MS-900, the Microsoft 365 Fundamentals exam, retired on 31 March 2026, so anyone starting now studies for its replacement at this level: exam AB-900, Microsoft 365 Copilot and Agent Administration Fundamentals. It is a 45-minute proctored exam with a pass mark of 700 and a skills outline that has moved from broad product awareness to admin tasks, data protection and Copilot. This guide explains the change and gives a study plan based on Microsoft's current study guide.
Who this is for
This is for people new to Microsoft 365 administration, such as help desk staff, small business owners who run their own tenant, students, and anyone who searched for an MS-900 study guide and found that the exam is gone. At the end you will know what AB-900 covers, how the weightings should shape your time, and what to practice hands-on.
Details were taken from Microsoft Learn pages checked on 26 October 2026: the AB-900 exam page (updated 14 October 2026), the AB-900 study guide, and the retired MS-900 study guide. Microsoft updates skills outlines, so reread the study guide the week before you book.
What happened to MS-900
Microsoft's MS-900 study guide carries this warning: the exam was retired on 31 March 2026 at 11:59 PM Central Standard Time. The Microsoft 365 Certified: Fundamentals certification page also shows a retired warning and says there is no training available for the exam.
The old exam measured four areas: cloud concepts (5-10%), Microsoft 365 apps and services (45-50%), security, compliance, privacy and trust (25-30%), and pricing, licensing and support (10-15%). The new exam does not use that structure. Do not study old MS-900 material on pricing models and cloud concepts as if it were the AB-900 outline, though some of it (licensing, Entra, Purview basics) overlaps.
What AB-900 covers
Microsoft describes the certification as demonstrating how to support, secure and protect an AI-enabled Microsoft 365 environment. The exam page lists what is assessed:
- Identify the core features and objects of Microsoft 365 services.
- Understand data protection and governance tasks for Microsoft 365 and Copilot.
- Perform basic administrative tasks for Copilot and agents.
The study guide says candidates should be familiar with Microsoft 365 core services, security, identity and access, data protection and governance, and Microsoft 365 Copilot and agents. It also expects familiarity with the admin centers for Exchange Online, SharePoint, Teams, Entra and Purview, and says you need experience with AI-driven productivity tools and modern IT management practices.
Exam facts
| Item | Value from Microsoft |
|---|---|
| Exam | AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals |
| Certification | Microsoft 365 Certified: Copilot and Agent Administration Fundamentals |
| Level | Beginner |
| Length | 45 minutes |
| Passing score | 700 or greater |
| Format | Proctored, may include interactive components |
| Retake | After 24 hours for the first retake; later waits vary, see the retake policy |
| Price | Depends on the country or region where it is proctored |
| Languages | English, Arabic (Saudi Arabia), Japanese, Chinese (Simplified), Chinese (Traditional), Korean, German, French, Indonesian (Indonesia), Italian, Portuguese (Brazil), Russian and Spanish |
| Skills outline | As of 14 October 2026 |
Microsoft recommends registering with a personal Microsoft account rather than a work or school account, because exam records tied to an organizational account are lost if you leave the organization.
Skills measured and how to spend your time
Weightings are ranges, so use them to split study time rather than to predict question counts.
| Skill area | Weight |
|---|---|
| Identify the core features and objects of Microsoft 365 services | 30-35% |
| Understand data protection and governance tasks for Microsoft 365 and Copilot | 35-40% |
| Perform basic administrative tasks for Copilot and agents | 25-30% |
Area 1: core features and objects (30-35%)
Microsoft lists three groups of objectives:
- Core objects: how license types assigned to users and groups affect access to features; organization settings and domain names in the Microsoft 365 admin center; Exchange admin center objects (mailboxes and distribution groups); SharePoint admin center objects (sites, libraries, folders) and roles and permissions for sites; Teams admin center objects (teams, channels, policies).
- Security principles: core Zero Trust principles, authorization, authentication methods, threat protection and intelligence, and Microsoft Defender XDR features.
- Core security features: Microsoft Entra ID, conditional access policies, single sign-on, users and groups as security objects, tools to troubleshoot sign-in issues (MFA, conditional access, risky sign-ins), Identity Secure Score, audit logs, Privileged Identity Management, and app registrations versus enterprise applications.
Hands-on tasks: assign a license to a group, create a shared mailbox and a distribution group, create a SharePoint site with a library and change its permissions, create a team with a channel, and read the Entra sign-in logs. For the sign-in troubleshooting objective, see AADSTS50076 MFA sign-in errors and AADSTS53003: blocked by Conditional Access.
Area 2: data protection and governance (35-40%)
This is the biggest area. Microsoft lists:
- Microsoft Purview: Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Security Posture Management for AI, Data Lifecycle Management; use cases for sensitivity labels; data classification; retention.
- Data security implications of Copilot: how Copilot accesses data, how Microsoft Graph influences responses, how Copilot uses permissions and other controls in Microsoft 365, Purview and Defender, and responsible AI principles.
- Governance risks: Compliance Manager, Data Explorer, Insider Risk Management, DLP alerts, Communication Compliance policy violations, activity explorer, DSPM for AI, and Content search in eDiscovery.
- Oversharing in SharePoint: tools to troubleshoot oversharing, running a data access governance report, and SharePoint Advanced Management features including restricted access control.
Hands-on tasks: publish a sensitivity label in a test tenant, create a DLP policy in test mode, run a content search, and open the data access governance report. Because the exam describes Copilot as respecting existing permissions, make sure you can explain why oversharing in SharePoint becomes a Copilot problem.
Area 3: Copilot and agent administration (25-30%)
- Features and capabilities: compare built-in capabilities of Copilot and agents; compare the Copilot monthly license model with pay-as-you-go, including SharePoint; identify which Copilot features can be enabled or disabled; use cases for Researcher, Analyst and custom agents.
- Copilot administration: assign Copilot licenses, monitor and manage pay-as-you-go billing policies, monitor usage and adoption (Copilot Analytics and the Microsoft 365 admin center), and manage prompts including saving, sharing, scheduling and deleting.
- Agent administration: configure user access to agents, create an agent, understand the approval process for agents, and monitor agents using the Microsoft 365 admin center and the Microsoft Power Platform admin center.
Hands-on tasks depend on what your tenant has. If you have no Copilot licenses, read the Microsoft 365 Copilot service description and the admin documentation linked from the study guide, and work through the practice assessment to find gaps.
A four-week study plan
This plan assumes about five hours a week. Adjust to your background.
| Week | Focus | Output |
|---|---|---|
| 1 | Area 1: admin centers, license types, Entra basics, Zero Trust | Test tenant with users, groups, a shared mailbox, a team and a site; notes on each admin center |
| 2 | Area 1 security plus Area 2 start: conditional access, sign-in logs, PIM, Purview overview | Screenshots or notes for each Purview solution and when you would use it |
| 3 | Area 2 finish: labels, DLP, retention, oversharing, Copilot data access | A written explanation of how Copilot uses permissions and what controls limit exposure |
| 4 | Area 3 and review: license models, agents, usage reports; practice assessment | Practice assessment score and a gap list; reread skills measured |
Build a test environment
You need a place to click. Use a Microsoft 365 developer or trial tenant if one is available to you, or a lab tenant at work you are allowed to use. Do not experiment with conditional access or DLP in a production tenant. Note that some features, such as Copilot administration, may be unavailable in a trial without the right licenses.
Use the free resources
Microsoft's exam page offers a free practice assessment on Microsoft Learn and an exam sandbox so you can see the question interface. The study guide links to Microsoft 365 documentation, Microsoft 365 Copilot documentation, the admin center help and Purview documentation, plus the Exam Readiness Zone videos. The practice assessment shows the style and difficulty of questions; it is not the exam, so use it to find weak areas rather than to memorize.
Exam day checklist
- Book through the Microsoft Learn exam page, using a personal Microsoft account.
- Decide between a test center and online proctoring, and run the system check early if online.
- Read each question for the task being asked. Microsoft notes that most questions cover generally available features and that preview features can appear if commonly used.
- Check the skills measured date. If it has changed since you started, read the change log in the study guide.
- If you fail, you can retake after 24 hours; later retakes have longer waits.
Troubleshooting common study problems
| Problem | What to do |
|---|---|
| Old MS-900 study notes cover pricing models and cloud concepts that are not in AB-900 | Use them only for overlapping topics such as licensing, Entra and Purview basics, and rebuild notes from the AB-900 outline |
| No Copilot license in your lab | Study the documentation and use the practice assessment for the administration objectives |
| Overwhelmed by Purview | Learn one sentence per solution: what it protects, where you configure it, and one use case |
| Scoring low on the practice assessment | Map each miss to a skills measured bullet and review that bullet in the documentation |
What to take next
Fundamentals exams are a starting point. If you want an Azure or AI angle next, see AI-900 retired: AI-901 study guide, and for choosing a first certification see AWS Cloud Practitioner vs AZ-900. Microsoft's renewal page says associate, expert and specialty certifications expire annually and can be renewed with a free assessment, and the page does not list fundamentals among them; see Microsoft certification renewal.
Checklist
- Confirm the exam you need is AB-900, not the retired MS-900.
- Read the current skills measured and note the date.
- Build a test tenant and practice each admin center task.
- Spend the most time on data protection and governance, then core features, then Copilot and agents.
- Take the free practice assessment in week 3 or 4 and fix gaps.
- Schedule the 45-minute exam with a personal Microsoft account.
References
- Exam AB-900 and certification page: https://learn.microsoft.com/en-us/credentials/certifications/copilot-and-agent-administration-fundamentals/
- Study guide for Exam AB-900: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/ab-900
- Study guide for Exam MS-900 (retired): https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/ms-900
- Microsoft 365 Certified: Fundamentals (retired): https://learn.microsoft.com/en-us/credentials/certifications/microsoft-365-fundamentals/
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.