Vlad Talks Tech

Is the AB-400 Harder Than the PL-400? A PL-400 Trainer Weighs In

Vlad Catrinescu — Tue, 03 Nov 2026 14:31:36 GMT

2026 has been a big year for Power Platform certifications, and the latest exam to change is the PL-400. It has been replaced by the AB-400 exam, Extending Microsoft Power Platform Solutions with Code and AI. I’m not a developer, so this isn’t an exam I can advise you on myself, but at the Power Platform Community Conference I sat down with someone who just took it: Nathalie Leenders, a Microsoft MVP and Power Platform consultant and trainer at Wortell.

Key takeaways

The AB-400 replaces the PL-400 as the exam for the Power Platform Developer Associate certification, and it goes much deeper into code than the PL-400 did.
New topics include Power Apps code apps, AI-assisted app building, MCP servers and PCF components combined with AI, on top of the model-driven apps and Dataverse work you already know.
If you already hold the Power Platform Developer Associate certification, you don’t need to take the AB-400 to keep it.
Nathalie doesn’t recommend the AB-400 as a first exam, or to anyone who isn’t a developer: she suggests at least six months of hands-on experience first.
Her biggest tip is to go through every objective in the study guide and get hands-on with anything you haven’t used yet.

Why Nathalie took the AB-400 after the PL-400

What I found impressive is that Nathalie already had the PL-400 and took the AB-400 anyway, just to stay up to date. The PL-400 was actually the very first certification she ever did. She took it as a challenge, with a free voucher from a Microsoft Ignite Cloud Skills Challenge, and she’s honest that she doesn’t recommend that route to anyone.

The PL-400 was, and still is, the most technical Power Platform exam out there. As Nathalie put it, it’s about extending: “So it’s JavaScript, it’s plug-ins, it’s Dataverse. It’s way beyond the standard capabilities of model-driven apps.”

Microsoft was also very quiet about the switch. There was no blog post announcing the AB-400. I only found out because I have some automations that watch the Microsoft Learn pages, and they told me the PL-400 was retiring. Nathalie had been expecting an announcement too, and instead the exam was just there.

What changed in the AB-400 exam

Nathalie took the AB-400 to see what Microsoft now considers “extending” the Power Platform, because the technology has changed so much. She went in prepared for technical questions, but not as technical as they actually were, and it caught her by surprise. As she joked, they extended the scope of the extending exam.

It’s still model-driven apps and it’s still Dataverse, but the exam goes much deeper and adds Power Apps code apps and AI-assisted app building. The questions changed too. The PL-400 had a bit of JavaScript and TypeScript, while the AB-400 shows you a piece of code with a few options, and asks you to choose the right ones and put them in the correct order.

Microsoft’s study guide shows the same shift. The AB-400 is split into four skill areas:

Build Microsoft Power Platform solutions (15-20%)
Extend the user experience (25-30%)
Extend Microsoft Power Platform (35-40%)
Develop integrations (10-15%)

That’s why Nathalie’s advice is clear: if you’re not a developer, don’t take the developer exam this time. Even with her experience building plug-ins and JavaScript, and having taught the PL-400 course, she just about didn’t pass, and she’s going to take it again. She told me she was one checkbox on one question away. That has happened to me a couple of times as well, and I’ve also passed an exam by one checkbox, so it all balances out.

Do you need the AB-400 if you already have the PL-400?

No. The certification doesn’t change: it’s still the Power Platform Developer Associate. If you passed the PL-400, you don’t need the AB-400 to keep being a certified Power Platform developer.

Nathalie took it because she loves certifications, and because she wanted to see which direction Microsoft would take the exam. The catch is that the exam is so new that, when we recorded in late October 2026, there was no learning path and no practice exam yet, only the study guide listing the new topics.

That’s always a challenge with a brand-new exam. Early on, an exam can include content that eventually gets removed as it becomes more balanced, so taking it at the beginning is usually a tougher challenge.

What to get hands-on with before the AB-400 exam

I asked Nathalie what someone who passed the PL-400 a couple of months ago should open a lab and actually try. Her list:

Code apps and AI-assisted app building. You can create an app from a prompt, but she suggests going further into the code itself.
Visual Studio Code connected to the Power Platform. Connect to Power Apps and to an MCP server, and dive into code apps from there.
PCF components combined with AI. The PL-400 focused heavily on extending model-driven apps, Dataverse plug-ins and JavaScript, and the AB-400 goes much deeper into all of that.

There’s a lot of content in the AB-400 that wasn’t in the PL-400. That makes it more fun in a way, but it also goes very deep.

Does the AB-400 match what companies are building?

I asked Nathalie whether the exam lines up with what organizations are building today, or whether it’s more of a Microsoft wish list. Her answer was that it’s a little bit of both.

Microsoft is pushing toward this as the future, but the exam is still heavily model-driven apps, the experience we’re used to, enhanced much more with AI. And companies want to build apps very quickly. In her words: “We used to develop model-driven apps. It would take us weeks to do what we can now do in an hour with AI, and with the generative pages in model-driven apps.” Being able to enhance that with code is what the exam leans toward, and she thinks that’s both what Microsoft wants and what companies are looking for right now.

If you want to see where Microsoft is taking the platform next, my PPCC 2026 keynote highlights cover the biggest announcements from the same conference where Nathalie and I sat down.

Should the AB-400 be your first Power Platform exam?

It depends on how quickly you pick things up, because the AB-400 is a very broad exam. The PL-400 was already big, and this one covers a lot more. If you’re starting out in the Power Platform, Nathalie doesn’t recommend going for it first, the way she did years ago when the PL-400 had a smaller scope. She’d want at least a few months, ideally six months of experience with code apps, plug-ins, model-driven apps and extending.

For the path, she’d start with the fundamentals, then take the AB-410, which is the Intelligent Applications Builder certification, and maybe the AB-620 for Copilot Studio. That gives you more knowledge of AI and agents and how it all works, which helps because the AB-400 has an agent portion.

Nathalie also pointed out that the path used to be easy to follow: fundamentals, associate, expert. With the PL-600 going away, it’s no longer a linear route, and she’s hoping Microsoft makes it a bit more linear again. If you want to see where everything fits today, my Power Platform credentials overview lays it out, and the PL-900 study guide is a good place to start with the fundamentals.

Nathalie’s final tip: don’t underestimate it

Her one piece of advice for the AB-400 exam is not to underestimate it. Open the study guide and go through every objective. If there’s one where you think “I haven’t worked with that yet”, get some experience with it before the exam, because there might be one question on it, or there might be ten.

Nathalie shares a lot of what she figures out at work on her blog, and you’ll often find her on the monthly Microsoft Power Platform community call and the weekly calls. If you see her at a user group or an event, say hi.

What this means for you

If you already hold the Power Platform Developer Associate certification, nothing changes for you. You can take the AB-400 to learn what’s new, like Nathalie did, but you don’t have to.

If you’re planning to take the AB-400 exam, plan more hands-on time than you would have for the PL-400. Work through each objective in the study guide, build a code app, connect Visual Studio Code to the Power Platform and an MCP server, and try PCF components with AI. If you’re newer to the Power Platform, start with the fundamentals and the AB-410 before you come back to this one.

And if you’re not a developer, you’re in good company: I’m not going for this one either, especially after this conversation. They’re not Pokémon, and we can’t catch them all.

Ready to start studying for the AB-400? My AB-400 study guide brings together the skills measured and the resources to prepare for the Power Platform Developer Associate certification.

Power Platform Just Hit 80 Million Users: PPCC 2026 Keynote Highlights

Vlad Catrinescu — Thu, 29 Oct 2026 12:37:28 GMT

Last year at the Power Platform Community Conference, Microsoft said that low code as we know it is dead. So before the PPCC 2026 keynote, a lot of people in Las Vegas were asking whether the Power Platform is dead as well. Well, I have good news for you, because Charles Lamanna said it pretty clearly: the Power Platform isn’t going anywhere, and it’s more important and healthier than ever.

Key takeaways

The Power Platform now has 80 million monthly active users, up from 25 million in 2022 and 56 million last year.
Microsoft announced an expanded and unified Microsoft Maker Community for everyone building across Power Platform, Copilot Studio and SharePoint.
You can now build Power Apps directly from the Microsoft Copilot app, and the result is a real app with real code behind it.
The new Copilot Managed Runtime gives vibe coded apps a Microsoft-hosted home that follows the policies your admins set.
Agents in Copilot Studio can now get their own identity, with a mailbox and OneDrive, and agent identities are rolling out to everyone right now.
The conference leaves Las Vegas and heads to Chicago on November 2 to 4, 2027.

Inside the Power Platform Community Conference 2026

I was at the Power Platform Community Conference 2026 in Las Vegas for the keynote, and the announcements matter whether you’re a maker, an IT pro, or the person who has to explain all of this to your team back at the office.

If you’ve never been to this conference, you’re really missing out. There were nearly 10,000 makers there this year, and between the sessions there were puppies. Yes, actual puppies in the expo hall. There was a makers market, an NFL experience where you could see how they use the Power Platform and tech to help their teams perform better, and even a human claw machine where you’re the one picking up the prizes.

The Power Platform now has 80 million monthly active users

Charles kicked things off by reminding us how much the world has changed since the first Power Platform conference in 2022. Back then, if you heard the word agent, you thought of Agent Smith in The Matrix. A prompt was a blinking cursor in a DOS terminal, a token was for playing Pac-Man at the arcade, and a vibe was just a feeling.

Since then, the Power Platform has grown massively, and I have the numbers to prove it. In 2022, the Power Platform had 25 million monthly active users, and today it’s at 80 million. That’s more than three times as many people in just four years. If you’ve been reading my recaps, it was 48 million in 2024 and 56 million last year, so this is the biggest year-over-year jump I’ve seen.

And it’s not just more people using the platform, it’s people doing more with it:

20% more people open a Power App every single day compared to last year.
There are 20% more flow runs, which shows that my favorite product, Power Automate, is doing better than ever.
AI usage in Power Apps has doubled.

So if you were worried the Power Platform was dying, the numbers tell you otherwise.

A new, unified Microsoft Maker Community

A big part of that growth is the community, and the Power Platform community is thriving, with members in more than 140 countries and regions, and over 90% of the answers coming from people like you and me. It really is the community helping the community.

The first announcement of the keynote was about that community: Charles announced an expanded and unified Microsoft Maker Community, one place for everybody building across Power Platform, Copilot Studio and SharePoint. I’ll be honest, that last part caught my attention, and a few other MVPs around me looked at each other and said “SharePoint?” You can find the new community at aka.ms/MakerCommunity.

Remember that at Microsoft, the engineering teams for Power Platform and Microsoft 365 are now under the same team, and everybody building is now a maker. So I’m really curious to see how those two communities come together. It might even have an impact on next year’s conference, but that’s my personal opinion, and I come back to it at the end.

Better tools: the first demo had no AI at all

Every demo in this keynote was a real use case from a real company. It wasn’t Contoso, where every demo just works all the time. Ryan Cunningham even joked that he’s starting to think those aren’t actually real companies.

The keynote was organized around four pillars: better tools, more makers, no cliffs, and value at scale. And funny enough, while Microsoft keeps saying there’s never been a better time to build with AI, the first demo had no AI at all. It showed the fundamental improvements Microsoft has made for people who build manually.

Power Apps: a pop-out formula bar and faster controls

You can now pop out the formula bar in Power Apps. So when your formula is dozens or hundreds of lines long, you’re not stuck with a small bar to read it in: you can put it beside your screen. Every new control is also more than 30% faster.

Model-driven apps are getting calendar and card views that you set up with just a few clicks. You could build those with code in the past, but now it takes a few clicks, and the calendar looks just like Outlook.

Power Automate: inline action cards and virtual network connectivity

Power Automate got some love too, which made me happy, because it’s my favorite product and I was a bit worried last year that there wasn’t much for it. The designer now has inline action cards, so you can view and edit an action’s parameters right on the canvas instead of in a panel on the left. You see more at the same time, so it’s kind of a modern take on the original designer.

And for my fellow IT pros, virtual network connectivity lets a cloud flow call a service that’s on-premises without you needing to build a custom connector. It’s safe, it’s secure, and it’s easy.

More makers: build Power Apps from Microsoft Copilot

The next pillar was more makers, and this is where AI comes in. In the new Microsoft Copilot (formerly Microsoft 365 Copilot) app, you have the chat you already use, plus Copilot Cowork, Code, and the brand new Autopilot. What’s new is that you can now build Power Apps from Copilot.

Charles even said he’s built more Power Apps in Copilot in the last two months than in the platform directly in the past two years. An app is now his favorite way to share information, rather than a traditional document or a PowerPoint deck.

We saw a demo where a marine underwriter at Markel Insurance, so a business user, built a full app for her team in Cowork just by describing what she wanted. It’s connected to their data, it sends emails through Outlook, it updates records in Dataverse, and sharing it is as easy as sharing a Word document. The person closest to the problem builds the solution, which is what the Power Platform has always been about, just in a more amplified way now.

No cliffs: low-code apps are code underneath

If you’re an IT pro like me, you’re probably thinking: okay, what happens when that app becomes business critical? This is where the no cliffs pillar comes in.

It took me a while to understand what that meant. In the past, there was a big limit to what you could do with no code and low code. Once you reached it, you had to go to pro code, and that was a big cliff to climb, because you couldn’t just keep working on the same app in Visual Studio Code. You had to rebuild it completely.

But behind every low-code app, there’s actually code. So when you build an app with AI, either as a code app or in Copilot Cowork, it’s still code deployed in the back. As soon as you reach your limit as a vibe coder, a developer can connect to it and take your solution to the next level without rebuilding everything.

The keynote even showed a solution built in Copilot Studio that a developer then opened in Visual Studio Code. He asked GitHub Copilot to explain it, and it drew a diagram of the whole solution. It also found that 3 of the last 12 follow-up emails asked suppliers for information they had already given, and the developer fixed that without ever opening the Copilot Studio designer. So even if you never look at it that way in the UI, it’s code in the back, and with AI and the new ways of hosting, that transition is easier than ever.

The Copilot Managed Runtime fixes the localhost:3000 problem

Let’s talk vibe coding, because Ryan had my favorite joke of the keynote: “Check out my cool new app, it’s at localhost 3000. What? That doesn’t work on your machine?” I’m sure that as an IT pro, someone has already shared an app with you that way, whether a colleague or a family member. We’ve all been there.

That’s exactly what the new Copilot Managed Runtime fixes. Whether you build in Cowork, Copilot Studio, Visual Studio Code, or even a third-party tool, you now have a dedicated runtime where you can safely host your apps. It’s hosted by Microsoft, and it follows the policies your admins set.

Makers finally have a way to host vibe coded apps in a secure, enterprise-compliant way. Personally, though, I’m wondering where the line is. When do you keep an app on the managed runtime, where you pay per use with Copilot credits, and when does a developer take it over and put it on Azure Static Web Apps for a fixed price of around $10 a month, so you know exactly what it costs? It’s brand new, so I’m curious to hear what you would do.

Copilot Studio workflows and the GitHub Copilot harness

The keynote also covered the workflows experience in Copilot Studio, which became generally available in August. So it’s not brand new, but it was still interesting to see it live, combining deterministic steps with everything AI, like classifying emails, calling an agent, or even asking Copilot Cowork to add a task.

In the demo, an insurance company’s shared mailbox got classified, the workflow called the right agents and automations, and the whole run, from the email coming in to a quote ready for the underwriter, cost less than 90 cents. Not 90 dollars, 90 cents. You can also test a single step without running the whole workflow, and you can choose to lay it out left to right or top to bottom. Ryan had some strong feelings about that during the keynote, and I suspect that’s why the top-to-bottom option exists now.

Staying with Copilot Studio, the GitHub Copilot harness isn’t new either, but we got numbers on how much better it is. In Microsoft’s testing, with the same model and the same tasks, code analysis went from about 41% to 88% on the new harness, with about 45% fewer input tokens. So your agents get smarter and cheaper at the same time, and that doesn’t happen very often.

Agents get their own identity, mailbox and OneDrive

I think the biggest showcase for a lot of people was agent identity. Until now, Microsoft mostly pitched agent identity to IT pros, as something to manage, rather than as something that makes you more productive.

What we saw at this keynote is that because an agent has its own identity, it has its own mailbox and its own OneDrive. You can chat with it in Teams, add it to a group conversation, email it, or tag it in a Word document exactly as if it were a user. That applies to Autopilot as well: Charles shared that his own Autopilot is named Apollo, and if you look at the org chart at Microsoft, you’ll actually see Apollo reporting to Charles.

Agent identities are rolling out to everyone in Copilot Studio right now.

The first governance demo on a PPCC keynote stage

The keynote closed with something we’ve never had before at a PPCC keynote: a security and governance demo. With everybody building apps, flows and agents right now, you want to make sure you manage them properly. We saw Agent 365 in the Microsoft 365 admin center, which isn’t new, but it was good to see it demoed.

My highlight was the Power Platform admin plugin with the Power Platform Advisor. It’s not new this week, but it was the first time I saw it live. It’s like an admin agent for Power Platform admins: you go into Cowork and ask it to build reports on what has been created in your environment. It reminds me of the SharePoint admin agent, but for the Power Platform, and I love that Microsoft is making governance easier for every company. It’s the first thing I want to try back at the office.

What this means for you

If you’re a maker, check out all the new experiences and see the new ways you can create apps and flows with AI, whether you’re building them with AI or putting AI inside them. If you haven’t tried it yet, plans in Power Apps are a good place to start building a whole solution from a prompt. If you have Copilot Cowork at work, try building an app with it. Charles’s idea of building an app or a dashboard to share information, instead of a PowerPoint deck or a Word document, is worth trying. It won’t fit every time, but it’s so much more flexible.

If you’re an IT pro, check out the latest in how to manage your environments. As more makers build apps, flows and agents, you need to keep an eye on them and keep them in check. Try the new Power Platform admin plugin, and see which of the tasks you used to do by hand or with PowerShell you can automate with AI. We’re about to see thousands of apps created every year, so keeping an eye on everything matters more than ever.

PPCC 2027 moves to Chicago

The Power Platform Community Conference is leaving Las Vegas and heading to the Windy City: Chicago, November 2 to 4, 2027. There’s a great promo if you register now, with 50% off and a free workshop if you do it fast, and you can register for the 2027 conference here.

The biggest change for me is the link itself: it’s now a Maker Conference. Charles included SharePoint in the new maker community, so I’m curious whether the 2027 conference will include more SharePoint and Microsoft 365 content, not just Power Platform. Will Microsoft have one big conference? Nothing has been announced yet, but it’s worth thinking about as the definition of a maker, and the tools makers use, keep changing.

Ready to plan your trip to Chicago? I’ll share every new PPCC promo on my Power Platform Community Conference page, so you can register for Chicago at the best price.

SharePoint hero links: Why every file now gets a single primary sharing link, and what it means for admins

Vlad Catrinescu — Mon, 26 Oct 2026 16:00:00 GMT

Learn how SharePoint hero links change file sharing, permissions, expiration policies, and reporting, plus what Microsoft 365 admins should do next.

How Agent Approval Works in Microsoft 365

Vlad Catrinescu — Thu, 22 Oct 2026 09:41:16 GMT

Your users are already building agents in Microsoft 365, but what happens when somebody’s experiment becomes available to everyone? You need to know how and why, because agent approval in Microsoft 365 depends on the type of agent, and each type gets there differently.

Key takeaways

SharePoint agents no longer have an approval process, and the site owner decides which agent is the main agent for the site.
By default, anyone can share an Agent Builder agent with the whole organization without admin approval, and an admin can change that setting.
A Copilot Studio agent needs an admin to approve it before everyone in the organization can use it.
An agent only responds with knowledge each user already has access to, except for files uploaded directly to an Agent Builder agent.
Admins approve agent requests in the Microsoft 365 admin center, under Agents, All agents, Requests.

Agent approval in Microsoft 365 depends on the type of agent

How an agent goes from being built by a maker to being available for everyone depends on the type of agent:

SharePoint agents are managed by the site owner.
Agent Builder agents in Microsoft Copilot can be shared with specific users or with the whole organization, without any admin approval. That’s the default behavior if you just deployed Copilot and didn’t change anything, and an admin can change it.
Copilot Studio agents can be shared with specific people without an approval. To share one with the whole organization, the maker needs an administrator to approve it.

If you’re preparing for the AB-900 exam, remember the default approval process for every type of agent. The AB-900 study guide lists understanding the approval process for agents as one of the skills measured.

SharePoint agents don’t have an approval process anymore

There is no approval process for SharePoint agents anymore. There used to be one, but it was removed in June 2026. You’ll still find the Approved folder in the site’s Site Assets library, but it doesn’t have the same purpose it did before. It’s just another folder now, and if you want, you can still put your agents in there so you know where your approved agents are.

The closest thing to an approval process is the Site AI pane. A site owner can open it and choose the main agent for the site, and there can only be one per site. To highlight more agents, site members, or anyone with edit permissions or higher, can add the agent link web part to any page, like the home page.

If you’re responsible for SharePoint agents more broadly, I cover the reports and policy levers in SharePoint agent governance.

A maker can share an Agent Builder agent either with specific users they choose, or with anyone in the organization. By default, that second option is enabled, so anybody can share an agent with everyone in the organization without an approval. That’s the default that surprises most admins.

I know that can sound a bit scary, but remember that the agent will only respond with knowledge the end user has access to. If the agent’s knowledge includes a SharePoint site that another user can’t access, Copilot won’t use that site to answer that user, because it always respects the user’s permissions. If you want the full picture of how that works, I explain it in how Microsoft Copilot accesses your work data.

There is one thing to remember for Agent Builder. If you upload a file directly to the agent, that file travels with the agent itself, so everyone who has access to the agent can get answers from the uploaded file.

Copilot Studio agents need an admin to approve them

Copilot Studio has a more defined workflow. A maker submits the agent to the organization catalog, and an administrator needs to approve it before other users can see it.

Copilot Studio also has many ways to configure knowledge sources, whether through service accounts or by connecting as the user talking to the agent. So what a user can reach really depends on how the agent was configured. But as an admin, you still have that approval step before it’s available organization wide.

An admin can approve agents in two admin centers: the Microsoft 365 admin center, where Microsoft Agent 365 lives, and the Teams admin center. For the AB-900 exam, focus on the Microsoft 365 admin center. That’s where Microsoft has been unifying its agent management capabilities, and the unified agent inventory is part of that same story.

How each approval flow looks in practice

Set the main agent on a SharePoint site

As a site owner, go to the site settings and open Site AI. Under Main agent, pick the agent visitors open from the agent icon in the header, and decide whether to show the Copilot button to site visitors. Save, and that agent becomes the default agent for the site. You can only set one default for the whole site.

To showcase more agents, edit a page and add the agent link web part. You can select any other agent in your organization, and your users can click the web part to chat with that agent.

Open the agent in Agent Builder, select Share, and choose who it’s available to: only you, specific users in your organization, or anyone in your organization. Then copy the link, select Apply, and anyone in the organization can start using the agent from that link.

Remember that the agent will only respond with knowledge each user has access to, and that applies to SharePoint agents as well.

Submit a Copilot Studio agent to the org catalog

Copilot Studio is the more advanced one, and the exact steps to send an agent for approval aren’t on the exam. Once the agent is published to the Microsoft Copilot and Microsoft Teams channel, the maker can submit it to the organization catalog to give everyone access. The agent then waits in an approval queue, pending admin action.

Approve or reject the request in the Microsoft 365 admin center

As an admin, here’s how to review the request:

In the Microsoft 365 admin center, go to Agents, then All agents.
Open the Requests tab. Select Refresh if the agent doesn’t show up yet.
Select the agent to open its details.
Choose Publish to store or Reject submission.

Before you decide, you have access to the information about the agent: when it was created and last updated, its channels, its data and tools, insights from Microsoft Purview and Microsoft Defender, and the Microsoft Entra Agent ID permissions when the agent uses one.

When you publish it to the store, you choose who gets the agent, such as all users, and whether to pre-install it for them. You can also apply a policy template to it, which is a Microsoft Agent 365 feature. Once you make it available, the agent is available for everybody in the organization.

What this means for you

So who approves an agent? It depends on the agent type, and the Microsoft 365 admin center is where you stay in control. SharePoint agents follow the site owner, Agent Builder agents follow a sharing setting that’s open by default, and Copilot Studio agents wait for you in the Requests tab.

Go take a look at what agents are already live in your tenant. Check whether the Agent Builder sharing setting is what your organization wants, and know who’s watching the Requests tab so Copilot Studio submissions don’t sit in the queue. And remember that a file uploaded directly to an Agent Builder agent is available to everyone who can use that agent.

If you’re studying for the AB-900, make sure you can name the default approval process for each type of agent, and spend your time in the Microsoft 365 admin center rather than the Teams admin center.

Ready to get AB-900 certified? This walkthrough comes from my three-course AB-900 path on Pluralsight, which covers the core Microsoft 365 services, data protection and governance, and the basics of Copilot and agent administration. Start with my AB-900 path on Pluralsight, and keep the AB-900 study guide open while you study.

Copilot in SharePoint FAQ: Your Agents, Skills and Autofill Questions Answered

Vlad Catrinescu — Wed, 21 Oct 2026 15:48:18 GMT

Fellow Microsoft MVP Gokan Ozcifci and I ran over time in our Copilot in SharePoint webinar, probably because I went about 15 minutes over the 20-minute slot he gave me. That left a lot of your questions unanswered, so as I promised at the end, I’ve answered every one of them here. Everyone who registered gets the recording by email, and if you didn’t, you can still watch the recording and get the slides.

Key takeaways

Copilot in SharePoint needs a Microsoft Copilot license (formerly Microsoft 365 Copilot) for each user. General availability started rolling out on September 30, 2026, so it can take a little longer to reach your tenant.
Everyday work, like creating skills and using autofill, is included with that license. Advanced work, like image generation, analytics, real-time autofill and anything at scale, uses Copilot Credits, through a spending policy your admin sets up.
Classic SharePoint agents saved as .agent files keep working until the end of March 2027, and starting in mid-November 2026, you build new agents for SharePoint with Agent Builder.
Copilot in SharePoint runs on a Microsoft-managed reasoning model from OpenAI that you can’t change, but you can pick the model for an agent you build in Copilot Studio.
Autofill columns are library columns that work with managed metadata, and there’s no supported way yet to reuse one in other libraries or sites.
Restricted Content Discovery, which your Copilot licenses unlock through SharePoint Advanced Management, keeps Copilot in SharePoint and agents off a site without changing who can open it.
Copilot in SharePoint isn’t available in GCC, GCC High or DoD yet.

Getting Copilot in SharePoint in your tenant

How do I know when Copilot in SharePoint is available in my tenant?

Look for the Copilot in SharePoint button in the lower-right corner of your SharePoint pages and document libraries. General availability started rolling out on September 30, 2026, and Microsoft’s get started guide for Copilot in SharePoint says the capabilities may appear in your tenant after that date as the rollout progresses. So if you don’t see it yet, don’t worry. As Gokan said during the webinar, it’s still rolling out.

And yes, it’s the paid license. Each user needs a Microsoft Copilot license, and with it the everyday features are included at no extra cost, with no opt-in step. Copilot Credits don’t replace the license either. They pay for advanced work on top of it, which I cover below.

As for the pay-as-you-go option I mentioned in the chat, there’s no pay-as-you-go way to use Copilot in SharePoint without the license. SharePoint agents pay-as-you-go only applies to .agent files, which stop working after March 2027, and Microsoft’s upgrade guidance for agents in SharePoint says it doesn’t apply to Copilot in SharePoint. For autofill columns you set up with Copilot in SharePoint, new files are covered by the Copilot license, even when the library is connected to a pay-as-you-go meter. Pay-as-you-go isn’t gone from Copilot altogether: as the .agent files retire, unlicensed use of agents moves to Copilot app pay-as-you-go.

If you’re an admin, the preview PowerShell settings, KnowledgeAgentScope and its list of sites, are only honored until November 1, 2026. After that, you manage where Copilot in SharePoint shows up with the Site AI settings and Restricted Content Discovery. If you used those settings to limit Copilot in SharePoint to a pilot, or to turn it off, plan for it to appear on every site for every licensed user after that date. If you excluded sites, decide which of them truly need Restricted Content Discovery, because it also hides them from organization-wide search and Copilot responses across Microsoft 365.

Does Copilot in SharePoint work in GCC?

Not yet. Microsoft’s get started guide says GCC, GCC High, DoD, Office 365 air-gapped cloud environments and Microsoft 365 operated by 21Vianet don’t currently support Copilot in SharePoint. Message Center post MC1511052 says it’s coming soon to the government clouds, without a date. Copilot Credits aren’t an option there yet either, because usage-based billing isn’t supported in GCC or GCC High.

Microsoft says the agent changes I cover below also apply to its government clouds, and upgrading to Agent Builder is supported there, though Agent Builder isn’t currently available for declarative agents in DoD. Converting an agent to a skill has to wait until Copilot in SharePoint arrives.

What is Site AI?

Site AI is the settings panel where site owners decide how people use AI on their site, Copilot in SharePoint included. You open it from Settings > Site AI, and it’s the panel I showed in the demo for setting the site’s main agent. From there, a site owner can:

Choose which agent opens from the agent icon in the header, either Copilot in SharePoint or a custom agent.
Hide the Copilot button on site pages for site visitors only.
Turn on advanced document processing, which today means a site admin sharing their own Copilot Credits so autofill uses advanced processing across the site.

On my demo site, Copilot was the main agent and credit sharing was off, so autofill there uses standard processing, which the Copilot license covers.

Hiding the button only applies to visitors, so to take Copilot in SharePoint off a site completely, admins turn on Restricted Content Discovery instead. The main agent choice also has an end date: after March 2027, Copilot is the only main agent a site can have, and Microsoft will remove that setting.

What the Copilot license covers, and when you need Copilot Credits

Does creating a skill cost extra?

No. Creating and managing skills is on Microsoft’s list of everyday work that the Copilot license covers, so a skill like the expense policy check I built in the demo costs nothing extra to create. Whether it uses credits depends on the work it does when it runs. Microsoft calls this a hybrid model, and its get started guide lists the everyday work the license includes:

Asking questions, finding content and catching up
Creating HTML, Word, Excel or PowerPoint files
Creating and editing pages, libraries or lists
Simple rules, approvals and deterministic workflows
Renaming and sharing individual files
Creating and managing skills
Using autofill metadata

Copilot Credits, through usage-based billing, pay for the advanced work:

Working across large or unbounded content sets
Creating entire sites and solutions
Creating and editing files, pages, libraries and lists at scale
Multistep, complex AI workflows, like skills in scheduled AI automations
Real-time autofill metadata
Generating new images and editing existing ones
Analytics on how sites, pages, news and documents perform

That’s the same split Gokan showed on his licensing slide, with his advice on who needs what along the bottom:

The “No user should invest in Syntex” line at the bottom of the slide is only Gokan’s and my opinion. Microsoft hasn’t announced that Syntex is being deprecated, and its pay-as-you-go services are still available under a new name, document processing for Microsoft 365.

Microsoft’s rule of thumb is that credits apply when a job “spans more content than you can work through yourself, needs to run on its own, or has to keep pace as content arrives.”

The 10,000 files I mentioned come from Microsoft’s Copilot Credits Guide, where it’s one of the heavy examples. Its medium examples, like re-tagging the documents in a project folder of 500 files, need credits too. Microsoft doesn’t publish a file count where “at scale” starts. Instead, when a prompt crosses that threshold, Copilot asks you to approve credit use before it continues. If you don’t have credits, it completes what it can and asks you to start a new chat. If you missed my first skills webinar, you can watch the Getting Started with SharePoint Skills recording for the basics.

Your admin turns on the advanced work in the Microsoft 365 admin center under Copilot > Cost management. You add a spending policy, choose all users or specific security groups, select Advanced work in SharePoint under Agents and services, then set limits and alerts and a billing method. If you already have spending policies, review them, because a policy that allows new agents and services as they become available can pick up Advanced work in SharePoint automatically.

Until a spending policy covers you, you only get the everyday work. Even /cost, the command that shows how many credits a task used, isn’t available yet, as I found on my demo site:

Gokan’s advice was to license everyone for the everyday work and give credits only to the people who manage content at scale. Microsoft’s guidance agrees: it prioritizes content managers and site managers, and says most other SharePoint users likely don’t need credits.

Will the prebuilt SharePoint page and list agents need Copilot Credits?

Nothing Microsoft has published ties them to credits, so the answer Gokan and I gave live holds: they need the Copilot license. The SharePoint list agent left the Frontier program and became generally available in February 2026, and it requires a Copilot license. The SharePoint page agent, a Frontier preview, is being retired between mid-October and mid-November 2026, according to Message Center post MC1481325. Gokan mentioned live that Microsoft had deprecated one agent a few weeks earlier, and that notice went out on September 29, 2026.

The same notice says you can keep creating and refining pages and news posts with Copilot in SharePoint. That’s everyday work the license covers, since creating and editing pages, libraries and lists is on the included list. Only doing it at scale needs credits.

Can everyone use an agent I put on a site?

They need either a Copilot license or pay-as-you-go that your admin sets up. With the license, using agents grounded in your organization’s content is included at no extra cost. For people without one, it depends on how the agent was built:

A classic SharePoint agent, the .agent file, uses SharePoint agents pay-as-you-go. Your admin creates a billing policy, and only users in the security group assigned to it can use agents. Microsoft lists the pay-as-you-go price at $0.01 per message, and a successful interaction uses 12 messages.
An Agent Builder agent that uses SharePoint content is billed through pay-as-you-go, consumed as Copilot Credits. Agents like that are off by default for Microsoft Copilot Chat (formerly Microsoft 365 Copilot Chat) users.

As the .agent files retire, Microsoft consolidates unlicensed use under Copilot app pay-as-you-go. For SharePoint content, people need permission to both the agent and the content it uses, so an agent won’t surface a SharePoint file someone couldn’t already open. The exception is files a maker uploads into an Agent Builder agent: anyone who can use that agent can get answers from them.

Does testing an agent in the preview pane use credits?

Not if you have a Copilot license, which is how I tested the Zava Travel Assistant in the demo. Testing an agent is interactive use, and Microsoft includes interactive use of agents by Copilot-licensed users at no extra cost.

Microsoft doesn’t document whether the preview pane in SharePoint, or the Try it tab in Agent Builder, is billed for someone who builds on pay-as-you-go without a license. If that’s you, I’d plan as if a test that reads SharePoint content is metered like any other use.

The only place Microsoft spells it out is Copilot Studio, where testing an agent in the test chat doesn’t consume Copilot Credits for the agent’s own activity. The exceptions are AI prompts or models inside agent flows, and agents built on the GitHub Copilot harness, which bill while you test.

SharePoint agents are moving to Agent Builder

Is a SharePoint agent basically an Agent Builder agent now?

Yes, and from mid-November 2026 that’s exactly what it will be. Today’s SharePoint agents, which I called classic agents in the demo (my naming, not Microsoft’s), are declarative agents saved as .agent files on the site. Microsoft’s upgrade guidance says that starting in mid-November 2026, you’ll use Microsoft Copilot Agent Builder to create agents for SharePoint and OneDrive, and creating an agent no longer saves a .agent file. You still pick SharePoint and OneDrive content as knowledge, and Agent Builder adds sources like Teams chats and meetings, Outlook email and Copilot connectors.

Microsoft’s timeline, which I put on one slide in the webinar, gives you until the end of March 2027 to move your classic agents:

In mid-November 2026, new agents for SharePoint are created with Agent Builder, an Upgrade to Microsoft 365 agent button appears in the builder, and the convert-agent-file-to-skill skill arrives in Copilot in SharePoint.
In November 2026, the Agent Chat web part, which puts an agent’s chat right on a SharePoint page, starts its preview, with general availability planned for January 2027 on the Microsoft 365 roadmap.
After March 2027, .agent files stop responding in SharePoint, Teams and the Copilot app.

There’s no automatic upgrade, so plan each one. An agent that mostly answers questions about its own site can be replaced by Copilot in SharePoint. One that runs a repeatable task becomes a skill, and a named Q&A or retrieval experience becomes an Agent Builder agent. Permissions don’t carry over, because an Agent Builder agent is shared on its own instead of following SharePoint file permissions. Unless the original was shared with everyone in your organization, the upgraded agent starts out private to you, and the .agent file’s usage history doesn’t transfer.

It hasn’t been removed: .agent files keep working until the end of March 2027. My best guess is a change in what the agent icon opens. For Copilot-licensed users, Copilot in SharePoint replaced the ready-made site agent. Unless a site owner picks a custom agent as the main agent in the Site AI settings, Copilot is now the main agent for the site.

Two other things can hide it too: Restricted Content Discovery is turned on for the site, which removes the agent icon from the header, or you don’t have a Copilot license and your organization hasn’t set up pay-as-you-go for agents. And if you mean the Copilot app rather than SharePoint, Microsoft is replacing its Agents entry point with Plugins, and upgraded agents show up in the plugin store.

Does a SharePoint agent get a Microsoft Entra ID, and does it show up in Agent 365?

No to the first, yes to the second. Microsoft’s agent identity documentation says Agent Builder agents currently don’t use or require app registration IDs or Agent IDs. Of the tools in this post, it’s new agents you create in Copilot Studio that get a Microsoft Entra Agent ID automatically. Microsoft doesn’t mention one for classic SharePoint agents either, and their answers depend on each user’s permissions to the agent’s sources.

For admins, agents show up in the agent registry in the Microsoft 365 admin center, under Agents > All agents > Registry. It lists agents with or without a Microsoft Entra agent identity, and SharePoint is one of its agent types. For classic agents, the registry gives you an overview of the agents that have been used in Copilot Chat, and blocking one there only affects its availability in Copilot Chat.

Agent Builder agents, including the ones you’ll create for SharePoint from mid-November, are integrated with Microsoft Agent 365 automatically. Viewing the registry doesn’t need a specific license, while Agent 365’s observability and policy features need Microsoft 365 E7 or an Agent 365 license.

Can an agent answer only from approved documents?

For your readers, mostly yes. People who can read a library but can’t see drafts get the last approved, major version of a file, and SharePoint search doesn’t return files that only exist as a minor version. So a visitor who only sees the published version gets answers from the published version.

The exception is the library’s Draft Item Security setting. If it’s set to “Any user who can read items”, everyone can see drafts, including the account that crawls for search. Editors and approvers can see drafts in the library too, so test the agent with an account that can’t.

For policies, I’d still keep it structural: keep final, approved documents in their own library or folder, keep work in progress somewhere else, and point the agent only at the final location. Someone in the chat suggested adding “only published documents” as a condition in the agent’s instructions. That’s fine as extra guidance, but don’t rely on it, because instructions aren’t a security boundary.

Can I choose the model Copilot in SharePoint uses?

Not in Copilot in SharePoint. Microsoft’s get started guide says it currently runs on a Microsoft-managed reasoning model from OpenAI, that Microsoft selects and manages the model, and that the specific model might change over time. So my answer holds, and I still wish we could choose. Microsoft doesn’t document a model picker for Agent Builder either, because those agents run on the same models Copilot uses.

Gokan’s workaround from the webinar is the one that works today: build the agent in Copilot Studio, add your SharePoint site as knowledge, and select the agent’s model from the dropdown, which includes Anthropic Claude models.

External models have to be turned on in both the Power Platform admin center and the Microsoft 365 admin center, where the Anthropic setting is on by default for most commercial customers outside the EU, EFTA and the UK. Anthropic models are also currently excluded from the EU Data Boundary, so check with your compliance team. Then publish the agent to the Microsoft Copilot app, so you can put it on a page with the Agent Chat web part. Publishing it to the SharePoint channel creates a .agent file, which stops working after March 2027.

Autofill columns

Do autofill columns work with site columns and the term store?

The term store, yes. Site columns, not officially. Autofill works with managed metadata columns, so you can map an autofill column to a term set from your term store, as I showed in my video on autofill columns with managed metadata. Microsoft’s autofill documentation notes that it only uses the first 100 terms of a mapped term set, and when a preferred term or a synonym matches, it saves the preferred term.

Besides managed metadata, autofill supports text, multiple lines of text, number, yes/no, date and time, choice, hyperlink and currency columns. It doesn’t support person or group, location, image or lookup columns.

The autofill column itself is a library column. You write its prompt in that column’s settings, and the values it extracts are saved to the column, so like other column data they can be indexed and used to trigger workflows. As Gokan said, there’s no supported way to reuse an autofill column in another library or site today. The site column workaround I mentioned is real, and the credit goes to Kasper Larsen. He showed how to reuse autofill prompts across libraries that share a content type with PnP PowerShell, building on Leon Armston’s earlier work. It relies on settings Microsoft hasn’t documented, so treat it as unsupported.

Does turning on autofill add the column to every library on the site?

No, only to the library you’re working in. Autofill columns are created one library at a time: Copilot in SharePoint can configure document libraries only, and even when you start from a folder, the configuration applies to that whole library. So keeping autofill in one library is simply a matter of creating autofill columns only in that library, and each column has its own toggle if you want to switch it off later.

In Gokan’s demo, Copilot suggested the columns for the one library he had open, showed a value for each invoice, and asked which columns to keep:

There’s no per-library on switch, because everyday autofill comes with the Copilot license without an opt-in. The controls above the library are broader. Restricted Content Discovery takes Copilot in SharePoint off a whole site, and in the Site AI settings, a site admin decides whether to share their Copilot Credits for advanced autofill. Once that’s on, autofill uses advanced processing whenever it runs on the site.

Can I roll out autofill columns across hundreds of libraries?

Not with anything Microsoft supports today. Microsoft doesn’t document an API, PowerShell cmdlet, site template setting or content type hub option for autofill, so as Gokan said live, you set up the column in each library. In his words, if you have 10 document libraries, you copy and paste the prompt 10 times.

What scales differently is the processing. Standard autofill is included with the Copilot license, and new files uploaded to the library are processed whether or not the uploader has a Copilot license. Real-time autofill metadata, the site-wide processing that keeps pace as content arrives, needs Copilot Credits and usage-based billing turned on for the site. Microsoft doesn’t publish a file count for “at scale” here either.

If you have to do it now, the community has tools. Leon Armston automated autofill columns with PnP PowerShell, and the CLI for Microsoft 365 has a command that sets autofill on a library column. Neither is supported by Microsoft. Leon’s post warns that the API behind it isn’t documented and is subject to change, and he has since noted that the backend APIs changed, so his original script may not work as written. Test carefully before you run anything across a tenant.

If you need the same extraction to run across many libraries in a supported way, Gokan’s slide had the other options: AI Builder models with Power Automate and Power Apps, Copilot Studio, and Azure Document Intelligence in Foundry Tools.

Protecting your content

Can I use SharePoint Advanced Management to keep sites out of Copilot?

Yes. As soon as at least one person in your organization has a Microsoft Copilot license assigned, your SharePoint admins get the SharePoint Advanced Management features included with Copilot. Restricted Content Discovery is the one that does what you’re describing. Copilot reaches your content through Microsoft Graph and the semantic index, which Microsoft builds automatically from your SharePoint content, and it only returns content the person asking can already access. My post on how Microsoft Copilot accesses your work data walks through how that works.

Restricted Content Discovery keeps a site’s content out of organization-wide search and Microsoft Copilot responses, including files people recently worked on. Copilot in SharePoint and AI actions don’t appear on that site at all, and people can’t use the ready-made agent, create agents, or add that site’s content to other agents. It doesn’t change who can open the content, so people who already have access can still open it directly, search within the site, and ask Copilot about a document they have open. You turn it on in the SharePoint admin center from the site’s settings in Active sites, or with PowerShell:

Set-SPOSite -Identity <site-url> -RestrictContentOrgWideSearch $true

The other controls you mentioned are on the same list of features your Copilot licenses include:

Restricted Access Control limits a site to the members of up to 10 groups. People outside them can’t open the site, even with existing permissions or a sharing link, and Copilot and search honor it too.
The block download policy gives a site browser-only access, with no downloading, printing or syncing.
Authentication contexts connect a Microsoft Entra Conditional Access policy to a SharePoint site, which is my best guess at the limited access feature you meant.

Microsoft calls Restricted Content Discovery a temporary governance control and recommends using it selectively, and on sites with more than 500,000 items it can take more than a week to fully apply. My post on SharePoint agent governance shows how to apply it straight from the agent access reports.

Can admins sanitize the HTML that Copilot creates?

Not today, and I haven’t found any sign of it coming: nothing on Microsoft Learn or the Microsoft 365 roadmap mentions an option to sanitize generated HTML.

Microsoft’s support article on HTML pages in SharePoint says SharePoint renders HTML in a sandboxed iframe, with Content Security Policy rules for extra isolation, and blocks arbitrary fetch requests and outbound API calls. JavaScript only runs when it’s contained in the same HTML file, apart from Microsoft-managed versions of a few libraries like Chart.js and Mermaid. External links also need a site admin to add their domain to HTML Field Security. That’s probably why the JavaScript in my expense report didn’t behave in the demo.

The same article answers your tenant question directly: you can’t disallow or restrict HTML pages at the tenant level. Site owners can turn off Allow HTML files in the Site Pages library, and that setting matters more soon. HTML pages, which let you publish an HTML file as a SharePoint page, reach general availability between mid-November and late December 2026, according to Message Center post MC1479517. For the external sharing risk, use the controls you already have:

The site’s external sharing settings
A data loss prevention (DLP) policy using the “File extension is” and “Content is shared from Microsoft 365” conditions
The block download policy on sensitive sites

Sensitivity labels won’t help at the file level, because HTML isn’t one of the file types they support in SharePoint. If a tenant-level option matters to you, send it to the product team as feedback. In the video they recorded for the webinar, they asked us to keep it coming.

What this means for you

Gokan and I focused the webinar on using Copilot in SharePoint, and most of your questions were about what it costs and what’s changing with agents. Both come with dates, so if you’re an admin, put these in your calendar:

Before November 1, 2026, check whether you used the preview PowerShell settings to limit Copilot in SharePoint to a few pilot sites or to keep it off some sites. After that date, Microsoft stops honoring them and Copilot in SharePoint shows up on every site for everyone with a Copilot license, so turn on Restricted Content Discovery early for any site that truly needs to stay out.
Before people start working at scale, decide who gets Copilot Credits and create a spending policy for Advanced work in SharePoint scoped to them. Check whether your existing spending policies already picked it up, too.
Between mid-November 2026 and the end of March 2027, inventory your .agent files with the agent registry, the SharePoint Advanced Management agent reports or search. Then move each one to Copilot in SharePoint, a skill or an Agent Builder agent.

If you’re a site owner or a maker, the rule of thumb from the webinar still applies: use an agent when people need a subject matter expert that answers questions, and use a skill when you have a repeatable process you want Copilot to run. Licensing can decide it too. Skills run in Copilot in SharePoint, so everyone using one needs a Copilot license, while an agent also works in Teams and the Copilot app, including for people on pay-as-you-go:

Start with the classic agents you already have, because those are the ones with a deadline.

Ready to tackle the admin side of Copilot in SharePoint? This webinar was about using it, and on November 12, Microsoft MVP Drew Madelung and I are covering governance: who can create skills and agents, where they live, what they can reach, and which control governs each one. Save your seat for Governing SharePoint Skills and Agents.

Microsoft 365 Archive FAQ: Copilot, Retention, Reactivation and Cost

Vlad Catrinescu — Tue, 20 Oct 2026 15:20:12 GMT

I hosted a Syskit webinar on Microsoft 365 Archive with Trent Green from Microsoft, and it was one of the most active webinars we’ve had in a while. Trent is a Principal Product Manager who has been driving the archive product for the past four years, so I asked him your questions about where archived files go, what your users see and what archiving really costs. Below are his answers, checked against Microsoft’s documentation, plus a few notes of my own.

Key takeaways

Microsoft 365 Archive moves inactive content to a cheaper cold storage tier inside SharePoint, where it keeps its metadata, permissions and compliance settings.
Archived content isn’t used to ground Microsoft Copilot (formerly Microsoft 365 Copilot) and is hidden from search by default, but users can still find it with the Archived filter.
Reactivation is instant for the first seven days, then takes up to 24 hours, and Trent says most files come back in 18 to 22 hours.
Archiving isn’t retention, and your retention policies still apply to archived files, including the ones that delete content.
You only pay for storage above your tenant quota, at $0.05 per GB per month for archived content instead of $0.20, and reactivation is free outside unlicensed OneDrive accounts.
Trent’s advice is to start with about a dozen sites, then scale with SharePoint Advanced Management or Microsoft Purview policies.

How Microsoft 365 Archive works

What is Microsoft 365 Archive?

Microsoft 365 Archive is a new tier of SharePoint and OneDrive storage for your inactive content. Active content still supports everyday collaboration and Copilot, while the archive tier is for data you need to keep but don’t need day to day. Trent gave three reasons to use it: lower cost, more relevant Copilot answers, and general storage management.

It comes as site-level archive, for a whole site, and file-level archive, for individual files on a site that stays active. Microsoft’s overview of Microsoft 365 Archive covers both.

Does archived content leave SharePoint?

No. Trent gets asked that a lot, along with whether you can use an external archive or whether content moves into another repository. Microsoft 365 Archive stays inside SharePoint, within the Microsoft 365 boundary.

It is simply a tiering mechanism.

Behind the scenes, Trent explained, SharePoint moves the content to the cold archive storage Azure offers out of the box, and manages that move for you. Because SharePoint still manages it, your metadata, folder structure, permissions, durability, security and compliance go into the archive and come back out with it.

Does archived content stay in the same country?

Yes. One attendee asked this with GDPR and Quebec’s Law 25 in mind, and Trent’s answer was “Absolutely.” Archived content follows the same geo residency requirements as your active content, and like all SharePoint data, it’s stored twice in different locations, both inside your residency boundary.

It’s not like we’ve shipped it somewhere cheap.

So wherever you agreed your active data can live, your archived data lives in the exact same locations.

Copilot and search

Does Copilot use archived content?

No, and Trent sees that as one of the big benefits. You want Copilot using the most relevant and recent information, so archived content is intentionally left out of Copilot grounding, and Trent said they’re seeing huge results in the relevancy of Copilot’s responses because of it. His team is working on possibly exposing some archived content to Copilot, with admins deciding what’s visible, but today the default is that none of it is.

Apps you build yourself work differently. Archived is a state of a file, so the APIs that list files still return archived files, flagged as archived, but Microsoft’s developer guidance for Microsoft 365 Archive says an app can’t read an archived file’s content until the file is reactivated.

Can users still find archived files in search?

Yes, but archived content is hidden from search results by default to keep things clean, and users opt in per session when they can’t find a file or know it’s archived. In OneDrive search, that’s the Archived filter, and SharePoint search has an Archived option under the File type dropdown. Results are permission trimmed, so people only see archived files they already have access to.

What changes when content is archived

The table below was the first of Trent’s three key takeaways. Compliance, eDiscovery, permissions, security, SharePoint’s extra durability, metadata and versions all stay exactly the same in the archive. Only two things change: archived content is excluded from Copilot grounding, and you have to reactivate it before you can open it again.

Does archiving change a site’s storage quota?

No. Archived files still count against the site’s quota, so a site quota is something archiving can’t get around. If you limit a site to 10 TB, that site gets 10 TB shared between active and archived storage, and the savings happen at the tenant level instead.

How long does reactivation take?

Up to 24 hours, and that’s the fundamental trade-off of archiving. In reality, Trent says most files and sites take 18 to 22 hours, and over 99.9% of files come back within 24 hours. It takes that long because your documents are split into pieces across redundant cold storage, and SharePoint has to fetch them and put each file back together.

The first seven days are the exception: content reactivates almost instantly during its first week in the archive, which helps a lot when someone archives the wrong file.

Do eDiscovery, legal holds and retention policies still work?

Yes. Everything in your Microsoft Purview compliance flows is fully honored, including legal holds, eDiscovery and retention policies you create after the content was archived. Microsoft’s documentation adds that eDiscovery can export straight from archived content, even if the export might take longer, and that sensitivity labels still apply.

Archiving is not retention

Does archiving a file mean it’s retained?

No, and Trent was very clear on this one. Retention policies are fully honored, so a policy can still require a file to be kept, or deleted, after a certain time. Archiving on its own doesn’t keep anything, though, because anyone with permission to delete a file can delete it straight from the archive.

Don’t think of archive as a retention mechanism, but rather just as a storage tier.

Will a retention policy that deletes content also delete archived files?

Yes. An attendee asked whether an auto-delete retention policy, or a label that deletes without review, would skip archived files. Archiving is only a state, so a retention policy that deletes files deletes them whether they’re archived or not, and as Trent put it, you don’t need to worry about archive blocking your retention policy.

File-level or site-level archive

When should I use file-level archive instead of site-level archive?

Use file-level archive when the site is still active, like a team or project site that’s always moving but holds a lot of content nobody uses anymore. You archive those files, and the pages, the lists and the rest of the site keep working.

Site-level archive is for when a project closes all at once. Trent’s example was construction companies, which have to keep a finished project’s files but rarely open them again, so they archive the whole project site in one go. An archived site needs a SharePoint admin to reactivate it, and the inactive site policies in SharePoint site lifecycle management can archive sites for you.

Can I archive a Teams site with private or shared channels?

Not fully, yet. Trent said Microsoft is working on tying this to the archive feature in Teams, so the Teams side and the SharePoint site get archived together. Until then, Microsoft’s documentation says the SharePoint admin center won’t archive a site that has private or shared channels, and PowerShell or Graph archive only the main site.

What archiving looks like for your users

How does a user archive a file?

A user selects the file in a document library and chooses Archive from the list of actions. A dialog reminds them that they can reactivate it instantly for seven days, and that after that, it takes up to 24 hours. The file then stays right where it was, with an archived icon next to its name.

The user needs edit permissions on the file, and the site has to allow file-level archive, which Microsoft’s documentation says is on by default for every site. Admins can turn the Archive action off for the tenant or for specific sites with PowerShell.

What can users do with an archived file?

A lot less than with an active file. To work with its content, they have to reactivate it, but they can still delete it, rename it (to add something like _archived, for example), move or copy it, and see its details. A moved or copied file keeps its archived state, because after the first seven days, it really is in cold storage.

To get a file back, a user selects Reactivate, or just opens the file, and confirms. Anyone with read permissions can do it, it’s free, and nobody has to sign off. After the first seven days, the person who reactivated it gets an email when the file is back, within 24 hours. Microsoft’s end user experience documentation walks through both sides.

Can you archive or reactivate a file on a locked or read-only site?

No. A locked or read-only site doesn’t allow any changes, and archiving is a change. The attendee who asked had actually tested it during the webinar, and got the same answer before Trent did.

Why you can’t archive a folder

An attendee who has used file-level archive since before it was generally available noticed that folders never show the archived icon. That’s by design: only files can be archived, not folders. With site-level archive, getting a single file back means reactivating the entire site, and Trent’s team didn’t want to repeat that problem with folders.

Instead, a folder has an Archive all files action that archives every file under it, subfolders included, so someone who needs one file back reactivates just that file. Trent’s team is exploring an archived icon for folders where every file is archived, but it isn’t on the immediate roadmap, so in the meantime you could rename the folder and add “Archived” in front of its name.

Where admins can see how much is archived

Today, mostly in PowerShell, and only for admins. The ArchivedFileDiskUsed property of Get-SPOSite returns the storage used by the archived files on a site, but it’s in bytes, which isn’t the easiest number to read. Here’s the version I use, which shows it in both MB and GB:

Get-SPOSite -Identity https://contoso.sharepoint.com/sites/projects | Select @{N='Archived (MB)';E={[math]::Round($_.ArchivedFileDiskUsed/1MB,2)}}, @{N='Archived (GB)';E={[math]::Round($_.ArchivedFileDiskUsed/1GB,2)}}

On one of my own sites, the raw property shows 17,241,055,487 bytes, and the version above turns that into 16.06 GB.

It comes from my file-level archive guide on the Syskit blog (I’m Syskit’s technical evangelist), along with the commands that turn file-level archive on or off for your tenant, your sites and new sites.

Trent said the archived gigabytes are coming to the Active sites list in the SharePoint admin center in the next couple of months, and his team is looking at showing site owners how much of their site is archived too.

Start manually, then scale with policies

This is the recommendation Trent’s team gives every customer, because file-level archive is new for your users and they need to learn it before you archive at scale. Customers who’ve had a lot of success did it in three steps:

Start with about a dozen sites whose owners are eager to try it.
Check that their workflows still work the way they expect with archived files.
Once retrieval and the experience work for them, switch to policies.

I do not expect to get to massive scale of archive by having IT admins go click archive on a hundred million files.

Which policies can archive files automatically?

There are two, and on October 8, 2026, they were at different stages, while manual file-level archive itself is generally available.

The SharePoint Advanced Management inactive files policy archives files by their last access date. That’s a brand-new property Trent’s team spent years building, so you only archive files no person is opening. It was coming to public preview (roadmap 573699), PowerShell-only at first, with a threshold of 6 to 48 months of inactivity.
Purview retention-based archive adds an archive step to your retention policies and labels. It fits if you already define your files’ lifecycle with retention, and it was in public preview (roadmap 561208).

Trent said customers are already archiving hundreds of millions of files with these policies, and they haven’t even come out of preview. My SharePoint Advanced Management roadmap post tracks what’s shipped and what’s coming.

Do the policies need extra licenses?

Yes. Manual file-level archive needs no license at all, only pay-as-you-go billing, but both policies need additional licensing, and Microsoft’s documentation lists a Microsoft 365 E5 license for archiving through retention policies.

For the inactive files policy, I asked Trent the question I always get. As an MVP, I can say it: SharePoint Advanced Management has a bit of a funny way to license things, where features made to help you deploy Copilot come with the Copilot license, and other features don’t. Trent confirmed that a Copilot license gives you SharePoint Advanced Management, and that it will include the inactive files policy. My SharePoint Advanced Management licensing Q&A with Microsoft has the background on that split.

What Microsoft 365 Archive costs

Every tenant gets a pool of SharePoint storage, 1 TB plus 10 GB for each eligible license, and Microsoft 365 Archive only bills you for what goes over it. It’s pay-as-you-go, so there’s no license to buy: you enable the pay-as-you-go service and connect an Azure subscription for billing. Reactivation is always free, since Microsoft removed the old site archive reactivation fee on March 31, 2025.

In Trent’s example, you have 1,200 GB in SharePoint and your licenses cover 1,000 GB, so 200 GB is billable. In active storage at $0.20 per GB per month, that’s $40 a month. Archived at $0.05 per GB per month, the same 200 GB costs $10, which is 75% less.

If your total storage were 900 GB, archiving would be completely free, and if you archived 800 GB of your 1,200 GB, you’d still only pay for the 200 GB above your quota. As I said during the webinar, there’s literally no way you pay more by using archive than by not using it: you either save money or pay the same, and you still get the Copilot relevancy. Microsoft’s pricing model for Microsoft 365 Archive has more billing scenarios.

What about OneDrive accounts of people who left?

Those are the one exception to free reactivation. When a OneDrive account becomes unlicensed, for example after someone leaves, it goes into the archive automatically, and since nobody pays for that account, reactivating it costs $0.60 per GB at list price. Trent’s team is also bringing file-level archive to OneDrive, and reactivating files archived in a licensed OneDrive account will always be free.

Should I turn on SharePoint pay-as-you-go storage too?

Yes. Trent said Microsoft 365 Archive is best paired with SharePoint pay-as-you-go storage, because prepaid storage packs lock you into the capacity you bought, so if archiving brings you back under it, you don’t see the savings. With both pay-as-you-go services on, you’re only billed for your overage, at the best blended rate between standard and archived storage.

Microsoft 365 SharePoint Storage, the pay-as-you-go meter for that overage, has been in public preview for commercial tenants since June 2026, and Microsoft plans general availability for November 2026. My post on Microsoft 365 pay-as-you-go updates covers the billing side.

Pay-as-you-go storage also keeps your tenant out of read-only mode. I asked Trent what happens when a tenant goes over its quota without it: after a warning and a small buffer window, the whole tenant goes read-only, and no SharePoint site or OneDrive account can add content.

What this means for you

Trent’s first takeaway was that archive changes access, not governance, so your compliance setup keeps working. His second was to start manually and scale with policies, and his third was that archiving can only save you money. If you’re a Microsoft 365 admin, here’s where I’d start:

Turn on Microsoft 365 Archive with pay-as-you-go billing, and decide which sites show users the Archive action.
Pick a dozen sites whose owners want to try it, and show their users the Archived filter and how to reactivate a file.
Follow both policies through preview, and check which licenses you have for each.
Estimate your savings with Syskit’s free storage calculator, which needs no permissions on your tenant.

Trent’s last piece of advice was to go try it. You can archive a one-megabyte file without any impact on your bill, so play with it and give his team your feedback.

Ready to start archiving? My Microsoft 365 file-level archive guide on the Syskit blog walks through turning on file-level archive, the PowerShell settings that control it, and my recommendations for getting started. Read the file-level archive in-depth guide

How Microsoft Copilot Accesses Your Work Data and the Web

Vlad Catrinescu — Fri, 09 Oct 2026 11:59:45 GMT

Microsoft Copilot (formerly Microsoft 365 Copilot) sees the same data as your users, but how does it actually access and use it? Copilot doesn’t directly access your data, and it doesn’t just open up SharePoint and start reading files. The process involves several different systems and safety checks, and as an IT professional, understanding how it works gives you the mental model behind the protection and governance tools you’ll use with Copilot.

Key takeaways

Copilot doesn’t read your files directly. It grounds your prompt with Microsoft Graph and Work IQ before anything reaches the large language model.
Copilot checks that the user can access the content, respects Restricted Content Discovery and Restricted SharePoint Search, and applies your Purview labels and data loss prevention policies.
The prompt you type isn’t the prompt the large language model receives, because Copilot modifies it along the way.
When Copilot needs the web, it sends Bing a short, anonymized query, not your full prompt, your files or your identity.
Your work data stays inside your Microsoft 365 service boundary, and admins can turn web search off.

Why Copilot data access matters for IT pros

We already know that Microsoft Copilot can access your data. If you manage a Microsoft 365 tenant, you also need the technical details of how it gets to that data, especially your work data.

Microsoft also uses a lot of different product names here, some more technical and some more marketing, especially in the Copilot ecosystem. You’ll often see Microsoft Graph, Work IQ and even more advanced terms like the semantic index. I’m going to focus on what’s in scope for the AB-900 exam, so let’s start with two definitions.

Microsoft Graph and Work IQ explained

Microsoft Graph is the index of your tenant. Everything Microsoft 365 already knows about your users’ files, mail, chats, meetings and calendars sits in or behind Microsoft Graph. It’s really the catalog, and it has been around for a while: the Microsoft Graph API went generally available in November 2015, and most documentation today still references Microsoft Graph when it talks about how Copilot accesses data. If you’re a developer, you probably use the Microsoft Graph API every single day.

Work IQ is the layer that takes Copilot to the next level. It doesn’t only have access to the data, it also has memory and inference, so Copilot understands what matters to you. That means who you collaborate with the most, the topics you focus on day to day, the projects you actually spend time in, and the files you really open compared to the ones you needed on a previous project that aren’t relevant anymore.

Work IQ is much newer. It launched at Microsoft Ignite in November 2025, around the same time as the AB-900 exam. Think of Work IQ as the personalized layer on top of Microsoft Graph. They work together to give Copilot its power.

How Copilot accesses your work data

It all starts with the user, who writes a prompt in Microsoft Copilot. Copilot acts like an orchestrator, and the first thing it needs to do is ground that prompt, which means finding the information from your organization that helps answer it. Here it uses both Microsoft Graph and Work IQ, and the goal is to select the most relevant documents before anything is sent to the large language model.

This is important, because it’s part of the value Microsoft adds. The relevant documents, emails and information are selected by the orchestrator before they ever reach the large language model.

The safety checks before the large language model

Microsoft also checks several things about those documents before they get to the model:

Does the user have access to those documents?
Are there restrictions, like Restricted Content Discovery or Restricted SharePoint Search, that say this content shouldn’t show up in Copilot?
Are there Microsoft Purview sensitivity labels or data loss prevention policies that change how Copilot can handle the data it found?

After Copilot does all of that, it combines the information and sends it to the large language model as part of your prompt.

Your prompt isn’t the prompt the model receives

The prompt the user types isn’t the same prompt that gets sent to the large language model. Copilot modifies that prompt a lot before it gets there, including for responsible AI. That’s also why you sometimes get different results between ChatGPT and Microsoft Copilot, even on general knowledge questions, when they use the same model in the back.

The answer then goes back to the user. Since Copilot checks things like Purview, if content was generated from data with a sensitivity label, the content Copilot generates keeps that label. Tools like Microsoft Purview and Microsoft Defender monitor everything, so every interaction is logged and any suspicious prompts are escalated to the admin team. And everything that has to do with your work data remains inside your Microsoft 365 service boundary and respects your service agreement.

How Copilot accesses web data

Web data works differently. This is when Copilot needs to go to the public web to get information that improves the answer to your prompt, or when you ask it to research the web.

Everything starts the same way. The user sends Microsoft Copilot a prompt, the orchestrator decides it needs data from the web, and Copilot creates a short, anonymized query stripped of your identity, with no file information. It sends that query to Bing, which gets the information from the public internet. That part is outside your Microsoft 365 service boundary, so when it comes to web data, you’re leaving that trusted boundary before going back to the large language model.

Even when the query leaves your boundary, there are still safety guardrails:

Admins can turn web search off. Because data leaves the tenant, even anonymized, some organizations prefer to disable it.
Users can switch between work and web. In work mode, Copilot can use their work data as well as the web. In web mode, it uses the web and the context they give it, but not their work data.
The query is anonymized. No identity and no files leave your tenant.
A safety filter runs before the answer gets back to the user. The answer also comes with citations, so the user can verify where the information came from.

So yes, some information does leave your service boundary, but it’s only a short query generated by Copilot. It’s not the full prompt, it’s not any file, and the user’s identity stays safe inside the tenant.

Four things to remember for the AB-900 exam

There are four things I want you to remember for the AB-900 exam about how Copilot keeps your information safe:

Copilot reads only what the requesting user can read. No backdoors, no elevated service account, no admin shortcut. It will never surface data the user doesn’t have access to.
Copilot always respects your compliance settings, such as data loss prevention policies, sensitivity labels and data residency.
Your work data stays in your Microsoft 365 boundary, including your documents and identities.
Microsoft Purview and Microsoft Defender XDR make sure everything is logged, and anything suspicious is escalated according to the policies you have in place.

Microsoft sometimes groups those into four principles: data minimization, transparency, content filtering and auditability. My AB-900 study guide maps the rest of the skills measured.

What this means for you

So the work answers follow your permissions, and the web answers? Well, that’s a switch. Both are things you control as an admin, which is why this mental model matters before you roll Copilot out.

On the work side, Copilot only shows people what they can already access, so the protection and governance tools you already have, from permissions to Restricted Content Discovery to Purview labels and data loss prevention, are the tools that shape what Copilot can use. On the web side, decide whether your organization is comfortable with an anonymized query leaving the service boundary. The control is the Allow web search in Copilot policy, which Microsoft documents in its data, privacy and security guide for web search in Copilot.

If you’re preparing for the exam, those four points are the ones to know cold. I also shared what to expect on the AB-900 exam after I took it.

Ready to get AB-900 certified? This lesson is part of my AB-900 certification path on Pluralsight, which covers the core Microsoft 365 services, data protection and governance, and the basics of Copilot and agent administration. Later in the path, I show you exactly where to turn web search on or off in the Microsoft 365 admin center. Start the AB-900 path on Pluralsight.

Identity Secure Score in Microsoft Entra ID: What to Fix First

Vlad Catrinescu — Tue, 06 Oct 2026 17:17:43 GMT

Microsoft gives every tenant a score for how protected your identities are, and it’s included in every Microsoft Entra ID license. Have you checked yours? It’s called Identity Secure Score, and it’s a lot more useful than a report card, because it ranks every recommendation by how much risk it removes, so you can see which moves are worth the most points.

Key takeaways

Every Microsoft Entra ID tenant has an Identity Secure Score, Free edition included, and you’ll find it right on the home page of the Microsoft Entra admin center.
Each recommendation is worth points based on how much it reduces your identity risk, so the ones worth the most points are the ones to tackle first.
If you only do one thing, require multifactor authentication for administrative roles, because an attacker who gets into an admin account without it is in control of your tenant.
Microsoft recalculates your score every 24 hours, and it can go down as well as up, for example when you add users and don’t secure them properly.
Microsoft Copilot (formerly Microsoft 365 Copilot) answers with whatever each identity can reach, so your identity posture really is your Copilot posture.

What Identity Secure Score measures

Almost every breach we see in the news these days starts the same way, with someone’s credentials getting compromised. But before you can improve your identity security, you need a way to measure it, and luckily for us, Microsoft built a feature that sums up your identity security posture in a single number. That feature is Identity Secure Score, and whether you’re on Entra ID Free or Entra ID P2, your tenant already has one, even if nobody has opened it yet.

Its whole job is to help you decide what to fix first. It ranks every recommendation by how much it would reduce your identity risk, and the bigger the security impact, the more points you get for implementing it. So if, for example, one recommendation moves your score by eight points and another moves it by two, you know exactly which one to tackle first.

How the score updates, and where else it shows up

Your score shows up as a percentage, and Microsoft recalculates it every 24 hours, so when you make a change, you’ll see the improvement within a day. That works both ways, though. Add a new identity without securing it properly, and you can watch your score go down just as quickly.

Your identity score also syncs into Microsoft Secure Score in the Microsoft Defender portal, where it sits alongside the scores for your apps and devices, so your security team gets one view across every pillar. From an Entra point of view, though, this is the score for Entra admins. It’s the full identity picture, the part you can actually do something about, while your security admins in Defender keep an eye on the whole tenant.

Which recommendations have the biggest impact?

The top one is requiring multifactor authentication for administrative roles, at 10 points, and close behind it, at 9, is making sure all your users can complete multifactor authentication. You’ll also see recommendations for a sign-in risk policy, a user risk policy and a policy to block legacy authentication. There are plenty of others, of course, and Microsoft keeps adding and removing them as identity security evolves (and, unfortunately, as hackers evolve too). So it’s worth checking your score often and keeping it as high as you can.

Require multifactor authentication for administrative roles

Ten points is the most Microsoft gives any single recommendation, and for good reason. If an attacker compromises any admin account that isn’t protected by multifactor authentication, and especially a Global Administrator account, they’re now in control of your tenant. So if you only do one single thing after reading this, make it this one.

A sign-in risk policy uses Microsoft Entra ID Protection to automatically challenge sign-ins that look risky, for example by asking for multifactor authentication. ID Protection is also what flags a user signing in from Germany five minutes after they were active in Canada, and unless your users have a teleporter, that’s exactly the kind of sign-in you want flagged.

Protect all users with a user risk policy

If Microsoft finds a user’s credentials leaked on the dark web, a user risk policy automatically makes that user reset their password the next time they sign in.

I think this is a really cool feature, because there are so many sites, forums and credential dumps out there that only dedicated security professionals and hackers know about. You’ve probably never heard of most of them, which is for the best. Microsoft runs a large-scale credential scanning operation that pulls from those sources, from law enforcement and from its own threat intelligence teams, and it checks what it finds against your users’ current passwords in Entra ID. When there’s a match, the policy forces that password reset, so your identities stay protected around the clock. If your users are synced from on-premises, this relies on password hash sync.

Enable policy to block legacy authentication

Legacy protocols, like basic authentication for Exchange, can’t enforce multifactor authentication at all, and attackers know it, so they specifically target those protocols to get around your modern security. This one is worth 7 points, and Microsoft’s own analysis found that more than 99 percent of password spray attacks use legacy authentication protocols.

Identity Secure Score on the AB-900 exam

If you’re studying for the AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals certification, this one is worth your time, because interpreting Identity Secure Score in Microsoft Entra ID is one of the skills measured in Microsoft’s AB-900 study guide. For the exam, remember that Identity Secure Score ranks recommendations by how much risk they reduce, so the bigger the security impact of an action, the more points it adds to your score.

And if you want to know what else to expect on exam day, my AB-900 exam review walks through the question types and the resources I recommend.

Checking the score in a real tenant

You don’t have to go hunting for it. Sign in to the Microsoft Entra admin center, and your Identity Secure Score is right there on the home page, in the Tenant status card at the top right. In my lab tenant, it’s been pretty static at around 46 to 47% for the past two or three months, so clearly I’ve got some homework to do as well.

Select View recommendations, give it a second to load, and you’ll see everything you can do to improve your score. All shows every recommendation, which in my tenant includes security best practices and a few from Microsoft Defender for Identity. The Security filter narrows the list down to the ones that count toward your score.

The first one on my list is Protect your tenant with Insider Risk condition in Conditional Access policy, which brings the insider risk signal from Microsoft Purview into your Conditional Access policies. It needs a Microsoft Entra ID P2 license, and completing it would get me an extra five points, which is pretty cool.

Select any recommendation and you get the full story: its status (Active, in my case), the date it was checked, and the users it affects. Right now, eight out of eight users in my tenant aren’t covered by an insider risk condition in a Conditional Access policy, so the more users I add to that policy, the better my score gets.

Why your score can go down

The second recommendation on my list, Enable self-service password reset, sits at 0.22 out of 1. That looks like a funny score until you open it and see that seven users in my tenant don’t have self-service password reset enabled, which is why I only get part of the point.

Microsoft scores some recommendations all or nothing, and others as a percentage, like the share of your users who are covered, which is exactly where a number like 0.22 comes from (Microsoft’s documentation walks through the math). It’s also why your score can go down. If you add new users and don’t secure them properly, that one point shrinks, because a bigger share of your users is missing the recommendation.

So at a high level, that’s Identity Secure Score: a list of recommendations, plus a score that tells you where your identity security posture stands today and what you can do to improve it in Entra ID.

What this means for you

Microsoft Copilot answers with whatever each identity can reach, so your identity posture really is your Copilot posture. If you want the bigger picture on that, I cover it in why generative AI amplifies the security risks you already have.

So go check your score in the Microsoft Entra admin center today:

Open View recommendations from the Tenant status card on the home page, and pick the Security filter.
If Require multifactor authentication for administrative roles isn’t complete, start there, because that’s the one I’d do first.
Check the Required licenses column before you plan anything, since some recommendations need Microsoft Entra ID P1 or P2.
Come back often, because Microsoft keeps adding and removing recommendations as identity security evolves.

And if your sign-in risk or user risk policies still live in ID Protection, it’s time to move them to Conditional Access, because Microsoft set October 1, 2026 as the retirement date for those legacy risk policies.

Ready to prepare for the AB-900? Identity Secure Score is just one piece of my AB-900 certification path, which covers the core Microsoft 365 services, data protection and governance, and the basics of Copilot and agent administration. You’ll find this topic in Identify the Core Features and Objects of Microsoft 365 Services, the first course of the full AB-900 path on Pluralsight. And for free resources plus my notes on every skill measured, grab my AB-900 study guide.

AB-650 Exam Review: Where Your Study Hours Should Really Go

Vlad Catrinescu — Tue, 06 Oct 2026 02:57:07 GMT

I took the AB-650 exam while it was still in beta. If I had planned my study time around the exam’s title, I would have studied the wrong things, and that’s the main thing I want you to know before you book it. Of course I can’t share any questions because of the NDA which we should all respect, but in this blog post, I want to share with you where I’d put your study hours and what to expect on exam day.

Key takeaways

The biggest part of the AB-650 is Govern and secure Microsoft 365 tenants and workloads, at 40-45% of the exam, and it’s mostly Microsoft Entra and Microsoft Purview.
For Purview, you need to know how to configure things like DLP policies and sensitivity labels, not just what they do.
Settings for Microsoft Copilot (formerly Microsoft 365 Copilot), Microsoft Agent 365 and SharePoint Advanced Management change fast, so click through them yourself before the exam.
Expect PowerShell, including knowing which older modules Microsoft doesn’t recommend anymore.
If this is your first Microsoft exam, start with the AB-900 and the SC-900.
If you were planning on the MS-102, it retires on November 30, 2026, and Microsoft recommends the AB-650 instead.

What the AB-650 exam really tests

The exam is called Administering Microsoft 365 and AI Services, and passing it gets you the Microsoft 365 and AI Services Administrator Associate certification. Microsoft first announced it as the AI Services Administrator Associate, so you’ll see both names out there. If you read either name and go straight to booking, you’ll walk in expecting a Microsoft 365 administration exam with some Copilot on top.

That’s not really what this is. My exam had a lot of Microsoft Entra and a lot of Microsoft Purview, and not that much Microsoft 365 directly. Everything was still about things that affect Microsoft 365, so it makes sense once you’re sitting there. It’s just not where I would have put my study hours based on the title alone.

And I have to be fair to Microsoft, because the study guide does tell you this. Look at how the exam is split, and Govern and secure Microsoft 365 tenants and workloads is worth 40-45%. That’s the biggest area by far, almost half of the exam, and it’s almost entirely Entra and Purview, with Microsoft Defender for Office 365 in there as well.

Skill area	Weight	What’s in it
Configure and manage Microsoft 365 tenants and workloads	20-25%	Tenant settings, domains, licenses, Microsoft 365 Backup, mailboxes, teams and SharePoint sites
Govern and secure Microsoft 365 tenants and workloads	40-45%	Microsoft Entra identities and authentication, Microsoft Defender for Office 365, Microsoft Purview
Manage and secure AI services in Microsoft 365	35-40%	Copilot settings, agents and Microsoft Agent 365, AI usage and cost monitoring

Even the AI part brings Entra back in, since agents now get their own identities through Microsoft Entra Agent ID. You can see the full breakdown in the AB-650 study guide on Microsoft Learn.

So the information is right there. It’s the exam title and the AI Services Administrator name on the certification that pull your attention toward Copilot and agents, when about half of the exam is identity and data protection.

My advice is the same one I’ve been giving IT pros for years, for every exam. Don’t just look at the title, and don’t just look at the marketing around it. Look at the study guide and at how Microsoft splits the exam, because the two don’t always tell the same story. Study everything, but if you’re going to over-invest anywhere, over-invest in Microsoft Entra and Microsoft Purview.

What I would brush up on

Let’s get a bit more practical. I’m calling out these areas because a lot of Microsoft 365 admins don’t use them day to day.

Microsoft Entra ID

Start with Microsoft Entra ID, and that includes authentication methods and Microsoft Entra Password Protection. Don’t forget that most organizations still have hybrid environments, so you need to know how to configure and manage those too, not just cloud-only scenarios. Password Protection is a good one to practice for that, since you can extend its banned password lists to your on-premises Active Directory with agents on your domain controllers.

Microsoft Defender for Office 365

Next is Microsoft Defender for Office 365. Go play with all the different services inside it, and not just on their own, but also how they integrate with Microsoft Purview.

Microsoft Purview

Speaking of Purview, this isn’t the SC-900, where you just need to know what each product does at a high level. You need to know how to actually configure it: data loss prevention (DLP) policies, sensitivity labels, sensitive information types. Reading about them isn’t enough, so get into the portal and build a few of each.

Copilot and Agent 365 in the Microsoft 365 admin center

This is a big one for the AI part of the exam. You need to know where everything is in the Microsoft 365 admin center for managing Copilot, and for Microsoft Agent 365.

I know what you might be thinking, and I agree: that whole area is brand new and moving fast. That’s how Microsoft ships things today, so remembering a blog post you read three months ago might not be enough. Go click through the admin center yourself before the exam. Microsoft’s study guide even says the exam can include preview features when they’re commonly used.

SharePoint Advanced Management

And don’t forget SharePoint Advanced Management. This is another one where you need to look at the latest, because it moves fast. Restricted Content Discovery, or RCD for short, changed behavior recently. Microsoft announced the change in message center post MC1427972, and the rollout started in late July 2026.

With the new behavior, files you recently accessed on a site with RCD turned on no longer show up for you in Copilot or Microsoft 365 search. Before, if you had recently viewed, edited or shared a file, you could still find it. The update also removes the Copilot button, the AI menus and Create pages with AI from those sites. Some older documentation still describes the old behavior, so make sure you know what changed. I also go deeper on RCD in my post on SharePoint agent governance.

Learn where things live across the admin centers

A broader tip for the entire exam is to learn where things live across the different admin centers. For any given task, know all the places you could configure it, because some settings exist in more than one admin center. Creating a user is the easy example, since you can do it in the Microsoft 365 admin center or in the Microsoft Entra admin center. At associate level, knowing which admin center is best, or which one gives you the option Microsoft is asking about, is an important distinction.

How much PowerShell is on the AB-650?

Because this is an associate exam, you also need to know PowerShell. The PowerShell questions I got weren’t that difficult, but I also spend way more time in PowerShell than the average IT pro, so that might be why they felt easy to me.

At a high level, know which modules you have, how to connect to each service, and what a few commands look like for each module. If you want a quick refresher, these are the main ones:

Service	Module	Connect with
Microsoft Entra ID and Microsoft Graph	Microsoft Graph PowerShell	`Connect-MgGraph`
Exchange Online	ExchangeOnlineManagement	`Connect-ExchangeOnline`
Microsoft Purview (Security & Compliance PowerShell)	ExchangeOnlineManagement	`Connect-IPPSSession`
SharePoint	Microsoft.Online.SharePoint.PowerShell	`Connect-SPOService`
Microsoft Teams	MicrosoftTeams	`Connect-MicrosoftTeams`

You also need to know the past modules. You might get questions where more than one option would work, but some of them use modules that Microsoft doesn’t recommend anymore, like the Azure AD and MSOnline modules that Microsoft Graph PowerShell replaced. So know which modules to use today.

Where to start if this is your first Microsoft exam

If this is your first Microsoft certification exam, or you’re just starting with Microsoft 365 and Copilot administration, I would start with the AB-900 (Microsoft 365 Copilot and Agent Administration Fundamentals) and the SC-900 (Microsoft Security, Compliance, and Identity Fundamentals). They aren’t required for the AB-650, but they give you a lot of the foundation on Microsoft 365, Copilot, Purview and Defender, and you can build up to the associate level from there. My AB-900 study guide and SC-900 study guide have free resources for both.

What to expect on exam day

I can’t share the number of questions on the exam, but Microsoft says most of its exams have between 40 and 60, and you get 100 minutes for an associate exam, or 120 if it may contain labs. For an associate-level exam like this one, expect the more advanced question types too: scenarios, questions where you put steps in the right order (Microsoft calls those build list questions), and pretty much every other question type Microsoft uses. You can try them all in Microsoft’s free exam sandbox.

Is the AB-650 a fair exam?

If I had to give an opinion, I think it’s a really fair exam, and a really fair test of how the job of a Microsoft 365 administrator has changed in the era of AI. For a long time, a lot of us mostly needed to know how to manage SharePoint. Now we need to understand identity better, because identity is the first way people get hacked. We need to understand data protection and Purview. And now we’re governing agents that have their own identities, all on top of the workload administration we already do.

So I think it points people in the right direction, with the right knowledge. Just go in with the right expectations about where the weight actually sits. If you’re a SharePoint, Teams or Exchange admin and you haven’t really touched Purview or Entra ID, learn those before you sit the exam.

What this means for you

If you’re a Microsoft 365 admin, this is the certification that lines up with what the job looks like now. And if you were planning to take the MS-102, keep the date in mind: Microsoft retires it on November 30, 2026, and recommends the AB-650 certification instead.

To get ready, I would go in this order:

Read the AB-650 study guide and check yourself against the Govern and secure section first, since it’s 40-45% of the exam.
In a test tenant, build a few DLP policies, sensitivity labels and sensitive information types, and spend time in Defender for Office 365.
Click through the Copilot and Agent 365 settings in the Microsoft 365 admin center, and read up on the new RCD behavior.
Practice connecting to each service with the current PowerShell modules.
If this is your first Microsoft exam, take the AB-900 and the SC-900 first.

Ready to start studying for the AB-650? My AB-650 study guide covers every skill measured on the exam, with free study notes and resources. And if you want to go deeper on Microsoft 365, Copilot and Purview, check out my 100+ courses on Pluralsight.

The end of SharePoint OTP

Vlad Catrinescu — Mon, 28 Sep 2026 16:00:00 GMT

Prepare for the SharePoint OTP retirement in October 2026. Learn what changes, which external users are affected, and how to prevent access issues.

Vlad Talks Tech

Is the AB-400 Harder Than the PL-400? A PL-400 Trainer Weighs In

Why Nathalie took the AB-400 after the PL-400

What changed in the AB-400 exam

Do you need the AB-400 if you already have the PL-400?

What to get hands-on with before the AB-400 exam

Does the AB-400 match what companies are building?

Should the AB-400 be your first Power Platform exam?

Nathalie’s final tip: don’t underestimate it

What this means for you

Power Platform Just Hit 80 Million Users: PPCC 2026 Keynote Highlights

Inside the Power Platform Community Conference 2026

The Power Platform now has 80 million monthly active users

A new, unified Microsoft Maker Community

Better tools: the first demo had no AI at all

Power Apps: a pop-out formula bar and faster controls

Power Automate: inline action cards and virtual network connectivity

More makers: build Power Apps from Microsoft Copilot

No cliffs: low-code apps are code underneath

The Copilot Managed Runtime fixes the localhost:3000 problem

Copilot Studio workflows and the GitHub Copilot harness

Agents get their own identity, mailbox and OneDrive

The first governance demo on a PPCC keynote stage

What this means for you

PPCC 2027 moves to Chicago

SharePoint hero links: Why every file now gets a single primary sharing link, and what it means for admins

How Agent Approval Works in Microsoft 365

Agent approval in Microsoft 365 depends on the type of agent

SharePoint agents don’t have an approval process anymore

Agent Builder: the sharing default that surprises most admins

Copilot Studio agents need an admin to approve them

How each approval flow looks in practice

Set the main agent on a SharePoint site

Share an Agent Builder agent

Submit a Copilot Studio agent to the org catalog

Approve or reject the request in the Microsoft 365 admin center

What this means for you

Copilot in SharePoint FAQ: Your Agents, Skills and Autofill Questions Answered

Getting Copilot in SharePoint in your tenant

How do I know when Copilot in SharePoint is available in my tenant?

Does Copilot in SharePoint work in GCC?

What is Site AI?

What the Copilot license covers, and when you need Copilot Credits

Does creating a skill cost extra?

Will the prebuilt SharePoint page and list agents need Copilot Credits?

Can everyone use an agent I put on a site?

Does testing an agent in the preview pane use credits?

SharePoint agents are moving to Agent Builder

Is a SharePoint agent basically an Agent Builder agent now?

Why did the agent in my navigation disappear?

Does a SharePoint agent get a Microsoft Entra ID, and does it show up in Agent 365?

Can an agent answer only from approved documents?

Can I choose the model Copilot in SharePoint uses?

Autofill columns

Do autofill columns work with site columns and the term store?

Does turning on autofill add the column to every library on the site?

Can I roll out autofill columns across hundreds of libraries?

Protecting your content

Can I use SharePoint Advanced Management to keep sites out of Copilot?

Can admins sanitize the HTML that Copilot creates?

What this means for you

Microsoft 365 Archive FAQ: Copilot, Retention, Reactivation and Cost

How Microsoft 365 Archive works

What is Microsoft 365 Archive?

Does archived content leave SharePoint?

Does archived content stay in the same country?

Copilot and search

Does Copilot use archived content?

Can users still find archived files in search?

What changes when content is archived

Does archiving change a site’s storage quota?

How long does reactivation take?

Do eDiscovery, legal holds and retention policies still work?

Archiving is not retention

Does archiving a file mean it’s retained?

Will a retention policy that deletes content also delete archived files?

File-level or site-level archive

When should I use file-level archive instead of site-level archive?

Can I archive a Teams site with private or shared channels?

What archiving looks like for your users