AB-900 Study Cram - Microsoft 365 Certified: Copilot and Agent Administration Fundamentals

Key Concepts

• Zero Trust: A security framework that assumes no implicit trust, requiring explicit verification for every access request.
• Authentication: The process of verifying a user's identity.
• Authorization: The process of determining what an authenticated user is allowed to do.
• Conditional Access: A feature in Microsoft Entra ID that enforces access policies based on various signals.
• Least Privilege: The principle of granting only the minimum permissions necessary for a user or system to perform its task.
• Just-In-Time (JIT) Access: Granting elevated permissions only when needed and for a limited duration.
• Role-Based Access Control (RBAC): Assigning permissions to roles rather than individual users.
• Assume Breach: A security posture that assumes a breach has already occurred and focuses on detection and response.
• Microsoft Sentinel: A cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution.
• Microsoft Defender XDR: An integrated suite of security solutions for extended detection and response.
• Microsoft Entra ID: Microsoft's cloud-based identity and access management service.
• Hybrid Identity: An identity that exists in both on-premises Active Directory and Microsoft Entra ID.
• Cloud-Only Identity: An identity created directly in Microsoft Entra ID.
• Password Hash Sync (PHS): Synchronizing a hash of the on-premises password hash to Entra ID for authentication.
• Pass-through Authentication (PTA): Authenticating directly against on-premises domain controllers for Entra ID sign-ins.
• Federation: Redirecting authentication requests to an on-premises identity provider.
• Self-Service Password Reset (SSPR): Allowing users to reset their own passwords.
• Verified ID: A decentralized digital identity that can be used for high-assurance authentication.
• Single Sign-On (SSO): Allowing users to authenticate once and access multiple applications without re-authentication.
• Microsoft Graph: A unified API endpoint for accessing data across Microsoft 365 services.
• Copilots: AI-powered assistants that work with users in the context of their tasks.
• AI-Powered Agents: Autonomous or semi-autonomous AI entities that can automate tasks and processes.
• Copilot Studio: A platform for building custom AI agents and copilots with low-code/no-code capabilities.
• Retrieval Augmented Generation (RAG): A technique that enhances LLMs by providing them with relevant external data.
• Semantic Index: A specialized index that understands natural language queries and maps them to relevant data.
• Responsible AI: Principles guiding the ethical and safe development and deployment of AI.
• Microsoft Purview: A suite of solutions for data governance, risk management, and compliance.
• Information Protection: Classifying and protecting sensitive data using labels.
• Data Loss Prevention (DLP): Policies to prevent sensitive data from being leaked.
• Data Lifecycle Management: Managing data retention and deletion policies.
• Insider Risk Management: Detecting and responding to malicious or accidental data misuse by insiders.
• Communication Compliance: Monitoring communications for regulatory and policy violations.
• DSPM for AI: Data Security Posture Management for AI, assessing and enforcing policies on AI data usage.
• Compliance Manager: A tool to assess and improve compliance with regulations.
• Data Explorer: A tool to discover and locate sensitive data.
• Content Search & eDiscovery: Tools for locating, reviewing, and preserving information for legal or audit purposes.

Introduction to Microsoft 365 and AI Administration (AB900 Study Cram)

This study cram focuses on the AB900 fundamentals exam, emphasizing understanding capabilities and their associated Microsoft products rather than in-depth technical execution. The exam format is multiple-choice and true/false, with no labs or complex case studies. Key preparation resources include the official exam page, study guide, exam sandbox, and Microsoft Learn courses.

1. Zero Trust Security Model

Zero Trust is a fundamental security concept, not a single product, but a set of processes and configurations. It acknowledges the shift from traditional network perimeters to a distributed environment with cloud services and remote work. The core principles are:

• Verify Explicitly: Every request from a user, device, or application must be authenticated and authorized, using multiple signals.

  • Authentication: Proving identity. Methods include:
    • Multi-Factor Authentication (MFA): Using two or more factors (something you know, have, or are). Examples: password + authenticator app code, password + SMS code.
    • Passwordless Authentication: Preferred methods like:
      • Passkeys: Considered phishing-resistant, requiring proximity (Bluetooth/NFC) and device unlock (PIN/biometric). They are tied to specific domains.
      • Windows Hello for Business: Biometric or PIN-based authentication.
      • Certificate-Based Authentication: Using digital certificates.
  • Authorization: Determining what an authenticated user can do.
    • Conditional Access (Microsoft Entra ID): Policies that evaluate risk signals (user risk, sign-in risk from Identity Protection), authentication strength, device compliance (Intune, Defender for Endpoint), location, and client app to grant or block access. Policies can enforce MFA, require compliant devices, or restrict session activities.

• Least Privilege: Granting only the necessary permissions for a task.

  • Just Enough Administration (JEA): Providing only the permissions required for a specific job.
  • Just-In-Time (JIT) Access: Elevated permissions are granted only when needed and revoked afterward. This is managed through Privileged Identity Management (PIM).
  • Role-Based Access Control (RBAC): Assigning permissions to roles, which are then assigned to users or groups.
  • Identity Governance: Managing access through Access Packages (combining group memberships, app access, etc.) with finite durations and approval workflows.
  • Dynamic Groups: Groups whose membership is determined by rules based on user attributes, automatically adding or removing users as their attributes change.

• Assume Breach: Operating under the assumption that malicious actors are already present. This necessitates continuous monitoring and correlation of signals from various sources.

  • Microsoft Sentinel: A SIEM/SOAR solution that ingests signals from devices (Defender for Endpoint), on-premises infrastructure (Defender for Identity), cloud identities, and other tools. It enables threat hunting, detection, and automated response using AI capabilities.
  • Entra ID Tenant Status & Secure Score: Provides an identity score and recommendations for improving security posture, highlighting the impact of addressing specific recommendations.

2. Protection and Capabilities (Microsoft Defender XDR)

Microsoft Defender XDR unifies protection across services for a coordinated defense. Key components include:

• Defender for Office 365: Detects phishing, malware, and malicious URLs/attachments in emails. Supports attack simulation training (Plan 2/E5) and Threat Explorer for real-time investigation.
• Defender for Endpoint: Provides Endpoint Detection and Response (EDR), anti-malware, attack surface reduction, and automated investigations for endpoint devices. It sends signals to Sentinel for broader visibility and can track attack paths.
• Defender for Identity: Monitors on-premises identity services (like Active Directory Domain Services) for credential attacks and compromises that could bleed into the cloud.
• Defender for Cloud Apps: Provides visibility into cloud applications and threat analytics.
• Threat Intelligence: Microsoft's library of threat intelligence reports.

3. Identity as the New Security Perimeter

With the dissolution of traditional network perimeters, identity becomes the primary security boundary.

• Identity: The digital persona of a person, application, or AI agent.
• Entra ID Tenant: The home for cloud identities.
• Hybrid Identity: An identity synchronized from on-premises Active Directory to Entra ID. The source of truth for attributes is typically on-premises AD.
• Cloud-Only Identity: An identity created directly in Entra ID.
• Authentication Methods for Hybrid Identities:
  • Password Hash Sync (PHS): Synchronizes a hash of the on-premises password hash to Entra ID. This allows cloud authentication without direct on-premises dependency and enables dark web credential leak detection.
  • Pass-through Authentication (PTA): Entra ID forwards authentication requests to on-premises domain controllers. Requires on-premises AD availability and specific AD capabilities.
  • Federation: Redirects authentication to an on-premises identity provider (e.g., AD FS). Requires hosting and managing federation services. Generally less preferred now due to complexity.
• Self-Service Password Reset (SSPR): Allows users to reset passwords, working for both hybrid and cloud-only accounts.
• Verified ID (Preview): A high-assurance authentication method using decentralized digital identities and third-party verification.
• Single Sign-On (SSO): Enables users to authenticate once and access multiple resources seamlessly. On Windows, this can involve Windows Hello for Business; on mobile, the Microsoft Authenticator app acts as a token broker.

4. Role-Based Access Control (RBAC) in Detail

RBAC defines what actions can be performed on specific resources.

• Groups: Permissions are typically assigned to security groups rather than individual users to simplify management.
• Roles: A collection of permissions or actions.
• Role Assignment: Granting a role to a group for a specific scope (e.g., a mailbox, SharePoint site).
• Built-in vs. Custom Roles: Microsoft provides many built-in roles (e.g., Global Administrator), but custom roles can be created for more granular control, adhering to JEA.
• Access Reviews: Periodic reviews to validate ongoing need for role assignments.
• Entitlement Management: Creating access packages that bundle permissions for finite periods, with approval workflows.
• Privileged Identity Management (PIM): Enables Just-In-Time (JIT) access for elevated roles.
• Dynamic Groups: Membership is automatically managed based on user attributes, preventing permission sprawl.
• M365 Groups vs. Security Groups:
  • Security Groups: Primarily for access control and permissions. Can be mail-enabled. Managed in Entra ID.
  • M365 Groups: Designed for collaboration, providing shared resources like mailboxes, calendars, and SharePoint document libraries. Managed in the M365 Admin Center.
• Distribution Lists: Used solely for sending emails to a group of recipients. Managed in the M365 Admin Center.
• M365 Admin Center: The primary portal for M365 administrators to manage groups, licenses, and other M365-specific settings, even though the underlying objects are in Entra ID.

5. Microsoft 365 Capabilities

A Microsoft 365 tenant is comprised of one or more domains.

• Core Services:
  • Exchange Online: Provides email, calendar, and mail flow management. Roles like Exchange Administrator manage mailboxes, mail flow rules, transport rules, retention policies, and litigation holds.
  • Microsoft Teams: Offers chat, meetings, calling, and app integrations. A dedicated Teams Administrator role manages team creation, policies, and app integrations.
  • SharePoint Online: Content management, intranet platforms, document libraries, and co-authoring. Site owners have full control, members can edit, and visitors have read-only access. SharePoint advanced management includes features like lifecycle management to enforce configurations (e.g., ensuring at least two owners per site).
  • OneDrive: Personal document storage, leveraging SharePoint storage.
• Microsoft Graph: A unified API that spans all M365 services, providing a single point of access to M365 data.

6. AI Capabilities: Copilots and Agents

AI in Microsoft 365 can be categorized into two main types:

• Copilots:
  • Function: AI assistants that work with users in the context of their current tasks.
  • Examples: Copilots in Word, PowerPoint, Excel, Outlook (summarize threads), Teams (summarize meetings, action items).
  • Access Control: Copilots operate under the user's identity and permissions; they cannot access data the user cannot access.
  • Customization: Tenant-level configurations and Copilot tuning are possible.
• AI-Powered Agents:
  • Function: Automate tasks, trigger by events, run on recurrence, and can be autonomous.
  • Examples: Writing Coach, Prompt Coach, Researcher, Analyst.
  • Customization: Can be built using Copilot Studio (low-code/no-code) or through pro-code development (VS Code, Foundry).
  • Identity: Agents typically have their own identity (e.g., Entra ID Agent ID) to operate across broader data sets.
  • Development Approaches:
    • Describe (Light): Natural language description of desired functionality.
    • Configure (Full): Detailed configuration of instructions, knowledge sources (up to 20), web access, and suggested prompts.
  • Knowledge Sources: Public websites, SharePoint sites, Dataverse, Dynamics 365, uploaded files. Respects confidential labeling.
  • Autonomous Agents: Triggered by events (e.g., receiving an email) and can operate independently.
  • Integration: Can hook into services integrated with M365 search via built-in or custom connectors (e.g., Salesforce, ServiceNow).
  • Best Practices: Focus on using APIs and Model Context Protocol (MCP) rather than graphical interfaces for agent development to ensure stability.
  • Governance: Agents can be approved before use. Usage can be monitored in reporting.

7. AI Under the Hood: Large Language Models and RAG

• Large Language Models (LLMs): The "digital brains" behind AI capabilities, predicting the next most probable token. They are trained on vast datasets but lack knowledge of an organization's specific data.
• Retrieval Augmented Generation (RAG): A technique to provide LLMs with relevant external data.
  • Semantic Index: Sits on top of Microsoft Graph, understanding natural language queries and mapping them to data.
  • Data Access: RBAC is strictly enforced; the semantic index will not retrieve data the user doesn't have access to.
  • No Model Training: LLMs are not trained on user data or prompts; business interactions are not used for model training.
  • Process: User prompt -> Copilot orchestrator -> Semantic Index query (for additional info) -> LLM (with prompt + system prompt) -> Response generation -> Content safety and groundedness checks -> User.
  • Content Safety & Groundedness: Checks for offensive content and minimizes hallucinations (factually incorrect statements).
• Work IQ (Preview): Leverages the semantic index, allowing other AI apps to access this data.
• Prompt Management: Users can save, share, and schedule prompts. Admins can control sharing and audit prompt usage.
• Responsible AI Principles:
  • Transparency: Knowing the source data, prompt history, and data access.
  • Safety: Content safety to block harmful content, minimal data usage.
  • Fairness: Treating everyone equally.
  • Reliability & Safety: Performing consistently and securely.
  • Security & Privacy: Protecting data.
  • Inclusiveness: Enabling everyone to leverage AI.
  • Accountability: Humans are responsible for AI actions.

8. Data Readiness and Content Protection

The semantic index makes data discoverable, highlighting the need for proper data management.

• Data AI Readiness:
  • SharePoint Site Permissions: Most sites should be private. Mispermissioned sites can expose sensitive data.
  • SharePoint Advanced Management: Includes a Permission Site Report to identify over-permissioned sites. Site owners can perform Site Access Reviews.
  • Restricted Content Discovery: At a site level, this prevents the semantic index and Copilot from searching that content.
  • Restricted SharePoint Search: Limits Copilot to specific sites (max 100, including child sites of hub sites).
• Content Protection (Microsoft Purview):
  • Information Protection: Classifying and protecting data with sensitivity labels (e.g., encrypting, watermarking, restricting access). Automatically discovers and classifies sensitive data using built-in rules, custom rules, and AI-powered trainable classifiers.
  • Data Loss Prevention (DLP): Prevents sensitive data leakage by blocking sharing or notifying users. Can target Copilots to prevent AI reasoning over highly confidential data.
  • Data Lifecycle Management: Retention policies for keeping, archiving, and deleting data.
  • Insider Risk Management: Detects unusual activities (e.g., copying large amounts of data to external services). Integrates with Conditional Access and DLP through Adaptive Protection to dynamically adjust risk levels and apply stricter policies.
  • Communication Compliance: Monitors email, Teams, and Yammer for regulatory and organizational policy violations.
  • DSPM for AI: Assesses and enforces policies on AI data usage, capturing AI prompts and responses, identifying "shadow AI" (non-corporate AI services), and using an activity explorer.

9. Licensing and Adoption

• Copilot Licensing:
  • Copilot Chat: Free, natural language interaction with web data (Bing search), but cannot access work data.
  • M365 Copilot Paid:
    • Business Plan: For smaller companies (max 300 users), lacks Purview and Insider Risk Management.
    • Enterprise Add-on: For M365 E3/E5, Office E3/E5, etc. Includes Purview and Information Rights Management.
    • Personal/Family Plans: Agent capabilities within apps, not grounded in work data.
  • Licensing Models:
    • Per User Per Month: Predictable billing (e.g., $30/user/month).
    • Pay-as-you-go (PAYG): Bills against an Azure subscription, offering flexibility but less predictable costs. Useful for infrequent users.
  • Copilot Studio Licensing: Paid, with credit packs or PAYG billing against an Azure subscription.
• License Assignment: Typically assigned to groups in the M365 Admin Center.
• Tenant-Level Controls: Enable/disable features (e.g., Teams transcriptions) at the tenant level.
• Adoption Strategy:
  • Pilot Programs: Enable a specific group, provide training.
  • User Feedback: Crucial for understanding value and identifying issues.
• Usage Monitoring:
  • M365 Admin Center: Shows assigned vs. owned licenses, active licenses, and user activity reports (who, when, how often, where).
  • Azure Portal: For PAYG billing, cost analysis, and budget alerts.
  • Viva Insights: Provides deep analytics on Copilot usage, trends, and research insights into how AI is being leveraged.

Conclusion

The AB900 exam focuses on understanding the capabilities of Microsoft 365 and AI administration, particularly within the context of modern security principles like Zero Trust. Key areas include identity management, access control, threat protection, and the integration of AI services like Copilots and agents. Effective adoption and governance of these technologies are crucial, with a strong emphasis on responsible AI principles and data protection through tools like Microsoft Purview. Understanding licensing models and usage monitoring is also essential for administrators. The exam emphasizes conceptual knowledge and the ability to identify the right tools and approaches for specific scenarios.