What MS-900 actually tests

MS-900 is not an admin exam. It is a fundamentals exam about Microsoft 365 as a cloud productivity, security, compliance, and device management platform. You are being tested on whether you understand what the services do, when they fit, and how Microsoft packages them.

That matters because many candidates study the wrong way. They go too deep into configuration steps in the Microsoft 365 admin center and not deep enough into service purpose, licensing boundaries, and feature mapping.

What to expect:

Audience: business stakeholders, new IT staff, sales engineers, project coordinators, adoption leads, and junior admins
Level: foundational, but not trivial
Question style: mostly scenario-based multiple choice, drag-and-drop, and service identification
What is hard: Microsoft product naming, overlapping capabilities, and license/service distinctions
What is straightforward: core cloud concepts, collaboration scenarios, and high-level security/compliance ideas if you keep the services organized

The exam objectives for MS-900 are usually grouped into four broad areas:

Describe cloud concepts
Describe core Microsoft 365 apps and services
Describe Microsoft 365 security, compliance, privacy, and trust
Describe Microsoft 365 pricing, licensing, and support

Those domains are not equally difficult. The cloud concepts section is the smallest lift for most IT people. The areas that trip candidates are:

Microsoft 365 collaboration services: knowing what lives in Teams vs SharePoint vs OneDrive vs Exchange
Security/compliance: distinguishing identity, access, endpoint management, information protection, insider risk, eDiscovery, and retention
Licensing: recognizing what is available in Business vs Enterprise plans and how add-ons fit

If you want a clean strategy: study the exam in this order:

Cloud concepts
Productivity and collaboration workloads
Security and compliance stack
Licensing, support, and billing models

That order mirrors how Microsoft positions the platform and reduces confusion later.

Cloud concepts: know the service model language cold

This is the shortest domain, but do not skip it. Microsoft uses cloud terminology precisely, and weak fundamentals make later questions harder.

Focus on these concepts:

Cloud models: public cloud, private cloud, hybrid cloud
Benefits of cloud services: high availability, scalability, elasticity, agility, fault tolerance, disaster recovery, global reach
Consumption-based pricing and why OpEx differs from CapEx
Service models:
- IaaS: infrastructure components you manage more directly
- PaaS: platform and runtime managed more by the provider
- SaaS: finished application consumed by users
Shared responsibility at a high level

For MS-900, you do not need Azure architect depth. You do need to recognize how Microsoft 365 fits as SaaS and how cloud delivery changes deployment, patching, and access.

Be ready for questions that ask you to identify advantages such as:

faster rollout of collaboration tools
reduced need for on-premises server maintenance
easier remote access
built-in redundancy and resilience
subscription-based licensing

Also understand the difference between Microsoft 365 and Office 365. This is a classic exam area.

Office 365 centers on productivity apps and services such as Exchange Online, SharePoint Online, Teams, and Office apps.
Microsoft 365 is broader. It combines productivity plus Windows, security, device management, and compliance capabilities depending on the plan.

A simple memory aid:

Office 365 = productivity
Microsoft 365 = productivity + security + management + Windows options

Do not overcomplicate this domain. If you can explain cloud value to a business manager and classify SaaS vs IaaS vs PaaS correctly, you are in good shape.

The Microsoft 365 workloads you must separate in your head

This is the heart of the exam. You need a service-by-service mental map. Most wrong answers come from mixing up tools that work together.

Start with the core productivity stack.

Exchange Online

Know what Exchange Online provides:

business email
calendars
contacts
mailbox features
integration with Outlook and Teams scheduling

What the exam cares about is not mailbox administration. It cares that you know Exchange Online is the email and calendaring workload in Microsoft 365.

SharePoint Online

Think of SharePoint Online as the platform for:

intranet and team sites
document management
content publishing
lists and collaboration spaces
file storage for teams and sites

Candidates often confuse SharePoint and OneDrive. Keep this distinction sharp:

OneDrive for Business = an individual user's work files
SharePoint Online = shared team and organizational content

Under the hood, Teams files are usually stored in SharePoint. You do not need to know every storage detail, but you do need to know the relationship.

OneDrive for Business

Know when OneDrive is the right answer:

personal work files
syncing files across devices
sharing files from a personal work library
offline access with sync

If a question talks about an individual user storing, syncing, or sharing their own files, OneDrive is usually correct.

Microsoft Teams

Teams is heavily tested because Microsoft positions it as the hub for collaboration. Know the major capabilities:

chat
meetings and webinars
calling
team collaboration channels
app integration
file collaboration

Also know what Teams is not replacing by itself:

Exchange still handles email and calendars
SharePoint and OneDrive still store files behind the scenes

Common exam traps:

asking where files shared in Teams are stored
asking which service supports persistent team collaboration
mixing Teams meetings with Exchange calendaring

Microsoft 365 Apps

You should know the difference between:

Microsoft 365 Apps for enterprise
Microsoft 365 Apps for business
web, desktop, and mobile app availability at a high level

Know the major apps:

Word
Excel
PowerPoint
Outlook
OneNote
Access and Publisher, where relevant

You do not need feature-deep knowledge. You do need to recognize that Microsoft 365 Apps are the subscription-based Office client apps with cloud-connected collaboration.

Viva, Forms, Bookings, Planner, Stream, Loop, and other apps

MS-900 sometimes samples the broader ecosystem. You should at least know the purpose of these:

Microsoft Viva: employee experience platform, especially communication, learning, insights, and knowledge modules
Microsoft Forms: surveys, quizzes, polls
Microsoft Bookings: appointment scheduling
Microsoft Planner: team task management
Microsoft Stream: enterprise video experiences
Microsoft Loop: collaborative components and workspaces
Microsoft Lists: tracking work with list-based data

Do not spend equal time on all of them. Know the one-line purpose.

Windows and device productivity tie-in

Because this is Microsoft 365, not just Office 365, you should understand that some plans include:

Windows Enterprise capabilities
cloud-based device management through Microsoft Intune
identity integration through Microsoft Entra ID

At this level, the exam wants recognition, not deployment knowledge.

How to study this domain efficiently

Build a comparison table with these columns:

Service
Primary purpose
Typical user scenario
Closely related services
Common confusion point

Example:

Teams | collaboration hub | chat/meetings/channels | Exchange, SharePoint, OneDrive | not the actual file repository
OneDrive | personal file storage | user stores own work files | SharePoint, Teams | not the team document platform
SharePoint | team/org content platform | shared document libraries and intranet | Teams, OneDrive | broader than file sync

If you can explain each core service in one sentence and compare it with its nearest neighbor, you are ready for most workload questions.

Security, compliance, privacy, and trust: where most candidates need a second pass

This domain is broad. It is still fundamentals-level, but the product family is large. You need a clean taxonomy.

Split it into five buckets: identity, access/device management, threat protection, information protection/compliance, and trust/privacy.

Identity with Microsoft Entra ID

You must know Microsoft Entra ID by name. Older material may still mention Azure AD, but current Microsoft branding is Entra ID.

Know these concepts:

identity and authentication
single sign-on (SSO)
multifactor authentication (MFA)
conditional access at a high level
self-service password reset

Typical exam framing:

Which service provides centralized identity?
Which capability reduces password-only risk?
Which feature can require extra verification based on conditions?

Device and application management with Microsoft Intune

Know what Microsoft Intune does:

manage devices
enforce compliance policies
deploy applications
support mobile device and endpoint management
help protect corporate data on managed and unmanaged devices

At this level, understand the role of Intune in endpoint management. Do not get dragged into profile deployment details.

Security solutions in Microsoft 365

Know the purpose of these products at a high level:

Microsoft Defender for Office 365: protection against phishing, malicious links, malicious attachments in collaboration/email contexts
Microsoft Defender for Endpoint: endpoint threat protection and detection
Microsoft Defender for Identity: identity-related threat detection in hybrid identity environments
Microsoft Defender for Cloud Apps: visibility and control for cloud app usage
Microsoft 365 Defender: unified experience across Defender products

You may not get every product in depth, but you should know what category each belongs to.

A useful shortcut:

Office 365 threats -> think email/collaboration protection
Endpoint threats -> think devices
Cloud app visibility -> think SaaS usage and session control
Identity threats -> think account and authentication behavior

Information protection and compliance

This is where candidates blur terms. Keep these separate:

Sensitivity labels: classify and protect content based on sensitivity
Retention labels/policies: keep or delete content according to lifecycle requirements
Data Loss Prevention (DLP): detect and prevent inappropriate sharing of sensitive information
eDiscovery: identify, preserve, collect, and export data for investigations/legal matters
Insider Risk Management: identify risky internal user activity patterns
Communication Compliance: monitor communications for policy violations
Information barriers: restrict communications between groups in regulated environments
Records management: manage retention and record declaration

Questions often describe a business need. Match the need to the right compliance tool.

Examples:

Need to stop credit card numbers from being emailed externally -> DLP
Need to classify a document as confidential and apply protection -> sensitivity label
Need to keep email for seven years -> retention policy/label
Need to search content for legal investigation -> eDiscovery

Service Trust, privacy, and regulatory concepts

Microsoft likes to test the trust story because buyers care about it.

Know these ideas:

Service Trust Portal provides information about compliance, privacy, security practices, and audit reports
Microsoft 365 supports compliance with standards and regulations, but the customer still has responsibilities
Customer data privacy and Microsoft commitments around handling data
concepts such as data residency, compliance offerings, and transparency

Do not memorize every certification framework. Just know that Microsoft provides documentation and reporting through the Service Trust Portal.

The best way to revise this domain

Create flashcards based on business problems, not product names.

For example:

"User sign-in needs extra verification" -> MFA
"Restrict access based on user/device/location" -> Conditional Access
"Manage mobile devices and app policies" -> Intune
"Block sensitive info from leaving" -> DLP
"Label and protect confidential files" -> Sensitivity labels
"Investigate content for legal case" -> eDiscovery

That matches how the exam asks questions.

Licensing, subscriptions, and support: smaller domain, easy points if you study the product lines

This domain is very manageable, but only if you study it directly. Many candidates assume they can guess. They cannot.

You need to understand how Microsoft sells Microsoft 365.

Core plan families

Know the difference between:

Microsoft 365 Business Basic
Microsoft 365 Business Standard
Microsoft 365 Business Premium
Microsoft 365 Apps for business
Enterprise plans such as Office 365 E1/E3/E5 and Microsoft 365 E3/E5 at a high level

You do not need every line item memorized, but you do need to know the pattern:

Business Basic: cloud services, lighter app entitlement
Business Standard: adds desktop apps and business productivity features
Business Premium: adds more advanced security and device management value
Apps for business: primarily the Office app suite without the full service bundle
Enterprise plans: broader capabilities for larger organizations, especially advanced compliance, security, analytics, and voice options depending on SKU

Also understand the distinction between:

Microsoft 365 plans
Office 365 plans
add-on licensing

Billing and support concepts

Know these basics:

subscription-based purchasing
monthly vs annual billing options at a high level
user-based licensing model
support availability through Microsoft and partners
service health and message center concepts in the admin ecosystem

You may also see questions about where organizations can review product details, compare plans, or understand service commitments.

Service Level Agreements and lifecycle awareness

Be familiar with:

the idea of a financially backed SLA for online services
service updates in the cloud model
Microsoft 365 roadmap and release/change awareness at a high level

You do not need legal-contract detail. You do need to understand that cloud services are continuously updated and governed by published commitments.

How to study this domain without drowning in SKU tables

Use Microsoft's official comparison pages and extract only these items for each major plan:

desktop apps included or not
email included or not
Teams included or not
device/security management level
target customer size/use case

That is enough for MS-900. If you try to memorize every add-on and every enterprise security feature, you will waste time.

A realistic MS-900 study plan based on your background

MS-900 is not a months-long grind unless you are completely new to Microsoft 365 and cloud concepts. For most candidates, this is a 1 to 4 week exam.

If you already work with Microsoft 365 lightly: 7 to 10 days

This fits help desk staff, coordinators, junior admins, or power users who already know Teams, Outlook, and OneDrive.

Days 1-2

Review cloud concepts
Learn the difference between Office 365 and Microsoft 365
Build your service comparison sheet for Teams, Exchange, SharePoint, OneDrive

Days 3-4

Cover the broader apps and services: Forms, Planner, Bookings, Viva, Lists, Stream, Loop
Review Windows, Intune, and Entra ID positioning in Microsoft 365

Days 5-6

Study security and compliance carefully
Drill DLP vs sensitivity labels vs retention vs eDiscovery
Learn Defender product roles at a high level

Days 7-8

Review licensing and support
Take a practice test
Revisit weak areas only

Days 9-10

Final review of Microsoft Learn notes
One more practice run

If you are new to Microsoft cloud: 2 to 3 weeks

Week 1

Cloud basics
Core collaboration services
Hands-on exploration in a trial tenant if possible

Week 2

Security, identity, compliance, and trust
Create flashcards for product-purpose mapping

Week 3

Licensing and support
Full practice exams
Read official docs for missed topics only

If you are non-technical but involved in Microsoft 365 projects: 3 to 4 weeks

Spend more time on terminology and product boundaries.

Week 1: cloud concepts and productivity workloads
Week 2: collaboration scenarios and use cases
Week 3: security/compliance language
Week 4: licensing, support, and exam practice

Weekly time target

Light experience: 8-12 hours total
New to the platform: 15-25 hours total
Non-technical learner: 20-30 hours total

The key is not total hours. It is repetition of service mapping. If you can quickly answer "Which Microsoft 365 service solves this business need?" you are on track.

Resources worth your time

Use a small set of high-quality resources. MS-900 does not reward random YouTube browsing.

Official first choice: Microsoft Learn

Start here:

Microsoft Learn exam page for MS-900
Learning path: Describe cloud concepts
Learning path: Describe core Microsoft 365 services and concepts
Learning path: Describe Microsoft 365 security and compliance capabilities
Learning path: Describe Microsoft 365 pricing, licensing, and support

Microsoft Learn is the closest match to exam wording and product positioning.

Official product documentation to use selectively

Use docs only to clarify confusing topics, especially:

Microsoft 365 documentation
Microsoft Entra documentation
Microsoft Intune documentation
Microsoft Purview documentation for compliance features
Service Trust Portal pages
Microsoft 365 plan comparison pages

Do not read docs front to back. Use them surgically.

Video courses that map well to fundamentals learners

Good options include:

John Savill on YouTube for Microsoft fundamentals explanations
LinkedIn Learning MS-900 courses by established Microsoft trainers when current versions are available
Pluralsight Microsoft 365 fundamentals content if you already have access

Pick one video source, not three.

Books

For a fundamentals exam, books are optional. If you prefer print or structured reading, look for current Microsoft 365 fundamentals titles from reputable publishers such as Microsoft Press or Sybex. Check publication date carefully because branding changes fast.

Hands-on practice

Hands-on work helps even for a fundamentals exam.

Best options:

Microsoft 365 Developer Program tenant, if available and appropriate for your use
Microsoft 365 trial tenants
a sandbox tenant in your lab environment

In your tenant, click through:

Microsoft 365 admin center
Teams admin center
Microsoft Entra admin center
Intune admin center
Microsoft Purview portal
Service health and message center views

You do not need to configure everything. Just seeing where capabilities live helps memory.

Practice questions

Since Truekia has 505 practice questions for this exam, use them as a diagnostic tool, not as a memorization dump.

A smart way to use them:

Take 50 questions cold.
Sort misses into four buckets: cloud, workloads, security/compliance, licensing.
Study only the weak bucket.
Repeat with another 50-75 questions.
In the final days, do mixed sets under time pressure.

If you miss a question, write down why the right answer is right and why the nearest wrong answer is wrong. That second part is where MS-900 is won.

How to answer MS-900 questions the way Microsoft writes them

Microsoft fundamentals exams often test whether you can identify the best fit among similar services. Read for keywords.

Examples of keyword mapping:

email/calendar -> Exchange Online
personal file storage/sync -> OneDrive for Business
team site/document library/intranet -> SharePoint Online
chat/meetings/channels -> Teams
identity/SSO/MFA -> Microsoft Entra ID
device/app management -> Intune
protect sensitive info from leaving -> DLP
classify and protect documents -> sensitivity labels
keep/delete content according to policy -> retention
investigation/legal hold/search -> eDiscovery

When two answers look similar, ask:

Is this about identity, device, content, or collaboration?
Is the question asking for storage location, user experience, or security control?
Is it asking what a product is, or what a license includes?

A lot of distractors are technically related but not the primary answer. For example:

Teams uses SharePoint, but Teams is still the answer if the need is persistent collaboration.
SharePoint stores team files, but OneDrive is the answer if the scenario is one user's personal work files.
Sensitivity labels protect/classify, but DLP is the answer if the need is to stop data leakage.

That distinction matters more than deep technical knowledge.

Last 48 hours and exam-day tactics

In the last two days, do not start new topics unless you are consistently missing an entire domain.

Final review checklist

Make sure you can explain, from memory:

public vs private vs hybrid cloud
SaaS vs PaaS vs IaaS
Microsoft 365 vs Office 365
Exchange Online, SharePoint Online, OneDrive for Business, Teams
Entra ID, Intune, Defender product family, Purview compliance concepts
DLP vs sensitivity labels vs retention vs eDiscovery
Business Basic vs Business Standard vs Business Premium
where Service Trust Portal fits

During the exam

Read the full question before looking at answers.
Watch for wording like best, most appropriate, or primary purpose.
Eliminate answers from the wrong category first. If the scenario is about identity, remove device and content tools immediately.
Do not overthink configuration detail. This is a fundamentals exam.
Flag uncertain questions and move on. Microsoft exams can create time loss if you stare too long at one licensing question.

For remote or test-center delivery

If you are taking it online, prepare your room early and avoid technical surprises. If at a test center, arrive early and use the extra minutes to mentally rehearse the service map.

The final mindset

Treat MS-900 as a product recognition and business-use-case exam. If you study it like a junior admin lab exam, you will go too deep in the wrong places. If you study it like a product brochure, you will stay too shallow.

The sweet spot is this: know what each Microsoft 365 service is for, how it relates to neighboring services, and which license family typically includes which level of capability. That is enough to pass confidently.