Certbie

Free practice · No sign-up required

AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals free practice test

10 questions with answer explanations. Choose an answer below to begin.

Question 1 of 10

Which principle should guide an administrator when assigning permissions for Copilot and agent administration tasks?

Show hint

Apply role-based access and least-privilege administration

0/10 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.

Learn by doing

Put your answers into practice

Use official documentation and hands-on labs to work through topics you missed.

Explore all study resources →

All questions and explanations

Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.

  1. Question 1

    Link to question

    Which principle should guide an administrator when assigning permissions for Copilot and agent administration tasks?

    1. Grant the minimum permissions needed to perform the role

    2. Give all administrators global access by default

    3. Allow every user to modify tenant-wide settings

    4. Reuse one shared admin account for all tasks

    Show answer and explanation

    Correct answer

    • Grant the minimum permissions needed to perform the role

    Least privilege reduces risk by ensuring administrators receive only the permissions required for their responsibilities. Excessive access increases the chance of misuse or accidental changes.

  2. Question 2

    Link to question

    Why is data security configuration important before broad Copilot rollout?

    1. Because Copilot responses are influenced by the data and permissions available to users

    2. Because security settings automatically make every answer correct

    3. Because rollout is impossible unless every file is public

    4. Because licensing replaces security controls

    Show answer and explanation

    Correct answer

    • Because Copilot responses are influenced by the data and permissions available to users

    Copilot and connected agents rely on the data users can access. Strong permissions, classification, and protection settings help ensure generated responses respect organizational boundaries.

  3. Question 3

    Link to question

    A company wants to introduce a new Copilot feature safely. What is the best rollout approach?

    1. Start with a pilot group and expand based on results

    2. Enable all features for every user at once with no testing

    3. Wait until every employee requests the feature individually

    4. Disable feedback collection during launch

    Show answer and explanation

    Correct answer

    • Start with a pilot group and expand based on results

    A phased rollout with a pilot group lets administrators test policies, gather feedback, and fix adoption or governance issues before expanding to the entire organization.

  4. Question 4

    Link to question

    Which signal is most useful when monitoring whether a Copilot rollout is succeeding?

    1. Usage patterns combined with user feedback and support trends

    2. Only the color scheme of the admin portal

    3. The number of browser tabs an admin keeps open

    4. Whether every prompt returns the same answer

    Show answer and explanation

    Correct answer

    • Usage patterns combined with user feedback and support trends

    Usage and outcome signals together show whether the rollout is actually helping users. Adoption without usefulness is not enough, so admins should watch meaningful engagement and feedback.

  5. Question 5

    Link to question

    What is the main reason to document acceptable use guidance for Microsoft 365 Copilot and agents?

    1. To set expectations for safe, appropriate, and reviewable usage

    2. To eliminate the need for access controls

    3. To force every user to become a system administrator

    4. To prevent updates to Copilot policies in the future

    Show answer and explanation

    Correct answer

    • To set expectations for safe, appropriate, and reviewable usage

    Acceptable use guidance helps users understand what the tool is for, how to handle sensitive information, and when AI output needs review before sharing or acting on it.

  6. Question 6

    Link to question

    Why should administrators review connectors, plugins, or extensions before allowing widespread use with Copilot-style experiences?

    1. Because integrations can expose additional data and actions that require governance

    2. Because integrations make identity controls unnecessary

    3. Because every extension automatically meets company policy

    4. Because reviewing them slows the service permanently

    Show answer and explanation

    Correct answer

    • Because integrations can expose additional data and actions that require governance

    Connected tools can expand the system’s reach to more data and actions. Reviewing them helps ensure the organization understands the security, privacy, and governance implications.

  7. Question 7

    Link to question

    An administrator wants to reduce the chance of users oversharing sensitive content through AI prompts. Which action helps most?

    1. Combine user training with existing information protection and access controls

    2. Remove all file permissions so nothing is protected

    3. Tell users that AI outputs never need verification

    4. Require prompts to be as long as possible

    Show answer and explanation

    Correct answer

    • Combine user training with existing information protection and access controls

    User education plus existing information protection controls are key. Training users on prompt hygiene and data handling reduces accidental disclosure alongside technical safeguards.

  8. Question 8

    Link to question

    What is the primary purpose of keeping audit and reporting visibility for Copilot administration?

    1. To monitor usage, investigate issues, and support governance reviews

    2. To replace all user training

    3. To prevent any future tenant configuration changes

    4. To guarantee that no inaccurate answer is ever produced

    Show answer and explanation

    Correct answer

    • To monitor usage, investigate issues, and support governance reviews

    Audit and reporting visibility support governance by helping admins understand adoption, investigate issues, and show that controls and configurations are working as intended.

  9. Question 9

    Link to question

    Why is change management important when introducing agents that automate parts of a business process?

    1. Because people need clarity on new processes, responsibilities, and review points

    2. Because change management automatically writes the prompts

    3. Because agents only work in organizations with no human users

    4. Because it removes the need for business owners

    Show answer and explanation

    Correct answer

    • Because people need clarity on new processes, responsibilities, and review points

    Agents can change roles, handoffs, and decision points. Change management ensures people understand the new workflow, responsibilities, and escalation paths.

  10. Question 10

    Link to question

    Which statement best reflects a sound administration mindset for Copilot and agents?

    1. Enable business value while continuously managing security, compliance, and adoption

    2. Allow all features without policies because innovation is faster

    3. Block all AI features permanently to avoid governance work

    4. Measure success only by the number of licenses assigned

    Show answer and explanation

    Correct answer

    • Enable business value while continuously managing security, compliance, and adoption

    Successful administration balances enablement with governance. The goal is not to block usage entirely or enable everything instantly, but to provide safe, useful access with ongoing oversight.

Read all flashcards

Recall the answer before opening each card.

What principle guides assigning permissions for Copilot and agent administration?

Least privilege: grant only the minimum permissions needed for the role to reduce risk of misuse or accidental changes.

Why must data security configuration be completed before broad Copilot rollout?

Because Copilot responses are influenced by the data and permissions users have; weak controls could expose sensitive information.

What is the recommended rollout approach for a new Copilot feature?

Start with a pilot group, test and gather feedback, then expand based on results. This phased approach manages risk.

Which signal best indicates a successful Copilot rollout?

Usage patterns combined with user feedback and support trends. Adoption alone is insufficient; the tool must be genuinely useful.

Why document acceptable use guidance for Copilot and agents?

To set expectations for safe, appropriate, and reviewable usage, including handling sensitive data and verifying AI outputs.

Why review connectors and plugins before wide use with Copilot?

Because integrations can expose additional data and actions, requiring governance to understand security, privacy, and compliance implications.

Which action most reduces oversharing risk in AI prompts?

Combine user training with existing information protection and access controls. Both human and technical measures are needed.

What is the primary purpose of audit and reporting visibility for Copilot administration?

To monitor usage, investigate issues, and support governance reviews, ensuring controls and configurations are working as intended.

Why is change management important when introducing agents that automate parts of a business process?

Because people need clarity on new processes, responsibilities, review points, and escalation paths. It ensures smooth adoption and reduces errors.

What is a sound administration mindset for Copilot and agents?

Enable business value while continuously managing security, compliance, and adoption. Balance enablement with governance, not block or unrestrained use.

What is the risk of granting excessive permissions to Copilot administrators?

Increased chance of misuse or accidental changes. Least privilege reduces risk by limiting permissions to only what is needed.

How do strong data protection settings affect Copilot responses?

They help ensure generated responses respect organizational boundaries by limiting the data and permissions available to users.

What is a benefit of piloting Copilot with a small group first?

Admins can test policies, gather feedback, and fix adoption or governance issues before expanding to the entire organization.

What should an admin do if usage is high but feedback is negative?

Investigate why—perhaps the tool isn't useful or causes friction. Meaningful engagement and outcomes matter, not just raw usage.

What topics should acceptable use guidance cover?

Allowed uses, handling sensitive data, verifying AI outputs, and reporting issues. It sets clear expectations for safe and reviewable usage.

What is a potential governance issue with unvetted connectors?

They can expand data access and actions without admin knowledge, introducing security, privacy, or compliance risks.

Why is user training important for reducing oversharing in AI tools?

It teaches users to avoid typing sensitive data into prompts and to recognize risky situations, complementing technical controls.

How do audit logs support Copilot governance?

They enable tracking of usage, investigation of incidents, and demonstration that controls and configurations are operating as designed.

What might change when agents automate parts of a business process?

Roles, handoffs, and decision points may change. People need clarity on new workflows, responsibilities, and escalation paths.

What is the result of a balanced administration approach?

Safe, useful access with ongoing oversight, not full blockade or instant enablement. Business value is enabled while risk is managed.

Active recall deck

Practice AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals with real flashcards

Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.

20 free cards

Card 1 of 20

1 reviewed this session

Connect the concepts

Your AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals study mind map

Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.

AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals10 questions in this practice set
Apply role-based access and least-privilege administration(1)
Explain the relationship between data protection and Copilot responses(1)
Plan a controlled Copilot rollout(1)
Monitor adoption and effectiveness of Copilot features(1)
Create user guidance for safe and compliant Copilot use(1)
Assess integrations used by Copilot and agents(1)
Reduce oversharing risk in AI-assisted workflows(1)
Use reporting and audit capabilities for governance(1)
Plan organizational change for agent-enabled workflows(1)
Describe balanced administration for AI experiences(1)
Exam-focused analysis

What this AB-900 practice set measures

This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.

Governance and Security Foundations

The practice bank emphasizes that Copilot and agent administration must start with strong governance. The least-privilege principle is central: administrators should grant only the minimum permissions needed for a role, reducing risk of misuse. Data security configuration is equally critical because Copilot responses are shaped by the data and permissions users already have. Without proper classification and protection, responses could inadvertently expose sensitive information. This section reinforces that permissions, data labeling, and protection settings are foundational before enabling AI features.

  • Apply least-privilege permissions to administrator roles to minimize risk.
  • Configure data security (labels, policies, access controls) before broad rollout.
  • Copilot and agents respond based on data users can access; permissions govern outputs.
  • Document acceptable use guidance to set clear expectations for safe usage.

Rollout and Adoption Strategies

Successful Copilot deployment follows a controlled, phased approach. The practice bank recommends starting with a pilot group to test policies, gather feedback, and resolve issues before expanding. Monitoring rollout success requires analyzing usage patterns alongside user feedback and support trends; adoption alone is insufficient if the tool isn't genuinely useful. Administrators should track meaningful engagement and outcome signals. Combined with clear acceptable use policies, this approach ensures safe, effective adoption while maintaining governance.

  • Use a pilot group first; expand based on feedback and adoption data.
  • Monitor usage patterns and user feedback to assess real effectiveness.
  • Acceptable use guidance helps users handle sensitive data appropriately.
  • Rollout governance includes reviewing integrations before wide release.

Integration and Oversharing Risk Management

Integrations like connectors, plugins, or extensions expand Copilot’s reach and must be reviewed for security and governance implications. The practice bank warns that integrations can expose additional data and actions. To reduce oversharing risk, administrators should combine user training with existing information protection and access controls. Training on prompt hygiene and data handling complements technical safeguards. This layered approach prevents accidental disclosure through AI prompts while still enabling productivity gains.

  • Review connectors and plugins for security and governance impact before use.
  • Integrations can expand data access and actions; assess risks.
  • Reduce oversharing by training users and enforcing protection policies.
  • Technical controls alone are insufficient; combine with user education.

Audit, Change Management, and Balanced Administration

Audit and reporting visibility is essential for monitoring usage, investigating issues, and demonstrating compliance. The practice bank highlights that these capabilities support governance reviews. Change management is critical when agents automate business processes, as people need clarity on new workflows, responsibilities, and review points. Finally, a sound administration mindset balances enablement with ongoing management of security, compliance, and adoption. The goal is safe, useful access with continuous oversight, not full blockade or instant expansion.

  • Maintain audit logs to track usage, investigate incidents, and prove compliance.
  • Change management clarifies roles, handoffs, and escalation paths for agent workflows.
  • Balanced administration enables business value while managing risk.
  • Do not block usage entirely or enable everything instantly; iterate with oversight.

Study workflow

Turn one AB-900 attempt into a study plan

  1. 1

    1. Perform Permissions Audit

    Review all administrative roles related to Copilot and agents. Remove any excess permissions and assign roles following the least-privilege principle. Document each role’s responsibilities and the exact permissions needed, ensuring no administrator has broader access than required.

  2. 2

    2. Configure Data Security Baselines

    Before rollout, apply sensitivity labels, data loss prevention policies, and access controls to your data estate. Verify that Copilot only surfaces content the user is authorized to see. Test with a pilot group to confirm that responses respect existing boundaries.

  3. 3

    3. Plan Phased Rollout with a Pilot

    Select a representative pilot group of users. Deploy Copilot and agents to them first. Monitor usage, collect feedback, and adjust policies or communications. Once the pilot is stable and feedback is positive, expand to additional groups gradually.

  4. 4

    4. Establish Acceptable Use and Training Program

    Write clear acceptable use guidance covering permitted tasks, handling of sensitive information, and requirement to review AI outputs. Deliver training on prompt hygiene and data privacy. Make the guidance accessible and update it as features evolve.

  5. 5

    5. Set Up Audit, Reporting, and Change Management

    Enable audit logging in the compliance portal for Copilot and agent activities. Create dashboards to track adoption, usage patterns, and support tickets. For any process automation, document new workflows, responsibilities, and escalation points, and communicate changes to affected teams.

FAQ

Questions about this AB-900 practice page

Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.

What is the least-privilege principle for Copilot administration?+

The least-privilege principle means granting administrators only the minimum permissions needed to perform their roles. This reduces the risk of misuse or accidental changes. For Copilot and agent administration, it applies to role assignments like Copilot Administrator or Agent Administrator, ensuring no admin has excessive access.

Why is data security configuration important before broad Copilot rollout?+

Copilot responses are influenced by the data and permissions available to users. If data security settings like sensitivity labels, retention policies, or access controls are not properly configured, Copilot may generate responses that expose sensitive information. Configuring these first ensures responses respect organizational boundaries.

How can an administrator reduce the risk of oversharing through AI prompts?+

Combine user training on prompt hygiene and data handling with existing information protection controls. Training helps users avoid typing sensitive data into prompts, while technical safeguards like DLP policies and access controls block or warn about risky behavior. Both are needed for effective risk reduction.

What should be included in an acceptable use guidance for Copilot and agents?+

The guidance should set expectations for safe, appropriate, and reviewable usage. Include allowed and prohibited uses, handling of confidential data, requirement to verify AI outputs before acting, and procedures for reporting issues. Ensure it is easy to access and aligned with your organization’s overall acceptable use policy.

Why is change management important when introducing agents that automate business processes?+

Agents can change roles, handoffs, and decision points. Change management helps people understand new processes, their responsibilities, review points, and escalation paths. Without it, confusion and resistance may arise, leading to errors or low adoption. Clear communication and training are essential.

Keep studying

Build the next review session

Browse another free bank or use the study strategy guide to turn your misses into spaced review.

All free testsStudy strategy