AB-900 Copilot & Agent Administration Fundamentals

Compare traditional AI with generative AI, showing how prompts and data sources enable Claude to output code, text, or images.

Learn how large language models work by predicting the next token, not knowledge, trained on public sources, and processed by neural networks and transformers to generate responses.

Explore retrieval augmented generation (rag), which retrieves real-time information from sources like Python docs, GitHub, and Reddit, augments the ai's knowledge, and generates improved responses to reduce hallucinations.

Learn core concepts of prompting and prompt engineering to reduce hallucinations, improve accuracy and efficiency, by giving AI a role, task, context, input data, and explicit output format.

Differentiate Adjentic AI from GenAI by highlighting autonomous task execution. Demonstrate examples like autonomous coding agents, end-to-end ticket resolution, and multi-agent workflow automation.

Discover how M365 Copilot integrates with Word, Excel, Outlook, Teams and more to boost productivity, using Microsoft Graph grounding and robust compliance checks for smarter, safer prompts.

Differentiate the three copilot licenses—free consumer Microsoft Co-Pilot, Microsoft 365 base, and Microsoft 365 Co-Pilot add-on—focusing on chat, web and work data access, and admin controls.

Discover how to assign the correct Copilot licenses in your Microsoft 365 environment, including basic licenses and add-ons, with prerequisites like E3/E5, via the admin center and licenses marketplace.

Learn how to obtain an E5 trial license and assign it to a user to access Defender XDR features based on Microsoft E5.

Explore the enterprise M365 Co-Pilot by signing in with a Microsoft account, selecting work, prompting with gallery prompts like explain blockchain in simple terms, and using agents.

Discover how to use Copilot in Word, via pencil prompts and the right-side chat, to draft a cybersecurity engineer job description with five years' experience, CISSP, Azure, Python, and PowerShell.

Draft emails with Copilot in Outlook by using the draft prompt, then rewrite or coach the text to adjust tone and length.

Create your own agents in M365 Copilot by selecting a template like career coach, configuring name, instructions, and knowledge sources, then create and interact with the agent.

Explore the Microsoft AI services landscape, detailing the CoPilot bundle, built-in versus standalone experiences, CoPilot Studio for low-code agent creation, and Foundry's developer-facing AI workloads.

Understand Microsoft's AI principles—fairness, reliability and safety, privacy and security, inclusiveness, transparency, accountability—and how they cover prompt injections and identify measure mitigate operate cycle for Co-Pilot, Co-Pilot Studio, and Boundary.

Explore the Azure global backbone, detailing global regions, region pairs, and availability zones that support low latency, disaster recovery, and data residency for Azure resources.

Discover Azure regions, data centers, and the global backbone, with insights on availability zones, pad regions, and geography. Filter regions by GDPR, HIPAA, PCI DSS, and other standards for compliance.

Explore the Azure resource hierarchy, including root and nested management groups, subscriptions, resource groups, and resources, and learn how governance, inheritance, and Azure policy enable secure, cost-effective, scalable deployments.

Explore Azure subscription types, including free credits for 30 days, 12 months of free services, student options, pay-as-you-go, and enterprise agreements, with guidance on common choices for learning.

Entra ID tenants provide identity services for human and managed identities and application registrations with Azure resource access. They are not bound to Azure, and Entra ID offers admin portal.

Create your azure subscription using the free option, sign in with a Microsoft account, and understand 12 months of popular services, 55 always free services, and 200 USD credit.

Explore the Azure resource hierarchy and set up your environment by managing management groups, subscriptions, and resource groups, including creating, renaming, moving, and deleting elements.

Create a budget tied to your subscription in Azure cost management, choose a monthly billing period, and set alerts for actual or forecasted spend without stopping resources.

Manage licenses in the M365 admin center to control access to apps and services. Use groups to scale licensing and assign or remove licenses as members join or leave.

Explore how to configure your M365 tenant from the admin center, including domains, search and intelligence, branding, directory synchronization, Teams, MFA, backups, and integrated apps.

Explore how to identify and configure Exchange Online objects, including mailboxes, groups, distribution lists, mail flow rules, resources, and contacts in the admin center.

explore how to configure SharePoint Online via the M365 admin center, create team or communication sites using templates, manage active and deleted sites, and set sharing and access control policies.

Explore the Microsoft Teams admin center to create and manage teams, apply policies, configure email and file storage integrations, manage devices like Surface Hub, and enforce security with Teams policies.

Apply Microsoft's zero trust principles: assume breach, verify explicitly, and use least privilege to architect systems that minimize implicit trust and prevent lateral movement.

Get a clear overview of Microsoft security operations, including Defender XDR and Defender for Cloud, unified in security.microsoft.com for on-premises and multi-cloud environments.

discover how cyber threat intelligence uses telemetry from Microsoft products to identify bad actors, IOCs, and TTPs, and how Mystic, MSRC, and the DCU translate insights into Defender XDR.

Block phishing with Defender for Office 365 and protect endpoints with Defender for Endpoint. Defend identities with Defender for Identity and monitor data exfiltration with Defender for CloudApps, Defender XDR.

Understand identity and access management (IAM) and how it provides the right access to the right resources at the right time. Explore human and machine identities, authentication, and authorization.

Explain how authentication verifies who you are before granting access, using passwords, biometrics, and one-time passwords, with multi-factor authentication providing a second factor, and authentication always occurring before authorization.

Understand how authorization determines access after authentication, through role-based access control and an identity provider, with multi-factor authentication, for resources like virtual machines and SQL databases in Azure.

Describe a modern identity architecture with EnterID as the identity provider, outlining how on-premises Active Directory synchronizes with EnterID to support authentication, authorization, and RBAC with Azure RBAC.

Explore Microsoft Entra ID as a cloud-based identity and access management solution, covering access reviews, B2B/B2C, conditional access, device management, MFA, PIM, and identity protection.

Explore the full range of Microsoft Entra ID identity types, from human and internal identities to machine, device, and workload identities, including B2B/B2C collaboration.

Explore how Microsoft Android ID manages user identities across cloud and on-premises, with synchronized, cloud, and guest identities, plus MFA and passwordless authentication trends.

Use managed identities to grant Azure resources access without credentials. Two types exist: system-assigned identities tied to a resource and user-assigned identities that can serve multiple resources.

Explore Enter ID roles for scalable role-based access control across Microsoft environments by assigning roles like Teams administrator, security administrator, and global reader to individuals and groups.

Explore how Entra ID groups streamline access control by assigning roles to groups rather than individuals, enabling scalable administration, RBAC, and automation with dynamic memberships and self-service.

Configure a security group in Entra.id by creating it, naming and describing, selecting membership type, assigning an owner and members, and setting Azure role assignments.

Explore Azure rbac and how role assignments grant access to resources. See how scope and role definitions control access to container apps, function apps, Cosmos DB, and Azure Sentinel.

Configure user identities in the Azure portal, create users with principal and display names, and assign intro ID role and Azure RBAC roles such as virtual machine contributor.

Configure a linux azure virtual machine with a system assigned managed identity and assign it storage account contributor at the subscription level.

Explore authentication methods in Entra.id, from passwords and SMS to passwordless options like Windows Hello for Business, FIDO2 keys, and certificate-based authentication, with MFA and self-service password reset (SSPR) considerations.

Learn Entra ID multi-factor authentication and distinguish multi-factor authentication by pairing something you know with something you have or you are, and favor passwordless methods like Windows Hello or Fido2.

Configure multi-factor authentication in Entra ID by enabling or disabling authentication methods such as passkeys (FIDO2) and SMS, set per-user MFA, and save policies.

Walk through passwordless authentication with Windows Hello for Business using EntraID, a nonce, and the TPM to achieve secure single sign-on across applications while transitioning from passwords to passwordless deployment.

Configure passwordless authentication in EntraID using Microsoft Authenticator app, enable number matching to fight MFA fatigue and phishing, and manage targets, geographic location, and Windows Hello for Business via Intune.

Discover how single sign-on in the Microsoft ecosystem authenticates once via EntraID and EntraConnect, enabling access to multiple applications like Dropbox and Salesforce.

Learn how conditional access enforces access control during authentication by evaluating signals like location, device compliance, and risk levels, and apply policies with MFA to enable zero-trust access.

Configure Entra conditional access policies by creating an Office 365 policy with user and sign-in risk conditions, MFA, device compliance, and hybrid join; test in report-only mode before enabling.

Discover Entra ID Protection, a real-time identity risk service that monitors sign-ins for user and sign-in risks, integrates with conditional access and Sentinel, and flags alerts like atypical travel.

Explore Entra ID protection to monitor identity risk on the dashboard and link protection with conditional access by configuring user and sign-in risk policies.

Create a conditional access policy from templates by selecting a category such as secure foundation or zero trust, then review, customize user roles, download JSON, and test in report-only mode.

Explain how privileged identity management (PIM) in Entra.id enables just in time, time-bound access to privileged roles with approvals and MFA. Highlight auditing, notifications, and break-glass controls to secure identities.

Configure Microsoft Entra Privileged Identity Management (PIM) to manage eligible and active role assignments, activate just-in-time access, and route requests through approvals with MFA and conditional access.

Register your application in the Entra.id tenant. Authenticate with a secret or a certificate to access resources, with conditional access across on-premises, Azure, or other clouds.

Create an app registration in EntraID, choose account types, configure a redirect URI and authentication endpoint, and note the resulting client ID and object ID.

Explore data security as a cybersecurity subset, protecting sensitive data through its lifecycle with access control, authentication, encryption, backups, data loss prevention, and insider risk management.

Discover Microsoft Purview's three pillars—data security, data governance, and risk and compliance—providing integrated visibility, DLP, encryption, and e-discovery across on-premises, multi-cloud, and SaaS data.

Access the Purview portal at purview.microsoft.com, explore the new portal, and learn that all course demos use it for coming years, with an option to switch to the legacy portal.

Learn role-based access control for Purview in the M365 admin portal, including Entra ID roles, role assignments, and permissions, plus how compliance roles compare.

Explore sensitive information types in Microsoft Purview, including manual, pattern-based, and machine learning classifications, and learn SIT structure and use in data loss prevention and auto-labeling.

Explore Purview's sensitive information types and the information protection classifiers. Learn about Microsoft predefined types, such as SSN and API keys, plus pattern details and proximity.

Identify how sensitivity labels in Microsoft Purview classify and protect data across Office apps with encryption and content markings, Defender for Cloud Apps, eDiscovery, Teams, SharePoint, Power BI.

Configure sensitivity labels in Purview, including creating top secret with highest priority, defining scope for files, emails, and meetings, and enabling access control, content marking, and auto labeling.

Configure sensitivity label policies in Purview by publishing labels to Office apps, setting the scope, and applying default labels to documents, emails, and services like Fabric and Power BI.

Configure auto-labeling policies in Microsoft Purview to automatically apply sensitivity labels to email, OneDrive, and SharePoint files containing US financial data such as credit cards and account information.

Learn how Purview uses retention labels and retention label policies to retain or delete content across sites and mailboxes, using a hybrid approach with item-level control and trainable classifiers.

Create a 10 year retention label in the Purview data lifecycle management portal, set start on item creation, retain for 10 years, and publish to all m365 locations.

Configure EntraID administrative units to restrict roles to specific regions, cluster users, devices, and security groups, and control scope with a P1 license.

Configure adaptive scopes to apply retention or compliance policies to specific users or SharePoint sites by linking an Entra ID administrative unit and defining Seattle-based attributes.

Publish a 10-year retention label in Purview by configuring a label policy with a Seattle adaptive scope for exchange mailboxes and OneDrive accounts.

Configure an auto labeling policy in Purview by selecting sensitive information types, adding keyword conditions, choosing where to apply (Exchange mailboxes, SharePoint, OneDrive, M365), and testing before activation.

Explore how the Microsoft Graph API grounds Copilot responses by checking user identity, devices, installed apps, and organization data to curate context and enforce access controls.

Understand how Copilot enforces permissions and privacy in Microsoft 365 through graph grounding, purview controls, sensitivity labels, and data loss prevention, while EU boundaries and encryption protect data.

Identify compliance risks across multi-cloud by using Microsoft Purview Compliance Manager, which provides pre-built assessments, workflow-driven risk evaluations, and guided improvement actions.

Assess insider risk management in Purview to define policies, detect, investigate, and act on internal threats like data leakage, IP theft, and compliance violations.

Configure insider risk management in Microsoft Purview by applying recommendations, turning on auditing and analytics, creating policies with HR data connectors, and tuning alerts for detection and Defender XDR integration.

Explore data loss prevention in Microsoft Purview, where DLP policies use deep content analysis to identify, monitor, and automatically protect sensitive data across Microsoft 365 services and on-premises environments.

Configure DLP policies in Microsoft Purview by editing default policies. Protect US financial data, including credit card and bank numbers, with policy tips and alerts.

Discover how Purview communication compliance detects regulatory and corporate policy violations, protects sensitive information, and supports risk management with privacy by design, role-based access control, and audit logs.