Microsoft Fundamentals MS-900 Exam Questions 2025

Azure Information Protection (AIP) is a cloud-based solution that uses encryption, identity, and authorization policies to help secure files and email.

1. AIP's protection technology, Azure Rights Management (Azure RMS), is used to encrypt documents and emails to ensure that only authorized users can access the content.

2. When configuring protection, administrators can define specific usage rights. This includes granting or denying permissions such as the ability to print, copy, or forward the content.

3. Administrators can configure the use license validity period for protected content. By setting this period to zero, a user is required to connect to the internet to authenticate and acquire a license each time they open the document, effectively preventing offline access.

1. Microsoft Learn. (2023). What is Azure Information Protection (AIP)? "Azure Information Protection (AIP) is a cloud-based solution that helps an organization to classify and optionally

protect its documents and emails by applying labels... Protection technology uses Azure Rights Management (Azure RMS)."

2. Microsoft Learn. (2023). Configuring usage rights for Azure Rights Management. This document details the configurable rights for protected content

explicitly listing "Print (PRINT)" as a right that can be granted or restricted within a protection policy.

3. Microsoft Learn. (2023). Terms for Azure Information Protection - use license. "The use license validity period... For a more restrictive setting

users can be required to connect to the internet every time they open a protected document or email. This configuration is achieved by setting the use license validity period to 0."

To retain mailbox content for a user whose account is deleted, the mailbox must first be placed on hold. This action converts the mailbox into an "inactive mailbox" when the user account is deleted, preserving its contents. The two primary methods to place a mailbox on hold are applying a Microsoft 365 retention policy or placing it on Litigation Hold. Both methods ensure that the mailbox data is preserved for the required period (in this case, 90 days) after the employee's departure, meeting the company's compliance and data retention requirements.

B. Recover the inactive mailbox.

This is an action performed on an existing inactive mailbox to make it an active mailbox for a new or returning user, not a method to initially retain the data.

C. Restore the inactive mailbox.

This action merges the content from an existing inactive mailbox into another user's active mailbox. It is not a method for the initial preservation of the terminated employee's data.

1. Microsoft Purview Documentation

"Learn about inactive mailboxes": "To make a mailbox inactive... the mailbox must be placed on Litigation Hold or assigned to a Microsoft 365 retention policy before it's deleted." This statement directly supports that applying a Litigation Hold (D) or a retention policy (A) are the prerequisite steps.

Source: Microsoft Learn

Learn about inactive mailboxes

"Inactive mailboxes" section.

2. Microsoft Purview Documentation

"Create and manage inactive mailboxes": "Step 1: Place a hold on a mailbox. To make a mailbox inactive

you have to place the mailbox on Litigation Hold or apply a Microsoft 365 retention policy to the mailbox before the corresponding user account is deleted." This outlines the exact two solutions presented in options A and D.

Source: Microsoft Learn

Create and manage inactive mailboxes

"Step 1: Place a hold on a mailbox" section.

3. Microsoft Purview Documentation

"Recover an inactive mailbox": This document explains that recovering an inactive mailbox is the process of converting it back to an active mailbox. This confirms that recovery (B) is a subsequent management task

not an initial retention strategy.

Source: Microsoft Learn

Recover an inactive mailbox

"Overview" section.

4. Microsoft Purview Documentation

"Restore an inactive mailbox": This document describes restoring as a process to "merge the contents of the inactive mailbox to an existing mailbox." This confirms that restoring (C) is for data consolidation

not the primary retention method.

Source: Microsoft Learn

Restore an inactive mailbox

"Overview" section.

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/MS-900/page_132_img_2.jpg

The selection of a Windows servicing tool depends on the level of control an administrator requires over the update process.

Windows Update is the default service that provides updates directly from Microsoft. While Windows Update for Business offers some policy-based controls for deferring updates, it's generally designed for simpler environments and provides limited administrative oversight compared to enterprise-grade tools. It is suitable for scenarios where automatic updates with basic deferral capabilities are sufficient.

Microsoft Endpoint Configuration Manager (MECM) is a comprehensive management solution that provides granular control over the entire update process. Administrators can use it to create sophisticated, phased deployments (servicing rings), manage bandwidth usage with peer-to-peer content distribution, approve or deny specific updates, and generate detailed compliance reports. This aligns with the need for "full control" and multiple deployment options.

Microsoft Learn, Windows client documentation. "Servicing tools for Windows client updates." This document outlines the different tools available for servicing Windows clients. It describes Windows Update (and Windows Update for Business) as a direct connection to Microsoft's update service with policy-based controls, while positioning Configuration Manager as the solution for the "most granular control over scheduling and deployment."

Microsoft Learn, Configuration Manager documentation. "Introduction to software updates in Microsoft Endpoint Configuration Manager." This source details the capabilities of MECM, stating, "Software updates in Configuration Manager provides a set of tools and resources that can help manage the complex task of tracking and applying software updates to client computers in the enterprise." It highlights features like managing synchronization, creating deployment rings, and monitoring compliance, which exemplify full control over the update process.

As a Microsoft 365 administrator, the primary and recommended method for obtaining technical support is by creating a service request through the centralized Microsoft 365 admin center. This portal allows administrators to submit detailed requests for any service within their subscription, including SharePoint Online, and track their status. Additionally, Microsoft provides direct telephone support for business customers, allowing administrators to speak with a support agent. Both methods are official and complete solutions for resolving technical issues.

A. Support requests are managed centrally in the Microsoft 365 admin center, not directly within the SharePoint admin center, which is for service-specific configuration.

D. A SharePoint portal is a user-facing site. End users cannot create official Microsoft support requests; this is an administrative privilege exercised through the admin center.

1. Microsoft. (n.d.). Get help or support for Microsoft 365 for business. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support.

Reference for C: The document states

"As an admin... you can use the Help & support page in the admin center to search for solutions

view recommendations

and create a service request to get support from Microsoft." This confirms the use of the Microsoft 365 admin center.

Reference for B: The same document includes a section

"Call support

" which directs administrators to find support phone numbers for their country or region

confirming telephone support is a valid option.

2. Microsoft. (n.d.). Find Microsoft 365 for business support phone numbers by country or region. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/admin/support/business-support-phone-numbers.

Reference for B: This page provides a comprehensive list of phone numbers

explicitly validating telephone as a support channel for administrators.

The Cloud Solution Provider (CSP) indirect reseller model is specifically designed for companies that want to sell Microsoft cloud services but do not have the infrastructure to provide direct billing or 24/7 technical support. In this model, the reseller partners with an indirect provider (a distributor) who manages the direct relationship with Microsoft, including billing and support infrastructure. This allows the reseller to focus on sales and customer relationships while earning commissions or margins, which perfectly matches the scenario described in the question.

A. Buy licenses for customers by using the Microsoft admin portal

This portal is for end-customer organizations to manage licenses for their own employees, not for a company to act as a reseller to other businesses.

B. Sign up as a Cloud Solution Provider direct reseller.

The direct reseller model requires the partner to provide their own billing infrastructure and 24/7 technical support, which the company explicitly does not offer.

D. Buy licenses for customers from a Microsoft authorized distributor.

This describes an action taken by an indirect reseller. The correct foundational step is to first enroll in the appropriate program, which is the CSP indirect reseller program.

---

1. Microsoft Partner Center Documentation. "Explore models in the Cloud Solution Provider program." Microsoft Learn. This document outlines the two CSP models. It states

"As an indirect reseller

you work with indirect providers (also known as distributors) who have a direct relationship with Microsoft... Partnering with indirect providers allows you to go to market without having to make a large capital investment." This directly supports the choice of the indirect reseller model for a company not providing support or managed services.

Source: https://learn.microsoft.com/en-us/partner-center/csp-overview

Section: "Cloud Solution Provider models".

2. Microsoft Partner Center Documentation. "Enroll in the Cloud Solution Provider program." Microsoft Learn. This guide details the requirements for each model. For the Direct Bill model

it lists requirements such as "Provide your customers with their primary channel for support

" which the company in the scenario cannot meet. This reinforces that the indirect model is the only suitable option.

Source: https://learn.microsoft.com/en-us/partner-center/csp-enroll-as-direct

Section: "Requirements".

Microsoft eDiscovery tools are designed for searching, identifying, and preserving electronic data for legal investigations or cases. They can be used to find information, including email content and documents in SharePoint Online, as part of a discovery process. This aligns with the first two statements.

The third statement is incorrect because Microsoft eDiscovery is a search and preservation tool, not a data lifecycle management tool. Data retention policies, such as ensuring documents are retained for a specific period and then deleted, are managed using Microsoft 365 retention policies, which are part of Microsoft Purview information governance, not eDiscovery.

Microsoft Docs. (2025). Overview of Microsoft Purview eDiscovery solutions. Retrieved from Microsoft official documentation.

Microsoft Docs. (2025). Learn about retention policies and retention labels. Retrieved from Microsoft official documentation.

Microsoft's support response times, governed by Service Level Agreements (SLAs), depend on the severity level assigned to an incident. A Critical (Severity A) incident, which involves a significant loss of service or business impact, receives the highest priority. For these events, Microsoft provides a continuous response with a commitment to an initial response time of one hour or less.

For High (Severity B) incidents, which cause a moderate business impact, Microsoft's response time is typically within four business hours for a standard support plan, as there is no commitment for a specific response time. Lastly, Noncritical (Severity C) incidents, which have a minimum business impact, receive the lowest priority. For these, the response is generally provided during business hours with an expected initial response time of eight hours or less for a standard support plan, indicating a "next-day" response for many cases. The provided options reflect a simplified interpretation of these service levels.

Microsoft Support Plans—Support Scope and Responsiveness: This official Microsoft Azure documentation outlines the different severity levels (A, B, and C) and their corresponding initial response times for various support plans, including the one-hour response time for Severity A (Critical) and the business-hours-based response for lower-severity cases.

Support for Microsoft Power Platform and Dynamics 365 apps: This document provides similar details, confirming that Severity A (Critical) issues require a "less than one hour" response time and that Microsoft expects the customer to commit to continuous, 24x7 operation with the support team. It also confirms that Severity C (Noncritical) issues are handled during business hours only.

Get support - Microsoft 365 admin: This official guide for Microsoft 365 administrators confirms the definitions for different severity levels and states the initial response times, such as "1 hour or less" for Sev A and "1 business day or less" for Sev B (High) incidents under a specific support model, which correlates with the "next-day" response for high-severity issues. It also outlines the continuous support for critical issues.

Microsoft ensures protection in its multitenant cloud environment through a defense-in-depth strategy. This includes physical, logical, and data-layer controls.

1. BitLocker Encryption (A): At the physical layer, BitLocker AES 256-bit encryption is used on all servers, encrypting customer data at rest on the disk volumes. This protects against unauthorized access to the underlying hardware.

2. Azure AD Isolation (B): At the logical layer, each tenant is a discrete, isolated container within Azure Active Directory (Azure AD). Azure AD enforces strict security boundaries, using role-based access control (RBAC) to ensure that credentials for one tenant cannot access the resources of another.

3. Application-Level Isolation (F): Services like Exchange Online are designed for multitenancy, meaning mailboxes from multiple tenants are stored in the same databases. Protection is provided by application-level code that enforces tenant isolation, ensuring no tenant can access or view the data of another.

C. Transport Layer Security (TLS) is a protocol used to encrypt data in transit over a network, not data at rest on a server.

D. Azure AD provides authorization at the identity and application layers. The transport layer is responsible for data transmission, not user authorization or access control.

E. This describes a dedicated or single-tenant architecture. The standard Microsoft 365 multitenant environment intentionally and securely stores data from multiple tenants in shared databases.

1. Microsoft Trust Center. (n.d.). Encryption in Microsoft 365. Microsoft. Retrieved from https://learn.microsoft.com/en-us/purview/encryption.

Section: "Encryption technologies in Microsoft 365" -> "Volume-level encryption". This section explicitly states

"Data at rest in Microsoft 365 is encrypted at the physical level with BitLocker." This supports answer A and refutes C's application to data at rest.

2. Microsoft. (2023

October 18). Isolation and Access Control in Microsoft 365. Microsoft Learn.

Section: "Tenant Isolation". This document details how Azure Active Directory provides a security boundary for each tenant. It states

"The logical isolation of customer content for each tenant is achieved through Azure Active Directory." This supports answer B.

3. Microsoft. (2023

October 18). Isolation and Access Control in Microsoft 365. Microsoft Learn.

Section: "Service-Specific Isolation" -> "Isolation in Exchange Online". This section explains

"Exchange Online stores data from multiple tenants in the same databases... Exchange Online application logic ensures that tenants can only manage and see their own mailboxes and recipients." This supports the architectural fact in F and explains the protection mechanism

while refuting E.

For Microsoft 365 Business subscriptions, which are designed for small and medium-sized businesses (up to 300 users), Microsoft provides flexible payment options. The most common methods when purchasing directly are with a credit or debit card. Additionally, in many countries and regions, customers can opt to pay directly from a bank account, which functions as an automatic bank transfer or direct debit. These two methods are the standard options available for a company of this size.

A. PayPal: PayPal is not a standard payment option offered globally for Microsoft 365 business subscriptions. Payment methods are limited to those specified by Microsoft for business accounts.

C. Enterprise Agreement: An Enterprise Agreement (EA) is a volume licensing program, not a direct payment method. It is designed for large organizations, typically with 500 or more users, not for a 50-employee company.

1. Microsoft Learn. (2024). Pay for your Microsoft business subscription. Document ID: f35a262c-336a-485a-a811-28b56e0ab255. Section: "Payment methods". This document explicitly states

"You can pay for your subscription with a credit or debit card

or a bank account."

2. Microsoft Learn. (2024). Manage payment methods for Microsoft business accounts. Document ID: d1344362-72b8-4b32-a1b7-2a8e2f2a3681. Section: "Add

update

or delete a payment method". This guide details the process for adding credit cards

debit cards

or bank accounts as payment instruments.

3. Microsoft Volume Licensing. (n.d.). Enterprise Agreement. Retrieved from the official Microsoft licensing site. The program overview specifies

"Best for organizations with 500 or more users or devices." This confirms that an EA is not the appropriate channel for a 50-employee company.

There are several officially supported methods for deploying Microsoft 365 Apps (formerly Office 365 ProPlus). The three primary methods are:

1. User-driven installation: Users with an assigned license can sign in to the Microsoft 365 portal and install the applications directly. This is the simplest method.

2. Managed deployment from a local source: Administrators can use the Office Deployment Tool (ODT) to download the installation files to a local network share and then deploy them to user devices.

3. Enterprise software deployment: Administrators can use enterprise management tools like Microsoft Configuration Manager (SCCM) to deploy and manage the installation of Microsoft 365 Apps from a local distribution point.

Microsoft 365 Apps use the Click-to-Run (C2R) installation technology, not the Windows Installer (MSI) technology used for older, volume-licensed versions of Office.

B. Microsoft 365 Apps are deployed using Click-to-Run technology, not Windows Installer (MSI) packages, making this method technically impossible.

C. A Windows Installer (MSI) package for Microsoft 365 Apps is not available for download, as it uses a different installation technology (Click-to-Run).

1. Microsoft Learn. (2024). Choose how to deploy Microsoft 365 Apps. This document outlines the primary deployment options

stating

"You can deploy Microsoft 365 Apps to users in your organization in a variety of ways

" and lists installing from the Office portal (Option E)

using the Office Deployment Tool (Option D)

and using Microsoft Configuration Manager (Option A).

2. Microsoft Learn. (2023). Deploy Microsoft 365 Apps with Microsoft Configuration Manager (current branch). This guide explicitly details the process for Option A: "You can deploy Microsoft 365 Apps with Configuration Manager. You create the application in Configuration Manager by using the Office 365 Client Installation wizard."

3. Microsoft Learn. (2024). Overview of the Office Deployment Tool. This document confirms Option D

stating

"The Office Deployment Tool (ODT) is a command-line tool that you can use to download and deploy Microsoft 365 Apps to your client computers."

4. Microsoft Support. (2024). Download and install or reinstall Microsoft 365 or Office 2021 on a PC or Mac. This end-user documentation validates Option E by instructing users to "Go to www.office.com and if you're not already signed in

select Sign in... From the Microsoft 365 home page select Install apps."