AB-900 Certification Exam Guide + Practice Questions

Explanation:
The correct answer is View all the users in the Microsoft Entra tenant. In the exhibit, John is assigned the Global Reader role. Microsoft documents that the Global Reader role is intended for users who need to view administrator features and settings in admin centers that a Global Administrator can view, but without edit permissions. That makes it appropriate for read-only visibility into tenant-wide directory and admin information, including users in Microsoft Entra.
The other answer choices are not supported by the Global Reader role. Microsoft distinguishes admin-center visibility from access to content in workloads such as SharePoint sites and Exchange mailboxes. Global Reader is a read-only administrative role, not a content access role for reading all documents or mailbox items. Likewise, performing eDiscovery of Microsoft 365 Copilot prompts requires Purview eDiscovery permissions or role group membership, not merely the Global Reader role. Microsoft documents eDiscovery permissions separately in Purview role groups.
Therefore, based on the assigned role shown, the valid completion is that John can view all the users in the Microsoft Entra tenant.

Explanation:
The correct answer is eDiscovery. In Microsoft Purview, eDiscovery is the solution used to search for content and export copies of that content from Microsoft 365 locations such as SharePoint and OneDrive. Microsoft Learn states that when you export search results from eDiscovery, copies of native Office documents and other documents are exported. That directly matches the requirement to provide HR with a copy of files.
By contrast, Audit is primarily used to investigate user and admin activity records and can export those audit records to CSV, but it does not export the actual files themselves. Audit would help identify that User1 modified files, but the question asks for copies of the recent files modified by User1, which is an eDiscovery content search and export scenario rather than an activity-log reporting scenario.
So, among the Microsoft Purview solutions shown, the appropriate selection is eDiscovery because it is the Purview tool designed to find and export the actual content items HR wants to receive.

Explanation:
The correct selections are No, Yes, Yes. Statement 1 is No because Microsoft documents that Agent Builder in Microsoft 365 Copilot is included with the Microsoft 365 Copilot license, and agents built with that feature are part of that licensed experience. Microsoft also states that the capability is enabled by default in Microsoft 365 Copilot licensed tenants. While Copilot Chat users with qualifying Microsoft 365 licenses can access web-grounded chat experiences, creating Microsoft 365 Copilot agents in the app is documented under the Copilot-licensed Agent Builder experience, not as an E5-only entitlement.
Statement 2 is Yes because Microsoft states that Researcher and Analyst were deployed to users with Microsoft 365 Copilot licenses. Statement 3 is Yes because Microsoft says users can build agents in Agent Builder by using natural language or manually.

Explanation:
The correct answer is
B. data loss prevention (DLP) policies. Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices. Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.
Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft’s documented solution is DLP policies.

Explanation:
You can use a Microsoft Entra security group to assign permissions to Microsoft Entra ID resources. Answer. Yes
You can use a Microsoft Entra security group to assign Microsoft 365 licenses.
Answer. Yes
You can use a Microsoft Entra security group to assign permissions to Microsoft Exchange mailboxes.
Answer. No