Free AB-900 practice questions

Access to Microsoft 365 services comes from the licenses assigned to a user. Each license contains service plans such as Exchange Online, SharePoint and Teams.

An account without a license can exist and sign in, but no workload is provisioned for it, so there is no mailbox and no Teams access. Assigning a license that contains the Exchange Online and Teams service plans fixes both. Admin roles, distribution groups and SharePoint groups all control something else (admin rights, mail delivery and site access) and assume the user is already licensed.

1. Notice that the account exists but nothing was assigned to it.
2. Recall that mailboxes and Teams access come from service plans in a license.
3. Reject options that grant admin rights, mail delivery or site access.
4. Choose assigning a license with the needed services.

Exam tip: No license, no services: an account only gets a mailbox, Teams and the apps through the service plans in its license.

Sensitivity labels classify an item and can apply protection, such as encryption and content markings, that stays with the item.

The requirement is protection that follows the file after it is downloaded or emailed. Encryption applied by a sensitivity label is embedded in the document, so access is checked whenever anyone tries to open it. DLP acts at the moment of sharing, retention labels govern how long items are kept, and Insider Risk Management only detects and scores risky behaviour.

1. Note that protection must persist outside the original location.
2. Recall that label encryption is stored with the item itself.
3. Reject controls that act only at a location or only detect activity.
4. Choose a sensitivity label that applies encryption.

Exam tip: Protection that travels with the file: sensitivity label with encryption.

Copilot Chat (included with eligible Microsoft 365 subscriptions) is grounded in web data; the Microsoft 365 Copilot license adds broad grounding in work data through Microsoft Graph. Copilot Chat inside Outlook is the exception: it can use the user’s own inbox and calendar without the add-on.

Without the add-on license, Copilot Chat uses organizational content only when the user uploads or pastes it, when it runs inside Outlook (which grounds it in her own inbox and calendar), or through a pay-as-you-go agent. She asked on the web, outside Outlook, so her mailbox isn’t searched. The web search policy, indexing and Restricted Content Discovery are all real controls, but none of them explains an unlicensed user getting no mailbox grounding there.

1. Note that the tenant has no Copilot add-on licenses.
2. Note where she asked: Copilot Chat on the web, not inside Outlook.
3. Recall what Copilot Chat is grounded in there without the license.
4. Check whether any distractor actually applies to Exchange mail, then conclude.

Exam tip: No Copilot license: Copilot Chat answers from the web and what you give it, except inside Outlook, where it can see your own mail.

Group-based licensing assigns licenses to a security group, mail-enabled security group or Microsoft 365 group; membership then decides who holds the license.

When the license is assigned to the Sales group, Microsoft Entra ID applies it to each member and removes it when the member leaves the group. That is exactly the automatic join/leave behaviour required. Assigning licenses user by user also works, but it fails the 'no per-user admin work' requirement. Teams policies and SharePoint groups don't license anything.

1. Identify the requirement: licensing that follows group membership automatically.
2. Recall that licenses can be assigned to groups from the Licenses page.
3. Reject direct assignment because it needs per-user work.
4. Reject Teams policy and SharePoint group options because they don't license users.

Exam tip: Assign licenses to a group when membership should decide who is licensed: join the group, get the license; leave it, lose it.

Sensitivity labels can be configured for containers (Microsoft 365 groups, Teams and SharePoint sites) as well as for files and emails.

A container label applies settings such as public/private privacy and whether guests can be added the moment the user selects it when creating the team. The label on the container does not label the files inside it. Retention policies and labels govern keeping and deleting content, and DLP inspects content for sensitive data.

1. Spot that the settings apply to the team and site, not to files.
2. Recall that sensitivity labels can be scoped to groups and sites.
3. Rule out retention and DLP, which don't set privacy or guest access.
4. Choose sensitivity labels for groups and sites.

Exam tip: Sensitivity labels also protect containers: privacy and guest access for teams, groups and sites.