AB-900 Practice Questions

The correct answers are A and D . Microsoft documents that with group-based licensing , licenses assigned to a group are automatically inherited by the group’s members. Therefore, if User1 is added to Group1 , User1 can receive the Microsoft 365 E3 license through group membership. Microsoft also documents that licenses can be assigned directly to individual users , so assigning a Microsoft 365 E3 license straight to User1 is also a complete solution.

Options B and C are incorrect because Conditional Access controls how users access cloud resources after sign-in; it does not grant product entitlements or service licenses. Microsoft licensing guidance separates access-policy controls from actual license assignment. In this scenario, the issue is lack of license entitlement, not access conditions. As a result, the valid solutions are either to make User1 a member of the licensed group or to assign the license directly to User1. Microsoft also notes that group-based licensing assignment can fail if required user properties such as usage location are missing, but among the available answer choices, the two complete license-granting actions are Add User1 to Group1 and Assign a license to User1 .

You can use the eDiscovery Microsoft Purview solution to find all the content that relates to the term “Project Falcon” in the emails exchanged by two users.

The correct answer is eDiscovery . Microsoft documents that Microsoft Purview eDiscovery is used to search for content in Microsoft 365 data sources that is relevant to an investigation, legal matter, or internal review. Microsoft specifically states that eDiscovery search can find email messages, documents, instant messages, and other content across Microsoft 365 locations, including Exchange Online mailboxes . This makes it the correct solution for locating content related to a keyword or phrase such as “Project Falcon” in emails exchanged between specific users.

This is different from other Purview solutions such as Communication Compliance, which is designed to monitor risky or inappropriate communications, or Data Lifecycle Management, which is for retention and deletion. The requirement here is targeted search and retrieval of content connected to a specific term in user email communications, which is exactly what eDiscovery is designed to do. Microsoft also notes that eDiscovery supports keyword queries and search conditions , which further aligns with this scenario.

The correct selections are Yes, Yes, Yes . For statement 1, Microsoft Support explains that if you are not a site owner, you might still be able to invite other people to the site , although the invitation can generate an access request that a site owner approves or declines. Microsoft also states that site users have the opportunity to invite other people to collaborate on sites , unless that feature is disabled. That makes the statement true.

For statement 2, Microsoft Learn states that in SharePoint you can give people permissions to a site by adding individual users, security groups, or Microsoft 365 groups to one of the three SharePoint groups, including the Members group. That directly supports the statement.

For statement 3, Microsoft documents that site ownership and membership can be managed by adding or removing owners, members, site owners, site members, and site visitors . For group-connected sites, Microsoft also documents that owners can manage group ownership and remove owner status. Therefore, a site owner can remove another site owner, provided at least one owner remains.

Prevent users from sharing PII: Data Loss Prevention

Use machine learning to train a model: Information Protection

The correct selections are Data Loss Prevention and Information Protection . Microsoft states that Microsoft Purview Data Loss Prevention (DLP) helps organizations identify, monitor, and automatically protect sensitive information, including preventing people from sharing sensitive items such as PII in Microsoft 365 locations and other supported channels. That directly matches the requirement to stop users from sharing files that contain personally identifiable information.

For the second requirement, the correct choice is Information Protection because Microsoft Purview’s classification and labeling capabilities include trainable classifiers , which Microsoft describes as a tool you can train using machine learning to recognize types of sensitive or business content. Microsoft positions these classification capabilities under Microsoft Purview Information Protection and data classification. That makes Information Protection the best fit for “use machine learning to train a model that detects sensitive content.”

The other options are not the best match here. Communication Compliance monitors risky communications, DSPM for AI focuses on AI posture and exposure, and Insider Risk Management detects risky user behavior rather than blocking PII sharing or training classifiers.

The correct answer is eDiscovery . In Microsoft Purview, eDiscovery is the solution used to search for content and export copies of that content from Microsoft 365 locations such as SharePoint and OneDrive. Microsoft Learn states that when you export search results from eDiscovery, copies of native Office documents and other documents are exported . That directly matches the requirement to provide HR with a copy of files .

By contrast, Audit is primarily used to investigate user and admin activity records and can export those audit records to CSV , but it does not export the actual files themselves. Audit would help identify that User1 modified files, but the question asks for copies of the recent files modified by User1 , which is an eDiscovery content search and export scenario rather than an activity-log reporting scenario.

So, among the Microsoft Purview solutions shown, the appropriate selection is eDiscovery because it is the Purview tool designed to find and export the actual content items HR wants to receive.

The correct answer is Require multifactor authentication for administrative roles . In the exhibit, each recommendation shows its available Secure Score points . The listed values are 1/1 for Use least privileged administrative roles , 8/8 for Do not expire passwords , 0.73/8 for Enable policy to block legacy authentication , and 0/10 for Require multifactor authentication for administrative roles . Because 10 points is the highest value among the options shown, resolving that recommendation would improve the Identity Secure Score the most.

Microsoft Learn explains that Identity Secure Score in Microsoft Entra is based on Microsoft security recommendations, and each recommendation contributes a specific number of points depending on its impact and implementation state. Recommendations related to administrator protection are especially important because privileged accounts are high-value attack targets. Microsoft also emphasizes multifactor authentication for admin roles as a core identity security best practice. Therefore, both from the screenshot and from Microsoft’s identity guidance, the recommendation with the greatest score improvement is Require multifactor authentication for administrative roles .