This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Use the appropriate tools to review audit logs for user and admin activity

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Monitoring user and administrator actions is an essential part of Microsoft 365 security and governance. Organizations must be able to determine:

• Who performed an action.
• What action occurred.
• When the activity occurred.
• Which resource was affected.
• Whether the activity was expected or suspicious.

Microsoft 365 provides several audit and logging tools that help administrators investigate security incidents, track administrative changes, support compliance requirements, and troubleshoot user issues.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the purpose of audit logs and know which tools are used to review user and administrator activity.

What Are Audit Logs?

Audit logs are records of activities performed within Microsoft 365 services.

They help organizations:

• Detect suspicious behavior.
• Investigate incidents.
• Meet regulatory requirements.
• Track administrative changes.
• Support forensic investigations.
• Verify user actions.

Audit logs provide visibility into activities occurring across Microsoft 365 environments.

Types of Activities Recorded

Microsoft 365 audit logs can capture actions such as:

User Activities

• Signing in
• Accessing files
• Sharing documents
• Creating Teams messages
• Deleting files
• Downloading content

Administrator Activities

• Resetting passwords
• Creating users
• Assigning licenses
• Modifying policies
• Creating groups
• Changing permissions

Service Activities

• Mailbox operations
• SharePoint changes
• Teams events
• Security configuration changes

Unified Audit Log

The primary audit tool in Microsoft 365 is the Unified Audit Log.

The Unified Audit Log collects events from multiple Microsoft 365 services, including:

• Microsoft Entra ID
• Exchange Online
• SharePoint Online
• OneDrive
• Microsoft Teams
• Microsoft Purview
• Microsoft Defender
• Power Platform services

Instead of reviewing separate logs for every service, administrators can search centrally.

Microsoft Purview Audit

The Unified Audit Log is accessed through Microsoft Purview.

Administrators can:

• Search activities by user.
• Search by date range.
• Filter by workload.
• Filter by activity type.
• Export results.

This centralized approach simplifies investigations.

Common Search Filters

Administrators commonly filter audit logs by:

User

Example:

user1@contoso.com

Activity

Examples:

• File deleted
• Mailbox accessed
• User added
• Password reset

Date and Time

Investigations often focus on a specific period.

Workload

Examples:

• SharePoint
• Exchange
• Teams
• Entra ID

These filters narrow results and improve efficiency.

Microsoft Entra Sign-In Logs

Sign-in logs are separate from the Unified Audit Log and focus specifically on authentication activity.

Sign-in logs record:

• Successful sign-ins
• Failed sign-ins
• IP addresses
• Device information
• Authentication methods used
• Conditional Access results

Sign-in logs are commonly used to troubleshoot access issues and investigate suspicious login attempts.

Audit Logs vs Sign-In Logs

Students frequently confuse these two tools.

Sign-In Logs

Focus on:

• Authentication attempts
• MFA events
• Conditional Access outcomes
• Login locations

Audit Logs

Focus on:

• User actions after authentication
• Administrative changes
• File access
• Configuration modifications

Both are important, but they serve different purposes.

Examples of Audit Events

Exchange Online

Events may include:

• Mailbox access
• Email deletions
• Mailbox permission changes

SharePoint Online

Events may include:

• File creation
• File downloads
• File sharing

Microsoft Teams

Events may include:

• Team creation
• Channel creation
• Membership changes

Microsoft Entra ID

Events may include:

• User creation
• Group modifications
• Role assignments

Reviewing Administrator Activity

Audit logs help determine:

• Which administrator made a change.
• When the change occurred.
• Which object was affected.

Examples include:

• Password resets.
• License assignments.
• Group membership changes.
• Conditional Access policy modifications.

This provides accountability and supports change tracking.

Reviewing User Activity

Audit logs can help answer questions such as:

• Did a user delete a file?
• Was a document downloaded?
• Was information shared externally?
• When did the action occur?

This information is valuable during investigations and compliance reviews.

Audit Logs and Microsoft 365 Copilot

Microsoft 365 Copilot relies on Microsoft 365 data sources.

Audit capabilities help organizations monitor:

• User access to content.
• Sharing activities.
• Administrative changes affecting Copilot environments.
• Compliance investigations involving AI-related workflows.

Copilot itself uses the same Microsoft 365 security and compliance framework.

Microsoft Defender XDR and Advanced Investigations

Microsoft Defender XDR can correlate events across:

• Identities
• Devices
• Email
• Applications

This provides a broader security perspective when investigating incidents.

While audit logs show individual events, Defender XDR helps connect related activities.

Retention of Audit Logs

Audit logs are retained for a specific period depending on:

• Subscription level.
• Licensing.
• Service configuration.

Organizations with advanced compliance licensing may receive extended retention periods.

For AB-900, understand that retention periods can vary by license type.

Exporting Audit Results

Administrators can export audit results for:

• Incident response.
• Compliance reporting.
• External investigations.
• Long-term analysis.

Exported data can be reviewed using spreadsheets or SIEM solutions.

Best Practices

Review Logs Regularly

Continuous monitoring helps detect issues early.

Use Filters

Filtering speeds investigations.

Protect Administrator Accounts

Administrative actions should always be auditable.

Enable MFA

Secure accounts that have access to audit data.

Maintain Least Privilege

Limit who can access sensitive logs.

Retain Logs Appropriately

Ensure audit records meet organizational requirements.

Important Exam Tips

Remember these AB-900 concepts:

• The Unified Audit Log is the primary Microsoft 365 audit tool.
• Microsoft Purview provides access to audit searches.
• Audit logs track actions performed after authentication.
• Sign-in logs focus on authentication events.
• Audit logs support investigations and compliance.
• Administrator changes are recorded.
• User activities can be searched and reviewed.
• Microsoft 365 Copilot relies on the same audit and compliance framework.
• Exporting logs supports reporting and analysis.
• Retention periods vary by license.

Practice Exam Questions

Question 1

Which Microsoft 365 feature provides centralized auditing across multiple services?

A. Microsoft Planner
B. Windows Event Viewer
C. Unified Audit Log
D. Microsoft Lists

Correct Answer: C

Explanation: The Unified Audit Log aggregates events from multiple Microsoft 365 services into a single searchable location.

Question 2

Which portal is commonly used to access audit searches?

A. Exchange admin center
B. Teams admin center
C. Microsoft Purview
D. SharePoint admin center

Correct Answer: C

Explanation: Microsoft Purview provides access to auditing and compliance features, including audit searches.

Question 3

Which activity would typically appear in an audit log?

A. Administrator resets a user’s password.
B. Monitor brightness changes.
C. Printer toner replacement.
D. CPU temperature fluctuations.

Correct Answer: A

Explanation: Administrative actions such as password resets are recorded in audit logs.

Question 4

Which log type focuses primarily on authentication events?

A. Microsoft Entra sign-in logs
B. SharePoint recycle bin logs
C. Unified Audit Log
D. Exchange message trace logs

Correct Answer: A

Explanation: Sign-in logs capture authentication attempts, MFA information, and Conditional Access outcomes.

Question 5

Which Microsoft 365 service records file downloads and sharing activities?

A. SharePoint Online audit events
B. Windows Registry
C. BIOS settings
D. Active Directory Sites and Services

Correct Answer: A

Explanation: SharePoint audit events track document-related activities.

Question 6

An administrator wants to determine who changed a Conditional Access policy. Which tool should be used?

A. Windows Device Manager
B. Unified Audit Log
C. Outlook rules wizard
D. Microsoft Paint

Correct Answer: B

Explanation: Administrative changes are captured within Microsoft 365 audit records.

Question 7

What is a major difference between audit logs and sign-in logs?

A. Audit logs only store Exchange events.
B. Sign-in logs are used exclusively for Teams.
C. Audit logs track actions after authentication, while sign-in logs track authentication attempts.
D. Sign-in logs cannot be searched.

Correct Answer: C

Explanation: Sign-in logs focus on access attempts, while audit logs record actions performed after access is granted.

Question 8

Which filter can help narrow audit search results?

A. User name
B. Date range
C. Activity type
D. All of the above

Correct Answer: D

Explanation: Audit searches support multiple filters to improve investigation efficiency.

Question 9

Why are audit logs important for compliance investigations?

A. They increase internet bandwidth.
B. They provide records of user and administrator actions.
C. They automatically block attacks.
D. They create Conditional Access policies.

Correct Answer: B

Explanation: Audit records provide evidence of activities that occurred within Microsoft 365.

Question 10

Which statement about Microsoft 365 Copilot and auditing is correct?

A. Copilot bypasses audit logging.
B. Copilot disables Microsoft Purview.
C. Copilot uses a separate audit system unrelated to Microsoft 365.
D. Copilot operates within the existing Microsoft 365 compliance and auditing framework.

Correct Answer: D

Explanation: Microsoft 365 Copilot relies on the same security, compliance, and audit infrastructure used throughout Microsoft 365.

Go to the AB-900 Exam Prep Hub main page

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   –> Identify the core security features of Microsoft 365 services
      –> Identify the appropriate tools to troubleshoot common sign-in issues (multifactor authentication [MFA], conditional access, and risky sign-ins)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub’s main page below the exam topics section.

Introduction

Identity security is one of the foundations of Microsoft 365. Users depend on secure and reliable access to services such as Outlook, Teams, SharePoint, OneDrive, and Microsoft 365 Copilot. When users cannot sign in, administrators must determine the cause and resolve the issue quickly.

Microsoft provides several tools within Microsoft Entra, Microsoft 365, and Microsoft Defender to diagnose and troubleshoot sign-in problems related to:

• Multi-Factor Authentication (MFA)
• Conditional Access policies
• Risky sign-ins
• Identity Protection alerts
• Account lockouts
• Authentication failures

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand which tools are used to investigate and resolve these common issues.

Common Causes of Sign-In Problems

Users may experience sign-in failures because of:

• Incorrect passwords
• Expired credentials
• Multi-Factor Authentication failures
• Conditional Access policies
• Blocked locations
• Device compliance requirements
• Risky sign-ins detected by Microsoft Entra
• Account lockouts
• Disabled user accounts

Troubleshooting begins by identifying which security control is preventing access.

Microsoft Entra Admin Center

The Microsoft Entra admin center is the primary location for troubleshooting identity-related problems.

Administrators can:

• View users and groups.
• Reset passwords.
• Review authentication methods.
• Investigate sign-in activity.
• Examine Conditional Access policies.
• Review risky users and risky sign-ins.

Many sign-in investigations begin here.

Sign-In Logs

One of the most important troubleshooting tools is the Sign-In Logs page in Microsoft Entra.

Sign-in logs provide information such as:

• User account involved
• Time of sign-in attempt
• Success or failure status
• IP address
• Location
• Device information
• Authentication method used
• Applications being accessed
• Conditional Access results

Example

A user reports they cannot access Teams.

The sign-in log may show:

Failure reason: Conditional Access policy requires a compliant device.

This immediately points administrators toward the root cause.

Authentication Methods

Administrators can review a user’s configured authentication methods.

Examples include:

• Microsoft Authenticator app
• SMS verification
• Phone calls
• FIDO2 security keys
• Passkeys

Problems may occur if:

• A user changes phones.
• The Authenticator app is deleted.
• Authentication methods are not registered.

Administrators can help users re-register their methods if necessary.

Troubleshooting Multi-Factor Authentication (MFA)

MFA issues commonly involve:

Missing Registration

The user never enrolled in MFA.

Lost Device

The user replaced or lost their phone.

Notification Problems

Push notifications are not being received.

Incorrect Verification Method

The user is attempting to use an outdated authentication method.

Blocked Authentication

Security policies may prevent certain authentication methods.

Authentication Methods Policy

Administrators can review authentication method policies to verify:

• Which methods are allowed.
• Which users are targeted.
• Whether a method has been disabled.

If SMS authentication has been disabled, users relying on text messages may be unable to complete MFA.

Conditional Access Troubleshooting

Conditional Access policies are a common source of access problems.

Examples include:

• Requiring MFA
• Blocking certain countries
• Requiring compliant devices
• Restricting specific applications

A user may have valid credentials but still be denied access because a policy condition is not satisfied.

Conditional Access Insights

The Conditional Access tab in sign-in logs helps administrators understand:

• Which policies were evaluated.
• Which policies applied.
• Why access was granted or denied.

Example

The log may indicate:

Access blocked because device is not compliant.

This allows administrators to identify the exact policy causing the issue.

What-If Tool

The Conditional Access What-If tool allows administrators to simulate access scenarios.

Administrators can test:

• User identity
• Device platform
• Location
• Application

The tool predicts which policies would apply without affecting production users.

This is extremely helpful when diagnosing policy conflicts.

Risky Sign-Ins

Microsoft Entra Identity Protection analyzes sign-in behavior and detects suspicious activity.

Examples include:

• Impossible travel
• Anonymous IP addresses
• Malware-linked addresses
• Unfamiliar locations

A sign-in may be blocked even when the password is correct.

Risky Users

A user may be flagged as risky because:

• Credentials were leaked.
• Suspicious activity was detected.
• Malware activity was associated with the account.

Risk levels include:

• Low
• Medium
• High

Administrators can review and remediate risky users.

Identity Protection Dashboard

The Identity Protection dashboard helps administrators investigate:

• Risky users
• Risky sign-ins
• Risk detections

Administrators can:

• Confirm compromise.
• Dismiss false positives.
• Require password resets.
• Restore access.

Password Reset Tools

Users who forget passwords can use:

Self-Service Password Reset (SSPR)

Allows users to reset passwords without contacting IT.

Benefits include:

• Faster recovery
• Reduced help desk workload
• Improved productivity

Administrators can also manually reset passwords when necessary.

Account Status

Administrators should verify whether:

• The account is enabled.
• The user license is assigned.
• The account has been deleted.
• Sign-in is blocked.

Sometimes the simplest explanation is the correct one.

Device Compliance Issues

Conditional Access often integrates with Microsoft Intune.

Users may be blocked because:

• Device encryption is disabled.
• Operating systems are outdated.
• Antivirus requirements are unmet.
• Devices are unmanaged.

Administrators can review compliance status in Intune.

Common Troubleshooting Workflow

Step 1: Verify User Account

• Is the account active?
• Is the correct license assigned?

Step 2: Review Sign-In Logs

• Determine why authentication failed.

Step 3: Check MFA

• Verify authentication methods.

Step 4: Review Conditional Access

• Identify policies that blocked access.

Step 5: Review Risk Detections

• Investigate risky users or risky sign-ins.

Step 6: Remediate

• Reset password.
• Re-register MFA.
• Update device compliance.
• Modify policy if appropriate.

Microsoft 365 Copilot Sign-In Issues

Microsoft 365 Copilot uses the same identity infrastructure as Microsoft 365.

Therefore, problems involving:

• MFA
• Conditional Access
• User permissions
• Risky sign-ins

can also affect access to Copilot.

Copilot does not bypass Microsoft Entra security controls.

Best Practices

Enable Self-Service Password Reset

Reduce support calls and improve user productivity.

Require MFA

Protect accounts from password theft.

Review Sign-In Logs First

They often reveal the root cause quickly.

Test Policies Before Deployment

Use the What-If tool to avoid accidental lockouts.

Monitor Risk Detections

Respond quickly to compromised accounts.

Apply Least Privilege

Avoid overly broad permissions and exceptions.

Exam Tips

Remember these AB-900 concepts:

• The Microsoft Entra admin center is the primary identity troubleshooting portal.
• Sign-in logs provide detailed authentication information.
• MFA problems often involve authentication methods.
• Conditional Access policies can block otherwise valid sign-ins.
• The What-If tool simulates policy results.
• Risky sign-ins are detected by Identity Protection.
• Risky users may require password resets.
• Self-Service Password Reset helps users recover accounts.
• Device compliance can affect access.
• Microsoft 365 Copilot relies on the same identity controls as Microsoft 365.

Practice Exam Questions

Question 1

A user reports they cannot access Microsoft Teams even though their password is correct. Which tool should an administrator review first?

A. Microsoft Planner
B. SharePoint recycle bin
C. Exchange message trace
D. Sign-in logs in Microsoft Entra

Correct Answer: D

Explanation: Sign-in logs provide details about authentication attempts and often reveal the reason access failed.

Question 2

Which Microsoft portal is the primary location for investigating identity-related sign-in problems?

A. SharePoint admin center
B. Microsoft Entra admin center
C. Teams admin center
D. Exchange admin center

Correct Answer: B

Explanation: Microsoft Entra provides identity management and troubleshooting capabilities.

Question 3

A user receives an MFA prompt but no longer has their old phone. Which area should an administrator review?

A. Distribution groups
B. Shared mailboxes
C. Authentication methods
D. Mail flow rules

Correct Answer: C

Explanation: Authentication methods determine which MFA options are available to users.

Question 4

Which feature allows administrators to simulate how Conditional Access policies would affect a user?

A. Risk detections dashboard
B. Sign-in diagnostics
C. Password reset portal
D. Conditional Access What-If tool

Correct Answer: D

Explanation: The What-If tool predicts policy outcomes without affecting users.

Question 5

Which Microsoft capability identifies suspicious activities such as impossible travel?

A. Exchange Online Protection
B. Microsoft Lists
C. Identity Protection
D. SharePoint Syntex

Correct Answer: C

Explanation: Identity Protection analyzes sign-in behavior and detects potential compromises.

Question 6

A sign-in log shows that access was denied because the device is not compliant. Which Microsoft service commonly provides compliance information?

A. Microsoft Intune
B. Outlook
C. Planner
D. Word

Correct Answer: A

Explanation: Intune manages devices and reports compliance status used by Conditional Access.

Question 7

Which feature allows users to reset their own passwords without contacting IT?

A. Password Protection
B. Self-Service Password Reset (SSPR)
C. Secure Score
D. Message Encryption

Correct Answer: B

Explanation: SSPR enables users to recover access independently.

Question 8

Which information can administrators view in sign-in logs?

A. Printer serial numbers
B. Monitor resolutions
C. CPU temperatures
D. Authentication success or failure details

Correct Answer: D

Explanation: Sign-in logs contain information about sign-in attempts and their outcomes.

Question 9

Which type of event may cause Microsoft Entra to classify a sign-in as risky?

A. Impossible travel between locations
B. A full mailbox
C. Duplicate Teams channels
D. Deleted SharePoint folders

Correct Answer: A

Explanation: Impossible travel is one of the risk signals analyzed by Identity Protection.

Question 10

How are Microsoft 365 Copilot sign-in problems typically investigated?

A. Copilot uses a separate identity system.
B. Copilot bypasses Conditional Access.
C. Copilot relies on the same Microsoft Entra identity controls as Microsoft 365.
D. Copilot does not use MFA.

Correct Answer: C

Explanation: Copilot uses the same authentication and security infrastructure as other Microsoft 365 services.

Go to the AB-900 Exam Prep Hub main page

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Identify the appropriate security object to use in an organization (users and groups)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Microsoft 365 uses identities and group memberships to control access to resources, applications, and data. Two of the most important security objects in Microsoft Entra ID and Microsoft 365 are users and groups.

Understanding when to use users and groups is fundamental to administering Microsoft 365 and securing resources. Rather than assigning permissions individually to every person, administrators can use groups to simplify access management and improve security.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the purpose of users and groups, their differences, and common scenarios for using each object.

Understanding Security Objects

A security object represents an identity or a collection of identities that can receive permissions and access rights.

Common Microsoft 365 security objects include:

• Users
• Groups
• Service principals
• Devices

For the AB-900 exam, the focus is primarily on users and groups.

Users

A user represents an individual identity that can authenticate and access Microsoft 365 resources.

Examples include:

• Employees
• Contractors
• Students
• Administrators

Each user account contains information such as:

• Username (User Principal Name)
• Display name
• Email address
• Assigned licenses
• Group memberships
• Authentication settings

Types of User Accounts

Member Users

Member users belong to the organization’s Microsoft Entra tenant.

Examples:

• Employees
• IT administrators
• Internal staff

Member users typically receive:

• Microsoft 365 licenses
• Mailboxes
• Teams access
• SharePoint permissions

Guest Users

Guest users are external users invited into the organization through Microsoft Entra B2B collaboration.

Examples:

• Vendors
• Consultants
• Business partners

Guest users:

• Use their own credentials.
• Access only resources that have been shared with them.
• Typically do not require full Microsoft 365 licenses.

Why User Accounts Are Important

User accounts provide:

Authentication

Verifying identity during sign-in.

Authorization

Determining what resources users can access.

Auditing

Tracking activities performed by specific individuals.

Personalization

Providing personalized experiences across Microsoft 365.

Groups

A group is a collection of users that simplifies management.

Instead of assigning permissions individually to many users, administrators assign permissions to the group and then add users to that group.

Benefits include:

• Easier administration
• Consistent permissions
• Reduced errors
• Faster onboarding and offboarding

Why Groups Improve Security

Suppose 100 employees need access to a SharePoint site.

Without groups:

• Permissions must be assigned to 100 individual users.

With groups:

1. Create a group.
2. Assign permissions once.
3. Add users to the group.

This approach is:

• Easier to manage.
• More scalable.
• Less likely to produce permission mistakes.

Types of Groups in Microsoft 365

Security Groups

Security groups are used primarily for assigning permissions.

Common uses:

• SharePoint access
• Conditional Access targeting
• Application permissions
• Device management

Example:

Finance Security Group

Members automatically inherit permissions assigned to the group.

Microsoft 365 Groups

Microsoft 365 groups provide collaboration capabilities in addition to membership management.

They can automatically provide:

• Shared mailbox
• Shared calendar
• Teams workspace
• SharePoint site
• Planner resources

Example:

Marketing Team

Distribution Groups

Distribution groups are used mainly for email communication.

Purpose:

• Send one email to multiple recipients.

Examples:

• All Employees
• Human Resources
• Sales Department

Distribution groups do not provide collaboration resources like Teams or SharePoint sites.

Mail-Enabled Security Groups

These groups combine:

• Security permissions
• Email distribution capabilities

They are useful when a group needs both access permissions and email functionality.

Users vs Groups

When to Use Individual Users

Use user objects when:

• Assigning licenses.
• Managing authentication methods.
• Configuring MFA.
• Reviewing sign-in logs.
• Managing personal mailboxes.

Examples:

• Assigning a Microsoft 365 Copilot license.
• Resetting a password.
• Enabling MFA.

When to Use Groups

Use groups when:

• Granting access to resources.
• Assigning SharePoint permissions.
• Managing Teams membership.
• Applying Conditional Access policies.
• Organizing departments.

Examples:

• Finance team access to a SharePoint site.
• Sales department access to Teams channels.
• Applying a security policy to all administrators.

Group-Based Management

Microsoft Entra supports group-based administration.

Advantages include:

Simplified Administration

One change affects many users.

Reduced Errors

Permissions are applied consistently.

Faster Employee Onboarding

Adding a new employee to the correct groups automatically provides needed access.

Easier Offboarding

Removing users from groups quickly revokes access.

Dynamic Groups

Dynamic groups automatically add or remove users based on attributes.

Examples:

• Department = Sales
• Country = United States
• Job title = Manager

Benefits:

• Automation
• Reduced administrative effort
• Consistent membership

Groups and Conditional Access

Conditional Access policies often target:

• Users
• Groups

Example:

Require MFA for all members of the IT Administrators group.

This is more efficient than configuring each administrator individually.

Groups and Microsoft 365 Copilot

Groups help manage access to resources used by Microsoft 365 Copilot.

Examples:

• Teams membership
• SharePoint permissions
• Collaboration resources
• Departmental content access

Because Copilot respects existing permissions, group memberships indirectly influence what content users can access through Copilot.

Best Practices

Assign Permissions to Groups Instead of Individuals

This improves scalability and consistency.

Use Security Groups for Access Management

Avoid assigning permissions directly to users whenever possible.

Use Microsoft 365 Groups for Collaboration

These groups support Teams, SharePoint, and Outlook integration.

Follow Least Privilege

Provide only the permissions users require.

Review Group Membership Regularly

Remove unnecessary access and outdated memberships.

Exam Tips

Remember these AB-900 concepts:

• Users represent individual identities.
• Groups represent collections of users.
• Users authenticate; groups do not.
• Security groups manage permissions.
• Microsoft 365 groups support collaboration resources.
• Distribution groups are primarily used for email.
• Group-based management simplifies administration.
• Dynamic groups automate membership.
• Conditional Access policies can target groups.
• Microsoft 365 Copilot respects permissions inherited through groups.

Practice Exam Questions

Question 1

Which security object represents an individual identity in Microsoft 365?

A. Distribution group
B. Microsoft 365 group
C. User account
D. Shared mailbox

Correct Answer: C

Explanation: A user account represents an individual who can authenticate and access Microsoft 365 resources.

Question 2

What is the primary advantage of using groups instead of assigning permissions individually?

A. Groups eliminate authentication requirements.
B. Groups simplify administration and provide consistent access.
C. Groups automatically assign licenses.
D. Groups replace Microsoft Entra ID.

Correct Answer: B

Explanation: Groups allow administrators to manage permissions for multiple users at once.

Question 3

Which type of group is primarily used for email distribution?

A. Security group
B. Microsoft 365 group
C. Dynamic group
D. Distribution group

Correct Answer: D

Explanation: Distribution groups are designed mainly for sending email messages to multiple recipients.

Question 4

Which object can sign in to Microsoft 365?

A. User account
B. Security group
C. Distribution group
D. Microsoft 365 group

Correct Answer: A

Explanation: Users authenticate directly, while groups are collections of users and cannot sign in.

Question 5

Which group type automatically provides collaboration resources such as a shared mailbox and SharePoint site?

A. Security group
B. Distribution group
C. Mail-enabled security group
D. Microsoft 365 group

Correct Answer: D

Explanation: Microsoft 365 groups provide collaboration services including Teams and SharePoint.

Question 6

A company wants to grant SharePoint access to an entire department. Which approach is recommended?

A. Assign permissions to each employee individually.
B. Create a security group and assign permissions to the group.
C. Create separate user accounts for each site.
D. Use a distribution group only.

Correct Answer: B

Explanation: Security groups simplify access management and reduce administrative effort.

Question 7

What is a dynamic group?

A. A group used only for Teams meetings.
B. A group with manually maintained memberships.
C. A group that sends email externally.
D. A group whose membership is automatically managed based on user attributes.

Correct Answer: D

Explanation: Dynamic groups automatically update membership according to configured rules.

Question 8

Which object is typically assigned Microsoft 365 licenses?

A. Security groups
B. Distribution groups
C. User accounts
D. Shared calendars

Correct Answer: C

Explanation: Licenses are generally assigned to individual users.

Question 9

Which statement about guest users is correct?

A. Guest users must always have Microsoft 365 licenses.
B. Guest users are external users invited to collaborate with the organization.
C. Guest users replace security groups.
D. Guest users cannot access SharePoint resources.

Correct Answer: B

Explanation: Guest users are external identities that can be granted access to shared resources.

Question 10

How do groups influence Microsoft 365 Copilot?

A. Groups allow Copilot to bypass permissions.
B. Groups disable Conditional Access.
C. Groups determine resource permissions that Copilot respects.
D. Groups automatically generate Copilot prompts.

Correct Answer: C

Explanation: Copilot uses existing Microsoft 365 permissions, many of which are granted through group memberships.

Go to the AB-900 Exam Prep Hub main page