Home › Certifications › AB-900 Certification Guide
Microsoft Certification Guide · 2026AB-900 Certification Guide 2026: Microsoft 365 Copilot and Agent Administration Fundamentals
Everything about the AB-900 exam — all three domains and weightings, why the biggest domain is governance rather than Copilot, the oversharing problem it exists to solve, what the credential is worth for an IT career, and a 6-week roadmap. No coding required.
Training & Technology Partners
Microsoft
AB-900 — Copilot and Agent Administration Fundamentals
The credential this guide covers
Claude
Claude Certified Architect – Foundations (CCAR-F)
Paired with AB-900 in our programme — read the CCAR-F guideAB-900 (Microsoft 365 Copilot and Agent Administration Fundamentals) is the credential for the people who roll out Copilot rather than build with it. It is a Fundamentals-tier exam, you pass at 700 out of 1000, and it covers three domains. No coding. But here is what surprises people: the largest domain is not Copilot administration — it is data protection and governance, at 35–40%.
That weighting is the most useful thing on this page. AB-900 is really a Microsoft Purview and governance exam wearing a Copilot badge — and there is a very good reason for that, which the exam blueprint states almost explicitly through an entire sub-domain devoted to oversharing in SharePoint.
AB-900 exam at a glance
| Attribute | Detail |
|---|---|
| Exam code | AB-900 — Microsoft 365 Copilot and Agent Administration Fundamentals |
| Certification earned | Microsoft 365 Certified: Copilot and Agent Administration Fundamentals |
| Level | Fundamentals — the entry tier, below Associate |
| Passing score | 700 out of 1000 |
| Format | Reported at 40–60 questions in 45 minutes — the Fundamentals format is markedly shorter than the 120-minute role-based exams |
| Delivery | Pearson VUE — online proctored or at a test centre |
| Skills measured version | Current as of 22 July 2026 (the blueprint was revised on that date) |
| Coding required | None — this is an administration and governance exam |
| Prerequisites | None enforced — familiarity with M365 admin centres is assumed |
| Renewal | Microsoft’s annual renewal requirement covers associate, expert and specialty certifications. AB-900 is Fundamentals tier, so it sits outside that list — confirm current policy on Microsoft Learn before relying on it |
| Exam price | Varies by country/region of proctoring |
What is the AB-900 certification?
Microsoft’s audience profile asks for familiarity with Microsoft 365 core services, security, identity and access, data protection and governance — plus Copilot and agents. It also names the admin centres you are expected to know: Exchange Online, SharePoint, Teams, Microsoft Entra and Microsoft Purview.
Five admin centres, two of which (Entra and Purview) are identity and compliance tools. That is the shape of this credential: it certifies an administrator, not a builder.
Copilot does not leak data. It surfaces data people already had permission to see — which is why the first serious problem every Copilot rollout hits is oversharing: years of over-permissive SharePoint sites suddenly becoming discoverable through natural-language search. Microsoft built an entire examinable sub-domain around identifying and monitoring it, including data access governance reports and SharePoint Advanced Management restricted access control. If you take one thing from this page, take that.
AB-900 skills measured and weightings
Three domains. Note the ordering — the domain with “Copilot” in the title is the smallest.
AB-900 exam blueprint — share of exam by domain
Official Microsoft weightings, skills measured as of 22 July 2026. Bars show the midpoint of each range.
Source: Microsoft Learn, “Study guide for Exam AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals”, skills measured as of 22 July 2026. Bars use the midpoint of each published range.
Governance plus core M365 services is roughly 70% of the exam at midpoint. Actual Copilot and agent administration — licensing, billing, usage monitoring, prompt management, agent creation and approval — is the smallest domain at 25–30%. Study Purview harder than you study Copilot.
The three domains as flashcards
Data protection and governance
Purview: Information Protection, DLP, Insider Risk Management, Communication Compliance, DSPM for AI, Data Lifecycle Management. Sensitivity labels, data classification, retention. Copilot data security: how Copilot accesses data, how Microsoft Graph influences responses, how permissions protect against risk, responsible AI principles. Risk identification: Compliance Manager, Data Explorer, Activity Explorer, DLP alerts, eDiscovery content search.
35–40% · biggest domainCore M365 features and objects
How licence types assigned to users and groups affect feature access. Objects across the Microsoft 365, Exchange, SharePoint and Teams admin centres. SharePoint roles and permissions. Security: Zero Trust principles, authentication methods, authorisation, Defender XDR, Entra ID, conditional access, SSO, MFA and risky sign-in troubleshooting, Identity Secure Score, audit logs, PIM, app registrations.
30–35% of examCopilot and agent administration
Built-in capabilities of Copilot versus agents. Monthly licence model versus pay-as-you-go, including SharePoint. Which Copilot features can be enabled or disabled. Use cases for Researcher, Analyst and custom agents. Assigning licences, managing PAYG billing policies, monitoring adoption via Copilot Analytics. Managing prompts — saving, sharing, scheduling, deleting. Creating agents, the approval process, and monitoring agent lifecycle.
25–30% · smallest domainThe oversharing sub-domain
Sitting inside the governance domain is a section on identifying and monitoring oversharing in SharePoint: the tools to troubleshoot it, running a data access governance report, and SharePoint Advanced Management including restricted access control. This is the single most job-relevant thing on the exam, because it is the problem every real Copilot deployment actually hits.
Inside domain 1DSPM for AI — the newest piece
Data Security Posture Management for AI appears by name in the blueprint: discovering and managing AI activity across the tenant. It is one of the newest Purview capabilities and one of the least widely understood, which makes it both a likely exam target and a genuinely scarce workplace skill.
Inside domain 1What is NOT on this exam
No code, no API, no prompt engineering at a technical level, no model or agent architecture. If you want to build agents rather than govern them, that is AI-103 on the Microsoft side or the Claude Developer credential on the Anthropic side.
Scope noteWho AB-900 is actually for
- Microsoft 365 administrators being handed a Copilot rollout and expected to make it safe.
- IT managers and service owners who need to answer “is our data safe with this turned on?” with evidence rather than reassurance.
- Security, compliance and governance staff whose remit just expanded to cover AI activity across the tenant.
- Non-technical professionals moving into AI operations — this is the only credential in our catalogue that requires no coding at all on the Microsoft side.
Where it will not carry you
- It is a Fundamentals credential. It signals informed competence, not deep expertise, and it will not on its own move an engineering salary band.
- It will not teach you to build. Creating an agent is on the blueprint, but at the level of using the admin experience, not writing tool schemas.
- Purview depth is assumed to be broad, not deep. You will recognise capabilities and use cases; you will not become a Purview implementation specialist from this alone.
What AB-900 is worth, honestly
We will be straight with you. AB-900 is a Fundamentals credential and it does not carry a salary premium of its own. Its value is different, and in one respect unusually strong: it certifies the exact skill that is currently blocking Copilot rollouts inside large organisations.
Where the value actually sits
Role security
Internal mobility
Scarce skill
Entry cost
Microsoft 365 administrator pay by market
India and the US shown as two separate charts, because rupee and dollar bands are different measures on different scales. These are role bands for M365 and IT administration, not certificate outcomes.
India — annual CTC
Microsoft 365 / IT administration roles, ₹ lakh per annum
Bar length maps the upper bound of each band against a ₹38 L scale. Bands drawn from published Indian IT administration and Microsoft 365 administrator ranges. Governance and AI-adoption responsibility positions you at the upper end of a band rather than creating a separate one.
United States — annual base
M365 administration and IT governance roles, US$ thousands
Bar length maps each figure against a $160K scale. Bands drawn from published US IT administration and Microsoft 365 administrator ranges; treated as role context rather than a certificate outcome.
These bands sit below the engineering bands on our AI-103 and AI-300 pages, and that is honest rather than accidental — administration and engineering are paid differently. If a bigger salary move is the goal, AB-900 is a sensible first credential, not a final one.
Compensation figures are compiled from independent, publicly available industry sources and are shown for role context. They are not a guarantee of pay in any specific market, company or outcome, and 360DT does not promise a salary result from any certification or programme.
Why this certification exists at all
1. Oversharing is the real Copilot blocker
Enterprises did not stall Copilot rollouts because the technology underperformed. They stalled them because the moment natural-language search sits over a decade of loosely-permissioned SharePoint, employees start finding things they were technically allowed to see but were never meant to find. Microsoft made that an examinable sub-domain, complete with data access governance reports and restricted access control.
2. Governance moved from a policy document to an admin console
Sensitivity labels, DLP, Insider Risk, Communication Compliance and DSPM for AI are all named in the blueprint. These are operational tools with buttons, not principles in a PDF. The exam reflects that AI governance is now something you configure rather than something you write down.
3. Somebody has to own the licence and billing model
Copilot’s monthly licence versus pay-as-you-go split, including for SharePoint, is explicitly on the exam. So is monitoring PAYG billing policies and tracking adoption through Copilot Analytics. Once AI spend became a real line item, somebody had to be accountable for it — and that person is the audience for this credential.
Your 6-week AB-900 roadmap
Weighted to the real blueprint, which means Purview and governance get the most time — not Copilot. Assume 5–7 hours per week; this is a Fundamentals exam and does not need a twelve-week plan.
The admin centres and core objects
Get hands-on in all five: Microsoft 365, Exchange, SharePoint, Teams and Entra. Licence types and how assignment to users versus groups changes feature access. Mailboxes and distribution groups. Sites, libraries, folders and SharePoint permissions. Teams, channels and policies.
Identity and security fundamentals
Zero Trust principles. Authentication versus authorisation. Entra ID capabilities, conditional access, SSO. Troubleshooting MFA, conditional access and risky sign-ins. Identity Secure Score. Audit logs for user and admin activity. PIM. App registrations versus enterprise apps. Defender XDR. Completes the 30–35% domain.
Microsoft Purview, part one
Information Protection, DLP, Insider Risk Management, Communication Compliance, Data Lifecycle Management, and DSPM for AI. Sensitivity labels and their use cases. Data classification. Retention. Spend real time in the portal — this domain is recognition-heavy and reading will not stick.
Copilot data security and oversharing
How Copilot accesses data and how Microsoft Graph shapes its responses. How M365, Purview and Defender controls protect against risk. Responsible AI principles. Then the oversharing block: troubleshooting tools, data access governance reports in SharePoint, and SharePoint Advanced Management restricted access control. The most job-relevant week.
Risk identification tooling
Compliance Manager for risks and recommendations. Data Explorer for sensitive information. Insider Risk Management. Responding to DLP alerts. Communication Compliance policy violations. Activity Explorer. Discovering AI activity with DSPM for AI. Content search in Purview eDiscovery. Completes the 35–40% domain.
Copilot and agent administration, then the exam
Copilot versus agent capabilities. Monthly licence versus pay-as-you-go, including SharePoint. Which features can be toggled. Researcher, Analyst and custom agent use cases. Licence assignment, PAYG billing policies, Copilot Analytics adoption tracking, prompt management. Creating agents, approval workflow, and lifecycle monitoring across the M365 and Power Platform admin centres. Then mocks and book.
Microsoft recommends registering with a personal MSA account. If you register with an organisational work or school account and later leave that organisation, your exam records are unrecoverable — which matters more than usual for a credential most people earn while employed by the tenant they administer.
Learn from Microsoft Certified Trainers
Certification prep at 360DT is delivered live by Microsoft Certified Trainers, Instructor at 360DT, an Anthropic Partners and a Microsoft Business Applications MVP — our full international faculty.
Naga Nandhini
Java Full Stack Corporate Trainer and Enterprise Solutions Expert
Powerhouse corporate trainer with 10+ years of upskilling engineers at HCL, Accenture, Cybage, Mobileum and Renault. An award-winning engineer who helped build the RAPTOR and KIKO platforms for an American Airlines client, she brings real enterprise delivery into every session.
Praveen Kumar
Full Stack and GenAI Corporate Trainer, Ex-TCS Team Lead
Full stack lead and GenAI builder with 10+ years of training behind 50+ corporate batches for TCS, HCL, Perficient, Renault Nissan and Saint-Gobain. He ships real RAG and local-LLM systems with Ollama, FastAPI and Spring Boot, then teaches exactly how they work.
Shantanu Pandey
Microsoft, Google, NVIDIA and HPE Certified Trainer
Director of Engineering at Meteoros Automation, ranked in Microsoft's Top 100 Trainers of 2025, holding MCT, Google Cloud, NVIDIA and PeopleCert credentials, with 500+ trainings delivered since 2011.
Sid
Microsoft Certified Trainer since 2016 and Azure Data Engineer
Dynamic corporate trainer and consultant with more than 10 years of experience across Microsoft Fabric, Azure Data Engineering, and modern cloud platforms. Focused on clear, practical learning that sticks.
Bipeen
AWS, Microsoft, and Anthropic Certified Trainer
AI, machine learning, and cloud transformation expert with more than 25 years of experience. A renowned global corporate trainer and conference speaker known for practical, outcome driven sessions.
Arshad Ahmad
Microsoft Certified Trainer (MCT), Cybersecurity & Power Platform Expert
Technology Trainer with 15 years in strategic client delivery, holding MCT, Azure Solutions Architect Expert, Cybersecurity Architect Expert and Power BI Data Analyst credentials, with 200+ trainings delivered.
Johan
Microsoft Business Applications MVP and Microsoft Certified Trainer
D365 Customer Service Lead – Europe at Avanade, and founder of the Power Platform School. A Microsoft Business Applications MVP and Microsoft Certified Trainer based in London, specializing in Dynamics 365 Customer Service and Power Platform.
Akim Nyamande
Microsoft, CompTIA, Juniper and Cisco Certified Trainer
IT training facilitator with over five years of experience and certifications across Microsoft, CompTIA, Juniper, and Cisco. Previously a Network Administrator before moving into technical training, now delivering hands-on courses in networking, systems administration, and cybersecurity fundamentals.
Ali El Khatib
Cisco Certified Systems Instructor (CCSI) and Microsoft Certified Trainer
Infrastructure Engineer at RHUH with 13 years in the training field, holding CCSI, MCSE, CCNP Routing and Switching, CCNP Security, CompTIA and Microsoft Azure certifications.
Vikas Mittal
AI instructor with 25+ years in technology training
Veteran technology trainer with more than 25 years of rich industry experience spanning Google, Microsoft, and emerging AI platforms. An exceptional mentor recognized for proven teaching excellence.
Sravia
NVIDIA Authorized Instructor and AI Data Specialist
Passionate AI and data evangelist with over 10 years of experience across machine learning, MLOps, and cloud native technologies. Dedicated to delivering impactful, engaging enterprise training programs.
Florian Garcia Compte
Cisco Certified Systems Instructor (CCSI)
Partner Director at AVAANZA FORMACION, a Cisco Learning Partner based in Madrid. Certified Cisco Systems Instructor (CCSI No. 21053) specializing in Cisco Data Center (ACI/SDN), Nexus, and Wireless, delivering official Cisco certification courses including CCNA, CCNP Enterprise, and CCNP Data Center.
Copilot & Agent Administrator Program — AB-900
The 360DT Copilot & Agent Administrator Program covers the full AB-900 blueprint — Purview governance, identity and conditional access, oversharing remediation, and Copilot licensing, adoption and agent lifecycle. No coding. You leave with a working agent and a rollout plan you can take to your own tenant.
Explore the AB-900 Program
AB-900 frequently asked questions
Do I need to know how to code for AB-900?
No. AB-900 is an administration and governance exam. Creating an agent is on the blueprint, but at the level of the admin experience rather than writing code, tool schemas or API calls. If you want to build rather than govern, that is AI-103 or the Claude Developer credential.
What is the biggest domain on the AB-900 exam?
Data protection and governance, at 35–40% — larger than the Copilot and agent administration domain, which is the smallest at 25–30%. Combined with core M365 services at 30–35%, roughly 70% of this exam is Microsoft 365 governance and security rather than Copilot itself. Study Purview harder than you study Copilot.
Why is so much of a Copilot exam about SharePoint and Purview?
Because oversharing is the problem Copilot actually creates. Copilot does not leak data; it surfaces data users already had permission to access. Years of over-permissive SharePoint suddenly becomes discoverable through natural language. Microsoft made this an examinable sub-domain covering troubleshooting tools, data access governance reports and SharePoint Advanced Management restricted access control.
What level is AB-900 and does it expire?
It is a Fundamentals-tier certification, the entry level below Associate. Microsoft’s stated annual renewal requirement applies to associate, expert and specialty certifications, so a Fundamentals credential sits outside that list — but confirm the current policy on Microsoft Learn before relying on it, since certification policies do change.
What is DSPM for AI and why is it on the exam?
Data Security Posture Management for AI is a Microsoft Purview capability for discovering and managing AI activity across a tenant — who is using AI tools, with what data. It is named directly in the blueprint. It is also one of the newest and least widely understood Purview features, which makes it both a likely exam target and a genuinely scarce workplace skill.
How long does it take to prepare for AB-900?
Around six weeks at 5–7 hours per week for someone already working in a Microsoft 365 environment — the roadmap on this page. Allow longer if you have never used Microsoft Purview, since that is where the largest domain lives and it is difficult to learn from reading alone.
Will AB-900 increase my salary?
Not on its own — it is a Fundamentals credential and we would be misleading you to claim otherwise. Its value is role security and internal mobility: it certifies the governance skill currently blocking Copilot rollouts, and it puts you in line for AI-governance responsibility as that remit forms. For a larger salary move, treat it as a first credential rather than a final one.
Is AB-900 worth it for a non-technical professional?
Yes, more so than most AI certifications. It requires no coding, it is Fundamentals tier, and the subject matter — permissions, policy, compliance, adoption, licensing — is closer to IT operations and information governance than to software engineering. It is a realistic entry point into AI work for administrators, compliance staff and IT managers.
Sources and further reading
- Microsoft Learn — Study guide for Exam AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals (audience profile, three skills-measured domains and weightings, 700 passing score, skills measured as of 22 July 2026, change log)
- Microsoft Community Hub — announcement of Microsoft 365 Certified: Copilot and Agent Administration Fundamentals
- Published exam-format data reporting 40–60 questions in 45 minutes for the Fundamentals format — confirm current details on Microsoft Learn before booking
- Microsoft Learn certification renewal policy — annual renewal stated for associate, expert and specialty certifications
- Published Indian and US Microsoft 365 administrator and IT administration compensation ranges, used for role context only
360 Digital Transformation is an Anthropic Partner and a Microsoft Authorized Training Partner. Microsoft certification exams are administered by Microsoft through Pearson VUE and are not included in programme tuition. Exam details are accurate as of 20 August 2026; always confirm current format, pricing, renewal policy and skills measured on Microsoft Learn before booking.
Microsoft 365 Copilot
Power BI
Claude for Admins
