AB-900 Exam Dumps - Microsoft 365 Copilot and Agent Administration Fundamentals

The correct answer is A. the Microsoft Defender portal . Microsoft documents that phishing investigation and analysis for email threats is handled in Microsoft Defender for Office 365 through the Microsoft Defender portal . Microsoft’s phishing investigation guidance and email security reporting both point admins to Defender capabilities such as Threat Explorer , campaign views , and phish reports to understand the scope, affected users, and impact of phishing attacks.

The other options are not the primary investigation tool for this scenario. The Microsoft 365 admin center is mainly for tenant administration and usage reporting, not detailed phishing impact investigation. The Microsoft Entra admin center focuses on identity and access management, not email threat analysis. The Exchange admin center manages mail flow and Exchange settings, but Microsoft’s current phishing investigation workflows are centered in the Microsoft Defender portal , where security analysts can review detections, remediation actions, and affected recipients.

So, to review the impact of a phishing incident that targeted email users, the Microsoft-documented choice is the Microsoft Defender portal .

The correct selections are No, Yes, Yes . Microsoft documents that the Audit page in the Microsoft Defender portal can be used to search the unified audit log for user and admin actions in the organization. Microsoft also states that audit log search in the Defender portal is the same as audit log search in the Microsoft Purview portal , which means both portals can be used to review administrative actions taken in Microsoft 365.

Microsoft further explains that Microsoft Purview Audit enables organizations to search for audit records of activities that users and admins perform across Microsoft services, making it a correct tool for this requirement.

By contrast, Search & intelligence in the Microsoft 365 admin center is not the feature used to investigate administrator actions through the unified audit log. It is not Microsoft’s documented audit search tool for this purpose. Therefore, for this hotspot the right answers are No for Search & intelligence, Yes for Audit in Microsoft Defender, and Yes for Audit in Microsoft Purview.

The correct answer is Activate the role. Microsoft Learn states that in Microsoft Entra Privileged Identity Management (PIM), when a user is made eligible for a Microsoft Entra role, they do not immediately have the permissions of that role. Microsoft specifically explains that eligible users must activate the role assignment before using the role. Only after activation does the user receive the permissions associated with that role for the approved time period.

That means if you are only eligible for the User Administrator role, you cannot create user accounts until you activate that role in PIM. The other options are incorrect because installing Microsoft Authenticator, requesting a license, or updating location information are not the universal prerequisite stated by Microsoft for using an eligible PIM role. Multifactor authentication can be required during activation depending on policy, but the core required action is still to activate the role first. Microsoft also notes that activation can involve entering a reason, selecting a duration, and completing any required approval or MFA steps.

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft’s recommended identity security best practices.

Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.

The correct answer is Data access governance . Microsoft documents that Data access governance reports in the SharePoint admin center help administrators discover overshared or sensitive SharePoint content and assess sharing exposure. More specifically, Microsoft’s sharing links activity reports under Data access governance are designed to monitor sharing activity and identify sites where links such as Anyone , People in the organization , and Specific people links have been created. This is the SharePoint admin reporting area Microsoft provides for investigating external sharing patterns and related exposure.

The other listed reports do not fit this requirement. Agent insights is for Copilot/agent usage, App insights is for application-related insights, Change history tracks configuration changes, OneDrive accounts focuses on OneDrive administration, and Site policy comparison compares site settings. None of those is the SharePoint report family intended for identifying externally shared SharePoint content. Based on Microsoft’s documentation, the report area you should use is Data access governance .

The correct answer is D. an app registration . Microsoft Learn states that to delegate identity and access management functions to Microsoft Entra ID , an application must be registered with a Microsoft Entra tenant . When you register an application, you create its identity configuration in Microsoft Entra, and a corresponding service principal is created so the application can authenticate and integrate with the tenant. This is the standard Microsoft mechanism for allowing a third-party cloud service or app to authenticate to Microsoft Entra.

The other options do not provide the app identity required for authentication. Multifactor authentication (MFA) strengthens user sign-ins, but it does not onboard a third-party service as an application identity in Entra. Conditional Access enforces access policies after authentication and authorization decisions are being made; it does not create the application identity itself. A Microsoft 365 Copilot connector is used to bring external data into Microsoft 365 experiences, not to let a third-party cloud service authenticate to Microsoft Entra. Therefore, the correct configuration is an app registration .