Microsoft 365 Certified: Copilot and Agent Administration Fundamentals
Before an organisation switches Copilot on for everyone, somebody has to answer an awkward question: what will it be able to read? AB-900 is Microsoft's fundamentals exam for the people who answer it, spanning Microsoft 365 objects, security basics, Purview controls and the first administrative steps for Copilot and agents.
Forty-five minutes, proctored, and no expiry once passed.
Exam facts
- Exam code
- AB-900
- Level
- Foundational
- Field
- Cloud
- Access
- Paid
- Assessment
- Proctored exam
- Duration
- 45 minutes
- Questions
- not published for this exam; Microsoft says most of its certification exams hold 40 to 60 questions
- Passing score
- 700 of 1,000 (scaled)
- Languages
- English, Arabic, Japanese, Chinese, Korean, German, French, Indonesian, Italian, Portuguese, Russian, SpanishChinese Simplified and Traditional are grouped here. The English edition changes on 14 October 2026 and, per the study guide, localised editions follow about eight weeks later.
- Price
- see vendor (read 26 September 2026)
- Validity
- never expires
- Exam delivery
- Pearson VUE (test centre or online proctored); students through Certiport
Prerequisites: None formally. Microsoft expects familiarity with Microsoft 365 services, its admin centres, identity and data protection basics, and Microsoft 365 Copilot and agents.
Source: exam page at Microsoft · Price: Priced by the country or region where the exam is proctored; the Microsoft Learn page read on 2026-09-26 showed no figure, so none is recorded
How to prepare
1. The vendor's free learning path
Microsoft publishes the exam objectives and a learning path free of charge — the authoritative source for scope and weighting. Open the learning path (opens in a new tab)
Book the exam
Delivered by Pearson VUE (test centre or online proctored); students through Certiport. Schedule with Microsoft (opens in a new tab)
Our course directory holds no preparation course for the current version of this exam (pool checked 26 September 2026). The vendor's learning path above is the reliable start.
Copilot answers from whatever the signed-in user can already reach, with Microsoft Graph deciding what that is. In a tidy tenant that is reassuring. In a typical one, where old sites are open to the whole company, labels were never applied and guest access has not been reviewed in years, it is alarming. The exam is built around that reality. Its largest section is not about Copilot at all but about data protection and governance, because an assistant surfaces oversharing faster than any audit would.
What is weighted where
| Area | Weight from 14 October 2026 | Examples from the study guide |
|---|---|---|
| Core features and objects of Microsoft 365 | 30–35 % | Licences, the Exchange, SharePoint and Teams admin centres, Zero Trust, Entra ID, conditional access, Defender XDR, audit logs |
| Data protection and governance for Microsoft 365 and Copilot | 35–40 % | Purview sensitivity labels and retention, DLP alerts, insider risk, DSPM for AI, eDiscovery content search, SharePoint oversharing reports |
| Basic administration of Copilot and agents | 25–30 % | Licence assignment, pay-as-you-go billing, usage and adoption reporting, agent access, approval and monitoring |
The weighting sends a clear message to anyone expecting a Copilot product tour. The Copilot and agent administration block is the smallest. The governance block is the largest, and it reaches into tools a new administrator may never have opened: Compliance Manager, activity explorer, content search, the data access governance report in SharePoint. The identity material overlaps heavily with zero trust thinking, least privilege and the sign-in problems that multi-factor authentication and conditional access create.
An update lands on 14 October 2026
Microsoft's certification page says the English edition changes on that date, and the study guide's change log marks the core security features objective as a minor revision. Localised editions follow roughly eight weeks after English. If you sit near the switch, check which skills list applies to your appointment.
Where it sits in the catalogue
- Microsoft 365 Fundamentals (MS-900) is marked retired on its Learn page. AB-900 now carries the Microsoft 365 Certified fundamentals name, but the pages we read do not call it MS-900's successor, so neither do we.
- It is proctored, booked through Pearson VUE, or through Certiport for students and educators.
- It never expires. Microsoft's expiry policy states that fundamentals certifications do not lapse.
- A free practice assessment and an exam sandbox are linked from the Learn page.
- The pass mark is 700 on Microsoft's scaled score, according to the study guide.
The audience is narrower than the fundamentals label suggests. Helpdesk staff moving towards Microsoft 365 administration, compliance officers who will be asked to approve a Copilot rollout, and project leads who need the vocabulary before a deployment all gain from it. Someone already running a tenant will find the objects section easy and the Purview section genuinely useful. Anyone heading for the administrator expert track should read the MS-102 page first, since that exam has its own announced retirement.
What a question looks like
Written by us in the exam's style. It is not a real question from any question bank, and we do not publish those.
A company is about to assign Microsoft 365 Copilot licences to its sales team. An audit shows that a SharePoint site holding salary data is shared with everyone in the organisation. What should the administrator do first to stop Copilot surfacing that data to the sales team? A) Turn off Copilot in Word and Excel for the sales team. B) Correct the site's permissions and review oversharing with the data access governance report. C) Withhold the sales team's Copilot licences until the next audit. D) Require multifactor authentication for all sales users.
Three options feel like decisive action. Only one addresses the cause: Copilot honours existing permissions, so the fix is the permission, not the assistant. Switching off apps or licences hides the symptom and leaves the salary data open to anyone who searches for it, and stronger sign-in protects the front door, not what lies behind it.
What it costs to get and to keep
| Item | Amount | Note |
|---|---|---|
| Exam fee | not published | priced by the country or region where the exam is proctored; no figure was shown on the Microsoft Learn page read on the recording day (read 26 September 2026) |
| Retakes | not published | 24 hours after a first failure, then 14 days between attempts, at most five in twelve months; Microsoft says retakes are paid where applicable (read 26 September 2026) |
| Practice | 0 USD | a free practice assessment and exam sandbox are linked from the Learn page (read 26 September 2026) |
| Renewal | not published | none; Microsoft fundamentals certifications do not expire (read 26 September 2026) |
How much preparation, from where you are
- You use Copilot but have never opened an admin centre
- The objects and identity material will take most of your time. If your employer gives you a test tenant, click through the admin centres; they make more sense seen than read.
- You already administer Microsoft 365
- Concentrate on Purview and on the Copilot and agent tasks, which are newer than most tenants' routines.
- You work in compliance or data protection
- The governance block is your home ground. Licensing, billing models and the admin centres are where the gap lies.
What passing this does not prove
- Building Purview policies end to end; the exam asks you to recognise and interpret rather than design.
- Developing agents beyond the basic creation step on the outline.
- Exchange, Teams or SharePoint administration in depth.
- Hybrid identity, directory synchronisation or tenant migration.
Against the alternatives
- Microsoft 365 Certified: Administrator Expert (MS-102)
- The expert administrator certificate: far deeper, with a qualifying associate certificate required and a published retirement date. AB-900 is the entry-level view of the same estate through an AI lens, and it is not among MS-102's prerequisites.
- Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
- Security, compliance and identity fundamentals across Microsoft's platforms. It shares ground with AB-900 on Entra ID and Purview but has no Copilot or agent administration. Choose AB-900 if your work is Microsoft 365, SC-900 if it is security in general.
AB-900 — quick answers
Is AB-900 the replacement for MS-900?
MS-900 is marked retired on its Learn page, and AB-900 now carries the Microsoft 365 Certified fundamentals name. The Microsoft pages we read do not describe it as a formal successor, so we record the retirement and leave the lineage open.
Does it expire?
No. Microsoft's expiry policy says fundamentals certifications do not expire, so there is no annual renewal of the kind its associate and expert certificates require.
Do I need administrator experience?
There is no formal prerequisite. The candidate profile does expect familiarity with the admin centres, identity and data protection basics, and Copilot itself, so complete beginners should work through the study guide's resources first.
What changes on 14 October 2026?
The English edition is updated on that date. The study guide lists the skills from that day, with the security features objective marked as a minor change, and other languages follow roughly eight weeks later.
What score do I need?
700 on Microsoft's scaled score of up to 1,000, as the study guide states. Because the score is scaled, 700 does not translate into answering seventy per cent correctly.
Where this exam sits in the field
What comes next
- Microsoft · MS-102Microsoft 365 Certified: Administrator Expert
- Microsoft · SC-900Microsoft Certified: Security, Compliance, and Identity Fundamentals
- Microsoft · AZ-900Microsoft Certified: Azure Fundamentals
- Microsoft · Lab-based assessmentMicrosoft Applied Skills: Streamline business workflows with AI chat
Concepts this exam draws on
Glossary entries with the reason each one matters for AB-900.
- Zero Trust
Deciding what Copilot may read is an access-control question first.
- Least Privilege
Agents and assistants inherit the permissions of the user; the exam asks how to keep them narrow.
- IAM
Copilot and agent administration runs on Microsoft 365 identities and roles.
- Sensitivity label
Labels and Purview policies are the administrator's controls over what agents read.
Last reviewed 26 September 2026 · Getting Digital