Tag: security

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification June 27, 2026

Understand the purpose and benefits of Single Sign-On (SSO) (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Understand the purpose and benefits of SSO

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern organizations use many applications and services, including Microsoft 365, Teams, SharePoint, Exchange Online, and third-party cloud applications. Without a centralized authentication system, users would need to maintain separate usernames and passwords for every application they use.

Single Sign-On (SSO) simplifies the user experience and improves security by allowing users to authenticate once and then access multiple applications without repeatedly signing in.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding the purpose and benefits of SSO is an important identity and security concept.

What Is Single Sign-On (SSO)?

Single Sign-On (SSO) is an authentication capability that allows users to sign in one time and gain access to multiple applications and services without entering credentials again for each application.

Instead of managing separate accounts for every service, users rely on a single identity managed through Microsoft Entra ID.

Example

A user signs in once and can then access:

Outlook
Microsoft Teams
SharePoint Online
OneDrive
Microsoft 365 Copilot
Third-party applications integrated with Microsoft Entra

SSO improves both convenience and security.

Why SSO Is Important

Without SSO, users often:

Maintain many passwords.
Reuse passwords across applications.
Forget credentials.
Require frequent password resets.

SSO addresses these challenges by providing a centralized authentication experience.

How Single Sign-On Works

The SSO process generally follows these steps:

Step 1: User Signs In

The user authenticates with Microsoft Entra ID.

Step 2: Identity Is Verified

Microsoft Entra confirms the user’s identity.

Step 3: Authentication Token Is Issued

A secure token is generated.

Step 4: Applications Trust the Token

Integrated applications accept the token and grant access without requiring another sign-in.

This process allows users to move seamlessly between applications.

SSO and Microsoft Entra ID

Microsoft Entra ID serves as the identity provider for Microsoft 365.

It provides:

Authentication
Authorization
Identity management
Access policies

Because Microsoft 365 services trust Microsoft Entra ID, users can access multiple services after a single sign-in.

Applications That Support SSO

SSO can be used with:

Microsoft 365 Applications

Examples:

Outlook
Teams
SharePoint Online
OneDrive
Word
Excel
PowerPoint

Third-Party Applications

Examples:

Salesforce
ServiceNow
Workday
Thousands of SaaS applications

Custom Applications

Organizations can integrate internally developed applications with Microsoft Entra.

Benefits of Single Sign-On

Improved User Experience

Users sign in once instead of repeatedly entering passwords.

Benefits include:

Less frustration.
Faster access to applications.
Improved productivity.

Reduced Password Fatigue

Managing many passwords can be difficult.

SSO reduces:

Forgotten passwords.
Password reuse.
User frustration.

Fewer Help Desk Requests

Password resets are one of the most common support issues.

SSO reduces:

Password-related tickets.
Administrative overhead.
Support costs.

Increased Productivity

Employees spend less time signing in and more time working.

Users can move easily between:

Teams
Outlook
SharePoint
Copilot

without repeated authentication prompts.

Improved Security

Although SSO simplifies access, security can actually improve because organizations can enforce:

Multi-Factor Authentication (MFA)
Conditional Access
Identity Protection
Centralized authentication policies

Centralized Access Management

Administrators can manage identities from one location instead of configuring authentication separately for every application.

Benefits include:

Easier administration.
Consistent security controls.
Faster onboarding and offboarding.

SSO and Multi-Factor Authentication

SSO does not replace MFA.

Instead, they work together.

Example:

User signs in once.
User completes MFA.
Access is granted to multiple applications.

This provides:

Convenience
Strong security

SSO and Conditional Access

Conditional Access policies can still apply even when SSO is used.

Examples:

Require MFA outside the corporate network.
Block risky sign-ins.
Require compliant devices.

SSO and Conditional Access complement each other.

SSO and Zero Trust

Single Sign-On supports Zero Trust when combined with modern security controls.

Verify Explicitly

Authentication still occurs before access is granted.

Use Least Privileged Access

Permissions are still enforced.

Assume Breach

Additional controls such as MFA and Conditional Access continue to evaluate risk.

SSO Does Not Mean Unlimited Access

A common misconception is that SSO gives users access to everything.

This is incorrect.

SSO:

Simplifies authentication.

Authorization still determines:

Which applications users can access.
What permissions they have.
Which resources they can view.

Users only receive access to resources they are authorized to use.

SSO and Microsoft 365 Copilot

Microsoft 365 Copilot relies on Microsoft Entra identities and benefits from SSO.

After users authenticate, they can move between:

Outlook
Teams
SharePoint
Word
Copilot experiences

without repeatedly entering credentials.

Copilot still respects existing permissions and security controls.

SSO vs Multiple Sign-Ins

Without SSO	With SSO
Multiple passwords	One identity
Repeated sign-ins	Single sign-in
Higher password fatigue	Better user experience
More password reset requests	Fewer support calls
Greater password reuse risk	Improved security

Best Practices

Enable Multi-Factor Authentication

SSO should be combined with MFA for stronger security.

Use Conditional Access

Evaluate sign-in risk and device compliance.

Follow Least Privilege

Users should only access necessary resources.

Centralize Identity Management

Use Microsoft Entra ID to manage users and applications.

Educate Users

Help users understand the difference between authentication and authorization.

Exam Tips

Remember these AB-900 concepts:

SSO stands for Single Sign-On.
SSO allows one sign-in to access multiple applications.
Microsoft Entra ID provides SSO for Microsoft 365.
SSO improves productivity and user experience.
SSO reduces password fatigue and help desk requests.
SSO does not replace authorization.
MFA and Conditional Access continue to function with SSO.
SSO supports Zero Trust when combined with additional security controls.
Microsoft 365 Copilot benefits from SSO.
Users only access resources they are authorized to use.

Practice Exam Questions

Question 1

What is the primary purpose of Single Sign-On (SSO)?

A. Encrypt documents automatically
B. Allow one authentication event to provide access to multiple applications
C. Replace authorization controls
D. Eliminate passwords completely

Correct Answer: B

Explanation: SSO enables users to authenticate once and access multiple applications without repeatedly entering credentials.

Question 2

Which Microsoft service provides Single Sign-On capabilities for Microsoft 365?

A. Microsoft Entra ID
B. Exchange Online
C. Microsoft Defender XDR
D. Microsoft Purview

Correct Answer: A

Explanation: Microsoft Entra ID acts as the identity provider for Microsoft 365 applications.

Question 3

Which problem does SSO help reduce?

A. SharePoint storage limitations
B. Teams meeting duration limits
C. Password fatigue
D. Mailbox quotas

Correct Answer: C

Explanation: Users no longer need to remember numerous passwords for different applications.

Question 4

What typically decreases when organizations implement SSO?

A. File version history
B. Help desk password reset requests
C. Device compliance policies
D. Multi-Factor Authentication

Correct Answer: B

Explanation: Fewer passwords usually lead to fewer password-related support requests.

Question 5

Which security control commonly works together with SSO?

A. Multi-Factor Authentication
B. Shared mailboxes
C. Distribution lists
D. Public folders

Correct Answer: A

Explanation: MFA strengthens security while maintaining the convenience of SSO.

Question 6

Does SSO automatically grant users access to every application?

A. Yes, if they know their password.
B. Yes, after one successful sign-in.
C. No, authorization and permissions still determine access.
D. No, unless Teams is installed.

Correct Answer: C

Explanation: SSO simplifies authentication but does not bypass authorization.

Question 7

Which statement best describes the relationship between SSO and Conditional Access?

A. SSO disables Conditional Access.
B. Conditional Access only works without SSO.
C. SSO replaces Conditional Access.
D. SSO and Conditional Access work together to secure access.

Correct Answer: D

Explanation: Conditional Access policies continue to evaluate users and devices even when SSO is used.

Question 8

Which benefit of SSO improves employee productivity?

A. Automatic mailbox backups
B. Elimination of file permissions
C. Reduced repeated sign-ins
D. Increased SharePoint storage

Correct Answer: C

Explanation: Users spend less time authenticating and more time working.

Question 9

Which Microsoft 365 services can benefit from SSO?

A. Outlook only
B. Teams only
C. SharePoint only
D. Outlook, Teams, SharePoint, and other Microsoft 365 applications

Correct Answer: D

Explanation: SSO supports access across multiple Microsoft 365 services.

Question 10

How does Microsoft 365 Copilot use Single Sign-On?

A. Copilot bypasses Microsoft Entra authentication.
B. Copilot requires separate credentials from Microsoft 365.
C. Copilot benefits from the same sign-in experience used by Microsoft 365 services.
D. Copilot disables Multi-Factor Authentication.

Correct Answer: C

Explanation: Copilot relies on Microsoft Entra identities and participates in the same SSO experience as other Microsoft 365 applications.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification June 27, 2026

Understand conditional access policies (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Understand conditional access policies

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Modern organizations must secure access to Microsoft 365 resources while still allowing users to work from anywhere and on many different devices. Traditional security models that rely only on usernames and passwords are no longer sufficient.

Conditional Access is one of the most important security features in Microsoft Entra. It helps organizations make intelligent access decisions based on various conditions and risk signals.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand what Conditional Access is, how policies work, and the common controls used to protect Microsoft 365 resources.

What Is Conditional Access?

Conditional Access is a feature of Microsoft Entra ID that evaluates signals and applies access controls before allowing users to access resources.

It is often described as:

“If this condition exists, then perform this action.”

Examples:

If a user signs in from outside the company network, require Multi-Factor Authentication.
If a device is not compliant, block access.
If a sign-in is considered high risk, deny access.

Conditional Access supports Microsoft’s Zero Trust security strategy.

Why Conditional Access Is Important

Conditional Access helps organizations:

Strengthen identity security.
Reduce unauthorized access.
Protect sensitive information.
Enable secure remote work.
Support compliance requirements.
Apply adaptive security controls.

Instead of trusting every sign-in automatically, Conditional Access evaluates each access request individually.

How Conditional Access Works

A Conditional Access policy generally contains three components:

1. Assignments (Who and What?)

Defines:

Users or groups
Applications
Conditions

2. Conditions (When?)

Conditions determine when the policy applies.

Examples:

Location
Device platform
Sign-in risk
User risk
Client applications

3. Access Controls (What Happens?)

Controls determine the action taken.

Examples:

Require MFA
Require a compliant device
Require password change
Block access

Common Components of a Conditional Access Policy

Users and Groups

Policies can target:

All users
Specific users
Security groups
Administrative accounts

Organizations often apply stricter policies to privileged users.

Cloud Apps and Resources

Policies can protect:

Microsoft 365 applications
Teams
Exchange Online
SharePoint Online
Custom applications

Different applications can have different requirements.

Conditions Used by Conditional Access

Location

Policies can evaluate where users are signing in from.

Examples:

Trusted corporate locations
External networks
Specific countries or regions

Example:

			
If sign-in occurs outside the corporate network,
require MFA.

Device Platform

Policies can apply to:

Windows
macOS
iOS
Android

Organizations may choose to treat platforms differently.

Device State

Conditional Access can determine whether devices are:

Compliant
Hybrid joined
Managed

Organizations can block unmanaged devices.

Sign-In Risk

Microsoft evaluates sign-ins for suspicious activity.

Examples:

Impossible travel
Unusual locations
Anonymous IP addresses

Higher-risk sign-ins may trigger additional controls.

User Risk

User risk reflects the likelihood that a user’s account has been compromised.

Examples:

Leaked credentials
Suspicious behavior

Organizations can require password changes or block access for risky users.

Access Controls

After evaluating conditions, Conditional Access applies controls.

Require Multi-Factor Authentication

One of the most common controls.

Example:

Require MFA for all administrator accounts.

Benefits:

Stronger identity protection.
Reduced credential theft.

Require Device Compliance

Users must use devices that meet organizational standards.

Examples:

Encryption enabled
Antivirus installed
Latest updates applied

This often integrates with Microsoft Intune.

Require Hybrid Microsoft Entra Joined Devices

Ensures access is granted only to approved organizational devices.

Require Password Change

Used when a user account is considered compromised.

Block Access

The most restrictive control.

Examples:

Block high-risk users.
Block unsupported devices.
Block access from certain locations.

Named Locations

Named locations allow administrators to define trusted locations.

Examples:

Corporate offices
Specific IP address ranges

Trusted locations can reduce unnecessary MFA prompts while maintaining security.

Conditional Access and Multi-Factor Authentication

Conditional Access frequently works together with MFA.

Examples:

Scenario 1

User signs in from home.

Result:

Require MFA.

Scenario 2

User signs in from a trusted office.

Result:

Allow access without additional prompts.

This creates a balance between security and user convenience.

Conditional Access and Device Compliance

Organizations often require devices to be:

Managed by Intune.
Encrypted.
Updated.
Secure.

If devices fail compliance requirements, access may be denied.

Conditional Access and Zero Trust

Conditional Access directly supports all three Zero Trust principles.

Verify Explicitly

Evaluate identity, device, location, and risk.

Use Least Privileged Access

Restrict access when necessary.

Assume Breach

Continuously evaluate security signals.

Conditional Access and Microsoft 365 Copilot

Microsoft 365 Copilot uses the same identity and access controls that protect Microsoft 365.

Conditional Access policies can affect access to:

Microsoft Teams
SharePoint Online
Exchange Online
OneDrive
Copilot experiences

Copilot does not bypass Conditional Access requirements.

Best Practices

Enable MFA for All Users

MFA is one of the strongest protections available.

Protect Administrator Accounts

Apply stricter controls to privileged users.

Require Compliant Devices

Reduce risks from unmanaged devices.

Use Trusted Locations Carefully

Avoid creating unnecessary exceptions.

Follow the Principle of Least Privilege

Grant only necessary access.

Benefits of Conditional Access

Organizations gain:

Adaptive Security

Policies adjust based on risk and conditions.

Improved User Experience

Security requirements appear only when necessary.

Stronger Identity Protection

Compromised accounts are easier to detect and control.

Support for Remote Work

Users can work securely from anywhere.

Zero Trust Alignment

Every access request is evaluated individually.

Exam Tips

Remember these key AB-900 concepts:

Conditional Access is part of Microsoft Entra.
Policies use an if-then approach.
Conditions include location, device state, sign-in risk, and user risk.
Access controls include requiring MFA, requiring compliant devices, and blocking access.
Conditional Access works closely with Intune and Microsoft Entra ID.
Named locations define trusted networks.
Conditional Access supports Zero Trust principles.
Microsoft 365 Copilot respects Conditional Access policies.
Administrator accounts typically receive stricter protections.
Conditional Access improves both security and usability.

Practice Exam Questions

Question 1

What is the primary purpose of Conditional Access?

A. Increase mailbox quotas
B. Automatically create Teams channels
C. Apply access decisions based on conditions and risk signals
D. Replace Microsoft Defender

Correct Answer: C

Explanation: Conditional Access evaluates various signals and determines whether access should be allowed, restricted, or blocked.

Question 2

Conditional Access is a feature of which Microsoft service?

A. Microsoft Entra ID
B. Exchange Online
C. Microsoft Purview
D. SharePoint Online

Correct Answer: A

Explanation: Conditional Access is provided through Microsoft Entra ID and is used to secure access to resources.

Question 3

Which statement best describes how Conditional Access works?

A. Use an “if condition, then action” model.
B. Always allow access.
C. Disable all external connections.
D. Eliminate authentication requirements.

Correct Answer: A

Explanation: Conditional Access evaluates conditions and applies controls accordingly.

Question 4

Which condition can be evaluated by Conditional Access?

A. Printer model
B. Monitor size
C. Mouse type
D. Sign-in risk

Correct Answer: D

Explanation: Sign-in risk is one of the security signals used when evaluating access requests.

Question 5

Which access control commonly works with Conditional Access to strengthen security?

A. Shared mailboxes
B. Multi-Factor Authentication
C. Distribution lists
D. Document versioning

Correct Answer: B

Explanation: MFA is frequently required through Conditional Access policies.

Question 6

What is the purpose of named locations?

A. Define trusted networks and IP ranges
B. Store SharePoint documents
C. Create Teams channels
D. Manage email retention

Correct Answer: A

Explanation: Named locations identify trusted locations that can influence policy behavior.

Question 7

Which Microsoft solution often works with Conditional Access to evaluate device compliance?

A. Microsoft Lists
B. Microsoft Planner
C. Microsoft Intune
D. Microsoft Forms

Correct Answer: C

Explanation: Intune provides device management and compliance information used by Conditional Access.

Question 8

Which action represents the most restrictive access control?

A. Require MFA
B. Require password change
C. Require compliant device
D. Block access

Correct Answer: D

Explanation: Blocking access completely prevents users from reaching resources.

Question 9

Which Zero Trust principle is most directly supported by Conditional Access?

A. Verify Explicitly
B. Trust Internal Networks
C. Open Access First
D. Eliminate Authentication

Correct Answer: A

Explanation: Conditional Access evaluates multiple signals before granting access, which aligns with Verify Explicitly.

Question 10

How does Microsoft 365 Copilot interact with Conditional Access policies?

A. Copilot bypasses policies.
B. Copilot disables MFA requirements.
C. Copilot ignores device compliance rules.
D. Copilot follows the same Conditional Access requirements as Microsoft 365 resources.

Correct Answer: D

Explanation: Copilot inherits existing identity and access controls and does not bypass security policies.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Cybersecurity, Data Security, Microsoft Certification June 27, 2026

Understand features and capabilities of Microsoft Entra (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Identify the core security features of Microsoft 365 services
      --> Understand features and capabilities of Microsoft Entra

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Identity is the foundation of security in Microsoft 365. Before users can access email, Teams, SharePoint, Microsoft 365 Copilot, or other services, their identities must be verified and managed securely.

Microsoft Entra is Microsoft’s family of identity and access solutions that helps organizations secure users, applications, devices, and external identities. Microsoft Entra provides authentication, authorization, identity governance, and access management capabilities that support modern security strategies such as Zero Trust.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding the major capabilities of Microsoft Entra is essential.

What Is Microsoft Entra?

Microsoft Entra is Microsoft’s identity and access product family.

It helps organizations:

Manage identities.
Authenticate users.
Control access to resources.
Protect against identity-based attacks.
Support Zero Trust security.

Microsoft Entra enables secure access to:

Microsoft 365
Microsoft Teams
SharePoint Online
Exchange Online
Third-party applications
Custom applications

Microsoft Entra ID

The core component of Microsoft Entra is Microsoft Entra ID (formerly Azure Active Directory).

Microsoft Entra ID is a cloud-based identity and access management service that provides:

User accounts
Group management
Authentication services
Authorization capabilities
Single Sign-On (SSO)
Multi-Factor Authentication (MFA)

Microsoft 365 relies on Microsoft Entra ID to manage identities.

Identity and Access Management (IAM)

Identity and Access Management (IAM) ensures that:

The correct users are identified.
Appropriate access is granted.
Access can be controlled and monitored.

IAM helps organizations maintain security while enabling productivity.

Authentication

Authentication verifies identity.

It answers:

Who are you?

Microsoft Entra supports multiple authentication methods, including:

Passwords
Microsoft Authenticator
SMS verification
Voice calls
FIDO2 security keys
Windows Hello for Business

Authentication occurs before authorization.

Authorization

Authorization determines what authenticated users are allowed to access.

It answers:

What are you allowed to do?

Examples include:

Accessing SharePoint sites.
Reading Exchange mailboxes.
Managing Teams settings.

Authorization is commonly controlled through:

Roles
Permissions
Policies

Single Sign-On (SSO)

Single Sign-On allows users to sign in once and access multiple applications without re-entering credentials.

Benefits include:

Improved user experience.
Reduced password fatigue.
Fewer password reset requests.
Increased productivity.

Users can access Microsoft 365 applications with one identity.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication requires more than one authentication factor.

Examples:

Password
Microsoft Authenticator approval

Benefits include:

Stronger security.
Reduced credential theft risk.
Better protection against phishing attacks.

MFA is one of Microsoft’s most important security recommendations.

Conditional Access

Conditional Access uses signals to determine whether access should be allowed.

Signals may include:

User identity
Device status
Location
Application being accessed
Risk level

Examples:

Require MFA outside the corporate network.
Block high-risk sign-ins.
Require compliant devices.

Conditional Access supports the Zero Trust principle of Verify Explicitly.

Role-Based Access Control (RBAC)

Microsoft Entra uses Role-Based Access Control to assign administrative privileges.

Examples of built-in roles include:

Global Administrator
User Administrator
Security Administrator
Exchange Administrator

RBAC follows the principle of least privilege by granting only the permissions required.

Groups

Groups simplify administration by allowing permissions and licenses to be assigned to multiple users simultaneously.

Types of groups include:

Security Groups

Used to assign permissions and policies.

Microsoft 365 Groups

Provide collaboration resources such as:

Outlook mailbox
Teams workspace
SharePoint site

Groups help reduce administrative effort.

Self-Service Capabilities

Microsoft Entra supports self-service features such as:

Self-Service Password Reset (SSPR)

Users can reset forgotten passwords without administrator assistance.

Benefits:

Reduced help desk workload.
Faster account recovery.

Self-Service Group Management

Users can manage group membership when permitted.

Device Identity and Management Integration

Microsoft Entra can recognize devices and work with Microsoft Intune.

This allows organizations to:

Register devices.
Evaluate compliance.
Control access based on device health.

Examples:

Require managed devices.
Block noncompliant devices.

External Identities

Organizations often collaborate with external users.

Microsoft Entra supports:

Guest users
Business partners
Contractors

External identities allow secure collaboration while maintaining administrative control.

Identity Protection

Microsoft Entra helps detect identity-related threats such as:

Credential theft
Suspicious sign-ins
Impossible travel scenarios
Password spray attacks

Identity protection helps organizations respond to risks quickly.

Identity Governance

Identity governance helps organizations manage:

Access reviews
Lifecycle management
Least privilege practices

Governance helps ensure users retain only the access they need.

Passwordless Authentication

Microsoft Entra supports passwordless sign-in methods including:

Microsoft Authenticator
Windows Hello for Business
FIDO2 security keys

Benefits include:

Improved user experience.
Reduced phishing risks.
Stronger security.

Microsoft Entra and Zero Trust

Microsoft Entra supports all three Zero Trust principles.

Verify Explicitly

Evaluate identity and access conditions.

Use Least Privileged Access

Grant only necessary permissions.

Assume Breach

Continuously monitor identity risks.

Microsoft Entra and Microsoft 365 Copilot

Microsoft 365 Copilot relies on Microsoft Entra identities.

Entra controls:

User authentication.
Authorization.
Access policies.
Group memberships.
Security controls.

Copilot inherits existing permissions and does not grant access to content users are not already authorized to view.

Benefits of Microsoft Entra

Organizations benefit from:

Centralized Identity Management

Manage users from a single platform.

Improved Security

Protect against identity attacks.

Better User Experience

Single Sign-On reduces friction.

Reduced Administrative Effort

Groups and self-service capabilities simplify management.

Support for Zero Trust

Access decisions are based on multiple signals.

Best Practices

Enable Multi-Factor Authentication

Protect identities against compromise.

Use Least Privilege

Assign only required permissions.

Implement Conditional Access

Strengthen access decisions.

Use Self-Service Password Reset

Reduce support costs.

Review Administrative Roles Regularly

Limit excessive privileges.

Exam Tips

Remember these key AB-900 concepts:

Microsoft Entra is Microsoft’s identity and access family.
Microsoft Entra ID was formerly Azure Active Directory.
Authentication verifies identity.
Authorization determines access.
Single Sign-On provides one login for multiple applications.
Multi-Factor Authentication improves security.
Conditional Access evaluates multiple signals.
RBAC controls administrative privileges.
Self-Service Password Reset reduces help desk workload.
Microsoft 365 Copilot relies on Microsoft Entra identities and permissions.

Practice Exam Questions

Question 1

What is the primary purpose of Microsoft Entra?

A. Replace Microsoft Teams meetings
B. Manage identity and access to resources
C. Increase SharePoint storage capacity
D. Provide email hosting

Correct Answer: B

Explanation: Microsoft Entra provides identity and access management capabilities for users, applications, and devices.

Question 2

What was Microsoft Entra ID previously called?

A. Microsoft Intune
B. Azure Active Directory
C. Exchange Online
D. Microsoft Purview

Correct Answer: B

Explanation: Microsoft Entra ID is the new name for Azure Active Directory.

Question 3

Which capability allows users to sign in once and access multiple applications?

A. Multi-Factor Authentication
B. Conditional Access
C. Single Sign-On
D. Identity Governance

Correct Answer: C

Explanation: Single Sign-On improves user experience by reducing repeated sign-ins.

Question 4

Which Microsoft Entra feature allows users to reset forgotten passwords without administrator assistance?

A. Self-Service Password Reset
B. Privileged Identity Management
C. Role-Based Access Control
D. Conditional Access

Correct Answer: A

Explanation: Self-Service Password Reset reduces support requests and speeds account recovery.

Question 5

Which capability uses factors such as location and device compliance when making access decisions?

A. Dynamic Distribution Groups
B. Microsoft Lists
C. Conditional Access
D. Shared Mailboxes

Correct Answer: C

Explanation: Conditional Access evaluates various signals before granting access.

Question 6

What does authentication determine?

A. What permissions users have
B. Who the user is
C. Which Teams channel is created
D. Which files are deleted

Correct Answer: B

Explanation: Authentication verifies a user’s identity.

Question 7

Which principle is supported by Role-Based Access Control (RBAC)?

A. Maximum privilege
B. Open access
C. Unlimited permissions
D. Least privilege

Correct Answer: D

Explanation: RBAC grants only the permissions necessary to perform assigned tasks.

Question 8

Which authentication method strengthens security by requiring multiple verification factors?

A. Single Sign-On
B. Multi-Factor Authentication
C. Shared mailbox access
D. Version history

Correct Answer: B

Explanation: MFA provides stronger identity protection than passwords alone.

Question 9

What type of group provides collaboration resources such as Teams, Outlook mailboxes, and SharePoint sites?

A. Security group
B. Distribution list
C. Microsoft 365 group
D. Mail contact

Correct Answer: C

Explanation: Microsoft 365 groups provide shared collaboration resources.

Question 10

How does Microsoft 365 Copilot use Microsoft Entra?

A. It bypasses user permissions.
B. It replaces authentication requirements.
C. It creates anonymous access.
D. It relies on Entra identities and existing permissions.

Correct Answer: D

Explanation: Copilot respects existing identities, permissions, and security controls managed by Microsoft Entra.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Cybersecurity, Data Security, Microsoft Certification June 27, 2026

Understand features and capabilities of Microsoft Defender XDR (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand features and capabilities of Microsoft Defender XDR

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Organizations today face attacks that target multiple areas simultaneously, including identities, email, endpoints, cloud applications, and collaboration platforms. Security teams need a unified way to detect, investigate, and respond to these threats.

Microsoft Defender XDR (Extended Detection and Response) is Microsoft’s integrated security platform that correlates signals across multiple security services to provide comprehensive threat protection.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, you should understand the purpose, components, and key capabilities of Microsoft Defender XDR.

What Is Microsoft Defender XDR?

Microsoft Defender XDR is a security platform that:

Collects signals from multiple Microsoft security solutions.
Correlates related events.
Detects attacks across domains.
Automates investigations.
Supports incident response.

The “XDR” in Defender XDR stands for:

Extended Detection and Response

Unlike isolated security tools, Defender XDR provides a unified view of attacks across the organization.

Why Defender XDR Is Important

Traditional security tools often work independently.

For example:

Email security detects phishing.
Endpoint security detects malware.
Identity security detects suspicious sign-ins.

Without correlation, security teams may miss the fact that these events are part of the same attack.

Defender XDR connects these signals and presents them as a single incident.

Components of Microsoft Defender XDR

Defender XDR integrates several Microsoft Defender products.

Microsoft Defender for Office 365

Protects:

Exchange Online
Outlook
Microsoft Teams
SharePoint Online
OneDrive

Focus areas:

Phishing protection
Safe Links
Safe Attachments
Business email compromise protection

Microsoft Defender for Endpoint

Protects:

Windows devices
macOS devices
Mobile devices

Capabilities include:

Endpoint detection
Vulnerability management
Device monitoring
Automated remediation

Microsoft Defender for Identity

Protects user identities by monitoring:

Authentication activity
Suspicious sign-ins
Credential attacks
Lateral movement attempts

Microsoft Defender for Cloud Apps

Provides visibility into:

SaaS applications
Cloud usage
Shadow IT
Risky behavior

Unified Incident Management

One of Defender XDR’s most important capabilities is incident correlation.

Example

A phishing email causes:

Credential theft.
Suspicious sign-in activity.
Malware installation.

Instead of producing three unrelated alerts, Defender XDR groups them into a single incident.

Benefits include:

Faster investigations.
Better understanding of attacks.
Reduced alert fatigue.

Alerts vs. Incidents

Alert

A single security event.

Examples:

Malware detected.
Suspicious email.
Risky sign-in.

Incident

A collection of related alerts representing an attack.

Security analysts typically investigate incidents rather than individual alerts.

Cross-Domain Visibility

Defender XDR provides visibility across:

Domain	Examples
Identities	User accounts and sign-ins
Endpoints	Computers and devices
Email	Exchange and Outlook
Collaboration	Teams and SharePoint
Applications	Cloud apps and services

This broad visibility helps identify complex attacks.

Automated Investigation and Response (AIR)

Defender XDR can automatically:

Detect suspicious activity.
Investigate evidence.
Recommend actions.
Perform remediation.

Examples include:

Isolating compromised devices.
Blocking malicious files.
Removing phishing emails.

Automation reduces the workload on security teams.

Attack Story and Incident Timeline

Defender XDR presents attacks visually through timelines.

Administrators can see:

When the attack started.
Which users were affected.
Which devices were involved.
How the attack progressed.

This helps security teams understand attack paths quickly.

Threat Intelligence

Microsoft Defender XDR uses Microsoft’s global threat intelligence network.

Microsoft analyzes trillions of signals from:

Microsoft 365
Azure
Windows
Identity systems
Cloud services

Threat intelligence helps identify:

Emerging threats
Known malicious actors
Attack patterns
Indicators of compromise

Threat Hunting

Security analysts can proactively search for threats using advanced hunting capabilities.

Threat hunting allows teams to:

Search large datasets.
Investigate suspicious activity.
Discover hidden threats.
Validate security concerns.

Rather than waiting for alerts, analysts actively look for attacks.

Automated Attack Disruption

Defender XDR can automatically interrupt attacks in progress.

Examples include:

Disabling compromised accounts.
Isolating devices.
Preventing lateral movement.

This capability helps reduce the impact of attacks before they spread.

Security Recommendations

Defender XDR provides recommendations that help organizations improve security posture.

Examples:

Enable Multi-Factor Authentication.
Reduce unnecessary permissions.
Update vulnerable devices.
Strengthen configurations.

These recommendations support Zero Trust principles.

Defender XDR and Zero Trust

Defender XDR supports all three Zero Trust principles.

Verify Explicitly

Analyze identities and sign-in behavior.

Use Least Privileged Access

Reduce attacker opportunities.

Assume Breach

Continuously monitor for suspicious activity.

Defender XDR and Microsoft 365 Copilot

Microsoft 365 Copilot benefits from the existing security protections provided by Defender XDR.

Defender XDR helps secure:

Emails
Teams conversations
SharePoint files
User identities
Devices

Copilot itself does not bypass security controls and continues to respect existing permissions.

Benefits of Microsoft Defender XDR

Organizations gain:

Unified Security Visibility

Multiple security signals appear in one platform.

Faster Detection

Threats are identified earlier.

Reduced Alert Fatigue

Related alerts are grouped into incidents.

Automated Response

Remediation can occur automatically.

Improved Security Operations

Security teams spend less time correlating events manually.

Best Practices

Enable Multi-Factor Authentication

Protect identities.

Review Incidents Regularly

Prioritize investigations.

Use Automated Investigation

Reduce manual effort.

Follow Security Recommendations

Improve overall posture.

Implement Zero Trust

Assume attacks can occur and prepare accordingly.

Exam Tips

Remember these AB-900 concepts:

XDR stands for Extended Detection and Response.
Defender XDR combines signals across multiple domains.
Alerts represent individual events.
Incidents group related alerts together.
Defender XDR integrates several Defender products.
Automated Investigation and Response (AIR) reduces manual work.
Threat intelligence helps identify emerging attacks.
Advanced hunting enables proactive investigations.
Automated attack disruption can stop attacks in progress.
Defender XDR supports Microsoft’s Zero Trust strategy.

Practice Exam Questions

Question 1

What does the “XDR” in Microsoft Defender XDR stand for?

A. Expanded Directory Routing
B. External Device Recovery
C. Exchange Data Replication
D. Extended Detection and Response

Correct Answer: D

Explanation: XDR stands for Extended Detection and Response and provides integrated threat protection across multiple domains.

Question 2

What is the primary purpose of Microsoft Defender XDR?

A. Increase mailbox sizes
B. Provide unified detection and response across security domains
C. Replace Microsoft Teams
D. Create SharePoint sites

Correct Answer: B

Explanation: Defender XDR correlates signals from multiple services to improve threat detection and response.

Question 3

Which Microsoft Defender product focuses on email and collaboration protection?

A. Defender for Endpoint
B. Defender for Identity
C. Defender for Office 365
D. Defender for Cloud Apps

Correct Answer: C

Explanation: Defender for Office 365 protects Exchange Online, Outlook, Teams, and related collaboration services.

Question 4

What is an incident in Microsoft Defender XDR?

A. A single sign-in attempt
B. A licensing error
C. A mailbox migration task
D. A collection of related security alerts

Correct Answer: D

Explanation: Incidents combine multiple related alerts into a single investigation.

Question 5

Which Defender component primarily protects devices?

A. Defender for Cloud Apps
B. Defender for Endpoint
C. Defender for Identity
D. Defender for Office 365

Correct Answer: B

Explanation: Defender for Endpoint provides security for computers and devices.

Question 6

What is the benefit of Automated Investigation and Response (AIR)?

A. Eliminates user accounts
B. Removes all security policies
C. Automates threat analysis and remediation
D. Replaces authentication

Correct Answer: C

Explanation: AIR helps detect, investigate, and respond to threats automatically.

Question 7

Which capability allows analysts to proactively search for hidden threats?

A. Safe Links
B. Threat hunting
C. Shared mailboxes
D. Distribution groups

Correct Answer: B

Explanation: Threat hunting enables analysts to investigate suspicious activity beyond standard alerts.

Question 8

Which Defender component focuses on identity-based attacks?

A. Defender for Identity
B. Defender for Endpoint
C. Defender for Office 365
D. Defender for Cloud Apps

Correct Answer: A

Explanation: Defender for Identity monitors authentication activity and suspicious account behavior.

Question 9

How does Defender XDR help reduce alert fatigue?

A. By deleting alerts automatically
B. By disabling auditing
C. By grouping related alerts into incidents
D. By preventing administrators from viewing alerts

Correct Answer: C

Explanation: Incident correlation allows analysts to investigate attacks more efficiently.

Question 10

Which Microsoft security principle is supported by Defender XDR’s continuous monitoring?

A. Trust Internal Networks
B. Assume Breach
C. Open Collaboration First
D. Disable Authentication

Correct Answer: B

Explanation: Continuous monitoring aligns with the Zero Trust principle of assuming that breaches can occur and detecting them quickly.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI Security, Data Security, Microsoft Certification June 27, 2026

Understand threat protection and intelligence (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand threat protection and intelligence

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Cyber threats continue to evolve in complexity and frequency. Organizations using Microsoft 365 must protect users, devices, identities, applications, and data from attacks such as phishing, malware, ransomware, and business email compromise.

Threat protection and threat intelligence are key components of Microsoft 365 security. They help organizations:

Detect threats.
Prevent attacks.
Investigate suspicious activity.
Respond to incidents.
Learn from global threat intelligence.

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding these concepts is essential because Microsoft 365 security capabilities are designed around proactive threat defense.

What Is Threat Protection?

Threat protection refers to the technologies and processes used to:

Prevent attacks.
Detect malicious activity.
Respond to incidents.
Minimize the impact of security events.

Threat protection helps secure:

User identities
Email systems
Devices
Applications
Data

Common Cyber Threats

Organizations face many types of attacks.

Phishing

Attackers send deceptive emails designed to trick users into:

Revealing passwords
Clicking malicious links
Downloading malware

Phishing is one of the most common attack methods.

Malware

Malicious software can:

Damage systems
Steal information
Monitor activity
Spread to other devices

Examples include:

Viruses
Worms
Trojans

Ransomware

Ransomware encrypts files and demands payment for their recovery.

Consequences include:

Data loss
Business interruption
Financial damage

Business Email Compromise (BEC)

Attackers impersonate executives or trusted contacts to convince employees to:

Transfer money
Reveal information
Approve fraudulent transactions

Credential Theft

Attackers attempt to steal usernames and passwords through:

Phishing
Password spraying
Brute-force attacks

What Is Threat Intelligence?

Threat intelligence is information gathered about cyber threats and attacker behavior.

Threat intelligence helps organizations:

Understand current attack trends.
Identify malicious actors.
Detect suspicious activity.
Improve security defenses.

Microsoft collects signals from billions of sources worldwide to build its threat intelligence capabilities.

Microsoft Security Signals

Microsoft analyzes signals from:

Microsoft 365
Azure
Windows devices
Email traffic
Authentication events
Cloud applications

These signals help identify emerging threats and provide organizations with actionable insights.

Microsoft Defender

Microsoft Defender is Microsoft’s threat protection platform.

It provides security across:

Email
Endpoints
Identities
Applications
Cloud workloads

Microsoft Defender helps organizations:

Prevent attacks.
Detect threats.
Investigate incidents.
Automate responses.

Microsoft Defender for Office 365

Microsoft Defender for Office 365 protects:

Exchange Online
Outlook
Microsoft Teams
SharePoint Online
OneDrive

Its primary focus is protecting users from email-based attacks.

Safe Links

Safe Links examines URLs in messages and documents.

Benefits:

Blocks malicious websites.
Protects against phishing attacks.
Evaluates links when users click them.

Safe Attachments

Safe Attachments analyzes files before users open them.

Suspicious files are:

Isolated
Scanned
Blocked if malicious

This helps prevent malware infections.

Anti-Phishing Protection

Anti-phishing policies help identify:

Spoofed senders
Impersonation attempts
Suspicious domains

These protections reduce credential theft risks.

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint protects devices such as:

Windows computers
macOS devices
Mobile devices

Capabilities include:

Threat detection
Vulnerability management
Device monitoring
Automated investigation

Microsoft Defender for Identity

Defender for Identity monitors identity-related threats.

Examples include:

Password attacks
Suspicious sign-ins
Lateral movement attempts

It helps protect user identities and privileged accounts.

Microsoft Defender for Cloud Apps

Defender for Cloud Apps helps organizations:

Monitor cloud applications.
Detect risky behavior.
Discover shadow IT.
Protect sensitive information.

Automated Investigation and Response (AIR)

Microsoft security solutions can automatically:

Detect suspicious activity.
Investigate the event.
Recommend or perform remediation actions.

Automation reduces response times and improves efficiency.

Threat Detection and Alerts

Security systems continuously monitor activity.

Alerts may be generated for:

Unusual sign-ins
Malware detections
Excessive file downloads
Phishing attempts

Administrators can investigate alerts and determine appropriate actions.

Security Incidents

Multiple related alerts may be grouped into an incident.

An incident provides:

A timeline of events.
Affected users.
Devices involved.
Recommended remediation steps.

Grouping alerts simplifies investigations.

Threat Hunting

Threat hunting is the proactive search for hidden threats within an environment.

Rather than waiting for alerts, analysts actively look for:

Suspicious activity
Abnormal behavior
Potential compromise indicators

Threat Protection and Zero Trust

Threat protection supports all Zero Trust principles.

Verify Explicitly

Analyze identity and access signals.

Use Least Privileged Access

Limit attacker capabilities.

Assume Breach

Continuously monitor and investigate suspicious activity.

Threat Protection and Microsoft 365 Copilot

Microsoft 365 Copilot inherits Microsoft 365 security protections.

Copilot itself does not:

Bypass security controls.
Override permissions.
Expose unauthorized content.

Threat protection mechanisms continue to protect:

Emails
Files
Teams conversations
SharePoint content

Benefits of Threat Intelligence

Threat intelligence helps organizations:

Detect Attacks Earlier

Identify malicious activity before damage occurs.

Improve Security Decisions

Use real-world intelligence to strengthen defenses.

Respond Faster

Automated investigation reduces response times.

Reduce Risk

Continuous monitoring improves overall security posture.

Best Practices

Enable Multi-Factor Authentication

Protect accounts from credential theft.

Use Microsoft Defender Solutions

Implement layered protection.

Educate Users About Phishing

Human awareness remains important.

Review Security Alerts Regularly

Investigate suspicious activity promptly.

Keep Systems Updated

Reduce vulnerabilities attackers can exploit.

Exam Tips

Remember these key AB-900 concepts:

Threat protection prevents, detects, and responds to attacks.
Threat intelligence provides information about emerging threats.
Phishing attacks target users through deceptive communications.
Ransomware encrypts files and demands payment.
Microsoft Defender provides integrated threat protection.
Safe Links protects against malicious URLs.
Safe Attachments protects against harmful files.
Alerts identify suspicious activity.
Multiple alerts may be grouped into incidents.
Threat protection supports Microsoft’s Zero Trust strategy.

Practice Exam Questions

Question 1

What is the primary purpose of threat protection?

A. Increase mailbox storage quotas
B. Prevent, detect, and respond to cyber threats
C. Create SharePoint sites automatically
D. Manage software licenses

Correct Answer: B

Explanation: Threat protection helps organizations identify and respond to attacks while minimizing their impact.

Question 2

Which attack attempts to trick users into revealing credentials or clicking malicious links?

A. Phishing
B. Compression attacks
C. Data deduplication
D. Versioning

Correct Answer: A

Explanation: Phishing uses deceptive communications to steal information or deliver malware.

Question 3

What is ransomware designed to do?

A. Improve email performance
B. Increase authentication speed
C. Encrypt files and demand payment
D. Create backup copies automatically

Correct Answer: C

Explanation: Ransomware locks data and attempts to extort victims for recovery access.

Question 4

What is threat intelligence?

A. A type of file storage
B. A SharePoint permission model
C. A Teams collaboration feature
D. Information about threats and attacker behavior

Correct Answer: D

Explanation: Threat intelligence helps organizations understand current threats and improve defenses.

Question 5

Which Microsoft security solution provides broad threat protection across identities, devices, and applications?

A. Microsoft Defender
B. Microsoft Lists
C. Microsoft Forms
D. Microsoft Planner

Correct Answer: A

Explanation: Microsoft Defender is Microsoft’s integrated security platform.

Question 6

Which Microsoft Defender for Office 365 feature evaluates URLs when users click them?

A. Safe Attachments
B. Conditional Access
C. Safe Links
D. Windows Hello

Correct Answer: C

Explanation: Safe Links checks URLs to protect users from malicious websites.

Question 7

Which feature analyzes files before users open them?

A. Safe Attachments
B. RBAC
C. External Access
D. Dynamic Groups

Correct Answer: A

Explanation: Safe Attachments helps prevent malware infections by scanning files before delivery.

Question 8

What can happen when several related security alerts are detected?

A. They are deleted automatically.
B. They are combined into a security incident.
C. They are converted into Teams messages only.
D. They are ignored after 24 hours.

Correct Answer: B

Explanation: Grouping alerts into incidents provides a broader view of attacks.

Question 9

What is the purpose of threat hunting?

A. Increasing mailbox sizes
B. Managing distribution lists
C. Proactively searching for hidden threats
D. Assigning user licenses

Correct Answer: C

Explanation: Threat hunting involves actively investigating environments for suspicious activity.

Question 10

Which Microsoft Defender for Office 365 capability helps identify impersonation and spoofing attempts?

A. Safe Attachments
B. Device Compliance Policies
C. SharePoint Permissions
D. Anti-Phishing Protection

Correct Answer: D

Explanation: Anti-phishing policies help detect impersonation attacks and suspicious senders.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Data Security, Microsoft Certification June 27, 2026

Understand authentication methods (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand authentication methods

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Authentication is one of the foundational security concepts in Microsoft 365. Before users can access email, files, Teams conversations, or Microsoft 365 Copilot experiences, the system must first verify their identity.

Authentication answers the question:

“Who are you?”

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, it is important to understand the various authentication methods available in Microsoft 365 and how they help secure organizational resources.

What Is Authentication?

Authentication is the process of verifying a user’s identity before granting access to Microsoft 365 resources.

When users sign in, Microsoft Entra ID (formerly Azure Active Directory) validates their credentials and determines whether they are who they claim to be.

Authentication occurs before authorization.

Example

User enters credentials.
Microsoft verifies identity.
Authorization determines what resources the user can access.

Authentication vs. Authorization

Although closely related, these are different concepts.

Authentication	Authorization
Verifies identity	Determines access rights
Answers “Who are you?”	Answers “What can you do?”
Occurs first	Occurs second
Uses credentials and identity factors	Uses permissions and policies

Why Authentication Is Important

Authentication helps organizations:

Prevent unauthorized access.
Protect sensitive data.
Reduce credential theft risks.
Support Zero Trust security.
Enable secure remote work.

Without authentication, Microsoft 365 resources would be exposed to anyone.

Authentication Factors

Authentication methods are based on one or more factors.

Something You Know

Examples:

Passwords
PINs
Security questions

Something You Have

Examples:

Smartphone
Hardware token
Security key

Something You Are

Examples:

Fingerprint
Facial recognition
Biometrics

Using multiple factors increases security.

Single-Factor Authentication (SFA)

Single-factor authentication requires only one credential.

Typically:

Username + Password

Advantages:

Simple
Familiar

Disadvantages:

Vulnerable to phishing attacks.
Password theft can lead to account compromise.

Because passwords alone are risky, organizations increasingly use stronger authentication methods.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) requires two or more authentication factors.

Example:

User enters a password.
User approves a request in Microsoft Authenticator.

Benefits include:

Stronger protection against compromised passwords.
Reduced account takeover risk.
Improved compliance.

Microsoft strongly recommends MFA for all users.

Common MFA Methods in Microsoft 365

Microsoft 365 supports several MFA options.

Microsoft Authenticator App

Users receive:

Push notifications
Number matching prompts
Verification approvals

Advantages:

Secure
Convenient
Widely recommended by Microsoft

Text Message (SMS)

Users receive a verification code by text.

Advantages:

Easy to use.

Limitations:

Less secure than app-based authentication.
Vulnerable to SIM-swapping attacks.

Voice Calls

Users receive an automated phone call with verification instructions.

This method is supported but is generally less secure than app-based options.

Hardware Security Keys

Physical devices such as FIDO2 security keys provide strong authentication.

Benefits:

Resistant to phishing attacks.
Passwordless capability.
Strong protection for privileged accounts.

Passwordless Authentication

Passwordless authentication eliminates traditional passwords.

Instead, users authenticate through:

Microsoft Authenticator
FIDO2 security keys
Windows Hello for Business

Benefits include:

Reduced phishing risk.
Improved user experience.
Fewer password-related support requests.

Passwordless authentication is a key part of Microsoft’s security strategy.

Windows Hello for Business

Windows Hello for Business uses:

Facial recognition
Fingerprint recognition
PINs

Because biometric information remains on the device, this method provides strong security and convenience.

FIDO2 Security Keys

FIDO2 keys are physical authentication devices.

Examples include:

USB keys
NFC keys

Benefits:

Passwordless sign-in.
Protection against phishing.
Strong authentication for administrators.

Certificate-Based Authentication

Certificate-based authentication uses digital certificates to verify identity.

Organizations commonly use this method for:

Highly secure environments
Smart cards
Specialized devices

Legacy Authentication

Legacy authentication uses older protocols that often rely only on usernames and passwords.

Examples include:

POP3
IMAP
SMTP AUTH (certain scenarios)

These methods do not support modern security controls like MFA.

Because of their security risks, organizations are encouraged to disable legacy authentication whenever possible.

Adaptive Authentication and Conditional Access

Microsoft Entra Conditional Access can require additional authentication based on risk factors.

Examples:

Require MFA outside the corporate network.
Block risky sign-ins.
Require compliant devices.

This supports the Zero Trust principle of Verify Explicitly.

Password Policies

Strong passwords remain important.

Best practices include:

Long passwords or passphrases.
Avoiding reused passwords.
Avoiding predictable information.
Enabling MFA.

Microsoft recommends focusing on password quality rather than forcing frequent password changes.

Authentication in Zero Trust

Authentication supports Zero Trust by:

Verifying Identity Continuously

Access requests are evaluated using multiple signals.

Reducing Credential Risks

MFA strengthens security.

Supporting Least Privilege

Only verified users receive access.

Authentication and Microsoft 365 Copilot

Microsoft 365 Copilot relies on existing Microsoft 365 identities.

Users must authenticate before accessing:

Outlook
Teams
SharePoint
Word
Copilot experiences

Copilot itself does not bypass authentication requirements.

Best Practices

Enable Multi-Factor Authentication

MFA is one of the most effective security controls.

Adopt Passwordless Authentication

Reduce reliance on passwords.

Use Microsoft Authenticator

Prefer app-based verification over SMS.

Disable Legacy Authentication

Reduce exposure to credential attacks.

Protect Administrator Accounts

Use stronger authentication methods for privileged users.

Exam Tips

Remember these key AB-900 concepts:

Authentication verifies identity.
Authentication occurs before authorization.
Single-factor authentication usually relies on passwords.
MFA uses multiple authentication factors.
Microsoft Authenticator is a recommended MFA method.
Passwordless authentication improves security.
Windows Hello for Business supports biometric authentication.
FIDO2 security keys provide phishing-resistant authentication.
Legacy authentication is less secure because it often does not support MFA.
Conditional Access can require additional authentication based on risk.

Practice Exam Questions

Question 1

What question does authentication answer?

A. Who is the user?
B. How much storage is available?
C. What resources can the user access?
D. Which files should be encrypted?

Correct Answer: A

Explanation: Authentication verifies identity and determines whether the user is who they claim to be.

Question 2

Which process occurs before authorization?

A. Authentication
B. Auditing
C. Encryption
D. Data classification

Correct Answer: A

Explanation: Users must first prove their identity before permissions are evaluated.

Question 3

Which example represents multi-factor authentication?

A. Username only
B. Password only
C. PIN only
D. Password and Microsoft Authenticator approval

Correct Answer: D

Explanation: MFA requires multiple authentication factors rather than relying on a single credential.

Question 4

Which authentication factor category includes a fingerprint?

A. Something you know
B. Something you have
C. Something you own
D. Something you are

Correct Answer: D

Explanation: Biometrics are considered “something you are.”

Question 5

Which Microsoft solution provides app-based MFA approvals?

A. Microsoft Authenticator
B. Exchange Online
C. SharePoint Online
D. Microsoft Purview

Correct Answer: A

Explanation: Microsoft Authenticator supports push notifications and secure MFA verification.

Question 6

What is a major advantage of passwordless authentication?

A. Increased mailbox size
B. Reduced phishing risks
C. Automatic role assignments
D. Elimination of permissions

Correct Answer: B

Explanation: Removing passwords helps reduce common attack methods such as phishing.

Question 7

Which authentication method uses facial recognition or fingerprints?

A. FIDO2
B. SMS verification
C. Voice call authentication
D. Windows Hello for Business

Correct Answer: D

Explanation: Windows Hello for Business supports biometric authentication and PIN-based sign-in.

Question 8

Why are legacy authentication protocols considered less secure?

A. They consume more storage.
B. They disable file sharing.
C. They often do not support modern protections such as MFA.
D. They prevent Teams meetings.

Correct Answer: C

Explanation: Legacy authentication protocols typically rely only on usernames and passwords.

Question 9

Which technology can require additional authentication based on risk conditions?

A. Conditional Access
B. Distribution groups
C. Shared mailboxes
D. Version history

Correct Answer: A

Explanation: Conditional Access evaluates signals and can require MFA or block access.

Question 10

Which authentication method provides phishing-resistant, passwordless sign-in through a physical device?

A. SMS codes
B. Security questions
C. Voice calls
D. FIDO2 security keys

Correct Answer: D

Explanation: FIDO2 keys provide strong passwordless authentication and resist phishing attacks.

Go to the AB-900 Exam Prep Hub main page

AB-900, AI, AI Security, Data Security, Microsoft Certification June 27, 2026

Understand Authorization (AB-900 Exam Prep)

This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Identify the core features and objects of Microsoft 365 services (30–35%)
   --> Understand the Microsoft 365 security principles
      --> Understand Authorization

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

In Microsoft 365 security, protecting resources involves two closely related concepts:

Authentication
Authorization

Although these terms are often confused, they serve different purposes.

Authentication answers the question: “Who are you?”
Authorization answers the question: “What are you allowed to do?”

For the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals exam, understanding authorization is important because Microsoft 365 relies heavily on permissions, roles, and policies to determine what users can access.

What Is Authorization?

Authorization is the process of determining whether an authenticated user has permission to access a resource or perform an action.

Examples of resources include:

Email messages
SharePoint sites
Teams channels
Files and folders
Applications
Administrative settings

Authorization occurs after authentication.

Authentication vs. Authorization

These concepts work together but perform different functions.

Authentication	Authorization
Verifies identity	Determines access rights
Answers “Who are you?”	Answers “What can you do?”
Usually requires credentials	Uses permissions and policies
Happens first	Happens second

Example

A user signs in with their Microsoft 365 account.
Microsoft verifies their identity (authentication).
Microsoft checks whether they are allowed to access a file (authorization).

Real-World Example

Imagine entering an office building.

Authentication

Showing your employee badge proves who you are.

Authorization

Your badge determines:

Which floors you may enter.
Which rooms you can access.
Whether you can enter the server room.

Not every employee receives the same level of access.

Why Authorization Is Important

Authorization helps organizations:

Protect sensitive information.
Limit insider threats.
Enforce security policies.
Support compliance requirements.
Implement the Zero Trust model.

Without authorization controls, every authenticated user would have unrestricted access to organizational data.

Authorization in Microsoft 365

Microsoft 365 uses authorization to control access to:

SharePoint

Sites
Libraries
Files
Folders

Microsoft Teams

Teams
Channels
Meetings

Exchange Online

Mailboxes
Distribution groups
Shared mailboxes

Copilot Experiences

Documents
Emails
Teams conversations
Knowledge sources

Permissions

Permissions are the primary mechanism used to implement authorization.

Permissions define what actions users can perform.

Examples include:

Read
Edit
Create
Delete
Full Control

Different users may receive different permissions for the same resource.

Role-Based Access Control (RBAC)

Microsoft 365 uses Role-Based Access Control (RBAC) to assign permissions according to job responsibilities.

Instead of assigning permissions individually to every user, permissions are grouped into roles.

Examples include:

Role	Purpose
Global Administrator	Manage the entire Microsoft 365 tenant
User Administrator	Manage user accounts
SharePoint Administrator	Manage SharePoint Online
Teams Administrator	Manage Microsoft Teams
Exchange Administrator	Manage Exchange Online

RBAC simplifies administration and supports the principle of least privilege.

Least Privilege and Authorization

Authorization supports the Zero Trust principle of Least Privileged Access.

Users should receive only the permissions necessary to perform their work.

Example:

HR employees can access HR documents.
Finance employees can access financial reports.
Marketing employees cannot view payroll files.

Restricting access reduces the impact of compromised accounts.

Group-Based Authorization

Permissions are often assigned through groups rather than individual users.

Examples:

Microsoft 365 Groups
Security Groups
SharePoint Groups

Benefits include:

Easier administration
Consistent access
Reduced errors
Simplified onboarding

When a user joins a group, they inherit the group’s permissions.

SharePoint Authorization

SharePoint permissions determine who can:

View documents
Edit content
Upload files
Manage sites

Common permission levels include:

Permission Level	Capabilities
Read	View content
Edit	Modify content
Full Control	Manage settings and permissions

A user without permission cannot access the content even if they know the file location.

Teams Authorization

Microsoft Teams uses authorization to determine:

Team membership
Channel access
Meeting permissions
App availability

For example:

Members of a team can participate in discussions.
Users outside the team cannot access conversations.
Private channels restrict access to selected members.

Exchange Online Authorization

Authorization determines access to:

Mailboxes
Shared mailboxes
Calendars
Distribution groups

Example:

An executive assistant may be granted permission to manage another user’s mailbox.

Conditional Access and Authorization

Conditional Access can add requirements before access is granted.

Examples include:

Requiring Multi-Factor Authentication (MFA)
Blocking risky sign-ins
Restricting access from unmanaged devices

Conditional Access combines identity signals with authorization decisions.

Administrative Roles

Administrative roles provide authorization for management tasks.

Examples:

Global Administrator

Can manage nearly every Microsoft 365 service.

Teams Administrator

Can manage Teams settings but not Exchange settings.

SharePoint Administrator

Can manage SharePoint but not user licensing.

This separation helps implement least privilege.

Authorization and Microsoft 365 Copilot

Microsoft 365 Copilot relies entirely on existing authorization controls.

Copilot:

Does not bypass permissions.
Cannot expose restricted information.
Only retrieves content users are already authorized to access.

Example

Suppose:

Alice has access to Finance documents.
Bob does not.

If Bob asks Copilot for salary reports, Copilot cannot retrieve them because Bob lacks authorization.

Authorization in Zero Trust

Authorization supports all three Zero Trust principles:

Verify Explicitly

Access decisions consider identity and context.

Use Least Privileged Access

Users receive only necessary permissions.

Assume Breach

Limiting permissions reduces the impact of attacks.

Best Practices

Assign Roles Carefully

Avoid excessive privileges.

Use Groups Instead of Individual Permissions

Simplify management.

Follow Least Privilege

Grant only required access.

Review Permissions Regularly

Remove outdated permissions.

Use MFA and Conditional Access

Strengthen authorization decisions.

Exam Tips

Remember these key AB-900 concepts:

Authentication verifies identity.
Authorization determines access rights.
Authorization occurs after authentication.
Permissions define what users can do.
RBAC assigns permissions through roles.
Least privilege limits unnecessary access.
Groups simplify permission management.
Conditional Access can influence authorization decisions.
Microsoft 365 Copilot respects existing permissions.
Users cannot access resources without authorization.

Practice Exam Questions

Question 1

Which question does authorization answer?

A. Where is the data stored?
B. Which password should be used?
C. What resources is the user allowed to access?
D. Is the device encrypted?

Correct Answer: C

Explanation: Authorization determines what actions an authenticated user is permitted to perform.

Question 2

Which process occurs first in Microsoft 365?

A. Authorization
B. Authentication
C. Auditing
D. Encryption

Correct Answer: B

Explanation: Users must first prove their identity before access rights can be evaluated.

Question 3

What is the primary purpose of Role-Based Access Control (RBAC)?

A. Encrypt files automatically
B. Create mailboxes
C. Assign permissions according to job responsibilities
D. Replace authentication

Correct Answer: C

Explanation: RBAC groups permissions into roles that align with organizational responsibilities.

Question 4

Which Microsoft 365 principle is directly supported by limiting permissions to only what users need?

A. External collaboration
B. Shared responsibility
C. Multi-tenancy
D. Least privilege

Correct Answer: D

Explanation: Least privilege minimizes unnecessary access and reduces security risks.

Question 5

A user signs in successfully but cannot open a SharePoint file. What is the most likely reason?

A. Authentication failed.
B. The user lacks authorization to the file.
C. The file was encrypted.
D. The device lacks internet access.

Correct Answer: B

Explanation: Successful authentication does not guarantee permission to access resources.

Question 6

Which mechanism is commonly used to simplify authorization management?

A. Distribution lists
B. Version history
C. Group-based permissions
D. Mail flow rules

Correct Answer: C

Explanation: Assigning permissions to groups is easier and more consistent than assigning permissions individually.

Question 7

Which Microsoft 365 administrative role can manage SharePoint Online but does not automatically manage Teams or Exchange?

A. Global Administrator
B. SharePoint Administrator
C. User Administrator
D. Billing Administrator

Correct Answer: B

Explanation: SharePoint Administrators are responsible specifically for SharePoint services.

Question 8

How does Microsoft 365 Copilot use authorization?

A. It ignores permissions to improve productivity.
B. It temporarily grants access to hidden documents.
C. It bypasses SharePoint security.
D. It only retrieves information users are already authorized to access.

Correct Answer: D

Explanation: Copilot honors existing Microsoft 365 permissions and security boundaries.

Question 9

Which statement best describes authentication and authorization?

A. They are the same process.
B. Authorization occurs before authentication.
C. Authentication verifies identity, and authorization determines access.
D. Authentication controls permissions.

Correct Answer: C

Explanation: Authentication confirms who the user is, while authorization determines what they may access.

Question 10

Which Microsoft capability can require additional conditions, such as MFA, before granting access?

A. Distribution groups
B. Conditional Access
C. Version history
D. Shared mailboxes

Correct Answer: B

Explanation: Conditional Access evaluates signals and can impose additional requirements before authorization is granted.

Go to the AB-900 Exam Prep Hub main page

DP-700, Microsoft Certification, Microsoft Fabric June 3, 2026

Endorse items (DP-700 Exam Prep)

This post is a part of the DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric Exam Prep Hub.
This topic falls under these sections:
Implement and manage an analytics solution (30–35%)
   --> Configure security and governance
      --> Endorse items

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations adopt Microsoft Fabric, the number of available data assets can grow rapidly. Data engineers, analysts, business users, and executives may encounter hundreds or even thousands of reports, semantic models, dashboards, warehouses, lakehouses, notebooks, and other data assets.

A common challenge is determining:

Which data assets are trustworthy?
Which reports should be used for executive reporting?
Which semantic models represent official business definitions?
Which datasets have been reviewed and approved?

To address these governance challenges, Microsoft Fabric supports endorsements.

Endorsements help organizations identify trusted and authoritative data assets, making it easier for users to discover and use approved content.

For the DP-700 exam, it is important to understand endorsement types, governance benefits, use cases, and how endorsements differ from security and sensitivity labels.

What Are Endorsements?

An endorsement is a governance feature that allows organizations to identify and promote trusted data assets.

Endorsements help users answer the question:

“Can I trust this data asset?”

Instead of searching through numerous reports and datasets, users can quickly identify endorsed items that have been reviewed and approved.

Purpose of Endorsements

Organizations use endorsements to:

Improve data discoverability
Promote trusted assets
Reduce duplicate reports
Encourage consistent reporting
Improve governance
Increase user confidence
Establish authoritative data sources

Endorsement Types

Microsoft Fabric supports two primary endorsement levels:

Promoted

Certified

These endorsement levels indicate different degrees of trust and governance.

Promoted Items

A Promoted item indicates:

The content creator believes the item is valuable.
The item is recommended for broader use.
The item may not have gone through formal governance review.

Think of Promoted as:

Recommended Content

Examples:

Frequently used reports
Department dashboards
Common semantic models
Team-approved datasets

Characteristics of Promoted Items

Promoted items:

Are easier to discover
Indicate useful content
Can be designated by authorized users
Do not necessarily represent official organizational standards

Example

A Sales team creates a dashboard used by dozens of users.

The dashboard is reliable and widely used.

The owner marks it as:

Promoted

This helps users identify it as recommended content.

Certified Items

Certified is a higher endorsement level.

Certified items have typically undergone formal review and approval processes.

Think of Certified as:

Official Trusted Content

Examples:

Executive reporting datasets
Enterprise semantic models
Corporate KPI reports
Official financial dashboards

Characteristics of Certified Items

Certified items:

Represent authoritative data
Follow governance standards
Have undergone validation
Are approved by designated governance teams
Should be used whenever possible

Example

A Finance semantic model contains:

Revenue
Expenses
Profit
Corporate KPIs

The governance team validates the model and certifies it.

The model becomes:

Certified

Users now know it represents official business definitions.

Comparing Promoted and Certified

Feature	Promoted	Certified
Recommended by creator	Yes	Yes
Formal review required	No	Yes
Governance approval	Optional	Required
Official organizational source	Not necessarily	Yes
Highest trust level	No	Yes

Why Endorsements Matter

Without endorsements:

			
Sales Report V1
Sales Report V2
Sales Report Final
Sales Report Final2
Sales Dashboard New

		

Users may not know which asset to trust.

With endorsements:

			
Sales Dashboard
(Certified)

The preferred asset becomes obvious.

Supported Fabric Items

Endorsements can be applied to many Fabric assets, including:

Semantic Models
Reports
Dashboards
Data Warehouses
Lakehouses
Dataflows
Other supported Fabric artifacts

Supported item types may evolve as Microsoft Fabric continues to expand.

Endorsements and Data Discovery

One major benefit of endorsements is improved discoverability.

Users searching for assets can identify:

Promoted content
Certified content

This reduces confusion and encourages reuse of trusted assets.

Governance Benefits

Endorsements support governance initiatives by helping organizations:

Establish trusted data sources
Reduce shadow analytics
Minimize duplicate content
Improve reporting consistency
Promote enterprise standards

Endorsements vs Security Permissions

A common DP-700 exam topic is distinguishing endorsements from security.

Endorsements	Permissions
Identify trusted content	Control access
Governance feature	Security feature
Improve discoverability	Restrict usage
Indicate quality	Grant authorization

Example:

A report may be:

Certified

But users still require permissions to access it.

Certification does not grant access.

Endorsements vs Sensitivity Labels

Another frequently tested distinction.

Endorsements	Sensitivity Labels
Indicate trustworthiness	Indicate sensitivity
Governance and quality	Classification and protection
Help users find trusted content	Help users identify sensitive content

Example:

			
Certified Report
Highly Confidential

Both labels may exist simultaneously.

The report is:

Trusted (Certified)
Sensitive (Highly Confidential)

Endorsements vs Data Lineage

Endorsements	Data Lineage
Indicates trust	Shows data flow
Governance tool	Dependency tracking tool

Data lineage answers:

Where did this data come from?

Endorsements answer:

Can I trust this asset?

Common DP-700 Exam Scenarios

Scenario 1

Requirement:

Users need to identify official KPI definitions.

Solution:

Use Certified semantic models.

Scenario 2

Requirement:

A department wants to recommend a dashboard without formal review.

Solution:

Use Promoted endorsement.

Scenario 3

Requirement:

An executive dashboard has been validated by the governance team.

Solution:

Apply Certified endorsement.

Scenario 4

Requirement:

A report contains highly sensitive financial information.

Solution:

Apply a sensitivity label.

Not an endorsement.

Endorsement Workflow

A common governance workflow:

			
Create Asset
      ↓
Validate Asset
      ↓
Promote Asset
      ↓
Governance Review
      ↓
Certify Asset

		

This process improves trust and consistency.

Best Practices

Certify Enterprise Assets

Certify:

Corporate KPI datasets
Financial reports
Enterprise semantic models

Promote Useful Content

Promote:

Department dashboards
Frequently used reports
Shared analytics assets

Establish Governance Processes

Define:

Who can certify content
Review procedures
Approval standards

Avoid Certifying Everything

Certification should remain meaningful and reserved for truly authoritative assets.

Combine Governance Features

Use endorsements alongside:

Sensitivity labels
Lineage tracking
Security permissions
Data cataloging

DP-700 Exam Focus Areas

You should understand:

✓ Purpose of endorsements

✓ Promoted endorsements

✓ Certified endorsements

✓ Governance benefits

✓ Data discovery improvements

✓ Trusted data sources

✓ Promoted versus Certified

✓ Endorsements versus permissions

✓ Endorsements versus sensitivity labels

✓ Endorsements versus lineage

✓ Common governance scenarios

Practice Exam Questions

Question 1

What is the primary purpose of endorsements in Microsoft Fabric?

A. Encrypt sensitive data

B. Identify trusted and recommended data assets

C. Filter rows of data

D. Control workspace permissions

Answer: B

Explanation

Endorsements help users identify trusted, recommended, and authoritative data assets within Fabric.

Question 2

Which endorsement level represents the highest level of organizational trust?

A. Endorsed

B. Promoted

C. Confidential

D. Certified

Answer: D

Explanation

Certified is the highest endorsement level and indicates formal governance review and approval.

Question 3

A department wants to highlight a useful dashboard without requiring formal governance approval.

Which endorsement should be used?

A. Certified

B. Promoted

C. Confidential

D. Restricted

Answer: B

Explanation

Promoted endorsements indicate recommended content without requiring formal certification processes.

Question 4

What is a key characteristic of a Certified item?

A. It automatically grants workspace access.

B. It is encrypted.

C. It automatically receives a sensitivity label.

D. It has undergone formal validation and approval.

Answer: D

Explanation

Certified items have been reviewed and approved according to organizational governance standards.

Question 5

How do endorsements differ from security permissions?

A. Endorsements classify sensitivity levels.

B. Endorsements indicate trustworthiness, while permissions control access.

C. Endorsements encrypt content.

D. Endorsements implement Row-Level Security.

Answer: B

Explanation

Permissions determine who can access an asset, while endorsements indicate whether the asset is trusted.

Question 6

Which statement about Promoted items is correct?

A. They require formal governance certification.

B. They cannot be used by business users.

C. They indicate content that is recommended for broader use.

D. They automatically become Certified after publication.

Answer: C

Explanation

Promoted items highlight useful and recommended content without formal certification requirements.

Question 7

A governance team reviews and approves an enterprise semantic model that contains official KPI definitions.

Which endorsement should be applied?

A. Public

B. Promoted

C. Internal

D. Certified

Answer: D

Explanation

Certified endorsement is appropriate for formally reviewed and approved enterprise assets.

Question 8

What problem do endorsements primarily help solve?

A. Unauthorized access

B. Data encryption

C. User identification

D. Difficulty identifying trusted content

Answer: D

Explanation

Endorsements help users distinguish trusted assets from numerous available reports and datasets.

Question 9

A report is marked as Certified.

What does this indicate?

A. It is an authoritative and approved data asset.

B. It is automatically encrypted.

C. It is accessible to all users.

D. It contains confidential information.

Answer: A

Explanation

Certification indicates that the asset has been validated and approved as a trusted source.

Question 10

Which statement best describes the relationship between endorsements and sensitivity labels?

A. They are identical governance features.

B. Sensitivity labels replace endorsements.

C. Endorsements indicate trustworthiness, while sensitivity labels indicate data sensitivity.

D. Certified items cannot have sensitivity labels.

Answer: C

Explanation

Endorsements focus on trust and quality, while sensitivity labels focus on classification and protection requirements.

Exam Tip

One of the most common DP-700 exam traps is confusing endorsements, sensitivity labels, and security permissions.

Remember:

Requirement	Solution
Identify trusted content	Endorsements
Classify sensitive data	Sensitivity Labels
Control who can access data	Permissions
Track data origins	Lineage

A useful memory aid is:

Promoted = Recommended
Certified = Official
Sensitivity Label = Sensitive
Permission = Access

If the exam question focuses on helping users identify the most trustworthy or authoritative asset, the correct answer is often Promoted or Certified endorsement, not a security control.

Go to the DP-700 Exam Prep Hub main page.

BI Administration, Data Security, Microsoft Certification, PL-300, Power BI January 17, 2026

Configure Row-Level Security Group Membership (PL-300 Exam Prep)

This post is a part of the PL-300: Microsoft Power BI Data Analyst Exam Prep Hub; and this topic falls under these sections:
Manage and secure Power BI (15–20%)
   --> Secure and govern Power BI items
      --> Configure Row-Level Security Group Membership

Note that there are 10 practice questions (with answers and explanations) at the end of each topic. Also, there are 2 practice tests with 60 questions each available on the hub below all the exam topics.

Overview

Configuring Row-Level Security (RLS) group membership is a key governance and scalability topic within the “Manage and secure Power BI (15–20%)” domain of the PL-300: Microsoft Power BI Data Analyst certification exam. This topic builds on basic RLS concepts and focuses on how users are assigned to RLS roles, with an emphasis on using Microsoft Entra ID (Azure AD) security groups instead of individual users.

For the exam, you should understand where RLS roles are defined, where group membership is configured, how group-based RLS behaves, and why it is considered a best practice.

What Is RLS Group Membership?

RLS group membership refers to assigning security groups (rather than individual users) to Row-Level Security roles in a Power BI semantic model. Any user who is a member of the group automatically inherits the data access defined by the role.

This approach:

Improves scalability
Simplifies administration
Aligns with enterprise security standards
Reduces ongoing maintenance

Exam Focus: The PL-300 exam strongly favors group-based RLS as the recommended approach.

Where RLS Group Membership Is Configured

Understanding where actions occur is frequently tested.

Power BI Desktop

Create RLS roles
Define DAX filter expressions
No users or groups are assigned here

Power BI Service

Assign users or security groups to RLS roles
Manage role membership after publishing

Key Distinction:

Roles and filters → Desktop

Users and groups → Service

Why Use Security Groups for RLS?

Benefits of Group-Based RLS

Centralized identity management
Groups are managed in Microsoft Entra ID, not Power BI.
Automatic access updates
Adding or removing users from a group instantly updates data access.
Reduced administrative effort
No need to modify RLS settings when staff changes.
Auditability and compliance
Easier to review who has access and why.

Exam Tip: If a question asks for the most scalable or best practice approach, choose security groups.

Types of Groups Used in RLS

Supported Group Types

Microsoft Entra ID security groups (recommended)
Mail-enabled security groups

Not Recommended / Not Supported

Distribution lists (not ideal for security)
Microsoft 365 groups (not designed for RLS scenarios)

PL-300 Expectation: Know that security groups are the preferred option for RLS role membership.

Assigning Groups to RLS Roles

Step-by-Step (Power BI Service)

Publish the semantic model from Power BI Desktop
In the Power BI Service, open the semantic model
Select Security
Choose an RLS role
Add one or more security groups
Save changes

Once assigned, all group members inherit the role’s data filters.

Group Membership and Dynamic RLS

Group membership is often combined with dynamic RLS for maximum flexibility.

Common Pattern

RLS role contains a dynamic filter using USERPRINCIPALNAME()
A mapping table links users to business entities (e.g., region, department)
A security group controls who is subject to that role

This pattern:

Minimizes the number of roles
Supports large organizations
Separates identity management from data logic

How Group-Based RLS Is Evaluated

When a user opens a report:

Power BI identifies the user’s Entra ID group memberships
The user is matched to assigned RLS roles
The union of all applicable role filters is applied
Only authorized rows are returned

Important Exam Concept:
Users in multiple roles see the combined (union) of allowed data—not the most restrictive set.

Testing Group-Based RLS

In Power BI Desktop

Use View as
Test role logic only (group membership is not evaluated here)

In Power BI Service

Use View as role
Or test by signing in as a user who belongs to the group

Exam Awareness: Group membership itself cannot be fully tested in Desktop—only in the Service.

Common Pitfalls (Exam-Relevant)

Assigning individual users instead of groups
Expecting RLS to apply before publishing
Forgetting that group membership changes happen outside Power BI
Confusing workspace roles with RLS roles
Assuming admins bypass RLS automatically

RLS Group Membership vs Workspace Roles

Feature	Workspace Roles	RLS Group Membership
Controls content access	✅	❌
Controls data visibility	❌	✅
Uses Entra ID groups	✅	✅
Defined in Desktop	❌	❌
Assigned in Service	✅	✅

PL-300 Focus: These are complementary—not interchangeable—security mechanisms.

Governance and Best Practices

Always prefer security groups over individuals
Use clear, business-aligned group names
Keep RLS logic simple and documented
Coordinate with identity administrators
Review group membership regularly

Common Exam Scenarios

You may be asked to identify:

The best way to manage RLS for hundreds of users
Why a user gained or lost data access without a model change
Where to update access when an employee changes roles
How group membership impacts RLS evaluation

Key Takeaways for the PL-300 Exam

RLS roles are defined in Power BI Desktop
Group membership is configured in the Power BI Service
Microsoft Entra ID security groups are the recommended approach
Group-based RLS improves scalability and governance
Users see the union of all assigned RLS roles
RLS applies to all reports and apps using the semantic model

Practice Questions

Go to the Practice Questions for this topic.

BI Administration, Business Intelligence Platform, Data Security, DP-600, Microsoft Certification, Microsoft Fabric December 28, 2025

Implement workspace-level access controls in Microsoft Fabric

This post is a part of the DP-600: Implementing Analytics Solutions Using Microsoft Fabric Exam Prep Hub; and this topic falls under these sections: 
Maintain a data analytics solution 
    --> Implement security and governance 
        --> Implement workspace-level access controls

To Do:
Complete the related module for this topic in the Microsoft Learn course: Secure data access in Microsoft Fabric

Workspace-level access control is the first and most fundamental security boundary in Microsoft Fabric. It determines who can access a workspace, what actions they can perform, and how they can interact with Fabric items such as Lakehouses, Warehouses, semantic models, reports, notebooks, and pipelines.

For the DP-600 exam, you should clearly understand workspace roles, their permissions, and how workspace security integrates with broader governance practices.

What Are Workspace-Level Access Controls?

Workspace-level access controls define permissions at the workspace scope, applying to all items within that workspace unless further restricted by item-level or data-level security.

These controls are managed through workspace roles, which are assigned to:

Individual users
Microsoft Entra ID (Azure AD) security groups
Distribution lists (limited scenarios)

Workspace Roles in Microsoft Fabric

Microsoft Fabric workspaces use role-based access control (RBAC). There are 4 roles that users can be assigned to for workspace access and each role grants a predefined set of permissions.

1. Admin

Highest level of access

Admins can:

Manage workspace settings
Add or remove users and assign roles
Delete the workspace
Control capacity assignment
Access and manage all items

Typical use cases

Platform administrators
Lead analytics engineers

Exam note
Admins automatically have all permissions of lower roles.

2. Member

Full content creation and collaboration role

Members can:

Create, edit, and delete Fabric items
Publish and update semantic models and reports
Share content
Run pipelines and notebooks

Members cannot:

Delete the workspace
Manage capacity settings

Typical use cases

Analytics engineers
Senior analysts

3. Contributor

Content creation with limited governance control

Contributors can:

Create and modify items they have access to
Run notebooks, pipelines, and queries
Publish reports and datasets

Contributors cannot:

Manage workspace users
Modify workspace settings

Typical use cases

Data analysts
Developers contributing content

4. Viewer

Read-only access

Viewers can:

View reports and dashboards
Read data from semantic models
Execute queries if explicitly allowed

Viewers cannot:

Create or edit items
Publish or share content

Typical use cases

Business users
Report consumers

Summary table:

Role	Description	Can / Cannot	Typical use cases
Admin	– Highest level of access. – Full workspace administration access including ability to delete.	Admins Can: – Manage workspace settings – Add or remove users and assign roles – Delete the workspace – Control capacity assignment – Access and manage all items	– Platform administrators – Lead analytics engineers
Member	– Full content creation and collaboration role. – Can manage members with same or lower permissions.	Members can: – Create, edit, and delete Fabric items – Publish and update semantic models and reports – Share content – Run pipelines and notebooks Members cannot: – Delete the workspace – Manage capacity settings	– Analytics engineers – Senior analysts
Contributor	– Content creation with limited governance control – Can create and manage workspace content	Contributors can: – Create and modify items they have access to – Run notebooks, pipelines, and queries – Publish reports and datasets Contributors cannot: – Manage workspace users – Modify workspace settings	– Data analysts – Developers contributing content
Viewer	– Read-only access to the workspace	Viewers can: – View reports and dashboards – Read data from semantic models – Execute queries if explicitly allowed Viewers cannot: – Create or edit items – Publish or share content	– Business users – Report consumers

How Workspace-Level Security Is Enforced

Workspace-level access controls:

Are evaluated before item-level or data-level security
Determine whether a user can even see workspace content
Apply consistently across all Fabric workloads (Power BI, Lakehouse, Warehouse, Data Factory, Real-Time Analytics)

This makes workspace roles the entry point for all other security mechanisms.

Best Practices for Workspace-Level Access Control

Use Security Groups Instead of Individuals

Assign Microsoft Entra ID security groups to workspace roles
Simplifies access management
Supports scalable governance

Separate Workspaces by Purpose

Common patterns include:

Development vs Test vs Production
Department-specific workspaces
Consumer-only (Viewer) workspaces

Apply Least Privilege

Grant users the lowest role necessary
Avoid overusing Admin and Member roles

Relationship to Other Security Layers

Workspace-level access controls work alongside:

Item-level permissions (e.g., sharing a report)
Row-level, column-level, and object-level security in semantic models
File-level security in OneLake
Capacity-level governance

For exam scenarios, always identify which security layer is being tested.

Common Exam Scenarios to Watch For

You may be asked to:

Choose the correct workspace role for a given user persona
Identify why a user cannot see or edit workspace content
Decide when to use Viewer vs Contributor
Understand how workspace roles interact with RLS or file access

Key Exam Takeaways

Workspace roles control who can access a workspace and what actions they can perform
Admin, Member, Contributor, and Viewer each have distinct permission boundaries
Workspace security is broader than item-level sharing
Always think workspace first, data second when designing security

Exam Tips

If the question is about who can create, edit, share, or manage content, the answer almost always involves workspace-level access controls.

Expect scenario-based questions that test:

Choosing the least-privileged role
Understanding the difference between Member vs Contributor
Knowing when workspace security is not enough and must be combined with RLS or item-level access

Practice Questions

Question 1 (Single choice)

Which workspace role in Microsoft Fabric allows a user to publish content, manage permissions, and delete the workspace?

A. Viewer
B. Contributor
C. Member
D. Admin

Correct Answer: D

Explanation:

Admin is the highest workspace role and includes full control, including managing access, deleting the workspace, and assigning roles.
Contributors and Members cannot manage workspace-level permissions.
Viewers have read-only access.

Question 2 (Scenario-based)

You want analysts to create and edit items (lakehouses, notebooks, reports) but prevent them from managing access or deleting the workspace. Which role should you assign?

A. Viewer
B. Contributor
C. Member
D. Admin

Correct Answer: C

Explanation:

Members can create, edit, and publish content but cannot manage workspace access or delete the workspace.
Contributors have more limited permissions.
Admins have excessive privileges for this scenario.

Question 3 (Multi-select)

Which actions are possible for a user assigned the Contributor role? (Select all that apply.)

A. Create new items
B. Edit existing items
C. Manage workspace permissions
D. Publish reports to the workspace

Correct Answers: A, B

Explanation:

Contributors can create and edit items.
They cannot manage permissions or perform full publishing/administrative actions.
Publishing to app audiences or managing access requires Member or Admin.

Question 4 (Scenario-based)

A workspace contains sensitive data. You want executives to view reports only, without seeing datasets, lakehouses, or notebooks. What is the BEST approach?

A. Assign Viewer role
B. Assign Contributor role
C. Assign Member role
D. Assign Admin role

Correct Answer: A

Explanation:

Viewer role provides read-only access and prevents exposure to underlying assets beyond consumption.
Other roles expose authoring and object-level visibility.

Question 5 (Single choice)

Workspace-level access controls in Fabric are applied to:

A. Individual tables only
B. Semantic models only
C. All items within the workspace
D. Reports published to apps only

Correct Answer: C

Explanation:

Workspace-level roles apply across all items in the workspace unless further restricted using item-level or semantic-model security.
Finer-grained security must be implemented separately.

Question 6 (Scenario-based)

You need to ensure that workspace access is centrally governed and users cannot self-assign roles. What is the BEST practice?

A. Allow Members to manage access
B. Restrict access management to Admins only
C. Use Viewer roles exclusively
D. Disable workspace sharing

Correct Answer: B

Explanation:

Only Admins should manage workspace access for governance and compliance.
Members should not be allowed to assign roles in controlled environments.

Question 7 (Multi-select)

Which of the following are valid workspace roles in Microsoft Fabric? (Select all that apply.)

A. Viewer
B. Contributor
C. Member
D. Owner

Correct Answers: A, B, C

Explanation:

Valid Fabric workspace roles are Viewer, Contributor, Member, and Admin.
“Owner” is not a Fabric workspace role.

Question 8 (Scenario-based)

A user can view reports but receives an error when attempting to open a semantic model directly. What is the MOST likely reason?

A. They are a Contributor
B. They are a Viewer
C. The dataset is in Import mode
D. XMLA endpoint is disabled

Correct Answer: B

Explanation:

Viewers can consume reports but may not have permissions to explore or access underlying semantic models directly.
This behavior aligns with workspace-level access restrictions.

Question 9 (Single choice)

Which statement about workspace-level access vs. item-level security is TRUE?

A. Workspace access overrides all other security
B. Workspace access is more granular than item-level security
C. Item-level security can further restrict access granted by workspace roles
D. Workspace access only applies to reports

Correct Answer: C

Explanation:

Workspace roles grant baseline access, which can then be restricted using item-level security, RLS, or object-level permissions.
Workspace access does not override more restrictive controls.

Question 10 (Scenario-based)

You want to minimize administrative overhead while allowing self-service analytics. Which workspace role strategy is MOST appropriate?

A. Assign Admin to all users
B. Assign Member to authors and Viewer to consumers
C. Assign Contributor to executives
D. Assign Viewer to data engineers

Correct Answer: B

Explanation:

This is a recommended best practice:
- Members for authors/builders
- Viewers for consumers
It balances governance and agility while minimizing risk.