MS-900 common mistakes
MS-900 · Understand the traps and how to avoid them.
When asked how often users get new Office features, the candidate answers from the name of the channel rather than the cadence, e.g. saying Semi-Annual Enterprise Channel updates monthly or that Current Channel follows a fixed monthly patch date.
The channel names sound self-explanatory, so candidates skim the deployment docs and then guess. The question is really testing a small table of cadences, and guessing loses an easy point.
What to do instead
Memorise three rows: Current Channel (features as soon as released, no fixed date), Monthly Enterprise Channel (monthly, second Tuesday, one-month deferral), Semi-Annual Enterprise Channel (January and July). Then note that Monthly Enterprise Channel exists for organisations that want a predictable patch window.
Asked where a file lives or what happens to it after a team is restructured, the candidate says Teams stores files inside the channel or in the sharer's OneDrive, and that deleting a channel deletes its files.
Teams is the UI people see, so it feels like the storage location. Candidates never open the SharePoint or OneDrive side of the service and assume the conversation surface owns the data.
What to do instead
Anchor one sentence: channel files are stored in the team's SharePoint site document library; files shared in a chat are stored in the OneDrive for Business of the person who shared them; deleting a channel does not delete the underlying files in SharePoint. Apply that sentence to every storage, sharing, and retention item.
The candidate assumes every plan with 'Microsoft 365' or 'Office 365' in the name includes the desktop Word, Excel, and PowerPoint applications, and answers accordingly for frontline or Essentials-style plans.
Most people only ever see E3/E5 and Business Premium, all of which include the desktop apps, so the exception never enters their mental model.
What to do instead
Build a quick three-bucket list before exam day: plans with desktop apps (Business Standard/Premium, E3, E5), plans with web/mobile apps only (Business Essentials, E1, F1/F3), and plans with no productivity apps. When a question names a plan, classify it into a bucket first, then answer.
The candidate treats sensitivity labels and retention labels as interchangeable, saying a sensitivity label deletes content after a period or that a retention label encrypts a document.
Both live in the compliance portal and are both called 'labels', and both can be applied automatically, so they blur together during study.
What to do instead
Use a two-column contrast: sensitivity labels classify and protect and travel with the item wherever it goes; retention labels govern lifecycle (keep, then delete or dispose). Anything about encryption, watermarking, or 'follows the file outside the tenant' is sensitivity; anything about 'how long' or 'deleted at end of period' is retention.
Presented with a scenario about investigating a phishing campaign, the candidate says Plan 1 of Defender for Office 365 includes Threat Explorer, Attack Simulator, or automated investigation and response, or conversely says Plan 1 lacks Safe Links.
Plan 1 and Plan 2 naming suggests a capacity difference rather than a capability difference, and the feature list is genuinely long.
What to do instead
Split by intent: Plan 1 = prevention (Safe Attachments, Safe Links, anti-phishing policies, real-time detections). Plan 2 = investigation, hunting, and automation (Threat Explorer, Attack Simulator, automated investigation and response, threat trackers, campaign views). If the scenario says 'investigate', 'hunt', 'simulate', or 'automate', answer Plan 2.
The candidate assigns Conditional Access to Entra ID P2, or assigns Identity Protection and Privileged Identity Management to P1.
Both tiers are marketed as identity protection, and candidates memorise a single 'premium features' blob instead of splitting it in two.
What to do instead
Hold one split: P1 = Conditional Access, group-based licensing, self-service password reset with on-premises writeback, hybrid join. P2 = Identity Protection (risk-based sign-in and user risk) plus Privileged Identity Management (just-in-time roles). Then read the scenario for the words 'risk' or 'just-in-time' to select P2.
The candidate treats Microsoft 365 Enterprise as a renamed Office 365 Enterprise and expects Windows Enterprise or the mobility and security components to be included in an Office 365 E3/E5 purchase.
The two product families share app names and admin portals, and older documentation and job titles still say Office 365 for everything.
What to do instead
State the equation: Microsoft 365 E3/E5 = Office 365 E3/E5 + Windows Enterprise E3/E5 + Enterprise Mobility + Security E3/E5. Office 365 contains only the client and cloud productivity services. On any question mentioning Windows licensing, device management, or identity protection inside a bundle, check whether the plan named is Microsoft 365 or Office 365.
When asked which plan provides a specific advanced capability, the candidate upgrades mentally from E3 to E5 and guesses a feature, e.g. assuming E5 includes Microsoft 365 Copilot, or that E3 includes Audio Conferencing or Power BI Pro.
E5 is remembered as 'the one with everything', so the actual delta between E3 and E5 is never learned as a list.
What to do instead
Learn the E3-to-E5 delta by category rather than as an undifferentiated list: security (Defender for Identity, Defender for Cloud Apps, Defender for Endpoint P2, Entra ID P2), voice and meetings (Audio Conferencing, Phone System), analytics (Power BI Pro), and advanced compliance (insider risk, advanced eDiscovery, Customer Lockbox). Separately note that Copilot is an add-on, not an E5 inclusion.
The candidate answers licensing questions as if any add-on can be bolted onto any subscription, ignoring prerequisite base licences and seat caps, for example adding Copilot to a plan that cannot support it or assuming Microsoft 365 Business Premium scales to any headcount.
Add-on SKUs appear in the same price list as base plans, so the dependency chain and the seat ceiling are invisible unless you have read the licensing pages.
What to do instead
Before answering, ask two questions: what is the base SKU this add-on requires, and does the base SKU have a seat limit? Remember Business Premium caps at 300 seats, and Copilot requires an eligible base licence such as Microsoft 365 E3/E5 or Business Standard/Premium. If a scenario exceeds the cap, the answer is an enterprise plan.
Asked about support, the candidate says Premier or Unified support is included in the subscription, that the admin center offers 24/7 phone support on every plan, or confuses Service health with Message center.
Support is studied last and usually skimmed, and the two admin-center dashboards look similar at a glance.
What to do instead
Fix three facts: included support is requested through the admin center and is not the paid Premier/Unified offering; the financially backed uptime commitment is 99.9% for the core services; Service health shows current and historical incidents and advisories, while Message center announces planned changes and feature rollouts. Match 'outage' to Service health and 'coming change' to Message center.