Microsoft 365 Certified: Copilot and Agent Administration Fundamentals — Practice Set 1

Question 1

Your company is setting up Microsoft 365 for the first time. An administrator needs to verify and configure the organization's custom domain so users can sign in with corporate email addresses. Which admin center should the administrator use to configure domain names for the organization?

Accepted Answer

The Microsoft 365 admin center is the correct tool for configuring domain names and organization-wide settings. It serves as the central hub for tenant-level configurations including adding and verifying custom domains. The Exchange Online admin center manages mailboxes and email flow but not domain registration for the tenant. Microsoft Entra handles identity and access management. SharePoint admin center manages SharePoint-specific settings like sites and storage.

Question 2

A company assigns Microsoft 365 E3 licenses to a security group called 'Marketing-Team'. A new employee joins the marketing department and is added to the security group. What happens to the new employee's access to Microsoft 365 features?

Accepted Answer

Group-based licensing in Microsoft 365 automatically assigns licenses to users when they are added to a group that has a license assigned. When the new employee is added to 'Marketing-Team', the Microsoft 365 E3 license is automatically provisioned, granting access to all included features. There is no need for manual individual assignment, a grace period, or PowerShell scripts — this is a core feature of Azure AD/Entra group-based licensing.

Question 3

An administrator needs to create a shared inbox so that the support team can collectively receive and respond to customer emails sent to support@contoso.com. No individual user should own this mailbox. Which object should the administrator create in the Exchange Online admin center?

Accepted Answer

A shared mailbox is the correct object for a collective inbox that multiple users can access and respond from without individual ownership. It is designed for scenarios like support@contoso.com where a team manages incoming email. A distribution list only forwards emails to members' individual mailboxes and does not provide a shared inbox. A mail-enabled security group provides the same forward-only behavior as a distribution list. A user mailbox with an alias still requires an individual license owner and does not provide true shared access.

Question 4

A project team needs a dedicated space in SharePoint to store project documents, where team members can have edit access but external contractors can only view files. The administrator needs to set this up. Which SharePoint object should the administrator configure permissions on to achieve this structure?

Accepted Answer

A SharePoint team site with unique permissions on a document library is the correct approach. SharePoint supports breaking permission inheritance at the library level, allowing different access levels (edit vs. view-only) for different user groups. A communication site uses default inheritance and is designed for broadcasting content, not collaborative project document management with granular permissions. OneDrive is intended for personal storage and does not support the same enterprise permission model. While Teams channels create connected SharePoint libraries, configuring granular external contractor access is better managed directly through SharePoint's permission model.

Question 5

An IT administrator is reviewing the Zero Trust security model that the organization plans to adopt for its Microsoft 365 environment. Which THREE principles are core to the Zero Trust model? (Choose 3)

Accepted Answer

The three core Zero Trust principles are: (A) Verify explicitly — every request is authenticated and authorized using all available signals including identity, location, device health, and service; (C) Use least privilege access — access is granted with minimum necessary permissions using just-in-time and just-enough-access controls; and (D) Assume breach — the model assumes that breach has occurred or will occur, so systems are designed to limit blast radius through network segmentation and encryption. Options B and E ('trust the network perimeter' and 'allow all internal traffic') are principles of the old perimeter-based security model that Zero Trust explicitly replaces.

Question 6

A user reports that they cannot sign in to Microsoft 365 and suspects it might be related to a conditional access policy. Which tool should an IT administrator use to investigate why the conditional access policy blocked the sign-in?

Accepted Answer

Microsoft Entra sign-in logs combined with the Conditional Access 'What If' tool are the correct resources for troubleshooting conditional access-related sign-in failures. Sign-in logs show exactly which policy was applied or blocked the sign-in, and the What If tool lets administrators simulate sign-in conditions to test policies. Microsoft Secure Score tracks security posture, not individual sign-in events. Microsoft Defender XDR focuses on threat incidents, not conditional access policy troubleshooting. The Microsoft 365 Message Center provides service announcements and planned maintenance notifications, not user sign-in diagnostic data.

Question 7

Contoso Ltd. recently promoted a junior IT staff member to temporarily manage Microsoft Entra ID for two weeks while the primary admin is on leave. The security team wants to ensure this temporary elevation follows best practices: the role should only be active when needed, requires approval from a manager, and all activations should be logged. Which Microsoft 365 feature should the security team configure to meet these requirements?

Accepted Answer

Privileged Identity Management (PIM) in Microsoft Entra ID is specifically designed for this scenario. PIM supports eligible role assignments where the user can activate the role only when needed (just-in-time access), requires manager approval before activation, enforces MFA at activation time, and maintains detailed audit logs of all activations and actions. Option A directly assigns a permanent Global Administrator role, which violates least privilege and leaves the elevated access active even when not needed. Option B does not address the approval workflow or time-limited activation requirements. Option D assigns a permanent role with only MFA, which doesn't provide just-in-time access or the approval workflow.

Question 8

An administrator notices that the organization's Identity Secure Score in Microsoft Entra ID is 42 out of 100. The dashboard recommends enabling MFA for all global administrators. What does the Identity Secure Score primarily measure?

Accepted Answer

The Identity Secure Score measures an organization's identity security posture by comparing current configuration settings against Microsoft's recommended security best practices. The score reflects how well the tenant is configured for identity security — higher scores indicate better alignment with recommendations such as enabling MFA, disabling legacy authentication, and using PIM. It does not measure license utilization (that is license management), security training completion (that belongs to security awareness platforms), or real-time threat detection rates (that is handled by Microsoft Defender XDR).

Question 9

A Microsoft Teams administrator needs to control which third-party applications users can install within Teams. Where should the administrator configure application permission policies?

Accepted Answer

The Teams admin center under Teams apps > Permission policies is where administrators configure which apps users are allowed to install and use in Microsoft Teams. This is the correct and purpose-built location for Teams app governance. The Microsoft 365 admin center provides high-level app management but not granular Teams app permission policies. Microsoft Entra Enterprise applications manages OAuth app consents for the tenant, not Teams-specific app permissions. SharePoint admin center is unrelated to Teams application policies.

Question 10

A compliance officer needs to prevent users from emailing documents containing credit card numbers outside the organization. Which Microsoft Purview feature should be configured to detect and block this activity automatically?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) is designed to detect and block the transmission of sensitive information such as credit card numbers. DLP policies can be applied to email, Teams messages, SharePoint, and OneDrive, and can take automated actions such as blocking the email or notifying the user when sensitive data types are detected. Insider Risk Management detects risky user behaviors but does not automatically block specific data transmissions. Communication Compliance monitors communications for policy violations but is primarily for review workflows, not automated blocking. Data Lifecycle Management governs retention and deletion of content, not transmission prevention.

Question 11

A legal team needs to ensure that documents classified as 'Highly Confidential' cannot be printed, copied, or shared outside the organization, even if downloaded to a local device. Which Microsoft Purview feature should be applied to enforce these restrictions?

Accepted Answer

Sensitivity labels with encryption are the correct tool because they apply persistent protection that travels with the document regardless of where it is stored. Encryption-backed sensitivity labels can restrict printing, copying, forwarding, and external access, and these protections remain even after the file is downloaded. Retention labels manage content lifecycle (keep or delete) but do not restrict printing or copying. DLP policies can block sharing within Microsoft 365 services but cannot encrypt downloaded files to prevent local printing/copying. Communication Compliance is a monitoring and review tool, not an enforcement mechanism for document-level access controls.

Question 12

Fabrikam Inc. has deployed Microsoft 365 Copilot to 500 users. The CISO is concerned that Copilot might surface confidential HR documents in responses to queries from non-HR employees. An audit reveals that many HR files in SharePoint have been shared with 'Everyone except external users'. The security team wants to understand Copilot's data access behavior and remediate oversharing risks. Which combination of tools should the security team use to discover oversharing and understand how Copilot accesses data?

Accepted Answer

This scenario requires two capabilities: understanding Copilot's AI-specific data access risks and discovering oversharing in SharePoint. Microsoft Purview DSPM for AI is specifically designed to discover and manage AI activity, surface data security risks related to Copilot, and provide insights into what data Copilot is accessing. SharePoint Advanced Management's data access governance reports identify sites and libraries that are broadly shared (e.g., with 'Everyone except external users') to detect oversharing. Together these tools directly address the stated problem. Option A focuses on cloud app security and infrastructure monitoring, not Copilot-specific AI data risks or SharePoint oversharing. Option C addresses user risk behavior and authentication, not data access or oversharing discovery. Option D monitors communications for policy compliance but does not provide SharePoint oversharing visibility or Copilot AI data access insights.

Question 13

A compliance manager wants to understand how well the organization meets regulatory requirements such as GDPR and ISO 27001. Which Microsoft Purview tool provides a risk score and recommended improvement actions for compliance posture?

Accepted Answer

Microsoft Purview Compliance Manager provides a compliance score along with recommended improvement actions mapped to specific regulatory frameworks such as GDPR, ISO 27001, NIST, and others. It helps organizations assess their compliance posture and prioritize remediation steps. Data Explorer is used for identifying and classifying sensitive information across the tenant, not for regulatory compliance scoring. eDiscovery is used for legal hold and content search for litigation or investigations. Activity Explorer shows a timeline of labeling and DLP events for sensitive data, not regulatory compliance posture scoring.

Question 14

A financial services firm is deploying Microsoft 365 Copilot. The Chief Compliance Officer asks: 'When a user asks Copilot a question about a client account, what data sources does Copilot access to generate its response?' The IT team needs to explain Copilot's data access model accurately. Which statement best describes how Microsoft 365 Copilot accesses organizational data?

Accepted Answer

Microsoft 365 Copilot uses Microsoft Graph as its data layer, which means it only accesses data that the currently signed-in user has permission to see based on existing Microsoft 365 permissions (SharePoint permissions, Teams membership, Exchange mailbox access, etc.). Copilot does not bypass or override access controls — it inherits them. This is a critical security principle: if a user cannot access a file directly, Copilot will not surface that file in responses. Option A is incorrect because Copilot does not access data beyond the user's permissions, even temporarily. Option C is incorrect — Copilot does not maintain a separate AI-specific database that bypasses permissions. Option D is incorrect because Copilot can access any data the user has permission to see across the tenant, not just OneDrive and mailbox.

Question 15

An HR manager has reported that a former employee may have exfiltrated sensitive performance review documents before their last day. An investigator needs to identify exactly which files the departing employee accessed and downloaded in the last 30 days. Which Microsoft Purview tool should the investigator use?

Accepted Answer

Microsoft Purview Activity Explorer provides a detailed timeline of user activities related to labeled and sensitive content, including file access, download, copy, and sharing events. It is the correct tool for tracking what a specific user did with sensitive files over a time period. Data Explorer is used for discovering where sensitive data resides across the tenant, not for tracking user activity on specific files. Communication Compliance monitors communications (email, Teams messages) for policy violations but does not track file access events. Compliance Manager assesses overall compliance posture; it does not provide per-user file activity timelines.

Question 16

A compliance team is configuring Microsoft Purview for a healthcare organization that must comply with HIPAA. They need to protect patient health information (PHI) across Microsoft 365. Which THREE Microsoft Purview capabilities should they configure to achieve comprehensive PHI protection? (Choose 3)

Accepted Answer

Three Purview capabilities directly address HIPAA PHI protection: (A) Sensitivity labels with encryption classify and persistently protect PHI documents so only authorized personnel can access them; (B) DLP policies with HIPAA-specific sensitive information types automatically detect and prevent PHI from being transmitted in violation of policy; and (C) Data Lifecycle Management retention policies ensure PHI records are retained for the legally required period and securely disposed of afterward, which is a HIPAA requirement. Option D (Defender for Endpoint antivirus) is an endpoint security tool, not a data protection/governance tool within Purview. Option E (Teams bandwidth policies) is a network quality setting unrelated to PHI protection or HIPAA compliance.

Question 17

An administrator wants to find all files across SharePoint Online and OneDrive for Business that contain social security numbers, in order to assess data exposure. Which tool should the administrator use?

Accepted Answer

Microsoft Purview Data Explorer is the correct tool for discovering where sensitive information types (such as Social Security Numbers) reside across Microsoft 365 services including SharePoint and OneDrive. It provides classification insights showing the volume and location of sensitive content. eDiscovery Content Search is designed for legal investigations and searches by keyword or condition, not for broad sensitive information type discovery across the tenant. SharePoint Search is a user-facing search tool without sensitive information type classification capabilities. Activity Explorer shows what users have done with classified content, not where unclassified sensitive data resides.

Question 18

Northwind Traders is using Microsoft 365 Copilot. A new company policy requires that Copilot interactions must adhere to responsible AI principles. The AI governance team asks an administrator to explain which principle ensures that Copilot does not produce outputs that discriminate against users based on protected characteristics. Which responsible AI principle does this requirement align with?

Accepted Answer

The Fairness principle in Microsoft's responsible AI framework addresses ensuring that AI systems treat all people fairly and do not create or reinforce discrimination based on protected characteristics such as race, gender, age, disability, or religion. This directly applies to the requirement that Copilot outputs should not discriminate. Reliability and Safety focuses on AI performing consistently and safely without unexpected harmful behavior. Transparency focuses on understanding how and why AI systems make decisions. Accountability focuses on people being answerable for AI systems and their impacts. While all principles work together, Fairness is the specific principle governing non-discriminatory outcomes.

Question 19

A SharePoint administrator is told that several team sites have been flagged for oversharing because files are accessible to all authenticated users in the organization. The administrator needs to run a report to identify which sites have the most broadly shared content. Which tool should the administrator use?

Accepted Answer

The SharePoint admin center Data Access Governance reports are specifically designed to identify oversharing in SharePoint, including sites and libraries where content is shared broadly with large groups such as 'Everyone except external users' or 'All Users'. This is a purpose-built report for the exact scenario described. Activity Explorer tracks user actions on labeled content but does not produce oversharing summary reports across sites. Microsoft Entra Access Reviews manages group and role membership reviews, not SharePoint content sharing permissions. Microsoft Defender for Cloud Apps Shadow IT reports identify unsanctioned cloud app usage, not internal SharePoint oversharing.

Question 20

A Microsoft 365 administrator needs to give 50 specific users access to Microsoft 365 Copilot features. What is the first step the administrator must take?

Accepted Answer

Assigning Microsoft 365 Copilot licenses is the foundational prerequisite for users to access Copilot features. Without a Copilot license, users cannot use any Copilot functionality regardless of other settings. License assignment is done through the Microsoft 365 admin center > Users > Active users, or via group-based licensing. There is no separate Copilot 'enable' toggle independent of licensing. Creating Teams policies or Entra app registrations are not required steps for standard Copilot license rollout.

Question 21

A global organization has deployed Microsoft 365 Copilot to 1,000 users. After three months, the CFO asks the IT director to provide data on how actively Copilot is being used and whether the investment is delivering value. The IT director needs to show metrics such as active users, features used, and adoption trends. Where should the IT director look to find this information?

Accepted Answer

The Microsoft 365 admin center provides Copilot Analytics and usage reports specifically designed for monitoring adoption, active users, feature utilization, and usage trends across the organization. This is the purpose-built dashboard for Copilot adoption tracking and ROI measurement. Entra sign-in logs show authentication events, not feature usage or adoption metrics. Purview Activity Explorer tracks sensitive data interactions, not overall Copilot usage patterns. Defender XDR Advanced Hunting is a threat hunting tool for security investigations, not an adoption analytics platform.

Question 22

An administrator is comparing licensing options for Microsoft 365 Copilot to recommend the best model for the organization. Which TWO statements correctly describe differences between the Copilot monthly license model and the pay-as-you-go model? (Choose 2)

Accepted Answer

Option A is correct — the monthly license model (Microsoft 365 Copilot license) is a fixed per-user per-month subscription that grants licensed users full access to Copilot capabilities. Option B is correct — the pay-as-you-go model charges based on actual usage (consumption-based billing), which is more cost-effective for users who use Copilot infrequently or unpredictably. Option C is incorrect — the monthly license model is not limited to SharePoint; it covers Copilot across Microsoft 365 apps. Option D is incorrect — pay-as-you-go does not require minimum license upfront purchases by definition. Option E is incorrect — there may be capability differences between the models, particularly for features like Copilot in SharePoint which has its own licensing considerations.

Question 23

A developer in the organization has created a custom Copilot agent in Microsoft Copilot Studio to automate IT helpdesk ticket triage. Before the agent can be deployed to all employees, which step must occur in the Microsoft 365 admin center?

Accepted Answer

Custom agents created in Microsoft Copilot Studio go through an approval process in the Microsoft 365 admin center before being deployed to users. Administrators can review, approve, or block agents submitted by developers to ensure they meet organizational security and compliance standards. This governance gate is a required step before broad user deployment. Option A (Power Platform premium license) may be required for certain Copilot Studio scenarios but is not the deployment gate described. Option C (Entra app registration) is not the standard approval process for Copilot Studio agents. Option D is incorrect — agents are not automatically available to all users after publishing; admin approval and configuration of user access is required.

Question 24

An administrator has deployed three custom agents across the organization: a leave management agent, an IT support agent, and a procurement agent. After two months, the Operations team asks which agents are being used most frequently and whether any agents have errors or are failing to complete tasks. Which admin center should the administrator use to monitor agent usage, operational health, and lifecycle status?

Accepted Answer

Agent monitoring is performed across both the Microsoft 365 admin center (which provides agent usage and adoption insights) and the Microsoft Power Platform admin center (which provides operational health, error rates, and agent lifecycle management for agents built on Power Platform/Copilot Studio). The two admin centers complement each other for comprehensive agent monitoring. The Teams admin center manages Teams app availability but does not provide deep agent operational health metrics. Microsoft Entra Enterprise applications manages OAuth app registrations, not agent operational performance. Purview Activity Explorer tracks data-related user activities, not agent operational health or usage statistics.

Question 25

An administrator wants to understand the built-in Copilot capabilities available in Microsoft 365. Which THREE statements correctly describe built-in Copilot features that administrators should be aware of? (Choose 3)

Accepted Answer

Option A is correct — Copilot Researcher is a purpose-built agent within Microsoft 365 Copilot designed for deep research tasks, synthesizing information across sources with advanced reasoning. Option B is correct — Copilot Analyst is a built-in feature that performs data analysis and can generate visualizations and insights from structured data files like Excel. Option D is correct — administrators have controls in the Microsoft 365 admin center to enable or disable specific Copilot features for their organization or specific user groups. Option C is incorrect — Microsoft 365 Copilot provides built-in AI assistance across apps (Word, Excel, Teams, Outlook, etc.) without requiring custom agents; agents extend functionality but are not prerequisites. Option E is incorrect — custom agents complement built-in Copilot capabilities; they do not replace them.

AB-900 — Microsoft 365 Certified: Copilot and Agent Administration Fundamentals