AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals

Tour every Microsoft 365 admin surface you will use in a fundamentals administrator role. You will explore the Microsoft 365 admin center, Exchange admin center, SharePoint admin center, and Teams admin center, then compile a cross-cutting inventory of the tenant configuration you observe. The lab tenant is a bare sandbox with only Microsoft's default configuration — some blades will show small counts or empty lists, and that is a valid observation to record. By the end of this lab you will be able to navigate every workload admin center referenced on the AB-900 exam and describe the tenant-level settings each surface exposes.

Explore Microsoft Entra ID as a Global Reader - the read-only counterpart to Global Administrator. You will walk the Entra admin center to observe users, groups, Conditional Access, authentication methods, Identity Secure Score, and Privileged Identity Management (PIM), and understand how each fits together to keep a Microsoft 365 tenant secure. Because your lab tenant is a bare sandbox with only defaults and your own Global Reader account, some blades will show empty grids or zero policies - that "empty state" is itself informative and mirrors what a Day-1 admin sees on a fresh tenant. By the end of this lab you will be able to identify the appropriate Entra ID objects and controls the AB-900 exam measures, and describe why a real admin would engage each one in a production tenant.

Learn how the Microsoft Purview portal frames Copilot governance. You will tour the Purview solutions catalog, explore sensitivity labels + policies, walk the DLP surface, inspect data classification and trainable classifiers, review Compliance Manager, and open Communication Compliance policies. By the end of this lab you will be able to identify each Purview solution the AB-900 exam measures, recognize their role in Copilot data protection, and read the settings pages a Microsoft 365 admin uses every week - all from a read-only Global Reader account with zero risk to the tenant.

Learn to inventory the AI-governance tooling that lives across Microsoft Purview - Data Security Posture Management (DSPM) for AI, Insider Risk Management, and eDiscovery Content Search - so you can describe what each surface tracks about Microsoft 365 Copilot interactions and where a fundamentals-level administrator would start when asked to inventory AI-risk controls. By the end of this lab you will be able to navigate the Purview DSPM for AI dashboard, recognize the recommended AI-risk policy templates, describe the Risky AI Usage Insider Risk template, and locate Copilot interactions through eDiscovery Content Search. The lab tenant is a bare sandbox - dashboards, alerts, and eDiscovery cases will be empty, which is realistic for a fresh Copilot deployment and is itself the finding you record.

In this hands-on lab you will learn to run the SharePoint oversharing reports and inventory the SharePoint Advanced Management (SAM) controls that keep Microsoft 365 Copilot grounded in only the content it should see. By the end of this lab you will be able to locate the Data Access Governance (DAG) reports in the SharePoint admin center, interpret a Sharing Links report, identify which SAM features are lit up in a tenant, describe how Restricted Content Discovery (RCD) reshapes what Copilot returns, and read a Site Access Review to close the audit loop.

Learn how to administer Microsoft 365 Copilot license assignment, Copilot Credits and pay-as-you-go billing, adoption analytics, prompt library governance, and Copilot Control System (CCS) tenant settings. You will sign in from the lab Windows 11 VM using the Global Reader account shown on the Environment tab and walk every control read-only. By the end of this lab you will be able to describe the Microsoft 365 admin surface for Copilot licensing, PAYG billing, adoption reporting, prompt management, and tenant-level Copilot settings — enough depth to speak to the AB-900 fundamentals objectives without any escalation surface on the tenant.

Learn to inventory, monitor, and govern Microsoft 365 Copilot agents from the two admin surfaces that own the lifecycle: the Copilot Control System inside the Microsoft 365 admin center and the Copilot Studio agents area inside the Power Platform admin center. By the end of this lab you will be able to locate any agent that appears in a tenant, verify who has access to it, walk through the approval-queue shape, and read the operational-health metrics — all read-only, from a Global Reader account.