Microsoft AB-900 Dumps Questions Answers

The correct answer is A. Microsoft Entra ID Protection . Microsoft Learn explains that Microsoft Entra ID Protection detects sign-in risk and user risk and can work with Conditional Access risk policies to automatically respond when suspicious authentication activity is identified. Microsoft documents specifically state that organizations can configure sign-in risk policies and user risk policies to automate responses such as blocking access , requiring multifactor authentication , or forcing password changes when risky activity is detected. Microsoft also notes that some very high-confidence risky sign-ins are automatically blocked by built-in protections.

The other options do not match this function. Microsoft Defender for Office 365 focuses on email, collaboration, and threat protection for tools like Exchange Online and Teams, not sign-in risk blocking. Microsoft Entra Privileged Identity Management (PIM) manages privileged role activation and governance, not risky sign-in detection. Microsoft Defender for Identity detects identity-related threats in hybrid identity environments, but the Microsoft feature used to automatically block risky sign-ins is Microsoft Entra ID Protection .

The correct answer is D. the Analyst agent in Microsoft 365 Copilot . Microsoft Learn training for Microsoft 365 Copilot specifically distinguishes the Analyst agent as the tool for gathering insights from data and enhancing data presentations. Microsoft’s guidance also notes in the Researcher FAQ that when the task is spreadsheet-related , Analyst agent is better suited for Microsoft Excel related tasks . This makes Analyst the best choice for a quarterly sales reporting scenario that involves detecting performance trends , surfacing anomalies , and producing visual insights from multiple datasets.

The other options are less suitable. Researcher is intended for complex multi-step research and source-cited reports across web and work content, not specialized data analysis across files. Microsoft 365 Copilot Search is for finding information, not for deep quantitative analysis and anomaly summarization. Copilot in Excel is powerful for workbook-level analysis, but the question emphasizes broader insight generation across multiple files and asks for the best Copilot experience for trends, visuals, and anomaly summaries. Microsoft positions Analyst as the dedicated agent for that kind of data-analysis workflow.

The correct selections are No, Yes, Yes . Microsoft documents that the Audit page in the Microsoft Defender portal can be used to search the unified audit log for user and admin actions in the organization. Microsoft also states that audit log search in the Defender portal is the same as audit log search in the Microsoft Purview portal , which means both portals can be used to review administrative actions taken in Microsoft 365.

Microsoft further explains that Microsoft Purview Audit enables organizations to search for audit records of activities that users and admins perform across Microsoft services, making it a correct tool for this requirement.

By contrast, Search & intelligence in the Microsoft 365 admin center is not the feature used to investigate administrator actions through the unified audit log. It is not Microsoft’s documented audit search tool for this purpose. Therefore, for this hotspot the right answers are No for Search & intelligence, Yes for Audit in Microsoft Defender, and Yes for Audit in Microsoft Purview.