Microsoft AB-900 - Microsoft 365 Copilot and Agent Administration Fundamentals

The correct answer is B. Data explorer. Microsoft Learn states that Data explorer in Microsoft Purview shows a current snapshot of items that have been classified as a sensitive information type in your organization. Microsoft’s sensitive information type documentation specifically lists examples such as social security numbers and credit card numbers, which means Data explorer is the appropriate portal feature for identifying files and emails that contain those data types. Data explorer is designed to help administrators see where sensitive data exists across supported Microsoft 365 locations.

The other options are less appropriate for this task. Information Protection reports focus more broadly on label and protection reporting. Information Protection policies are for configuring classification and protection behavior, not for finding existing files and emails containing SSNs or credit card numbers. Activity explorer is primarily used to review user and policy-related activities, such as label changes or DLP events, rather than to provide the direct sensitive-data inventory view requested here. Since the question asks to identify the files and emails containing specific sensitive information types, Microsoft’s documented answer is Data explorer.

To use Microsoft 365 Copilot Chat to reason over web data, you need a Microsoft 365 Copilot license. Answer: No

To use the Researcher agent in Microsoft 365 Copilot, you need a Microsoft 365 Copilot license. Answer: Yes

To add an agent in the Microsoft 365 Copilot app, you need a Microsoft 365 Copilot license. Answer: No

The correct selections are No, Yes, No . Microsoft documents that Microsoft 365 Copilot Chat is available at no additional cost for eligible Entra account users with qualifying Microsoft 365 licenses, and that it includes secure AI chat grounded in the web . That means a separate Microsoft 365 Copilot add-on license is not required just to use Copilot Chat over web data.

Statement 2 is Yes because Microsoft states that Researcher is part of the core default experience for Microsoft 365 Copilot licensed users . In other words, access to the Researcher agent requires the Microsoft 365 Copilot license.

Statement 3 is No because Microsoft documents that users can access agents and create them in the Microsoft 365 Copilot app through Copilot Chat, and Microsoft 365 service descriptions state that web-grounded agents are available at no extra cost for commercial users with a qualifying Microsoft 365 license. A Copilot add-on license is required for certain advanced capabilities, but not simply to add an agent in the app in general.

The correct answer is D. an app registration . Microsoft Learn states that to delegate identity and access management functions to Microsoft Entra ID , an application must be registered with a Microsoft Entra tenant . When you register an application, you create its identity configuration in Microsoft Entra, and a corresponding service principal is created so the application can authenticate and integrate with the tenant. This is the standard Microsoft mechanism for allowing a third-party cloud service or app to authenticate to Microsoft Entra.

The other options do not provide the app identity required for authentication. Multifactor authentication (MFA) strengthens user sign-ins, but it does not onboard a third-party service as an application identity in Entra. Conditional Access enforces access policies after authentication and authorization decisions are being made; it does not create the application identity itself. A Microsoft 365 Copilot connector is used to bring external data into Microsoft 365 experiences, not to let a third-party cloud service authenticate to Microsoft Entra. Therefore, the correct configuration is an app registration .

The correct answer is C. the code interpreter capability . Microsoft Learn states that the code interpreter capability for Microsoft 365 Copilot declarative agents allows the agent to generate and execute Python code to analyze data and generate visualizations . Microsoft’s agent schema documentation explicitly describes Code Interpreter as a capability used to solve complex math problems, analyze data, and generate visualizations. That directly matches the requirement to create charts and visualizations from a Microsoft Excel workbook .

Microsoft documentation also explains that code interpreter supports working with Excel files and is used for scenarios such as data analysis , statistical computations , and generating charts . This makes it the correct configuration for an agent that must reason over workbook data and produce chart-based outputs. By contrast, the image generator capability is for creating images, not for analyzing workbook data. The Scrum Assistant and Customer Insights Assistant options are templates, not the specific technical capability required to read data and build charts from an Excel workbook.

In Microsoft 365 Copilot, you should use the Researcher agent to perform multi-step reasoning over unstructured data.

The correct answer is the Researcher agent . Microsoft describes Researcher in Microsoft 365 Copilot as an agent for complex, multi-step research that can reason across information sources and synthesize findings into structured outputs. That aligns with the phrase multi-step reasoning in the question. Microsoft’s guidance also contrasts Researcher with Analyst , which is aimed more at data analysis and spreadsheet-oriented tasks.

The other options are less suitable. Chat is general-purpose and not the specialized tool Microsoft positions for deeper multi-step research workflows. A notebook is used to organize materials and chats, not as the main reasoning engine for this scenario. The Analyst agent is better suited to structured data analysis, trends, and calculations rather than broad reasoning over unstructured data such as documents, notes, and mixed content. Based on Microsoft’s product positioning, the best fit for multi-step reasoning over unstructured information is the Researcher agent .

The correct answer is A. Microsoft Entra ID Protection . Microsoft Learn explains that Microsoft Entra ID Protection detects sign-in risk and user risk and can work with Conditional Access risk policies to automatically respond when suspicious authentication activity is identified. Microsoft documents specifically state that organizations can configure sign-in risk policies and user risk policies to automate responses such as blocking access , requiring multifactor authentication , or forcing password changes when risky activity is detected. Microsoft also notes that some very high-confidence risky sign-ins are automatically blocked by built-in protections.

The other options do not match this function. Microsoft Defender for Office 365 focuses on email, collaboration, and threat protection for tools like Exchange Online and Teams, not sign-in risk blocking. Microsoft Entra Privileged Identity Management (PIM) manages privileged role activation and governance, not risky sign-in detection. Microsoft Defender for Identity detects identity-related threats in hybrid identity environments, but the Microsoft feature used to automatically block risky sign-ins is Microsoft Entra ID Protection .

The correct answer is A. the Microsoft Defender portal . Microsoft documents that phishing investigation and analysis for email threats is handled in Microsoft Defender for Office 365 through the Microsoft Defender portal . Microsoft’s phishing investigation guidance and email security reporting both point admins to Defender capabilities such as Threat Explorer , campaign views , and phish reports to understand the scope, affected users, and impact of phishing attacks.

The other options are not the primary investigation tool for this scenario. The Microsoft 365 admin center is mainly for tenant administration and usage reporting, not detailed phishing impact investigation. The Microsoft Entra admin center focuses on identity and access management, not email threat analysis. The Exchange admin center manages mail flow and Exchange settings, but Microsoft’s current phishing investigation workflows are centered in the Microsoft Defender portal , where security analysts can review detections, remediation actions, and affected recipients.

So, to review the impact of a phishing incident that targeted email users, the Microsoft-documented choice is the Microsoft Defender portal .

The correct answers are A and D . Microsoft documents that with group-based licensing , licenses assigned to a group are automatically inherited by the group’s members. Therefore, if User1 is added to Group1 , User1 can receive the Microsoft 365 E3 license through group membership. Microsoft also documents that licenses can be assigned directly to individual users , so assigning a Microsoft 365 E3 license straight to User1 is also a complete solution.

Options B and C are incorrect because Conditional Access controls how users access cloud resources after sign-in; it does not grant product entitlements or service licenses. Microsoft licensing guidance separates access-policy controls from actual license assignment. In this scenario, the issue is lack of license entitlement, not access conditions. As a result, the valid solutions are either to make User1 a member of the licensed group or to assign the license directly to User1. Microsoft also notes that group-based licensing assignment can fail if required user properties such as usage location are missing, but among the available answer choices, the two complete license-granting actions are Add User1 to Group1 and Assign a license to User1 .

The correct answer is Data access governance . Microsoft documents that Data access governance reports in the SharePoint admin center help administrators discover overshared or sensitive SharePoint content and assess sharing exposure. More specifically, Microsoft’s sharing links activity reports under Data access governance are designed to monitor sharing activity and identify sites where links such as Anyone , People in the organization , and Specific people links have been created. This is the SharePoint admin reporting area Microsoft provides for investigating external sharing patterns and related exposure.

The other listed reports do not fit this requirement. Agent insights is for Copilot/agent usage, App insights is for application-related insights, Change history tracks configuration changes, OneDrive accounts focuses on OneDrive administration, and Site policy comparison compares site settings. None of those is the SharePoint report family intended for identifying externally shared SharePoint content. Based on Microsoft’s documentation, the report area you should use is Data access governance .

The correct answer is D. the Microsoft 365 admin center . Microsoft Learn states that users with a Microsoft 365 Copilot license can use Copilot capabilities, and Microsoft specifically points administrators to the Microsoft 365 admin center and its setup guidance to assign the required licenses to users. Microsoft also documents that the Researcher and Analyst agents were deployed to existing users with Microsoft 365 Copilot licenses and that administrators govern these agents through the Microsoft 365 admin center .

The other portals are not the primary place for this task. Microsoft Entra admin center focuses on identity and access, Microsoft Purview focuses on compliance and governance, and Microsoft Defender focuses on security operations and threat protection. None of those is the main admin experience Microsoft documents for assigning Microsoft 365 Copilot access and managing the availability of Researcher and Analyst. Because the goal is to enable a user to use Microsoft 365 Copilot and its Microsoft-provided agents, the correct administrative tool is the Microsoft 365 admin center .