Learning & Credentials | Vlad Talks Tech

Is the AB-400 Harder Than the PL-400? A PL-400 Trainer Weighs In

Vlad Catrinescu — Tue, 03 Nov 2026 14:31:36 GMT

2026 has been a big year for Power Platform certifications, and the latest exam to change is the PL-400. It has been replaced by the AB-400 exam, Extending Microsoft Power Platform Solutions with Code and AI. I’m not a developer, so this isn’t an exam I can advise you on myself, but at the Power Platform Community Conference I sat down with someone who just took it: Nathalie Leenders, a Microsoft MVP and Power Platform consultant and trainer at Wortell.

Key takeaways

The AB-400 replaces the PL-400 as the exam for the Power Platform Developer Associate certification, and it goes much deeper into code than the PL-400 did.
New topics include Power Apps code apps, AI-assisted app building, MCP servers and PCF components combined with AI, on top of the model-driven apps and Dataverse work you already know.
If you already hold the Power Platform Developer Associate certification, you don’t need to take the AB-400 to keep it.
Nathalie doesn’t recommend the AB-400 as a first exam, or to anyone who isn’t a developer: she suggests at least six months of hands-on experience first.
Her biggest tip is to go through every objective in the study guide and get hands-on with anything you haven’t used yet.

Why Nathalie took the AB-400 after the PL-400

What I found impressive is that Nathalie already had the PL-400 and took the AB-400 anyway, just to stay up to date. The PL-400 was actually the very first certification she ever did. She took it as a challenge, with a free voucher from a Microsoft Ignite Cloud Skills Challenge, and she’s honest that she doesn’t recommend that route to anyone.

The PL-400 was, and still is, the most technical Power Platform exam out there. As Nathalie put it, it’s about extending: “So it’s JavaScript, it’s plug-ins, it’s Dataverse. It’s way beyond the standard capabilities of model-driven apps.”

Microsoft was also very quiet about the switch. There was no blog post announcing the AB-400. I only found out because I have some automations that watch the Microsoft Learn pages, and they told me the PL-400 was retiring. Nathalie had been expecting an announcement too, and instead the exam was just there.

What changed in the AB-400 exam

Nathalie took the AB-400 to see what Microsoft now considers “extending” the Power Platform, because the technology has changed so much. She went in prepared for technical questions, but not as technical as they actually were, and it caught her by surprise. As she joked, they extended the scope of the extending exam.

It’s still model-driven apps and it’s still Dataverse, but the exam goes much deeper and adds Power Apps code apps and AI-assisted app building. The questions changed too. The PL-400 had a bit of JavaScript and TypeScript, while the AB-400 shows you a piece of code with a few options, and asks you to choose the right ones and put them in the correct order.

Microsoft’s study guide shows the same shift. The AB-400 is split into four skill areas:

Build Microsoft Power Platform solutions (15-20%)
Extend the user experience (25-30%)
Extend Microsoft Power Platform (35-40%)
Develop integrations (10-15%)

That’s why Nathalie’s advice is clear: if you’re not a developer, don’t take the developer exam this time. Even with her experience building plug-ins and JavaScript, and having taught the PL-400 course, she just about didn’t pass, and she’s going to take it again. She told me she was one checkbox on one question away. That has happened to me a couple of times as well, and I’ve also passed an exam by one checkbox, so it all balances out.

Do you need the AB-400 if you already have the PL-400?

No. The certification doesn’t change: it’s still the Power Platform Developer Associate. If you passed the PL-400, you don’t need the AB-400 to keep being a certified Power Platform developer.

Nathalie took it because she loves certifications, and because she wanted to see which direction Microsoft would take the exam. The catch is that the exam is so new that, when we recorded in late October 2026, there was no learning path and no practice exam yet, only the study guide listing the new topics.

That’s always a challenge with a brand-new exam. Early on, an exam can include content that eventually gets removed as it becomes more balanced, so taking it at the beginning is usually a tougher challenge.

What to get hands-on with before the AB-400 exam

I asked Nathalie what someone who passed the PL-400 a couple of months ago should open a lab and actually try. Her list:

Code apps and AI-assisted app building. You can create an app from a prompt, but she suggests going further into the code itself.
Visual Studio Code connected to the Power Platform. Connect to Power Apps and to an MCP server, and dive into code apps from there.
PCF components combined with AI. The PL-400 focused heavily on extending model-driven apps, Dataverse plug-ins and JavaScript, and the AB-400 goes much deeper into all of that.

There’s a lot of content in the AB-400 that wasn’t in the PL-400. That makes it more fun in a way, but it also goes very deep.

Does the AB-400 match what companies are building?

I asked Nathalie whether the exam lines up with what organizations are building today, or whether it’s more of a Microsoft wish list. Her answer was that it’s a little bit of both.

Microsoft is pushing toward this as the future, but the exam is still heavily model-driven apps, the experience we’re used to, enhanced much more with AI. And companies want to build apps very quickly. In her words: “We used to develop model-driven apps. It would take us weeks to do what we can now do in an hour with AI, and with the generative pages in model-driven apps.” Being able to enhance that with code is what the exam leans toward, and she thinks that’s both what Microsoft wants and what companies are looking for right now.

If you want to see where Microsoft is taking the platform next, my PPCC 2026 keynote highlights cover the biggest announcements from the same conference where Nathalie and I sat down.

Should the AB-400 be your first Power Platform exam?

It depends on how quickly you pick things up, because the AB-400 is a very broad exam. The PL-400 was already big, and this one covers a lot more. If you’re starting out in the Power Platform, Nathalie doesn’t recommend going for it first, the way she did years ago when the PL-400 had a smaller scope. She’d want at least a few months, ideally six months of experience with code apps, plug-ins, model-driven apps and extending.

For the path, she’d start with the fundamentals, then take the AB-410, which is the Intelligent Applications Builder certification, and maybe the AB-620 for Copilot Studio. That gives you more knowledge of AI and agents and how it all works, which helps because the AB-400 has an agent portion.

Nathalie also pointed out that the path used to be easy to follow: fundamentals, associate, expert. With the PL-600 going away, it’s no longer a linear route, and she’s hoping Microsoft makes it a bit more linear again. If you want to see where everything fits today, my Power Platform credentials overview lays it out, and the PL-900 study guide is a good place to start with the fundamentals.

Nathalie’s final tip: don’t underestimate it

Her one piece of advice for the AB-400 exam is not to underestimate it. Open the study guide and go through every objective. If there’s one where you think “I haven’t worked with that yet”, get some experience with it before the exam, because there might be one question on it, or there might be ten.

Nathalie shares a lot of what she figures out at work on her blog, and you’ll often find her on the monthly Microsoft Power Platform community call and the weekly calls. If you see her at a user group or an event, say hi.

What this means for you

If you already hold the Power Platform Developer Associate certification, nothing changes for you. You can take the AB-400 to learn what’s new, like Nathalie did, but you don’t have to.

If you’re planning to take the AB-400 exam, plan more hands-on time than you would have for the PL-400. Work through each objective in the study guide, build a code app, connect Visual Studio Code to the Power Platform and an MCP server, and try PCF components with AI. If you’re newer to the Power Platform, start with the fundamentals and the AB-410 before you come back to this one.

And if you’re not a developer, you’re in good company: I’m not going for this one either, especially after this conversation. They’re not Pokémon, and we can’t catch them all.

Ready to start studying for the AB-400? My AB-400 study guide brings together the skills measured and the resources to prepare for the Power Platform Developer Associate certification.

How Agent Approval Works in Microsoft 365

Vlad Catrinescu — Thu, 22 Oct 2026 09:41:16 GMT

Your users are already building agents in Microsoft 365, but what happens when somebody’s experiment becomes available to everyone? You need to know how and why, because agent approval in Microsoft 365 depends on the type of agent, and each type gets there differently.

Key takeaways

SharePoint agents no longer have an approval process, and the site owner decides which agent is the main agent for the site.
By default, anyone can share an Agent Builder agent with the whole organization without admin approval, and an admin can change that setting.
A Copilot Studio agent needs an admin to approve it before everyone in the organization can use it.
An agent only responds with knowledge each user already has access to, except for files uploaded directly to an Agent Builder agent.
Admins approve agent requests in the Microsoft 365 admin center, under Agents, All agents, Requests.

Agent approval in Microsoft 365 depends on the type of agent

How an agent goes from being built by a maker to being available for everyone depends on the type of agent:

SharePoint agents are managed by the site owner.
Agent Builder agents in Microsoft Copilot can be shared with specific users or with the whole organization, without any admin approval. That’s the default behavior if you just deployed Copilot and didn’t change anything, and an admin can change it.
Copilot Studio agents can be shared with specific people without an approval. To share one with the whole organization, the maker needs an administrator to approve it.

If you’re preparing for the AB-900 exam, remember the default approval process for every type of agent. The AB-900 study guide lists understanding the approval process for agents as one of the skills measured.

SharePoint agents don’t have an approval process anymore

There is no approval process for SharePoint agents anymore. There used to be one, but it was removed in June 2026. You’ll still find the Approved folder in the site’s Site Assets library, but it doesn’t have the same purpose it did before. It’s just another folder now, and if you want, you can still put your agents in there so you know where your approved agents are.

The closest thing to an approval process is the Site AI pane. A site owner can open it and choose the main agent for the site, and there can only be one per site. To highlight more agents, site members, or anyone with edit permissions or higher, can add the agent link web part to any page, like the home page.

If you’re responsible for SharePoint agents more broadly, I cover the reports and policy levers in SharePoint agent governance.

A maker can share an Agent Builder agent either with specific users they choose, or with anyone in the organization. By default, that second option is enabled, so anybody can share an agent with everyone in the organization without an approval. That’s the default that surprises most admins.

I know that can sound a bit scary, but remember that the agent will only respond with knowledge the end user has access to. If the agent’s knowledge includes a SharePoint site that another user can’t access, Copilot won’t use that site to answer that user, because it always respects the user’s permissions. If you want the full picture of how that works, I explain it in how Microsoft Copilot accesses your work data.

There is one thing to remember for Agent Builder. If you upload a file directly to the agent, that file travels with the agent itself, so everyone who has access to the agent can get answers from the uploaded file.

Copilot Studio agents need an admin to approve them

Copilot Studio has a more defined workflow. A maker submits the agent to the organization catalog, and an administrator needs to approve it before other users can see it.

Copilot Studio also has many ways to configure knowledge sources, whether through service accounts or by connecting as the user talking to the agent. So what a user can reach really depends on how the agent was configured. But as an admin, you still have that approval step before it’s available organization wide.

An admin can approve agents in two admin centers: the Microsoft 365 admin center, where Microsoft Agent 365 lives, and the Teams admin center. For the AB-900 exam, focus on the Microsoft 365 admin center. That’s where Microsoft has been unifying its agent management capabilities, and the unified agent inventory is part of that same story.

How each approval flow looks in practice

Set the main agent on a SharePoint site

As a site owner, go to the site settings and open Site AI. Under Main agent, pick the agent visitors open from the agent icon in the header, and decide whether to show the Copilot button to site visitors. Save, and that agent becomes the default agent for the site. You can only set one default for the whole site.

To showcase more agents, edit a page and add the agent link web part. You can select any other agent in your organization, and your users can click the web part to chat with that agent.

Open the agent in Agent Builder, select Share, and choose who it’s available to: only you, specific users in your organization, or anyone in your organization. Then copy the link, select Apply, and anyone in the organization can start using the agent from that link.

Remember that the agent will only respond with knowledge each user has access to, and that applies to SharePoint agents as well.

Submit a Copilot Studio agent to the org catalog

Copilot Studio is the more advanced one, and the exact steps to send an agent for approval aren’t on the exam. Once the agent is published to the Microsoft Copilot and Microsoft Teams channel, the maker can submit it to the organization catalog to give everyone access. The agent then waits in an approval queue, pending admin action.

Approve or reject the request in the Microsoft 365 admin center

As an admin, here’s how to review the request:

In the Microsoft 365 admin center, go to Agents, then All agents.
Open the Requests tab. Select Refresh if the agent doesn’t show up yet.
Select the agent to open its details.
Choose Publish to store or Reject submission.

Before you decide, you have access to the information about the agent: when it was created and last updated, its channels, its data and tools, insights from Microsoft Purview and Microsoft Defender, and the Microsoft Entra Agent ID permissions when the agent uses one.

When you publish it to the store, you choose who gets the agent, such as all users, and whether to pre-install it for them. You can also apply a policy template to it, which is a Microsoft Agent 365 feature. Once you make it available, the agent is available for everybody in the organization.

What this means for you

So who approves an agent? It depends on the agent type, and the Microsoft 365 admin center is where you stay in control. SharePoint agents follow the site owner, Agent Builder agents follow a sharing setting that’s open by default, and Copilot Studio agents wait for you in the Requests tab.

Go take a look at what agents are already live in your tenant. Check whether the Agent Builder sharing setting is what your organization wants, and know who’s watching the Requests tab so Copilot Studio submissions don’t sit in the queue. And remember that a file uploaded directly to an Agent Builder agent is available to everyone who can use that agent.

If you’re studying for the AB-900, make sure you can name the default approval process for each type of agent, and spend your time in the Microsoft 365 admin center rather than the Teams admin center.

Ready to get AB-900 certified? This walkthrough comes from my three-course AB-900 path on Pluralsight, which covers the core Microsoft 365 services, data protection and governance, and the basics of Copilot and agent administration. Start with my AB-900 path on Pluralsight, and keep the AB-900 study guide open while you study.

How Microsoft Copilot Accesses Your Work Data and the Web

Vlad Catrinescu — Fri, 09 Oct 2026 11:59:45 GMT

Microsoft Copilot (formerly Microsoft 365 Copilot) sees the same data as your users, but how does it actually access and use it? Copilot doesn’t directly access your data, and it doesn’t just open up SharePoint and start reading files. The process involves several different systems and safety checks, and as an IT professional, understanding how it works gives you the mental model behind the protection and governance tools you’ll use with Copilot.

Key takeaways

Copilot doesn’t read your files directly. It grounds your prompt with Microsoft Graph and Work IQ before anything reaches the large language model.
Copilot checks that the user can access the content, respects Restricted Content Discovery and Restricted SharePoint Search, and applies your Purview labels and data loss prevention policies.
The prompt you type isn’t the prompt the large language model receives, because Copilot modifies it along the way.
When Copilot needs the web, it sends Bing a short, anonymized query, not your full prompt, your files or your identity.
Your work data stays inside your Microsoft 365 service boundary, and admins can turn web search off.

Why Copilot data access matters for IT pros

We already know that Microsoft Copilot can access your data. If you manage a Microsoft 365 tenant, you also need the technical details of how it gets to that data, especially your work data.

Microsoft also uses a lot of different product names here, some more technical and some more marketing, especially in the Copilot ecosystem. You’ll often see Microsoft Graph, Work IQ and even more advanced terms like the semantic index. I’m going to focus on what’s in scope for the AB-900 exam, so let’s start with two definitions.

Microsoft Graph and Work IQ explained

Microsoft Graph is the index of your tenant. Everything Microsoft 365 already knows about your users’ files, mail, chats, meetings and calendars sits in or behind Microsoft Graph. It’s really the catalog, and it has been around for a while: the Microsoft Graph API went generally available in November 2015, and most documentation today still references Microsoft Graph when it talks about how Copilot accesses data. If you’re a developer, you probably use the Microsoft Graph API every single day.

Work IQ is the layer that takes Copilot to the next level. It doesn’t only have access to the data, it also has memory and inference, so Copilot understands what matters to you. That means who you collaborate with the most, the topics you focus on day to day, the projects you actually spend time in, and the files you really open compared to the ones you needed on a previous project that aren’t relevant anymore.

Work IQ is much newer. It launched at Microsoft Ignite in November 2025, around the same time as the AB-900 exam. Think of Work IQ as the personalized layer on top of Microsoft Graph. They work together to give Copilot its power.

How Copilot accesses your work data

It all starts with the user, who writes a prompt in Microsoft Copilot. Copilot acts like an orchestrator, and the first thing it needs to do is ground that prompt, which means finding the information from your organization that helps answer it. Here it uses both Microsoft Graph and Work IQ, and the goal is to select the most relevant documents before anything is sent to the large language model.

This is important, because it’s part of the value Microsoft adds. The relevant documents, emails and information are selected by the orchestrator before they ever reach the large language model.

The safety checks before the large language model

Microsoft also checks several things about those documents before they get to the model:

Does the user have access to those documents?
Are there restrictions, like Restricted Content Discovery or Restricted SharePoint Search, that say this content shouldn’t show up in Copilot?
Are there Microsoft Purview sensitivity labels or data loss prevention policies that change how Copilot can handle the data it found?

After Copilot does all of that, it combines the information and sends it to the large language model as part of your prompt.

Your prompt isn’t the prompt the model receives

The prompt the user types isn’t the same prompt that gets sent to the large language model. Copilot modifies that prompt a lot before it gets there, including for responsible AI. That’s also why you sometimes get different results between ChatGPT and Microsoft Copilot, even on general knowledge questions, when they use the same model in the back.

The answer then goes back to the user. Since Copilot checks things like Purview, if content was generated from data with a sensitivity label, the content Copilot generates keeps that label. Tools like Microsoft Purview and Microsoft Defender monitor everything, so every interaction is logged and any suspicious prompts are escalated to the admin team. And everything that has to do with your work data remains inside your Microsoft 365 service boundary and respects your service agreement.

How Copilot accesses web data

Web data works differently. This is when Copilot needs to go to the public web to get information that improves the answer to your prompt, or when you ask it to research the web.

Everything starts the same way. The user sends Microsoft Copilot a prompt, the orchestrator decides it needs data from the web, and Copilot creates a short, anonymized query stripped of your identity, with no file information. It sends that query to Bing, which gets the information from the public internet. That part is outside your Microsoft 365 service boundary, so when it comes to web data, you’re leaving that trusted boundary before going back to the large language model.

Even when the query leaves your boundary, there are still safety guardrails:

Admins can turn web search off. Because data leaves the tenant, even anonymized, some organizations prefer to disable it.
Users can switch between work and web. In work mode, Copilot can use their work data as well as the web. In web mode, it uses the web and the context they give it, but not their work data.
The query is anonymized. No identity and no files leave your tenant.
A safety filter runs before the answer gets back to the user. The answer also comes with citations, so the user can verify where the information came from.

So yes, some information does leave your service boundary, but it’s only a short query generated by Copilot. It’s not the full prompt, it’s not any file, and the user’s identity stays safe inside the tenant.

Four things to remember for the AB-900 exam

There are four things I want you to remember for the AB-900 exam about how Copilot keeps your information safe:

Copilot reads only what the requesting user can read. No backdoors, no elevated service account, no admin shortcut. It will never surface data the user doesn’t have access to.
Copilot always respects your compliance settings, such as data loss prevention policies, sensitivity labels and data residency.
Your work data stays in your Microsoft 365 boundary, including your documents and identities.
Microsoft Purview and Microsoft Defender XDR make sure everything is logged, and anything suspicious is escalated according to the policies you have in place.

Microsoft sometimes groups those into four principles: data minimization, transparency, content filtering and auditability. My AB-900 study guide maps the rest of the skills measured.

What this means for you

So the work answers follow your permissions, and the web answers? Well, that’s a switch. Both are things you control as an admin, which is why this mental model matters before you roll Copilot out.

On the work side, Copilot only shows people what they can already access, so the protection and governance tools you already have, from permissions to Restricted Content Discovery to Purview labels and data loss prevention, are the tools that shape what Copilot can use. On the web side, decide whether your organization is comfortable with an anonymized query leaving the service boundary. The control is the Allow web search in Copilot policy, which Microsoft documents in its data, privacy and security guide for web search in Copilot.

If you’re preparing for the exam, those four points are the ones to know cold. I also shared what to expect on the AB-900 exam after I took it.

Ready to get AB-900 certified? This lesson is part of my AB-900 certification path on Pluralsight, which covers the core Microsoft 365 services, data protection and governance, and the basics of Copilot and agent administration. Later in the path, I show you exactly where to turn web search on or off in the Microsoft 365 admin center. Start the AB-900 path on Pluralsight.

Identity Secure Score in Microsoft Entra ID: What to Fix First

Vlad Catrinescu — Tue, 06 Oct 2026 17:17:43 GMT

Microsoft gives every tenant a score for how protected your identities are, and it’s included in every Microsoft Entra ID license. Have you checked yours? It’s called Identity Secure Score, and it’s a lot more useful than a report card, because it ranks every recommendation by how much risk it removes, so you can see which moves are worth the most points.

Key takeaways

Every Microsoft Entra ID tenant has an Identity Secure Score, Free edition included, and you’ll find it right on the home page of the Microsoft Entra admin center.
Each recommendation is worth points based on how much it reduces your identity risk, so the ones worth the most points are the ones to tackle first.
If you only do one thing, require multifactor authentication for administrative roles, because an attacker who gets into an admin account without it is in control of your tenant.
Microsoft recalculates your score every 24 hours, and it can go down as well as up, for example when you add users and don’t secure them properly.
Microsoft Copilot (formerly Microsoft 365 Copilot) answers with whatever each identity can reach, so your identity posture really is your Copilot posture.

What Identity Secure Score measures

Almost every breach we see in the news these days starts the same way, with someone’s credentials getting compromised. But before you can improve your identity security, you need a way to measure it, and luckily for us, Microsoft built a feature that sums up your identity security posture in a single number. That feature is Identity Secure Score, and whether you’re on Entra ID Free or Entra ID P2, your tenant already has one, even if nobody has opened it yet.

Its whole job is to help you decide what to fix first. It ranks every recommendation by how much it would reduce your identity risk, and the bigger the security impact, the more points you get for implementing it. So if, for example, one recommendation moves your score by eight points and another moves it by two, you know exactly which one to tackle first.

How the score updates, and where else it shows up

Your score shows up as a percentage, and Microsoft recalculates it every 24 hours, so when you make a change, you’ll see the improvement within a day. That works both ways, though. Add a new identity without securing it properly, and you can watch your score go down just as quickly.

Your identity score also syncs into Microsoft Secure Score in the Microsoft Defender portal, where it sits alongside the scores for your apps and devices, so your security team gets one view across every pillar. From an Entra point of view, though, this is the score for Entra admins. It’s the full identity picture, the part you can actually do something about, while your security admins in Defender keep an eye on the whole tenant.

Which recommendations have the biggest impact?

The top one is requiring multifactor authentication for administrative roles, at 10 points, and close behind it, at 9, is making sure all your users can complete multifactor authentication. You’ll also see recommendations for a sign-in risk policy, a user risk policy and a policy to block legacy authentication. There are plenty of others, of course, and Microsoft keeps adding and removing them as identity security evolves (and, unfortunately, as hackers evolve too). So it’s worth checking your score often and keeping it as high as you can.

Require multifactor authentication for administrative roles

Ten points is the most Microsoft gives any single recommendation, and for good reason. If an attacker compromises any admin account that isn’t protected by multifactor authentication, and especially a Global Administrator account, they’re now in control of your tenant. So if you only do one single thing after reading this, make it this one.

A sign-in risk policy uses Microsoft Entra ID Protection to automatically challenge sign-ins that look risky, for example by asking for multifactor authentication. ID Protection is also what flags a user signing in from Germany five minutes after they were active in Canada, and unless your users have a teleporter, that’s exactly the kind of sign-in you want flagged.

Protect all users with a user risk policy

If Microsoft finds a user’s credentials leaked on the dark web, a user risk policy automatically makes that user reset their password the next time they sign in.

I think this is a really cool feature, because there are so many sites, forums and credential dumps out there that only dedicated security professionals and hackers know about. You’ve probably never heard of most of them, which is for the best. Microsoft runs a large-scale credential scanning operation that pulls from those sources, from law enforcement and from its own threat intelligence teams, and it checks what it finds against your users’ current passwords in Entra ID. When there’s a match, the policy forces that password reset, so your identities stay protected around the clock. If your users are synced from on-premises, this relies on password hash sync.

Enable policy to block legacy authentication

Legacy protocols, like basic authentication for Exchange, can’t enforce multifactor authentication at all, and attackers know it, so they specifically target those protocols to get around your modern security. This one is worth 7 points, and Microsoft’s own analysis found that more than 99 percent of password spray attacks use legacy authentication protocols.

Identity Secure Score on the AB-900 exam

If you’re studying for the AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals certification, this one is worth your time, because interpreting Identity Secure Score in Microsoft Entra ID is one of the skills measured in Microsoft’s AB-900 study guide. For the exam, remember that Identity Secure Score ranks recommendations by how much risk they reduce, so the bigger the security impact of an action, the more points it adds to your score.

And if you want to know what else to expect on exam day, my AB-900 exam review walks through the question types and the resources I recommend.

Checking the score in a real tenant

You don’t have to go hunting for it. Sign in to the Microsoft Entra admin center, and your Identity Secure Score is right there on the home page, in the Tenant status card at the top right. In my lab tenant, it’s been pretty static at around 46 to 47% for the past two or three months, so clearly I’ve got some homework to do as well.

Select View recommendations, give it a second to load, and you’ll see everything you can do to improve your score. All shows every recommendation, which in my tenant includes security best practices and a few from Microsoft Defender for Identity. The Security filter narrows the list down to the ones that count toward your score.

The first one on my list is Protect your tenant with Insider Risk condition in Conditional Access policy, which brings the insider risk signal from Microsoft Purview into your Conditional Access policies. It needs a Microsoft Entra ID P2 license, and completing it would get me an extra five points, which is pretty cool.

Select any recommendation and you get the full story: its status (Active, in my case), the date it was checked, and the users it affects. Right now, eight out of eight users in my tenant aren’t covered by an insider risk condition in a Conditional Access policy, so the more users I add to that policy, the better my score gets.

Why your score can go down

The second recommendation on my list, Enable self-service password reset, sits at 0.22 out of 1. That looks like a funny score until you open it and see that seven users in my tenant don’t have self-service password reset enabled, which is why I only get part of the point.

Microsoft scores some recommendations all or nothing, and others as a percentage, like the share of your users who are covered, which is exactly where a number like 0.22 comes from (Microsoft’s documentation walks through the math). It’s also why your score can go down. If you add new users and don’t secure them properly, that one point shrinks, because a bigger share of your users is missing the recommendation.

So at a high level, that’s Identity Secure Score: a list of recommendations, plus a score that tells you where your identity security posture stands today and what you can do to improve it in Entra ID.

What this means for you

Microsoft Copilot answers with whatever each identity can reach, so your identity posture really is your Copilot posture. If you want the bigger picture on that, I cover it in why generative AI amplifies the security risks you already have.

So go check your score in the Microsoft Entra admin center today:

Open View recommendations from the Tenant status card on the home page, and pick the Security filter.
If Require multifactor authentication for administrative roles isn’t complete, start there, because that’s the one I’d do first.
Check the Required licenses column before you plan anything, since some recommendations need Microsoft Entra ID P1 or P2.
Come back often, because Microsoft keeps adding and removing recommendations as identity security evolves.

And if your sign-in risk or user risk policies still live in ID Protection, it’s time to move them to Conditional Access, because Microsoft set October 1, 2026 as the retirement date for those legacy risk policies.

Ready to prepare for the AB-900? Identity Secure Score is just one piece of my AB-900 certification path, which covers the core Microsoft 365 services, data protection and governance, and the basics of Copilot and agent administration. You’ll find this topic in Identify the Core Features and Objects of Microsoft 365 Services, the first course of the full AB-900 path on Pluralsight. And for free resources plus my notes on every skill measured, grab my AB-900 study guide.

AB-650 Exam Review: Where Your Study Hours Should Really Go

Vlad Catrinescu — Tue, 06 Oct 2026 02:57:07 GMT

I took the AB-650 exam while it was still in beta. If I had planned my study time around the exam’s title, I would have studied the wrong things, and that’s the main thing I want you to know before you book it. Of course I can’t share any questions because of the NDA which we should all respect, but in this blog post, I want to share with you where I’d put your study hours and what to expect on exam day.

Key takeaways

The biggest part of the AB-650 is Govern and secure Microsoft 365 tenants and workloads, at 40-45% of the exam, and it’s mostly Microsoft Entra and Microsoft Purview.
For Purview, you need to know how to configure things like DLP policies and sensitivity labels, not just what they do.
Settings for Microsoft Copilot (formerly Microsoft 365 Copilot), Microsoft Agent 365 and SharePoint Advanced Management change fast, so click through them yourself before the exam.
Expect PowerShell, including knowing which older modules Microsoft doesn’t recommend anymore.
If this is your first Microsoft exam, start with the AB-900 and the SC-900.
If you were planning on the MS-102, it retires on November 30, 2026, and Microsoft recommends the AB-650 instead.

What the AB-650 exam really tests

The exam is called Administering Microsoft 365 and AI Services, and passing it gets you the Microsoft 365 and AI Services Administrator Associate certification. Microsoft first announced it as the AI Services Administrator Associate, so you’ll see both names out there. If you read either name and go straight to booking, you’ll walk in expecting a Microsoft 365 administration exam with some Copilot on top.

That’s not really what this is. My exam had a lot of Microsoft Entra and a lot of Microsoft Purview, and not that much Microsoft 365 directly. Everything was still about things that affect Microsoft 365, so it makes sense once you’re sitting there. It’s just not where I would have put my study hours based on the title alone.

And I have to be fair to Microsoft, because the study guide does tell you this. Look at how the exam is split, and Govern and secure Microsoft 365 tenants and workloads is worth 40-45%. That’s the biggest area by far, almost half of the exam, and it’s almost entirely Entra and Purview, with Microsoft Defender for Office 365 in there as well.

Skill area	Weight	What’s in it
Configure and manage Microsoft 365 tenants and workloads	20-25%	Tenant settings, domains, licenses, Microsoft 365 Backup, mailboxes, teams and SharePoint sites
Govern and secure Microsoft 365 tenants and workloads	40-45%	Microsoft Entra identities and authentication, Microsoft Defender for Office 365, Microsoft Purview
Manage and secure AI services in Microsoft 365	35-40%	Copilot settings, agents and Microsoft Agent 365, AI usage and cost monitoring

Even the AI part brings Entra back in, since agents now get their own identities through Microsoft Entra Agent ID. You can see the full breakdown in the AB-650 study guide on Microsoft Learn.

So the information is right there. It’s the exam title and the AI Services Administrator name on the certification that pull your attention toward Copilot and agents, when about half of the exam is identity and data protection.

My advice is the same one I’ve been giving IT pros for years, for every exam. Don’t just look at the title, and don’t just look at the marketing around it. Look at the study guide and at how Microsoft splits the exam, because the two don’t always tell the same story. Study everything, but if you’re going to over-invest anywhere, over-invest in Microsoft Entra and Microsoft Purview.

What I would brush up on

Let’s get a bit more practical. I’m calling out these areas because a lot of Microsoft 365 admins don’t use them day to day.

Microsoft Entra ID

Start with Microsoft Entra ID, and that includes authentication methods and Microsoft Entra Password Protection. Don’t forget that most organizations still have hybrid environments, so you need to know how to configure and manage those too, not just cloud-only scenarios. Password Protection is a good one to practice for that, since you can extend its banned password lists to your on-premises Active Directory with agents on your domain controllers.

Microsoft Defender for Office 365

Next is Microsoft Defender for Office 365. Go play with all the different services inside it, and not just on their own, but also how they integrate with Microsoft Purview.

Microsoft Purview

Speaking of Purview, this isn’t the SC-900, where you just need to know what each product does at a high level. You need to know how to actually configure it: data loss prevention (DLP) policies, sensitivity labels, sensitive information types. Reading about them isn’t enough, so get into the portal and build a few of each.

Copilot and Agent 365 in the Microsoft 365 admin center

This is a big one for the AI part of the exam. You need to know where everything is in the Microsoft 365 admin center for managing Copilot, and for Microsoft Agent 365.

I know what you might be thinking, and I agree: that whole area is brand new and moving fast. That’s how Microsoft ships things today, so remembering a blog post you read three months ago might not be enough. Go click through the admin center yourself before the exam. Microsoft’s study guide even says the exam can include preview features when they’re commonly used.

SharePoint Advanced Management

And don’t forget SharePoint Advanced Management. This is another one where you need to look at the latest, because it moves fast. Restricted Content Discovery, or RCD for short, changed behavior recently. Microsoft announced the change in message center post MC1427972, and the rollout started in late July 2026.

With the new behavior, files you recently accessed on a site with RCD turned on no longer show up for you in Copilot or Microsoft 365 search. Before, if you had recently viewed, edited or shared a file, you could still find it. The update also removes the Copilot button, the AI menus and Create pages with AI from those sites. Some older documentation still describes the old behavior, so make sure you know what changed. I also go deeper on RCD in my post on SharePoint agent governance.

Learn where things live across the admin centers

A broader tip for the entire exam is to learn where things live across the different admin centers. For any given task, know all the places you could configure it, because some settings exist in more than one admin center. Creating a user is the easy example, since you can do it in the Microsoft 365 admin center or in the Microsoft Entra admin center. At associate level, knowing which admin center is best, or which one gives you the option Microsoft is asking about, is an important distinction.

How much PowerShell is on the AB-650?

Because this is an associate exam, you also need to know PowerShell. The PowerShell questions I got weren’t that difficult, but I also spend way more time in PowerShell than the average IT pro, so that might be why they felt easy to me.

At a high level, know which modules you have, how to connect to each service, and what a few commands look like for each module. If you want a quick refresher, these are the main ones:

Service	Module	Connect with
Microsoft Entra ID and Microsoft Graph	Microsoft Graph PowerShell	`Connect-MgGraph`
Exchange Online	ExchangeOnlineManagement	`Connect-ExchangeOnline`
Microsoft Purview (Security & Compliance PowerShell)	ExchangeOnlineManagement	`Connect-IPPSSession`
SharePoint	Microsoft.Online.SharePoint.PowerShell	`Connect-SPOService`
Microsoft Teams	MicrosoftTeams	`Connect-MicrosoftTeams`

You also need to know the past modules. You might get questions where more than one option would work, but some of them use modules that Microsoft doesn’t recommend anymore, like the Azure AD and MSOnline modules that Microsoft Graph PowerShell replaced. So know which modules to use today.

Where to start if this is your first Microsoft exam

If this is your first Microsoft certification exam, or you’re just starting with Microsoft 365 and Copilot administration, I would start with the AB-900 (Microsoft 365 Copilot and Agent Administration Fundamentals) and the SC-900 (Microsoft Security, Compliance, and Identity Fundamentals). They aren’t required for the AB-650, but they give you a lot of the foundation on Microsoft 365, Copilot, Purview and Defender, and you can build up to the associate level from there. My AB-900 study guide and SC-900 study guide have free resources for both.

What to expect on exam day

I can’t share the number of questions on the exam, but Microsoft says most of its exams have between 40 and 60, and you get 100 minutes for an associate exam, or 120 if it may contain labs. For an associate-level exam like this one, expect the more advanced question types too: scenarios, questions where you put steps in the right order (Microsoft calls those build list questions), and pretty much every other question type Microsoft uses. You can try them all in Microsoft’s free exam sandbox.

Is the AB-650 a fair exam?

If I had to give an opinion, I think it’s a really fair exam, and a really fair test of how the job of a Microsoft 365 administrator has changed in the era of AI. For a long time, a lot of us mostly needed to know how to manage SharePoint. Now we need to understand identity better, because identity is the first way people get hacked. We need to understand data protection and Purview. And now we’re governing agents that have their own identities, all on top of the workload administration we already do.

So I think it points people in the right direction, with the right knowledge. Just go in with the right expectations about where the weight actually sits. If you’re a SharePoint, Teams or Exchange admin and you haven’t really touched Purview or Entra ID, learn those before you sit the exam.

What this means for you

If you’re a Microsoft 365 admin, this is the certification that lines up with what the job looks like now. And if you were planning to take the MS-102, keep the date in mind: Microsoft retires it on November 30, 2026, and recommends the AB-650 certification instead.

To get ready, I would go in this order:

Read the AB-650 study guide and check yourself against the Govern and secure section first, since it’s 40-45% of the exam.
In a test tenant, build a few DLP policies, sensitivity labels and sensitive information types, and spend time in Defender for Office 365.
Click through the Copilot and Agent 365 settings in the Microsoft 365 admin center, and read up on the new RCD behavior.
Practice connecting to each service with the current PowerShell modules.
If this is your first Microsoft exam, take the AB-900 and the SC-900 first.

Ready to start studying for the AB-650? My AB-650 study guide covers every skill measured on the exam, with free study notes and resources. And if you want to go deeper on Microsoft 365, Copilot and Purview, check out my 100+ courses on Pluralsight.

AB-620 Exam: What to Expect, Difficulty, and Study Tips

Vlad Catrinescu — Wed, 19 Aug 2026 04:59:33 GMT

The AB-620 exam is the path to the brand-new Microsoft Certified: AI Agent Builder Associate certification, and after taking the beta a few hours ago, I want to share my honest first-look review. If you are deciding whether to sit for this exam, what to study, or whether you are even the right audience for it, this post covers everything I can share without breaking NDA.

Key takeaways

Passing the AB-620 exam earns you the Microsoft Certified: AI Agent Builder Associate certification.
Despite being tagged as an app maker exam on Microsoft Learn, the AB-620 is really built for developers and consultants integrating Copilot Studio with enterprise systems.
Microsoft scrapped the original AB-610 Copilot Studio Agent Maker exam and consolidated everything into the AB-620.
Expect heavy coverage of Azure AI Search, Microsoft Foundry, Microsoft Fabric, the agent-to-agent protocol, and Power Platform pipelines for ALM.
Testing agents and application lifecycle management makes up 20 to 25 percent of the exam, which is enough to make or break a pass.
If you are a Power Platform app maker, the Copilot Studio Applied Skills are likely a better fit than this exam.

What is the AB-620 exam?

The AB-620 is a Microsoft associate-level certification exam currently in beta. Pass it and you earn the Microsoft Certified: AI Agent Builder Associate credential. The official exam name is Designing and Building Integrated AI Solutions in Copilot Studio.

The exam tagline tells you most of what you need to know: Develop and integrate advanced, scalable AI agents using Microsoft Copilot Studio, Power Platform, and enterprise technologies to deliver robust solutions for organizations. In plain language, the AB-620 exam is about putting agents into production, not about the basics of agent building.

Why the AB-620 is really a Copilot Studio developer exam

Here is the most important thing to understand before you register: even though the exam is tagged as an app maker exam on Microsoft Learn, in my opinion that tagging is misleading. The AB-620 is built for developers and consultants who spend almost every workday building agentic solutions that integrate Copilot Studio with Microsoft Foundry, Azure AI Search, Microsoft Fabric, and more.

If you are a citizen developer who occasionally builds a topic in Copilot Studio, this exam will feel out of reach. If you live in Copilot Studio and routinely wire it up to enterprise services, you are exactly the audience Microsoft built the AB-620 for.

Having spent the last decade helping IT pros prepare for Microsoft certifications, I have seen plenty of exam mismatches between the listed persona and the actual content. The AB-620 is one of the more notable examples I have come across recently.

What happened to the AB-610?

A few months ago, Microsoft announced two Copilot Studio certifications: the AB-610 Copilot Studio Agent Maker and the AB-620 Copilot Studio Agent Developer. That two-track approach made sense. The Agent Maker exam would have covered the low-code persona, and the Agent Developer exam would have covered the integration-heavy persona.

Microsoft has since scrapped the AB-610 and consolidated everything into the AB-620. Instead of keeping the original Copilot Studio Agent Developer name, which would have been honest signaling, Microsoft renamed the exam to AI Agent Builder Associate. That broader name suggests both makers and developers belong here, but the content still skews heavily toward the developer side.

For the full backstory on these two exams, see my earlier post on the original AB-610 vs AB-620 Copilot Studio certifications.

What the AB-620 exam actually tests

The meat of the AB-620 exam is about production-grade agents and the advanced scenarios an enterprise will ask about before it ships an agent to production. Do not expect questions about turning generative AI on, what a topic is, or who should be authoring agents. That foundational content is not what this exam is measuring.

What you will see is heavy coverage of how to connect a Copilot Studio agent to enterprise services. Specifically, expect to be tested on:

Connecting a Copilot Studio agent to Azure AI Search
Connecting a Copilot Studio agent to a Microsoft Fabric data agent
Connecting a Copilot Studio agent to a Microsoft Foundry agent
Connecting to partner agents outside your tenant using the agent-to-agent protocol
Designing multi-agent solutions that span those systems

Real production agents today are rarely built entirely inside Copilot Studio. The AB-620 reflects that reality by testing your ability to design solutions that span multiple Microsoft AI services.

Testing agents and ALM with Power Platform pipelines

A second major area of the AB-620 exam covers testing agents and application lifecycle management. This bucket is marked at 20 to 25 percent of the exam, which sounds modest on paper but is more than enough to be the difference between pass and fail.

You need to know all the ways to test Copilot Studio agents and how to implement application lifecycle management for agents using Power Platform pipelines. The exam expects you to be able to take an agent from a development environment, through any required validation, and all the way to production while following a proper ALM process.

The takeaway is that the AB-620 does not assume you are only a builder. It assumes you own the full lifecycle of an agent, from build to release.

How to study for the AB-620 exam

The single best piece of advice I can give is to do every scenario in the exam objectives at least once before sitting down. Go to Microsoft Learn, pull up the AB-620 study guide, and work through the tasks hands on:

Connect a Copilot Studio agent to Azure AI Search.
Connect a Copilot Studio agent to a Microsoft Foundry agent.
Connect a Copilot Studio agent to another Copilot Studio agent.
Experiment with the agent-to-agent protocol so you know what it is and why it exists.
Build a deployment flow for an agent using Power Platform pipelines.

Why does hands-on practice matter so much? Because every associate-level Microsoft exam, including this one, leans heavily on order-list questions. You will be asked, “you want to do this, put the following steps in the correct order.” If you have not configured the scenario recently, those questions are punishing. If you have walked through it once, they become almost free.

The other point worth flagging is the question weighting. Microsoft did honor the study guide in the sense that nothing showed up in my beta that was not on the published exam objectives. However, the percentage of questions from each bucket felt off compared to the weights listed on the study guide. I cannot share which buckets were over-represented or under-represented due to NDA, but my recommendation is the same as it always is for a beta: study every skill area equally and do not lean on the weights as a planning tool.

Exam format, questions, and Microsoft Learn access

A few practical notes about the exam itself:

The number of questions is always between 40 and 60. I cannot share the exact count for the AB-620.
You have access to Microsoft Learn during the exam, just like every other associate-level exam. I did not end up using it, but it is there if you need to verify something.
Expect associate-level question types: scenario-based questions, order lists, and multi-step problems. This is not the difficulty level of a fundamentals exam.
Labs may show up. Microsoft does not publish whether a given exam includes hands-on labs, and I cannot share what was on my exam, but be prepared for the possibility.

AB-620 vs Copilot Studio Applied Skills

If you are a Power Platform app maker who does not spend all day in Copilot Studio, the AB-620 is probably too advanced for where you are right now. The better path is the Copilot Studio Applied Skills. There are two of them available, and they validate hands-on Copilot Studio skills without the integration-heavy enterprise scope of the AB-620.

If you want a deeper look at the lab-based credential for Copilot Studio, see my APL-7008 study guide for creating agents in Microsoft Copilot Studio.

The AB-620 is still a great goal if your job is to become a full-time Copilot Studio agent builder, or if you are already a developer integrating AI services across the Microsoft stack. For everyone else, the Applied Skills path will give you a recognized credential without the steep developer-focused prep.

What this means for you

The AB-620 is a high-value certification for a narrow audience: developers, consultants, and architects building production-grade agents that span Copilot Studio, Azure AI Search, Microsoft Foundry, Microsoft Fabric, and Power Platform. If that describes your day-to-day work, this exam validates the skills you are already using and is well worth the prep time.

If you are a citizen developer, business user, or IT pro who builds simple Copilot Studio agents on the side, this exam is not the right next step. Start with the Copilot Studio Applied Skills instead. They give you a recognized credential without asking you to master enterprise integration patterns you may never use.

Before you register, pull up the AB-620 exam objectives on Microsoft Learn and do an honest gap analysis. If you can do each task on the list without looking it up, you are ready. If half the objectives are unfamiliar, build hands-on time with the missing scenarios before scheduling the exam. Beta exams take longer to score, so plan accordingly if you are aiming for a specific certification deadline.

Ready to build your Copilot Studio skills the right way? I have over 100 courses on Pluralsight covering Microsoft 365, Power Platform, and Copilot, including hands-on agent building. Browse the full course catalog on Pluralsight to find your next step.

Free Microsoft Fabric Certification: Fabric Data Days Guide

Vlad Catrinescu — Wed, 15 Jul 2026 17:21:02 GMT

Right now you can earn a free Microsoft Fabric certification thanks to Fabric Data Days, a Microsoft event handing out 100% off certification exam vouchers for Fabric and SQL. There are only 20,000 vouchers available, and the deadline to request one is August 10, 2026. This guide walks you through which exams qualify, the three steps you need to complete, and how to claim your voucher before they run out.

Key takeaways

Fabric Data Days gives you a 100% off voucher for a Microsoft Fabric or SQL certification exam, so the exam is completely free.
Three certifications qualify: the DP-600, the DP-700, and the DP-800.
To qualify, you complete three tasks: join the Microsoft Fabric Community, watch two Data Days sessions, and finish three Microsoft Learn modules.
Only 20,000 vouchers are available, and the request deadline is August 10, 2026.
Your voucher arrives as a Microsoft Fabric Community private message, not an email, and it can take up to two weeks to hear back.

What Fabric Data Days is and what you get

Fabric Data Days is a Microsoft event built around learning the Microsoft Fabric and SQL data platforms, and this year it comes with a strong incentive. When you complete a short set of learning tasks, Microsoft gives you a voucher that covers 100% of the cost of a qualifying certification exam. In other words, you study for the exam and you take it for free.

The offer is genuinely time sensitive. Microsoft has set aside 20,000 vouchers, and once they are claimed, the offer is done. On top of that, you have to submit your request by August 10, 2026, so this is not something to leave for the last minute.

This is one of the better certification deals Microsoft runs, because two of the three qualifying tasks double as real exam preparation. You are not jumping through hoops for a discount. You are studying for the exam you want to pass, and the voucher is the reward.

Which free Microsoft Fabric certification can you get?

Three certifications qualify for the free voucher, and you choose one when you submit your request:

DP-600: Microsoft Certified: Fabric Analytics Engineer Associate. Best if you focus on analytics, semantic models, and turning data into insights with Power BI and Fabric.
DP-700: Microsoft Certified: Fabric Data Engineer Associate. Best if you build and manage data engineering solutions, pipelines, and lakehouses in Microsoft Fabric.
DP-800: Microsoft Certified: SQL AI Developer Associate. Best if you develop AI-enabled database solutions across Microsoft SQL Server, Azure SQL, and SQL databases in Microsoft Fabric.

My advice is simple: pick the certification that lines up with the work you already do, or with the role you are aiming for next. A voucher only helps if it leads to a credential you will actually use.

How to qualify for your free exam voucher

Qualifying is straightforward. There are three tasks, and two of them help you study for your exam at the same time.

Step 1: Join the Microsoft Fabric Community

First, you need to join the Microsoft Fabric Community, which is completely free. If you are not a member yet, sign up and make sure you are logged in, because this is also where your voucher will eventually be delivered.

Step 2: Watch two Data Days sessions

Next, watch two Data Days sessions. You can attend them live or watch them on demand, so you are not locked into a specific time slot. Watching live has one advantage: you can ask questions during the session. Either way, many of the sessions map directly to exam topics, so this time counts toward your preparation.

Sessions are scheduled through the week of August 3rd, and they are offered in several languages, including English and Portuguese. Most run about 30 minutes, so watching two takes roughly an hour.

One important tip: write down which two sessions you watched. You will need to name them later when you fill out the request form.

Step 3: Complete three Microsoft Learn modules

Finally, complete three Microsoft Learn modules from the designated collection. The collection is organized by exam, with a separate section for the DP-600, the DP-700, and the DP-800, so every module you finish is relevant to the certification you are targeting.

Before you start, sign in to Microsoft Learn. When you are signed in, your progress saves to your profile, and you will have a clear record of exactly which modules you completed, which you also need for the form.

How to fill out the voucher request form

Once your three tasks are done, it is time to fill out the request form. The form is short. You select your country and the exam you plan to take, then answer a few quick questions: why you want to get Microsoft certified, which two sessions you watched, and which three modules you completed. This is why noting your sessions and modules along the way makes the form painless.

The form also asks whether you already hold any Microsoft certifications and whether you work for a Microsoft partner organization. Finally, you agree to the terms and conditions and submit. That is all there is to it.

The fine print: vouchers, deadline, and expiration

Three details are worth keeping front of mind before you start:

There are only 20,000 vouchers. Once they are gone, they are gone, so the sooner you complete the steps, the better.
The request deadline is August 10, 2026. Get your form in before then.
Your voucher comes with an expiration date. Book and take your exam before that date, or the voucher is wasted.

The whole program is time-sensitive from start to finish, so treat every date as a hard deadline.

What to expect after you submit

After you submit the form, do not expect an instant response. Two things are important to know so you are not caught off guard.

First, your voucher is delivered as a Microsoft Fabric Community private message, not by email. Keep an eye on your community inbox rather than watching your email.

Second, it can take up to two weeks to hear back on whether you are eligible. Submit your request, then be patient. As long as you completed the steps and got your form in before the deadline, you are in the queue.

What this means for you

If a Microsoft Fabric or SQL certification has been on your list, this is one of the easiest times to pursue it. The exam that would normally cost you money becomes free, and most of the effort to qualify is effort you would have spent studying anyway.

As a Microsoft MVP who has helped IT professionals prepare for certifications for years, my honest take is that the biggest risk here is waiting too long. With a capped number of vouchers and a firm August 10, 2026 deadline, the people who move early are the ones who get certified for free.

Here is your action plan. Decide which certification fits your role, whether that is the DP-600, the DP-700, or the DP-800. Join the Microsoft Fabric Community, watch two Data Days sessions, and complete three Microsoft Learn modules, noting each one as you go. Then submit the request form, watch your community inbox, and book your exam as soon as your voucher arrives so you comfortably beat its expiration date.

Get certified for free before the deadline

Ready to claim your free Microsoft Fabric certification? Complete the three tasks, then submit your request through the official Fabric Data Days form.

The vouchers are capped at 20,000, and the deadline is August 10, 2026, so the sooner you start, the better your odds.

If you want to keep up with deals like this, I cover Microsoft certification news and free voucher offers regularly, including a past round where you could also get certified in Microsoft Fabric for free, a free Microsoft certification voucher through AI Skills Fest, and a limited-time offer to save 50% on the DP-700 exam. To prepare for your exam once your voucher arrives, my Pluralsight courses cover Microsoft data and analytics topics in depth.

AB-410 exam: what to expect, difficulty, and study tips

Vlad Catrinescu — Mon, 13 Jul 2026 19:58:08 GMT

The AB-410 exam is Microsoft’s new Power Platform certification for the AI era, and after taking it while it was still in beta, I can tell you it does a great job of capturing how big the Power Platform really is. This post breaks down what the AB-410 exam covers, the things that surprised me, and exactly how I would prepare if I were sitting it today. I will not touch anything under NDA, so think of this as pointers on what to study and how to get ready, not a list of questions.

Key takeaways

The AB-410 is the AI-era successor to the PL-200, shifting the persona from Power Platform functional consultant to an app builder who brings AI into the solutions you build.
The exam tests real breadth across Dataverse, model-driven apps, canvas apps, Power Automate, business logic, and AI, not one narrow corner of the platform.
The AI focus is about enhancing apps you have already built, not using AI to generate an app from scratch.
Business process flows, application lifecycle management (ALM), and security show up more than the study guide suggests.
Expect roughly 50% overlap with the PL-200, so existing Power Platform skills carry over, but you will need to skill up on using AI inside the Power Platform.
Microsoft targeted July 2026 for general availability, with a chance it slips into August.

What the AB-410 exam is and where it fits

The AB-410 is the exam for the Microsoft Certified: Intelligent Applications Builder Associate certification. It is part of Microsoft’s new AB series of exams, and it takes the place of the old PL-200. If you searched for the AB-410 and landed here, that is the short version: this is the credential that now sits where the PL-200 used to.

The persona shifted along with the exam code. The PL-200 was aimed at the Power Platform functional consultant. The AB-410 is aimed at an app builder who brings AI into the solutions they build. That is a meaningful change in focus, but the foundation is the same platform, so if you already have a PL-200 background, this is a natural next step rather than a fresh start.

Overall, I really like this exam. It sits at the right level for an associate certification, and more than anything, it reflects how mature and how large the Power Platform has become.

What the AB-410 exam actually tests

You are not tested on just a little slice of the Power Platform. The AB-410 spans Dataverse, model-driven apps, canvas apps, Power Automate, business logic, and the AI pieces that sit on top of all of it. That breadth is the whole point. Passing it says you can build real solutions across the platform, not just configure one feature in isolation.

The official study guide organizes the skills measured into three areas:

Create a foundation for intelligent applications (25 to 30%)
Create intelligent applications (25 to 30%)
Build business application logic and automation (40 to 45%)

That last area carries the most weight, so business logic and automation deserve the bulk of your study time.

How AI really shows up on the exam

Here is the nuance I most want you to walk away with, because it is easy to misread the study guide. The AI on this exam is not really about using AI to build the app for you. The study guide mentions building with natural language and features like generative pages, but in my experience, that was not the bulk of it.

Instead, the AI was about enhancing apps you already built. It was less “AI, go make me an app” and much more “I already have an app, how do I make it smarter?” Personally, I am a big fan of that framing, because it mirrors how enterprises are actually adopting AI today.

The questions also felt like genuine enterprise scenarios rather than throwaway sample apps. That matters, because it means passing the AB-410 says something real about whether you can handle enterprise work.

Three things that surprised me on the AB-410 exam

A few things stood out enough that I want you to prepare for them specifically.

Power Automate is a supporting character, not the star

I was happy to see Power Automate on the exam, but a lot of the Power Automate questions were not really about building inside Power Automate itself. They were about how you use Power Automate from other places, like an app calling a flow. So treat Power Automate as a supporting character in a bigger solution, and study how it connects to apps and data rather than only how to build a flow in isolation.

Business process flows are back

I was surprised by how much business process flows showed up. For the past three or four years, Microsoft has been pulling them out of Power Platform certifications, so it was easy to assume they were fading away. They are not. Business process flows are still essential when you work with data and records, so do not sleep on them.

Do not ignore ALM and security

In the study guide, application lifecycle management is basically one bullet point and security is roughly one line. In practice, both came up exactly as they would on a real project. Make sure you understand solutions, environments, and the security model, even if the study guide makes them look like an afterthought.

How to study for the AB-410 exam

My biggest piece of advice, especially if you already have Power Platform skills, is to take the apps, solutions, and flows you have already built and practice infusing AI into them. Pull up an old lab with an existing solution and ask yourself how you would add small AI features to make it better.

Maybe the app calls a flow, and that flow calls an AI Builder prompt. Maybe you embed the AI directly in the app instead. The study guide files these capabilities under the AI Hub, though many of us still call it AI Builder. Either way, go build a few practice projects that consume both prompts and models, from both an app and a flow.

On top of that, make sure your Dataverse fundamentals are solid. You need the basics like table relationships and views, but also newer pieces like prompt columns.

All of this assumes you already have a solid Power Platform base, because the platform is mature now. If you are truly brand new to everything, do not start here. Start with the PL-900 to build your foundation, then come back for the AB-410.

If you took the PL-200, I would estimate roughly a 50% overlap between it and the AB-410. A lot of your fundamentals around building apps and flows carry straight over. To pass this one, you will need to skill up on using AI inside the Power Platform, and honestly, that is a good thing.

AB-410 exam logistics: format, length, and Microsoft Learn access

A few quick logistics worth knowing before you book. I cannot share the exact number of questions, but Microsoft exams generally land somewhere between 40 and 60. For an associate exam like this one, expect the more advanced question types, including scenarios that have multiple questions attached to them.

One useful thing: you get access to Microsoft Learn right inside the exam, so you have a safety net if you need to look something up. Do not lean on it too heavily, though. The clock is running, and those scenario questions take real time to read, so you still want to know your material cold.

Finally, timing. I took the AB-410 while it was in beta. Depending on when you are reading this, it may already be generally available. Microsoft was targeting July 2026 for general availability, and I would not be surprised if it lands in August instead.

What this means for you

If you are already a Power Platform builder, the AB-410 is a strong target that proves you can bring AI into the apps you build. The fastest path to being ready is to stop studying AI as a separate topic and start layering it onto solutions you already know how to build. That single shift covers most of what makes this exam different from the PL-200.

If you are newer to the platform, resist the urge to jump straight to an associate exam. Earn the PL-900 first, get comfortable with Dataverse, apps, and flows, then return for the AB-410 once the fundamentals are second nature. As a Microsoft MVP who has authored 100+ Pluralsight courses on these technologies, I can tell you that a solid base makes the AI layer far easier to absorb.

On timing, keep an eye on the certification’s status. If it is still in beta when you sit it, your score arrives after the beta period closes and the exam goes live. If it has reached general availability, you get your result the usual way.

Ready to prepare for the AB-410? Start by refreshing the fundamentals this exam builds on. My PL-200 study guide is the best place to see how much carries over, and if you are earlier in your journey, the PL-900 study guide will get your foundation solid before you tackle the AI layer. You can also work through my Power Platform courses on Pluralsight to build hands-on experience with apps, flows, and Dataverse.

APL-3010 Retirement: What It Means and What to Take Instead

Vlad Catrinescu — Fri, 26 Jun 2026 13:20:33 GMT

The APL-3010 retirement is official: Microsoft is retiring the Implement a Data Warehouse in Microsoft Fabric applied skill on June 30, 2026. After that date you can no longer earn it, but it stays free to take right up until the deadline, and once you pass, it remains on your Microsoft transcript permanently. Below is exactly what the credential covered, what an applied skill retirement actually means for you, and which Microsoft Fabric credentials are worth pursuing now.

Key takeaways

The APL-3010 Implement a Data Warehouse in Microsoft Fabric applied skill retires on June 30, 2026.
It is free to take until then, with no proctoring and no scheduling required.
Applied Skills do not expire. Once you pass, the credential stays on your transcript for good.
This is the third Microsoft Fabric applied skill to retire in six months.
Strong replacements remain: the APL-3008 Real-Time Intelligence applied skill, plus the DP-600 and DP-700 certifications.

What the APL-3010 Applied Skill Covered

The APL-3010 applied skill validated that you could build a data warehouse in Microsoft Fabric from end to end. That meant creating the data warehouse itself, then loading, transforming, and querying your data inside it. It also covered modeling a proper star schema with fact and dimension tables, and managing security on top of everything.

It was a well-rounded, lab-based assessment aimed at the Data Engineer role at an intermediate level, and it rewarded anyone comfortable working in T-SQL. If you have ever stood up a warehouse and shaped data for reporting, the scenario felt familiar.

When the APL-3010 Retirement Happens

The APL-3010 retirement takes effect on June 30, 2026, and the assessment remains free to take until that date. There is no exam fee, no proctor, and nothing to schedule. It is a hands-on lab you can launch and complete on your own time, which means you can realistically earn it in a single afternoon.

That combination of free and low-friction is the reason to act now rather than later. Once the date passes, the option is gone.

What an Applied Skill Retirement Actually Means

An applied skill retirement works differently from a certification expiring, and the distinction matters. Applied Skills do not expire. After an applied skill retires, it shows as an active credential on your transcript for two years, then moves to your historical credentials. Either way, it remains on your transcript permanently as something you have passed.

In practice, that makes taking the APL-3010 before the deadline almost risk-free. You invest an afternoon, you pass, and the credential stays on your record for good with nothing to renew. If you are still mapping out how these credentials differ, my breakdown of Applied Skills versus certifications explains it in full, and how to get Microsoft Applied Skills walks through the process step by step.

A Bigger Wave of 2026 Microsoft Retirements

This is not the first Fabric applied skill to go this year. Earlier in 2026, Microsoft already retired the Data Science and Machine Learning applied skill and the Implement a Lakehouse in Microsoft Fabric applied skill. With the data warehouse one now joining them, that is three Microsoft Fabric applied skills retired in six months.

Zoom out and the pattern is even clearer. In 2026 alone, Microsoft is retiring or replacing around 14 certifications and 13 separate applied skills, and the Microsoft fiscal year is not even over yet. Having covered Microsoft credential changes on this blog for years, I can tell you this has been one of the busiest stretches of retirements I have seen. If a Microsoft credential has been on your list, this is the year to pay attention. For the full picture, see my running guide to Microsoft certification retirements in 2026.

Which Microsoft Fabric Credentials to Take Instead

The good news is that losing this one does not leave you short on Microsoft Fabric options.

If you want to stay on the applied skills track, look at the APL-3008 Implement a Real-Time Intelligence Solution with Microsoft Fabric applied skill. Be aware that it is a very different assessment from the one retiring. It focuses on streaming and KQL rather than data warehousing, but it keeps you building hands-on in Fabric.

If you would rather earn a certification, Microsoft has been investing heavily in the Fabric track:

DP-600 Fabric Analytics Engineer Associate, a strong fit if you lean toward the analytics and Power BI side.
DP-700 Fabric Data Engineer Associate, the natural next step if you are coming from a data warehouse background.

What the APL-3010 Retirement Means for You

If you have ever considered the Implement a Data Warehouse in Microsoft Fabric applied skill, take it before June 30, 2026. It is free, it takes about an afternoon, and it stays on your transcript permanently once you pass. There is very little downside to grabbing it while you still can.

If you are planning a longer Microsoft Fabric learning path, shift your attention to the credentials that are sticking around. Coming from a data warehouse background, DP-700 is the cleanest next move. If your work leans toward analytics and Power BI, DP-600 fits better, and the APL-3008 applied skill is there if you want to validate real-time and streaming skills.

The one hard deadline to remember is June 30, 2026. After that, the APL-3010 is no longer available to earn.

Ready to go deeper on Microsoft Fabric? Whether you are studying for DP-600 or DP-700, my Microsoft Fabric and data courses on Pluralsight walk through the concepts hands-on, and Microsoft’s official APL-3010 study guide is a great free starting point while the assessment is still available.

Copilot Studio Applied Skill APL-7008 Is Retiring June 30

Vlad Catrinescu — Thu, 25 Jun 2026 14:01:16 GMT

Microsoft is retiring the Create Agents in Microsoft Copilot Studio Applied Skill, known by its code APL-7008, on June 30, 2026. If you have been meaning to add this Copilot Studio Applied Skill to your transcript, you have until the end of June to earn it for free, and after that it is gone. Below is what the credential covered, what the retirement actually means for your transcript, and which Copilot Studio credentials you can still earn once it is gone.

Key takeaways

APL-7008, the Create Agents in Microsoft Copilot Studio Applied Skill, retires on June 30, 2026.
It is free, it is not proctored, and it runs as an interactive lab, so you can earn it in a single sitting.
Applied Skills never expire. Once you pass, the credential stays on your Microsoft transcript permanently.
After June 30, the Enhance Agents with Autonomous Capabilities Applied Skill and the AB-620 AI Agent Builder Associate certification are your remaining Copilot Studio options.
This is one piece of a much larger shake-up. We are not even halfway through 2026, and Microsoft has already retired or replaced 14 certifications and 13 Applied Skills.

What the Copilot Studio Applied Skill (APL-7008) covered

APL-7008 validated your ability to build a custom agent from start to finish in Copilot Studio. It was a well-rounded credential that touched almost every core part of agent building, not just one narrow feature.

The assessment covered creating the initial agent, working with topics and trigger phrases, and configuring the different nodes in a conversation. It also covered managing variables and entities, setting up the generative AI side with knowledge sources and actions, and pulling data from Dataverse to make the agent more useful.

As someone who earned this Applied Skill myself, I can tell you it was a genuinely practical credential. It mapped closely to the work you actually do when you build an agent for a real business scenario.

If you want the full background on the credential, I covered it in detail when this Applied Skill first launched.

Why retiring this credential is a surprise

I will be honest: this retirement caught me off guard. Copilot Studio is exactly where Microsoft is pushing companies right now, so I expected an update to this credential rather than a full retirement.

There is a reason behind it, though. Copilot Studio is going through a massive change as a product. The interface is changing, topics have been deprioritized and tucked away in the new experience, and the platform now leans on skills and more AI capabilities. A refresh would have made sense to me. A complete retirement, with less than two weeks’ notice, still surprised me.

This is not happening in isolation either. The pace of credential changes has been relentless this year, which I broke down in my roundup of every Microsoft certification change in 2026.

What an Applied Skill retirement actually means

Here is where Applied Skills work differently from regular certifications, and it is the part most people miss. Applied Skills do not expire. If you pass one, it shows up as an active credential for two years after the retirement date, and then it moves to your historical credentials.

More importantly, it stays on your Microsoft transcript forever as a credential you have passed. Retirement does not erase it. It simply means no new learners can earn it after the cutoff date.

That is why earning APL-7008 before June 30 is worth doing, even though it is going away. You keep the credential permanently, and right now, you can still take it for free. If you want the bigger picture on how these two credential types differ, I wrote a full comparison of Applied Skills versus certifications.

The Copilot Studio credentials you can still earn

Losing APL-7008 does not leave you without options. Two Copilot Studio credentials are available today, and they cover different audiences.

The first is the Enhance Agents with Autonomous Capabilities Applied Skill. It goes deeper and more niche than APL-7008 did, focusing on the autonomous side of agents, but it is still firmly in the Copilot Studio world, and it is still free.

The second is the AB-620 AI Agent Builder Associate certification. This is a brand new exam aimed at developers and advanced builders creating production-ready agent solutions. I took it myself last month, and I will warn you that it is not an easy one, certainly harder than the title might suggest. I compared it to the maker-focused option in my breakdown of the AB-610 and AB-620 Copilot Studio certifications.

What this means for you

If earning a Copilot Studio credential has been on your list, the next few days matter. APL-7008 is free, unproctored, and you do not need to schedule it. You simply open the assessment on Microsoft Learn and complete the interactive lab, usually in a single sitting. After June 30, 2026, that option disappears.

So the practical move is simple. If you want APL-7008, earn it before the deadline and keep it on your transcript for good. If you miss the window or want to go further, the Enhance Agents with Autonomous Capabilities Applied Skill and the AB-620 certification are both still available.

Whatever you decide, do not assume you can come back to APL-7008 later. Once it retires, there is no way to earn it again.

Ready to earn APL-7008 before it retires? You can take the Create Agents in Microsoft Copilot Studio Applied Skill for free on Microsoft Learn until June 30, 2026. Start the assessment on Microsoft Learn. If you want to sharpen your agent-building skills first, my Pluralsight courses walk through Copilot Studio step by step.

Learning & Credentials | Vlad Talks Tech

Is the AB-400 Harder Than the PL-400? A PL-400 Trainer Weighs In

Why Nathalie took the AB-400 after the PL-400

What changed in the AB-400 exam

Do you need the AB-400 if you already have the PL-400?

What to get hands-on with before the AB-400 exam

Does the AB-400 match what companies are building?

Should the AB-400 be your first Power Platform exam?

Nathalie’s final tip: don’t underestimate it

What this means for you

How Agent Approval Works in Microsoft 365

Agent approval in Microsoft 365 depends on the type of agent

SharePoint agents don’t have an approval process anymore

Agent Builder: the sharing default that surprises most admins

Copilot Studio agents need an admin to approve them

How each approval flow looks in practice

Set the main agent on a SharePoint site

Share an Agent Builder agent

Submit a Copilot Studio agent to the org catalog

Approve or reject the request in the Microsoft 365 admin center

What this means for you

How Microsoft Copilot Accesses Your Work Data and the Web

Why Copilot data access matters for IT pros

Microsoft Graph and Work IQ explained

How Copilot accesses your work data

The safety checks before the large language model

Your prompt isn’t the prompt the model receives

How Copilot accesses web data

Four things to remember for the AB-900 exam

What this means for you

Identity Secure Score in Microsoft Entra ID: What to Fix First

What Identity Secure Score measures

How the score updates, and where else it shows up

Which recommendations have the biggest impact?

Require multifactor authentication for administrative roles

Protect all users with a sign-in risk policy

Protect all users with a user risk policy

Enable policy to block legacy authentication

Identity Secure Score on the AB-900 exam

Checking the score in a real tenant

Why your score can go down

What this means for you

AB-650 Exam Review: Where Your Study Hours Should Really Go

What the AB-650 exam really tests

What I would brush up on

Microsoft Entra ID

Microsoft Defender for Office 365

Microsoft Purview

Copilot and Agent 365 in the Microsoft 365 admin center

SharePoint Advanced Management

Learn where things live across the admin centers

How much PowerShell is on the AB-650?

Where to start if this is your first Microsoft exam

What to expect on exam day

Is the AB-650 a fair exam?

What this means for you

AB-620 Exam: What to Expect, Difficulty, and Study Tips

What is the AB-620 exam?

Why the AB-620 is really a Copilot Studio developer exam

What happened to the AB-610?

What the AB-620 exam actually tests

Testing agents and ALM with Power Platform pipelines

How to study for the AB-620 exam

Exam format, questions, and Microsoft Learn access

AB-620 vs Copilot Studio Applied Skills

What this means for you

Free Microsoft Fabric Certification: Fabric Data Days Guide

What Fabric Data Days is and what you get

Which free Microsoft Fabric certification can you get?

How to qualify for your free exam voucher

Step 1: Join the Microsoft Fabric Community

Step 2: Watch two Data Days sessions

Step 3: Complete three Microsoft Learn modules

How to fill out the voucher request form

The fine print: vouchers, deadline, and expiration

What to expect after you submit

What this means for you

Get certified for free before the deadline

AB-410 exam: what to expect, difficulty, and study tips

What the AB-410 exam is and where it fits