Free Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 Exam Questions

The correct answer is C. Microsoft Defender for Endpoint. Microsoft documents that Defender for Endpoint is the Microsoft security solution for endpoint devices, including Windows 11, and that it lets security teams investigate incidents, alerts, affected devices, files, processes, and remediation actions in the Microsoft Defender portal. Microsoft's investigation guidance specifically describes using Defender for Endpoint to review alerts and investigate affected devices from the devices list, alerts queue, and incident views.

The correct answer is D. the Analyst agent in Microsoft 365 Copilot. Microsoft Learn training for Microsoft 365 Copilot specifically distinguishes the Analyst agent as the tool for gathering insights from data and enhancing data presentations. Microsoft's guidance also notes in the Researcher FAQ that when the task is spreadsheet-related, Analyst agent is better suited for Microsoft Excel related tasks. This makes Analyst the best choice for a quarterly sales reporting scenario that involves detecting performance trends, surfacing anomalies, and producing visual insights from multiple datasets.

The other options are less suitable. Researcher is intended for complex multi-step research and source-cited reports across web and work content, not specialized data analysis across files. Microsoft 365 Copilot Search is for finding information, not for deep quantitative analysis and anomaly summarization. Copilot in Excel is powerful for workbook-level analysis, but the question emphasizes broader insight generation across multiple files and asks for the best Copilot experience for trends, visuals, and anomaly summaries. Microsoft positions Analyst as the dedicated agent for that kind of data-analysis workflow.

The correct answers are C and D. Microsoft Learn explains that agents created with Agent Builder in Microsoft 365 Copilot allow you to define specific instructions that extend Microsoft 365 Copilot for a business scenario. Microsoft also documents that you can add knowledge sources such as specific public websites and SharePoint content so the agent can reason over targeted information instead of relying only on the default chat experience. Those two capabilities directly match the needs in options C and D.

Option A is incorrect because grouping chats is a Copilot notebook scenario, not the reason to build an agent. Option B is incorrect in the context of creating an agent in the Microsoft 365 Copilot app. Agent Builder supports declarative agents with instructions, knowledge, and capabilities, but Microsoft Learn describes custom AI model control as part of custom engine agents built with tools such as Copilot Studio, SDKs, or Foundry, not as a standard Agent Builder feature in the Microsoft 365 Copilot app. Therefore, when the task is specifically to create an agent in the app, the valid reasons are custom instructions and reasoning over a specific website.

The correct answer is B. the Microsoft 365 admin center. Microsoft documents that administrators assign product licenses to users from the Microsoft 365 admin center, including on the Active users page where you can open a user account and manage Licenses and apps. Microsoft also documents license assignment workflows there for both direct assignment and group-based licensing scenarios. That makes the Microsoft 365 admin center the standard administrative portal for giving a user access to Microsoft 365 services and features.

The other options are incorrect for this task. The Microsoft Purview portal is used for compliance, governance, data protection, eDiscovery, audit, and related Purview solutions, not for assigning Microsoft 365 product licenses. The Microsoft Teams admin center is used to manage Teams settings, policies, devices, voice, and collaboration features, but it is not the central portal for assigning tenant product licenses to users.

The correct answer is C. Site lifecycle management. In the SharePoint admin center, Microsoft includes a Site ownership policy under Site lifecycle management that can identify sites with too few owners and drive remediation. Microsoft documents that this policy can detect sites with fewer than the required number of owners, notify site owners, and if the issue is not fixed, enforce an action such as making the site read-only. That directly matches the requirement that sites with fewer than two owners be marked as read-only when they are not remediated.

The other options do not fit this scenario. Site-level access restriction is about controlling who can access a site, not enforcing ownership-count governance. Data access governance reports help identify oversharing and permissions exposure, but they do not enforce a minimum-owner remediation policy that makes sites read-only. Block download policy for SharePoint and OneDrive is used to restrict downloading from unmanaged devices or similar access scenarios, not to handle insufficient site ownership. Therefore, the Microsoft-documented feature to configure is Site lifecycle management.

The correct answer is B. data loss prevention (DLP) policies. Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices. Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.

Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft's documented solution is DLP policies.

The correct answers are A and D because both tasks are supported directly in the Exchange admin center (EAC). Microsoft Learn states that administrators can manage mail flow rules in Exchange Online from the EAC under Mail flow > Rules, which includes creating and managing transport rules for organizational email handling. Microsoft Learn also states that administrators can create shared mailboxes in the EAC under Recipients > Mailboxes, where a shared mailbox can be added and then delegated to users.

Option B is incorrect because adding a custom domain is normally done in the Microsoft 365 admin center, specifically on the Domains page. Although Exchange can later work with accepted domains and related mail flow settings, the act of adding and verifying a custom domain is not an Exchange admin center task. Option C is incorrect because license assignment is handled through Microsoft 365 or Microsoft Entra administrative tools, not the Exchange admin center.

The correct answer is A. the SharePoint admin center. Microsoft documents that the SharePoint admin center includes Data access governance reports and site-level sharing reports that help administrators identify where content is shared externally. Microsoft also documents that every standard Microsoft Teams team is connected to a SharePoint site for file storage and collaboration. Because Teams files and many sharing scenarios for teams are backed by SharePoint sites, the SharePoint admin center is the correct place to investigate which sites are shared externally, including Teams-connected SharePoint sites.

The correct answer is D. From the Finance site, configure permissions. Microsoft states that Microsoft 365 Copilot honors existing Microsoft 365 permissions and only grounds responses in content that the signed-in user is already allowed to access. That means if users are getting Finance-site content in Copilot responses, those users likely still have permission to that SharePoint content. The direct fix is to review and correct the site, library, folder, or file permissions on the Finance site so only the intended users retain access.

The other options do not directly solve this requirement. Information Barriers are designed for communication and collaboration segmentation scenarios, not for ordinary site-level oversharing remediation. A Defender data connector is unrelated to SharePoint permission enforcement. Conditional Access controls sign-in and session access conditions, but it does not selectively remove Copilot grounding from one SharePoint site for users who still have site permissions. Because Copilot uses SharePoint and Microsoft Graph permissions as its boundary, the Microsoft-documented corrective action is to fix the Finance site permissions.

The correct answer is A. Data access governance in the SharePoint admin center. Microsoft Learn documents Data access governance reports in the SharePoint admin center as the reporting solution used to understand data exposure, including permission structure and sharing link activity. Microsoft specifically states that the site permissions snapshot report provides visibility across SharePoint and OneDrive sites, helping administrators understand current permissions exposure, and that separate reports are created for SharePoint and OneDrive. Microsoft also documents sharing links activity reports as part of Data access governance for monitoring link-sharing activity, and notes that OneDrive support is available through PowerShell for those reports. Together, this is the Microsoft reporting capability aligned with permissions and active sharing links for OneDrive content.

The other options do not fit this requirement. Microsoft 365 admin center reports focus mainly on usage and activity reporting, not detailed permissions and sharing-link governance. Defender Audit is for security investigation activity, and Purview eDiscovery is for legal and investigative content search, not for generating OneDrive permissions and sharing-link governance reports. Therefore, the best Microsoft-documented answer is Data access governance in the SharePoint admin center.