Services, objects, identities, groups, and licensing in Microsoft 365
Domain Weight
Identify the core features and objects of Microsoft 365 services accounts for 33% of the AB-900 exam.
This domain checks that you know what the main Microsoft 365 services do and which objects they contain. Questions usually ask you to identify a service, an object, or the right admin center for a task.
Core Services and Their Objects
Service
Primary Purpose
Key Objects
Microsoft Entra ID
Identity and access for the tenant
Users, groups, service principals, licenses, roles
Exchange Online
Email, calendar, and contacts
User mailboxes, shared mailboxes, distribution lists, resource mailboxes
SharePoint Online
Team sites and content collaboration
Sites, document libraries, lists, site collections
OneDrive for Business
Personal file storage and sharing
Per-user library, files, sharing links
Microsoft Teams
Chat, meetings, calling, and apps
Teams, channels, tabs, chat, connectors
Microsoft 365 admin center
Day-to-day administration
Users, licenses, billing, service health, reports
Microsoft 365 admin center
Assign licenses, create users, manage groups and domains, review service health, billing, and usage reports.
Microsoft Entra admin center
Manage identities, conditional access, administrative roles, enterprise apps, and group-based licensing at the directory level.
Identities, Groups, and Licenses
A user account is the identity object; a license grants access to specific services such as Exchange Online, SharePoint, and Copilot
Security groups grant access to resources and cannot receive mail by default
Mail-enabled security groups combine resource access with email distribution
Distribution lists route email only and cannot be used to assign permissions
Microsoft 365 groups provide a shared mailbox, calendar, SharePoint site, and can back a team
Group-based licensing assigns licenses automatically based on group membership
Common admin roles include Global administrator, User administrator, License administrator, Exchange administrator, SharePoint administrator, and Teams administrator
Group Type
Can Receive Mail
Can Grant Resource Access
Security group
No
Yes
Mail-enabled security group
Yes
Yes
Distribution list
Yes
No
Microsoft 365 group
Yes (shared mailbox)
Yes
Copilot License Prerequisites
Microsoft 365 Copilot is an add-on license that requires a qualifying base license such as Microsoft 365 E3, E5, Business Standard, Business Premium, A3, or A5. Unlicensed users can still use Copilot Chat with an Entra ID account.
Exam Focus Areas
Know which admin center owns a task: Microsoft 365 admin center for users, licenses, and billing, Entra admin center for identity and roles, and the Purview portal for compliance
Microsoft 365 groups automatically create a shared mailbox, calendar, and SharePoint site, so they carry more objects than a plain security group
Distribution lists send mail but cannot assign permissions; use a security or mail-enabled security group when access is required
Assign administrative roles with least privilege instead of granting Global administrator, and use group-based licensing at scale
Practice This Domain
Test your understanding with free practice questions at /certifications/microsoft/ab-900/practice — focus on: Microsoft 365 admin center: domain names, org settings, license types, Exchange Online admin center: mailboxes and distribution lists, SharePoint admin center: sites, libraries, folders, roles and permissions.
