AB-900 cheat sheet — every exam topic on one page

Identify the core features and objects of Microsoft 365 services

AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin Centers

• An account with no license can sign in but has no mailbox, Teams or other services; licenses grant services, admin roles grant management rights.
• Individual services inside a license can be turned off per assignment without removing the license; a usage location is required before direct assignment.
• Group-based licensing follows membership automatically, works with security and security-enabled Microsoft 365 groups, and ignores members of nested groups.
• Custom domains are added on the Domains page and verified with a tenant-specific MS=ms TXT record before service records are added; onmicrosoft.com stays.
• Org settings (Services, Security & privacy, Organization profile) changes apply to the whole organization.
• Shared mailboxes need no license within 50 GB; Full Access opens one, Send As sends as it, Send on Behalf shows who sent it.
• Distribution and dynamic distribution groups are mail-only; mail-enabled security and Microsoft 365 groups can also grant permissions.
• SharePoint defaults: Owners Full Control, Members Edit, Visitors Read; Contribute edits items but cannot create or delete libraries.
• Microsoft 365 groups have no read-only role, so readers of a group-connected site go in its Visitors group; break inheritance to restrict one library or folder.
• Shared channels include outside people without guest accounts; archiving makes a team read-only; a direct Teams policy assignment beats any group ranking.

AB-900 Microsoft 365 Security Principles: Zero Trust, Authentication, Authorization and Defender XDR

• Zero Trust: verify explicitly (check every request on every signal), use least privilege access (just-in-time, just-enough), assume breach (limit blast radius, segment, encrypt, detect).
• Authentication proves who you are; authorization decides what you may do. Signed in but denied is an authorization result.
• Assign the narrowest admin role: Global Reader to view without changing, Password Administrator to reset ordinary users' passwords.
• MFA needs factors from two different categories — two things you know is still single-factor.
• Phishing-resistant methods are Windows Hello for Business, passkeys (FIDO2) and certificate-based authentication; SMS, voice, codes and push approvals can be relayed.
• A Temporary Access Pass is a time-limited passcode for onboarding or recovery, so a user can register a passwordless method.
• Threat analytics shows Microsoft research on active threats mapped to your exposure; global threat intelligence blocks threats seen at other customers.
• Defender for Office 365 = email and collaboration (Safe Links at click, Safe Attachments before delivery); Defender for Identity = on-premises AD; Entra ID Protection = risky cloud users and sign-ins.
• Defender XDR correlates alerts into incidents, coordinates response across products, disrupts attacks automatically and supports advanced hunting over 30 days of raw data.

AB-900 Microsoft Entra ID Security Features: Conditional Access, SSO, PIM, Secure Score and Logs

• Security defaults are the free, all-or-nothing baseline (MFA for everyone, legacy authentication blocked); Conditional Access is the flexible alternative and needs Entra ID P1.
• Conditional Access: users, target resources and conditions decide whether a policy applies; grant controls block or require something; session controls limit the session afterwards.
• Report-only mode measures a policy against real sign-ins without enforcing it; the What If tool simulates one hypothetical sign-in.
• SSO means one identity for many apps: fewer passwords for users and one control point for admins — blocking one account cuts off every connected app.
• Security groups grant access and licences; Microsoft 365 groups add collaboration; dynamic membership (P1) keeps membership in step with user attributes; guests are external people using their own accounts.
• Sign-in logs explain failed sign-ins; a lost MFA device is fixed by requiring MFA re-registration; legacy-protocol failures are fixed by moving to modern authentication.
• User risk (leaked credentials) is remediated through a user-risk Conditional Access policy — Require risk remediation (now recommended) or Require password change, both MFA plus a secure password change for password users; sign-in risk is remediated by MFA; a block policy needs an admin to clear the risk.
• Identity Secure Score is the percentage of Microsoft's identity recommendations you have adopted, not a breach probability; only the "resolved" statuses earn points.
• Entra audit logs keep directory changes for 7 days (Free) or 30 days (P1/P2); Purview Audit (Standard) covers all workloads for 180 days.
• App registrations hold the application object in the home tenant; Enterprise applications hold the service principal in each tenant that uses the app. PIM makes admin roles eligible, time-bound and approval-based.

Understand data protection and governance tasks for Microsoft 365 and Copilot

AB-900 Microsoft Purview and Copilot Data Security: Sensitivity Labels, DLP, Retention and Responsible AI

• DLP stops risky sharing in real time; Insider Risk Management correlates user activities (pseudonymized); Communication Compliance reviews message content; DSPM for AI shows AI usage and offers one-click policies; Data Lifecycle Management retains and deletes.
• Sensitivity labels classify and protect: encryption travels with the file, markings add headers, footers and watermarks, and container labels set privacy, guest access and external sharing for teams, groups and sites.
• Client-side labeling (default, mandatory, auto-labeling in Office apps) needs a user working in the file; service-side auto-labeling policies label SharePoint and OneDrive content at rest and email only in transit.
• Sensitive information types match patterns, trainable classifiers recognise kinds of documents, and exact data match checks values against your own table.
• Retention policies cover whole locations; retention labels cover individual items, one at a time, and can declare records. Retention wins over deletion and the longest retention period wins.
• Retained SharePoint and OneDrive files that users delete are kept in the Preservation Hold library; Copilot prompts and responses are kept in a hidden folder of the user's mailbox.
• Copilot grounds prompts in Microsoft Graph as the signed-in user, so it only uses content that user can at least view, and overshared content becomes easier to find.
• Copilot connectors index external content into Graph with its access lists; prompts, responses and Graph data aren't used to train foundation models.
• Copilot needs VIEW and EXTRACT to return text from encrypted content, new content inherits the highest-priority source label, and a DLP policy for the Microsoft 365 Copilot and Copilot Chat location can keep labeled items and sensitive prompts out of Copilot's processing.
• Defender for Cloud Apps discovers generative AI apps and blocks Unsanctioned ones on Defender for Endpoint devices; the six responsible AI principles are fairness, reliability and safety, privacy and security, inclusiveness, transparency and accountability.

AB-900 Data Protection Risks and SharePoint Oversharing: Purview Explorers, Alerts, DSPM for AI and SharePoint Advanced Management

• Compliance Manager tracks regulations: assessments from templates, improvement actions (your organization's share) with owners and evidence, and a compliance score. Secure Score measures security posture instead.
• Data explorer is a snapshot of where classified items are; seeing items needs Data Explorer List viewer (list and locations) or Content viewer (contents).
• Activity explorer is a history of label and DLP events from the unified audit log, about 30 days, not real time; older events need an audit log search.
• Insider Risk Management alerts are confirmed into a case or dismissed, and usernames are pseudonymized by default.
• DLP alerts are best managed in Defender XDR; event details show the matched rule, sensitive info types and any override with its justification. Threshold (aggregated) alerts cut volume.
• Communication Compliance: Notify reminds, Escalate changes reviewer, Escalate for investigation opens an eDiscovery (Premium) case, Remove message in Teams hides the message.
• DSPM for AI needs Purview Audit on; third-party AI sites also need onboarded devices and the browser extension. Its default data risk assessment covers the top 100 SharePoint sites by usage weekly.
• Content search (in Purview eDiscovery) finds and exports content across mailboxes, SharePoint, OneDrive and Teams; eDiscovery Manager is the least-privilege role.
• Find oversharing with data access governance reports (SharePoint admin center > Reports) and DSPM for AI data risk assessments; snapshot reports show current access, activity reports the last 28 days.
• Restricted access control limits who can open a site (membership plus permission); Restricted Content Discovery only hides it from Copilot and org-wide search.

Perform basic administrative tasks for Copilot and agents

AB-900 Copilot and Agent Features: Licensing vs Pay-As-You-Go, Admin Settings, Researcher and Analyst

• An agent is Copilot scoped to a job with its own instructions, knowledge and optional actions; it uses the same models and the asking user's permissions, never the creator's.
• Copilot Chat included with Microsoft 365 is web-grounded; the Microsoft 365 Copilot license adds automatic Microsoft Graph grounding in the user's mail, meetings and files and full Copilot in the apps.
• The license is a fixed monthly per-user charge; pay-as-you-go bills actual usage to an Azure subscription through a billing policy, is off by default and doesn't provide the licensed in-app experience.
• For unlicensed users, instruction and public-web agents are free in Copilot Chat; agents grounded in shared tenant data are metered and need pay-as-you-go or Copilot Studio capacity, however they were built.
• Creating a SharePoint agent needs a Copilot license plus permission to add files; using one needs a license or pay-as-you-go, and billing follows the user.
• Copilot image generation and Screen and camera sharing (on by default) are Copilot actions settings; Copilot Frontier (default No access) controls preview features for all or specific groups; self-service purchases can be Allow, Allow trials only or Do not allow.
• Web grounding is controlled by the Allow web search in Copilot cloud policy in the Microsoft 365 Apps admin center, and Researcher honours it with no per-site list.
• In Teams meeting policy, only On with saved transcript required (the default) is enforced; Off and the other values just set the organizer's default.
• Researcher writes deep, cited reports from work and web sources; Analyst analyzes raw data files with Python and shows its code; both are pre-installed, not customizable, not removable by users, and blockable individually by admins.
• Use a custom agent for repeated, scoped work: SharePoint or Agent Builder for Q&A, Copilot Studio for workflows, approvals and external connectors.

AB-900 Copilot and Agent Administration: Licenses, Pay-As-You-Go Billing, Usage Reports, Prompts and Agent Governance

• Copilot licenses are assigned in the Microsoft 365 admin center (Billing > Licenses or a user's Licenses and apps); group-based assignment makes the license follow group membership.
• License Administrator is the least-privileged role for assigning licenses; Billing Administrator buys and manages billing.
• Guests and cross-tenant users can't hold a Copilot license, Semi-Annual Enterprise Channel doesn't get Copilot, and Copilot can take up to 24 hours to appear after assignment.
• A pay-as-you-go billing policy needs a Billing, AI or Global Administrator plus Owner or Contributor on an Azure subscription and resource group in the same tenant.
• Budgets send alerts at chosen percentages but never stop usage; a policy bills nothing until it is connected to a service such as Copilot Chat or SharePoint agents.
• Pay-as-you-go spend shows on the policy's Budget tab and in Microsoft Cost Management, not in usage reports.
• The Copilot usage report counts enabled vs active users, where active needs an intentional action; names are concealed until the Reports org setting is changed.
• The Copilot Dashboard in Viva Insights gives leaders readiness, adoption, impact and sentiment without admin center access.
• Saved prompts are private, team-shared prompts reach one team, scheduled prompts run only for their owner, and organizational prompts (AI Administrator or Search Editor) reach everyone and are deleted permanently.
• Admins turn scheduled prompts off by disabling connected experiences in Office through Cloud Policy, which also turns off other connected experiences; the change isn't retroactive: schedules already set up run to completion, while users lose the controls to change them.
• Agent User access limits people, Agent and plugin access limits publisher types, and Sharing covers only Agent Builder agents; Requests holds submissions and pending updates, block pauses an agent indefinitely, and delete is restorable for 30 days.