AB-900 Practice Questions

The Microsoft 365 Copilot agents usage report is the most appropriate tool for this requirement. This report is specifically designed to provide insights into the usage of Copilot extensions, which are functionally equivalent to agents or plugins. It allows administrators to see which agents are being used, how frequently, and by which users, enabling them to track adoption and value without needing to parse raw log data. This aligns perfectly with the admin's need for a built-in, agent-specific usage summary.

A. The general Microsoft 365 Copilot usage report focuses on overall adoption across apps like Teams and Outlook, not necessarily the detailed usage of specific custom agents.

B. The Entra ID sign-in report tracks authentication events to applications. It does not provide granular detail on which specific agent or feature was used within an application like Copilot.

D. The SharePoint site usage report is irrelevant as it tracks activity within SharePoint sites and has no connection to Copilot agent usage.

1. Microsoft 365 admin center documentation. "Microsoft Copilot for Microsoft 365 usage report". Microsoft Learn. learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/copilot-usage-report. This document describes the usage report

which includes metrics on "Copilot plugin usage" allowing admins to "understand which plugins are being used in your organization."

The correct method for a Microsoft 365 administrator to centrally manage the availability of specific built-in Copilot agents (also referred to as plugins or apps) is through the "Integrated Apps" section of the Microsoft 365 admin center. This portal allows administrators to deploy, block, or assign specific apps to users or groups, providing granular control over which Copilot capabilities are visible and accessible to the organization.

A. Force Copilot chat history to sync for all users: This action relates to data retention and user experience continuity; it has no effect on which agents are available in the Copilot app.

C. Turn off all Copilot features per user only from Windows: This is incorrect because the goal is to block a specific agent, not all features. Furthermore, central management is done from the Microsoft 365 admin center, not on a per-user basis from the Windows OS.

D. Hide the Copilot icon across all Office apps and web portals: This is a broad, all-or-nothing action that would disable the entire Copilot experience, which contradicts the requirement to keep Copilot Chat and other agents available.

1. Microsoft Learn. (2024). Manage Copilot plugins in Integrated apps. Microsoft 365 admin center documentation. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-copilot-plugins. This document explicitly states: "You can manage Copilot plugins in the same way you manage any other app in the Microsoft 365 admin center... In the Microsoft 365 admin center

go to Settings > Integrated apps."

2. Microsoft Learn. (2024). Manage Copilot for Microsoft 365. Microsoft 365 Copilot documentation. Retrieved from https://learn.microsoft.com/en-us/microsoft-365-copilot/manage-copilot. This overview page directs administrators to the Integrated Apps section for managing plugins and connectors

confirming it as the central control plane for this task.

Content search is the ideal tool for this scenario. It is designed for running broad, ad-hoc searches across multiple Microsoft 365 services, including Exchange Online mailboxes, SharePoint Online sites, and OneDrive for Business accounts, from a single interface. The compliance officer can define search criteria, preview the results to validate them, and then export the matching items for external review. This meets all requirements without the unnecessary overhead of case management or legal holds found in eDiscovery tools.

A. Run separate searches in each mailbox and site: This approach is highly inefficient, not scalable, and prone to error, as it requires manual searching in disparate locations.

C. Create an eDiscovery (Premium) case and build review sets: This is excessive for the stated need. eDiscovery tools are for formal legal cases and include features like legal hold and case management, which were explicitly not required.

D. Export audit logs from Microsoft 365 and filter them o[line: Audit logs track user and admin activities (e.g., file viewed, email sent), not the actual content of the files or messages.

1. Microsoft. (2024). Content search in Microsoft Purview. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/content-search. (The introductory paragraph states

"Use the Content search tool...to search for content such as email

documents

and instant messaging conversations in your organization.").

2. Microsoft. (2024). Get started with Content search. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/purview/get-started-with-content-search. (See the "What can you search for?" section

which lists Exchange mailboxes

SharePoint sites

and OneDrive accounts as searchable locations).

Copilot Studio is an integral part of the Microsoft Power Platform. Therefore, its governance is managed through the Power Platform admin center. This centralized console is used to create and manage environments, apply data loss prevention (DLP) policies that control which connectors agents can use, and monitor usage and performance analytics for the agents (formerly bots). These functions are fundamental to securely managing and scaling agents within an organization.

B. Microsoft 365 license management, including for Copilot, is handled in the Microsoft 365 admin center, not the Power Platform admin center.

C. Channel configuration (e.g., Teams, web chat) for an individual agent is managed within the Copilot Studio authoring canvas, not centrally in the admin center.

D. User identity tasks, such as resetting multi-factor authentication, are managed in the Microsoft Entra admin center (formerly Azure AD).

1. Microsoft Learn. (2024). Microsoft Copilot Studio security and governance. "Microsoft Copilot Studio governance is managed through the Power Platform admin center... Key admin tools to govern Copilot Studio include: Environments

Data loss prevention policies

Connectors

[and] Monitoring and reporting." Section: Governance.

2. Microsoft Learn. (2024). Power Platform environments. "Environments are containers for apps

flows

connections

and other assets in Power Platform... You can create and manage environments in the Power Platform admin center." Section: Environments overview.

Microsoft Purview Data Loss Prevention (DLP) policies inspect Copilot Chat and agent traffic in Microsoft 365. Built-in sensitive-information types (e.g., credit-card numbers) trigger actions that block or warn when users attempt to send such data to external destinations, preventing accidental exfiltration while still allowing internal use.

A. Mail-flow rules act only on Exchange email; they don’t monitor Copilot chats or agents.

C. Retention labels manage lifecycle/records, not real-time data transfer control.

D. Spam-filtering policies target malware and junk mail, not sensitive-data leakage.

1. Microsoft Learn – “Data loss prevention (DLP) for Microsoft 365 Copilot” §“Prevent oversharing”

2024.

2. Microsoft Learn – “Overview of data loss prevention” §“Locations protected by DLP”

2024.

A retention policy in Exchange Online, as part of Microsoft Purview Data Lifecycle Management, defines the rules for how long email messages and other content are kept (retained) and what happens to them after that period expires. Administrators can configure policies to retain content for a specific duration to meet compliance or business requirements, and then either automatically delete it, archive it, or do nothing. This ensures that data is managed throughout its lifecycle, balancing business value with risk mitigation.

A. Deletes all emails immediately upon receipt: This is incorrect. Retention policies specify a duration for keeping items, not immediate deletion.

C. Blocks all incoming mail from external domains: This is the function of mail flow rules (transport rules) or anti-spam policies, not retention policies.

D. Forwards every message to an external archive system: This functionality is typically handled by journaling rules or mail flow rules, not retention policies.

1. Microsoft Learn. (2024). Learn about retention policies & retention labels. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/purview/retention. See the "What are retention policies and retention labels?" section

which states

"Use retention policies and retention labels to manage the data for your organization."

2. Microsoft Learn. (2024). Retention policy and retention label actions. Microsoft Docs. Retrieved from https://learn.microsoft.com/en-us/purview/retention-actions. See the section "Comparing what retention policies and retention labels can do

" which details actions like "Retain content" and "Delete content."

Microsoft Entra Privileged Identity Management (PIM) is designed specifically to address the risks of standing administrative access. It enforces just-in-time (JIT) access, requiring users to request and justify elevation into a privileged role. Access is time-bound, automatically revoking permissions after a configured duration. PIM also provides a comprehensive audit trail of all activation requests, approvals, and activities performed while elevated, directly meeting all of the stated requirements from leadership to mitigate the identified security risks.

A. Microsoft Entra Conditional Access enforces access policies at sign-in but does not manage just-in-time role elevation or time-bound assignments.

C. Administrative units are used to delegate and scope administrative permissions to specific subsets of an organization, not to manage the activation of those permissions.

D. Privileged access groups are a feature within PIM. Implementing PIM itself is the comprehensive solution, not just one of its components.

1. Microsoft Learn. (2024). What is Microsoft Entra Privileged Identity Management?. "What does it do?" section. This document states that PIM provides "just-in-time privileged access

" "time-bound access

" and requires "approval to activate privileged roles."

2. Microsoft Learn. (2024). Deploy Microsoft Entra Privileged Identity Management (PIM). "Plan the deployment" section. This guide positions PIM as the primary tool to "manage

control

and monitor access to important resources

" directly addressing the scenario's need to move away from permanent admin assignments.

The Copilot Control System lets admins approve each Copilot Studio agent and restrict its availability to specific Azure AD security groups. Approving the HR agent and scoping it to the HR security group ensures only HR staff see it in Microsoft 365 Copilot Chat and prevents tenant-wide rollout.

A. Licenses alone don’t limit visibility; without scoping, the agent is discoverable to everyone.

B. Sharing with Everyone overrides the requested restriction and exposes the agent tenant-wide.

D. Disabling every other agent is administrative overkill and does not guarantee future isolation.

1. Microsoft Learn

“Manage access to copilots with the Copilot Control System”

section “Approve or deny a copilot”

steps 4-6 (2024-03-04).

2. Microsoft Learn

“Copilot Studio governance”

section “Security group scoping” (2024-02-20).

The most fundamental prerequisite for a user to access Microsoft 365 Copilot features is having a valid "Microsoft 365 Copilot" license assigned to their account. Without this license, Copilot will not be enabled or appear in any of the Microsoft 365 Apps, regardless of other settings. Therefore, checking the user's license assignment in the Microsoft 365 admin center is the logical and most important first step in troubleshooting this issue.

A. Whether the employee’s Office apps are updated to the latest build: While necessary, this is a secondary check. Updated apps are irrelevant if the user is not licensed for the feature.

B. Whether the employee has local admin rights on their device: Local administrator rights are not a requirement for using Copilot within Microsoft 365 applications.

D. Whether the employee’s mailbox is using an Exchange Online Plan 2 SKU: A user needs a base Microsoft 365 license (like E3/E5), but the primary missing component for Copilot is the specific Copilot add-on license.

1. Microsoft Learn. (2024). Microsoft 365 Copilot requirements. The document lists "Microsoft 365 Copilot license" as a key requirement. It states

"A Microsoft 365 Copilot license must be assigned to each user."

2. Microsoft Learn. (2024). Get started with Microsoft Copilot for Microsoft 365. Step 1: "Buy and assign licenses". This is presented as the first action an administrator must take to enable Copilot for users.

This option perfectly encapsulates the three core principles of the Microsoft Zero Trust security model. "Verify explicitly" means always authenticating and authorizing based on all available data points. "Use least privilege access" ensures users have only the access they need, just-in-time and just-enough. "Assume breach" means minimizing the blast radius for breaches and segmenting access. This modern approach moves away from the outdated idea that internal network traffic can be implicitly trusted, which is the core problem described in the scenario.

A. Trusting any device on the VPN is the opposite of the "verify explicitly" principle of Zero Trust.

B. Relying on perimeter firewalls and implicit trust is the definition of the legacy security model that Zero Trust replaces.

C. Granting broad access for an entire session directly violates the "use least privilege access" principle.

1. Microsoft Learn. (2024). What is Zero Trust?. "Guiding principles of Zero Trust" section. This document explicitly lists the three principles as: 1. Verify explicitly

2. Use least privileged access

and 3. Assume breach.

2. Microsoft Zero Trust. (n.d.). The Microsoft Zero Trust security model. This resource provides a comprehensive overview

stating

"Instead of believing everything behind the corporate firewall is safe

the Zero Trust model assumes breach and verifies each request as though it originates from an uncontrolled network."