Practice Free AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals Exam Questions Answers With Explanation

The correct selections are No, Yes, Yes . Microsoft documents that the Audit page in the Microsoft Defender portal can be used to search the unified audit log for user and admin actions in the organization. Microsoft also states that audit log search in the Defender portal is the same as audit log search in the Microsoft Purview portal , which means both portals can be used to review administrative actions taken in Microsoft 365.

Microsoft further explains that Microsoft Purview Audit enables organizations to search for audit records of activities that users and admins perform across Microsoft services, making it a correct tool for this requirement.

By contrast, Search & intelligence in the Microsoft 365 admin center is not the feature used to investigate administrator actions through the unified audit log. It is not Microsoft’s documented audit search tool for this purpose. Therefore, for this hotspot the right answers are No for Search & intelligence, Yes for Audit in Microsoft Defender, and Yes for Audit in Microsoft Purview.

a site member of

The correct answer is a site member of . In the exhibit, the Site members group for Site1 contains Everyone except external users with Edit permissions. Microsoft documents that “Everyone except external users” automatically includes all internal users and excludes external guests . Since User1 is a newly created user in the organization, User1 is an internal user and is therefore included in that built-in principal.

Because that built-in principal is placed in the Site members group, User1 inherits member-level access to the site. User1 is not a site owner, because the Site owners group contains only the Global Administrator entry shown in the exhibit. User1 is also not merely a visitor, because the Site visitors group is listed as None . Finally, User1 is not prevented from accessing the site, because the membership granted through Everyone except external users gives internal users access to the site according to the permissions assigned to that group.

The correct answer is D. an app registration . Microsoft Learn states that to delegate identity and access management functions to Microsoft Entra ID , an application must be registered with a Microsoft Entra tenant . When you register an application, you create its identity configuration in Microsoft Entra, and a corresponding service principal is created so the application can authenticate and integrate with the tenant. This is the standard Microsoft mechanism for allowing a third-party cloud service or app to authenticate to Microsoft Entra.

The other options do not provide the app identity required for authentication. Multifactor authentication (MFA) strengthens user sign-ins, but it does not onboard a third-party service as an application identity in Entra. Conditional Access enforces access policies after authentication and authorization decisions are being made; it does not create the application identity itself. A Microsoft 365 Copilot connector is used to bring external data into Microsoft 365 experiences, not to let a third-party cloud service authenticate to Microsoft Entra. Therefore, the correct configuration is an app registration .

The correct answer is accountability . Microsoft’s Responsible AI framework is built on six principles: fairness , reliability and safety , privacy and security , inclusiveness , transparency , and accountability . Microsoft describes accountability as the principle that people who design and deploy AI systems must remain responsible for how those systems operate and for the impacts they create. A key part of that principle is ensuring there is human oversight so humans remain in control of decisions and system behavior.

The other options do not match the wording in the sentence as closely. Transparency focuses on helping people understand how AI systems work and why they produce certain outcomes. Privacy and security is about protecting data and securing systems. Reliability and safety is about dependable and safe operation. Inclusiveness is about designing AI that empowers and includes people broadly. The principle tied to oversight, responsibility, and keeping humans in control is accountability .

The correct answer is B . Microsoft documents that admins can block agents in the Microsoft 365 admin center, and when administrators block Microsoft agents such as Researcher and Analyst, those agents are made inaccessible to all users in the tenant. Microsoft’s agent management guidance also states that admins can manage agent lifecycle and access centrally, including blocking or removing agent availability across the organization.

Applied to this scenario, if an admin blocks Agent1 , the shared agent is no longer available for either the creator ( User1 ) or the recipient ( User2 ), and other users also cannot install or access it. This rules out options A and C, which both say the blocked agent remains accessible. It also rules out D, because blocking is a tenant admin action that removes availability broadly, not just for shared recipients while leaving the creator unaffected. Microsoft positions blocking as an organization-level control over agent access, so the best matching option is that Agent1 is removed from User1 and User2, and no users can install Agent1 .

The correct answers are A and D . Microsoft documents that with group-based licensing , licenses assigned to a group are automatically inherited by the group’s members. Therefore, if User1 is added to Group1 , User1 can receive the Microsoft 365 E3 license through group membership. Microsoft also documents that licenses can be assigned directly to individual users , so assigning a Microsoft 365 E3 license straight to User1 is also a complete solution.

Options B and C are incorrect because Conditional Access controls how users access cloud resources after sign-in; it does not grant product entitlements or service licenses. Microsoft licensing guidance separates access-policy controls from actual license assignment. In this scenario, the issue is lack of license entitlement, not access conditions. As a result, the valid solutions are either to make User1 a member of the licensed group or to assign the license directly to User1. Microsoft also notes that group-based licensing assignment can fail if required user properties such as usage location are missing, but among the available answer choices, the two complete license-granting actions are Add User1 to Group1 and Assign a license to User1 .

The correct answer is C. the code interpreter capability . Microsoft Learn states that the code interpreter capability for Microsoft 365 Copilot declarative agents allows the agent to generate and execute Python code to analyze data and generate visualizations . Microsoft’s agent schema documentation explicitly describes Code Interpreter as a capability used to solve complex math problems, analyze data, and generate visualizations. That directly matches the requirement to create charts and visualizations from a Microsoft Excel workbook .

Microsoft documentation also explains that code interpreter supports working with Excel files and is used for scenarios such as data analysis , statistical computations , and generating charts . This makes it the correct configuration for an agent that must reason over workbook data and produce chart-based outputs. By contrast, the image generator capability is for creating images, not for analyzing workbook data. The Scrum Assistant and Customer Insights Assistant options are templates, not the specific technical capability required to read data and build charts from an Excel workbook.

You can use the eDiscovery Microsoft Purview solution to find all the content that relates to the term “Project Falcon” in the emails exchanged by two users.

The correct answer is eDiscovery . Microsoft documents that Microsoft Purview eDiscovery is used to search for content in Microsoft 365 data sources that is relevant to an investigation, legal matter, or internal review. Microsoft specifically states that eDiscovery search can find email messages, documents, instant messages, and other content across Microsoft 365 locations, including Exchange Online mailboxes . This makes it the correct solution for locating content related to a keyword or phrase such as “Project Falcon” in emails exchanged between specific users.

This is different from other Purview solutions such as Communication Compliance, which is designed to monitor risky or inappropriate communications, or Data Lifecycle Management, which is for retention and deletion. The requirement here is targeted search and retrieval of content connected to a specific term in user email communications, which is exactly what eDiscovery is designed to do. Microsoft also notes that eDiscovery supports keyword queries and search conditions , which further aligns with this scenario.

The correct answer is D. a sensitivity label policy . In Microsoft Purview, creating a sensitivity label by itself does not make it available to users. Microsoft Learn states that after you create sensitivity labels, you must publish them by creating a label policy so that users and groups can see and apply those labels in Microsoft 365 apps and services. Publishing controls which labels are available and to whom they are shown. This is why a sensitivity label policy is required to ensure that users can apply Label1 to files.

The other options do not meet the requirement. Auto-labeling policies apply labels automatically when content matches conditions, but they are not the primary mechanism for simply making a label available for user selection. A trainable classifier is used to identify content categories, not to publish a label. A retention label policy publishes retention labels for records and lifecycle purposes, which is different from sensitivity labeling for classification and protection. Therefore, the correct Microsoft-documented method to let users apply Label1 to files is to publish it using a sensitivity label policy .

The correct answer is A. the Microsoft Defender portal . Microsoft documents that phishing investigation and analysis for email threats is handled in Microsoft Defender for Office 365 through the Microsoft Defender portal . Microsoft’s phishing investigation guidance and email security reporting both point admins to Defender capabilities such as Threat Explorer , campaign views , and phish reports to understand the scope, affected users, and impact of phishing attacks.

The other options are not the primary investigation tool for this scenario. The Microsoft 365 admin center is mainly for tenant administration and usage reporting, not detailed phishing impact investigation. The Microsoft Entra admin center focuses on identity and access management, not email threat analysis. The Exchange admin center manages mail flow and Exchange settings, but Microsoft’s current phishing investigation workflows are centered in the Microsoft Defender portal , where security analysts can review detections, remediation actions, and affected recipients.

So, to review the impact of a phishing incident that targeted email users, the Microsoft-documented choice is the Microsoft Defender portal .

The correct answer is Microsoft 365 Copilot . Microsoft Learn states that Restricted SharePoint Search (RSS) gives organizations time to review and correct permissions on SharePoint sites, and then add only those reviewed sites to an allowed list that Copilot can access . That means RSS is specifically about restricting Copilot’s access to SharePoint content, not blocking administrators, guest users, or Microsoft Purview eDiscovery from those sites.

This distinction is important. Microsoft explains that users can still access SharePoint content based on their normal permissions, while RSS limits what Microsoft 365 Copilot can use as grounding data until site permissions are reviewed and approved. So the feature helps reduce oversharing risk in Copilot without removing a user’s direct ability to find or open content they already have permission to access in SharePoint. In other words, the restriction is placed on Copilot’s searchable grounding scope , not on the user’s own SharePoint permissions. That is why the sentence is correctly completed with Microsoft 365 Copilot .

the Microsoft Authenticator app

The correct answer is the Microsoft Authenticator app . The image shows the familiar Microsoft MFA prompt that says “Are you trying to sign in?” and “Enter the number shown to sign in.” Microsoft documents this as number matching in Authenticator push notifications , which is part of Microsoft Entra multifactor authentication using the Microsoft Authenticator app . Microsoft explains that number matching is a security improvement for Authenticator push approvals and is used when the default sign-in method is Authenticator push notifications.

The other choices do not match the experience shown. Email OTP would involve a one-time code sent by email. SMS would send a text message code to a phone number. Temporary Access Pass is a time-limited passcode used for onboarding or recovery scenarios, not the mobile push screen shown in the image. Because the graphic specifically shows a mobile approval prompt with number matching, the MFA method is clearly the Microsoft Authenticator app .

The correct answer is B. data loss prevention (DLP) policies . Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices . Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.

Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft’s documented solution is DLP policies .

The correct answer is A . Microsoft Learn defines Zero Trust as a security strategy built on the principles verify explicitly , use least privilege access , and assume breach . Microsoft also summarizes Zero Trust as a model that assumes breach and verifies every request , rather than trusting users, devices, or traffic simply because they originate from inside the corporate network. This is the key reason option A is correct. Under Zero Trust, every access request should be evaluated continuously using available signals such as identity, device state, location, service, and risk.

Option B is incorrect because improving user experience is not the defining principle of Zero Trust. Option C is incorrect because Zero Trust requires ongoing review and adjustment of permissions, especially through least privilege and risk-based access. Option D is incorrect because Zero Trust explicitly rejects implicit trust based on network location. Microsoft states that organizations should reduce reliance on the traditional idea that anything on the internal network is automatically safe or trustworthy.

The correct answer is are NOT assigned a Microsoft 365 Copilot license. Microsoft’s official reporting guidance explains that the Copilot credits report is used to manage metered consumption costs for Microsoft 365 Copilot Chat. The purpose of this report is to show credit consumption tied to pay-as-you-go billing policies, including metrics such as total credits used and credits used per user, per agent, and per billing policy. Microsoft’s Copilot analytics documentation further defines these credit-related metrics around Copilot Chat users, which are users with a Microsoft 365 license but without a Microsoft 365 Copilot license who consume credits while using agents.

Because licensed Microsoft 365 Copilot users are generally covered by their Copilot entitlement for included agent usage, the credits report is intended to track the metered agent usage scenario for users who are not assigned a Microsoft 365 Copilot license and who interact with work-grounded agents in Microsoft 365 Copilot Chat. That is why this option correctly completes the sentence.

The correct answers are A and D because both tasks are supported directly in the Exchange admin center (EAC) . Microsoft Learn states that administrators can manage mail flow rules in Exchange Online from the EAC under Mail flow > Rules , which includes creating and managing transport rules for organizational email handling. Microsoft Learn also states that administrators can create shared mailboxes in the EAC under Recipients > Mailboxes , where a shared mailbox can be added and then delegated to users.

Option B is incorrect because adding a custom domain is normally done in the Microsoft 365 admin center , specifically on the Domains page. Although Exchange can later work with accepted domains and related mail flow settings, the act of adding and verifying a custom domain is not an Exchange admin center task. Option C is incorrect because license assignment is handled through Microsoft 365 or Microsoft Entra administrative tools, not the Exchange admin center.