AB-900 Study Guide

Microsoft 365 licenses control which services and features a user can access. No license means no access, regardless of permissions. Licenses can be assigned to individual users through the Microsoft 365 admin center, or at scale through group-based licensing in Microsoft Entra ID.

What you need to know

• Different license tiers (E1, E3, E5 for enterprise; Business Basic, Standard, Premium for SMB; A1, A3, A5 for education) include different feature sets
• Group-based licensing automatically assigns or removes licenses as users join or leave groups, which is the recommended approach for organizations with many users
• Licensing and permissions are separate concepts. A licensed user still needs appropriate permissions to access specific resources
• For Microsoft 365 Groups, the creator's license determines group capabilities

Microsoft Learn resource: Assign licenses to users in the Microsoft 365 admin center (opens in a new tab)

The Microsoft 365 admin center is the central hub for tenant-wide settings. Organization configurations include domain names, company profile information, release preferences, and password policies.

What you need to know

• Custom domains (like contoso.com) are verified using DNS records (TXT or MX) before they can be used for email routing
• The Domain Name Administrator role is required to add, modify, or remove domains
• Organization profile settings include company name, address, and release preferences (Standard release vs. Targeted release)
• Targeted release lets you preview new features before they roll out to all users

Microsoft Learn resource: Add a domain to Microsoft 365 (opens in a new tab)

Exchange Online manages all email-related objects in your organization. The key objects are mailboxes, distribution lists, and mail contacts.

What you need to know

Exam tip: Shared mailboxes do not require a license. This is a commonly tested fact because it has real cost implications for organizations.

Microsoft Learn resource: Manage mailboxes in Exchange Online (opens in a new tab)

SharePoint organizes collaboration through sites, libraries, lists, and folders. The SharePoint admin center lets you manage all of these at the organizational level.

What you need to know

• Team sites are connected to Microsoft 365 Groups and Microsoft Teams. They are for collaborative work where everyone contributes
• Communication sites are standalone and designed for one-to-many communication (company news, department updates)
• Document libraries store files and support versioning, check-out/check-in, and metadata
• Lists store structured data with columns and views
• OneDrive represents personal storage; SharePoint sites are for team and organizational content

Exam tip: Know the difference between team sites and communication sites. Team sites are group-connected and collaborative; communication sites are for publishing content to a wider audience.

Microsoft Learn resource: Manage sites in the SharePoint admin center (opens in a new tab)

SharePoint uses role-based access control with permission inheritance. Sites, libraries, lists, and individual items can all have their own permissions.

What you need to know

• Permissions are inherited by default from the parent object (site to library to folder to item)
• You can break inheritance to set unique permissions at any level
• The SharePoint Administrator role in Microsoft 365 can create/delete sites, manage sharing settings, and manage storage limits
• For team sites connected to Microsoft 365 Groups, group owners become site owners and group members become site members

Microsoft Learn resource: Understanding permission levels in SharePoint (opens in a new tab)

Microsoft Teams organizes collaboration through teams, channels, and policies. The Teams admin center controls the features available to users across the organization.

What you need to know

• Teams are the main container for a group of people working together
• Channels organize conversations by topic within a team. They come in three types: standard (visible to all team members), private (restricted membership), and shared (allows cross-organization collaboration)
• Policies control feature availability and come in several types:

• Policies can be assigned to individual users, groups, or applied as org-wide defaults
• Shared channels are different from guest access. Shared channels enable true cross-organization collaboration without requiring users to switch tenants

Microsoft Learn resource: Manage teams in the Microsoft Teams admin center (opens in a new tab)

Zero Trust is a security architecture built on the idea that you should never automatically trust anything, whether it is inside or outside your network. Every access request must be verified.

The three core principles

1. Verify explicitly: Always authenticate and authorize based on all available data points, including user identity, location, device health, and the resource being accessed
2. Use least privilege access: Limit user access with Just-In-Time (JIT) and Just-Enough-Access (JEA) policies. Give people only the permissions they need, for only as long as they need them
3. Assume breach: Design your security as if attackers are already inside. Minimize blast radius, segment access, verify encryption end-to-end, and use analytics to detect threats

Exam tip: Zero Trust is a strategy and architecture, not a single product you can buy. It applies across identities, devices, applications, data, networks, and infrastructure.

Microsoft Learn resource: What is Zero Trust? (opens in a new tab)

Authorization determines what an authenticated user is allowed to do. In Microsoft 365, authorization is managed through role-based access control (RBAC), group memberships, and resource-level permissions.

What you need to know

• Authentication answers "who are you?" while authorization answers "what can you access?"
• RBAC assigns users to roles, and roles contain specific permissions
• Group-based authorization scales better than assigning permissions to individual users
• Conditional Access can make real-time authorization decisions based on risk, location, and device compliance

Microsoft Learn resource: Role-based access control in Microsoft Entra ID (opens in a new tab)

Authentication verifies that users are who they claim to be. Microsoft 365 supports multiple methods, from traditional passwords to modern passwordless options.

What you need to know

• Multifactor authentication (MFA) combines two or more methods and reduces account compromise risk by 99.9%
• Security defaults provide a baseline level of security for all tenants by requiring MFA through the Authenticator app
• Conditional Access-based MFA is more granular and recommended over per-user MFA
• Legacy authentication protocols (IMAP, POP3, SMTP) should be blocked because they do not support MFA

Exam tip: Know the difference between per-user MFA (legacy approach) and Conditional Access MFA (modern, recommended approach). Also know that FIDO2 and Windows Hello are phishing-resistant methods.

Microsoft Learn resource: Authentication methods in Microsoft Entra ID (opens in a new tab)

Microsoft 365 includes multiple Defender products that work together to detect, analyze, and respond to security threats across your environment.

What you need to know

• Threat intelligence aggregates signals from billions of security events to identify emerging threats
• Threat analytics provides in-product reports on active attack campaigns and their organizational impact
• These products share signals in real time, so blocking a threat in one product can prevent it across the entire suite

Microsoft Learn resource: Microsoft Defender XDR overview (opens in a new tab)

Microsoft Defender XDR (Extended Detection and Response) unifies all the individual Defender products into a single coordinated security platform.

What you need to know

• Unified incident queue: One place to see all security incidents across endpoints, email, identity, and cloud apps
• Automatic attack disruption: Can automatically contain an attack by disabling or isolating compromised assets before a security analyst even gets involved
• Advanced hunting: Lets you write custom queries (using KQL) to search across 30+ days of raw signal data
• Self-healing: AI-powered remediation for compromised devices, user identities, and mailboxes
• Cross-product correlation: Automatically connects related alerts into incidents so you see the full attack story

Exam tip: Automatic attack disruption is unique to the XDR layer and is not available when using individual Defender products alone. This is a key differentiator.

Microsoft Learn resource: Microsoft Defender XDR (opens in a new tab)

Microsoft Entra ID (formerly Azure Active Directory) is the identity and access management platform that powers Microsoft 365. It handles who can sign in and what they can access.

What you need to know

• Core functions: User and device management, authentication, authorization, and identity governance
• User types: Cloud-only users, hybrid users (synced from on-premises AD), and guest users (external)
• Group types: Security groups (for resource access), Microsoft 365 groups (for collaboration), and distribution groups (for email)
• Application management: Register apps, configure single sign-on, and assign users to applications
• Reporting: Activity reports, audit logs, sign-in logs, and risky user/sign-in reports
• Licensing tiers: Free, P1, P2, and ID Governance, each adding more capabilities

Microsoft Learn resource: What is Microsoft Entra ID? (opens in a new tab)

Conditional Access is the policy engine at the heart of Zero Trust in Microsoft 365. It evaluates every sign-in attempt and makes real-time access decisions based on conditions you define.

What you need to know

Conditional Access policies follow an "if/then" structure:

• If (assignments): Who is signing in? From where? On what device? To which app?
• Then (access controls): Allow access, block access, require MFA, require a compliant device, or limit the session

• Conditional Access requires Microsoft Entra ID P1 or P2 (included with E3/E5)
• Report-only mode lets you test policies safely before enforcing them
• Policy templates provide pre-built configurations for common scenarios (like requiring MFA for all admins)

Exam tip: Security defaults and Conditional Access are mutually exclusive. If you enable Conditional Access policies, you need to disable security defaults. Conditional Access provides much more granular control.

Microsoft Learn resource: What is Conditional Access? (opens in a new tab)

Single Sign-On (SSO) lets users authenticate once and access all their authorized applications without re-entering credentials.

What you need to know

• User benefits: Fewer passwords to remember, faster access to apps, fewer help desk calls for password resets
• Security benefits: Centralized authentication means you can enforce MFA and Conditional Access across all applications from one place
• Admin benefits: Consistent security policies, full audit trail, simplified user provisioning and deprovisioning
• SSO protocols: SAML 2.0, OpenID Connect, OAuth 2.0, and password-based SSO
• Microsoft Entra ID supports thousands of pre-integrated SaaS applications for SSO through the app gallery

Microsoft Learn resource: What is single sign-on in Microsoft Entra ID? (opens in a new tab)

Users and groups are the foundational objects for managing identity and access in Microsoft Entra ID.

What you need to know

• Dynamic groups automatically update membership based on user attribute rules (department, location, job title)
• Assigned groups require manual member management
• Group owners manage membership; resource owners assign permissions to groups
• Security groups can be nested (a group can contain other groups)

Microsoft Learn resource: Manage groups in Microsoft Entra ID (opens in a new tab)

When users cannot sign in, you need to know where to look. Microsoft Entra ID provides several diagnostic tools.

What you need to know

• Sign-in logs: Show every authentication attempt with success/failure status, which Conditional Access policies were applied, MFA status, and risk level
• MFA troubleshooting: Check that the user has registered an MFA method. A policy cannot enforce MFA if the user has not completed registration
• Conditional Access diagnostics: Sign-in logs show exactly which policy blocked access and why
• Risky sign-in detection: Machine learning identifies unusual patterns like impossible travel (signing in from two distant locations within minutes), unfamiliar locations, and credential spray attacks
• Common error codes: 500121 (MFA not completed), 70046 (session expired)

Exam tip: The most common sign-in troubleshooting scenario on exams involves identifying whether a Conditional Access policy is blocking access. Always check the sign-in logs first.

Microsoft Learn resource: Troubleshoot sign-in errors in Microsoft Entra ID (opens in a new tab)

Identity Secure Score tells you how well your organization's identity configuration aligns with Microsoft's security best practices.

What you need to know

• Displayed as a percentage; higher is better
• Updated approximately every 24 hours
• Includes 23+ recommendations such as: enable MFA for all admins, block legacy authentication, enable SSO, configure access reviews, and use PIM
• Score does not measure the likelihood of a breach. It measures your security posture against recommended practices
• Some recommendations require P1 or P2 licensing to implement

Exam tip: Identity Secure Score is identity-specific. Microsoft Secure Score is the broader, organization-wide score that covers five domains. Do not confuse the two.

Microsoft Learn resource: Identity Secure Score in Microsoft Entra ID (opens in a new tab)

Audit logs record all changes made by users and admins in your Microsoft 365 environment. They are essential for security investigations and compliance verification.

What you need to know

• Audit logs cover: user creation/deletion, license changes, password resets, role assignments, policy changes, file sharing, and more
• Logs can be searched through Microsoft Purview audit log search or the Microsoft 365 admin center
• Default retention is 90 days (extendable with audit retention policies)
• Each log entry includes: the user who performed the action, the action taken, the date/time, the IP address, and the affected resources
• Global admin or audit read permissions are required to access logs

Important distinction: Audit logs record all activities (who changed what); sign-in logs record authentication attempts (who signed in and from where). They are different tools for different purposes.

Microsoft Learn resource: Search the audit log in Microsoft Purview (opens in a new tab)

PIM provides just-in-time privileged access instead of permanent "always-on" admin roles. This dramatically reduces the risk window for sensitive operations.

What you need to know

• Instead of having permanent Global Admin access, a user is made "eligible" and must activate the role when needed
• Activation requires MFA, a justification, and optionally an approval from another admin
• Access is time-bound: the role automatically deactivates after a set period (e.g., 8 hours)
• PIM keeps a full audit trail of every activation: who activated what role, when, why, and for how long
• Access reviews can periodically verify that users still need their eligible roles
• Requires Microsoft Entra ID P2 or Identity Governance licensing

Exam tip: PIM is one of the strongest examples of the Zero Trust principle "use least privilege access." Expect questions that test whether you understand the difference between eligible and active assignments.

Microsoft Learn resource: What is Microsoft Entra Privileged Identity Management? (opens in a new tab)

App registrations and enterprise applications control how applications integrate with Microsoft Entra ID and access organizational data.

What you need to know

• Delegated permissions act on behalf of a signed-in user (the app can only do what the user can do)
• Application permissions act as the app itself, without a signed-in user (more powerful, requires admin consent)
• Client secrets are like passwords for apps and must be rotated regularly
• The Microsoft Entra app gallery has thousands of pre-integrated applications with simplified configuration
• Multi-tenant apps work across any Microsoft Entra tenant; single-tenant apps work only in the tenant where they are registered

Exam tip: Know the difference between delegated and application permissions. Delegated permissions are bounded by the user's own permissions; application permissions are not. This makes application permissions more powerful and riskier.

Microsoft Learn resource: Application and service principal objects in Microsoft Entra ID (opens in a new tab)

Microsoft Purview is the umbrella for all data protection, governance, and compliance tools in Microsoft 365. Here is what each component does:

Microsoft Purview Information Protection

Helps you discover, classify, and protect sensitive information wherever it lives or travels. The main tools are sensitive information types (200+ built-in patterns like credit card numbers and social security numbers), trainable classifiers (machine learning-based identification), and sensitivity labels.

Microsoft Purview Data Loss Prevention (DLP)

Monitors data at rest, in use, and in motion across Microsoft 365 services, Office apps, Windows/macOS devices, and on-premises file shares. DLP uses deep content analysis (not simple text scanning) to detect sensitive information. Protective actions include showing policy tips (warnings), blocking with or without override options, and quarantining items.

Key fact for the exam: DLP now also covers Microsoft 365 Copilot interactions. You can create DLP policies that prevent Copilot from processing prompts containing sensitive information types or accessing files with specific sensitivity labels.

Microsoft Purview Insider Risk Management

Detects internal risks like data theft, data leaks, and security violations using machine learning and behavioral signals. Built with privacy by design: usernames are pseudonymized, access is role-based, and admin opt-in is required. Integrates with Adaptive Protection to dynamically apply stricter controls for risky users.

Microsoft Purview Communication Compliance

Detects regulatory compliance violations and business conduct violations (harassment, threats, sensitive data sharing) across Teams, Exchange, Viva Engage, Outlook, and Microsoft 365 Copilot. Can also detect prompt injection attacks and protected material in AI interactions.

Microsoft Purview DSPM for AI (Data Security Posture Management)

The front door for discovering and securing AI usage in your organization. Automatically runs weekly risk assessments on your top 100 SharePoint sites and provides one-click policies to deploy protection. Integrates existing Purview controls (DLP, Insider Risk, labels, retention) with easy-to-use tools specifically designed for AI governance.

Microsoft Purview Data Lifecycle Management

Helps you retain what you need and delete what you do not through retention policies and retention labels. Supports archive mailboxes, inactive mailboxes (retaining content after an employee leaves), and priority cleanup for expediting deletion of sensitive information.

Microsoft Learn resource: Microsoft Purview documentation (opens in a new tab)

Sensitivity labels classify and protect content by traveling with the data wherever it goes.

What you need to know

• Labels can enforce encryption, content marking (headers, footers, watermarks), and access restrictions
• Labels can be applied manually by users, automatically by policy (based on sensitive information types or trainable classifiers), or recommended to users
• File and email labels protect individual documents and messages
• Container labels protect SharePoint sites, Teams, Viva Engage communities, and Loop workspaces by controlling privacy settings, external access, and unmanaged device access
• Labels can set default sharing link types in SharePoint and OneDrive to prevent oversharing
• For Copilot: if a file has an encryption label, Copilot can only access its content if the EXTRACT usage right is granted

Exam tip: Sensitivity labels created for files and emails cannot be used for containers (sites, teams), and vice versa. They are separate scopes even though they use the same label framework.

Microsoft Learn resource: Learn about sensitivity labels (opens in a new tab)

Data classification identifies and tags sensitive data so you can protect it appropriately.

What you need to know

• Sensitive information types (SITs): Pattern-based detection using regular expressions, keywords, and proximity analysis. Over 200 built-in types available
• Trainable classifiers: Machine learning models that learn from examples rather than patterns. Useful for content like resumes, contracts, or financial statements where patterns alone are not enough
• Content Explorer: Shows you a snapshot of items with sensitivity labels, retention labels, or classified sensitive information types across your organization
• Activity Explorer: Shows activities related to sensitive data, including label changes, DLP matches, and external sharing events
• Data classification requires E5/A5/G5 licensing for full analytics

Microsoft Learn resource: Data classification overview (opens in a new tab)

Retention policies and labels help you keep content for as long as you need it, and delete it when you do not.

What you need to know

• Retention actions: retain and then delete, retain indefinitely, or delete without retaining
• When multiple retention policies apply, the longest retention period wins
• Retention labels support advanced features like event-based retention (triggered by business events like an employee departure) and disposition reviews (manual review before permanent deletion)
• Items declared as records become immutable and cannot be edited or deleted

Microsoft Learn resource: Learn about retention policies and retention labels (opens in a new tab)

This is one of the most important concepts for the exam. Copilot does not have its own special access to data. It uses your existing permissions.

What you need to know

• Copilot accesses data through Microsoft Graph, which enforces the same user identity-based access controls as every other Microsoft 365 service
• If a user cannot access a file through SharePoint or OneDrive normally, Copilot cannot access it either
• Copilot respects sensitivity labels. If a file has encryption without the EXTRACT usage right, Copilot cannot display its text content
• Prompts, responses, and data accessed through Microsoft Graph are never used to train foundation large language models
• For agents: data ingested into Microsoft Graph stays in your tenant. Data from external integrations stays in the external app

Exam tip: "Copilot respects existing permissions" is the key principle. You do not need to configure separate "Copilot permissions." If your existing permission model is good, Copilot is safe. If it is not (oversharing), Copilot will expose those problems.

Microsoft Learn resource: Data, privacy, and security for Microsoft 365 Copilot (opens in a new tab)

Microsoft Graph is the data layer that powers Copilot. It is what connects Copilot to your organizational data.

What you need to know

• Microsoft Graph provides the knowledge index that Copilot uses to ground its responses in your organization's data
• Permission trimming happens automatically. Copilot applies the same permission checks as other Microsoft 365 services
• All existing policies are enforced: sensitivity labels, Conditional Access, DLP policies, and audit logging
• Microsoft Graph data residency commitments are honored

Microsoft Learn resource: Microsoft Graph overview (opens in a new tab)

Multiple Microsoft 365 security and compliance tools work together to protect Copilot interactions.

What you need to know

Key point: These controls work through automatic integration. You do not need to configure separate "Copilot protection" for most of them, though you can scope DLP policies specifically to the "Microsoft 365 Copilot and Copilot Chat" policy location for targeted governance.

Microsoft Learn resource: Microsoft Purview data security and compliance protections for Microsoft 365 Copilot (opens in a new tab)

Microsoft's AI products, including Copilot, are built on six responsible AI principles.

The six principles

1. Fairness: AI systems should treat all people fairly and avoid bias
2. Reliability and safety: AI should perform reliably and safely with safeguards against harmful content
3. Privacy and security: AI should respect privacy with encryption, RBAC, and least privilege access
4. Inclusiveness: AI should be accessible and provide fair outcomes across demographics
5. Transparency: Users should know they are interacting with AI and understand how it works
6. Accountability: Organizations should continuously monitor AI performance and maintain audit logs

Exam tip: You do not need to memorize detailed implementation specifics, but you should know all six principle names and their core meaning. Expect scenario-based questions that ask which principle applies.

Microsoft Learn resource: Responsible AI for agent design (opens in a new tab)

Compliance Manager helps you assess your compliance posture against industry regulations and standards.

What you need to know

• Provides prebuilt assessments for 360+ regulations and standards (GDPR, HIPAA, FINRA, and others)
• Uses a risk-based compliance score to show your progress
• Offers improvement actions with step-by-step guidance for both Microsoft-managed and customer-managed controls
• Integrates with DSPM for AI to help meet AI-specific regulations
• Control-mapping templates align regulatory requirements to specific Microsoft Purview solutions

Microsoft Learn resource: Microsoft Purview Compliance Manager (opens in a new tab)

Content Explorer provides a visual snapshot of where sensitive data lives in your organization.

What you need to know

• Shows items with sensitivity labels, retention labels, or classified sensitive information types
• You can filter by label, sensitivity type, classification, and content location
• Custom sensitive information types can be searched using their ID
• Requires E5/A5/G5 licensing for full data classification analytics

Microsoft Learn resource: Get started with content explorer (opens in a new tab)

Insider Risk Management detects potentially risky activities by users within your organization.

What you need to know

• Policy templates include: Data theft by departing users, data leaks, data leaks by risky users, security policy violations, risky AI usage, and risky browser usage
• Risk signals include: mass file downloads, external sharing, email forwarding rules, clipboard copying, and suspicious search patterns
• Uses HR connector signals (like employee termination notices) to trigger monitoring for departing user scenarios
• Privacy by design: usernames are pseudonymized for investigators, access is role-based, and admin opt-in is required before data collection begins

Microsoft Learn resource: Learn about insider risk management (opens in a new tab)

DLP alerts are generated when a user's activity matches a policy rule condition.

What you need to know

• Alerts appear in the DLP alert dashboard and are available for 30 days
• Alerts are also routed to the Microsoft Defender portal for 6 months with additional investigation capabilities
• For Exchange: DLP scans new email messages only, not items already in the mailbox
• For SharePoint/OneDrive: DLP scans both new and existing items
• Activity Explorer shows DLP rule matches, user overrides (with justifications), and egress activities

Microsoft Learn resource: Get started with the DLP alert dashboard (opens in a new tab)

Communication Compliance detects regulatory and conduct violations in organizational communications.

What you need to know

• Detects violations across Teams, Exchange, Viva Engage, Outlook, and Microsoft 365 Copilot
• Detection types include: regulatory violations (SEC, FINRA), harassment, threats, sensitive data sharing, and AI-specific risks (prompt injection)
• Integrates with Insider Risk Management by automatically creating a trigger policy. If a user sends 5+ potentially risky messages in 24 hours, it can trigger an Insider Risk investigation
• Reviewers are explicitly assigned and usernames are pseudonymized for privacy

Microsoft Learn resource: Learn about communication compliance (opens in a new tab)

Activity Explorer provides a detailed view of activities related to sensitive data across your organization.

What you need to know

• Tracks: label applications and changes, DLP policy matches, auto-labeling events, endpoint DLP activities, and data access patterns
• Can filter by activity type, label, sensitive information type, user, date range, and workload
• The AI activities tab (available through DSPM) tracks Copilot interactions including prompts, responses, and sensitivity labels referenced

Microsoft Learn resource: Get started with activity explorer (opens in a new tab)

DSPM for AI is your central hub for monitoring and governing AI usage in the organization.

What you need to know

• Reports page shows: total interactions, sensitive interactions per app, top unethical AI interactions, top sensitivity labels referenced, and insider risk severity
• Data risk assessments: Automatic weekly assessment of your top 100 SharePoint sites, plus custom assessments you can run on demand
• One-click policies you can deploy:
  • Detect risky interactions in AI apps
  • Detect sensitive info shared with AI via network
  • Protect items with sensitivity labels from Copilot processing
  • Secure interactions from enterprise apps (captures prompts/responses for discovery)

Microsoft Learn resource: Microsoft Purview DSPM for AI (opens in a new tab)

Content Search in Microsoft Purview eDiscovery lets you search for specific content across your Microsoft 365 environment.

What you need to know

• Search locations include: Exchange mailboxes, SharePoint sites, OneDrive, Teams, Microsoft 365 Groups, and Viva Engage
• You can search for sensitive information types using the SensitiveType property
• For AI interactions: use the ItemClass property to search for Copilot activities specifically
• Search results can be previewed, refined, exported, or added to review sets for further analysis

Microsoft Learn resource: Content search in Microsoft Purview (opens in a new tab)

What you need to know

SharePoint Advanced Management (SAM) provides several tools:

• Data access governance reports show permission state across your sites (who has access to what)
• Sharing links activity reports identify which sites are creating "Anyone" links, "People in your organization" links, and "Specific people (guests)" links
• Site ownership policies identify ownerless sites and notify owner candidates
• Inactive site policies flag sites that have not been accessed for a configurable period
• Site access reviews let you delegate oversharing review to site owners

DSPM for AI also runs data risk assessments that specifically identify oversharing risks relevant to Copilot access.

Microsoft Learn resource: Data access governance reports in SharePoint (opens in a new tab)

Data access governance reports give you a baseline view of permissions across your SharePoint environment.

What you need to know

• Site permissions report: Shows total permissioned users, content shared with "Everyone," "Everyone except external users," and guest users
• Sharing links activity report: Shows recent sharing link creation by type over the last 28 days
• Sensitivity label distribution report: Tracks labeled content across sites
• Reports can also be generated via PowerShell using Start-SPODataAccessGovernanceInsight
• Requires a Microsoft 365 Copilot license (at least one user) or standalone SharePoint Advanced Management license

Microsoft Learn resource: Data access governance reports (opens in a new tab)

SharePoint Advanced Management provides advanced governance controls that go beyond the standard SharePoint admin center.

What you need to know

• Restricted Access Control is particularly important for Copilot readiness. It ensures that even if someone has been accidentally granted access to a site, they cannot discover or access its content through Copilot
• SAM works alongside DSPM for AI and Microsoft Purview to provide comprehensive data governance

Microsoft Learn resource: SharePoint Advanced Management overview (opens in a new tab)

Copilot and agents serve different but complementary roles.

What you need to know

• Copilot provides AI productivity features across Microsoft 365 apps (Word, Excel, Outlook, Teams, PowerPoint)
• Agents extend Copilot with specialized knowledge, custom instructions, and automated actions for specific business scenarios
• Two types of agents: Declarative agents (use Copilot's orchestrator and inherit its security model) and Custom engine agents (bring your own AI orchestration)

Microsoft Learn resource: Microsoft 365 Copilot agents overview (opens in a new tab)

Organizations can choose between predictable monthly licensing and flexible consumption-based billing.

What you need to know

• For SharePoint agents specifically, pay-as-you-go lets you give users agent access without requiring full Copilot licenses
• Users with monthly licenses are not charged additionally for agent interactions
• Pay-as-you-go consumption resets on the first of each month; unused capacity does not roll over

Microsoft Learn resource: Microsoft 365 Copilot licensing (opens in a new tab)

Admins have granular control over Copilot feature availability.

What you need to know

• Generally available features are enabled by default. Disabling them typically requires a Microsoft Support request
• Preview features can be toggled on or off by tenant admins or environment admins
• Feature toggles work at different scopes: tenant-level, environment-level, and app-level
• In Power Platform admin center: navigate to Tenant settings or Environments > Settings > Features to control Copilot toggles
• Turning off Copilot for makers does not disable Copilot controls already embedded in published apps
• Some features require cross-region data movement consent before they can be enabled in regulated regions

Microsoft Learn resource: Manage Microsoft 365 Copilot settings (opens in a new tab)

Researcher is a prebuilt agent in Microsoft 365 Copilot designed for comprehensive information synthesis.

What you need to know

• Searches across web sources and organizational documents simultaneously
• Synthesizes information from multiple sources with citations
• Available in the left navigation of Copilot Chat alongside other agents
• Target use cases: market research, competitive analysis, policy research, topic investigation, and multi-source decision support
• Respects user permissions to organizational data (no privilege escalation)

Microsoft Learn resource: Get started with Researcher agent in Microsoft Copilot (opens in a new tab)

Analyst is a prebuilt agent specialized in data analysis and business insights.

What you need to know

• Examines data patterns, trends, and generates actionable insights
• Integrates with Excel, SharePoint data, Power BI reports, and Dataverse
• Target use cases: financial analysis, sales performance tracking, customer behavior analysis, operational metrics, and KPI monitoring
• Provides data visualization recommendations

Key distinction: Researcher focuses on information synthesis (finding and combining knowledge); Analyst focuses on data analysis (examining numbers and trends).

Microsoft Learn resource: Examine the Analyst agent (opens in a new tab)

Custom agents address organization-specific workflows that prebuilt agents do not cover.

What you need to know

• Common business use cases: customer support, IT help desk, HR policy Q&A, expense approvals, vendor management, contract analysis, onboarding assistants
• Lightweight agents (instructions + public web grounding only) do not generate additional usage charges for licensed Copilot users
• Agents accessing shared tenant data (SharePoint, connectors) generate Copilot Studio meter consumption

Microsoft Learn resource: Choose the right tool to build your declarative agent (opens in a new tab)

Copilot licenses are managed through the Microsoft 365 admin center.

What you need to know

• Navigate to Users > Active users > select user > Manage product licenses > check "Microsoft 365 Copilot"
• For bulk assignment, use group-based licensing through Microsoft Entra ID security groups
• The Copilot Readiness Report in the admin center shows: how many users are eligible, which update channels they are on, and how many licenses have been assigned vs. available
• Users must be on Current Channel or Monthly Enterprise Channel for Copilot features to work
• Copilot Studio has separate licensing: a tenant license (organizational) and user licenses (for makers building agents)

Microsoft Learn resource: Assign Microsoft 365 Copilot licenses (opens in a new tab)

Pay-as-you-go billing connects Copilot usage to an Azure subscription for consumption-based charging.

What you need to know

• Setup: Create an Azure subscription and resource group, then create a billing policy in the Power Platform admin center that links the environment to the subscription
• Notification alerts warn admins when usage approaches defined limits
• Hard stop automatically turns off agents when they hit spending limits
• Usage is measured in Copilot Credits (one credit = one user-agent interaction)
• Consumption resets on the first of each month
• You can unlink an environment from an Azure subscription at any time

Microsoft Learn resource: Set up Microsoft Copilot pay-as-you-go services (opens in a new tab)

Multiple tools help you track how Copilot is being used across your organization.

What you need to know

• User segments in Copilot analytics: Novice (less than 75% weekly usage consistency), Habitual (consistent but under 15 actions/week), and Power users (consistent with 15+ actions/week)
• Data in the admin center typically has a 72-hour latency
• The Copilot Dashboard includes benchmarking against similar organizations

Microsoft Learn resource: Microsoft 365 Copilot usage report (opens in a new tab)

Prompts are reusable instructions that configure Copilot to perform specific tasks.

What you need to know

• Shared users cannot edit prompts, only use them
• Scheduled prompts are supported in Teams, Office.com, and Outlook
• Admins can manage scheduled prompt availability and compliance through Microsoft 365 Copilot admin settings
• Scheduled prompts require optional connected experiences to be enabled

Microsoft Learn resource: Manage scheduled prompts for Microsoft Copilot (opens in a new tab)

Agent access is managed through the Microsoft 365 admin center and Power Platform admin center.

What you need to know

• In the M365 admin center: navigate to Copilot > Settings > Data access > Agents to control agent availability
• Deployment models: "Just me" (creator only), "Entire organization" (all users), or "Specific users/groups" (targeted)
• SharePoint agents respect existing SharePoint permissions. Users cannot access data through an agent that they cannot access directly
• Copilot Studio agents are managed through the Power Platform admin center at the environment level
• Microsoft 365 agents are managed through the M365 admin center

Microsoft Learn resource: Manage agents in the Microsoft 365 admin center (opens in a new tab)

Agents can be created using several tools depending on complexity and audience.

What you need to know

Agent Builder (in Microsoft 365 Copilot):

1. Select "New agent" in Copilot Chat
2. Describe the agent using natural language or configure manually
3. Add instructions, knowledge sources (SharePoint, OneDrive, web), and actions
4. Test using the built-in test panel
5. Publish to make available

Copilot Studio:

1. Create a blank agent or use a template
2. Define instructions, knowledge sources, connectors, and integrations
3. Configure actions and workflows
4. Test and submit to admin for approval

Key points

• All agents respect existing Microsoft 365 permissions
• Lightweight agents (instructions + web grounding only) do not incur extra charges for licensed users
• Organization-wide agents require admin approval before becoming available to end users

Microsoft Learn resource: Build and manage agents (opens in a new tab)

Organization-built agents go through a governance workflow before they become available to all users.

What you need to know

1. Maker builds and tests the agent
2. Maker publishes to the "Microsoft 365 Copilot and Teams" channel
3. Agent appears as a pending request in M365 admin center > Agents > All agents > Requests
4. Admin reviews: capabilities, knowledge sources, actions, security and compliance status
5. Admin approves (publishes) or rejects (with feedback)
6. Approved agents appear in the Agent Store under "Built by your org"

Important rules

• Content updates (changing instructions or knowledge) do not require re-approval
• Metadata changes (icon, description) do require new approval
• Makers can resubmit after addressing rejection feedback with no limit on attempts
• Admins can deploy approved agents to specific users/groups or the entire organization

Microsoft Learn resource: Manage agents in the Microsoft 365 admin center (opens in a new tab)

Agent monitoring happens across two admin centers depending on the agent type.

What you need to know

Microsoft 365 admin center (Agent overview page):

• Agent health snapshot for the last 30 days
• Pending approval requests (oldest prioritized)
• Ownerless agents that need an owner assigned
• Active users over time (30-day trend)
• Agents by publisher and platform breakdown

Power Platform admin center (Copilot page):

• Active agents count (agents with sessions in the last 28 days)
• Session success rate (percentage resolved)
• Top 10 agents by monthly active sessions
• Message consumption and licensing details

Key lifecycle indicators to monitor:

• Agent status: Active, paused, pending approval, ownerless
• Version control and publishing history
• Deployment status (which users/groups have access)
• Cost per agent and per interaction

Exam tip: The M365 admin center focuses on governance and organizational oversight. The Power Platform admin center provides technical performance and cost data. Know which admin center to use for which task.

Microsoft Learn resource: Agent management in Microsoft 365 admin center (opens in a new tab)