AB-900 Microsoft 365 Copilot & Agent Administration Fundamentals Study Prep

The correct answer is B. the Microsoft Purview DSPM for AI solution . Microsoft documents that Data Security Posture Management for AI (DSPM for AI) in Microsoft Purview provides a central place to secure data for AI apps and proactively monitor AI use , including Copilots and agents . Microsoft also states that DSPM for AI helps organizations identify where sensitive content is used in AI interactions , review Copilot prompts and responses , analyze usage patterns , assess exposure and oversharing risks, and get recommendations for protections such as sensitivity labels and DLP policy coverage.

The other options do not fit this requirement. Microsoft Viva Insights focuses on productivity and work-pattern analytics, not sensitive-data protection in Copilot interactions. Microsoft Security Copilot is a security assistant for analysts, not the Purview governance solution that analyzes sensitive content use in Copilot and recommends data protections. Insider Risk Management is for identifying risky user behavior, not for broad AI interaction posture analysis and protection recommendations. Microsoft specifically positions DSPM for AI as the “front door” for discovering, monitoring, and protecting AI-related data usage in Microsoft 365 Copilot.

You can use the eDiscovery Microsoft Purview solution to find all the content that relates to the term “Project Falcon” in the emails exchanged by two users.

The correct answer is eDiscovery . Microsoft documents that Microsoft Purview eDiscovery is used to search for content in Microsoft 365 data sources that is relevant to an investigation, legal matter, or internal review. Microsoft specifically states that eDiscovery search can find email messages, documents, instant messages, and other content across Microsoft 365 locations, including Exchange Online mailboxes . This makes it the correct solution for locating content related to a keyword or phrase such as “Project Falcon” in emails exchanged between specific users.

This is different from other Purview solutions such as Communication Compliance, which is designed to monitor risky or inappropriate communications, or Data Lifecycle Management, which is for retention and deletion. The requirement here is targeted search and retrieval of content connected to a specific term in user email communications, which is exactly what eDiscovery is designed to do. Microsoft also notes that eDiscovery supports keyword queries and search conditions , which further aligns with this scenario.

The correct answer is B . Microsoft documents that admins can block agents in the Microsoft 365 admin center, and when administrators block Microsoft agents such as Researcher and Analyst, those agents are made inaccessible to all users in the tenant. Microsoft’s agent management guidance also states that admins can manage agent lifecycle and access centrally, including blocking or removing agent availability across the organization.

Applied to this scenario, if an admin blocks Agent1 , the shared agent is no longer available for either the creator ( User1 ) or the recipient ( User2 ), and other users also cannot install or access it. This rules out options A and C, which both say the blocked agent remains accessible. It also rules out D, because blocking is a tenant admin action that removes availability broadly, not just for shared recipients while leaving the creator unaffected. Microsoft positions blocking as an organization-level control over agent access, so the best matching option is that Agent1 is removed from User1 and User2, and no users can install Agent1 .

The correct answer is A. the SharePoint admin center . Microsoft documents that the SharePoint admin center includes Data access governance reports and site-level sharing reports that help administrators identify where content is shared externally. Microsoft also documents that every standard Microsoft Teams team is connected to a SharePoint site for file storage and collaboration. Because Teams files and many sharing scenarios for teams are backed by SharePoint sites, the SharePoint admin center is the correct place to investigate which sites are shared externally, including Teams-connected SharePoint sites .

The other options are less suitable for this requirement. The Teams admin center is primarily for Teams policy, user, device, and workload administration, but it is not the main portal Microsoft documents for identifying externally shared site content. The Microsoft 365 admin center focuses on broad tenant administration and usage reporting, and the Microsoft Defender portal is for security investigation rather than SharePoint/Teams sharing governance. For identifying externally shared SharePoint sites and Teams-connected sites, Microsoft’s documented reporting path is the SharePoint admin center .

The correct answer is A . Microsoft Learn defines Zero Trust as a security strategy built on the principles verify explicitly , use least privilege access , and assume breach . Microsoft also summarizes Zero Trust as a model that assumes breach and verifies every request , rather than trusting users, devices, or traffic simply because they originate from inside the corporate network. This is the key reason option A is correct. Under Zero Trust, every access request should be evaluated continuously using available signals such as identity, device state, location, service, and risk.

Option B is incorrect because improving user experience is not the defining principle of Zero Trust. Option C is incorrect because Zero Trust requires ongoing review and adjustment of permissions, especially through least privilege and risk-based access. Option D is incorrect because Zero Trust explicitly rejects implicit trust based on network location. Microsoft states that organizations should reduce reliance on the traditional idea that anything on the internal network is automatically safe or trustworthy.

The correct answer is Microsoft SharePoint sites . Microsoft Learn documents that Microsoft Purview sensitivity labels for containers can be applied to Microsoft Teams, Microsoft 365 groups, and SharePoint sites . These labels can control settings such as privacy, external sharing, and unmanaged device access for the labeled site. That is the official Microsoft feature that matches the sentence in the question.

The other options are not the best match for this item. Microsoft 365 Copilot conversations are not the standard object to which admins directly apply a sensitivity label in the way this question is asking. Copilot can honor labels on source content and may display label context in responses, but the selectable resource here is not “Copilot conversations.” Azure Blob Storage is also not the intended answer in the Microsoft 365 Copilot and Agent Admin context for Purview sensitivity labels.

So for this hotspot, the sentence is correctly completed with Microsoft SharePoint sites , because Microsoft explicitly supports applying Purview sensitivity labels to SharePoint sites as a container-level labeling capability.

The correct answer is Microsoft Graph . Microsoft documents that Microsoft 365 Copilot accesses organizational content and context through Microsoft Graph . Microsoft Graph provides the user’s work context, including items such as emails, chats, meetings, files, contacts, and calendar data , along with relationship and activity signals that help Copilot ground and rank responses. Microsoft also explains that Copilot combines organizational content with the user’s working context, such as recent chat conversations, email exchanges on a topic, and the meeting the user is currently in. Those are exactly the kinds of signals described in the question, including collaboration history and document relevance.

The other options do not fit this sentence. Microsoft Copilot Studio is used to build and customize copilots and agents. Microsoft Purview is for compliance, governance, and data protection. Microsoft Viva Insights provides workplace analytics and insights, but it is not the core service described by Microsoft as supplying the contextual signals that ground Microsoft 365 Copilot responses. Therefore, the only option that correctly completes the sentence is Microsoft Graph .

The correct setting is Restricted site access configured with Group1 . Microsoft Learn states that you can restrict access to a SharePoint site by specifying Microsoft Entra security groups or Microsoft 365 groups as the Restricted Access Control group . Microsoft also states that, after the policy is applied, a user can access the site content only if the user both already has permission to the site or content and is a member of the specified restricted access group. This exactly matches the requirement: users who currently have access to Site1 must also be members of Group1 to continue accessing the content.

The Restrict content from Microsoft 365 Copilot setting is unrelated to direct user access to the SharePoint site. That control limits whether Copilot can use site content, but it does not block users from opening the site themselves. Microsoft separately explains that Restricted SharePoint Search and Copilot restrictions are not the same as changing actual SharePoint permissions or access boundaries. So for this scenario, keep the Copilot restriction Off and configure Restricted site access with Group1 .

Microsoft Defender for Office 365 provides protection from phishing and malware attacks. Answer: Yes

Microsoft Defender for Identity monitors identities in Active Directory domains. Answer: Yes

Microsoft Defender Vulnerability Management provides protection for software as a service (SaaS) applications. Answer: No

The correct selections are Yes, Yes, No . Microsoft documents that Microsoft Defender for Office 365 protects email and collaboration workloads from threats such as phishing and malware , including zero-day malware and business email compromise scenarios. That makes statement 1 Yes .

Statement 2 is also Yes because Microsoft states that Microsoft Defender for Identity monitors identity signals from on-premises Active Directory and related identity infrastructure to detect suspicious activity and identity-based attacks. Microsoft further describes monitoring information generated from your organization’s Active Directory, network, and event activities.

Statement 3 is No because Microsoft Defender Vulnerability Management is focused on discovering and prioritizing vulnerabilities across devices and assets such as Windows, macOS, Linux, mobile platforms, and network devices. Microsoft’s SaaS application protection offering is Microsoft Defender for Cloud Apps , not Defender Vulnerability Management.

The correct answer is D. a sensitivity label policy . In Microsoft Purview, creating a sensitivity label by itself does not make it available to users. Microsoft Learn states that after you create sensitivity labels, you must publish them by creating a label policy so that users and groups can see and apply those labels in Microsoft 365 apps and services. Publishing controls which labels are available and to whom they are shown. This is why a sensitivity label policy is required to ensure that users can apply Label1 to files.

The other options do not meet the requirement. Auto-labeling policies apply labels automatically when content matches conditions, but they are not the primary mechanism for simply making a label available for user selection. A trainable classifier is used to identify content categories, not to publish a label. A retention label policy publishes retention labels for records and lifecycle purposes, which is different from sensitivity labeling for classification and protection. Therefore, the correct Microsoft-documented method to let users apply Label1 to files is to publish it using a sensitivity label policy .