AB-900 Exam Dumps - Microsoft 365 Certified: Copilot and Agent Administration Fundamentals Questions and Answers

In Microsoft 365 Copilot, you should use the Researcher agent to perform multi-step reasoning over unstructured data.

The correct answer is the Researcher agent . Microsoft describes Researcher in Microsoft 365 Copilot as an agent for complex, multi-step research that can reason across information sources and synthesize findings into structured outputs. That aligns with the phrase multi-step reasoning in the question. Microsoft’s guidance also contrasts Researcher with Analyst , which is aimed more at data analysis and spreadsheet-oriented tasks.

The other options are less suitable. Chat is general-purpose and not the specialized tool Microsoft positions for deeper multi-step research workflows. A notebook is used to organize materials and chats, not as the main reasoning engine for this scenario. The Analyst agent is better suited to structured data analysis, trends, and calculations rather than broad reasoning over unstructured data such as documents, notes, and mixed content. Based on Microsoft’s product positioning, the best fit for multi-step reasoning over unstructured information is the Researcher agent .

the Microsoft Authenticator app

The correct answer is the Microsoft Authenticator app . The image shows the familiar Microsoft MFA prompt that says “Are you trying to sign in?” and “Enter the number shown to sign in.” Microsoft documents this as number matching in Authenticator push notifications , which is part of Microsoft Entra multifactor authentication using the Microsoft Authenticator app . Microsoft explains that number matching is a security improvement for Authenticator push approvals and is used when the default sign-in method is Authenticator push notifications.

The other choices do not match the experience shown. Email OTP would involve a one-time code sent by email. SMS would send a text message code to a phone number. Temporary Access Pass is a time-limited passcode used for onboarding or recovery scenarios, not the mobile push screen shown in the image. Because the graphic specifically shows a mobile approval prompt with number matching, the MFA method is clearly the Microsoft Authenticator app .

The correct answer is A. the SharePoint admin center . Microsoft documents that the SharePoint admin center includes Data access governance reports and site-level sharing reports that help administrators identify where content is shared externally. Microsoft also documents that every standard Microsoft Teams team is connected to a SharePoint site for file storage and collaboration. Because Teams files and many sharing scenarios for teams are backed by SharePoint sites, the SharePoint admin center is the correct place to investigate which sites are shared externally, including Teams-connected SharePoint sites .

The other options are less suitable for this requirement. The Teams admin center is primarily for Teams policy, user, device, and workload administration, but it is not the main portal Microsoft documents for identifying externally shared site content. The Microsoft 365 admin center focuses on broad tenant administration and usage reporting, and the Microsoft Defender portal is for security investigation rather than SharePoint/Teams sharing governance. For identifying externally shared SharePoint sites and Teams-connected sites, Microsoft’s documented reporting path is the SharePoint admin center .

The correct selections are No, Yes, No . Microsoft defines Zero Trust as a security strategy and explicitly states that it isn’t a product or a service . Instead, it is an approach based on principles such as verify explicitly , use least privilege access , and assume breach . That makes statement 2 true.

Statement 1 is false because Zero Trust does not require an Azure subscription. Microsoft provides Zero Trust guidance across many environments, including Microsoft 365, Copilot, Azure, and hybrid scenarios. It is a strategy that can be implemented with different technologies and is not dependent on owning Azure specifically.

Statement 3 is also false because there is no single switch in the Microsoft 365 admin center to “enable Zero Trust” for an organization. Microsoft’s documentation presents Zero Trust as a set of policies, configurations, and deployment steps across services such as Microsoft Entra, Intune, Defender, and Microsoft 365 workloads, not as one admin-center toggle.

Top of Form

Bottom of Form

The correct answers are A and D . Microsoft documents that with group-based licensing , licenses assigned to a group are automatically inherited by the group’s members. Therefore, if User1 is added to Group1 , User1 can receive the Microsoft 365 E3 license through group membership. Microsoft also documents that licenses can be assigned directly to individual users , so assigning a Microsoft 365 E3 license straight to User1 is also a complete solution.

Options B and C are incorrect because Conditional Access controls how users access cloud resources after sign-in; it does not grant product entitlements or service licenses. Microsoft licensing guidance separates access-policy controls from actual license assignment. In this scenario, the issue is lack of license entitlement, not access conditions. As a result, the valid solutions are either to make User1 a member of the licensed group or to assign the license directly to User1. Microsoft also notes that group-based licensing assignment can fail if required user properties such as usage location are missing, but among the available answer choices, the two complete license-granting actions are Add User1 to Group1 and Assign a license to User1 .

a site member of

The correct answer is a site member of . In the exhibit, the Site members group for Site1 contains Everyone except external users with Edit permissions. Microsoft documents that “Everyone except external users” automatically includes all internal users and excludes external guests . Since User1 is a newly created user in the organization, User1 is an internal user and is therefore included in that built-in principal.

Because that built-in principal is placed in the Site members group, User1 inherits member-level access to the site. User1 is not a site owner, because the Site owners group contains only the Global Administrator entry shown in the exhibit. User1 is also not merely a visitor, because the Site visitors group is listed as None . Finally, User1 is not prevented from accessing the site, because the membership granted through Everyone except external users gives internal users access to the site according to the permissions assigned to that group.

The correct answer is Microsoft 365 Copilot . Microsoft Learn states that Restricted SharePoint Search (RSS) gives organizations time to review and correct permissions on SharePoint sites, and then add only those reviewed sites to an allowed list that Copilot can access . That means RSS is specifically about restricting Copilot’s access to SharePoint content, not blocking administrators, guest users, or Microsoft Purview eDiscovery from those sites.

This distinction is important. Microsoft explains that users can still access SharePoint content based on their normal permissions, while RSS limits what Microsoft 365 Copilot can use as grounding data until site permissions are reviewed and approved. So the feature helps reduce oversharing risk in Copilot without removing a user’s direct ability to find or open content they already have permission to access in SharePoint. In other words, the restriction is placed on Copilot’s searchable grounding scope , not on the user’s own SharePoint permissions. That is why the sentence is correctly completed with Microsoft 365 Copilot .

The correct answer is B . Microsoft documents that admins can block agents in the Microsoft 365 admin center, and when administrators block Microsoft agents such as Researcher and Analyst, those agents are made inaccessible to all users in the tenant. Microsoft’s agent management guidance also states that admins can manage agent lifecycle and access centrally, including blocking or removing agent availability across the organization.

Applied to this scenario, if an admin blocks Agent1 , the shared agent is no longer available for either the creator ( User1 ) or the recipient ( User2 ), and other users also cannot install or access it. This rules out options A and C, which both say the blocked agent remains accessible. It also rules out D, because blocking is a tenant admin action that removes availability broadly, not just for shared recipients while leaving the creator unaffected. Microsoft positions blocking as an organization-level control over agent access, so the best matching option is that Agent1 is removed from User1 and User2, and no users can install Agent1 .

The correct answer is Require multifactor authentication for administrative roles . In the exhibit, each recommendation shows its available Secure Score points . The listed values are 1/1 for Use least privileged administrative roles , 8/8 for Do not expire passwords , 0.73/8 for Enable policy to block legacy authentication , and 0/10 for Require multifactor authentication for administrative roles . Because 10 points is the highest value among the options shown, resolving that recommendation would improve the Identity Secure Score the most.

Microsoft Learn explains that Identity Secure Score in Microsoft Entra is based on Microsoft security recommendations, and each recommendation contributes a specific number of points depending on its impact and implementation state. Recommendations related to administrator protection are especially important because privileged accounts are high-value attack targets. Microsoft also emphasizes multifactor authentication for admin roles as a core identity security best practice. Therefore, both from the screenshot and from Microsoft’s identity guidance, the recommendation with the greatest score improvement is Require multifactor authentication for administrative roles .

The correct selections are Yes, Yes, Yes . For statement 1, Microsoft Support explains that if you are not a site owner, you might still be able to invite other people to the site , although the invitation can generate an access request that a site owner approves or declines. Microsoft also states that site users have the opportunity to invite other people to collaborate on sites , unless that feature is disabled. That makes the statement true.

For statement 2, Microsoft Learn states that in SharePoint you can give people permissions to a site by adding individual users, security groups, or Microsoft 365 groups to one of the three SharePoint groups, including the Members group. That directly supports the statement.

For statement 3, Microsoft documents that site ownership and membership can be managed by adding or removing owners, members, site owners, site members, and site visitors . For group-connected sites, Microsoft also documents that owners can manage group ownership and remove owner status. Therefore, a site owner can remove another site owner, provided at least one owner remains.