Practice Free AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals Exam Questions Answers With Explanation

The correct answer is D. Data Lifecycle Management . Microsoft Learn states that Microsoft Purview retention policies and retention labels, managed under Data Lifecycle Management , support three core outcomes: retain-only , delete-only , and retain and then delete . The requirement in this question is exact: keep email for seven years and then permanently delete it. That is a textbook retain and then delete retention configuration, which Microsoft documents as part of Purview’s retention capabilities. Microsoft also recommends using Microsoft 365 retention policies and labels for retaining and deleting emails rather than relying on older Exchange-only approaches in most modern compliance scenarios.

The other options do not meet the requirement. Information Protection focuses on labeling and protecting sensitive information. Insider Risk Management is used to detect and investigate risky user behavior. Data Loss Prevention helps prevent inappropriate sharing or exfiltration of sensitive data. None of those are designed to enforce a timed seven-year retention period followed by automatic permanent deletion. The Microsoft Purview solution explicitly built for that lifecycle requirement is Data Lifecycle Management .

The correct answer is A. the Microsoft Defender portal . Microsoft documents that phishing investigation and analysis for email threats is handled in Microsoft Defender for Office 365 through the Microsoft Defender portal . Microsoft’s phishing investigation guidance and email security reporting both point admins to Defender capabilities such as Threat Explorer , campaign views , and phish reports to understand the scope, affected users, and impact of phishing attacks.

The other options are not the primary investigation tool for this scenario. The Microsoft 365 admin center is mainly for tenant administration and usage reporting, not detailed phishing impact investigation. The Microsoft Entra admin center focuses on identity and access management, not email threat analysis. The Exchange admin center manages mail flow and Exchange settings, but Microsoft’s current phishing investigation workflows are centered in the Microsoft Defender portal , where security analysts can review detections, remediation actions, and affected recipients.

So, to review the impact of a phishing incident that targeted email users, the Microsoft-documented choice is the Microsoft Defender portal .

The correct answer is C. the Microsoft 365 Copilot dashboard in Microsoft Viva Insights . Microsoft documents that the Microsoft Copilot Dashboard in Viva Insights provides detailed organizational reporting for Copilot usage and impact, including meeting-related metrics such as total meeting hours summarized or recapped , intelligent recap actions taken using Copilot , and summarize meeting actions taken using Copilot in Teams . Those metrics directly match the scenario in the question.

The other options are less suitable. The Microsoft 365 Apps usage report focuses on app usage generally, not detailed Copilot-in-Teams behavior. The Copilot readiness report is for readiness and deployment planning, not deep Teams usage metrics. The Microsoft 365 Copilot usage report in the admin center provides adoption information, but Microsoft’s detailed meeting-action and meeting-hours metrics are documented in the Viva Insights Copilot Dashboard . Therefore, for detailed Teams-specific Copilot reporting during a pilot, the best answer is the Microsoft 365 Copilot dashboard in Microsoft Viva Insights .

The correct answer is Microsoft 365 Copilot . Microsoft Learn states that Restricted SharePoint Search (RSS) gives organizations time to review and correct permissions on SharePoint sites, and then add only those reviewed sites to an allowed list that Copilot can access . That means RSS is specifically about restricting Copilot’s access to SharePoint content, not blocking administrators, guest users, or Microsoft Purview eDiscovery from those sites.

This distinction is important. Microsoft explains that users can still access SharePoint content based on their normal permissions, while RSS limits what Microsoft 365 Copilot can use as grounding data until site permissions are reviewed and approved. So the feature helps reduce oversharing risk in Copilot without removing a user’s direct ability to find or open content they already have permission to access in SharePoint. In other words, the restriction is placed on Copilot’s searchable grounding scope , not on the user’s own SharePoint permissions. That is why the sentence is correctly completed with Microsoft 365 Copilot .

The correct answer is D. the Analyst agent in Microsoft 365 Copilot . Microsoft Learn training for Microsoft 365 Copilot specifically distinguishes the Analyst agent as the tool for gathering insights from data and enhancing data presentations. Microsoft’s guidance also notes in the Researcher FAQ that when the task is spreadsheet-related , Analyst agent is better suited for Microsoft Excel related tasks . This makes Analyst the best choice for a quarterly sales reporting scenario that involves detecting performance trends , surfacing anomalies , and producing visual insights from multiple datasets.

The other options are less suitable. Researcher is intended for complex multi-step research and source-cited reports across web and work content, not specialized data analysis across files. Microsoft 365 Copilot Search is for finding information, not for deep quantitative analysis and anomaly summarization. Copilot in Excel is powerful for workbook-level analysis, but the question emphasizes broader insight generation across multiple files and asks for the best Copilot experience for trends, visuals, and anomaly summaries. Microsoft positions Analyst as the dedicated agent for that kind of data-analysis workflow.

Communications Compliance uses OCR (optical character recognition) and machine learning to detect offensive or risky text inside images , including those in SharePoint and OneDrive.

By default, Communications Compliance pseudonymizes user identities to reduce investigator bias. Admins can later deanonymize if needed.

It does not add disclaimers. It silently monitors communications and flags policy violations; disclaimers are handled by Exchange transport rules, not Communications Compliance.

The correct answer is Require multifactor authentication for administrative roles . In the exhibit, each recommendation shows its available Secure Score points . The listed values are 1/1 for Use least privileged administrative roles , 8/8 for Do not expire passwords , 0.73/8 for Enable policy to block legacy authentication , and 0/10 for Require multifactor authentication for administrative roles . Because 10 points is the highest value among the options shown, resolving that recommendation would improve the Identity Secure Score the most.

Microsoft Learn explains that Identity Secure Score in Microsoft Entra is based on Microsoft security recommendations, and each recommendation contributes a specific number of points depending on its impact and implementation state. Recommendations related to administrator protection are especially important because privileged accounts are high-value attack targets. Microsoft also emphasizes multifactor authentication for admin roles as a core identity security best practice. Therefore, both from the screenshot and from Microsoft’s identity guidance, the recommendation with the greatest score improvement is Require multifactor authentication for administrative roles .

The correct answers are C and D . Microsoft Learn explains that agents created with Agent Builder in Microsoft 365 Copilot allow you to define specific instructions that extend Microsoft 365 Copilot for a business scenario. Microsoft also documents that you can add knowledge sources such as specific public websites and SharePoint content so the agent can reason over targeted information instead of relying only on the default chat experience. Those two capabilities directly match the needs in options C and D.

Option A is incorrect because grouping chats is a Copilot notebook scenario, not the reason to build an agent. Option B is incorrect in the context of creating an agent in the Microsoft 365 Copilot app . Agent Builder supports declarative agents with instructions, knowledge, and capabilities, but Microsoft Learn describes custom AI model control as part of custom engine agents built with tools such as Copilot Studio, SDKs, or Foundry, not as a standard Agent Builder feature in the Microsoft 365 Copilot app. Therefore, when the task is specifically to create an agent in the app, the valid reasons are custom instructions and reasoning over a specific website .

The correct answer is B . Microsoft documents that admins can block agents in the Microsoft 365 admin center, and when administrators block Microsoft agents such as Researcher and Analyst, those agents are made inaccessible to all users in the tenant. Microsoft’s agent management guidance also states that admins can manage agent lifecycle and access centrally, including blocking or removing agent availability across the organization.

Applied to this scenario, if an admin blocks Agent1 , the shared agent is no longer available for either the creator ( User1 ) or the recipient ( User2 ), and other users also cannot install or access it. This rules out options A and C, which both say the blocked agent remains accessible. It also rules out D, because blocking is a tenant admin action that removes availability broadly, not just for shared recipients while leaving the creator unaffected. Microsoft positions blocking as an organization-level control over agent access, so the best matching option is that Agent1 is removed from User1 and User2, and no users can install Agent1 .

The correct answer is A. Microsoft 365 Copilot Chat. The requirement specifically asks for unlicensed users who used Copilot in Microsoft Teams. That points to Copilot Chat usage, not the standard Microsoft 365 Copilot licensed-user report. Microsoft’s usage documentation distinguishes Copilot Chat activity, including Copilot Chat work and web experiences, and lists Microsoft Teams as an entry point where users can access Copilot Chat. Microsoft also states that the Microsoft 365 Copilot usage report’s user-level table is scoped to users who were licensed for Microsoft 365 Copilot, which makes it the wrong report for identifying unlicensed Copilot Chat users. Microsoft 365 Apps and Copilot Search reports do not target this Teams Copilot Chat usage scenario.

The correct answers are B and C . Microsoft documents that Identity Secure Score in Microsoft Entra is based on identity security recommendations, including recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” Those recommendations directly map to the number of global administrators and whether passwords are set to never expire , so both factors affect the score.

Option A is incorrect because SharePoint site permissions are part of SharePoint content and collaboration security, not a direct factor in the Microsoft Entra Identity Secure Score model. Option D is also incorrect because the location of users can be used in Conditional Access and other access control decisions, but Microsoft does not list user geographic location itself as a direct Identity Secure Score recommendation. Identity Secure Score is driven by Entra identity best-practice checks and recommendations rather than by SharePoint permission structure or user location data.

The correct selections are The Microsoft 365 admin center and A billing policy . Microsoft documents that Microsoft 365 Copilot pay-as-you-go is administered in the Microsoft 365 admin center , specifically under Copilot > Billing & usage , where admins create and manage billing policies . Microsoft explains that a billing policy defines the billing infrastructure for pay-as-you-go, including the Azure subscription and the set of users covered by that policy. That user scoping is what allows organizations to separate usage and spending by groups such as departments.

Microsoft also documents that billing policies support budgets , spending views , and monitoring current expenses for services linked to the policy. This supports the requirement for greater visibility into Copilot usage costs and forecasting departmental spending. By assigning different departments to different billing policies, the organization can track Copilot costs by department. The other listed features do not fit: auto-claim policy is unrelated to cost tracking, and Copilot connector is for external data grounding, not billing segmentation.

The correct answer is C. the code interpreter capability . Microsoft Learn states that the code interpreter capability for Microsoft 365 Copilot declarative agents allows the agent to generate and execute Python code to analyze data and generate visualizations . Microsoft’s agent schema documentation explicitly describes Code Interpreter as a capability used to solve complex math problems, analyze data, and generate visualizations. That directly matches the requirement to create charts and visualizations from a Microsoft Excel workbook .

Microsoft documentation also explains that code interpreter supports working with Excel files and is used for scenarios such as data analysis , statistical computations , and generating charts . This makes it the correct configuration for an agent that must reason over workbook data and produce chart-based outputs. By contrast, the image generator capability is for creating images, not for analyzing workbook data. The Scrum Assistant and Customer Insights Assistant options are templates, not the specific technical capability required to read data and build charts from an Excel workbook.

A Communication Compliance policy can detect inappropriate text in Microsoft Teams messages. Answer: Yes

A Communication Compliance policy can detect offensive language in Microsoft 365 Copilot prompts. Answer: Yes

A Communication Compliance policy can be used to retain email messages for 10 years. Answer: No

The correct selections are Yes, Yes, No . Microsoft documents that Microsoft Purview Communication Compliance can detect potentially inappropriate messages in supported communication channels, including Microsoft Teams and email . Microsoft also states that reviewers can investigate communications in Microsoft 365 Copilot and Microsoft 365 Copilot Chat , which means Communication Compliance policies can evaluate Copilot prompts and responses for risky or offensive content.

This makes statement 1 Yes , because inappropriate text in Teams messages is a standard Communication Compliance scenario. Statement 2 is also Yes , because Microsoft explicitly includes Microsoft 365 Copilot and Microsoft 365 Copilot Chat among the supported communication sources for policy review and investigation.

Statement 3 is No because retaining email for a fixed period such as 10 years is handled by Microsoft Purview Data Lifecycle Management through retention policies or retention labels, not by Communication Compliance. Communication Compliance is for monitoring and investigating risky communications, not for long-term retention enforcement.

The correct answers are A and D because both tasks are supported directly in the Exchange admin center (EAC) . Microsoft Learn states that administrators can manage mail flow rules in Exchange Online from the EAC under Mail flow > Rules , which includes creating and managing transport rules for organizational email handling. Microsoft Learn also states that administrators can create shared mailboxes in the EAC under Recipients > Mailboxes , where a shared mailbox can be added and then delegated to users.

Option B is incorrect because adding a custom domain is normally done in the Microsoft 365 admin center , specifically on the Domains page. Although Exchange can later work with accepted domains and related mail flow settings, the act of adding and verifying a custom domain is not an Exchange admin center task. Option C is incorrect because license assignment is handled through Microsoft 365 or Microsoft Entra administrative tools, not the Exchange admin center.

The correct answer is Microsoft Defender XDR . Microsoft Learn defines Microsoft Defender XDR as a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. That wording matches the sentence in the question almost exactly, which makes this the clearly correct choice.

The other options do not fit that definition. Microsoft Entra Conditional Access is Microsoft’s Zero Trust policy engine used to evaluate signals and enforce access policies, not a cross-domain threat detection and response suite. Microsoft Entra ID Protection focuses on detecting and responding to identity risks such as risky sign-ins and risky users. Microsoft Purview is Microsoft’s portfolio for data governance, data security, and compliance. None of those products is described by Microsoft as coordinating detection, prevention, investigation, and response across endpoints, identities, email, and applications in the same integrated XDR manner. Therefore, the only answer that correctly completes the sentence is Microsoft Defender XDR .

The correct answer is C because Microsoft explains that authorization is the process of determining whether an authenticated identity is allowed to access a resource . Microsoft Learn distinguishes authorization from authentication by stating that authentication proves who you are, while authorization decides what you can access or do after identity has been established. In Microsoft 365 and the Microsoft identity platform, authorization commonly involves permissions, scopes, roles, and consent that control access to data and services such as Microsoft Graph, Exchange, SharePoint, or Teams.

Option A is incorrect because it refers more to external identity validation or federation concepts, not authorization itself. Option B describes authentication , not authorization, since it is about verifying identity claims. Option D describes a control such as multifactor authentication or Conditional Access requirements, which can happen before access is granted, but that still is not the definition of authorization. Authorization begins after identity verification and focuses on whether the identity has the right permissions for the requested resource.