Free Microsoft 365 Certified: Copilot and Agent Administration Fundamentals (AB-900) Sample Questions

Correct answer: C — FIDO2 security keys

• A. Incorrect. SMS-based authentication requires a mobile phone to receive a text message, which is prohibited on the factory floor. Furthermore, SMS is not a passwordless method and is vulnerable to interception and SIM swapping.
• B. Incorrect. The Microsoft Authenticator app requires a smartphone to approve push notifications or generate TOTP codes. Since mobile phones are not allowed, this method is not viable for this scenario.
• C. Correct. FIDO2 security keys provide a hardware-based, phishing-resistant, passwordless authentication method. They do not require a mobile device, making them the ideal solution for high-security environments and shared workstations where phones are prohibited.
• D. Incorrect. Voice call authentication requires access to a phone to receive a call. It is neither passwordless nor permitted in an environment where mobile devices are banned.

Correct answer: A — Windows Hello for Business

• A. Windows Hello for Business is a biometric sign-in feature designed for Windows 10 and 11. It allows users to sign in to their devices using facial recognition, fingerprints, or a PIN, providing a secure and convenient passwordless experience specifically for corporate-managed laptops.
• B. Microsoft Authenticator is a mobile app used primarily for Multi-Factor Authentication (MFA) and passwordless phone sign-in to cloud services. While it is a key part of Microsoft's identity strategy, it does not provide the facial recognition capability for local Windows device login.
• C. FIDO2 security keys are external physical hardware devices used for passwordless authentication. Although they are a secure alternative to passwords, they do not utilize the laptop's built-in camera for facial recognition.
• D. OATH hardware tokens are physical devices that generate time-based one-time passwords (TOTP) for MFA. They are used for manual entry of codes and do not support biometric facial recognition or direct passwordless sign-in for Windows laptops.

Correct answers: A, B, C — User or group membership; IP location information; Device compliance state

• A. Correct. User or group membership is a fundamental signal for Conditional Access. It allows administrators to include or exclude specific users or groups to ensure that policies are applied to the correct identities within the organization.
• B. Correct. IP location information is used via named locations or country/region-based policies. This allows administrators to enforce access controls based on the geographic location or specific network ranges of the user's sign-in attempt.
• C. Correct. Device compliance state is a standard signal often integrated with Microsoft Intune. It ensures that only devices meeting specific security standards, such as encryption or up-to-date antivirus, can access protected resources.
• D. Incorrect. While Entra ID stores user attributes, Conditional Access does not natively use job titles from HR records as a direct signal. Access decisions are based on identity, device, location, and risk rather than specific HR record fields.
• E. Incorrect. The time of day is not a standard, built-in signal for Microsoft Entra Conditional Access policies. Policies are primarily triggered by the identity's context, device health, and sign-in risk levels.

Correct answer: A — Microsoft Entra Connect

• A. Correct. Microsoft Entra Connect (formerly Azure AD Connect) is the primary tool used to synchronize on-premises Active Directory objects (users, groups, etc.) with Microsoft Entra ID. This enables hybrid identity, allowing users to use the same credentials for both on-premises and cloud resources.
• B. Incorrect. Microsoft Intune is a cloud-based endpoint management solution used for mobile device management (MDM) and mobile application management (MAM). It does not perform identity synchronization.
• C. Incorrect. Microsoft Defender for Identity is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It is a security monitoring tool, not a synchronization tool.
• D. Incorrect. Microsoft Entra Application Proxy provides secure remote access to on-premises web applications for external users. While it integrates with Microsoft Entra ID, it is used for application publishing rather than synchronizing the directory itself.

Correct answers: A, C — Users only need to remember one set of credentials.; It reduces the number of password reset requests to the IT helpdesk.

• A. Single Sign-On (SSO) allows users to access multiple applications and services with a single set of credentials. This simplifies the user experience by reducing the number of passwords they need to remember and manage.
• B. SSO does not eliminate the need for Conditional Access policies. Conditional Access is a separate security engine used to provide additional security by enforcing specific access controls based on conditions like location, device state, or risk level.
• C. By reducing the number of passwords users must manage, SSO decreases the frequency of forgotten passwords. This, in turn, reduces the number of password reset requests submitted to the IT helpdesk, saving administrative time and resources.
• D. SSO does not automatically block sign-ins from outside the corporate network. Location-based restrictions are typically handled through Conditional Access policies, firewall rules, or VPN requirements.
• E. SSO does not replace the need for multifactor authentication (MFA). MFA provides an additional layer of security by requiring multiple forms of verification, and it is considered a complementary best practice to use alongside SSO.

Correct answer: B — Microsoft Entra ID P1

• A. Incorrect. Microsoft Entra ID Free (formerly Azure AD Free) supports basic features such as Single Sign-On (SSO) and Multi-Factor Authentication (MFA), but it does not include advanced group management capabilities like dynamic membership rules.
• B. Correct. Microsoft Entra ID P1 is the minimum license level required to implement dynamic membership rules for groups. This feature allows administrators to define rules based on user or device attributes (e.g., department or location) to automatically manage group membership.
• C. Incorrect. Microsoft 365 Business Basic is a productivity suite subscription that includes core cloud services but does not inherently provide the Microsoft Entra ID P1 features required for dynamic group membership. A higher-tier license like Microsoft 365 Business Premium or Entra ID P1/P2 is required.

Correct answers: A, C — Convert the user mailbox to a shared mailbox.; Grant the manager Full Access and Send As permissions to the mailbox.

• A. Converting the user mailbox to a shared mailbox is a standard practice when offboarding employees. This allows the mailbox to be retained and accessed without requiring an active Microsoft 365 license, though permissions must still be assigned to allow others to open it.
• B. Deleting the user account immediately is not recommended in this scenario. Doing so would remove the manager's access to the mailbox and eventually lead to the permanent deletion of the data unless specific retention policies are in place.
• C. Granting Full Access and Send As permissions is the direct method for enabling delegation. Full Access allows the manager to open and read the mailbox, while Send As allows them to send emails that appear to come from the former employee's address.
• D. Resource mailboxes are specifically designed for coordinating resources like meeting rooms or company equipment. They are not intended for preserving or managing a former employee's email account.
• E. A mail contact is an object that contains information about a person who exists outside of your organization. It does not provide any access to internal mailboxes or allow for delegating permissions to a manager.

Correct answers: A, B — Folders; Files

• A. Correct. Folders are fundamental container objects within Microsoft 365 services, particularly in SharePoint Online and OneDrive for Business, used to organize and structure content within libraries.
• B. Correct. Files are the primary content objects in Microsoft 365. They represent the core data units (such as documents, spreadsheets, and presentations) that users create, store, and collaborate on across various services.
• C. Incorrect. Document Sets are a specialized feature in SharePoint used to manage multiple documents as a single entity. While useful, they are considered an advanced content management feature rather than a core object of Microsoft 365 services.
• D. Incorrect. Subsites are a legacy method of structuring SharePoint site hierarchies. Microsoft now recommends a 'flat' architecture using Hub Sites, and subsites are not considered core objects of the modern Microsoft 365 ecosystem.
• E. Incorrect. Web parts are building blocks used to customize the layout and functionality of SharePoint pages. They are UI components rather than core data or service objects.
• F. Incorrect. Site columns are metadata elements used to define reusable data fields. While they are critical for data classification and consistency, they are attributes of objects rather than core objects themselves.

Correct answer: B — Site Owners

• A. Site Members typically have 'Edit' or 'Contribute' permissions. This allows them to add, edit, or delete items and files, but they do not have the highest level of control required to manage site-wide settings or site permissions.
• B. Site Owners are assigned the 'Full Control' permission level. They have complete authority over the site, which includes the ability to manage site structure, customize settings, and grant or revoke permissions for other users.
• C. Site Visitors are assigned 'Read' permissions. This allows them to view content and download documents but prevents them from making any changes to the site content, settings, or permissions.
• D. While 'Site Collection Administrator' is a role with higher-level privileges, 'Site Administrators' is not the standard name for the default group at the site level. The core role responsible for site-level management in the Microsoft 365 group-connected site model is the Site Owner.

Correct answers: A, B, C, E — Full Control; Edit; Read; Design

• A. Full Control is a default permission level that grants users all available permissions, including the ability to manage permissions and change site settings. It is assigned to the 'Owners' group by default.
• B. Edit is a default permission level that allows users to add, edit, and delete lists; it also permits viewing, adding, updating, and deleting list items and documents. It is the default level for the 'Members' group in modern SharePoint sites.
• C. Read is a default permission level that allows users to view pages and list items and download documents. It is typically assigned to the 'Visitors' group.
• D. Approve is a default permission level, but it is generally only available when SharePoint Server Publishing features are enabled or specific workflows are in use; it is not considered a standard level for all team sites.
• E. Design is a standard default permission level that allows users to view, add, update, delete, approve, and customize items, as well as change the layout and appearance of pages and site themes.
• F. Manage Hierarchy is a default permission level specific to sites with Publishing features activated, allowing users to manage site structure and settings.

Correct answer: B — Restricted site access

• A. Site access reviews are governance and auditing controls used to periodically review and validate existing access permissions. They do not enforce a real-time access boundary that prevents unauthorized users from accessing shared content.
• B. Restricted site access (RSA) is a SharePoint policy that allows administrators to limit site access to members of a specific security group (e.g., HR Department). Even if a file within the site is shared with a user outside that group, the RSA policy will block that user's access at the site level, acting as an effective 'access fence'.
• C. The default sharing link type determines which link setting is selected by default when a user clicks the Share button (such as 'People in your organization' or 'Specific people'). It does not enforce security group-based access restrictions on the site itself.
• D. Guest access restrictions control whether external users can be invited to or access content within a site. They do not provide the capability to restrict internal access to a specific Microsoft Entra security group.

Correct answer: A — Restricted access control for OneDrive

• A. Correct. Restricted access control (RAC) for OneDrive is a SharePoint Advanced Management feature that allows administrators to limit access to a user's OneDrive content to a specific security group. This ensures that even if files were previously shared, only members of the specified group can access the OneDrive.
• B. Incorrect. OneDrive retention policies are part of Microsoft Purview and are used to manage the data lifecycle (how long content is kept or when it is deleted) rather than controlling which users have access permissions.
• C. Incorrect. OneDrive sync restrictions are used to control which devices or domains can synchronize files, focusing on device security and data leakage prevention rather than restricting access to a specific set of users.
• D. Incorrect. OneDrive storage limits define the maximum storage capacity allocated to a user's OneDrive and do not affect or restrict user access permissions.

Correct answer: B — Sensitivity labels report in Data access governance

• A. Incorrect. The Site usage report focuses on activity and storage metrics such as site visits, unique viewers, and storage used. It does not provide data regarding the distribution of sensitivity labels across files within those sites.
• B. Correct. The Sensitivity labels report, located within Data access governance (in the SharePoint admin center), is specifically designed to help administrators identify where labeled content resides. It identifies which SharePoint sites contain the highest number of files with specific sensitivity labels, which is key for identifying potential oversharing of sensitive data.
• C. Incorrect. The Data loss prevention (DLP) report is used to monitor policy matches and incidents where sensitive data has been shared or handled incorrectly. It is used for enforcement and violation tracking rather than analyzing the distribution of labeled files across sites.
• D. Incorrect. While the Information protection report in Microsoft Purview provides broad insights into sensitivity label usage across the tenant, the specific requirement to identify and compare SharePoint sites by label density is a function of the Data access governance reports in SharePoint.

Correct answers: A, B — Sharing links report; Sensitivity labels report

• A. Correct. The Sharing links report is a primary component of Data access governance (DAG). It helps administrators identify sites where users have created 'Anyone' links or 'People in your organization' links, which are key indicators of potential oversharing.
• B. Correct. The Sensitivity labels report under Data access governance shows which sites have specific sensitivity labels applied. This allows administrators to monitor sites containing sensitive or highly confidential data to ensure appropriate sharing controls are in place.
• C. Incorrect. The Site storage report is an administrative metric used for capacity and resource management. While it is available in the SharePoint admin center, it is not part of the Data access governance reports.
• D. Incorrect. User activity reports are standard usage and audit reports found in the Microsoft 365 admin center or the general 'Usage' section of SharePoint reports, but they are not listed under the specific Data access governance blade.
• E. Incorrect. The Search analytics report is located under the Search section of the SharePoint admin center and focuses on search queries and performance rather than data governance or oversharing.

Correct answer: A — Auto-labeling

• A. Correct. Auto-labeling in Microsoft Purview Information Protection can detect sensitive content (such as keywords or project codes) and automatically apply or recommend a sensitivity label. This feature helps ensure consistent classification and protection of sensitive data across the organization.
• B. Incorrect. Retention labels are used for Data Lifecycle Management to control how long content is kept and when it should be deleted. They are not used to classify information based on confidentiality or to suggest sensitivity labels.
• C. Incorrect. Insider Risk Management focuses on identifying and mitigating internal risks, such as potential data leaks or policy violations by employees. It does not handle the automated suggestion of sensitivity labels based on document content.
• D. Incorrect. Exact Data Match (EDM) is a sensitive information type (SIT) classification method used to detect specific values from a structured database (like customer IDs). While it can be used as a trigger within an auto-labeling policy, it is the classification mechanism itself, whereas 'Auto-labeling' is the overarching feature that provides the suggestion functionality.

Correct answers: A, B, C — Profanity and harassment; Threats of violence; Regulatory compliance violations, such as insider trading

• A. Microsoft Purview Communication Compliance uses machine learning and keyword matching to identify offensive language, including profanity and harassment, across Microsoft 365 channels like Teams, Outlook, and Yammer.
• B. The service includes built-in templates designed to detect threatening language and threats of violence, helping organizations ensure a safe workplace by flagging harmful communication.
• C. Communication Compliance identifies communications that may breach legal or regulatory requirements, such as insider trading or other regulated-content violations, by monitoring keywords and data patterns.
• D. Malware detection in email attachments is a function of Microsoft Defender for Office 365, not Communication Compliance, which focuses on policy violations within the text and context of communication.
• E. DDoS attacks are network-level security threats. These are mitigated by services like Azure DDoS Protection rather than communication compliance tools.
• F. Unauthorized firewall changes are infrastructure and configuration security events. These would be monitored via security logs and SIEM solutions like Microsoft Sentinel, not Purview Communication Compliance.

Correct answer: A — Data Loss Prevention (DLP)

• A. Correct. Data Loss Prevention (DLP) is the primary Microsoft Purview tool designed to identify, monitor, and automatically protect sensitive information (such as credit card numbers, PII, or internal-only files). DLP policies allow organizations to block or warn users when they attempt to share this data with external parties across services like Exchange, SharePoint, OneDrive, and Teams.
• B. Incorrect. Insider Risk Management focuses on identifying and mitigating risky behaviors from within the organization, such as intellectual property theft or security policy violations by employees. While it monitors for data exfiltration, it is a behavioral analysis tool rather than a real-time prevention mechanism for sensitive data sharing with external parties.
• C. Incorrect. Communication Compliance is used to detect, capture, and act on inappropriate messages within an organization, such as harassment, offensive language, or regulatory compliance violations (e.g., in financial services). It is not the primary tool for preventing the leakage of sensitive data to external parties.

Correct answer: B — Copilot will state that it cannot find or access the document.

• A. Incorrect. Microsoft 365 Copilot adheres strictly to the user's existing permissions and will not access or summarize content that the user does not have permission to read. It does not perform automatic redaction of keywords to bypass access controls.
• B. Correct. Copilot respects the Microsoft 365 security model and SharePoint permissions. If a user lacks read permissions for a specific file, Copilot cannot retrieve or process that file, and it will respond by stating it cannot find or access the document.
• C. Incorrect. Copilot does not automate access requests or interact with SharePoint permission workflows on the user's behalf. Access must be granted through standard Microsoft 365 sharing and permission management tools.
• D. Incorrect. Copilot only utilizes data the user is authorized to access. It will not use metadata to circumvent permission settings or provide a partial summary of a restricted document.

Correct answers: A, B, D — Implement Microsoft Purview Sensitivity Labels.; Conduct access reviews to ensure least privilege in SharePoint.; Apply Data Loss Prevention (DLP) policies.

• A. Correct. Microsoft Purview Sensitivity Labels help classify and protect sensitive content by enforcing appropriate access and usage policies. Since Copilot respects these labels, they are a critical component in ensuring it only surfaces data that users are authorized to see.
• B. Correct. Microsoft 365 Copilot respects existing user permissions (following the principle of least privilege). Conducting access reviews in SharePoint reduces the risk of oversharing and ensures that users—and by extension, Copilot—cannot access sensitive information they are not supposed to see.
• C. Incorrect. Enabling public link sharing for internal documents increases the risk of data leakage and unauthorized access, making it more difficult to control what information Copilot might surface to users.
• D. Correct. Data Loss Prevention (DLP) policies are used to identify and protect sensitive information across the Microsoft 365 ecosystem. These policies act as a safeguard to prevent the unauthorized sharing or distribution of sensitive data processed or generated by Copilot.
• E. Incorrect. Disabling Multi-Factor Authentication (MFA) significantly weakens the organization's security posture and increases the risk of unauthorized account access, which could lead to sensitive data being exposed via Copilot.
• F. Incorrect. Storing data on local, unencrypted drives bypasses the centralized governance and protection features of Microsoft 365, making the data unmanageable and vulnerable to physical theft or loss.

Correct answer: A — Microsoft Entra ID and M365

• A. Correct. Copilot for Microsoft 365 leverages existing permissions and security settings established in Microsoft Entra ID (formerly Azure Active Directory) and Microsoft 365. It respects the same data access boundaries that apply to other Microsoft 365 services, ensuring that users only interact with content they are already authorized to see.
• B. Incorrect. The public internet is an external network and does not hold internal organizational permissions or access control configurations for Microsoft 365 data.
• C. Incorrect. While Copilot utilizes large language models, data access controls are not configured or enforced on OpenAI's infrastructure. Copilot respects Microsoft 365 security boundaries and uses tenant data permissions to govern access.

Correct answer: B — False

• A. The statement is false because Microsoft Graph indexes internal organizational data within a Microsoft 365 tenant—such as documents, emails, chats, and calendar events—to provide relevant context for Copilot responses.
• B. The statement is false because Microsoft Graph is designed to surface private organizational content and user context; grounding in public internet data is typically handled by Bing Search integration rather than the Graph.

Correct answer: B — Content Explorer

• A. Activity Explorer is used to monitor historical activities and events related to sensitive data, such as when labels are applied, changed, or removed. It provides a log of actions rather than a tool for browsing the actual file content.
• B. Content Explorer is the specific tool within Microsoft Purview's data classification framework that allows administrators (with the correct permissions, such as the Content Explorer Content Viewer role) to browse and inspect the actual source content of files identified as containing sensitive information. This is essential for verifying classification accuracy and reviewing data in context.
• C. Compliance Manager is a risk assessment tool used to track regulatory compliance posture, manage improvement actions, and provide a compliance score. It does not provide the capability to browse or inspect individual file contents.
• D. Insider Risk Management focuses on detecting, investigating, and mitigating potentially malicious or unintentional risky activities by users within an organization. It does not serve as a general-purpose tool for browsing the content of sensitive files.

Correct answer: B — Insider Risk Management

• A. Communication Compliance is used to monitor, detect, and act on inappropriate or risky messages within an organization, such as harassment or the sharing of sensitive information in Teams or Outlook. It is focused on the content of communications rather than monitoring bulk data downloads or movement.
• B. Insider Risk Management is specifically designed to identify and act on risky user behaviors, such as data exfiltration by departing employees. It can leverage signals from HR connectors (like resignation submissions) and monitor data movement patterns (like bulk downloads) to detect potential threats before an employee leaves.
• C. Microsoft Purview eDiscovery is used to search, preserve, and export content for legal cases and internal investigations. While it can be used to gather evidence after an incident has occurred, it is not a proactive monitoring or detection tool for behavioral risks.
• D. Data Lifecycle Management focuses on the retention and deletion of data to meet compliance and regulatory requirements. It manages how long data is kept and when it is disposed of, but it does not analyze user behavior or detect unauthorized downloads.

Correct answer: A — Content search

• A. Correct. Content search in the Microsoft Purview compliance portal is the designated tool for searching mailbox and other Microsoft 365 content. It allows you to filter by keywords (like 'Project X'), specific senders, and date ranges to locate and export content for legal discovery or internal investigations.
• B. Incorrect. Activity Explorer is used to monitor user and system activities related to data protection and governance policies, such as the application of sensitivity labels or data loss prevention (DLP) events. It cannot be used to search the body of emails for specific keywords.
• C. Incorrect. Compliance Manager is a dashboard used to track, manage, and assess your organization's overall compliance posture and scores relative to regulatory frameworks. It does not provide the functionality to search or retrieve specific email messages.
• D. Incorrect. Communication Compliance is a tool used to detect and remediate policy-violating communications (such as harassment or insider risk threats). While it inspects communications, it is not the standard tool for performing ad-hoc content discovery for legal requests based on keywords and date ranges.

Correct answers: A, B, D — View the event details and sensitive data matched; Change the alert status (e.g., Active, Dismissed); Download the original file that triggered the alert

• A. Correct. Viewing the event details and the specific sensitive information types (SITs) that matched the DLP policy is a core functionality. This allows investigators to see exactly why the content was flagged and which specific strings or patterns triggered the alert.
• B. Correct. Managing the lifecycle of an alert is part of the standard triaging workflow. Administrators can change the alert status to Active, Investigating, Dismissed, or Resolved within the Microsoft Purview compliance portal.
• C. Incorrect. Formatting a user's hard drive is a destructive hardware action and is not a feature of Microsoft Purview DLP. DLP focuses on monitoring, alerting, and enforcing data policies, not remote device destruction.
• D. Correct. Provided the investigator has the necessary permissions (such as the Data Classification Content Viewer role), they can download the original file or item associated with the alert to conduct a deeper forensic review of the violation.
• E. Incorrect. Employment termination is a legal and human resources process. While a DLP violation may lead to disciplinary action, the compliance portal does not have the capability to automatically terminate contracts.

Correct answers: A, C — Summarizing action items from a Microsoft Teams meeting; Drafting email responses in Microsoft Outlook based on recent threads

• A. Summarizing action items from a Microsoft Teams meeting is a core native capability of Microsoft 365 Copilot. It leverages built-in integrations with Microsoft Teams and meeting transcripts to provide summaries and track action items automatically without any additional configuration or custom agents.
• B. Interacting with third-party proprietary systems for complex workflows is not a native feature of Microsoft 365 Copilot. This functionality typically requires building custom agents or using Graph/Power Platform connectors to bridge the gap between Microsoft 365 and external systems.
• C. Drafting email responses in Microsoft Outlook based on context from recent threads is a built-in productivity feature of Microsoft 365 Copilot. It uses the LLM's access to the Microsoft Graph to understand the user's communication history and generate relevant drafts natively.
• D. Automated procurement from external vendors is a transactional external workflow. It would require specialized custom agents, connectors, or API integrations to communicate with the vendor's external system, as it is not part of the standard Microsoft 365 productivity suite.
• E. Managing Azure infrastructure is the domain of Microsoft Copilot for Azure. While Microsoft 365 Copilot is broad, infrastructure deployment tasks for Azure virtual machines are not natively built into the Microsoft 365 specific Copilot interface and would require specialized administrative tools or integrations.

Correct answer: A — Semantic Index

• A. Correct. The Semantic Index for Microsoft 365 is a key architectural component that works alongside the Microsoft Graph. It creates a sophisticated map of data (emails, chats, and documents) to enable the LLM to provide contextually relevant and grounded responses based on user-specific content.
• B. Incorrect. While Azure SQL Database is a cloud-based relational database, it is not a core component used by Microsoft 365 Copilot for retrieval-augmented generation from within the Microsoft 365 ecosystem.
• C. Incorrect. Power Automate Desktop is a tool used for Robotic Process Automation (RPA) to automate UI-based tasks. It does not play a role in the primary indexing or grounding process of Copilot's personalized responses.

Correct answer: A — Azure subscription

• A. Correct. Enabling pay-as-you-go (PAYG) billing for advanced Microsoft 365 services, such as SharePoint Premium (which includes AI and Copilot-driven features), requires linking the Microsoft 365 tenant to an active Azure subscription. This provides the necessary billing infrastructure for metered usage.
• B. Incorrect. A Power Platform environment is a container for apps, flows, and agents. While an environment can be configured for pay-as-you-go usage, the billing itself is enabled by linking that environment (or the tenant) to an Azure subscription, not the other way around.
• C. Incorrect. Dynamics 365 is a suite of business applications. It is not used as the billing or governance foundation for enabling pay-as-you-go features within SharePoint or the broader Microsoft 365 ecosystem.

Correct answer: A — Analyst

• A. Correct. The Analyst agent is specifically designed to work with structured data, making it the primary choice for querying databases, performing mathematical calculations, and generating charts. This agent is tailored for tasks requiring quantitative data analysis and visualization.
• B. Incorrect. The Researcher agent is optimized for gathering, discovering, and synthesizing information from various qualitative sources and documentation. It is not the agent optimized for querying structured numerical data or chart creation.
• C. Incorrect. The Creator agent is focused on generating creative content, such as text, images, and other multimedia assets. It is not specialized for data analysis or performing mathematical tasks.

Correct answer: B — Publish the agent

• A. Incorrect. Exporting a solution is typically used to move the agent between different environments (such as development to production) or for backup purposes. It does not make the latest changes active for end-users to interact with.
• B. Correct. In Copilot Studio, you must publish the agent so that the latest changes and topics become active and available to users. Without publishing, users in Microsoft Teams will continue to interact with the previously published version or will not see the agent at all if it is new.
• C. Incorrect. Assigning the System Administrator role is related to administrative permissions within the Power Platform environment and does not trigger the deployment or activation of agent updates for end-users.
• D. Incorrect. Deleting default topics is an optional part of the content design process and is not a requirement for deploying or making the agent available to users in Teams.

Correct answers: A, B, C — Total billed sessions; Environment database capacity; Active environments

• A. Correct. Total billed sessions are the primary usage metric for agents (Microsoft Copilot Studio). This metric is tracked in the Power Platform admin center to help administrators monitor consumption and billing.
• B. Correct. Environment database capacity is a fundamental administrative metric in the Power Platform admin center, allowing administrators to monitor storage usage (Dataverse database, file, and log) across their environments.
• C. Correct. The Power Platform admin center provides an inventory and status of all environments, allowing administrators to monitor the number and state of active environments within the tenant.
• D. Incorrect. Document editing activity in Microsoft Word is monitored through Microsoft 365 usage reports or audit logs, not the Power Platform admin center.
• E. Incorrect. Exchange mailbox sizes are managed and monitored through the Exchange Admin Center or the Microsoft 365 Admin Center, not the Power Platform admin center.
• F. Incorrect. SharePoint site storage is monitored in the SharePoint Admin Center. While Power Platform agents may interact with SharePoint, its storage metrics are not native to the Power Platform admin center's environment capacity reports.

Correct answer: B — Power Platform

• A. Incorrect. The Microsoft 365 admin center is used for managing Microsoft 365 services, users, licenses, and general tenant settings. While it provides high-level billing for licenses, it does not provide the specific detailed analytics required to view billed sessions for individual custom agents.
• B. Correct. The Power Platform admin center is the centralized location for managing and monitoring Power Platform resources, including Copilot Studio (formerly Power Virtual Agents). It provides tenant-level analytics and capacity reports that include the total number of billed sessions for custom agents.
• C. Incorrect. The Microsoft Teams admin center focuses on Teams-specific administration such as meeting policies, messaging, and app availability. While custom agents are often deployed within Teams, the actual usage analytics and billed-session reporting are managed via the Power Platform infrastructure.

Correct answer: A — Pay-as-you-go billing

• A. Pay-as-you-go billing for Copilot allows organizations to use an Azure subscription to pay for usage based on monthly active users. This is specifically designed for scenarios where companies need flexibility for temporary staff or have reached their prepaid seat limit without wanting to commit to additional annual licenses.
• B. An Enterprise Agreement (EA) true-up is an annual reconciliation process where an organization reports its actual license usage to Microsoft. While it accounts for growth, it is a formal contract mechanism rather than a flexible billing policy for temporary access, and it typically leads to an annual commitment for the seats added.
• C. Reserved instances are a purchasing model for cloud infrastructure services, such as virtual machines or SQL databases, where you commit to a term to receive a discount. They are not applicable to seat-based software licensing like Microsoft Copilot.
• D. Spot pricing refers to the ability to purchase unused Azure compute capacity at a lower price for workloads that can be interrupted. It is an infrastructure cost-saving measure and has no relevance to Copilot licensing.

Correct answer: A — 24 to 48 hours

• A. Correct. Microsoft 365 usage reports, including Copilot usage data, typically have a processing latency of 24 to 48 hours. This time is required to aggregate activity data across all Microsoft 365 services and tenants.
• B. Incorrect. A refresh rate of 5 to 10 minutes is associated with real-time monitoring, whereas Microsoft 365 admin center usage reports are aggregated over longer periods and are not near-real-time.
• C. Incorrect. 1 to 2 hours is too frequent for the standard processing window used for Microsoft 365 usage reports, which usually lag by at least a day.
• D. Incorrect. A 7-day refresh rate is too infrequent. While the reports allow you to view data over 7, 30, 90, or 180 days, the data itself is updated daily with a 24-48 hour delay.

Correct answers: A, B, C — Save; Share; Delete

• A. Correct. Users can save prompts to 'My prompts' within Copilot Lab. This allows them to store and reuse effective prompts across various Microsoft 365 applications for future sessions, enhancing productivity and consistency.
• B. Correct. Copilot Lab enables users to share prompts with others. This feature facilitates collaboration and allows team members to distribute useful prompt patterns and best practices across the organization.
• C. Correct. Users can manage their personalized prompt library by deleting prompts that are no longer needed. This helps maintain an organized and relevant collection of prompts.
• D. Incorrect. Compiling is a programming process. Copilot Lab is a platform for managing and discovering natural language prompts, and it does not offer a functionality to compile code or scripts.
• E. Incorrect. While Microsoft 365 provides enterprise-grade security for data, there is no specific 'Encrypt' action available to users for individual prompts within the Copilot Lab interface.