CertQuests
| Field | Details |
|---|---|
| Exam Code | MS-900 |
| Questions | 40–60 multiple-choice, drag-drop, case study |
| Duration | 45 minutes |
| Passing Score | 700 / 1000 |
| Price | $99 USD |
| Recertification | None (fundamentals certs don't expire) |
| Recommended Experience | General IT knowledge, cloud basics |
| Prerequisites | None |
Course Modules
Six in-depth modules mapped to the four MS-900 exam domains. Each opens to three lessons — intro, key concepts, study notes, takeaways, and a linked mini-quiz drawn from the MS-900 question bank.
01
Cloud Concepts & Microsoft 365 Overview
3 lessons · ~3h
Key Concepts
- Deployment models — where the cloud runs: Public cloud shares provider infrastructure across many customers (Microsoft 365, Azure). Private cloud is dedicated to one organisation. Hybrid cloud connects public and private/on-premises so workloads can span both.
- Service models — how much you manage: IaaS gives you virtual machines and networks; you manage the OS and up. PaaS gives you a managed platform to build apps; the provider handles the OS and runtime. SaaS gives you finished software you just sign in to.
- Microsoft 365 is SaaS: You consume Exchange, SharePoint, and Teams as a subscription — Microsoft runs every layer. This is the single most-tested classification on the exam.
- Subscription model: Microsoft 365 is licensed per user per month — no servers to buy, capacity scales with the number of licences.
Key Concepts
- Scalability: Add or remove capacity to match demand. Vertical scaling resizes a resource; horizontal scaling adds more instances.
- Elasticity: Capacity adjusts automatically as load rises and falls — you pay for what you use, when you use it.
- Agility: Resources and services can be provisioned in minutes, so the business responds to change quickly instead of waiting on hardware.
- Reliability & availability: Redundant, geographically distributed infrastructure keeps services running and recoverable; Microsoft publishes Service Level Agreements (SLAs) for uptime.
- OpEx vs CapEx: On-premises hardware is a capital expense (CapEx) paid up front. Cloud subscriptions are an operating expense (OpEx) — predictable, ongoing, and tied to actual usage.
Key Concepts
- Shared responsibility: Security duties are split between Microsoft and the customer. The split shifts with the service model.
- Always Microsoft: The physical datacentre, hosts, and network — regardless of IaaS, PaaS, or SaaS.
- Always the customer: Their data, accounts, identities, and access management — even in SaaS like Microsoft 365.
- The shifting middle: Operating system and application responsibility move toward Microsoft as you go IaaS → PaaS → SaaS.
- Why it matters for M365: Microsoft keeps the service running, but the customer must still manage who has access, configure security features, and protect their own data.
💻 Scenario — deciding between Microsoft 365 plans
Situation: A 150-person professional services firm currently pays for separate email hosting, a file server, and desktop Office licenses. The CEO asks IT: "Can Microsoft 365 consolidate all of this and how does pricing work?"
Answer: Microsoft 365 Business Premium includes Exchange Online (email), SharePoint/OneDrive (file storage), Teams (collaboration), and Office apps — all in one per-user subscription. The firm shifts from CapEx (server hardware, perpetual licenses) to OpEx (per-user/month billing). If they grow from 150 to 200 users, they just add licenses — no hardware planning required.
Which plan? Business Premium (up to 300 users) covers their entire stack including Intune device management and Defender for Business. Enterprise E3 or E5 is the path if they ever exceed 300 users or need advanced compliance features (E5 adds Defender for Endpoint P2, Purview eDiscovery, and Sentinel licensing).
- Deployment models say where the cloud runs (public / private / hybrid); service models say how much you manage (IaaS / PaaS / SaaS). Microsoft 365 is SaaS.
- Cloud benefits cluster around scalability, elasticity, agility, reliability, and the shift from up-front CapEx to pay-as-you-go OpEx.
- In shared responsibility the customer always owns data and identities; Microsoft always owns the physical layer — the OS/app middle shifts with the service model.
02
Collaboration Services — Exchange, SharePoint, OneDrive, Teams
3 lessons · ~4h
Key Concepts
- Exchange Online: The cloud-hosted enterprise email, calendar, and contacts service — the mailbox behind Outlook on the web, desktop, and mobile.
- Mailbox types: User mailboxes for people, shared mailboxes for teams (e.g. support@), and resource mailboxes for rooms and equipment that can be booked.
- Distribution groups vs Microsoft 365 groups: A distribution group fans an email out to members; a Microsoft 365 group provides a shared mailbox, calendar, and SharePoint site, and underpins Teams.
- Protection & compliance: Exchange Online Protection (EOP) filters spam and malware on every message; mail flow rules and retention can be applied centrally.
- Outlook is the client; Exchange is the service: A common exam distinction — the app you open vs the service that hosts the mailbox.
Key Concepts
- SharePoint Online: Cloud document management and intranet — team sites, communication sites, document libraries, lists, and news.
- OneDrive for Business: Each user's personal cloud storage, with file sync across devices and easy sharing. Best for individual or in-progress work.
- SharePoint vs OneDrive: Put shared, team-owned content in SharePoint; keep personal or draft content in OneDrive. Files shared in a Teams channel actually live in the team's SharePoint site.
- Co-authoring & versioning: Both let multiple people edit a file at once and keep version history so changes can be rolled back.
- Sharing controls: Links can be scoped to specific people, the organisation, or anyone — administrators set the allowed boundaries.
Key Concepts
- Microsoft Teams: The unified hub for chat, channels, meetings, and calls — the front door to collaboration in Microsoft 365.
- Teams and channels: A team is a group of people; channels organise its conversations and files by topic. Each team is backed by a Microsoft 365 group and a SharePoint site.
- Chat vs channels: Chat is ad-hoc and private to participants; channel posts are visible to the whole team and persist as a record.
- Meetings & Teams Phone: Teams hosts online meetings with video, screen share, and recording; Teams Phone adds full PSTN calling so Teams becomes the business phone system.
- Apps & integration: Teams surfaces other Microsoft 365 services and third-party apps as tabs and bots, keeping work in one place.
💻 Scenario — migrating on-premises file shares to SharePoint + OneDrive
Situation: The firm has 8 TB of files on a Windows file server. Different departments need shared team folders; individual staff need personal storage; all files must be accessible from home without VPN.
Walk: Departmental shared files → SharePoint team sites (one per department, with Teams integration for real-time collaboration). Personal files → OneDrive for Business (1 TB per user, auto-sync to desktop). Result: file server can be decommissioned. Staff access files via browser, Teams, or the sync client. Co-authoring in Word/Excel works without emailing attachments.
Exam note: MS-900 tests the distinction: SharePoint = team/departmental shared content; OneDrive = personal content. Teams channels store their files in SharePoint behind the scenes.
- Exchange Online hosts mail and calendars; Outlook is just the client. Shared and resource mailboxes cover team addresses and bookable rooms.
- OneDrive = "my files" (personal/draft); SharePoint = "our files" (team-owned). Teams channel files live in SharePoint.
- Teams is the collaboration hub — chat, channels, meetings, and Teams Phone — and every team is backed by a Microsoft 365 group plus a SharePoint site.
03
Microsoft Viva, Power Platform & Copilot
3 lessons · ~3h
Key Concepts
- Microsoft Viva: An employee-experience platform that lives inside Teams, built from several modules.
- Viva Connections: An intranet dashboard in Teams surfacing SharePoint news, resources, and dashboard cards.
- Viva Engage: The social and community network (formerly Yammer) — communities, storylines, and leadership conversations.
- Viva Insights: Personal and manager wellbeing and productivity analytics — focus time, meeting habits, work-life balance.
- Viva Learning & Viva Topics: Learning aggregates training content into Teams; Topics uses AI to mine and surface organisational knowledge.
Key Concepts
- Power Platform: A low-code / no-code suite that lets non-developers build solutions on top of Microsoft 365 data.
- Power BI: Business analytics — interactive reports and dashboards from many data sources.
- Power Automate: Workflow automation — triggers and actions that connect apps (e.g. "save email attachments to SharePoint").
- Power Apps: Custom business apps built visually, without traditional coding.
- Power Pages & Copilot Studio: Power Pages builds external-facing websites; Copilot Studio builds custom conversational agents.
Key Concepts
- Microsoft 365 Copilot: An AI assistant embedded across Word, Excel, PowerPoint, Outlook, and Teams — it drafts content, summarises, and answers questions grounded in your organisation's data.
- Grounding with Microsoft Graph: Copilot uses the Microsoft Graph to base responses on your emails, files, and chats — and it respects existing permissions, so it only surfaces content the user can already access.
- Copilot is a paid add-on: Microsoft 365 Copilot is licensed separately on top of an eligible base subscription — it is not included in standard plans.
- Microsoft Loop: A collaborative app of flexible components — portable pieces of content that stay in sync wherever they are pasted (Teams chat, Outlook, a Loop workspace).
- Where they fit: Copilot accelerates individual work; Loop keeps shared content live and consistent across apps.
💻 Scenario — automating a manual approval workflow with Power Automate
Situation: The finance team manually emails managers every time an invoice over $5,000 is submitted. The manager emails back "approved" or "rejected". This process takes 2–3 days and has no audit trail.
With Power Automate: A no-code flow is built in 30 minutes: Trigger = new item added to a SharePoint "Invoices" list with amount > $5,000. Action 1 = send an approval request to the manager via Teams adaptive card. Action 2 = if approved, update the SharePoint item status to "Approved" and notify accounts payable. Action 3 = if rejected, notify the submitter with the reason. All decisions are logged in the SharePoint list for audit.
MS-900 pattern: "Automate repetitive tasks without code" = Power Automate. "Build a simple business app without code" = Power Apps. "Analyse data visually" = Power BI.
- Viva modules each have one job: Connections = intranet, Engage = social, Insights = wellbeing, Learning = LMS, Topics = knowledge mining.
- Power Platform is low-code: Power BI analyses, Power Automate automates, Power Apps builds apps, Power Pages builds sites.
- Microsoft 365 Copilot is a paid add-on that grounds AI in Graph data and respects permissions; Loop keeps content synced across apps.
Halfway through MS-900? The CertQuests podcast covers Microsoft 365 service comparisons and the E3-vs-E5 licensing maze — great for cementing these concepts away from the screen.
▶ Open Spotify
04
Device Management — Intune, Autopilot, Windows 365 & AVD
3 lessons · ~3h
Key Concepts
- Microsoft Intune: The cloud endpoint-management service, part of Microsoft Intune Suite, for managing Windows, macOS, iOS, and Android devices.
- Mobile Device Management (MDM): Enrols and manages a whole device — enforcing compliance policies, configuration profiles, and the ability to wipe a lost device.
- Mobile Application Management (MAM): Manages and protects only the corporate apps and data on a device, leaving the rest untouched — ideal for personal (BYOD) devices.
- App protection policies: Control corporate data within apps — block copy-paste to personal apps, require a PIN, selectively wipe company data without touching personal content.
- Compliance & Conditional Access: Intune reports device compliance to Entra ID, so Conditional Access can require a compliant device before granting access.
Key Concepts
- Windows Autopilot: A zero-touch deployment service — a new device ships straight from the vendor to the user and configures itself on first sign-in.
- How it works: The device hardware ID is registered with the organisation; when the user signs in with their work account, Autopilot joins it to Entra ID and applies Intune policies and apps automatically.
- No imaging: Autopilot removes the traditional IT step of building and applying a custom OS image to each machine.
- Self-service provisioning: A remote employee can unbox a laptop and have a fully managed, policy-compliant device with no IT visit.
- Works with Intune: Autopilot handles enrolment; Intune delivers the configuration, security policies, and apps.
Key Concepts
- Cloud PC / virtual desktop: Both services stream a Windows desktop from the cloud to any device, so the desktop and its data never live on the local endpoint.
- Windows 365: A per-user Cloud PC with fixed, predictable per-month pricing. It is delivered as SaaS — simple to buy, fast to provision, and easy to manage.
- Azure Virtual Desktop (AVD): Runs on Azure infrastructure with consumption-based pricing. It supports multi-session Windows (several users on one VM) and offers far more flexibility and control.
- Choosing between them: Pick Windows 365 for simplicity and predictable cost (one dedicated PC per user); pick AVD for cost optimisation at scale, multi-session, and deep customisation.
- Common ground: Both improve security — data stays in the cloud — and both let users work from any device.
💻 Scenario — zero-touch laptop deployment with Autopilot + Intune
Situation: IT needs to ship 50 laptops directly from a supplier to home-based employees without IT ever touching them. On first boot, each laptop should enrol into Microsoft 365, install required apps, and enforce security policies automatically.
Walk: 1) Supplier uploads hardware IDs to Windows Autopilot (via CSV or OEM programme). 2) IT configures an Autopilot deployment profile in Intune: OOBE skipped, domain joined, assigned to the employee's account. 3) Employee receives the laptop, powers it on, signs in with their Microsoft 365 account. 4) Autopilot registers the device with Intune automatically. 5) Intune pushes the required apps (Microsoft 365 Apps, company VPN, Defender for Endpoint) and compliance policies (BitLocker required, PIN lock enabled). Employee is productive within 45 minutes — IT never touched the device.
Exam note: Autopilot = zero-touch provisioning. Intune = ongoing device management (compliance + app deployment). Windows 365 = full Windows PC streamed from the cloud (Cloud PC).
- Intune manages endpoints: MDM for whole (corporate) devices, MAM / app protection for corporate data on personal (BYOD) devices.
- Windows Autopilot is zero-touch provisioning — devices ship direct to users and configure themselves on first sign-in, no imaging.
- Windows 365 = simple, fixed-price per-user Cloud PC; AVD = flexible, consumption-priced, multi-session virtual desktops.
05
Identity & Security — Entra ID, Zero Trust, Defender XDR, Purview
3 lessons · ~5h
Key Concepts
- Microsoft Entra ID: The cloud identity and access service behind Microsoft 365 — formerly Azure Active Directory. The names are interchangeable; it is the same product.
- Authentication & MFA: Entra ID verifies who users are. Multi-factor authentication adds a second factor (phone, app, key) and is the strongest defence against stolen passwords.
- Single Sign-On (SSO): One sign-in grants access to many apps, reducing password fatigue and risk.
- Conditional Access: An if-then policy engine — if signals like location, device, or risk meet a condition, then require MFA, require a compliant device, or block access.
- Zero Trust: A security model with three principles — verify explicitly, use least-privilege access, and assume breach. It replaces "trust the internal network" with "never trust, always verify".
Key Concepts
- Defender XDR: Microsoft's Extended Detection & Response suite — it correlates threat signals across identity, endpoints, email, and cloud apps into a unified portal.
- Defender for Endpoint: Endpoint detection and response (EDR) protecting devices — Windows, macOS, Linux, mobile.
- Defender for Office 365: Protects email and collaboration — Safe Links and Safe Attachments against phishing and malicious files.
- Defender for Identity: Detects attacks against on-premises Active Directory using domain-controller signals.
- Defender for Cloud Apps: A Cloud Access Security Broker (CASB) — discovers shadow IT and gives visibility and control over SaaS usage.
Key Concepts
- Microsoft Purview: The compliance and data-governance umbrella for Microsoft 365.
- Sensitivity labels: Classify and protect documents and emails — applying encryption and visual markings that travel with the file.
- Data Loss Prevention (DLP): Policies that detect and block the sharing of sensitive data — credit card numbers, IDs — across Microsoft 365.
- Retention & records management: Govern how long content is kept and when it is deleted, satisfying regulatory requirements.
- eDiscovery, Audit & Compliance Manager: eDiscovery finds and preserves content for legal cases; Audit is the immutable activity log; Compliance Manager scores your posture against regulations.
💻 Scenario — enabling Zero Trust for a hybrid workforce
Situation: Employees work from corporate offices, home, and client sites using personal and company devices. IT wants to enforce Zero Trust: every access request must be verified regardless of location or device.
Walk: 1) Identity — enable MFA for all users in Entra ID. 2) Conditional Access — require compliant device (Intune-enrolled, BitLocker on) AND MFA for access to sensitive apps. Block access from untrusted countries. 3) Least privilege — assign Microsoft 365 roles by need only; use PIM for admin activations. 4) Device health — Intune compliance policy marks a device non-compliant if Defender real-time protection is off; Conditional Access blocks non-compliant devices. 5) Threat detection — Microsoft Defender XDR correlates identity (Defender for Identity), endpoint (Defender for Endpoint), and email (Defender for Office 365) signals into a unified incident view.
Result: An employee on a personal, unmanaged device from an unknown IP gets blocked. Same employee on their Intune-managed laptop passes all checks and gets access. Zero Trust in practice.
- Entra ID (formerly Azure AD) handles identity; MFA, SSO, and Conditional Access enforce Zero Trust — verify explicitly, least privilege, assume breach.
- Defender XDR correlates threats — Endpoint (devices), Office 365 (email), Identity (on-prem AD), Cloud Apps (SaaS).
- Microsoft Purview covers compliance — sensitivity labels, DLP, retention, eDiscovery, Audit, and Compliance Manager; advanced features are E5-only.
06
Licensing, Pricing & Support
3 lessons · ~2h
Key Concepts
- Microsoft 365 vs Office 365: Office 365 is just the productivity apps and cloud services. Microsoft 365 bundles Office 365 + Windows Enterprise + Enterprise Mobility & Security (which includes Intune). If a scenario involves managing Windows devices or Intune, it is Microsoft 365.
- Business plans: For small and medium businesses up to 300 seats — Business Basic, Business Standard, Business Premium.
- Enterprise plans: For organisations of any size with no seat cap — E1, E3, E5.
- Education plans: A1, A3, A5 for schools and universities.
- Frontline plans: F1 and F3 — discounted plans for shift and frontline workers who mainly need communication and lightweight apps.
Key Concepts
- E1: Cloud services only — Exchange, SharePoint, Teams via the web and mobile. No installable desktop Office apps.
- E3: Everything in E1 plus installed desktop Office apps, core security and compliance, and Intune device management.
- E5: Everything in E3 plus advanced security (full Defender XDR Plan 2), advanced compliance (Insider Risk, Communication Compliance, advanced eDiscovery), Power BI Pro, and Teams Phone.
- Pick by feature: If a scenario needs Power BI Pro, Teams Phone, or advanced threat protection, the answer is almost always
E5. - Business Premium: The SMB equivalent of "E3-plus-advanced-security" — full Office apps, Intune, and Defender, capped at 300 seats.
Key Concepts
- Billing options: Microsoft 365 is sold per user, billed monthly or annually; an annual commitment is cheaper per month than month-to-month.
- Purchase channels: Customers buy directly from Microsoft or through a Cloud Solution Provider (CSP) partner that bundles management and support.
- Add-ons: Capabilities like Microsoft 365 Copilot and Teams Phone are licensed as separate add-ons on top of a base plan.
- FastTrack: A free onboarding and deployment-guidance benefit for eligible subscriptions of 150+ licences — it helps migrate and roll out services. It is not break-fix support.
- Microsoft Unified support: A paid support offering (the successor to Premier Support) with proactive services and an account team — distinct from FastTrack.
💻 Scenario — choosing the right Microsoft support plan
Situation: The firm's Microsoft 365 environment went down for 4 hours on a Tuesday morning. They had no Microsoft support contract — just the default self-service portal. The CEO asks: "What support plan do we need so this never takes 4 hours to resolve again?"
Support tiers: Basic (included) = online self-service + billing support only; no technical cases. Developer = for dev environments, limited hours. Standard = business hours support, no SLA on response. Professional Direct = <1 hour response for critical issues, designated support manager, proactive services. Unified (enterprise) = 24/7, assigned Technical Account Manager, on-site support.
Answer for this firm: Professional Direct — critical issues get a sub-1-hour response, and the proactive monitoring catch problems before they become 4-hour outages. MS-900 expects you to recognise the tier names and their primary differentiators (response time, proactivity, TAM).
- Microsoft 365 = Office 365 + Windows Enterprise + EMS/Intune; Office 365 is just the apps and services. Business plans cap at 300 seats; Enterprise plans do not.
- The ladder: E1 web-only → E3 adds desktop apps + Intune → E5 adds advanced security/compliance + Power BI Pro + Teams Phone.
- FastTrack is free deployment guidance (150+ seats); Microsoft Unified is paid support — never confuse the two.
Key Concepts to Master
Microsoft 365 vs Office 365
This trips up nearly everyone. Microsoft 365 bundles Windows 11 Enterprise + Enterprise Mobility & Security (EMS) + Office 365. So Microsoft 365 E3 = Office 365 E3 + Windows 11 Enterprise E3 + EMS E3. Office 365 alone is just the productivity apps and cloud services (Exchange, SharePoint, Teams) — no Windows license, no Intune. If a question mentions managing Windows devices or includes Intune, it's M365, not O365.
Microsoft 365 Plan Decoder
E1 = cloud services only, no installable Office apps (web/mobile only). E3 = E1 + installed Office apps + basic security/compliance + Intune. E5 = E3 + advanced security (full Defender XDR) + Power BI Pro + Teams Phone + advanced compliance (Insider Risk, Communication Compliance, Records Management). When a scenario needs Power BI Pro, Teams Phone, or advanced threat protection, the answer is almost always E5.
FastTrack is NOT Premier Support
FastTrack is a free migration and deployment guidance benefit included with eligible subscriptions of 150+ licenses — it helps you onboard, migrate mailboxes, and roll out services. It is not reactive break-fix support. Premier Support (now Microsoft Unified) is a paid plan with a Technical Account Manager (TAM) and 24/7 incident response. The exam loves to mix these up — read the question carefully.
4-Week Study Plan
Top 4 Mistakes on the MS-900 Exam
MS-900 vs AZ-900 — What's the Difference?
Many IT pros take both as complementary credentials. MS-900 is easier and more business-focused; AZ-900 is slightly more technical. There is no required order — pick whichever maps to your day job first.
MS-900 — M365 Fundamentals
- Exchange Online, SharePoint, Teams
- OneDrive for Business, Microsoft Loop
- Intune MDM/MAM & Windows Autopilot
- Microsoft Viva & Power Platform
- Microsoft 365 Copilot
- Defender XDR & Microsoft Purview
- E1/E3/E5, Business Premium, F3 licensing
- Focus: business productivity layer
AZ-900 — Azure Fundamentals
- Azure Compute (VMs, Containers, Functions)
- Azure Storage (Blob, Files, Queues)
- Azure Networking (VNets, Load Balancer)
- Azure AD / Entra ID identity
- Azure Monitor & Cost Management
- Azure Policy & Resource Manager
- Azure pricing calculator & SLAs
- Focus: cloud infrastructure layer