The MS-900 examination is no longer available. Microsoft retired Microsoft 365 Fundamentals on March 31, 2026, making the old skills outline a historical reference rather than a registration or preparation route. That distinction matters because many explanations of Microsoft 365 still carry an MS-900 label even though the product, service names, licensing arrangements, and certification choices continue to change. This article explains what the assessment originally covered, which concepts remain useful, and how to choose a relevant active direction without treating an old certificate as if it were still offered.
The legacy MS-900 syllabus remains a helpful map of how collaboration, identity, devices, governance, billing and service support connect in a cloud productivity environment. It is not an authoritative description of every feature available in Microsoft 365 today. Readers can use it to identify vocabulary and operational responsibilities, then confirm current capabilities and eligibility directly with Microsoft. This approach is more useful than memorizing a retired exam's domain percentages or attempting to reconstruct an examination that cannot be scheduled.
What the retired MS-900 blueprint covered
The historical assessment introduced cloud computing ideas before moving into Microsoft's productivity services. Cloud models and service models were not presented merely as definitions: they explained why organizations purchase a subscription service rather than own every layer of its infrastructure. The concepts of public, private and hybrid cloud, subscription-based delivery and shared responsibility supplied a common language for later questions about business value, security and operations.
Another part of the blueprint linked familiar products to administrative responsibilities. A person who knows how to send messages in Teams has not necessarily understood the identity, retention and device policies that affect those messages. Likewise, someone using SharePoint documents may not know how administrators govern site permissions, external sharing and information lifecycle. This difference between end-user capability and organizational control made the foundational exam meaningful to business stakeholders as well as beginning IT practitioners.
The historical skills guide also discussed subscription plans, pricing, service health and support. Those topics should be read as categories, not a promise that old bundle names or purchasing rules still apply. A current licensing decision must account for the tenant, region, commercial agreement and latest product entitlements. The retired syllabus can remind readers to investigate service limits and billing obligations, but it cannot settle today's licensing questions by itself.
Collaboration services in the Microsoft 365 environment
Exchange Online, SharePoint, OneDrive and Teams serve different but connected purposes. Exchange supports organizational email, calendars and related communication workloads. SharePoint provides sites and managed document collaboration, while OneDrive gives individuals a synchronized workspace for their files. Teams brings conversations, meetings and integrations together, often relying on the other services for content and calendaring. Knowing how those relationships work is more practical than trying to memorize a disconnected product list.
Consider a project team sharing a document during a meeting. Participants might see the file in Teams, but its storage and access arrangements can depend on the underlying SharePoint or OneDrive location. Retention, search, permissions and guest access involve more than the meeting interface. An administrator investigating an accidental disclosure or a failed share must follow the content through the services that store and govern it, not assume that a single Teams toggle explains everything.
For that reason, foundational learning should distinguish user experiences from configuration boundaries. Exchange mail flow is not interchangeable with Teams chat. Personal file sharing is not identical to a departmental library. A Teams policy cannot replace every identity or data protection setting. The Microsoft 365 concept remains useful precisely because these connected tools have different responsibilities even when they appear as one suite to an employee.
Identity, devices and administrative boundaries
Microsoft Entra ID supports identities and access across the Microsoft cloud environment. Its job includes user and group objects, sign-in mechanisms and access decisions; application services then use that identity information in their own permission models. An organization may need an employee to sign in successfully while still restricting that employee's ability to export certain information or access a sensitive project site. Identity authentication and data authorization answer related, but different, questions.
Multi-factor authentication and conditional access illustrate that distinction. MFA provides an additional verification step, while conditional access allows decisions to reflect properties such as user, device or sign-in circumstances. These controls are not universal substitutes for application permissions, device compliance or information protection. Readers using legacy training should check how Microsoft Entra ID is currently administered rather than relying on old Azure Active Directory terminology.
Intune adds a device and application-management dimension. Managing a laptop, applying an organizational configuration profile, checking compliance and controlling access to company data are separate activities from issuing Microsoft 365 licenses. A properly prepared administrator can explain what the organization manages on corporate devices, what is available for personally owned devices, and how management choices affect user privacy and access. The retired fundamentals scope introduced this relationship without qualifying someone to design every endpoint deployment.
Administrative roles matter for the same reason. Giving one person global administrative authority for ordinary support work creates unnecessary risk. Teams, Exchange, SharePoint, security and compliance operations have different boundaries, and real organizations often distribute responsibilities among specialized administrators. When reviewing fundamentals, ask not only which service provides a feature but who should be permitted to operate it and how the action would be audited.
Security, information protection and compliance
Security and compliance were major themes of the historic MS-900 curriculum, but there is no single setting that makes a tenant secure. Identity controls limit unwanted access; threat protection helps detect and respond to attacks; device security addresses endpoint risk; and information governance determines how business records are labeled, retained, discovered and disposed of. The strongest explanation shows which failure mode each layer is intended to address.
Microsoft Defender offerings cover different protection surfaces, and Microsoft Purview includes capabilities related to information protection, retention, eDiscovery and compliance processes. These product families change in naming, packaging and functionality over time. A reader should understand why a company needs a retention requirement or a data loss prevention control before comparing license editions or following screenshots from an older exam book. A useful deeper topic is the connection between compliance requirements and the enforcement mechanisms that support them.
An important operational example is an employee leaving a company. The organization may need to disable access, transfer business files, preserve records under applicable retention rules and remove managed device data. These steps cross identity, collaboration, records management and endpoint administration. The retired blueprint's enduring value lies in helping people recognize these overlapping responsibilities, not in declaring one product the answer to every scenario.
Another example is a compromised account. Resetting a password may be necessary but insufficient if sessions, app consent, forwarding rules or risky sign-ins remain unexamined. A fundamentals learner should understand the sequence of identifying affected services, limiting access, reviewing evidence and coordinating with administrators who own the relevant systems. Product-specific remediation instructions need to come from current guidance and local policy.
Licensing, service health and support after retirement
Licensing concepts remain relevant because Microsoft 365 is sold through subscriptions and service-specific entitlements. However, package names, commercial channels, compliance features and add-on rights can change. Historical exam materials sometimes encourage candidates to match features to plans as if there were one permanent matrix. An operating business instead needs to verify the licenses assigned to the relevant users, compare available alternatives and document which capabilities are necessary for security and collaboration outcomes.
Service management is equally important. Administrators must know where to investigate service incidents, distinguish a tenant configuration issue from a vendor-side outage, and communicate realistic expectations to users. Support availability depends on an organization's agreements and deployment arrangements. An old service-level description is a starting point for terminology, not a substitute for the current contractual language or service-health data.
Cost comparisons should consider migration, governance and operational support, not only the subscription price. For instance, increasing document retention may satisfy a legal requirement but can also introduce storage and information-management implications. Adding security functionality may reduce risk but create policy administration work. The more mature question is what the organization needs to control and what costs accompany those responsibilities, rather than which named exam once mentioned a particular Microsoft 365 bundle.
Where MS-900 differs from active certification choices
Retirement does not mean Microsoft 365 knowledge has ceased to matter. It means candidates cannot earn a new MS-900 examination result after the published retirement date. Someone who wants current formal recognition should begin with an active credential's official overview and skills measured, then decide whether its scope fits the role. A current exam may focus more deeply on administration, security or another specialized responsibility than the former general-purpose fundamentals exam did.
Microsoft's AB-900 concerns Microsoft 365 Copilot and agent administration fundamentals. Its objectives include core Microsoft 365 objects, information protection and governance, and basic administrative work with Copilot and agents. The shared Microsoft 365 context makes it relevant to some readers of old MS-900 material, but it is not an automatic one-for-one replacement. Someone who primarily wants to develop Exchange, Teams, SharePoint or identity administration skills should compare other active training or certification objectives instead of assuming that AB-900 covers the former syllabus unchanged.
The best next step is therefore role-based. A business stakeholder may need service ownership, licensing and risk vocabulary, without pursuing a specific exam. A beginning administrator may need current tenant labs and service-specific learning. Someone responsible for protection and compliance should compare active security and governance credentials. A retired exam is useful historical context only when it directs a learner toward demonstrably current work.
Using MS-900 material responsibly today
For historical study, organize notes around decisions rather than old multiple-choice traps. Explain what the service does, where identities and data are controlled, which team owns its operation and what questions require current product documentation. This creates knowledge transferable to a modern environment even when product names and screens change. Avoid presenting a 2025 or earlier practice question as evidence of the options offered in 2026.
Readers maintaining older records or interpreting an existing credential may still need to know what the MS-900 exam covered. That history is legitimate and deserves a precise account. The boundary is equally clear: this page is an account of retired Microsoft 365 Fundamentals objectives, not exam registration advice or proof that a new certificate can be earned. Verification should begin with Microsoft's archived study guide for the old objective map and its current certification catalog for any decision about training, exams or commercial functionality.
