AB-900: Securing and Administering Copilot and Agents

Exam AB-900 evaluates the fundamentals of administering Microsoft 365 Copilot and agents inside an organization's existing productivity environment. The Microsoft 365 Copilot and Agent Administration Fundamentals credential is intended for people familiar with core Microsoft 365 services, identity, data protection, governance and administrative interfaces. As of October 10, 2026, Microsoft shows the credential as current but has announced an English-language objective update effective October 14, 2026. Candidates should read the outline corresponding to their exam date; a future effective-date section should not be mistaken for the currently applied blueprint.

An AI assistant working across organizational information inherits existing security and information-management decisions. If SharePoint permissions are too broad, the assistant's retrieval may surface data to people who already have excessive access. If users lack the correct licenses, a desired capability may not be enabled. AB-900 is not primarily an exam about writing prompts: it asks whether the administrator understands the surrounding identity, content, collaboration and protection systems well enough to support an AI-enabled tenant responsibly.

Recognize the Microsoft 365 administrative landscape

Microsoft 365 combines directory-backed identities, collaboration workloads and information services. The main admin center helps manage organization settings and licensing; specialized centers manage Exchange mail, SharePoint sites, Teams policies, Microsoft Entra identities and Microsoft Purview compliance capabilities. They do not provide unrelated duplicates of the same setting. A support request about access to a team, a shared mailbox or a Copilot-enabled site should be routed to the service that actually owns the relevant object and policy.

Understand the relationships among users, groups, teams, sites, mailboxes, folders and libraries. A user can belong to several groups, while each service may add its own sharing model or policy requirements. Giving someone a Microsoft 365 license does not automatically grant access to every team or document. Conversely, membership in a group does not guarantee that a premium AI feature is enabled. The administrator needs to trace from user identity through assigned license, group membership, workload permissions and any conditional access restrictions.

Tenant configuration also includes domains, organizational settings and service availability. A request to enable a feature should trigger a check of licensing, prerequisites, organization policy and the affected users' actual permissions. Testing on one privileged administrator account can hide the experience of ordinary staff. Copilot readiness, licenses and governance depends on disciplined inventory and staged testing rather than assuming that purchasing licenses completes deployment.

Protect identities before granting agent capabilities

Authentication proves identity, while authorization controls what the identified user or workload may do. Microsoft Entra supports user and group management, sign-in controls and conditional access mechanisms that can reflect risk, device state and other signals. Multifactor authentication lowers certain credential risks but cannot correct an excessive permission assignment. A tenant that enables strong sign-in verification while leaving sensitive documents visible to everyone has addressed one class of risk, not the whole information boundary.

Agents and connectors may operate under user-delegated or application identities, depending on their design. Those distinctions change the effective permissions of tool calls. An application with broad access to mailboxes can create more exposure than a narrowly delegated read operation. Examine consent, app registrations, group scope and role assignments before allowing an integration to act on organizational resources. Identity and access for Microsoft 365 agents is central because a useful agent should not become an unmonitored superuser.

Least privilege also requires ongoing review. Temporary troubleshooting access can persist indefinitely if no one owns the removal decision. Administrator roles should be assigned to people who need those capabilities, with elevated activities logged and reviewed. A shared service account undermines accountability, especially when a downstream agent takes action through that identity. Documentation should distinguish what a user is entitled to see, what an assistant can retrieve and what a connected tool may modify.

Apply data classification and retention deliberately

Information can be sensitive because of its content, source or business context. Purview capabilities help organizations classify and protect information, implement retention rules and monitor selected compliance events. Sensitivity labels and access-control rules are not interchangeable: a label can express protection requirements, while the effective ability to read content still depends on the relevant enforcement controls and sharing arrangements. Protecting Copilot data with Purview should be understood through concrete scenarios such as a confidential personnel document and an external collaboration site.

Retention decisions affect documents, conversation records and generated material. A policy may require business records to be preserved while other data must be deleted on a schedule; different content locations can have different rules. An AI assistant that produces a summary does not necessarily change the classification of the underlying information. Administrators should identify where source documents, generated answers and audit trails are stored and which policies apply to each. This is especially important when teams copy AI output into channels with broader membership.

Oversharing remediation is often more urgent than feature tuning. Before rolling out organization-wide search or summarization, examine anonymous links, broad groups, public sites and obsolete content. Restricting an assistant at the prompt level is not a durable replacement for repairing access rules at the source. Consider how information changes over time: a document approved for wide sharing last year may now contain sensitive new attachments. Ongoing permission hygiene supports both security and accurate Copilot responses.

Administer Copilot and agents as governed services

Deployment involves licenses, capability availability, application settings and user enablement. Administrators should plan a limited pilot with representative accounts and real permissions, then validate expected behaviors before broader rollout. A test should cover a user who is entitled to a document and another who is not. An effective assistant should respect those boundaries. Also check that disabled integrations remain inaccessible, and that agent owners can identify their permitted data sources and tools.

Administering Microsoft 365 Copilot and agents includes service lifecycle concerns. Who approves creation of an organization-wide agent? Who maintains its instructions and connectors? Who handles a report of inaccurate or risky output? Policies for publishing and discovering agents should be aligned with ordinary change management. Without ownership, a popular internal agent can depend on an employee's unmanaged integration or stale credential.

Monitoring should distinguish platform availability, sign-in or entitlement problems, user training needs and genuine agent quality issues. If an employee cannot use Copilot, first check licenses and access before blaming the model. If a response cites obsolete content, examine source currency and permissions. If an agent repeats a transaction, investigate tool integration and retry behavior rather than only rewriting prompts. Categorizing incidents accurately shortens recovery and prevents teams from treating every AI-related symptom as a model fault.

Handle external integrations and untrusted input safely

Agents may encounter information in email messages, shared documents or web pages. Such content may include malicious instructions attempting to redirect the agent, but it should remain task data rather than trusted configuration. Protect tool permissions, use approved connectors and require confirmation for actions with external effects. A chat instruction telling an agent not to disclose customer records is insufficient if the agent already possesses a broad export capability and no authorization control prevents misuse.

Administrators should understand the distinction between content sharing and credential sharing. A staff member forwarding a permitted summary to a colleague differs from granting an application persistent rights to every mailbox. Review connector consent and the authority under which downstream actions run. Where an integration has unusually broad scope, document the business requirement, compensating controls and owner. Disable unused paths rather than accepting lingering access as the price of flexibility.

Change testing matters because Microsoft 365 capabilities evolve. A revised agent permission model, new administrative control or updated feature configuration may affect an existing workflow. Treat the October 14 objective revision as a reminder to review the official effective-date outline, and apply the same discipline to operating the service: document changes, communicate impact and confirm behavior under standard user accounts.

Configuration drift is another practical administrative concern. A tenant may begin with a carefully approved group structure, but emergency membership changes and departmental reorganizations gradually alter effective access. Regular access reviews, ownership checks and controlled recertification help keep entitlements aligned to current roles. A Copilot rollout can expose old sharing mistakes simply because people now discover content more easily; that visibility is a reason to improve the underlying records and permissions, not to hide the finding. Administrators should combine change tracking with periodic tests of what different standard users can retrieve, ensuring policy declarations match observed behavior.

Prepare by solving administrative support scenarios

Use a test tenant or sanctioned training environment to map services, users, groups and controlled content. Assign a suitable license, configure access to a document library, test sign-in and review how an eligible user accesses Copilot. Then remove a permission and confirm that the formerly accessible information is no longer exposed through the same path. Observe which admin center owns each change and which audit evidence supports the result. Avoid performing risky experiments in a live production tenant.

AB-900 candidates should be able to troubleshoot a user's entitlement, explain why identity and data protection affect agent behavior, and identify who must approve or monitor a published agent. The point is operational readiness, not merely the ability to name administrative products. Microsoft 365 Copilot can support business work only when the surrounding services are configured and governed with the same discipline expected of the organization's other information systems.