Free and Premium Microsoft AB-900 Dumps Questions Answers

The correct answer is Data access governance . Microsoft documents that Data access governance reports in the SharePoint admin center help administrators discover overshared or sensitive SharePoint content and assess sharing exposure. More specifically, Microsoft’s sharing links activity reports under Data access governance are designed to monitor sharing activity and identify sites where links such as Anyone , People in the organization , and Specific people links have been created. This is the SharePoint admin reporting area Microsoft provides for investigating external sharing patterns and related exposure.

The other listed reports do not fit this requirement. Agent insights is for Copilot/agent usage, App insights is for application-related insights, Change history tracks configuration changes, OneDrive accounts focuses on OneDrive administration, and Site policy comparison compares site settings. None of those is the SharePoint report family intended for identifying externally shared SharePoint content. Based on Microsoft’s documentation, the report area you should use is Data access governance .

The correct answer is B . Microsoft documents that admins can block agents in the Microsoft 365 admin center, and when administrators block Microsoft agents such as Researcher and Analyst, those agents are made inaccessible to all users in the tenant. Microsoft’s agent management guidance also states that admins can manage agent lifecycle and access centrally, including blocking or removing agent availability across the organization.

Applied to this scenario, if an admin blocks Agent1 , the shared agent is no longer available for either the creator ( User1 ) or the recipient ( User2 ), and other users also cannot install or access it. This rules out options A and C, which both say the blocked agent remains accessible. It also rules out D, because blocking is a tenant admin action that removes availability broadly, not just for shared recipients while leaving the creator unaffected. Microsoft positions blocking as an organization-level control over agent access, so the best matching option is that Agent1 is removed from User1 and User2, and no users can install Agent1 .

The correct answer is C. Run the prompt. Scheduled prompts in Microsoft 365 Copilot are based on an existing Copilot prompt interaction. The practical workflow is to run the prompt first, then use the scheduling option for that prompt to define when and how often it should run, such as midnight. Saving a prompt is useful for reuse, but the question asks what task must be included to schedule a prompt execution. Creating an agent is a separate customization workflow and is not required to schedule a normal Copilot prompt. Creating a notebook is also unrelated; notebooks organize materials and chats but do not create a scheduled prompt run by themselves. The required action is to run the prompt so it can be scheduled.

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft’s recommended identity security best practices.

Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.

The correct answer is B. the Microsoft Purview DSPM for AI solution . Microsoft documents that Data Security Posture Management for AI (DSPM for AI) in Microsoft Purview provides a central place to secure data for AI apps and proactively monitor AI use , including Copilots and agents . Microsoft also states that DSPM for AI helps organizations identify where sensitive content is used in AI interactions , review Copilot prompts and responses , analyze usage patterns , assess exposure and oversharing risks, and get recommendations for protections such as sensitivity labels and DLP policy coverage.

The other options do not fit this requirement. Microsoft Viva Insights focuses on productivity and work-pattern analytics, not sensitive-data protection in Copilot interactions. Microsoft Security Copilot is a security assistant for analysts, not the Purview governance solution that analyzes sensitive content use in Copilot and recommends data protections. Insider Risk Management is for identifying risky user behavior, not for broad AI interaction posture analysis and protection recommendations. Microsoft specifically positions DSPM for AI as the “front door” for discovering, monitoring, and protecting AI-related data usage in Microsoft 365 Copilot.

From the SharePoint admin center, you can create a site .

The correct answer is site . Microsoft documents that in the SharePoint admin center , administrators can go to Active sites and select Create to create a new SharePoint site, such as a team site or communication site . Microsoft also describes site creation as one of the key tasks available to users with the SharePoint Administrator role.

The other options do not fit this sentence. A server is not something you create from the SharePoint admin center in Microsoft 365, because SharePoint Online is a Microsoft-managed cloud service. A user is typically created in the Microsoft 365 admin center or Microsoft Entra admin center, not in the SharePoint admin center. A role is also assigned through Microsoft 365 or Microsoft Entra administrative experiences, not created from the SharePoint admin center as the primary task described here.

So the sentence is correctly completed as: From the SharePoint admin center, you can create a site.

a site member of

The correct answer is a site member of . In the exhibit, the Site members group for Site1 contains Everyone except external users with Edit permissions. Microsoft documents that “Everyone except external users” automatically includes all internal users and excludes external guests . Since User1 is a newly created user in the organization, User1 is an internal user and is therefore included in that built-in principal.

Because that built-in principal is placed in the Site members group, User1 inherits member-level access to the site. User1 is not a site owner, because the Site owners group contains only the Global Administrator entry shown in the exhibit. User1 is also not merely a visitor, because the Site visitors group is listed as None . Finally, User1 is not prevented from accessing the site, because the membership granted through Everyone except external users gives internal users access to the site according to the permissions assigned to that group.

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft documents tenant controls for web search on or off , but not a general Microsoft 365 Copilot setting to block only selected websites for normal Copilot responses. Microsoft also says it doesn’t recommend or support managing Copilot through selective URL or domain blocking at the network level. Website allow/block lists shown in Microsoft documentation apply to Researcher with Computer Use virtual-device settings, not to standard Microsoft 365 Copilot web grounding overall.

Statement 2 is Yes because Microsoft provides the Allow web search in Copilot policy in Cloud Policy service and in the Microsoft 365 admin center, which can disable web search for Microsoft 365 Copilot and Copilot Chat.

Statement 3 is Yes because Microsoft states that admins can block Researcher and Analyst , and agent governance includes a Block action. Microsoft also notes that for Researcher and Analyst, user scoping isn’t edited through the usual panel; availability is managed by blocking the selected agent at the tenant level.

The correct answer is View all the users in the Microsoft Entra tenant . In the exhibit, John is assigned the Global Reader role. Microsoft documents that the Global Reader role is intended for users who need to view administrator features and settings in admin centers that a Global Administrator can view, but without edit permissions. That makes it appropriate for read-only visibility into tenant-wide directory and admin information, including users in Microsoft Entra.

The other answer choices are not supported by the Global Reader role. Microsoft distinguishes admin-center visibility from access to content in workloads such as SharePoint sites and Exchange mailboxes . Global Reader is a read-only administrative role, not a content access role for reading all documents or mailbox items. Likewise, performing eDiscovery of Microsoft 365 Copilot prompts requires Purview eDiscovery permissions or role group membership, not merely the Global Reader role. Microsoft documents eDiscovery permissions separately in Purview role groups.

Therefore, based on the assigned role shown, the valid completion is that John can view all the users in the Microsoft Entra tenant .

The correct answer is C. Microsoft Graph . Microsoft documents that Microsoft 365 Copilot combines large language models with content and context from the Microsoft Graph to generate grounded responses. Microsoft Graph provides access to organizational data and signals across Microsoft 365 services, including SharePoint , OneDrive , Exchange , Teams , calendars, chats, files, and other work content. When SharePoint data is relevant to the prompt and the user already has permission to access it, Copilot uses Microsoft Graph as the layer that retrieves and grounds that corporate data for the response.

The other options are incorrect for this question. Microsoft Intune is used for endpoint and device management. Microsoft Defender is used for threat protection and security operations. Microsoft Purview provides compliance, governance, data protection, and risk management capabilities. While Copilot honors Purview protections and Microsoft 365 permissions, the specific service it uses to access and ground responses in SharePoint-based corporate data is Microsoft Graph . Therefore, the correct answer is Microsoft Graph .

The correct answer is D. an app registration . Microsoft Learn states that to delegate identity and access management functions to Microsoft Entra ID , an application must be registered with a Microsoft Entra tenant . When you register an application, you create its identity configuration in Microsoft Entra, and a corresponding service principal is created so the application can authenticate and integrate with the tenant. This is the standard Microsoft mechanism for allowing a third-party cloud service or app to authenticate to Microsoft Entra.

The other options do not provide the app identity required for authentication. Multifactor authentication (MFA) strengthens user sign-ins, but it does not onboard a third-party service as an application identity in Entra. Conditional Access enforces access policies after authentication and authorization decisions are being made; it does not create the application identity itself. A Microsoft 365 Copilot connector is used to bring external data into Microsoft 365 experiences, not to let a third-party cloud service authenticate to Microsoft Entra. Therefore, the correct configuration is an app registration .

The correct answers are B and C . Microsoft documents that Identity Secure Score in Microsoft Entra is based on identity security recommendations, including recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” Those recommendations directly map to the number of global administrators and whether passwords are set to never expire , so both factors affect the score.

Option A is incorrect because SharePoint site permissions are part of SharePoint content and collaboration security, not a direct factor in the Microsoft Entra Identity Secure Score model. Option D is also incorrect because the location of users can be used in Conditional Access and other access control decisions, but Microsoft does not list user geographic location itself as a direct Identity Secure Score recommendation. Identity Secure Score is driven by Entra identity best-practice checks and recommendations rather than by SharePoint permission structure or user location data.

The correct selections are The Microsoft 365 admin center and A billing policy . Microsoft documents that Microsoft 365 Copilot pay-as-you-go is administered in the Microsoft 365 admin center , specifically under Copilot > Billing & usage , where admins create and manage billing policies . Microsoft explains that a billing policy defines the billing infrastructure for pay-as-you-go, including the Azure subscription and the set of users covered by that policy. That user scoping is what allows organizations to separate usage and spending by groups such as departments.

Microsoft also documents that billing policies support budgets , spending views , and monitoring current expenses for services linked to the policy. This supports the requirement for greater visibility into Copilot usage costs and forecasting departmental spending. By assigning different departments to different billing policies, the organization can track Copilot costs by department. The other listed features do not fit: auto-claim policy is unrelated to cost tracking, and Copilot connector is for external data grounding, not billing segmentation.

The correct setting is Restricted site access configured with Group1 . Microsoft Learn states that you can restrict access to a SharePoint site by specifying Microsoft Entra security groups or Microsoft 365 groups as the Restricted Access Control group . Microsoft also states that, after the policy is applied, a user can access the site content only if the user both already has permission to the site or content and is a member of the specified restricted access group. This exactly matches the requirement: users who currently have access to Site1 must also be members of Group1 to continue accessing the content.

The Restrict content from Microsoft 365 Copilot setting is unrelated to direct user access to the SharePoint site. That control limits whether Copilot can use site content, but it does not block users from opening the site themselves. Microsoft separately explains that Restricted SharePoint Search and Copilot restrictions are not the same as changing actual SharePoint permissions or access boundaries. So for this scenario, keep the Copilot restriction Off and configure Restricted site access with Group1 .

The correct answer is are NOT assigned a Microsoft 365 Copilot license. Microsoft’s official reporting guidance explains that the Copilot credits report is used to manage metered consumption costs for Microsoft 365 Copilot Chat. The purpose of this report is to show credit consumption tied to pay-as-you-go billing policies, including metrics such as total credits used and credits used per user, per agent, and per billing policy. Microsoft’s Copilot analytics documentation further defines these credit-related metrics around Copilot Chat users, which are users with a Microsoft 365 license but without a Microsoft 365 Copilot license who consume credits while using agents.

Because licensed Microsoft 365 Copilot users are generally covered by their Copilot entitlement for included agent usage, the credits report is intended to track the metered agent usage scenario for users who are not assigned a Microsoft 365 Copilot license and who interact with work-grounded agents in Microsoft 365 Copilot Chat. That is why this option correctly completes the sentence.

The correct answers are A and D . Microsoft documents that with group-based licensing , licenses assigned to a group are automatically inherited by the group’s members. Therefore, if User1 is added to Group1 , User1 can receive the Microsoft 365 E3 license through group membership. Microsoft also documents that licenses can be assigned directly to individual users , so assigning a Microsoft 365 E3 license straight to User1 is also a complete solution.

Options B and C are incorrect because Conditional Access controls how users access cloud resources after sign-in; it does not grant product entitlements or service licenses. Microsoft licensing guidance separates access-policy controls from actual license assignment. In this scenario, the issue is lack of license entitlement, not access conditions. As a result, the valid solutions are either to make User1 a member of the licensed group or to assign the license directly to User1. Microsoft also notes that group-based licensing assignment can fail if required user properties such as usage location are missing, but among the available answer choices, the two complete license-granting actions are Add User1 to Group1 and Assign a license to User1 .

The correct answer is eDiscovery . In Microsoft Purview, eDiscovery is the solution used to search for content and export copies of that content from Microsoft 365 locations such as SharePoint and OneDrive. Microsoft Learn states that when you export search results from eDiscovery, copies of native Office documents and other documents are exported . That directly matches the requirement to provide HR with a copy of files .

By contrast, Audit is primarily used to investigate user and admin activity records and can export those audit records to CSV , but it does not export the actual files themselves. Audit would help identify that User1 modified files, but the question asks for copies of the recent files modified by User1 , which is an eDiscovery content search and export scenario rather than an activity-log reporting scenario.

So, among the Microsoft Purview solutions shown, the appropriate selection is eDiscovery because it is the Purview tool designed to find and export the actual content items HR wants to receive.

The correct selections are No, No, Yes . Microsoft states that for Microsoft 365 Copilot , customer prompts, responses, and Microsoft Graph grounding data aren’t used to train foundation models . Microsoft also explains that Copilot processes organizational data within the service boundary and applies the same commitments that protect Microsoft 365 customer data. That makes statements 1 and 2 No . Microsoft further documents that Microsoft 365 Copilot grounds responses using Microsoft Graph and only surfaces data that the user is permitted to access , so it respects existing identity, access, and permission controls in the tenant. That makes statement 3 Yes .

This behavior is a core part of Copilot’s enterprise design. Microsoft describes Copilot as inheriting your organization’s existing Microsoft 365 permissions model, including access controls on content in SharePoint, OneDrive, Exchange, Teams, and other Microsoft 365 services. So Copilot does not grant new access; it works within the permissions already assigned to the signed-in user.

The correct answer is C. the code interpreter capability . Microsoft Learn states that the code interpreter capability for Microsoft 365 Copilot declarative agents allows the agent to generate and execute Python code to analyze data and generate visualizations . Microsoft’s agent schema documentation explicitly describes Code Interpreter as a capability used to solve complex math problems, analyze data, and generate visualizations. That directly matches the requirement to create charts and visualizations from a Microsoft Excel workbook .

Microsoft documentation also explains that code interpreter supports working with Excel files and is used for scenarios such as data analysis , statistical computations , and generating charts . This makes it the correct configuration for an agent that must reason over workbook data and produce chart-based outputs. By contrast, the image generator capability is for creating images, not for analyzing workbook data. The Scrum Assistant and Customer Insights Assistant options are templates, not the specific technical capability required to read data and build charts from an Excel workbook.

The correct answer is A. Microsoft 365 Copilot Chat. The requirement specifically asks for unlicensed users who used Copilot in Microsoft Teams. That points to Copilot Chat usage, not the standard Microsoft 365 Copilot licensed-user report. Microsoft’s usage documentation distinguishes Copilot Chat activity, including Copilot Chat work and web experiences, and lists Microsoft Teams as an entry point where users can access Copilot Chat. Microsoft also states that the Microsoft 365 Copilot usage report’s user-level table is scoped to users who were licensed for Microsoft 365 Copilot, which makes it the wrong report for identifying unlicensed Copilot Chat users. Microsoft 365 Apps and Copilot Search reports do not target this Teams Copilot Chat usage scenario.

The correct answer is B. using a custom agent that is grounded in work data . Microsoft Learn states that agents that access shared tenant data , such as SharePoint or Graph Connector content, are billed based on metered consumption . Microsoft also describes pay-as-you-go for Microsoft 365 as applying to agents in Microsoft 365 Copilot Chat , where organizations pay only for the messages used instead of assigning a full Microsoft 365 Copilot license. That is exactly the scenario described in option B: a custom agent grounded in work data.

The other options are not the intended pay-as-you-go scenario. A Teams meeting recap and Copilot in Word are standard Microsoft 365 Copilot application experiences tied to licensed Copilot functionality, not metered agent consumption. Researcher is an advanced Microsoft 365 Copilot agent available as part of Microsoft 365 Copilot capabilities, not the documented example of pay-as-you-go replacing a Copilot license. Microsoft’s pay-as-you-go guidance centers on agent-based usage , especially agents grounded in organizational work data.

The correct answer is D. the Microsoft 365 admin center . Microsoft Learn states that users with a Microsoft 365 Copilot license can use Copilot capabilities, and Microsoft specifically points administrators to the Microsoft 365 admin center and its setup guidance to assign the required licenses to users. Microsoft also documents that the Researcher and Analyst agents were deployed to existing users with Microsoft 365 Copilot licenses and that administrators govern these agents through the Microsoft 365 admin center .

The other portals are not the primary place for this task. Microsoft Entra admin center focuses on identity and access, Microsoft Purview focuses on compliance and governance, and Microsoft Defender focuses on security operations and threat protection. None of those is the main admin experience Microsoft documents for assigning Microsoft 365 Copilot access and managing the availability of Researcher and Analyst. Because the goal is to enable a user to use Microsoft 365 Copilot and its Microsoft-provided agents, the correct administrative tool is the Microsoft 365 admin center .