Pass4Future also provide interactive practice exam software for preparing Microsoft 365 Copilot and Agent Administration Fundamentals (AB-900) Exam effectively. You are welcome to explore sample free Microsoft AB-900 Exam questions below and also try Microsoft AB-900 Exam practice test software.
Do you know that you can access more real Microsoft AB-900 exam questions via Premium Access? ()
Which statement accurately describes authorization in Microsoft 365?
Answer : C
The correct answer is C because Microsoft explains that authorization is the process of determining whether an authenticated identity is allowed to access a resource. Microsoft Learn distinguishes authorization from authentication by stating that authentication proves who you are, while authorization decides what you can access or do after identity has been established. In Microsoft 365 and the Microsoft identity platform, authorization commonly involves permissions, scopes, roles, and consent that control access to data and services such as Microsoft Graph, Exchange, SharePoint, or Teams.
Option A is incorrect because it refers more to external identity validation or federation concepts, not authorization itself. Option B describes authentication, not authorization, since it is about verifying identity claims. Option D describes a control such as multifactor authentication or Conditional Access requirements, which can happen before access is granted, but that still is not the definition of authorization. Authorization begins after identity verification and focuses on whether the identity has the right permissions for the requested resource.
Your organization has a Microsoft 365 E5 subscription. You create a Microsoft Purview sensitivity label named Label1. You need to ensure that users can apply Label1 to files in Microsoft 365. What should you use?
Answer : D
The correct answer is D. a sensitivity label policy. In Microsoft Purview, creating a sensitivity label by itself does not make it available to users. Microsoft Learn states that after you create sensitivity labels, you must publish them by creating a label policy so that users and groups can see and apply those labels in Microsoft 365 apps and services. Publishing controls which labels are available and to whom they are shown. This is why a sensitivity label policy is required to ensure that users can apply Label1 to files.
The other options do not meet the requirement. Auto-labeling policies apply labels automatically when content matches conditions, but they are not the primary mechanism for simply making a label available for user selection. A trainable classifier is used to identify content categories, not to publish a label. A retention label policy publishes retention labels for records and lifecycle purposes, which is different from sensitivity labeling for classification and protection. Therefore, the correct Microsoft-documented method to let users apply Label1 to files is to publish it using a sensitivity label policy.
Your company plans to use Microsoft 365 Copilot.
You need to provide a user with the ability to use Microsoft 365 Copilot, including the Researcher and Analyst agent. What should you use?
Answer : D
The correct answer is D. the Microsoft 365 admin center. Microsoft Learn states that users with a Microsoft 365 Copilot license can use Copilot capabilities, and Microsoft specifically points administrators to the Microsoft 365 admin center and its setup guidance to assign the required licenses to users. Microsoft also documents that the Researcher and Analyst agents were deployed to existing users with Microsoft 365 Copilot licenses and that administrators govern these agents through the Microsoft 365 admin center.
The other portals are not the primary place for this task. Microsoft Entra admin center focuses on identity and access, Microsoft Purview focuses on compliance and governance, and Microsoft Defender focuses on security operations and threat protection. None of those is the main admin experience Microsoft documents for assigning Microsoft 365 Copilot access and managing the availability of Researcher and Analyst. Because the goal is to enable a user to use Microsoft 365 Copilot and its Microsoft-provided agents, the correct administrative tool is the Microsoft 365 admin center.
Your company has a Microsoft SharePoint site named Site1. Site1 contains all the policies of the company s HR department. The policies are saved as Microsoft Word documents.
All users have read access to Site1.
The HR department manager reports that user requests about the policies are NOT being addressed in a timely manner, especially around major holidays.
You need to recommend a solution to enable the users to find the HR department policies. The solution must provide the users with a list of common queries and ensure that responses are grounded only in Site1.
What should you include in the recommendation?
Answer : C
The correct answer is C. a custom Microsoft 365 Copilot agent. Microsoft Learn explains that Agent Builder in Microsoft 365 Copilot lets you create agents with specific instructions, dedicated knowledge sources, and starter prompts. Starter prompts are designed to help users understand the most common supported scenarios, which directly matches the requirement to provide users with a list of common queries. Microsoft also documents that an agent can be grounded in selected SharePoint sites, folders, or files, allowing the response scope to be targeted to the HR policy content in Site1 rather than broad enterprise or web data.
The other options do not fit the requirement. Copilot in Word is document-focused and is not intended to create a reusable, shared query experience grounded only in one SharePoint source. Copilot notebooks group materials and chats, but they are not the right tool for publishing a guided HR policy assistant with starter prompts. Researcher is designed for broader, multi-step research using work data and web content, so it does not satisfy the requirement to keep answers grounded only in Site1.
Your organization has a Microsoft 365 E5 subscription.
You need to prevent users from sharing corporate financial data to external users. What should you use?
Answer : B
The correct answer is B. data loss prevention (DLP) policies. Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices. Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.
Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft's documented solution is DLP policies.
