SaveMyCert
Log in
5 of 5 free questions left today·for 30 a day
AB-900 · Domain 1

Identify the core features and objects of Microsoft 365 services practice questions

Identify the core features and objects of Microsoft 365 services is worth 33% of the AB-900 exam — the 2nd-heaviest of the 3 domains. Licensing and the Microsoft 365, Exchange, SharePoint and Teams admin centers, Zero Trust, authentication and authorization, Defender XDR, Microsoft Entra ID, conditional access, SSO, Identity Secure Score, audit logs, PIM and app registrations. Official weight range 30–35%. 6 fully worked examples are further down this page, answers included.

Exam weight
33%
the 2nd-heaviest of the 3 domains
Questions
70
across 3 topics
Free, no account
5/day
a free account allows 30 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 3 domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Identify the core features and objects of Microsoft 365 services questions, fully explained

Questions from the AB-900 bank mapped to domain 1, with the answer key and the reasoning behind every option. None of them repeat the examples on the main AB-900 practice page.

Question 1Identify the core features and objects of Microsoft 365 services

An admin assigned a Microsoft 365 license to the Employees group. Contractors are added only to a Contractors group, which is itself a member of Employees. Contractors report that they have no license. What should the admin do, with the least ongoing effort?

Choose one.

  • a
    Assign the license to each contractor individually from the Active users page

    This licenses the current contractors, but every new contractor must be licensed by hand, which is more ongoing effort than licensing the group.

  • b
    Assign the same license directly to the Contractors group as a second group assignment Correct

    Group-based licensing reaches only direct members of the licensed group. Licensing the Contractors group itself covers its members, and the license still follows membership automatically.

  • c
    Convert the Contractors group into a Microsoft 365 group and leave it nested in Employees

    The group type isn't the problem. Members of any nested group don't inherit the parent group's license assignment.

  • d
    Make Employees a member of the Contractors group so the license flows into Contractors

    Reversing the nesting doesn't help: Employees holds the license, and nested membership still isn't used by group-based licensing.

The concept

Group-based licensing applies the license only to users who are direct members of the licensed group. Members of a nested group are not licensed through the parent group.

Why that’s the answer

The contractors are members of Employees only through the nested Contractors group, so the Employees assignment never reaches them. Two facts decide the answer: nesting isn't followed, and a license can be assigned to more than one group. Licensing the Contractors group directly fixes the gap and keeps licensing automatic as contractors come and go. Licensing each contractor works too, but it creates per-user work for every new contractor. Changing the group type or reversing the nesting leaves the users in a nested group.

How to reason it out
  1. Spot the nesting: contractors are only indirect members of the licensed group.
  2. Recall that group-based licensing reaches direct members only.
  3. Look for a fix that keeps licensing tied to membership.
  4. Choose a second group assignment on the Contractors group over per-user assignment.

Exam tip: Group-based licensing ignores nested groups: license the group the users are directly in.

AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin Centers — the lesson that teaches this.

Question 2Identify the core features and objects of Microsoft 365 services

All users have Microsoft 365 E3. The legal team must keep everything else in E3 but must not be able to use Microsoft Forms on any device or in the browser. Other departments keep Forms. What should the admin do?

Choose one.

  • a
    Remove the Microsoft 365 E3 license from the legal team

    This removes Forms but also every other E3 service the legal team must keep, such as the mailbox and Teams.

  • b
    Turn off Microsoft Forms in the legal team's E3 license assignment Correct

    Each license is made of service plans, and individual apps and services can be switched off for a user's or group's assignment. That removes Forms for legal only while all other E3 services stay.

  • c
    Block the Forms app for the legal team with a Teams app permission policy

    A Teams app permission policy only controls apps inside Teams. Legal could still open Forms in the browser.

  • d
    Turn off the Microsoft Forms service on the Org settings page for the tenant

    Org settings apply to the whole organization. They can't remove Forms for one department while others keep it.

The concept

A license is a bundle of service plans. Admins can turn individual apps and services on or off when they assign the license to a user or a group.

Why that’s the answer

The requirement has three parts: legal loses Forms everywhere, legal keeps everything else in E3, and other departments keep Forms. Turning off Forms in legal's license assignment meets all three. Removing E3 loses the other services. A Teams app permission policy only covers Teams. Org settings change the service for everyone.

How to reason it out
  1. List the constraints: one service, one department, everywhere.
  2. Recall that service plans inside a license can be switched off per assignment.
  3. Reject removing the whole license and org-wide settings.
  4. Reject the Teams-only control because Forms is also used in the browser.

Exam tip: To remove one app but keep the rest of a license, turn that service off in the license assignment instead of removing the license.

AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin Centers — the lesson that teaches this.

Question 3Identify the core features and objects of Microsoft 365 services

Which user property must be set before an admin can assign a Microsoft 365 license directly to that user?

Choose one.

  • a
    Office location

    Office location is a contact detail shown in the directory. Licensing doesn't depend on it.

  • b
    Usage location Correct

    Some Microsoft services aren't available in every country or region, so a user's usage location must be set before a license can be assigned to them.

  • c
    Department

    Department is an optional profile attribute (useful for dynamic groups). It isn't needed to assign a license.

  • d
    Manager

    Manager is an optional reporting-line attribute. It isn't needed to assign a license.

The concept

Usage location records the country or region where a user consumes Microsoft 365 services; licensing checks it because not every service is offered everywhere.

Why that’s the answer

Before a license can be assigned to a user, the admin must specify the user's usage location. With group-based licensing, users without one inherit the tenant's location. Office location sounds similar but is only a directory contact field; department and manager are optional profile attributes.

How to reason it out
  1. Recall what licensing must know: where the service will be used.
  2. Separate usage location from the similar-sounding office location.
  3. Reject optional profile attributes.

Exam tip: Set usage location before assigning a license; office location is just a contact field.

AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin Centers — the lesson that teaches this.

Question 4Identify the core features and objects of Microsoft 365 services

A company signed up for Microsoft 365 with contoso.onmicrosoft.com. It now owns contoso.com and wants users' email addresses and sign-in names to use it. Where does the admin start?

Choose one.

  • a
    Add contoso.com on the Domains page of the Microsoft 365 admin center Correct

    Custom domains are added and verified on the Domains page under Settings in the Microsoft 365 admin center. After that, users and mailboxes can use the domain.

  • b
    Add contoso.com as an accepted domain on the Mail flow page of the Exchange admin center

    Accepted domains do appear in Exchange, but a domain becomes available to Microsoft 365 by adding and verifying it in the Microsoft 365 admin center first.

  • c
    Rename contoso.onmicrosoft.com to contoso.com on the Org settings page

    The onmicrosoft.com domain isn't renamed to a custom domain. A custom domain is added alongside it.

  • d
    Add contoso.com as a site address on the Active sites page of the SharePoint admin center

    SharePoint site addresses use the tenant's SharePoint domain. Adding sites doesn't make contoso.com available for email or sign-in.

The concept

Custom domain names are managed on the Domains page (Settings > Domains) of the Microsoft 365 admin center.

Why that’s the answer

To use contoso.com for email and sign-in, the admin adds the domain on the Domains page, proves ownership with a DNS record, and then adds the DNS records the services need. The onmicrosoft.com domain stays in the tenant. Exchange accepted domains and SharePoint sites depend on the domain already being added to Microsoft 365.

How to reason it out
  1. Identify the object: a domain name for the whole tenant.
  2. Recall that tenant domains live on the Domains page of the Microsoft 365 admin center.
  3. Reject workload-specific admin centers and renaming the initial domain.

Exam tip: New domain name for the tenant? Settings > Domains in the Microsoft 365 admin center.

AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin Centers — the lesson that teaches this.

Question 5Identify the core features and objects of Microsoft 365 services

While adding fabrikam.com in the Microsoft 365 admin center, the admin is asked to prove the company owns the domain. Which DNS change completes this step?

Choose one.

  • a
    Add the TXT record value that Microsoft 365 generates (MS=ms...) at the DNS host Correct

    Ownership is verified by publishing the unique TXT value Microsoft 365 generates for the tenant. Only someone who controls the domain's DNS can add it.

  • b
    Add an SPF TXT record that lists Microsoft 365 as an allowed sender at the DNS host

    SPF is also a TXT record, but it tells receivers which servers may send mail for the domain. It is set up after verification and doesn't prove ownership.

  • c
    Add an autodiscover CNAME record that points to Microsoft 365 at the DNS host

    The autodiscover CNAME helps Outlook find the mailbox settings. It is one of the service records added after the domain is verified.

  • d
    Add the two DKIM selector CNAME records for the domain at the DNS host

    DKIM CNAME records let Microsoft 365 sign outgoing mail. They are configured later and don't verify domain ownership.

The concept

Domain verification proves the tenant controls the domain; Microsoft 365 provides a unique TXT value to add at the domain's DNS host.

Why that’s the answer

Adding a domain has two stages: verify ownership, then add the records each service needs. Verification uses the unique MS=ms... TXT value generated for the tenant. SPF, autodiscover and DKIM records all belong to the second stage and serve mail delivery, client configuration and message signing.

How to reason it out
  1. Separate proving ownership from configuring services.
  2. Recall that verification uses a tenant-specific TXT value.
  3. Reject SPF even though it is also a TXT record, because it has a different purpose.
  4. Reject autodiscover and DKIM records as service records added later.

Exam tip: Verify a domain with the MS=ms... TXT record; SPF, autodiscover and DKIM come after.

AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin Centers — the lesson that teaches this.

Question 6Identify the core features and objects of Microsoft 365 services

Which page of the Microsoft 365 admin center holds tenant-wide settings such as calendar sharing, the password expiration policy and the organization profile?

Choose one.

  • a
    Domains

    Domains manages the tenant's domain names and their DNS records, not service or security settings.

  • b
    Org settings Correct

    Org settings has Services, Security & privacy and Organization profile tabs, which hold tenant-wide settings such as calendar sharing, password expiration and organization information.

  • c
    Active users

    Active users manages individual user accounts, licenses and roles rather than tenant-wide settings.

  • d
    Service health

    Service health shows incidents and advisories for Microsoft 365 services. It has no settings to change.

The concept

Settings > Org settings in the Microsoft 365 admin center is where tenant-wide configuration for services, security and privacy, and the organization profile lives.

Why that’s the answer

Org settings groups organization-wide configuration on three tabs: Services (for example calendar sharing), Security & privacy (for example the password expiration policy) and Organization profile (for example organization information and release preferences). The other pages manage domains, individual users or service status.

How to reason it out
  1. Notice that every example is a tenant-wide setting.
  2. Recall the three tabs of Org settings.
  3. Reject pages that manage domains, single users or service status.

Exam tip: Tenant-wide service, security and profile settings live in Settings > Org settings.

AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin Centers — the lesson that teaches this.

What AB-900 domain 1 tests, topic by topic

The official exam guide breaks Identify the core features and objects of Microsoft 365 services into 3 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published AB-900 practice questions per topic in Identify the core features and objects of Microsoft 365 services
TopicWhat it coversQuestions
Core Objects of Microsoft 365 ServicesOfficial AB-900 study guide, "Identify the core features and objects of Microsoft 365 services" (skills measured as of October 14, 2026). "Identify the core objects of Microsoft 365 services": Explain how license types assigned to users and groups affect access to Microsoft 365 features; Explore the organization configurations by using the Microsoft 365 admin center (domain names and org settings); Identify the appropriate objects to configure by using the Exchange admin center (mailboxes and distribution groups); Identify the appropriate objects to configure by using the SharePoint admin center (sites, libraries, and folders); Identify the appropriate roles and permissions for sites in SharePoint in Microsoft 365; Identify the appropriate objects to configure by using the Teams admin center (teams, channels, and policies).23
Microsoft 365 Security PrinciplesOfficial AB-900 study guide, "Identify the core features and objects of Microsoft 365 services" (skills measured as of October 14, 2026). "Understand the Microsoft 365 security principles": Explain the core Zero Trust principles; Understand authorization; Understand authentication methods; Understand threat protection and intelligence; Understand features and capabilities of Microsoft Defender XDR.24
Core Security Features of Microsoft 365Official AB-900 study guide, "Identify the core features and objects of Microsoft 365 services" (skills measured as of October 14, 2026). "Identify the core security features of Microsoft 365 services": Understand features and capabilities of Microsoft Entra ID; Understand conditional access policies; Understand the purpose and benefits of SSO; Identify the appropriate security object to use in an organization (users and groups); Identify the appropriate tools to troubleshoot common sign-in issues (multifactor authentication [MFA], conditional access, and risky sign-ins); Interpret Identity Secure Score in Microsoft Entra ID; Use the appropriate tools to review audit logs for user and admin activity; Identify the role of Privileged Identity Management (PIM) in an organization; Understand App registrations and Enterprise applications.23
Total70

Revise Identify the core features and objects of Microsoft 365 services before you drill it

AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin CentersExpect short admin scenarios that describe a requirement and ask which object, page, admin center, permission or policy meets it. Many questions turn on a stated constraint — no extra license, least ongoing effort, read-only, without guest accounts, only one department affected — so read for the constraint as well as the feature. Know the near-twins well: user vs shared mailbox, room vs equipment mailbox, Full Access vs Send As vs Send on Behalf, distribution vs dynamic distribution vs mail-enabled security vs Microsoft 365 group, communication vs team site, Edit vs Contribute, private vs shared channel, archive vs delete, and direct vs group policy assignment. Harder items combine two rules from different parts of the topic, so knowing how assignments are inherited and which one takes precedence matters as much as knowing the feature names. A few items ask you to select two answers.AB-900 Microsoft 365 Security Principles: Zero Trust, Authentication, Authorization and Defender XDRQuestions in this topic are short scenarios. Zero Trust items describe one or more controls and ask which principle each applies, so you need to tell checking a request, sizing access and containing an intruder apart. Authorization items contrast authentication with authorization and ask for the least-privileged built-in admin role that still covers a stated task. Authentication items test the factor categories behind MFA, the difference between MFA and phishing-resistant MFA (including relay phishing), and when a Temporary Access Pass fits. Threat items ask where to find Microsoft threat research, how global threat intelligence protects an organization, which Defender product covers a given workload, and which Defender XDR capability (incidents, cross-product response, attack disruption, AIR or advanced hunting) fits a described situation, sometimes as select-two items.AB-900 Microsoft Entra ID Security Features: Conditional Access, SSO, PIM, Secure Score and LogsQuestions in this topic are short admin scenarios that ask which Entra ID feature, object, setting or log fits a stated need, often decided by a constraint such as no extra licences, without blocking anyone yet, before the sign-in happens, with no manual changes, or with no help-desk call. Expect to tell security defaults from Conditional Access, grant controls from session controls and conditions, report-only mode from the What If tool, and App registrations from Enterprise applications (including for a multitenant app from another company). Users-and-groups items ask for the right group type or user type. Troubleshooting items give a sign-in symptom and ask which log or fix applies, including lost MFA devices, legacy authentication and user risk versus sign-in risk. Others ask what an Identity Secure Score value or status means, which log still holds an older event, and how PIM assignments deliver approval-based, time-limited admin access. A few are select-two items.

Other AB-900 domains

Domain 2: Understand data protection and governance tasks for Microsoft 365 and Copilot38% of the exam · 82 questionsDomain 3: Perform basic administrative tasks for Copilot and agents29% of the exam · 62 questionsAll AB-900 practice questionsMixed sessions across all 3 domains — the way the real exam interleaves them.

Identify the core features and objects of Microsoft 365 services: your questions

Identify the core features and objects of Microsoft 365 services is domain 1 of the AB-900 exam guide and carries 33% of the scored content — the 2nd-heaviest of the 3 domains. On a 45-question paper that works out to roughly 15 questions, though Microsoft Azure does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official AB-900 exam guide.