AB-900 Copilot & Agent Administration Fundamentals

Compare traditional AI with generative AI, showing how prompts and data sources enable Claude to output code, text, or images.

Explore retrieval augmented generation (rag), which retrieves real-time information from sources like Python docs, GitHub, and Reddit, augments the ai's knowledge, and generates improved responses to reduce hallucinations.

Learn core concepts of prompting and prompt engineering to reduce hallucinations, improve accuracy and efficiency, by giving AI a role, task, context, input data, and explicit output format.

Differentiate Adjentic AI from GenAI by highlighting autonomous task execution. Demonstrate examples like autonomous coding agents, end-to-end ticket resolution, and multi-agent workflow automation.

Discover how M365 Copilot integrates with Word, Excel, Outlook, Teams and more to boost productivity, using Microsoft Graph grounding and robust compliance checks for smarter, safer prompts.

Differentiate the three copilot licenses—free consumer Microsoft Co-Pilot, Microsoft 365 base, and Microsoft 365 Co-Pilot add-on—focusing on chat, web and work data access, and admin controls.

Discover how to assign the correct Copilot licenses in your Microsoft 365 environment, including basic licenses and add-ons, with prerequisites like E3/E5, via the admin center and licenses marketplace.

Discover how to use Copilot in Word, via pencil prompts and the right-side chat, to draft a cybersecurity engineer job description with five years' experience, CISSP, Azure, Python, and PowerShell.

Create your own agents in M365 Copilot by selecting a template like career coach, configuring name, instructions, and knowledge sources, then create and interact with the agent.

Explore the Microsoft AI services landscape, detailing the CoPilot bundle, built-in versus standalone experiences, CoPilot Studio for low-code agent creation, and Foundry's developer-facing AI workloads.

Explore the Azure global backbone, detailing global regions, region pairs, and availability zones that support low latency, disaster recovery, and data residency for Azure resources.

Explore the Azure resource hierarchy, including root and nested management groups, subscriptions, resource groups, and resources, and learn how governance, inheritance, and Azure policy enable secure, cost-effective, scalable deployments.

Explore Azure subscription types, including free credits for 30 days, 12 months of free services, student options, pay-as-you-go, and enterprise agreements, with guidance on common choices for learning.

Explore the Azure resource hierarchy and set up your environment by managing management groups, subscriptions, and resource groups, including creating, renaming, moving, and deleting elements.

Create a budget tied to your subscription in Azure cost management, choose a monthly billing period, and set alerts for actual or forecasted spend without stopping resources.

Manage licenses in the M365 admin center to control access to apps and services. Use groups to scale licensing and assign or remove licenses as members join or leave.

Explore how to identify and configure Exchange Online objects, including mailboxes, groups, distribution lists, mail flow rules, resources, and contacts in the admin center.

Explore the Microsoft Teams admin center to create and manage teams, apply policies, configure email and file storage integrations, manage devices like Surface Hub, and enforce security with Teams policies.

Apply Microsoft's zero trust principles: assume breach, verify explicitly, and use least privilege to architect systems that minimize implicit trust and prevent lateral movement.

Block phishing with Defender for Office 365 and protect endpoints with Defender for Endpoint. Defend identities with Defender for Identity and monitor data exfiltration with Defender for CloudApps, Defender XDR.

Understand identity and access management (IAM) and how it provides the right access to the right resources at the right time. Explore human and machine identities, authentication, and authorization.

Understand how authorization determines access after authentication, through role-based access control and an identity provider, with multi-factor authentication, for resources like virtual machines and SQL databases in Azure.

Describe a modern identity architecture with EnterID as the identity provider, outlining how on-premises Active Directory synchronizes with EnterID to support authentication, authorization, and RBAC with Azure RBAC.

Explore Microsoft Entra ID as a cloud-based identity and access management solution, covering access reviews, B2B/B2C, conditional access, device management, MFA, PIM, and identity protection.

Explore the full range of Microsoft Entra ID identity types, from human and internal identities to machine, device, and workload identities, including B2B/B2C collaboration.

Explore how Microsoft Android ID manages user identities across cloud and on-premises, with synchronized, cloud, and guest identities, plus MFA and passwordless authentication trends.

Use managed identities to grant Azure resources access without credentials. Two types exist: system-assigned identities tied to a resource and user-assigned identities that can serve multiple resources.

Configure a security group in Entra.id by creating it, naming and describing, selecting membership type, assigning an owner and members, and setting Azure role assignments.

Explore Azure rbac and how role assignments grant access to resources. See how scope and role definitions control access to container apps, function apps, Cosmos DB, and Azure Sentinel.

Configure a linux azure virtual machine with a system assigned managed identity and assign it storage account contributor at the subscription level.

Learn Entra ID multi-factor authentication and distinguish multi-factor authentication by pairing something you know with something you have or you are, and favor passwordless methods like Windows Hello or Fido2.

Configure multi-factor authentication in Entra ID by enabling or disabling authentication methods such as passkeys (FIDO2) and SMS, set per-user MFA, and save policies.

Walk through passwordless authentication with Windows Hello for Business using EntraID, a nonce, and the TPM to achieve secure single sign-on across applications while transitioning from passwords to passwordless deployment.

Discover how single sign-on in the Microsoft ecosystem authenticates once via EntraID and EntraConnect, enabling access to multiple applications like Dropbox and Salesforce.

Configure Entra conditional access policies by creating an Office 365 policy with user and sign-in risk conditions, MFA, device compliance, and hybrid join; test in report-only mode before enabling.

Discover Entra ID Protection, a real-time identity risk service that monitors sign-ins for user and sign-in risks, integrates with conditional access and Sentinel, and flags alerts like atypical travel.

Explore Entra ID protection to monitor identity risk on the dashboard and link protection with conditional access by configuring user and sign-in risk policies.

Create a conditional access policy from templates by selecting a category such as secure foundation or zero trust, then review, customize user roles, download JSON, and test in report-only mode.

Register your application in the Entra.id tenant. Authenticate with a secret or a certificate to access resources, with conditional access across on-premises, Azure, or other clouds.

Create an app registration in EntraID, choose account types, configure a redirect URI and authentication endpoint, and note the resulting client ID and object ID.

Explore data security as a cybersecurity subset, protecting sensitive data through its lifecycle with access control, authentication, encryption, backups, data loss prevention, and insider risk management.

Discover Microsoft Purview's three pillars—data security, data governance, and risk and compliance—providing integrated visibility, DLP, encryption, and e-discovery across on-premises, multi-cloud, and SaaS data.

Access the Purview portal at purview.microsoft.com, explore the new portal, and learn that all course demos use it for coming years, with an option to switch to the legacy portal.

Explore sensitive information types in Microsoft Purview, including manual, pattern-based, and machine learning classifications, and learn SIT structure and use in data loss prevention and auto-labeling.

Identify how sensitivity labels in Microsoft Purview classify and protect data across Office apps with encryption and content markings, Defender for Cloud Apps, eDiscovery, Teams, SharePoint, Power BI.

Configure sensitivity label policies in Purview by publishing labels to Office apps, setting the scope, and applying default labels to documents, emails, and services like Fabric and Power BI.

Configure EntraID administrative units to restrict roles to specific regions, cluster users, devices, and security groups, and control scope with a P1 license.

Publish a 10-year retention label in Purview by configuring a label policy with a Seattle adaptive scope for exchange mailboxes and OneDrive accounts.

Explore how the Microsoft Graph API grounds Copilot responses by checking user identity, devices, installed apps, and organization data to curate context and enforce access controls.

Identify compliance risks across multi-cloud by using Microsoft Purview Compliance Manager, which provides pre-built assessments, workflow-driven risk evaluations, and guided improvement actions.

Configure insider risk management in Microsoft Purview by applying recommendations, turning on auditing and analytics, creating policies with HR data connectors, and tuning alerts for detection and Defender XDR integration.

Explore data loss prevention in Microsoft Purview, where DLP policies use deep content analysis to identify, monitor, and automatically protect sensitive data across Microsoft 365 services and on-premises environments.

Discover how Purview communication compliance detects regulatory and corporate policy violations, protects sensitive information, and supports risk management with privacy by design, role-based access control, and audit logs.