AB-900 sample questions — 25 answered and explained

Exchange Online has different recipient types: user mailboxes (licensed), shared mailboxes (one inbox for many people, no license of its own within its storage limit), resource mailboxes and groups.

The team needs one inbox that several people work in and that sends from its own address, without another license. A shared mailbox does exactly that. Distribution groups only copy messages into each member's own mailbox. A licensed user mailbox could be shared, but it breaks the no-new-license constraint.

1. Identify the need: one common inbox that several people use.
2. Recall that shared mailboxes don't need a license within their storage limit.
3. Reject groups that only copy mail to members.
4. Reject the option that needs another license.

Exam tip: One inbox for a team, sending from the team address: shared mailbox.

Resource mailboxes are mailboxes for things that are booked: room mailboxes for locations and equipment mailboxes for movable items.

A bookable meeting room is a room mailbox. Its calendar shows when it is busy and it can auto-accept invitations. An equipment mailbox works the same way but is meant for portable items, not rooms. Shared mailboxes and distribution groups are for people and mail, not booking.

1. Identify the object: a fixed physical place that people book, not a portable item.
2. Recall the two resource mailbox types.
3. Choose room for locations and equipment for portable items.

Exam tip: Rooms get room mailboxes; projectors and cars get equipment mailboxes.

Shared mailbox access is granted with mailbox permissions: Full Access to open and read, and Send As or Send on Behalf to send.

Two separate needs: opening the mailbox (Full Access) and sending as its address alone (Send As). Send on Behalf is the tempting near-twin, but recipients see 'person on behalf of billing'. Group ownership and the Mailbox Import Export role aren't mailbox permissions for daily use.

1. Split the requirement into opening the mailbox and sending from it.
2. Map opening to Full Access.
3. Compare Send As with Send on Behalf: only Send As hides the person.
4. Reject group and admin-role options.

Exam tip: Full Access to read, Send As to appear as the mailbox, Send on Behalf to appear as 'you on behalf of'.

Group types differ in what they can do: distribution groups deliver mail only, security groups grant access, mail-enabled security groups do both, and Microsoft 365 groups combine mail with a collaboration workspace.

The group must both receive email and be usable as a permission principal in SharePoint. Mail-enabled security groups and Microsoft 365 groups do both. Distribution and dynamic distribution groups are mail-only, and a shared mailbox isn't a group of people at all.

1. List the two needs: an email address and the ability to grant permissions.
2. Recall which group types are security-enabled.
3. Reject mail-only distribution groups.
4. Reject the shared mailbox because it isn't a group.

Exam tip: Mail only: distribution group. Permissions too: mail-enabled security group or Microsoft 365 group.

Dynamic distribution groups calculate their membership from recipient attributes such as Department; Exchange Online refreshes the calculated list at least once every 24 hours.

Two requirements decide this: attribute-driven membership with no manual edits, and email delivery only. A dynamic distribution group filters recipients by attributes such as Department, and Exchange Online recalculates the list automatically (at least every 24 hours), so a department change is picked up without anyone touching the group. A Microsoft 365 group with a dynamic membership rule also follows the attribute, but it brings a shared mailbox, calendar, files and possibly a Teams workspace. Static distribution groups and shared mailboxes depend on someone adding or removing people.

1. Spot the two needs: membership driven by an attribute, and email delivery only.
2. Recall that dynamic distribution groups filter on recipient attributes and deliver email only.
3. Reject the dynamic Microsoft 365 group: it adds collaboration workloads HR doesn't want.
4. Reject objects whose membership is maintained by hand.

Exam tip: Membership from attributes, not from a list? Use a dynamic distribution group.

SharePoint has team sites for collaboration and communication sites for broadcasting to a wide audience.

Few authors and many readers is the communication site pattern. Its permissions use the SharePoint Owners, Members and Visitors groups, so most employees can go in Visitors. Team sites, whether or not they are group-connected, are for people working together, and channel sites belong to a Teams channel.

1. Identify the audience: whole company, mostly readers.
2. Recall that communication sites are built for broadcasting.
3. Reject collaboration-focused team and channel sites.

Exam tip: Broadcast to many: communication site. Collaborate as a team: team site.

In the SharePoint admin center, Deleted sites lists deleted sites during the retention period and lets admins restore them.

A whole site was deleted recently, so the admin restores it from Deleted sites in the SharePoint admin center. Restoring a group would help only for a group-connected team site, which a communication site isn't. Site recycle bins handle items inside a site that still exists. Content search can export files but doesn't restore the site.

1. Identify what was deleted: an entire site, not files in it.
2. Recall where deleted sites are restored: SharePoint admin center > Deleted sites.
3. Rule out the group restore because communication sites have no group.
4. Rule out recycle bins and search exports.

Exam tip: A deleted site comes back from Deleted sites in the SharePoint admin center; a recycle bin restores items inside a site.

SharePoint sites have three default groups: Owners (Full Control), Members (Edit) and Visitors (Read).

Visitors get Read: they can view pages, items and documents and download them. Contribute (edit items only) and Edit (edit items and manage lists and libraries) allow changes, and Full Control adds site administration.

1. Recall the default group-to-level mapping.
2. Map Visitors to Read.
3. Reject levels that allow changes.

Exam tip: Owners = Full Control, Members = Edit, Visitors = Read.

Communication Compliance detects inappropriate or sensitive content in messages (Teams, Exchange, Viva Engage, Copilot interactions) and supports a reviewer workflow.

The requirement is about message content (harassment, threats) and a review workflow. Communication Compliance is built for that. Insider Risk Management is the tempting near-twin, but it focuses on user activities such as downloads and exfiltration, not on the tone of messages. DLP looks for sensitive data, and eDiscovery supports legal searches.

1. Identify what is inspected: the content of messages.
2. Separate message content (Communication Compliance) from user activity (Insider Risk Management).
3. Choose Communication Compliance.

Exam tip: Offensive or non-compliant messages to reviewers: Communication Compliance.

Data Security Posture Management (DSPM) for AI is the Purview starting point for securing AI use: reports, recommendations and one-click policies.

The requirement lists three things: AI interaction visibility, sensitive data in those interactions, and ready-made policies. DSPM for AI delivers all three, creating DLP, Insider Risk Management, Communication Compliance and collection policies from its recommendations. The other tools each cover one adjacent job.

1. List the needs: AI usage visibility, sensitive data, ready-made policies.
2. Recall that DSPM for AI offers reports and one-click policies.
3. Reject tools that cover only compliance scoring, app discovery or case searches.

Exam tip: Securing AI use in Purview starts in DSPM for AI.

Data Lifecycle Management governs how long content is kept, using retention policies and retention labels with retain and delete actions.

Keeping content for a fixed period and then deleting it is a retain-then-delete retention setting, which belongs to Data Lifecycle Management. An eDiscovery hold also preserves content, but indefinitely and only for a case, with no automatic deletion.

1. Identify the need: keep for a period, then delete.
2. Recall that retention settings live in Data Lifecycle Management.
3. Reject holds that preserve but never delete.

Exam tip: Keep for X years, then delete: retention in Data Lifecycle Management.

Retention policies apply at the location level; retention labels apply to individual items and can mark them as records.

The contracts share libraries with content that needs a different period, so a location-wide setting can't single them out. A retention label is applied item by item and can declare the item a record, which locks editing. A second retention policy would cover every item in those sites, and sensitivity labels or holds don't provide item-level retention with record status.

1. Notice the contracts live alongside other content.
2. Recall that retention policies apply to whole locations.
3. Recall that retention labels are per item and can declare records.
4. Choose a record retention label for the contracts.

Exam tip: Different retention for some items in a location, or records: retention labels, not policies.

The principles of retention decide conflicts: retention wins over deletion, then the longest retention period wins. Retained SharePoint and OneDrive content is kept in the Preservation Hold library.

Two facts combine here. First, the delete-only policy can't remove an item another policy still needs to retain, and the longest retention period (five years) wins. Second, when a user deletes a retained SharePoint item, a copy is kept in the site's Preservation Hold library rather than the recycle bin. After five years the retain-then-delete policy permanently deletes it. Recycle bins aren't where retained copies are kept, and the two-year deletion never overrides the five-year retention.

1. Apply the first principle: retention wins over deletion.
2. Apply the second: the longest retention period wins (five years).
3. Recall where SharePoint keeps retained copies: the Preservation Hold library.
4. Combine: kept there until year five, then deleted.

Exam tip: Retention beats deletion and the longest period wins; SharePoint keeps the copy in the Preservation Hold library.

Copilot works in the security context of the signed-in user and only surfaces organizational data that user has at least view permission to.

With the same question and the same settings, the difference comes from what each user can access. Copilot retrieves content through Microsoft Graph as the user, so permission trimming applies: the spreadsheet is available to the first employee and invisible to the second. Copilot isn't limited to files a user has opened before, web search only adds public results, and retention labels control how long items are kept rather than who can see them.

1. Note that only the users differ.
2. Recall that Copilot uses each user's own permissions.
3. Conclude that access to the spreadsheet differs.

Exam tip: Copilot sees what the user can see, no more.

Copilot grounds prompts in organizational data retrieved through Microsoft Graph (emails, files, chats, meetings, calendar) at the time of the prompt, as the signed-in user.

Copilot doesn't know your emails in advance. When the prompt arrives, it searches Microsoft Graph for relevant content the user can access, adds it to the prompt sent to the language model, and returns a response with citations. Training data, public web search and admin permissions aren't how it reaches a user's mailbox.

1. Identify the data: the user's own mailbox.
2. Recall that Copilot retrieves organizational data through Microsoft Graph at prompt time.
3. Recall that it acts with the user's permissions only.

Exam tip: Copilot is grounded in Microsoft Graph, as the user, at prompt time.

Copilot's data commitments: organizational data grounds responses but isn't used for training, and interactions are stored like other Microsoft 365 content.

Prompts and responses form the user's Copilot activity history. They are stored in Microsoft 365 (a hidden mailbox folder), encrypted, and available to Content search, eDiscovery and retention policies. Microsoft states that prompts, responses and Graph data aren't used to train foundation LLMs, and that Copilot opted out of human-review abuse monitoring. The distractors describe session-only storage, tenant fine-tuning and human review, none of which apply.

1. Recall where interactions are stored: in Microsoft 365, searchable by compliance tools.
2. Recall the training commitment for prompts, responses and Graph data.
3. Reject storage, fine-tuning and review claims that contradict those commitments.

Exam tip: Copilot data isn't used to train models, and its interactions are stored and searchable like other Microsoft 365 content.

Microsoft 365 Copilot connectors (formerly Microsoft Graph connectors) index external content into Microsoft Graph along with its access control lists, so Copilot can use it with permission trimming.

Several options would let Copilot see the tickets, but the constraint is per-user visibility. A Copilot connector (the feature Microsoft previously called a Graph connector) ingests each item with its ACL, so Graph-based permission trimming applies. Copying the tickets into SharePoint or into an agent's knowledge flattens the permissions to whoever can reach that copy, and web search can't reach a private system.

1. List the ways Copilot could reach the tickets.
2. Apply the constraint: each user sees only tickets they're allowed to see.
3. Reject options that copy data into a location with broader access.
4. Choose a Copilot connector that keeps the access lists.

Exam tip: External data in Copilot with its permissions intact: a Microsoft 365 Copilot connector (formerly Graph connector) with ACLs.

Copilot honors encryption usage rights: it needs the EXTRACT (copy) usage right to show text from encrypted content.

The VIEW usage right lets the user open the file, but EXTRACT is what allows copying content, and it's the right Copilot checks before returning text. Without it, Copilot won't summarize the item but can still cite it with a link so the user can open and read it themselves.

1. Note the usage rights: VIEW without EXTRACT.
2. Recall that Copilot needs EXTRACT to return text from encrypted items.
3. Recall that it can still link to the item.

Exam tip: No EXTRACT, no summary: Copilot can only link to the item.

Copilot settings in the Microsoft 365 admin center (Copilot > Settings) include Copilot actions such as Copilot image generation and Screen and camera sharing.

Copilot image generation is the setting that lets users ask Copilot to create, design and edit images. Disabling it stops new images being generated; PowerPoint can still offer stock or brand images. The other settings are real but control vision, preview access and transcription vocabulary.

1. Translate the requirement: stop Copilot creating images.
2. Find the setting that governs image creation.
3. Rule out vision, preview and dictionary settings.
4. Turn off Copilot image generation.

Exam tip: Stop Copilot making pictures: turn off Copilot image generation.

Vision in Microsoft Copilot (screen and camera sharing) is on by default and can be turned off in Copilot > Settings > Copilot actions.

Vision is on by default, so the admin must act to stop it. Turning off Screen and camera sharing disables vision. Unpinning the app only hides it, and image generation and web search are independent controls that leave vision untouched.

1. Identify the capability: Copilot seeing the screen or camera.
2. Recall its default state: on.
3. Find the setting that controls it.
4. Turn off Screen and camera sharing.

Exam tip: Vision is on by default; turn off Screen and camera sharing to stop it.

Copilot Frontier (Copilot > Settings > User access) controls access to experimental and preview features; the default is No access, and admins can choose All groups of users or Specific user groups.

The pilot must get experimental features and everyone else must not, so the setting must be Copilot Frontier scoped to specific groups. Targeted release and the Insider Beta Channel are tempting because they also mean getting things early, but one previews Microsoft 365 service updates and the other previews desktop app builds; neither is the Copilot Frontier control for the Copilot app and web apps.

1. Identify the feature class: experimental Copilot features.
2. Recall the setting that governs them: Copilot Frontier.
3. Apply the scope constraint: only the pilot group.
4. Choose Specific user groups.

Exam tip: Experimental Copilot features for a pilot: Copilot Frontier scoped to specific groups.

Microsoft Copilot self-service purchases has three values: Allow, Allow trials only and Do not allow.

Leadership wants trials without purchases. Allow trials only gives exactly that, and the trial doesn’t automatically convert to a paid subscription when it ends. Allow permits buying, and Do not allow also removes the trial.

1. Note the two requirements: trials yes, purchases no.
2. Recall the three setting values.
3. Match the value that allows trying but not buying.
4. Choose Allow trials only.

Exam tip: Try but don’t buy: self-service purchases set to Allow trials only.

Web grounding for Microsoft 365 Copilot and Copilot Chat is controlled by the Allow web search in Copilot policy, created as a cloud policy in the Microsoft 365 Apps admin center.

The Microsoft 365 admin center lists "Web search for Microsoft Copilot and Microsoft Copilot Chat" under Data access, but it is a shortcut: you don’t configure it there. The admin creates a Cloud Policy service policy and disables Allow web search in Copilot, which applies across Copilot Chat experiences for all licenses. Conditional Access and Edge policies are real tools but don’t switch off web grounding.

1. Identify the requirement: no public web grounding.
2. Recall the policy name: Allow web search in Copilot.
3. Recall where it is configured: the Microsoft 365 Apps admin center cloud policy.
4. Reject shortcut pages and unrelated policies.

Exam tip: Web grounding off = Allow web search in Copilot disabled in a cloud policy.

Researcher honours the tenant-level web search setting; it is the only admin control over Researcher’s web content.

With Allow web search in Copilot disabled, Researcher doesn’t use web data. It still works and can draw on work content the user can access, such as files, emails, meetings and chats. Microsoft notes there is no granular site-level control: the global web search setting is the only lever.

1. Note the tenant setting: web search disabled.
2. Recall that Researcher follows that setting.
3. Recall that web search isn’t required for Researcher to run.
4. Conclude: work data only.

Exam tip: Web search off means Researcher works from work data only.

The Copilot setting in a Teams meeting policy has four values: On, On with saved transcript required (the default), On with transcript saved by default, and Off. Each sets the organizer's default Copilot meeting option, and only On with saved transcript required enforces it.

Copilot after a meeting relies on the saved transcript, which the During and after the meeting option provides. Only during the meeting uses temporary speech-to-text data, so Copilot can't be used once the meeting ends. On sets Only during the meeting as the organizer's default and lets organizers change it. Both transcript values default to During and after the meeting, and On with saved transcript required also locks the option. Off starts every meeting without Copilot.

1. Translate 'during but not after' into the meeting option Only during the meeting.
2. Note that organizers must be able to change it, so the value can't be enforced.
3. Map each policy value to the organizer default it creates.
4. Pick On.

Exam tip: Meeting policy On = Copilot only during the meeting by default; organizers can change it.