Question 14 (Best Answer)

An administrator discovers that a SharePoint site grants access to “Everyone except external users.”

Why could this present a risk after deploying Microsoft 365 Copilot?

A. Copilot automatically republishes files externally.

B. Copilot may surface documents to any employee who already has access.

C. Copilot encrypts every document.

D. Copilot deletes inherited permissions.

Correct Answer

B

Explanation

Copilot honors existing permissions. If a large audience already has access to documents, Copilot may surface those documents during conversations, increasing the visibility of overshared information.


Question 15 (Matching)

Match each administrative portal to its primary responsibility.

PortalResponsibility
1. Microsoft 365 Admin CenterA. Data governance and compliance
2. Microsoft Purview PortalB. User licensing and Microsoft 365 administration
3. Power Platform Admin CenterC. Manage agents and Power Platform environments

Choose the correct answer.

A.
1-C
2-B
3-A

B.
1-B
2-C
3-A

C.
1-B
2-A
3-C

D.
1-A
2-C
3-B

Correct Answer

C

Explanation

  • Microsoft 365 Admin Center manages users, licenses, and Microsoft 365 services.
  • Microsoft Purview manages compliance, governance, and data protection.
  • Power Platform Admin Center manages Power Platform environments and many custom agents.

Question 16 (Scenario)

A business unit wants to deploy a custom agent for employees.

Before the agent becomes broadly available, the organization requires managerial review and approval.

What is the primary purpose of the approval process?

A. Improve network performance

B. Reduce Azure costs

C. Automatically create SharePoint sites

D. Ensure the agent meets organizational governance and compliance requirements

Correct Answer

D

Explanation

Approval workflows help ensure that agents:

  • Meet security standards.
  • Follow governance policies.
  • Use approved data sources.
  • Comply with organizational requirements.

Question 17 (Multiple Answer)

Which TWO actions can administrators commonly perform for Microsoft 365 Copilot in the Microsoft 365 Admin Center?

(Choose two.)

A. Assign Copilot licenses

B. Review Copilot usage reports

C. Design Power BI semantic models

D. Configure Windows Firewall policies

Correct Answers

A and B

Explanation

The Microsoft 365 Admin Center enables administrators to:

  • Assign licenses.
  • View adoption reports.
  • Manage service settings.
  • Monitor Copilot usage.

Power BI modeling and Windows Firewall management occur elsewhere.


Question 18 (Fill in the Blank)

Microsoft 365 Copilot respects existing __________ when retrieving organizational content.

A. Azure subscriptions

B. SharePoint branding

C. Microsoft 365 permissions

D. Windows registry settings

Correct Answer

C

Explanation

Copilot only retrieves information users are already authorized to access through Microsoft 365 permissions.

It never bypasses existing security controls.


Question 19 (Scenario)

An administrator wants to identify which custom agents are actively being used, how frequently they are accessed, and whether some should be retired.

Which combination of administrative capabilities best supports this objective?

A. Review operational insights and lifecycle information in the Microsoft 365 Admin Center and Power Platform Admin Center.

B. Configure Microsoft Defender Antivirus.

C. Run Windows Event Viewer.

D. Review Exchange transport rules.

Correct Answer

A

Explanation

Administrators can monitor:

  • Agent usage
  • Operational health
  • Adoption
  • Lifecycle status
  • Publishing status

through the Microsoft 365 Admin Center and Power Platform Admin Center.

The remaining options are unrelated.


Question 20 (Case Study)

A financial services organization has enabled Microsoft 365 Copilot for 500 employees.

After deployment, administrators discover that several sensitive documents appear in Copilot responses more often than expected. Investigation reveals that the documents reside in a SharePoint site with broad internal permissions.

Which sequence of actions represents the BEST response?

A.

  1. Delete Microsoft 365 Copilot.
  2. Restore SharePoint.
  3. Recreate documents.
  4. Reassign licenses.

B.

  1. Disable Microsoft Graph.
  2. Create a new tenant.
  3. Restore OneDrive.
  4. Reinstall Microsoft 365.

C.

  1. Increase Copilot licenses.
  2. Publish more SharePoint sites.
  3. Enable guest access.
  4. Run Copilot Analytics.

D.

  1. Review SharePoint permissions.
  2. Use SharePoint Advanced Management reports to identify oversharing.
  3. Restrict access where appropriate.
  4. Continue monitoring through Microsoft Purview and Copilot Analytics.

Correct Answer

D

Explanation

This follows Microsoft’s recommended governance approach:

  • Review permissions.
  • Identify oversharing.
  • Correct access controls.
  • Continue monitoring with governance and analytics tools.

Deleting Copilot or rebuilding the tenant would not solve the underlying permissions issue.


Question 21 (Single Answer)

A company wants to provide Microsoft 365 Copilot only to employees in the Finance department during a pilot deployment.

What is the simplest way to accomplish this?

A. Assign Microsoft 365 Copilot licenses only to Finance users.

B. Disable Microsoft Graph for all other users.

C. Create a separate Microsoft 365 tenant.

D. Disable SharePoint Online for everyone except Finance.

Correct Answer

A

Explanation

Assigning Copilot licenses only to Finance users is the recommended and simplest method for piloting Microsoft 365 Copilot. No additional tenant or service changes are required.


Question 22 (Multiple Answer)

Which TWO administrative tasks can be performed for Microsoft 365 Copilot using the Microsoft 365 Admin Center?

(Choose two.)

A. Assign Copilot licenses.

B. View Copilot adoption and usage reports.

C. Configure Microsoft Defender Antivirus policies.

D. Create Microsoft Fabric workspaces.

Correct Answers

A and B

Explanation

The Microsoft 365 Admin Center enables administrators to:

  • Assign and remove licenses.
  • Monitor Copilot adoption and usage.
  • Manage users and Microsoft 365 services.

Defender and Microsoft Fabric are managed in separate administration portals.


Question 23 (Scenario)

An organization wants to understand why Microsoft 365 Copilot is surfacing sensitive documents during conversations.

Which issue is MOST likely responsible?

A. Copilot is bypassing Microsoft Entra ID.

B. Copilot has been granted Global Administrator permissions.

C. Existing SharePoint permissions allow users to access those documents.

D. Microsoft Graph automatically expands user permissions.

Correct Answer

C

Explanation

Copilot never bypasses existing security. If users can already access sensitive documents because of broad SharePoint permissions, Copilot can include those documents in responses.


Question 24 (Best Answer)

Which Microsoft Purview capability helps administrators understand AI-related risks across organizational data?

A. SharePoint Version History

B. Data Security Posture Management (DSPM) for AI

C. Microsoft Planner

D. Exchange Mail Flow Rules

Correct Answer

B

Explanation

DSPM for AI helps organizations:

  • Discover AI usage.
  • Identify sensitive data exposure.
  • Assess AI-related risks.
  • Improve governance.

The other options do not provide AI governance capabilities.


Question 25 (Matching)

Match each feature with its primary purpose.

FeaturePurpose
1. Copilot AnalyticsA. Monitor adoption and usage
2. Activity ExplorerB. Review user activities involving sensitive data
3. SharePoint Advanced ManagementC. Identify oversharing risks

Choose the correct mapping.

A.

1-A

2-B

3-C

B.

1-C

2-A

3-B

C.

1-B

2-C

3-A

D.

1-A

2-C

3-B

Correct Answer

A

Explanation

  • Copilot Analytics monitors adoption and usage.
  • Activity Explorer tracks sensitive data activities.
  • SharePoint Advanced Management identifies oversharing risks.

Question 26 (Scenario)

A newly created custom agent is available only to its creator.

The administrator wants everyone in the Human Resources department to use the agent.

What should the administrator do?

A. Delete and recreate the agent.

B. Assign the appropriate user access permissions to the HR users or group.

C. Purchase additional Microsoft 365 licenses.

D. Enable Microsoft Defender for Office 365.

Correct Answer

B

Explanation

Administrators control which users or groups can access custom agents. Sharing or assigning permissions to the HR group makes the agent available to authorized users.


Question 27 (Multiple Answer)

Which TWO statements accurately describe Microsoft 365 Copilot prompts?

(Choose two.)

A. Users can save prompts for future use.

B. Users can share prompts with others when supported.

C. Prompts permanently modify SharePoint permissions.

D. Prompts automatically create new Microsoft 365 users.

Correct Answers

A and B

Explanation

Microsoft 365 Copilot allows users to:

  • Save prompts.
  • Reuse prompts.
  • Share prompts where supported.
  • Schedule certain prompts in supported experiences.

Prompts never modify permissions or user accounts.


Question 28 (Scenario)

A company wants to understand whether newly deployed agents are actively being used and whether some agents should be retired.

Which information should administrators review?

A. Windows Performance Monitor

B. Azure Resource Health

C. Operational insights and agent lifecycle information

D. Exchange mailbox quotas

Correct Answer

C

Explanation

Agent lifecycle information includes:

  • Usage
  • Adoption
  • Operational health
  • Publication status
  • Lifecycle stage

These metrics help determine whether agents continue to provide business value.


Question 29 (Fill in the Blank)

Microsoft 365 Copilot never grants users additional permissions because it always respects existing __________.

A. licensing assignments

B. Microsoft 365 security permissions

C. Power Platform environments

D. Exchange transport rules

Correct Answer

B

Explanation

One of the most important concepts for the AB-900 exam is that Microsoft 365 Copilot respects existing Microsoft 365 permissions. It does not elevate privileges or expose information users cannot already access.


Question 30 (Comprehensive Scenario)

A global organization plans to deploy Microsoft 365 Copilot to thousands of employees.

Before expanding deployment, administrators want to:

  • identify overshared SharePoint content,
  • monitor AI adoption,
  • investigate AI-related activities,
  • manage user licenses,
  • monitor custom agent usage.

Which combination of Microsoft tools BEST satisfies all of these requirements?

A.

  • Microsoft Defender
  • Azure Portal
  • Windows Admin Center

B.

  • Exchange Admin Center
  • Azure Cost Management
  • Microsoft Intune

C.

  • Microsoft Purview Activity Explorer
  • Microsoft 365 Admin Center
  • Copilot Analytics
  • SharePoint Advanced Management
  • Power Platform Admin Center

D.

  • Microsoft Planner
  • Power BI Desktop
  • Visual Studio Code

Correct Answer

C

Explanation

This combination provides complete administrative coverage:

  • Microsoft Purview Activity Explorer monitors AI-related activities involving sensitive information.
  • Microsoft 365 Admin Center manages users, licensing, and Microsoft 365 administration.
  • Copilot Analytics measures Copilot adoption and usage.
  • SharePoint Advanced Management identifies oversharing risks and governance issues.
  • Power Platform Admin Center manages many custom agents and their lifecycle.

The other options do not collectively address governance, administration, analytics, licensing, and agent management.


Monitor agents, including usage, operational insights, and agent lifecycle, by working with the Microsoft 365 Admin Center and the Microsoft Power Platform Admin Center (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Perform basic administrative tasks for Copilot and agents (25–30%)
   --> Perform basic administrative tasks for agents
      --> Monitor agents, including usage, operational insights, and agent lifecycle, by working with the Microsoft 365 Admin Center and the Microsoft Power Platform Admin Center


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations deploy more Microsoft 365 Copilot agents, effective administration extends beyond simply creating and publishing them. Administrators must continuously monitor agent usage, operational health, adoption, security, and lifecycle to ensure that agents continue to provide business value while meeting organizational governance and compliance requirements.

Microsoft provides two primary administrative portals for monitoring and managing agents:

  • Microsoft 365 admin center
  • Microsoft Power Platform admin center

Each portal serves a different purpose. The Microsoft 365 admin center focuses on Microsoft 365 services, Copilot adoption, licensing, and organizational administration, while the Power Platform admin center focuses on environments, Copilot Studio, Power Platform resources, and operational management of custom agents.

For the AB-900 exam, you should understand which portal is used for which administrative tasks, the types of monitoring information available, and the basic lifecycle of an agent.


Why Monitoring Agents Is Important

Monitoring helps administrators answer questions such as:

  • Are users actually using the agent?
  • Is the agent providing business value?
  • Are there operational issues?
  • Is adoption increasing?
  • Are users encountering errors?
  • Should the agent be updated or retired?
  • Are governance policies being followed?

Without monitoring, organizations cannot determine whether their AI investments are successful.


Administrative Portals

Microsoft 365 Admin Center

The Microsoft 365 admin center provides organization-wide administration for Microsoft 365 services, including Copilot.

Administrators commonly use it to:

  • View Copilot adoption
  • Monitor Copilot usage
  • Assign licenses
  • Manage users
  • Manage billing
  • View service health
  • Review reports
  • Monitor tenant-wide administration

It provides a business-level view of how Microsoft 365 Copilot is being used across the organization.


Microsoft Power Platform Admin Center

The Power Platform admin center focuses on the operational management of Power Platform resources, including custom agents created with Copilot Studio.

Administrators use it to:

  • Manage environments
  • Monitor agent health
  • Manage Dataverse resources
  • Review capacity
  • Configure security
  • Manage connectors
  • Review operational information
  • Manage Power Platform policies

It provides technical administration for custom AI solutions.


Monitoring Agent Usage

Usage monitoring helps organizations understand adoption.

Common usage metrics include:

  • Number of users
  • Active users
  • Conversations
  • Sessions
  • Frequency of use
  • Popular agents
  • Usage trends over time

These metrics help determine whether users are benefiting from the deployed agents.


Usage Scenarios

An administrator might monitor:

  • Daily active users
  • Weekly adoption growth
  • Monthly conversation counts
  • Frequently used agents
  • Least-used agents

Low adoption may indicate:

  • Lack of awareness
  • Poor training
  • Limited usefulness
  • Difficult user experience

Operational Insights

Operational insights help administrators understand how agents are performing.

Examples include:

  • Agent availability
  • Service status
  • Response success
  • Failed requests
  • Processing errors
  • Environment health
  • Connector status
  • Workflow execution

Operational monitoring focuses on technical performance rather than business adoption.


Examples of Operational Issues

Administrators may investigate:

  • Failed API connections
  • Broken Power Automate flows
  • Authentication failures
  • Connector problems
  • Environment capacity limits
  • Dataverse issues

Identifying these issues early minimizes disruption for users.


Monitoring Agent Lifecycle

Every agent follows a lifecycle from creation to retirement.

Typical lifecycle stages include:

  1. Planning
  2. Design
  3. Development
  4. Testing
  5. Approval
  6. Publishing
  7. Monitoring
  8. Updating
  9. Republishing
  10. Retirement

Administrators monitor agents throughout this lifecycle.


Lifecycle Management Activities

During an agent’s lifecycle, administrators may:

  • Update instructions
  • Improve prompts
  • Add new knowledge sources
  • Remove outdated content
  • Modify connectors
  • Improve security
  • Publish new versions
  • Disable obsolete agents
  • Archive retired agents

Lifecycle management is an ongoing process rather than a one-time task.


Adoption Monitoring

One important responsibility is measuring adoption.

Organizations often monitor:

  • Licensed users
  • Active users
  • Usage growth
  • Conversation volume
  • Department adoption
  • Business impact

High adoption generally indicates that users find the agent valuable.


Performance Monitoring

Performance monitoring focuses on the quality of the user experience.

Administrators may evaluate:

  • Response times
  • Reliability
  • Availability
  • Error rates
  • Successful interactions
  • Failed interactions

Consistent performance builds user confidence in AI solutions.


Security Monitoring

Monitoring also includes security.

Administrators watch for:

  • Unauthorized access
  • Permission issues
  • Authentication failures
  • Suspicious activity
  • Compliance alerts
  • Data access concerns

Security monitoring helps ensure that agents continue to comply with organizational policies.


Governance Monitoring

Governance activities include monitoring:

  • Approved agents
  • Published agents
  • Ownership
  • Data sources
  • Permissions
  • Connector usage
  • Compliance policies

Organizations should periodically review whether agents still meet governance requirements.


Environment Monitoring

The Power Platform admin center allows administrators to monitor environments that host agents.

Typical information includes:

  • Environment health
  • Capacity usage
  • Storage
  • Dataverse utilization
  • Resource allocation

Healthy environments help ensure reliable agent performance.


Monitoring Connectors

Many agents rely on connectors to access business systems.

Administrators may monitor:

  • Connector availability
  • Authentication status
  • Connection errors
  • Connector permissions
  • External system connectivity

Problems with connectors often result in incomplete or failed agent responses.


Monitoring User Feedback

Organizations should also gather user feedback.

Useful indicators include:

  • User satisfaction
  • Reported issues
  • Feature requests
  • Accuracy concerns
  • Suggested improvements

Feedback helps guide future improvements to the agent.


Retirement of Agents

Not every agent remains useful forever.

Administrators may retire agents when:

  • Business needs change.
  • New agents replace older versions.
  • Information becomes outdated.
  • Security risks increase.
  • Adoption declines significantly.

Retired agents should be archived or removed according to organizational governance policies.


Best Practices

Organizations should:

  • Monitor usage regularly.
  • Review adoption reports.
  • Monitor operational health.
  • Investigate errors promptly.
  • Review security frequently.
  • Track lifecycle status.
  • Keep documentation current.
  • Update agents regularly.
  • Remove obsolete agents.
  • Use both Microsoft 365 and Power Platform administration tools appropriately.

Microsoft 365 Admin Center vs. Power Platform Admin Center

Microsoft 365 Admin CenterPower Platform Admin Center
User administrationEnvironment administration
License managementDataverse management
Copilot adoptionAgent operations
Usage reportingEnvironment health
BillingConnector management
Service healthCapacity monitoring
Organization-wide administrationPower Platform governance
Copilot reportsOperational insights

Exam Tips

For the AB-900 exam, remember these key points:

  • The Microsoft 365 admin center focuses on Microsoft 365 administration, licensing, Copilot usage, adoption, and organizational reporting.
  • The Power Platform admin center focuses on operational management of custom agents, environments, connectors, Dataverse, and Power Platform resources.
  • Usage monitoring measures adoption and business value.
  • Operational insights focus on technical health and performance.
  • Agents should be monitored throughout their entire lifecycle.
  • Administrators should regularly review performance, governance, and security after an agent is deployed.

Practice Exam Questions

Question 1

Which administrative portal is primarily used to monitor Microsoft 365 Copilot adoption and licensing?

A. Microsoft 365 admin center

B. Microsoft Defender portal

C. Azure Portal

D. Microsoft Purview portal

Answer: A

Explanation: The Microsoft 365 admin center provides organization-wide administration, including Copilot licensing, adoption reports, and usage monitoring.


Question 2

What is the primary purpose of monitoring agent usage?

A. To increase internet bandwidth

B. To determine adoption and business value

C. To install software updates

D. To configure SharePoint permissions

Answer: B

Explanation: Usage metrics help organizations understand whether agents are delivering value and being actively used.


Question 3

Which portal is primarily responsible for monitoring environments, connectors, and Dataverse resources for custom agents?

A. Microsoft Entra admin center

B. Microsoft Purview portal

C. Microsoft Power Platform admin center

D. Exchange admin center

Answer: C

Explanation: The Power Platform admin center manages environments, Dataverse, connectors, capacity, and operational aspects of custom agents.


Question 4

Which metric best represents agent adoption?

A. CPU utilization

B. Network latency

C. Number of active users

D. Available storage space

Answer: C

Explanation: Active users are a key indicator of how widely an agent is being adopted.


Question 5

Which activity is part of an agent’s lifecycle after publication?

A. Ongoing monitoring and updates

B. Automatic deletion

C. Disabling Microsoft 365

D. Removing all connectors

Answer: A

Explanation: Administrators continuously monitor, update, and improve agents after they are deployed.


Question 6

Which of the following is considered an operational insight?

A. Number of licensed users

B. Employee vacation requests

C. Failed connector authentication

D. SharePoint storage quota purchase

Answer: C

Explanation: Operational insights include technical issues such as connector failures, authentication problems, and service errors.


Question 7

Why should administrators monitor agent performance?

A. To increase hardware prices

B. To ensure reliable responses and a positive user experience

C. To disable audit logs

D. To reduce Microsoft 365 storage

Answer: B

Explanation: Performance monitoring helps ensure agents remain reliable, responsive, and useful.


Question 8

Which administrative activity helps identify agents that are no longer providing business value?

A. Monitoring adoption trends

B. Updating Windows drivers

C. Installing Office applications

D. Configuring printers

Answer: A

Explanation: Declining adoption trends may indicate that an agent should be improved or retired.


Question 9

What should administrators monitor to help identify security concerns related to agents?

A. Desktop wallpaper settings

B. Keyboard layouts

C. Unauthorized access attempts and permission issues

D. Browser home pages

Answer: C

Explanation: Monitoring permissions, authentication failures, and unauthorized access helps maintain security.


Question 10

Which statement best describes the relationship between the Microsoft 365 admin center and the Microsoft Power Platform admin center?

A. Both portals perform exactly the same administrative functions.

B. The Microsoft 365 admin center is used only for Exchange Online.

C. The Power Platform admin center replaces the Microsoft 365 admin center for all administration.

D. The Microsoft 365 admin center focuses on organizational Microsoft 365 administration and Copilot usage, while the Power Platform admin center focuses on environments and operational management of custom agents.

Answer: D

Explanation: The two portals complement one another. The Microsoft 365 admin center provides tenant-wide administration, licensing, and adoption reporting, while the Power Platform admin center provides operational management of environments, connectors, Dataverse resources, and custom agents built with Copilot Studio.


Go to the AB-900 Exam Prep Hub main page