AB-900 is Microsoft's newest fundamentals-level certification, launched in 2026 as the entry point to a brand-new AB (agentic business) track. Passing it earns the Microsoft 365 Certified: Copilot and Agent Administration Fundamentals credential — proof you can support, secure, and govern an AI-enabled Microsoft 365 tenant, from Copilot licensing to agent lifecycle management.
If you administer Microsoft 365, work in IT governance, or you're advising clients on Copilot rollout, this is the first Microsoft cert built specifically around that job. This guide covers the official skills domains straight from Microsoft's AB-900 study guide, exam logistics, and how it fits next to AI-900/AI-901 — because on the surface the names look interchangeable, and they're not.
What is the AB-900 certification?
AB-900 stands for "Copilot and Agent Administration Fundamentals." It's a Beginner-level exam under the Administrator role and Artificial intelligence subject on Microsoft Learn — the same tier as AZ-900 and AI-900/AI-901, but scoped to one job: keeping a Microsoft 365 + Copilot environment secure, governed, and properly licensed.
There are no formal prerequisites, but Microsoft's audience profile expects you to already know core Microsoft 365 services, admin centers (Exchange, SharePoint, Teams, Entra, Purview), authentication basics, and "AI-driven productivity tools and modern IT management practices." In practice: this is not a first certification for someone new to Microsoft 365 — it assumes M365 admin fluency and layers Copilot/agent governance on top.
The certification renews annually through a free online assessment, same as Microsoft's other associate and fundamentals credentials.
AB-900 skills measured (official domains)
Microsoft's skills-measured page (current as of the study guide dated August 2026, refreshing again October 14, 2026) breaks the exam into three domains:
| Domain | Weight |
|---|---|
| Identify the core features and objects of Microsoft 365 services | 30–35% |
| Understand data protection and governance tasks for Microsoft 365 and Copilot | 35–40% |
| Perform basic administrative tasks for Copilot and agents | 25–30% |
Notice the domain order: the largest chunk of the exam is data protection and governance, not Copilot feature knowledge. This tells you exactly who Microsoft built this cert for — not developers building agents, but the admins and compliance people who have to answer "where is our data going" once Copilot is turned on.
Domain 1: Core Microsoft 365 features and objects (30–35%)
This is standard M365 admin territory: license types and how they gate feature access, org configuration in the Microsoft 365 admin center, mailbox and distribution group objects in Exchange, sites/libraries/permissions in SharePoint, and teams/channels/policies in Teams. The security half of this domain covers Zero Trust principles, Entra ID authentication and conditional access, Defender XDR capabilities, Identity Secure Score, audit logs, Privileged Identity Management, and app registrations.
If you've administered an M365 tenant for even six months, most of this domain is review. It's the baseline Microsoft assumes before layering Copilot governance on top.
Domain 2: Data protection and governance for M365 and Copilot (35–40%)
This is the exam's center of gravity, and it's almost entirely Microsoft Purview. Expect questions on:
- Purview Information Protection, DLP, Insider Risk Management, Communication Compliance, Data Lifecycle Management, and DSPM for AI (Data Security Posture Management) — the newest Purview capability, built specifically to discover and govern AI activity
- Sensitivity labels and data classification
- How Copilot actually accesses data — Microsoft Graph's role in shaping Copilot responses, and how Purview/Defender permissions constrain what Copilot can surface
- Oversharing detection and remediation in SharePoint, including SharePoint Advanced Management and data access governance reports
- Compliance Manager, Data Explorer, activity explorer, and eDiscovery content search
In production tenants I've worked on, oversharing is the single most common Copilot rollout blackeye — someone enables Copilot, and within a week it's surfacing a finance spreadsheet that was "shared with everyone" three years ago and forgotten. This domain is Microsoft testing whether you'd catch that before it becomes an incident, not after.
Domain 3: Copilot and agent administration (25–30%)
The smallest domain, but the one unique to this exam. It covers the practical admin motions: comparing Copilot's built-in capabilities against custom agents, understanding the monthly-license vs. pay-as-you-go billing models (including SharePoint's separate PAYG billing), assigning licenses, monitoring adoption through Copilot Analytics, managing shared/scheduled prompts, and the agent side — configuring access, creating an agent, understanding the approval workflow, and monitoring agent usage and lifecycle across both the M365 admin center and the Power Platform admin center.
Two named Copilot capabilities worth knowing by name for the exam: Researcher and Analyst — Microsoft's terms for specific Copilot use-case modes, not generic marketing language.
AB-900 exam details
| Detail | Value |
|---|---|
| Exam code | AB-900 |
| Certification | Microsoft 365 Certified: Copilot and Agent Administration Fundamentals |
| Level | Beginner (Fundamentals tier) |
| Passing score | 700 / 1000 |
| Duration | 45 minutes |
| Cost | $99 USD (varies by region) |
| Language | English only |
| Format | Proctored, Pearson VUE or Certiport (students/educators) |
| Renewal | Free annual online assessment |
| Prerequisites | None formal, but M365 admin familiarity assumed |
Forty-five minutes is short for a Microsoft cert — most associate-level exams run 100–120 minutes, and even fundamentals exams like AI-900 typically ran closer to an hour. That compresses the question count and leaves little room to second-guess yourself, so timing practice matters more here than the domain breadth suggests.
AB-900 vs. AI-900/AI-901: don't confuse these
The naming is genuinely confusing — AB-900 and AI-901 differ by one character and both sit at Beginner level with a Microsoft 365/Azure AI theme. They test almost entirely different things.
| AI-900 / AI-901 | AB-900 | |
|---|---|---|
| Focus | Azure AI services and (for AI-901) building with Microsoft Foundry | Governing Copilot and agents inside Microsoft 365 |
| Audience | AI/cloud career starters, developers | M365 admins, IT governance, compliance |
| Core platform | Azure AI Foundry | Microsoft Purview, M365 admin center |
| Building vs. governing | AI-901 has you build (prompts, apps, agents) | AB-900 has you administer and audit, not build |
| Python required | Yes (AI-901) | No |
If your goal is an AI engineering or cloud AI career, AI-901 is still the right starting point. If your job is running the M365 tenant Copilot gets deployed into — or you're the person compliance calls when Copilot surfaces something it shouldn't — AB-900 is the more relevant credential, and it's arguably the more overlooked one right now because it's brand new.
Where AB-900 fits in the 2026 Microsoft AI certification landscape
AB-900 is the entry point to Microsoft's new AB track, built around agentic-AI business roles rather than technical AI development. Above it sits AB-100 (Agentic AI Business Solutions Architect, Expert tier), plus AB-730 and AB-731. This mirrors how AZ-900 sits below the AZ associate exams, or how AI-900/AI-901 sits below AI-103 — Microsoft is building a full ladder for a role category that didn't really exist as a distinct job two years ago: the person accountable for whether Copilot is deployed safely, not just deployed.
It's also worth placing next to SC-500, Microsoft's Cloud and AI Security Engineer cert. SC-500 is deep infrastructure security — identity, network, posture management, Entra Agent ID — for security engineers. AB-900 is narrower and shallower by design: M365/Copilot governance for admins, not a security specialist credential. Don't use one to substitute for the other on a resume; they answer different job requirements.
Should you take AB-900?
Worth it if: you administer or will administer a Microsoft 365 tenant with Copilot enabled, you work in IT compliance/governance and need to speak credibly about AI data exposure, or you're a consultant advising clients on Copilot rollout and want a credential that backs up the advice.
Skip it (for now) if: your goal is AI development or engineering — AI-901 or AI-103 serve that path better — or you have zero Microsoft 365 admin experience, since the exam assumes that baseline rather than teaching it.
The SERP for this exam is currently dominated by dump sites and thin aggregator guides — there's no real first-hand educational content yet, the same gap that existed for AI-901 in its first weeks. That's a signal this cert is new enough that studying from the official Microsoft Learn modules, not third-party practice-question sites, is your best return on time right now.
How to prepare
Microsoft's own learning paths (linked from the official study guide) cover each domain, and the free exam sandbox is worth doing before exam day just to see the question format — AB-900 uses interactive components, not pure multiple choice. Beyond that, hands-on time in a real (or test) Microsoft 365 admin center matters more than reading for this exam: Domain 2 in particular tests whether you can find an oversharing report or a DLP alert, not just define what one is.
Pair your Copilot governance knowledge with broader AI fluency through CloudaQube's hands-on cloud and AI labs — practical reps in admin tooling and cloud environments make the "where do I click" questions on exams like this one far less stressful. If you're mapping out a longer AI career path, see how fundamentals certs like this one fit into the AI engineer career path for 2026.
