I85PREP
⌘ K
AB-900 study materials
AB-900 study resources

AB-900: Core features and objects of Microsoft 365 services

AB-900 · Work through your exam, one topic at a time.

All guide sections

Core features and objects of Microsoft 365 services

Start with the tenant, not the app

Everything in Microsoft 365 lives inside a tenant - the organizational boundary that owns your domains, identities, and licenses. Within the tenant, Microsoft Entra ID holds the identity objects: users (members and guests), groups, and service principals. A security group grants access to resources; a Microsoft 365 group adds a shared mailbox, calendar, SharePoint site, and Teams team. Confusing these two is the most common exam trap.

The workload objects you must recognize

  • Exchange Online: mailboxes (user, shared, room), distribution lists, mail contacts, mail flow rules.
  • SharePoint Online / OneDrive: sites, document libraries, files; OneDrive is simply each user's personal site.
  • Teams: teams (backed by a Microsoft 365 group), channels (standard, private, shared), and apps.
  • Admin surfaces: the Microsoft 365 admin center for users, licenses, and service health; Entra for identity and roles; Exchange, Teams, and SharePoint admin centers for workload settings; the Security and Purview portals for protection.

Traps to expect

Questions love license assignment versus permission - a missing feature is usually a licensing gap, while "access denied" is a permission or group membership gap. Another trap is object deletion: blocking sign-in is reversible, deleting a user is not, and removing a license can soft-delete a mailbox's data. Also remember that guests are external identities who authenticate with their own credentials but are governed by your tenant policies.

Rule of thumb

When a symptom appears, ask three questions in order: Is the user licensed? Is the object shared or owned correctly? Is a policy overriding? Worked example: a user cannot open a shared mailbox in Outlook. The mailbox exists and is licensed correctly, so check the mailbox delegation: Full Access lets the user open the mailbox, while Send As only allows sending from its address. Grant Full Access, then confirm the change propagates before touching anything else.