MS-900: The Retired Microsoft 365 Fundamentals Exam

MS-900, Microsoft 365 Fundamentals, retired on March 31, 2026. It should no longer be presented as an exam that a new candidate can schedule. Its historic topic areas remain useful for people learning the Microsoft 365 ecosystem: cloud concepts, productivity and collaboration services, identity and security fundamentals, compliance, licensing, pricing, and support. The difference between useful learning material and a current credential matters. Candidates should check the current Microsoft Learn catalog for active foundational credentials, while administrators can use MS-900 topics as a map of the services they are expected to understand before working with advanced Microsoft 365 roles.

Understand cloud service responsibilities before product features

Microsoft 365 is delivered largely as cloud software services, but the customer still has responsibilities for users, devices, access, data governance, configuration, and support processes. The shared-responsibility concept changes with the service being used. A cloud provider may operate the underlying infrastructure, yet an organization can still expose confidential data through careless sharing or an overly privileged account. Learners should distinguish Software as a Service from infrastructure and platform offerings, without assuming that a managed application removes the need for security decisions. Availability, service continuity, connectivity, and identity services are also part of a cloud adoption model.

Organizations adopt cloud services for reasons such as reduced infrastructure operations, scalable access, faster collaboration, and centralized management. Those benefits depend on connectivity and governance. A distributed business may be able to collaborate without operating its own mail servers, but poor identity management can undermine that benefit. A migration is also a change in support responsibilities. Service health, subscriptions, support entitlements, data-location requirements, and administrative interfaces must be understood by the people operating the environment. Comparing basic deployment models provides a foundation for later decisions about hybrid identity, endpoint management, and third-party integrations.

Map collaboration services to actual work

Exchange Online provides business messaging and calendaring capabilities; SharePoint supports sites and document collaboration; OneDrive commonly supports personal work files; Teams combines communications and shared collaboration experiences. These services overlap in the user's experience but are not interchangeable. A file uploaded into a Teams channel may rely on SharePoint storage, while a private file shared in a chat may follow a different ownership path. Recognizing the underlying service helps administrators predict sharing behavior, access controls, and retention obligations.

Collaboration design should start with the business task. A team responsible for a long-running project needs shared ownership, document versioning, and structured communication. An individual working document may begin in OneDrive and move into a shared site when it becomes a team artifact. Email remains appropriate for formal communication and certain external workflows. A classroom or department with constant short interactions may benefit from Teams channels, but an uncontrolled proliferation of workspaces can make information difficult to find. The historic MS-900 scope introduced the products; practical competence lies in choosing them according to ownership, collaboration, and information lifecycle.

Explain Microsoft 365 identity and device protection

Microsoft Entra ID provides identity functions underpinning access to Microsoft 365. Authentication verifies an identity; authorization determines what that identity can access or administer. Multi-factor authentication makes certain credential attacks harder, while Conditional Access evaluates signals and policy before granting access. These protections are complementary. A user can authenticate correctly and still be blocked because a device does not meet a policy requirement. Conversely, a valid password does not establish that the sign-in is safe when risk indicators suggest compromise. Learners should understand how identities, groups, roles, and device conditions affect access.

Endpoint management and protection also intersect with cloud services. Intune can apply suitable management and compliance policies; Microsoft Defender capabilities help detect and respond to threats depending on licensing and configuration. Device registration, enrollment, configuration, and compliance are different concepts. An employee-owned phone may require different data protection than a corporate laptop. The Microsoft Entra Conditional Access topic is a natural deeper connection because authentication policy is often the boundary between straightforward collaboration and controlled access to organizational data.

Distinguish compliance, information protection, and security

A security control seeks to prevent or respond to harm; a compliance requirement may specify lawful handling, preservation, or disclosure of records. These objectives overlap but are not identical. Microsoft Purview tools can support sensitivity labeling, data loss prevention, retention, eDiscovery, and auditing where enabled. Labeling a document confidential does not determine how long it must be retained. Retaining data for an approved period does not mean every user should have access to it. The administrator must work with security, privacy, legal, and records-management teams to implement the relevant policies.

Consider an employee sharing a spreadsheet containing customer personal data with an external organization. Access controls may govern who can open it; sensitivity labels may influence how it is protected; DLP rules may restrict the attempted sharing; auditing may record relevant activities. Each tool addresses a different dimension of the situation. A foundational learner should be able to explain what category of control might apply, without suggesting that simply enabling an application makes an organization compliant. When incidents occur, proper escalation and evidence preservation matter more than making hasty changes to unknown tenant-wide settings.

Understand licenses, service plans, and support choices

Microsoft 365 plans package services and features in different combinations. A licensing decision should consider business requirements, user roles, security capabilities, administrative features, and ongoing cost, not only whether a particular app icon appears in a plan. Assigning licenses through groups can support scale, but group changes may remove access unexpectedly. Optional features and premium security or compliance capabilities may require additional entitlements. Administrators should verify current commercial terms and regional availability because offers evolve; historical MS-900 diagrams can become out of date even while the underlying service concepts remain valid.

Support and service-level arrangements also require careful understanding. A service-level commitment is not a promise that no outage will ever occur, and an issue may arise from a local network or configuration problem rather than the cloud provider. An organization needs to know which support channels are available, how to check service health, and how to communicate a disruption to users. Data protection and business continuity planning should account for accidental deletion, compromise, and operational dependencies. Cloud services can reduce infrastructure maintenance but do not eliminate planning for unavailable services or human error.

Use the old syllabus without repeating outdated claims

The historical MS-900 exam made a reasonable starting point for understanding Microsoft 365 services, but a candidate reading an older study document should validate names and functionality. Azure Active Directory was renamed Microsoft Entra ID, product capabilities have evolved, and licensing packages can change. The Microsoft 365 administration role is much broader than the retired fundamentals exam and involves tenant-level identity, Defender, and Purview responsibilities. Confusing a foundations syllabus with expert administration can lead to unrealistic skill claims.

A practical learning exercise is to follow one employee's digital workday. The employee signs in, accesses email and a project workspace, shares an approved document, joins a meeting, and uses a managed device. For each action, identify the underlying service, identity requirement, administrative owner, and security or compliance implication. Then introduce an unusual event such as accidental sharing or loss of a device and identify which control plane is involved. This approach turns a list of familiar product names into a usable understanding of the platform.

Choose an active learning goal after retirement

Because MS-900 retired in March 2026, the appropriate next step is not searching for a last-minute booking or assuming a cached Microsoft Learn course proves exam availability. A learner should identify a current job goal and then review active Microsoft credentials in that area. Someone interested in endpoint deployment might examine device administration; a person managing Teams would follow collaboration administration; a security-focused learner might prioritize identity and security capabilities. A general introduction can still be useful before those paths even if it no longer ends in the old MS-900 badge.

Organizations should update internal skills matrices so the retired exam does not remain an unquestioned requirement for new hires or promotion. Existing holders may still list legitimate historical achievements in their records, but new learners need active alternatives. The concepts of cloud responsibility, tenant identity, collaboration, licensing, and information governance are still relevant. The certification code simply has a different status. Maintaining that distinction helps readers use historical content responsibly and prevents training plans from promising a credential that Microsoft no longer offers.

Foundational training should also distinguish product availability from a user's entitlement to a capability. The Microsoft 365 service may offer a feature, but the organization's subscription, tenant configuration, user licensing, policy, or region can still limit access. A support team should not assume that an employee who cannot see a feature is encountering a software defect. Confirming the assigned service plans, organizational policy, and rollout prerequisites is often the right first investigation. This teaches a wider lesson about SaaS administration: the interface a user experiences is the outcome of several independent decisions, not a fixed representation of the product catalog.

Security and compliance concepts become clearer with paired examples. A suspicious email attachment tests threat-protection and incident-response processes; an employee deliberately sharing an internal report outside the company tests authorization and information-governance controls. A temporary guest who no longer needs access tests the identity lifecycle. A legal requirement to preserve records despite staff departures tests retention planning. Each is a distinct problem despite happening in the same tenant. Learners who can recognize the responsible control and escalation team are better prepared for real work than those who simply remember that Microsoft provides a feature with a familiar name.