Microsoft Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 Exam Dumps: Updated Questions & Answers (April 2026)

The correct answer is C because Microsoft explains that authorization is the process of determining whether an authenticated identity is allowed to access a resource . Microsoft Learn distinguishes authorization from authentication by stating that authentication proves who you are, while authorization decides what you can access or do after identity has been established. In Microsoft 365 and the Microsoft identity platform, authorization commonly involves permissions, scopes, roles, and consent that control access to data and services such as Microsoft Graph, Exchange, SharePoint, or Teams.

Option A is incorrect because it refers more to external identity validation or federation concepts, not authorization itself. Option B describes authentication , not authorization, since it is about verifying identity claims. Option D describes a control such as multifactor authentication or Conditional Access requirements, which can happen before access is granted, but that still is not the definition of authorization. Authorization begins after identity verification and focuses on whether the identity has the right permissions for the requested resource.

The correct answer is C. a custom Microsoft 365 Copilot agent . Microsoft Learn explains that Agent Builder in Microsoft 365 Copilot lets you create agents with specific instructions , dedicated knowledge sources , and starter prompts . Starter prompts are designed to help users understand the most common supported scenarios, which directly matches the requirement to provide users with a list of common queries. Microsoft also documents that an agent can be grounded in selected SharePoint sites, folders, or files , allowing the response scope to be targeted to the HR policy content in Site1 rather than broad enterprise or web data.

The other options do not fit the requirement. Copilot in Word is document-focused and is not intended to create a reusable, shared query experience grounded only in one SharePoint source. Copilot notebooks group materials and chats, but they are not the right tool for publishing a guided HR policy assistant with starter prompts. Researcher is designed for broader, multi-step research using work data and web content, so it does not satisfy the requirement to keep answers grounded only in Site1.

The correct answers are B and C . Microsoft documents that Identity Secure Score in Microsoft Entra is based on identity security recommendations, including recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” Those recommendations directly map to the number of global administrators and whether passwords are set to never expire , so both factors affect the score.

Option A is incorrect because SharePoint site permissions are part of SharePoint content and collaboration security, not a direct factor in the Microsoft Entra Identity Secure Score model. Option D is also incorrect because the location of users can be used in Conditional Access and other access control decisions, but Microsoft does not list user geographic location itself as a direct Identity Secure Score recommendation. Identity Secure Score is driven by Entra identity best-practice checks and recommendations rather than by SharePoint permission structure or user location data.

The correct answer is B. data loss prevention (DLP) policies . Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices . Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.

Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft’s documented solution is DLP policies .

The correct selections are Yes, Yes, Yes . For statement 1, Microsoft Support explains that if you are not a site owner, you might still be able to invite other people to the site , although the invitation can generate an access request that a site owner approves or declines. Microsoft also states that site users have the opportunity to invite other people to collaborate on sites , unless that feature is disabled. That makes the statement true.

For statement 2, Microsoft Learn states that in SharePoint you can give people permissions to a site by adding individual users, security groups, or Microsoft 365 groups to one of the three SharePoint groups, including the Members group. That directly supports the statement.

For statement 3, Microsoft documents that site ownership and membership can be managed by adding or removing owners, members, site owners, site members, and site visitors . For group-connected sites, Microsoft also documents that owners can manage group ownership and remove owner status. Therefore, a site owner can remove another site owner, provided at least one owner remains.

The correct selections are No, No, Yes . Microsoft states that in Microsoft 365 Copilot and Microsoft 365 Copilot Chat, prompts and responses aren’t used to train the underlying foundation models . Microsoft also documents that Copilot works within the Microsoft 365 service boundary and that data accessed through Microsoft Graph isn’t used to train foundation models . That makes statements 1 and 2 No .

Statement 3 is Yes because Microsoft documents that Microsoft 365 Copilot honors the same data protection, access control, and compliance capabilities that apply across Microsoft 365. Microsoft also states that Copilot only surfaces organizational data that users already have permission to access, including content retrieved through Microsoft Graph in services such as SharePoint, OneDrive, Exchange, and Teams.

A Communication Compliance policy can detect inappropriate text in Microsoft Teams messages. Answer: Yes

A Communication Compliance policy can detect offensive language in Microsoft 365 Copilot prompts. Answer: Yes

A Communication Compliance policy can be used to retain email messages for 10 years. Answer: No

The correct selections are Yes, Yes, No . Microsoft documents that Microsoft Purview Communication Compliance can detect potentially inappropriate messages in supported communication channels, including Microsoft Teams and email . Microsoft also states that reviewers can investigate communications in Microsoft 365 Copilot and Microsoft 365 Copilot Chat , which means Communication Compliance policies can evaluate Copilot prompts and responses for risky or offensive content.

This makes statement 1 Yes , because inappropriate text in Teams messages is a standard Communication Compliance scenario. Statement 2 is also Yes , because Microsoft explicitly includes Microsoft 365 Copilot and Microsoft 365 Copilot Chat among the supported communication sources for policy review and investigation.

Statement 3 is No because retaining email for a fixed period such as 10 years is handled by Microsoft Purview Data Lifecycle Management through retention policies or retention labels, not by Communication Compliance. Communication Compliance is for monitoring and investigating risky communications, not for long-term retention enforcement.

The correct answer is accountability . Microsoft’s Responsible AI framework is built on six principles: fairness , reliability and safety , privacy and security , inclusiveness , transparency , and accountability . Microsoft describes accountability as the principle that people who design and deploy AI systems must remain responsible for how those systems operate and for the impacts they create. A key part of that principle is ensuring there is human oversight so humans remain in control of decisions and system behavior.

The other options do not match the wording in the sentence as closely. Transparency focuses on helping people understand how AI systems work and why they produce certain outcomes. Privacy and security is about protecting data and securing systems. Reliability and safety is about dependable and safe operation. Inclusiveness is about designing AI that empowers and includes people broadly. The principle tied to oversight, responsibility, and keeping humans in control is accountability .

provide control over how users can access cloud apps.

The correct answer is provide control over how users can access cloud apps . Microsoft Learn defines Microsoft Entra Conditional Access as the Zero Trust policy engine that uses if-then logic to make access decisions. Microsoft states that Conditional Access policies determine who can access resources, what resources they can access, and under what conditions . These policies can require actions such as multifactor authentication, compliant devices, or other controls before allowing access to applications and services like Microsoft 365. That means Conditional Access is specifically used to control how users access cloud apps .

The other options are incorrect. Conditional Access policies are not configured by using the Microsoft Defender portal ; they are managed in the Microsoft Entra admin center . They are also not applied only to on-premises resources , because Microsoft documents Conditional Access primarily for cloud identities, cloud apps, and cloud-connected resources. Finally, Conditional Access does not require a Microsoft Exchange mailbox. It can be applied broadly across many Microsoft and third-party cloud applications integrated with Microsoft Entra.

The correct selections are No, No, Yes . Microsoft states that for Microsoft 365 Copilot , customer prompts, responses, and Microsoft Graph grounding data aren’t used to train foundation models . Microsoft also explains that Copilot processes organizational data within the service boundary and applies the same commitments that protect Microsoft 365 customer data. That makes statements 1 and 2 No . Microsoft further documents that Microsoft 365 Copilot grounds responses using Microsoft Graph and only surfaces data that the user is permitted to access , so it respects existing identity, access, and permission controls in the tenant. That makes statement 3 Yes .

This behavior is a core part of Copilot’s enterprise design. Microsoft describes Copilot as inheriting your organization’s existing Microsoft 365 permissions model, including access controls on content in SharePoint, OneDrive, Exchange, Teams, and other Microsoft 365 services. So Copilot does not grant new access; it works within the permissions already assigned to the signed-in user.