MS-900 Exam Guide, Objectives & Preparation

Exam Overview

Exam Code	MS-900
Exam Name	Microsoft 365 Fundamentals
Vendor	Microsoft
Total Questions	432
Last Updated	26-Oct, 2026

Free MS-900 Questions Get Premium Access

Why CertsPoint?

Latest & Verified Questions
Detailed Explanations
Regular Updates
Full-Length Practice Tests
Boost Your Exam Confidence

PDF Study Materials

Downloadable guides and resources

Practice Tests

Full-length tests with real exam experience

Progress Tracking

Monitor your performance and improvement

Study Anywhere

Access on desktop, tablet, and mobile

Excellent

4.6 (398 Up Votes)

Secure Payment Privacy Protected Money Back Guarantee

Free MS-900 Practice Questions

Explore 6 free practice questions for the Microsoft MS-900 exam and review the answers and explanations to support your preparation.

Question 1
Multiple answers

A company that has 50 employees plans to purchase a Microsoft 365 Business subscription. Which two payment methods are available? Each correct answer presents a complete solution NOTE: Each correct selection is worth one point.
- Option A:
  PayPal
  Correct
- Option B:
  automatic bank transfer
  Correct
- Option C:
  Enterprise Agreement
  Correct
- Option D:
  credit card or debit card
  Correct
Show Answer & Explanation Hide Answer & Explanation
Correct Answer: B, D
Explanation
For a company purchasing a Microsoft 365 Business subscription, the available payment methods include:
B. Automatic bank transfer ✅
D. Credit card or debit card ✅
Why the others are incorrect
A. PayPal ❌
PayPal is generally not a standard payment option for Microsoft 365 Business subscriptions.
C. Enterprise Agreement ❌
An Enterprise Agreement is a volume licensing program, not a payment method, and is typically intended for larger organizations.
Correct Answers: B. Automatic bank transfer and D. Credit card or debit card ✅✅
Question 2
Single answer

A company is a Microsoft 365 reseller. The company does not provide managed services or direct customer support. You need to provide licenses for customers and earn commissions for each license sold. What should you do?
- Option A:
  Buy licenses for customers by using the Microsoft admin portal
  Correct
- Option B:
  Sign up as a Cloud Solution Provider direct reseller.
  Correct
- Option C:
  Sign up as a Cloud Solution Provider indirect reseller.
  Correct
- Option D:
  Buy licenses for customers from a Microsoft authorized distributor.
  Correct
Show Answer & Explanation Hide Answer & Explanation
Correct Answer: C
Explanation
The company:
Wants to sell Microsoft 365 licenses.
Wants to earn commissions/margins on license sales.
Does not provide managed services or direct customer support.
An Indirect Reseller works through a CSP distributor (indirect provider), which handles much of the infrastructure, billing support, and relationship with Microsoft.
Why the others are incorrect
A. Buy licenses by using the Microsoft admin portal ❌
This is for customers managing their own subscriptions, not for reselling licenses.
B. Sign up as a CSP direct reseller ❌
Direct resellers must provide customer support and meet Microsoft's operational requirements.
D. Buy licenses for customers from a Microsoft authorized distributor ❌
Purchasing licenses from a distributor alone does not establish the required CSP reseller relationship for earning commissions as described in the scenario.
✅ Correct Answer: C. Sign up as a Cloud Solution Provider indirect reseller.

Question 3

Drag & Drop

DRAG DROP An organization is considering migrating resources to the cloud. The company does not plan to deploy Microsoft Azure ExpressRoute or site-to-site VPNs. You need to identify which workloads you can migrate to the cloud. Which workloads you can migrate to the cloud? To answer, drag the appropriate actions to the correct workloads. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Show Answer & Explanation Hide Answer & Explanation

Correct Answer

Workload Correct Action Explanation
You have a legacy application that requires connectivity with an on-premises data store. Remain on-premises Legacy applications with strict dependencies on physical, on-premises data infrastructure often suffer from latency issues or security compliance constraints if moved to the public cloud without major rewriting. Keeping them on-premises is the safest approach.
You need to deploy an external-facing website. Migrate to the cloud Public clouds are perfectly designed for external-facing websites due to their global reach, high availability, DDoS protection, and ability to automatically scale resources up or down based on incoming web traffic.
You need to deploy a Microsoft SharePoint collaboration site for partners. Migrate to the cloud Deploying collaboration environments (like SharePoint/SharePoint Online) in the cloud provides external partners with seamless, secure access from anywhere without needing complex corporate VPN configurations.

Workload	Correct Action	Explanation
You have a legacy application that requires connectivity with an on-premises data store.	Remain on-premises	Legacy applications with strict dependencies on physical, on-premises data infrastructure often suffer from latency issues or security compliance constraints if moved to the public cloud without major rewriting. Keeping them on-premises is the safest approach.
You need to deploy an external-facing website.	Migrate to the cloud	Public clouds are perfectly designed for external-facing websites due to their global reach, high availability, DDoS protection, and ability to automatically scale resources up or down based on incoming web traffic.
You need to deploy a Microsoft SharePoint collaboration site for partners.	Migrate to the cloud	Deploying collaboration environments (like SharePoint/SharePoint Online) in the cloud provides external partners with seamless, secure access from anywhere without needing complex corporate VPN configurations.

Explanation

Workload Correct Action Explanation
You have a legacy application that requires connectivity with an on-premises data store. Remain on-premises Legacy applications with strict dependencies on physical, on-premises data infrastructure often suffer from latency issues or security compliance constraints if moved to the public cloud without major rewriting. Keeping them on-premises is the safest approach.
You need to deploy an external-facing website. Migrate to the cloud Public clouds are perfectly designed for external-facing websites due to their global reach, high availability, DDoS protection, and ability to automatically scale resources up or down based on incoming web traffic.
You need to deploy a Microsoft SharePoint collaboration site for partners. Migrate to the cloud Deploying collaboration environments (like SharePoint/SharePoint Online) in the cloud provides external partners with seamless, secure access from anywhere without needing complex corporate VPN configurations.

Question 4
Single answer

You are the Microsoft 365 administrator for a company. An employee requests personal data under General Data Protection Regulation (GDPR) guidelines. You need to retrieve data for the employee. What should you do?
- Option A:
  Create a data subject request case.
  Correct
- Option B:
  Create a retention policy.
  Correct
- Option C:
  Create a data-loss prevention policy.
  Correct
- Option D:
  Create a GDPR assessment
  Correct
Show Answer & Explanation Hide Answer & Explanation
Correct Answer: A
Explanation
Under GDPR, when an employee requests access to their personal data, Microsoft 365 provides Data Subject Requests (DSRs) to help organizations locate, export, review, or delete personal data.
A. Create a data subject request case ✅
This is the correct method for handling and retrieving an individual's personal data under GDPR.
Why the others are incorrect
B. Create a retention policy ❌
Used to retain or delete content according to compliance requirements, not to retrieve personal data.
C. Create a data-loss prevention (DLP) policy ❌
Prevents sensitive information from being shared improperly.
D. Create a GDPR assessment ❌
Used to evaluate compliance readiness, not to fulfill a user's data request.
✅ Correct Answer: A. Create a data subject request case.
Question 5
Single answer

Your organization plans to deploy Microsoft 365 in a hybrid scenario. You need to ensure that employees can use a smart card for authentication. Which hybrid identity solution should you implement?
- Option A:
  password hash synchronization with single sign on
  Correct
- Option B:
  Active Directory federation Services (AD FS)
  Correct
- Option C:
  Ping federate and federation integration
  Correct
- Option D:
  pass-through authentication and single sign-on
  Correct
Show Answer & Explanation Hide Answer & Explanation
Correct Answer: B
Explanation
If employees must use smart cards for authentication in a Microsoft 365 hybrid environment, you need a federated identity solution that supports smart card authentication.
B. Active Directory Federation Services (AD FS) ✅
AD FS supports advanced authentication methods, including smart cards and certificate-based authentication, making it the correct choice.
Why the others are incorrect
A. Password Hash Synchronization with Single Sign-On ❌
Uses password-based authentication and does not provide native smart card authentication.
C. PingFederate and federation integration ❌
While PingFederate can support smart cards, Microsoft exam questions typically expect the Microsoft-native solution, AD FS, for this requirement.
D. Pass-through Authentication and Single Sign-On ❌
Validates passwords against on-premises Active Directory but does not provide smart card authentication.
✅ Correct Answer: B. Active Directory Federation Services (AD FS).
Question 6
Single answer

You are the Microsoft 365 administrator for a company. Your company plans to open a new office in the United Kingdom. You need to provide penetration test and security assessment reports for the new office. Where can you locate the required reports?
- Option A:
  Data Governance page of the Security and Compliance portal.
  Correct
- Option B:
  Compliance Manager page of the Services Trust portal
  Correct
- Option C:
  Data Loss Prevention page of the Security and Compliance portal
  Correct
- Option D:
  Regional Compliance page of the Services Trust portal
  Correct
Show Answer & Explanation Hide Answer & Explanation
Correct Answer: D
Explanation
The Services Trust Portal (STP) provides Microsoft audit reports, compliance documentation, penetration test summaries, security assessments, and regional compliance information.
For a new office in the United Kingdom, you would use the Regional Compliance section to access reports related to regional regulations and compliance requirements.
Why the others are incorrect
A. Data Governance page of the Security and Compliance portal ❌
Focuses on data classification, retention, and governance, not penetration test reports.
B. Compliance Manager page of the Services Trust Portal ❌
Used to assess and manage compliance posture, not primarily to obtain penetration testing and security assessment reports.
C. Data Loss Prevention page of the Security and Compliance portal ❌
Used to create and manage DLP policies.
✅ Correct Answer: D. Regional Compliance page of the Services Trust Portal.

Free MS-900 Practice Questions

Question 1

A company that has 50 employees plans to purchase a Microsoft 365 Business subscription. Which two payment methods are available? Each correct answer presents a complete solution NOTE: Each correct selection is worth one point.

PayPal

automatic bank transfer

Enterprise Agreement

credit card or debit card

Question 2

A company is a Microsoft 365 reseller. The company does not provide managed services or direct customer support. You need to provide licenses for customers and earn commissions for each license sold. What should you do?

Buy licenses for customers by using the Microsoft admin portal

Sign up as a Cloud Solution Provider direct reseller.

Sign up as a Cloud Solution Provider indirect reseller.

Buy licenses for customers from a Microsoft authorized distributor.

Question 3

Question 4

You are the Microsoft 365 administrator for a company. An employee requests personal data under General Data Protection Regulation (GDPR) guidelines. You need to retrieve data for the employee. What should you do?

Create a data subject request case.

Create a retention policy.

Create a data-loss prevention policy.

Create a GDPR assessment

Question 5

Your organization plans to deploy Microsoft 365 in a hybrid scenario. You need to ensure that employees can use a smart card for authentication. Which hybrid identity solution should you implement?

password hash synchronization with single sign on

Active Directory federation Services (AD FS)

Ping federate and federation integration

pass-through authentication and single sign-on

Question 6

You are the Microsoft 365 administrator for a company. Your company plans to open a new office in the United Kingdom. You need to provide penetration test and security assessment reports for the new office. Where can you locate the required reports?

Data Governance page of the Security and Compliance portal.

Compliance Manager page of the Services Trust portal

Data Loss Prevention page of the Security and Compliance portal

Regional Compliance page of the Services Trust portal