Pass the Microsoft Microsoft 365 Certified: Copilot and Agent Administration Fundamentals AB-900 Questions and answers with CertsForce

The correct answers are B and C . Microsoft documents that Identity Secure Score in Microsoft Entra is based on identity security recommendations, including recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” Those recommendations directly map to the number of global administrators and whether passwords are set to never expire , so both factors affect the score.

Option A is incorrect because SharePoint site permissions are part of SharePoint content and collaboration security, not a direct factor in the Microsoft Entra Identity Secure Score model. Option D is also incorrect because the location of users can be used in Conditional Access and other access control decisions, but Microsoft does not list user geographic location itself as a direct Identity Secure Score recommendation. Identity Secure Score is driven by Entra identity best-practice checks and recommendations rather than by SharePoint permission structure or user location data.

The correct answer is D. From the Finance site, configure permissions . Microsoft states that Microsoft 365 Copilot honors existing Microsoft 365 permissions and only grounds responses in content that the signed-in user is already allowed to access. That means if users are getting Finance-site content in Copilot responses, those users likely still have permission to that SharePoint content. The direct fix is to review and correct the site, library, folder, or file permissions on the Finance site so only the intended users retain access.

The other options do not directly solve this requirement. Information Barriers are designed for communication and collaboration segmentation scenarios, not for ordinary site-level oversharing remediation. A Defender data connector is unrelated to SharePoint permission enforcement. Conditional Access controls sign-in and session access conditions, but it does not selectively remove Copilot grounding from one SharePoint site for users who still have site permissions. Because Copilot uses SharePoint and Microsoft Graph permissions as its boundary, the Microsoft-documented corrective action is to fix the Finance site permissions .

The correct answer is D. Data Lifecycle Management . Microsoft Learn states that Microsoft Purview retention policies and retention labels, managed under Data Lifecycle Management , support three core outcomes: retain-only , delete-only , and retain and then delete . The requirement in this question is exact: keep email for seven years and then permanently delete it. That is a textbook retain and then delete retention configuration, which Microsoft documents as part of Purview’s retention capabilities. Microsoft also recommends using Microsoft 365 retention policies and labels for retaining and deleting emails rather than relying on older Exchange-only approaches in most modern compliance scenarios.

The other options do not meet the requirement. Information Protection focuses on labeling and protecting sensitive information. Insider Risk Management is used to detect and investigate risky user behavior. Data Loss Prevention helps prevent inappropriate sharing or exfiltration of sensitive data. None of those are designed to enforce a timed seven-year retention period followed by automatic permanent deletion. The Microsoft Purview solution explicitly built for that lifecycle requirement is Data Lifecycle Management .

The correct answer is Microsoft Graph . Microsoft documents that Microsoft 365 Copilot accesses organizational content and context through Microsoft Graph . Microsoft Graph provides the user’s work context, including items such as emails, chats, meetings, files, contacts, and calendar data , along with relationship and activity signals that help Copilot ground and rank responses. Microsoft also explains that Copilot combines organizational content with the user’s working context, such as recent chat conversations, email exchanges on a topic, and the meeting the user is currently in. Those are exactly the kinds of signals described in the question, including collaboration history and document relevance.

The other options do not fit this sentence. Microsoft Copilot Studio is used to build and customize copilots and agents. Microsoft Purview is for compliance, governance, and data protection. Microsoft Viva Insights provides workplace analytics and insights, but it is not the core service described by Microsoft as supplying the contextual signals that ground Microsoft 365 Copilot responses. Therefore, the only option that correctly completes the sentence is Microsoft Graph .

The correct answer is Microsoft Defender XDR . Microsoft Learn defines Microsoft Defender XDR as a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks. That wording matches the sentence in the question almost exactly, which makes this the clearly correct choice.

The other options do not fit that definition. Microsoft Entra Conditional Access is Microsoft’s Zero Trust policy engine used to evaluate signals and enforce access policies, not a cross-domain threat detection and response suite. Microsoft Entra ID Protection focuses on detecting and responding to identity risks such as risky sign-ins and risky users. Microsoft Purview is Microsoft’s portfolio for data governance, data security, and compliance. None of those products is described by Microsoft as coordinating detection, prevention, investigation, and response across endpoints, identities, email, and applications in the same integrated XDR manner. Therefore, the only answer that correctly completes the sentence is Microsoft Defender XDR .

The correct answer is B. using a custom agent that is grounded in work data . Microsoft Learn states that agents that access shared tenant data , such as SharePoint or Graph Connector content, are billed based on metered consumption . Microsoft also describes pay-as-you-go for Microsoft 365 as applying to agents in Microsoft 365 Copilot Chat , where organizations pay only for the messages used instead of assigning a full Microsoft 365 Copilot license. That is exactly the scenario described in option B: a custom agent grounded in work data.

The other options are not the intended pay-as-you-go scenario. A Teams meeting recap and Copilot in Word are standard Microsoft 365 Copilot application experiences tied to licensed Copilot functionality, not metered agent consumption. Researcher is an advanced Microsoft 365 Copilot agent available as part of Microsoft 365 Copilot capabilities, not the documented example of pay-as-you-go replacing a Copilot license. Microsoft’s pay-as-you-go guidance centers on agent-based usage , especially agents grounded in organizational work data.

the Microsoft Authenticator app

The correct answer is the Microsoft Authenticator app . The image shows the familiar Microsoft MFA prompt that says “Are you trying to sign in?” and “Enter the number shown to sign in.” Microsoft documents this as number matching in Authenticator push notifications , which is part of Microsoft Entra multifactor authentication using the Microsoft Authenticator app . Microsoft explains that number matching is a security improvement for Authenticator push approvals and is used when the default sign-in method is Authenticator push notifications.

The other choices do not match the experience shown. Email OTP would involve a one-time code sent by email. SMS would send a text message code to a phone number. Temporary Access Pass is a time-limited passcode used for onboarding or recovery scenarios, not the mobile push screen shown in the image. Because the graphic specifically shows a mobile approval prompt with number matching, the MFA method is clearly the Microsoft Authenticator app .

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft documents tenant controls for web search on or off , but not a general Microsoft 365 Copilot setting to block only selected websites for normal Copilot responses. Microsoft also says it doesn’t recommend or support managing Copilot through selective URL or domain blocking at the network level. Website allow/block lists shown in Microsoft documentation apply to Researcher with Computer Use virtual-device settings, not to standard Microsoft 365 Copilot web grounding overall.

Statement 2 is Yes because Microsoft provides the Allow web search in Copilot policy in Cloud Policy service and in the Microsoft 365 admin center, which can disable web search for Microsoft 365 Copilot and Copilot Chat.

Statement 3 is Yes because Microsoft states that admins can block Researcher and Analyst , and agent governance includes a Block action. Microsoft also notes that for Researcher and Analyst, user scoping isn’t edited through the usual panel; availability is managed by blocking the selected agent at the tenant level.

The correct selections are No, Yes, No . Microsoft defines Zero Trust as a security strategy and explicitly states that it isn’t a product or a service . Instead, it is an approach based on principles such as verify explicitly , use least privilege access , and assume breach . That makes statement 2 true.

Statement 1 is false because Zero Trust does not require an Azure subscription. Microsoft provides Zero Trust guidance across many environments, including Microsoft 365, Copilot, Azure, and hybrid scenarios. It is a strategy that can be implemented with different technologies and is not dependent on owning Azure specifically.

Statement 3 is also false because there is no single switch in the Microsoft 365 admin center to “enable Zero Trust” for an organization. Microsoft’s documentation presents Zero Trust as a set of policies, configurations, and deployment steps across services such as Microsoft Entra, Intune, Defender, and Microsoft 365 workloads, not as one admin-center toggle.

Top of Form

Bottom of Form

The correct answer is B. the Microsoft 365 admin center . Microsoft documents that administrators assign product licenses to users from the Microsoft 365 admin center , including on the Active users page where you can open a user account and manage Licenses and apps . Microsoft also documents license assignment workflows there for both direct assignment and group-based licensing scenarios. That makes the Microsoft 365 admin center the standard administrative portal for giving a user access to Microsoft 365 services and features.

The other options are incorrect for this task. The Microsoft Purview portal is used for compliance, governance, data protection, eDiscovery, audit, and related Purview solutions, not for assigning Microsoft 365 product licenses. The Microsoft Teams admin center is used to manage Teams settings, policies, devices, voice, and collaboration features, but it is not the central portal for assigning tenant product licenses to users.

Therefore, when the requirement is simply to assign a license to a user in a Microsoft 365 subscription, Microsoft’s documented answer is the Microsoft 365 admin center .