Microsoft AB-900: Governing Copilot and Agents in Microsoft 365

AB-900 covers the administration foundations needed to support Microsoft 365 Copilot and agents in an organization. The audience is an administrator who understands Microsoft 365 services, identity, collaboration, protection and governance. Microsoft's July 22, 2026 study outline separates core Microsoft 365 objects, data protection for Copilot, and basic operational administration of Copilot and agents. An English exam update is scheduled for October 14, 2026, so the exact objectives should be checked against the date on which the candidate books the exam.

A central lesson is that adding Copilot does not replace the Microsoft 365 permission model. Poorly scoped SharePoint access, unmanaged guest accounts and inconsistent retention labels remain security issues even when the assistant itself behaves as designed. AB-900 is therefore different from AB-731, which emphasizes organizational transformation, and different from application development credentials. Here the administrator must identify a misconfiguration, select a control and verify the outcome within existing enterprise services.

Connect core Microsoft 365 objects to administrative responsibilities

Microsoft 365 has several control planes. The main admin center manages identities, licenses, domains and organization settings. Exchange Online has mailboxes and distribution groups. SharePoint Online has sites, libraries and permissions; Teams adds teams, channels and collaboration policies. Microsoft Entra governs identity and sign-in, while Microsoft Purview provides data classification, retention and compliance capabilities. An AB-900 scenario often turns on recognizing which object a problem belongs to before choosing an interface or administrative role.

Suppose one department cannot use a Copilot capability although employees can open the relevant Microsoft 365 app. The administrator should distinguish missing licenses, tenant configuration, service availability, user membership and policy restrictions. Granting a broad global administrator role is not a solution. Investigate effective assignment at the affected user or group, check administrative audit evidence and test with a representative account. A setting can be correctly enabled in one workload yet inaccessible through a different permission or policy layer.

Licenses, groups, mailboxes, SharePoint sites and Teams resources have different lifecycles. Users joining a project may receive membership through groups, but access inherited from an old team can persist after roles change. Offboarding therefore means revoking or updating actual entitlements, not merely removing a person from a communications channel. A controlled inventory of shared spaces makes it easier to reason about Copilot's ability to surface information across documents and discussions.

Apply identity controls before enabling broad AI access

Microsoft Entra ID supports multifactor authentication, Conditional Access, privileged role management and sign-in investigation. These controls matter because Copilot relies on users' authenticated context. If an attacker compromises an account with expansive document access, a conversational search interface can make discovery of that data quicker. A better answer starts with strong authentication, least-privilege role assignment and visibility into unusual activity rather than blocking every AI feature by default.

Privileged Identity Management can support time-bound administrator access. An administrator who only needs to review a deployment should not have permanent broad privileges. Conditional Access decisions depend on user, device, risk and access conditions, so troubleshoot them using sign-in logs and policy evaluation instead of guessing from the failure screen. An enforcement decision may reflect an untrusted device or risk event, not a malfunctioning Copilot license.

App registrations and enterprise applications also require scrutiny. A custom agent or connector may have its own application identity with permissions distinct from the signed-in employee. Review consent grants and application permissions, restrict secrets, and identify who owns a connector when it no longer has a business purpose. A user-facing agent should not silently act with rights beyond the user's approved scope merely because a background service account has those rights.

Control oversharing across SharePoint and Microsoft Graph

Copilot can retrieve information that the signed-in user is authorized to access; that statement is only as reassuring as the underlying authorization. An organization may have sensitive folders available to large groups through old links or broad site membership. Before expanding deployment, identify externally shared sites, abandoned content and libraries where access is inconsistent with the document's classification. Review actual effective permissions, not simply the site's name or business unit.

SharePoint data access governance reports and advanced management capabilities help administrators investigate oversharing. A report might show files accessible to many people, but broad access can be legitimate for approved policies or training materials. The task is to separate intentional reach from accidental exposure. Remediation may involve breaking unnecessary inheritance, changing default sharing settings, retiring links and assigning sensitive libraries to narrower groups. Verify that legitimate collaboration still works after tightening permissions.

The role of Microsoft Graph is essential: information surfaced by an assistant may come from mail, meetings, documents or collaboration services under a person's context. New employees should not discover historical restricted information merely because colleagues linked it in a broadly accessible site. A useful security review traces a sample answer back to the original content, its access path and who can grant or revoke that access. Unlike Power BI workspace and data permissions, the Copilot exposure being investigated here depends on the source document’s Microsoft 365 permissions and the user’s authorized context; one workload’s access setting does not secure the other.

Use Purview to manage retention, classification and AI risk

Microsoft Purview includes sensitivity labels, Data Loss Prevention, data lifecycle management, communication compliance, Insider Risk Management and Data Security Posture Management for AI. Each capability addresses a different question. A label describes sensitivity and may enable enforcement; DLP detects or blocks specified movement of data; retention governs preservation and disposal; investigation tools support review of activity. A single feature does not automatically satisfy every legal or information-security requirement.

For example, a finance file marked confidential may still be stored in a library with excessive access. Apply labels and permissions as complementary controls. When a user attempts to paste regulated information into an unauthorized destination, DLP can provide a different protective boundary. Administrators must understand alert routing, exceptions, false positives and the audit trail. A policy that silently blocks important work without an escalation path may cause staff to transfer information through less controlled channels.

AI usage also produces operational data. Review what prompts, responses and tool interactions are recorded, who can inspect them and how long they are retained. An administrator should be able to identify an agent with unusually high access or usage and determine whether the activity is expected. Microsoft Purview's AI-oriented posture capabilities can assist discovery, but governance still needs an owner to interpret findings and approve remediation rather than treating a dashboard score as the final judgment.

Administer Copilot licenses, agents and approval boundaries

AB-900 examines basic licensing, usage measurement and administration rather than advanced agent development. Copilot licensing can involve assigned subscriptions and pay-as-you-go billing models depending on the product and tenant configuration. A team should validate that the charging model matches intended usage, track consumption and establish budget alerts. Usage metrics must be read alongside quality outcomes; a highly active agent can still waste staff time if its responses require extensive correction.

Agents need lifecycle management. Establish who can create an agent, what actions it may perform, who approves wider distribution and who is responsible for maintenance. An agent that retrieves answers from a shared resource differs materially from one that can modify a customer record or trigger an external payment. Approval gates should reflect that difference. Restrict connections and data sources; test tool behavior when a user has insufficient rights; and document a safe way to disable the agent if access or output quality becomes unsafe.

Consider a HR assistant deployed for answering policy questions. It can retrieve approved benefits information but should not expose a colleague's private records or execute an employment action. Audit the knowledge source, test access with accounts from different departments and check how requests outside scope are escalated. If a document is withdrawn, verify that its content is no longer returned through indexing or caching. Operational monitoring should record unresolved cases and sources of wrong answers, not just successful chat sessions.

An administrator should also test how license or policy changes affect actual access over time. A user can retain a cached application session after a subscription is removed, or an agent can continue surfacing an indexed reference after someone changes its underlying document. Design validation around both new sign-ins and existing sessions. A support ticket that simply says "Copilot still works" after an admin action does not establish that every entitlement was refreshed correctly. Identify the specific feature, access route and expected effect, then test with a new session and a controlled account.

When responding to a potential oversharing incident, preserve the original report before changing permissions. A file may have been exposed through a site membership, anonymous link or inherited library permission. Each requires a different remediation. Capture who had access, whether activity evidence indicates actual use, and which team owns notifying affected stakeholders. If the response immediately deletes the content, it may destroy useful evidence while failing to fix the permission pattern elsewhere. Strong AB-900 administration is deliberate enough to protect both users and the audit trail.

Troubleshoot and measure a secure rollout

A disciplined rollout starts with a small representative user group and known content sets. Establish the sign-in requirements, license assignments, sharing policies, Purview controls and support responsibilities. Test typical and adversarial queries using users with different access levels. A successful test does not prove security unless the expected refusals and blocked actions also behave correctly. Document the sources used and how permission changes propagate after a file, user or group is modified.

When a problem is reported, determine whether it is a user permission issue, a missing source, a model-quality issue or a connector failure. These require different teams and fixes. If a generated answer is wrong because a source is stale, retraining users alone will not solve it. If an agent cannot act because the employee lacks a role, increasing the model's prompt detail will not grant authorization. Administrators should collect relevant audit logs and business symptoms before modifying tenant-wide policies.

Microsoft's AB-900 study guide provides the canonical skills for this edition. Review the objectives again after October 14, 2026, because the English outline is scheduled to change; localized versions may follow later. Build hands-on confidence in Microsoft 365 admin center, Entra, SharePoint and Purview with a controlled lab tenant. The exam rewards recognizing which boundary protects an outcome, how to check that it is in force and how to support Copilot without turning convenience into unnecessary data exposure.