AB-900 Copilot and Agents Book: Study Guide & Exam Questions
  • 1.Part 1: Identify the core features and objects of Microsoft 365 services

1.1 Introduction to Microsoft 365 core services and admin controls

Microsoft 365 is a cloud-connected platform where communication, collaboration, content, identity, and security operate as one system rather than as isolated apps. For administrators, the core job is to connect those pieces so people can work productively without exposing organizational data.

How the Microsoft 365 architecture fits together

The platform can be understood as five interacting layers that build on each other. Identity verifies who or what is requesting access, core services provide the workplaces where work happens, data connects information across those services, intelligence uses that connected data to assist users, and security and compliance controls span all of the layers.

  • Identity layer: Microsoft Entra ID handles authentication, Conditional Access, and identity protection.

  • Service layer: Exchange Online, SharePoint Online, OneDrive, Microsoft Teams, and Copilot deliver mail, files, meetings, chat, and AI assistance.

  • Data layer: Microsoft Graph links data across services through a RESTful API model, enabling search, insights, automation, and contextual answers.

  • Intelligence layer: Copilot and task-oriented agents use Graph signals to summarize, recommend, and automate work.

  • Security and compliance layer: tools for data loss prevention (DLP), eDiscovery, retention, auditing, threat protection, and posture assessment protect the whole stack.

Within that design, Copilot serves as an intelligent orchestrator. It draws on mail, files, meetings, chats, and calendars to surface relevant material, draft content, and carry out multi-step tasks across apps.

Identity as the foundation

Microsoft Entra ID is the identity control point for the suite. It evaluates role, device state, location, and risk before granting access to Teams, SharePoint, Exchange, and other resources. Policies for multifactor authentication (MFA), Conditional Access, and identity protection are defined there, so one change can affect several workloads at once.

Microsoft Entra is the broader platform that contains Microsoft Entra ID alongside Permissions Management and Verified ID. It is designed to support Zero Trust by verifying every identity, governing permissions, and checking credentials for cloud and on-premises resources from a unified control plane.

Diagram: Every Identity, Human identities, Workload identities, Customers, Partners, Devices, Every Resource, Data, SaaS apps, Cloud-based apps and resources, On-premises applications, Websites, Microsoft Entra, Granular access policies, Global scale and resilience, AI and automation, Unified Experience

A university IT team manages mail, file sharing, and chat from one cloud suite. Authentication is handled centrally, an API connects data across apps for search and automation, and an AI assistant uses those signals to help users.

1. In a Microsoft 365 environment where an AI assistant needs context from email, files, and meetings, which component provides the connected data layer that makes that contextual help possible?
  • Microsoft Entra ID, because it stores documents and chat transcripts
  • Microsoft Graph, because it connects data across services for insights and automation
  • Microsoft Purview, because it provisions mailboxes and teams
  • Microsoft Intune, because it generates AI responses directly
Show answer and explanation
  • Microsoft Graph, because it connects data across services for insights and automation

Microsoft Graph is the data layer that connects information across services for insights, automation, and Copilot context, while Entra ID handles identity and Purview handles governance.

2. A change to a Conditional Access policy in Microsoft Entra ID can simultaneously affect user access to Microsoft Teams, SharePoint Online, and Exchange Online.
  • True
  • False
Show answer and explanation
  • True

Conditional Access and identity controls in Microsoft Entra ID apply across connected workloads, so one policy can affect Teams, SharePoint, and Exchange together.

Extra questions

You are reviewing what can be accomplished from the Microsoft Teams admin center.

3. From the Microsoft Teams admin center, you can ____.
  • administer a Teams Rooms device
  • allocate a Teams license to a user
  • roll out the Teams client
  • stop users from creating teams
Show answer
  • From the Microsoft Teams admin center, you can administer a Teams Rooms device.
4. Your tenant holds a Microsoft 365 subscription. You must grant a license to a person. Which console should you use?
  • the Microsoft Purview portal
  • the Microsoft 365 admin center
  • the Microsoft Teams admin center
Show answer and explanation
  • the Microsoft 365 admin center

Licenses are granted in the Microsoft 365 admin center on the person under Users then Active users then Licenses and apps or on the product under Billing then Licenses. The Purview portal handles security and compliance and the Teams admin center handles Teams rules, neither grants licenses.

5. Your subscription includes a SharePoint site named Site1. You must stop users from sharing Site1 content with external people. What should you use?
  • the settings inside Site1
  • the SharePoint admin center
  • the Microsoft 365 admin center
  • the Microsoft Entra admin center
Show answer and explanation
  • the SharePoint admin center

External sharing for one site is set in the SharePoint admin center under Sites, Active sites, Site1, Settings and More sharing settings by choosing Only people in your organization, leaving other sites unchanged. Owners cannot change that level from inside the site, the Microsoft 365 admin center sharing option applies organization-wide, and Microsoft Entra external collaboration controls tenant-wide guest invitations.

6. When you need to add a domain to a Microsoft 365 subscription, you must verify the domain by ____.
  • adding a public DNS record
  • confirming your business address
  • uploading a certificate
  • uploading a webpage
Show answer
  • When you need to add a domain to a Microsoft 365 subscription, you must verify the domain by adding a public DNS record.
7. Your organization uses Microsoft 365. Which two tasks can you carry out from the Exchange admin center? Each correct answer is part of the solution.
  • Assign a Microsoft Exchange license.
  • Create a mail flow rule.
  • Create a shared mailbox.
  • Add a custom domain.
Show answer and explanation
  • Create a mail flow rule.
  • Create a shared mailbox.

The Exchange admin center administers recipients and mail flow, with mail flow rules under Mail flow and Rules and shared mailboxes under Recipients and Mailboxes. Licenses are granted in the Microsoft 365 or Microsoft Entra admin center, and custom domains are added and verified in the Microsoft 365 admin center under Settings and Domains.

8. A member of a SharePoint site can invite other people to content in the site.
  • True
  • False
Show answer and explanation
  • True

Members hold Edit rights and, unless owners restrict sharing to owners only, owners, members and others with Edit rights may share files and folders and, depending on the setting, the site itself.

9. An owner of a SharePoint site can add Microsoft 365 groups as members of the site.
  • True
  • False
Show answer and explanation
  • True

Owners give access by adding individuals, security groups or Microsoft 365 groups to the Owners, Members or Visitors groups, for example adding a team's Microsoft 365 group to the Members group of a communication site.

10. An owner of a SharePoint site can remove another owner from the site.
  • True
  • False
Show answer and explanation
  • True

Owners have Full Control over membership and can add or remove other owners, including through the Microsoft 365 group on a group-connected site, which must retain at least one owner.

11. Your organization uses Microsoft 365. You built a security group named Group1 and assigned a Microsoft 365 E3 license to it, but User1 still cannot use the E3 features. Which two actions will give User1 all the E3 features? Each correct answer is a complete solution.
  • Add User1 to Group1.
  • Assign a Conditional Access policy to Group1.
  • Assign a Conditional Access policy to User1.
  • Assign a license to User1.
Show answer and explanation
  • Add User1 to Group1.
  • Assign a license to User1.

With group-based licensing every member automatically inherits the group's licenses, so adding User1 to Group1 grants the E3 features, and assigning the license directly to User1 also grants them. Conditional Access policies govern how sign-in to apps is allowed and never grant license entitlements.

12. From the SharePoint admin center, you can create a ____.
  • role
  • server
  • site
  • user
Show answer
  • From the SharePoint admin center, you can create a site.

Your subscription includes a SharePoint site named Site1 with the permissions shown below. You then create a new user named User1.

  • Site owners have Full Control and contain Global Administrator with Full Control.
  • Site members have Edit permission and contain Everyone except external users with Edit.
  • Site visitors have no access and contain None.
  • The organization does not require guest access to expire.
  • Other groups or people also hold permissions on the site and can be seen in Advanced permissions settings.
13. Based on the exhibit, User1 is ____ Site1.
  • a site member of
  • a site owner of
  • a site visitor of
  • prevented from accessing
Show answer
  • Based on the exhibit, User1 is a site member of Site1.