Is AB-900 the replacement for MS-900?

MS-900 retired on 31 March 2026. AB-900 is now the fundamentals-level Microsoft exam that covers Microsoft 365 core services and administration, with Copilot and agents added, so it is the natural first exam for anyone starting in Microsoft 365 administration. Your old MS-900 certification stays on your transcript.

Does the AB-900 certification expire?

No. AB-900 earns a fundamentals certification, and Microsoft fundamentals certifications do not expire, so there is no yearly renewal assessment. Associate and expert certifications that you may take later, such as MD-102 or SC-401, do expire each year and need a free online renewal assessment.

Do I need a Microsoft 365 Copilot licence to prepare for AB-900?

It helps but is not essential. Much of the exam covers Microsoft 365 admin centers, Entra ID and Purview, which any admin tenant can show. For the Copilot and agent tasks, a lab tenant with Copilot licences, Copilot Chat with pay-as-you-go agents, or a course lab environment gives you the hands-on practice you need.

Is AB-900 suitable for freshers in India?

Yes, if you are aiming for Microsoft 365 support or administration roles. It is a beginner-level exam, and Microsoft's course is designed for novice administrators without prior hands-on experience. Freshers should still practise in a lab tenant, because questions describe real admin center tasks rather than definitions alone.

Is AB-900 useful if my company has not bought Copilot yet?

Yes. Most of the exam is about Microsoft 365 permissions, identity and data protection, which you need whether or not Copilot is switched on. Fixing oversharing and labelling sensitive content before a Copilot purchase is exactly the preparation leadership will ask IT to do.

AB-900 Exam Guide: Copilot and Agent Administration for Indian Admins

AB-900 is Microsoft's fundamentals exam for running Microsoft 365 once Copilot and agents are switched on. Passing it earns the Microsoft 365 Certified: Copilot and Agent Administration Fundamentals certification. The skills were refreshed on 14 October 2026, and the largest area, at 35 to 40%, is data protection and governance: permissions, Microsoft Purview and oversharing, not prompt writing.

At a glance

Item	Detail
Exam	AB-900, Microsoft 365 Copilot and Agent Administration Fundamentals
Level	Beginner; fundamentals certifications do not expire
Skill areas	Core Microsoft 365 30 to 35%, data protection and governance 35 to 40%, Copilot and agent admin 25 to 30%
Exam time	45 minutes, with no Microsoft Learn access during the exam
Pass mark	700
Official course	AB-900T00, one day
Context	MS-900 retired 31 March 2026; MS-102 retires 30 November 2026

What AB-900 covers

The AB-900 study guide lists three areas. The 14 October 2026 update made a minor change to the security features section; the audience profile did not change.

Identify the core features and objects of Microsoft 365 services (30 to 35%)

How licences assigned to users and groups affect access; organisation settings and domains in the Microsoft 365 admin center; mailboxes and distribution groups in the Exchange admin center; sites, libraries, folders, roles and permissions in SharePoint; teams, channels and policies in the Teams admin center. Then security basics: Zero Trust, authentication and authorisation, Microsoft Defender XDR, Microsoft Entra ID, Conditional Access, single sign-on, troubleshooting sign-ins (MFA, Conditional Access, risky sign-ins), Identity Secure Score, audit logs, Privileged Identity Management, and app registrations versus enterprise applications.

Understand data protection and governance tasks for Microsoft 365 and Copilot (35 to 40%)

Microsoft Purview Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Security Posture Management (DSPM) for AI and Data Lifecycle Management; sensitivity labels, classification and retention; how Copilot accesses data, how Microsoft Graph shapes its answers and how permissions protect against risk; Compliance Manager, Data Explorer, activity explorer and eDiscovery content search; and spotting oversharing in SharePoint with data access governance reports and SharePoint Advanced Management, including restricted access control.

Perform basic administrative tasks for Copilot and agents (25 to 30%)

Comparing built-in Copilot and agent capabilities; the monthly Copilot licence versus pay-as-you-go, including SharePoint agents; which Copilot features can be turned on or off; use cases for Researcher, Analyst and custom agents; assigning licences; pay-as-you-go billing policies; usage and adoption reporting, including Copilot Analytics; managing prompts; and, for agents, user access, creation, the approval process and monitoring in the Microsoft 365 and Power Platform admin centers.

Why oversharing is the heart of this exam

Copilot works with the permissions a user already has. If a salary sheet sits in a SharePoint site shared with the whole company, Copilot can find it for anyone who asks the right question. Copilot did not leak anything; the permissions did.

Microsoft names one of the biggest culprits plainly. Its documentation on item-level permission reports calls unresolved "Everyone except external users" permissions a top oversharing risk, because that content is visible to every internal user and surfaces directly in Copilot search results.

A common pattern in organisations that moved from on-premises file shares to SharePoint over the years is broad access copied across and never reviewed. The AB-900 answer is a sequence you should be able to explain:

Run the site permissions snapshot in the data access governance reports to find sites with the widest access.
Run the sharing links and "Everyone except external users" activity reports to see recent oversharing.
Send site access reviews to the site owners, who know what should be shared.
Apply sensitivity labels, restricted access control or restricted content discovery to sensitive sites.
Watch AI activity with DSPM for AI in Purview.

Admins who prefer scripts can trigger the activity report from SharePoint Online PowerShell:

Start-SPODataAccessGovernanceInsight -ReportEntity EveryoneExceptExternalUsersAtSite -Workload SharePoint -ReportType RecentActivity -Name "PublicSiteViaEEEU"

Without a SharePoint Advanced Management licence you must first enable data collection for these activity reports, and the report only contains data from that point on. Knowing that detail is the difference between an admin who has run the report and one who has only read about it.

Three questions Indian leadership will ask you

"Where is our Copilot data stored?"

Microsoft lists India among the sign-up countries covered by its Product Terms data residency commitments for Microsoft 365 Copilot and Copilot Chat, which deal with where customer data, such as prompts and responses, is stored at rest. The Advanced Data Residency add-on also lists India as a local region geography. Read Data Residency for Microsoft 365 Copilot offerings and the Product Terms for the exact wording before you answer in writing. This is general information, not legal advice; your legal or compliance team decides what your obligations are.

"Do we have to buy a Copilot licence for everyone?"

Not necessarily, and the exam expects you to compare the options. Users without a paid Microsoft 365 Copilot licence can use agents in Copilot Chat through pay-as-you-go billing, charged to an Azure subscription through a billing policy that you create in the Microsoft 365 admin center. You can scope a policy to a group, set a monthly, quarterly or yearly budget with alert thresholds, and the region you pick for the policy decides where the tenant ID and usage data are stored, as described in Microsoft's pay-as-you-go setup guide. Ask finance who owns the Azure subscription before you connect it.

"Who is allowed to build and publish agents?"

AB-900 tests the controls: configuring which users can access agents, the approval process before an agent is available to others, and monitoring usage and lifecycle from the Microsoft 365 admin center and the Power Platform admin center. Agree on a simple rule early, such as "anyone can build for themselves, IT approves anything shared with a department", and our Copilot Studio agents guide helps business teams understand what they are asking for.

Who should take AB-900

Helpdesk and L1 or L2 Microsoft 365 support engineers in SMEs, managed service providers and global capability centres who now get Copilot tickets.
System administrators moving from on-premises Active Directory and Exchange to the cloud admin centres.
Freshers aiming for Microsoft 365 administration roles who need a first, recognised credential.
Copilot champions and functional consultants who work alongside IT during a rollout; our Microsoft 365 Copilot rollout guide covers the business side.

What next after AB-900? SC-900 deepens security, compliance and identity, then MD-102 for endpoints or SC-401 for information protection. Be careful with MS-102: Microsoft retires it on 30 November 2026, so do not start preparing for it now unless you can sit the exam before that date.

A three-week study plan

Week	Focus	Practise in a lab tenant
1	Microsoft 365 core: admin centers, licences, Entra ID basics	Create users and groups, assign licences by group, test a Conditional Access policy in report-only mode
2	Purview and oversharing	Publish a sensitivity label, create a DLP policy, run a content search, generate a data access governance report
3	Copilot and agents	Work through the "Explore Microsoft 365 Copilot and agent administration" learning path; set up a billing policy with a budget; create and approve an agent

You need a tenant where you are an administrator. The free Microsoft 365 Developer Program sandbox is limited to eligible members, such as Visual Studio Professional or Enterprise subscribers and some Microsoft partners, so most learners use a trial tenant or the lab environment provided with a course. Never practise on your employer's production tenant without written approval.

Exam day

Format: fundamentals exams give 45 minutes of exam time inside a 65-minute seat time, and Microsoft Learn is not available during the exam.
Online from home: a walled room with a closed door, nobody entering, a clear desk, and a government ID whose name matches your Microsoft certification profile exactly.
Retakes: wait 24 hours after a first failed attempt, then 14 days between later attempts.
Exam fee: varies by country; check the exam page for the current price in India.

How CertTulen Academy can help

CertTulen Academy, a Microsoft Training Services Partner and Microsoft AI Cloud Partner, runs a one-day AB-900 Copilot and Agent Administration Fundamentals course as live, MCT-led online training with hands-on admin labs. IT teams preparing a Copilot rollout can book a private corporate cohort, online or in person in major Indian cities. Course pages show INR pricing with UPI, card and netbanking checkout. Contact us on WhatsApp at +91 93618 83583 or through our contact page for a batch that suits your time zone.