Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 Identify the core features and objects of Microsoft 365 services: 446 practice questions

Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 446 questions 12 shown free

12 of the 446 Identify the core features and objects of Microsoft 365 services questions in the Certsqill Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Microsoft 365 Copilot and Agent Administration Fundamentals AB-900? Take the free 5-min readiness check →

1. Check the employee’s license assignment and provisioning: What should the administrator check first?

Easy
During new-employee onboarding, the employee belongs to a licensed group, but the expected Microsoft 365 service is unavailable. Exhibit: The group has an available product license, and the employee account is eligible. What should the administrator check first?
  1. Assign Global Administrator so every Microsoft 365 feature becomes available.
    Administrative roles govern management actions and do not replace required product licenses.
  2. Check the employee’s license assignment and provisioning status. ✓
    A license enables entitled features, while provisioning status confirms the service became available.
  3. Create a distribution group so the employee receives the licensed service.
    Distribution groups distribute mail and do not assign licenses or provision Microsoft 365 services.
  4. Add the employee as a SharePoint site owner to activate service access.
    SharePoint ownership controls site permissions and does not activate an employee’s product entitlement.
The trap
Confuses mail distribution with product licensing and provisioning. Confuses content permissions with tenant service entitlement. Confuses administrative authority with feature licensing.

Verify license assignment and service provisioning before changing permissions or administrative roles.

2. Inspect the relevant organization setting and its current: In the Microsoft 365 admin center, which TWO checks

Medium
Finance users report two symptoms: mail sent to contoso-finance.example is rejected because the domain is not verified, and a required organization-wide finance setting is disabled. In the Microsoft 365 admin center, which TWO checks should the administrator perform? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Create an Exchange distribution group for every finance department.
    Distribution groups route messages but cannot verify domains or enable organization settings.
  2. Assign Global Administrator to every finance report recipient.
    Administrative roles do not repair an unverified domain or automatically change organization settings.
  3. Inspect the relevant organization setting and its current value. ✓
    Organization settings provide tenant-level controls that can enable or disable supported service behavior.
  4. Change the finance users’ SharePoint site permissions.
    SharePoint permissions do not verify domains or control tenant-wide finance service settings.
  5. Review the domain’s verification and configuration status. ✓
    Domain configuration determines whether Microsoft 365 can recognize and use the organization’s mail domain.
The trap
Uses excessive privilege instead of diagnosing configuration. Confuses recipient objects with tenant configuration. Targets content access instead of organization configuration.

Use the admin center to inspect both the domain status and the affected organization setting.

3. Verify Exchange plan provisioning: What should the administrator verify?

Medium
A research employee can sign in, but Exchange Online shows no mailbox. The user’s group license is assigned and the product is available. What should the administrator verify?
  1. Distribution-group membership
    Distribution groups distribute messages and do not create individual user mailboxes.
  2. SharePoint site ownership for the research team
    SharePoint ownership provides site permissions and does not create an Exchange mailbox.
  3. Verify Exchange plan provisioning ✓
    The Exchange service plan must be enabled and provisioned for the licensed user.
  4. A Teams policy allowing private-channel creation
    Teams channel policies do not provision Exchange Online mailboxes.
The trap
Confuses mail routing with mailbox provisioning. Confuses Teams policy configuration with Exchange licensing. Confuses collaboration permissions with recipient provisioning.

Verify that the Exchange plan is enabled and provisioned.

4. Configure site membership and permissions so only: Which action best meets the stated requirement?

Hard
A product-planning site contains sensitive plans. Everyone in the project must access the site, but users outside the project must not access any site content. The administrator is deciding between site-level controls and content-level controls. Which action best meets the stated requirement?
  1. Set permissions separately on each document folder containing product plans.
    Folder permissions can protect selected content but may leave other site content accessible.
  2. Apply a sensitivity label to the site and assume every file is automatically labeled.
    A site label does not automatically label every file or establish complete site membership control.
  3. Create a document library and use unique permissions for its product-plan files.
    Library permissions restrict that library, but they do not secure unrelated content across the site.
  4. Configure site membership and permissions so only the project group can access the site. ✓
    Site-level permissions establish the required access boundary for all content within the product-planning site.
The trap
Uses a content scope when the requirement is site-wide. Confuses labeling with comprehensive access control. Protects selected folders rather than the entire site boundary.

Use site membership and permissions for the complete site boundary; use labels for information protection.

5. Add the user to the site Members group: Which change is appropriate?

Easy
A SharePoint report shows that a sales user can read a team site but cannot edit documents. The user should edit existing documents without receiving full site administration. Which change is appropriate?
  1. Make the user a site collection administrator.
    Site collection administration grants substantially broader authority than ordinary document editing requires.
  2. Assign the user a Microsoft 365 product license only.
    Licensing enables entitled services but does not automatically grant access to this site’s documents.
  3. Move the user into the site Visitors group.
    Visitors commonly receive read access, which does not solve the editing requirement.
  4. Add the user to the site Members group. ✓
    The Members group commonly provides edit access without granting the broader control associated with Owners.
The trap
Grants excessive administrative authority for routine editing. Preserves read-only access instead of enabling editing. Confuses service entitlement with SharePoint permissions.

Add the user to the appropriate Members group rather than granting site administration.

6. Assign a Teams policy that restricts private-channel: Which least-privilege action should the administrator ta

Easy
Exhibit: In the Teams admin center, the Field Agents team is correctly owned and members already belong to the right groups. A review finds that members can create private channels, but policy requires only designated users to create them. Which least-privilege action should the administrator take?
  1. Assign a Teams policy that restricts private-channel creation. ✓
    A Teams policy governs this channel behavior without changing ownership or membership.
  2. Change the SharePoint site permissions for the team’s files.
    SharePoint permissions govern files and do not control Teams private-channel creation.
  3. Add every member to a second team with broader channel settings.
    A second team adds unnecessary access and does not correct the original team’s policy.
  4. Remove the team owner and recreate the Field Agents team.
    Recreating the team is disruptive and does not directly configure the channel-creation policy.
The trap
Targets the connected site rather than Teams behavior. Expands collaboration scope instead of restricting the behavior. Changes the team object instead of its applicable policy.

Use a Teams policy because channel-creation behavior is controlled separately from team ownership and membership.

7. Use least privilege for requested access: Which TWO principles directly reject that proposal?

Easy
A branch administrator proposes trusting every sign-in from the corporate network. The organization is adopting Zero Trust. Which TWO principles directly reject that proposal? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Grant broad access after one successful sign-in.
    A successful authentication does not justify unrestricted authorization for later actions.
  2. Treat network location as sufficient proof of trust.
    Zero Trust does not consider an internal network location sufficient evidence by itself.
  3. Use least privilege for requested access. ✓
    Access should provide only the permissions necessary for the user, task, and current conditions.
  4. Rely on perimeter controls instead of user context.
    Zero Trust assumes breach and evaluates access continuously rather than relying only on perimeter location.
  5. Verify explicitly before granting access. ✓
    Zero Trust evaluates identity and relevant signals rather than trusting a request solely because of network location.
The trap
Directly contradicts explicit verification. Confuses authentication with continuing authorization. Replaces Zero Trust with perimeter-based trust.

Zero Trust requires explicit verification and least privilege; network location alone is not trusted.

8. Check the user’s or group’s effective edit permission: What should the administrator check next?

Medium
A department user can sign in and open a SharePoint document but receives an authorization error when editing it. Authentication succeeded and the user has the required license. What should the administrator check next?
  1. Check whether the user’s Exchange mailbox is provisioned
    Mailbox provisioning does not grant SharePoint document-editing permission.
  2. Check the user’s or group’s effective edit permission ✓
    The administrator should inspect effective permissions at the applicable document, library, site, or group scope.
  3. Check whether the tenant’s domain is verified for the organization
    Domain verification does not determine whether this user can edit an accessible document.
  4. Check whether the user completed a second authentication factor
    Authentication already succeeded, so the next investigation should concern authorization for editing.
The trap
Rechecks authentication after the scenario confirms it succeeded. Targets unrelated tenant configuration. Confuses Exchange recipient status with SharePoint authorization.

Check the effective SharePoint permission required to edit.

9. Use FIDO2 security keys for passwordless sign-in: Which use case best matches that method?

Easy
Human Resources needs a suitable authentication method for employees accessing sensitive information remotely. The organization supports compatible passwordless security keys. Which use case best matches that method?
  1. Use SSO to authorize every application automatically.
    SSO reduces repeated sign-ins but does not grant universal application access or authorization.
  2. Use a site Visitors group as a second authentication factor.
    Visitors groups provide SharePoint permissions and are not authentication factors.
  3. Use FIDO2 security keys for passwordless sign-in. ✓
    FIDO2 security keys provide a supported passwordless authentication method when configured for the organization.
  4. Use a SharePoint Members group to authenticate employees.
    SharePoint groups authorize site actions but do not authenticate employee identities.
The trap
Confuses authorization groups with authentication methods. Confuses convenient sign-in with universal access. Treats a permission group as an authentication factor.

FIDO2 security keys are suitable passwordless authentication for supported remote-access scenarios.

10. Supported signals: What is the most accurate consequence of this administrative change?

Medium
During a regional office rollout, the organization enables Microsoft Defender XDR integrations for supported identity, endpoint, email, and application workloads. What is the most accurate consequence of this administrative change?
  1. All related threats are automatically prevented before any user impact.
    Correlation improves detection and investigation but does not guarantee prevention of every incident.
  2. Every regional employee receives Global Administrator permissions.
    Enabling threat protection does not assign administrative roles or broaden employee permissions.
  3. The rollout automatically creates a legal retention policy.
    Defender XDR threat protection is not a retention-policy system for organizational records.
  4. Supported signals, alerts, and incidents can be correlated across workloads. ✓
    Defender XDR correlates supported workload signals to improve investigation across related alerts and incidents.
The trap
Confuses security correlation with guaranteed prevention. Confuses threat operations with compliance retention. Confuses service rollout with authorization changes.

Defender XDR correlates supported security signals, alerts, and incidents across connected workloads.

11. Review the Defender XDR incident: Which object should the analyst use?

Hard
Exhibit: Defender XDR receives related identity, endpoint, and email alerts for one suspected compromise. A service-desk analyst needs the administrative object that groups these signals for investigation. Which object should the analyst use?
  1. Create a Microsoft Purview retention policy
    Retention policies govern information lifecycle and do not correlate security signals or manage investigation incidents.
  2. Review the Defender XDR incident ✓
    A Defender XDR incident correlates supported alerts and signals across workloads for coordinated investigation.
  3. Open the individual alert
    An alert represents one detection and may not provide the cross-workload investigation context required here.
  4. Check the threat-intelligence indicator
    Threat intelligence supplies investigative context, but it does not group related organizational detections into one case.
The trap
Indicators provide context, not the incident container. Retention governs data lifecycle, not security correlation. It handles one detection rather than correlated investigation.

Use a Defender XDR incident to investigate correlated signals across supported security workloads.

12. Entra audit logs: Which Entra ID capability should be reviewed?

Easy
During audit preparation, an administrator must determine who changed a directory role assignment and when. Which Entra ID capability should be reviewed?
  1. Sign-in logs
    Sign-in logs show authentication outcomes and access details, rather than administrative role-assignment changes.
  2. Entra audit logs ✓
    Entra audit logs record supported directory changes, including administrative changes to role assignments.
  3. Risky users report
    Risk reports identify risky identities or sign-ins, not the administrator responsible for changing a directory role.
  4. Identity Secure Score
    Identity Secure Score measures posture against recommendations, not the history of a particular directory change.
The trap
Risk reporting is not directory-change auditing. Posture recommendations do not provide event history. Authentication records do not show role modifications.

Use Entra audit logs to investigate who changed a directory role assignment and when.

434 more Identify the core features and objects of Microsoft 365 services questions

The remaining 434 questions in this domain are part of the full Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 bank — 1350 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 readiness — free

Other Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 domains

Part of the Certsqill Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 question bank · Identify the core features and objects of Microsoft 365 services · Every answer, right and wrong, comes with its own explanation.