My AB-900 Exam Review: Lab Blueprint, Public-Objective Concepts, and Study Notes

1. Study log: the last pass before exam day

This is the last AB-900 entry in the study journey. It pulls the four lab entries into one pre-exam cheat sheet that covers all three official domains, and it adds a small PowerShell script that turns the official skills list into a printable checklist ranked by your weakest objectives.

This entry doesn’t report an exam result, and nothing in it comes from exam content. Every concept below maps to a public objective in the study guide and a Microsoft Learn page I read for this article. I didn’t connect to a tenant for this entry. The script ran locally against the live study guide and synthetic self-ratings (section 4).

Blueprint version: the study guide lists skills measured as of October 14, 2026, and the credential page shows a last update of 10/14/2026.[1][2] That version is in effect now, so this article targets it. The change log lists one minor change from the prior version, in “Identify the core security features of Microsoft 365 services”.[1] If your exam was before October 14, 2026, you sat the prior version.

The three domains and their weights in the October 14 version:[1]

Domain	Weight	Objectives listed
Identify the core features and objects of Microsoft 365 services	30–35%	20
Understand data protection and governance tasks for Microsoft 365 and Copilot	35–40%	19
Perform basic administrative tasks for Copilot and agents	25–30%	14

The objective counts come from the script in section 4, run against the study guide on October 17, 2026.

Default approach	AI-hardened approach
Study from an outline you saved weeks ago.	Re-open the study guide and check the “Skills measured as of” date before you book.[1]
Spend most of your time on agents because the exam title says agents.	Data protection and governance carries the largest weight, 35–40%. Agents and Copilot admin carry 25–30%.[1]
Read your score report as a percentage.	The score is scaled from 1 to 1,000, and 700 passes. Microsoft says a 700 may not equal 70% of the points.[3]
Learn only GA features.	Most questions cover GA features, but the guide says the exam may include commonly used Preview features.[1]
Plan to renew it next year.	Fundamentals certifications don’t expire.[5]

2. Exam facts and the lab blueprint so far

These facts come from Microsoft Learn as of October 17, 2026.

Item	What Microsoft says
Credential	Microsoft 365 Certified: Copilot and Agent Administration Fundamentals, level Beginner, role Administrator[2]
Time	45 minutes, proctored, may include interactive components[2]
Passing score	700 or greater on a 1 to 1,000 scaled score[1][3]
Retakes	Wait 24 hours after a first failed attempt, then 14 days between later attempts, with no more than five attempts in 12 months[4]
Renewal	Fundamentals certifications don’t expire[5]
Price	Based on the country or region where the exam is proctored[2]
Languages	English plus 12 other languages listed on the credential page[2]
Practice	A practice assessment and an exam sandbox are linked from the credential page[2]

The credential page also recommends registering with a personal Microsoft account (MSA). If you register with a work or school account and leave that organization, Microsoft says your exam records “will be lost” and “will be unrecoverable”.[2] I’d book with a personal account.

The lab entries so far, mapped to the domain each one covers most:

Entry	Main domain	What it covers
Day 1: Conditional Access lab blueprint	Core features and objects	Conditional Access, MFA and sign-in controls in front of Copilot
Copilot oversharing PowerShell report	Data protection and governance	”Everyone except external users” exposure in SharePoint
Purview DSPM for AI lab	Data protection and governance	Sensitivity labels, Restricted Content Discovery and DSPM for AI
Agent lifecycle and approvals	Copilot and agents	Agent approvals, user access, admin roles and Power Platform controls

If you want the case for taking AB-900 at all, start with the AB-900 certification review.

3. Build your cheat sheet

Microsoft Learn has a learning path, “Explore Microsoft 365 Copilot and agent administration”, with three modules whose titles track the Copilot and agents domain.[21] Work through it first, then use these steps to find what you still don’t know.

Save the script from section 4 as New-AB900CheatSheet.ps1. It needs PowerShell 7.2 or later.
Create a template from the live study guide:
```
./New-AB900CheatSheet.ps1 -NewTemplate -TemplatePath ./ab900-ratings.json
```
The script downloads the study guide as Markdown and writes every objective under the “Skills measured as of” heading with a confidence of 0. If Microsoft changes the page layout, the parser stops with an error instead of writing a partial file.
Open ab900-ratings.json and set each confidence to 1 (weak), 2 (partial) or 3 (solid). Use note for the doc you still need to read. Be harsh here. A 2 you can’t explain out loud is a 1.

Preview the output, then render it:

./New-AB900CheatSheet.ps1 -InputPath ./ab900-ratings.json -WhatIf
./New-AB900CheatSheet.ps1 -InputPath ./ab900-ratings.json

Validation rejects any objective still at 0, so a half-rated file fails here.

Open ab900-cheatsheet/cheat-sheet.html in a browser and print it. Each domain is a table sorted weak first. priority.csv ranks the same rows across all domains. Priority is the domain’s top weight multiplied by (4 minus confidence), so a weak objective in the 35–40% domain lands near the top.
Study the top of priority.csv, update your ratings, and re-run step 4 with -Force. Without -Force the script won’t overwrite output that came from a different input.

4. Engineering deliverable: printable AB-900 cheat sheet generator

The script has three modes. -NewTemplate reads the study guide and writes a ratings template. -InputPath validates your ratings and writes cheat-sheet.html, priority.csv, manifest.json and an audit.log. -Rollback removes only the files it wrote whose SHA-256 hash still matches the manifest. It never connects to a Microsoft 365 tenant.

What I tested, on Linux with PowerShell 7.4.6: -NewTemplate against the live study guide on October 17, 2026 parsed 53 objectives across three domains with the 30–35%, 35–40% and 25–30% weights, and -NewTemplate -WhatIf wrote nothing. I filled the template with synthetic ratings, not my own. -WhatIf on render created no folder. A normal run wrote all four files, and a second identical run reported no changes. Changed input without -Force stopped with an error, and with -Force it rebuilt. A file with four domains, a bad weight and a confidence of 5 failed validation and wrote nothing. -Rollback removed the HTML and the manifest but skipped priority.csv after I edited it, and logged the hash mismatch. A note containing <b> came out HTML-encoded. PSScriptAnalyzer reported only PSReviewUnusedParameter for the two switches that select a parameter set.

#Requires -Version 7.2
<#
.SYNOPSIS
  Builds a printable AB-900 pre-exam cheat sheet from the official skills list and your own confidence ratings.
.DESCRIPTION
  -NewTemplate downloads the AB-900 study guide from Microsoft Learn as Markdown and writes a JSON template
  with every objective listed under "Skills measured as of ...", each rated 0 (not rated yet).
  -InputPath validates a rated JSON file and writes cheat-sheet.html, priority.csv, a manifest and an audit log.
  -Rollback removes only the files this script wrote whose SHA-256 hash still matches the manifest.
  Nothing here connects to a Microsoft 365 tenant.
#>
[CmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Render')]
param(
    [Parameter(Mandatory, ParameterSetName = 'Template')]
    [switch] $NewTemplate,

    [Parameter(Mandatory, ParameterSetName = 'Template')]
    [string] $TemplatePath,

    [Parameter(Mandatory, ParameterSetName = 'Render')]
    [ValidateScript({ Test-Path -LiteralPath $_ -PathType Leaf })]
    [string] $InputPath,

    [Parameter(ParameterSetName = 'Render')]
    [Parameter(ParameterSetName = 'Rollback')]
    [string] $OutputDirectory = './ab900-cheatsheet',

    [Parameter(ParameterSetName = 'Render')]
    [switch] $Force,

    [Parameter(Mandatory, ParameterSetName = 'Rollback')]
    [switch] $Rollback
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
$StudyGuideUrl = 'https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/ab-900?accept=text/markdown'

function Write-Audit {
    param([string] $Action, [string] $Target, [string] $Detail = '')
    if ($WhatIfPreference) { return }
    $logPath = Join-Path $OutputDirectory 'audit.log'
    if (-not (Test-Path -LiteralPath $OutputDirectory)) { New-Item -ItemType Directory -Path $OutputDirectory | Out-Null }
    [ordered]@{ utc = [DateTime]::UtcNow.ToString('o'); action = $Action; target = $Target; detail = $Detail } |
        ConvertTo-Json -Compress | Add-Content -LiteralPath $logPath -Encoding utf8
}

function Get-Sha256 { param([string] $Path) (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash }

function ConvertFrom-StudyGuide {
    param([string] $Markdown)
    $m = [regex]::Match($Markdown, '(?m)^## Skills measured as of (?<date>[A-Za-z]+ \d{1,2}, \d{4})\s*$')
    if (-not $m.Success) { throw 'No "Skills measured as of" heading found. The study guide format may have changed.' }
    $asOf = [datetime]::ParseExact($m.Groups['date'].Value, 'MMMM d, yyyy', [cultureinfo]::InvariantCulture)
    $body = $Markdown.Substring($m.Index + $m.Length)
    $end = $body.IndexOf("`n## ")
    if ($end -ge 0) { $body = $body.Substring(0, $end) }
    $domains = [System.Collections.Generic.List[object]]::new()
    $domain = $null; $skill = $null
    foreach ($line in $body -split "`r?`n") {
        if ($line -match '^### (?<name>.+) \((?<min>\d+)[\u2013-](?<max>\d+)%\)\s*$') {
            $domain = [ordered]@{ name = $Matches.name; weightMin = [int]$Matches.min; weightMax = [int]$Matches.max; skills = [System.Collections.Generic.List[object]]::new() }
            $domains.Add($domain); $skill = $null
        } elseif ($domain -and $line -match '^#### (?<name>.+?)\s*$') {
            $skill = [ordered]@{ name = $Matches.name; objectives = [System.Collections.Generic.List[object]]::new() }
            $domain.skills.Add($skill)
        } elseif ($skill -and $line -match '^- (?<text>.+?)\s*$') {
            $skill.objectives.Add([ordered]@{ text = $Matches.text; confidence = 0; note = '' })
        }
    }
    [ordered]@{ exam = 'AB-900'; blueprintAsOf = $asOf.ToString('yyyy-MM-dd'); source = $StudyGuideUrl; domains = $domains }
}

function Test-CheatSheetInput {
    param($Data)
    $errors = [System.Collections.Generic.List[string]]::new()
    if ($Data.exam -ne 'AB-900') { $errors.Add("exam must be 'AB-900'.") }
    $parsedDate = [datetime]::MinValue
    if (-not [datetime]::TryParseExact([string]$Data.blueprintAsOf, 'yyyy-MM-dd', [cultureinfo]::InvariantCulture, 'None', [ref]$parsedDate)) {
        $errors.Add('blueprintAsOf must be a yyyy-MM-dd date.')
    }
    $domains = @($Data.domains)
    if ($domains.Count -ne 3) { $errors.Add("Expected 3 domains, found $($domains.Count).") }
    $sumMin = 0; $sumMax = 0
    foreach ($d in $domains) {
        if ($d.weightMin -isnot [long] -or $d.weightMax -isnot [long] -or $d.weightMin -lt 0 -or $d.weightMax -gt 100 -or $d.weightMin -gt $d.weightMax) {
            $errors.Add("Domain '$($d.name)' has invalid weights."); continue
        }
        $sumMin += $d.weightMin; $sumMax += $d.weightMax
        foreach ($s in @($d.skills)) {
            foreach ($o in @($s.objectives)) {
                if ([string]::IsNullOrWhiteSpace($o.text)) { $errors.Add("Empty objective under '$($s.name)'.") }
                if ($o.confidence -isnot [long] -or $o.confidence -lt 1 -or $o.confidence -gt 3) {
                    $errors.Add("Rate '$($o.text)' 1 (weak), 2 (partial) or 3 (solid).")
                }
            }
        }
    }
    if ($domains.Count -eq 3 -and ($sumMin -gt 100 -or $sumMax -lt 100)) { $errors.Add("Domain weight ranges ($sumMin-$sumMax%) can't add up to 100%.") }
    if ($errors.Count) { throw ("Input validation failed:`n - " + ($errors -join "`n - ")) }
}

# --- Template mode ---------------------------------------------------------
if ($PSCmdlet.ParameterSetName -eq 'Template') {
    if (Test-Path -LiteralPath $TemplatePath) { throw "$TemplatePath already exists. Pick a new path so your ratings aren't overwritten." }
    $md = (Invoke-WebRequest -Uri $StudyGuideUrl -UseBasicParsing).Content
    $template = ConvertFrom-StudyGuide -Markdown $md
    $count = ($template.domains.skills.objectives | Measure-Object).Count
    if ($PSCmdlet.ShouldProcess($TemplatePath, "Write template with $count objectives (skills measured as of $($template.blueprintAsOf))")) {
        $template | ConvertTo-Json -Depth 6 | Set-Content -LiteralPath $TemplatePath -Encoding utf8
        Write-Output "Wrote $count objectives to $TemplatePath. Set each confidence to 1, 2 or 3, then run -InputPath."
    }
    return
}

$manifestPath = Join-Path $OutputDirectory 'manifest.json'

# --- Rollback mode ---------------------------------------------------------
if ($PSCmdlet.ParameterSetName -eq 'Rollback') {
    if (-not (Test-Path -LiteralPath $manifestPath)) { Write-Output 'No manifest found. Nothing to roll back.'; return }
    $manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
    foreach ($f in $manifest.files) {
        $p = Join-Path $OutputDirectory $f.name
        if (-not (Test-Path -LiteralPath $p)) { continue }
        if ((Get-Sha256 -Path $p) -ne $f.sha256) { Write-Warning "Skipping $($f.name): it changed after this script wrote it."; Write-Audit -Action 'rollback-skip' -Target $f.name -Detail 'hash mismatch'; continue }
        if ($PSCmdlet.ShouldProcess($p, 'Remove generated file')) { Remove-Item -LiteralPath $p; Write-Audit -Action 'remove' -Target $f.name }
    }
    if ($PSCmdlet.ShouldProcess($manifestPath, 'Remove manifest')) { Remove-Item -LiteralPath $manifestPath; Write-Audit -Action 'remove' -Target 'manifest.json' }
    return
}

# --- Render mode -----------------------------------------------------------
$raw = Get-Content -LiteralPath $InputPath -Raw
$data = $raw | ConvertFrom-Json
Test-CheatSheetInput -Data $data
$inputHash = [Convert]::ToHexString([System.Security.Cryptography.SHA256]::HashData([Text.Encoding]::UTF8.GetBytes($raw)))

if (Test-Path -LiteralPath $manifestPath) {
    $old = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
    $intact = @($old.files | Where-Object { -not (Test-Path -LiteralPath (Join-Path $OutputDirectory $_.name)) -or (Get-Sha256 -Path (Join-Path $OutputDirectory $_.name)) -ne $_.sha256 }).Count -eq 0
    if ($old.inputSha256 -eq $inputHash -and $intact) { Write-Output 'Output is already current. No changes.'; return }
    if (-not $Force) { throw 'Existing output came from different input or was edited. Use -Force to rebuild, or -Rollback first.' }
}

$rows = foreach ($d in $data.domains) {
    foreach ($s in $d.skills) {
        foreach ($o in $s.objectives) {
            [pscustomobject]@{
                Priority   = $d.weightMax * (4 - $o.confidence)
                Domain     = $d.name
                Weight     = "$($d.weightMin)-$($d.weightMax)%"
                Skill      = $s.name
                Objective  = $o.text
                Confidence = @('', 'weak', 'partial', 'solid')[$o.confidence]
                Note       = $o.note
            }
        }
    }
}
$rows = $rows | Sort-Object -Property @{ Expression = 'Priority'; Descending = $true }, Domain, Skill, Objective

$enc = { param($t) [System.Net.WebUtility]::HtmlEncode([string]$t) }
$sb = [System.Text.StringBuilder]::new()
[void]$sb.AppendLine('<!doctype html><html lang="en"><head><meta charset="utf-8"><title>AB-900 pre-exam cheat sheet</title>')
[void]$sb.AppendLine('<style>body{font:11pt/1.35 system-ui,sans-serif;margin:1.5cm}h1{font-size:16pt}h2{font-size:12pt;margin-top:1em;break-after:avoid}table{border-collapse:collapse;width:100%}td,th{border:1px solid #999;padding:3px 5px;vertical-align:top;text-align:left}tr{break-inside:avoid}.weak{font-weight:700}@media print{a{color:inherit}}</style></head><body>')
[void]$sb.AppendLine("<h1>AB-900 pre-exam cheat sheet</h1><p>Skills measured as of $(& $enc $data.blueprintAsOf). Generated $([DateTime]::UtcNow.ToString('yyyy-MM-dd')) UTC from your own ratings. Weak items first within each domain.</p>")
foreach ($d in $data.domains) {
    [void]$sb.AppendLine("<h2>$(& $enc $d.name) ($($d.weightMin)-$($d.weightMax)%)</h2><table><tr><th>Skill</th><th>Objective</th><th>You</th><th>Note</th></tr>")
    foreach ($r in $rows | Where-Object Domain -eq $d.name) {
        [void]$sb.AppendLine("<tr class=""$($r.Confidence)""><td>$(& $enc $r.Skill)</td><td>$(& $enc $r.Objective)</td><td>$($r.Confidence)</td><td>$(& $enc $r.Note)</td></tr>")
    }
    [void]$sb.AppendLine('</table>')
}
[void]$sb.AppendLine('</body></html>')

if ($PSCmdlet.ShouldProcess($OutputDirectory, "Write cheat-sheet.html and priority.csv for $(@($rows).Count) objectives")) {
    if (-not (Test-Path -LiteralPath $OutputDirectory)) { New-Item -ItemType Directory -Path $OutputDirectory | Out-Null }
    $html = Join-Path $OutputDirectory 'cheat-sheet.html'
    $csv = Join-Path $OutputDirectory 'priority.csv'
    Set-Content -LiteralPath $html -Value $sb.ToString() -Encoding utf8
    $rows | Export-Csv -LiteralPath $csv -NoTypeInformation -Encoding utf8
    [ordered]@{
        inputSha256 = $inputHash
        files       = @(foreach ($p in $html, $csv) { [ordered]@{ name = Split-Path $p -Leaf; sha256 = Get-Sha256 -Path $p } })
    } | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath $manifestPath -Encoding utf8
    Write-Audit -Action 'write' -Target 'cheat-sheet.html,priority.csv,manifest.json' -Detail "objectives=$(@($rows).Count)"
    $weak = @($rows | Where-Object Confidence -eq 'weak').Count
    Write-Output "Wrote $(@($rows).Count) objectives ($weak rated weak) to $OutputDirectory."
}

Design notes:

Input validation: exactly three domains, integer weights between 0 and 100, weight ranges that can add up to 100%, no empty objective, and every confidence 1, 2 or 3. All errors print together so you fix the file once.
Idempotency: the manifest stores the SHA-256 of the input file and of each output. Same input and untouched output means no write.
Audit log: render and rollback runs append JSON lines with UTC timestamps for each write, removal and skipped removal. -WhatIf runs log nothing. Template mode refuses to overwrite an existing ratings file.
Rollback: it deletes only files whose hash still matches, so a cheat sheet you annotated and saved over stays put.
The template parser depends on the study guide’s current Markdown headings. If Microsoft changes them, the script throws instead of guessing.

5. Public-objective concepts to retain

These are my one-page notes per domain, each tied to the October 14, 2026 skills list.[1] They’re study notes from Microsoft Learn, not exam questions.

Identify the core features and objects of Microsoft 365 services (30–35%)

Zero Trust has three principles: verify explicitly, use least privilege access, and assume breach. Least privilege means “only the access they need, for the shortest time required”.[6]
Privileged Identity Management (PIM) gives just-in-time privileged access, time-bound assignments with start and end dates, and approval to activate privileged roles. PIM requires licenses, so don’t assume every tenant has it.[7]
Identity Secure Score is a percentage that shows how closely you match Microsoft’s security recommendations. Microsoft recalculates it every 24 hours. It’s available to free and paid customers, but some recommendations need a paid license to view and act on.[8]
Conditional Access, MFA and sign-in troubleshooting are covered hands-on in the Day 1 lab.

Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)

Copilot grounds the prompt with Microsoft Graph in the user’s tenant before it goes to the LLM. Data access “is always scoped to the signed-in user’s permissions”.[9]
Copilot “only surfaces organizational data to which individual users have at least view permissions”. Microsoft’s advice is to use the permission models in services such as SharePoint so the right people have the right access.[10]
When content is encrypted by Microsoft Purview Information Protection, through sensitivity labels or IRM, Copilot honors the usage rights granted to the user.[10]
Restricted site access control limits a SharePoint site to members of a control group. Users outside the group can’t open the site or its files, even with prior permissions or a sharing link, and Copilot and organization-wide search honor the policy.[11]
Data access governance reports in the SharePoint admin center include snapshot reports for site permissions and sensitivity labels on files, plus activity reports for sharing links and content shared with “Everyone except external users”.[12] The oversharing report entry covers the PowerShell side.
Microsoft’s six responsible AI principles: fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability.[13]
DSPM for AI and sensitivity labels are covered in the Purview DSPM for AI lab.

Perform basic administrative tasks for Copilot and agents (25–30%)

Pay-as-you-go applies to Microsoft Copilot Chat, SharePoint agents and the Microsoft Copilot Retrieval API (Preview). Copilot Studio has its own pay-as-you-go billing.[14]
Pay-as-you-go setup takes two steps: add a billing policy, then connect it to a Copilot service. A billing policy alone doesn’t complete setup. You can add a budget with email notifications at percentage milestones.[14]
Global administrator, Billing administrator and AI administrator can manage pay-as-you-go. Global reader is read-only.[14]
Researcher handles complex, multi-step research and writes a cited report from web and work content the user can access.[15] Analyst focuses on structured data such as tables, spreadsheets and dashboards, with Excel and Power BI as the examples in Microsoft’s training.[16]
Researcher and Analyst are part of the core Copilot Chat experience and don’t fall under agent-related settings.[17] The admin page lists them under Tools in Copilot Chat, while the Researcher page says to look under Agents.[15][17] Memorize the governance rule. The menu label may move.
The Microsoft Copilot usage report in the Microsoft 365 admin center covers 7, 28, 90 or 180 days. Data for a given day typically shows up within 48 hours. Enabled Users counts licensed users, and Active Users counts enabled users who tried a user-initiated Copilot feature.[18]
Prompt Gallery holds Microsoft prompts under Suggested, saved prompts under Your Prompts, and team prompts under Teams.[19]
Scheduled prompts depend on connected experiences. To turn the feature off, set Allow the use of connected experiences in Office to Disabled in Cloud Policy, which also turns off other connected experiences. Inventorying scheduled prompts with Microsoft’s PowerShell script needs the Power Platform Administrator role.[20]
Agent access, approvals and lifecycle monitoring are in the agent lifecycle entry.

My recommendation: if you have limited time, spend it on the data protection domain first. It carries the most weight, and many of its objectives depend on one fact: Copilot shows only data the user already has permission to see.[1][10]

6. Next step in the study journey

AB-900 is the fundamentals layer. The series moves next to AB-100 and the architect tier, starting with an AB-100 study blueprint built from its official skills list. Before then, generate your template, rate every objective honestly, and print the cheat sheet the week of your exam.

Sources

My AB-900 Exam Review: Lab Blueprint, Public-Objective Concepts, and Study Notes

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes