A field guide to Microsoft's Copilot credentials: the AB-series spine, the developer track, and the security track, and how to pick the one that matches the work you do.
What you'll learn
Tell certifications, exams, instructor-led courses, and Applied Skills apart
Match each AB-series credential to the work it measures
Choose GH-300, SC-200, or SC-500 from your real responsibilities
Check a credential's lifecycle status before you build a plan around it
Search for "Microsoft Copilot certification" and you'll meet a wall of codes: AB-900, AB-730, AB-731, AB-620, AB-100, GH-300, SC-200, SC-500. Each one measures different work. A poor match can leave you studying for weeks for a credential that says little about your actual role.
This lesson gives you a workable map. You'll identify the different record types, match credentials to the work you own, and check that a route is still current before planning around it.
Start with the record type
Microsoft Learn puts several kinds of record along the same learning route. They aren't interchangeable, and knowing which one you're looking at prevents you from booking the wrong assessment.
Record type
What it is
Certification
The formal credential you earn by meeting its requirements
Exam
The test associated with a certification (for example, exam AB-620)
Instructor-led course
A taught preparation course, often coded with a T00 suffix
Applied Skills
A hands-on, scenario-based lab assessment, not a multiple-choice exam
Program
A learning path, challenge, or voucher initiative, not itself a credential
A certification, its exam, and its preparation course belong to the same route but remain separate records. Finishing the course shows that you completed training. It doesn't show that you passed the exam. The next lesson, Applied Skills, Vouchers, and Licensing Literacy, covers Applied Skills in detail. For now, keep the taught course and the practical assessment in separate columns.
This is a mid-2026 snapshot
Credential names, exam codes, and availability change often. Treat every code in this lesson as a starting point, not a guarantee. The one habit that never expires is opening the official credential page and checking its current status before you commit time or money.
Choose an AB credential from the work you own
The AB series covers Copilot and agent roles directly. It isn't a sequence from beginner to expert. Start with the deliverable you're accountable for, then choose the credential that measures it.
Credential
Best fit
The work it measures
AB-730 (AI Business Professional)
People using Copilot in daily work
Prompts, conversations, and drafted business content
AB-731 (AI Transformation Leader)
Decision-makers and change leaders
A value case, service choice, governance approach, and adoption strategy
AB-900 (Copilot and Agent Administration Fundamentals)
An organization-wide plan, design, deployment, and optimization approach
Write one sentence that begins, "I am accountable for…" Then underline the verb. Use Copilot points to AB-730. Lead or drive adoption points to AB-731. Administer or govern the tenant points to AB-900. Build an agent points to AB-620. Architect a portfolio of solutions points to AB-100. If two routes fit, favor the one nearest your main deliverable.
AB-730 and AB-731 are easy to blur. AB-730 measures your own productive use, including prompts, content analysis, and drafting a memo. AB-731 measures decisions made for the organization, such as the value case, service choice, governance, and adoption. Someone leading a rollout should target AB-731. AB-730 doesn't need to come first.
Match the credential to my work· copilot-chat
Bad example
Which Microsoft Copilot certification should I take?
Good example
Act as a certification advisor. Here is one sentence describing what I'm accountable for: "[paste your 'I am accountable for…' sentence]". Based on the verb and the deliverable, tell me which of AB-730, AB-731, AB-900, AB-620, or AB-100 is my best primary target and which is a plausible but weaker alternative. Explain the distinction in one paragraph. Do not tell me I qualify for anything. Just match the work to the credential.
Why this works: A recommended primary credential plus the runner-up, with a reason tied to the work you own rather than the title's seniority. It's a starting point you then confirm on the official page.
Developer and security work follows different routes
Some responsibilities sit outside the AB series because the work being measured is different.
GH-300 (GitHub Copilot) is aimed at developers and technical managers who use GitHub Copilot across the software lifecycle. It covers responsible use, features, prompting, data and architecture, privacy, and safeguards. The published details are unusually clear: this is an intermediate exam, the passing score is 700 out of 1,000, the duration is 100 minutes, the fee is $99 USD, delivery is through Pearson VUE, and the certificate remains valid for 24 months. It is the direct route when your work centers on writing, testing, and reviewing code.
Security work splits into two routes. Neither is a standalone "Security Copilot certification":
SC-200 (Security Operations Analyst) measures operational work: triaging alerts, investigating incidents, and hunting threats. Security Copilot shows up inside incident response. Choose it if you investigate and respond.
SC-500 (Cloud and AI Security Engineer Associate), a beta credential in this snapshot, is the engineering track: workspace configuration, capacity, plugins, agents, permissions, and lifecycle. Choose it if you deploy, configure, and govern security systems.
A quick responsibility test settles it: build, test, review software → GH-300, investigate incidents and hunt threats → SC-200, deploy and govern cloud or AI security systems → SC-500.
A credential is not a license
Earning AB-900 does not give anyone a Microsoft 365 Copilot license, and passing GH-300 does not provision GitHub Copilot seats. A credential proves a skill. Access is a separate purchase you verify on its own. The next lesson covers the money side. For now, never let a badge stand in for a license check.
Check status before you spend time on a route
Microsoft regularly retires older credentials. For every item on your shortlist, record its lifecycle status (active, beta, scheduled, or retired) and its relationship to Copilot (direct or adjacent). Those fields answer different questions. A security certification can be adjacent to Copilot and still be fully active.
Treat a newer credential as a successor only when the evidence documents that relationship. A similar topic isn't enough. If a route has retired, use the official retirement notice and don't invent its replacement. In this snapshot, the "Create agents in Microsoft Copilot Studio" Applied Skills assessment was retired with no successor established. It can't remain a current step in a plan.
AB-100 adds an eligibility check. It is a valid target only if you own solution-architecture decisions and already hold one of its listed qualifying credentials, including AB-620. Consider an adoption lead who owns the rollout but not the architecture and holds no qualifying credential. AB-731 fits that work now. AB-100 remains deferred until both gates are met.
Is AB-100 even your next step?· copilot-chat
Bad example
Tell me whether AB-100 is the best advanced certification for me.
Good example
I'm considering AB-100. Ask me two gating questions, one at a time. First: do I personally own solution-architecture decisions, not just adoption or implementation? Second: do I already hold one of AB-100's listed qualifying credentials? Based only on my answers, tell me whether AB-100 is a valid next target or a deferred branch. If it's deferred, name what I'd need to satisfy first. Don't assume either gate is already met.
Why this works: A clear "target now" or "defer until…" verdict for AB-100, so you don't plan around an exam you aren't yet eligible to pursue.
Rank a shortlist of routes· copilot-chat
Bad example
Rank these certifications and tell me which one is best.
Good example
Using only the credentials I list below, rank them for this persona: "[describe the role, the two or three tasks they own, and whether they prefer a taught course, a hands-on assessment, or an exam]". Weigh role fit, level, format preference, and status. Do not add credentials I didn't list, do not treat a course as a certification, and flag any that I should re-check for retirement before trusting.
Why this works: A ranked shortlist of two or three routes with a one-line reason each, plus a reminder of which items to verify against the official page.
Map the route before writing the study plan
Begin with the work you own and name its main verb. That verb points you toward a credential family. Then confirm that the specific credential is active, check whether its Copilot relationship is direct or adjacent, and note any eligibility gate, including AB-100's. A study plan is useful only after those checks.
The senior-sounding title can be tempting, but a credential that doesn't measure your job is wasted effort. The next lesson turns your chosen route into an evidence and cost plan. At this stage, you need a route you can explain and a current status you have verified.
Try it yourself
Draft your persona ladder
Turn the map into a one-page route for yourself in about seven minutes. No product access needed.
01
Write one sentence starting "I am accountable for…" and underline its main verb.
02
Use the verb to pick one primary AB-series, GH-300, or SC credential, and note one runner-up.
Hint: Use → 730, lead → 731, administer → 900, build → 620, architect → 100.
03
For your primary pick, write the one work product that would prove you earned it (a prompt-and-revision, an adoption proposal, a governance design, a tested agent, or an architecture brief).
04
Add one status check: open the official credential page and confirm it is active, and note any eligibility gate (AB-100 needs a qualifying credential first).
A one-page ladder naming your primary credential, its runner-up, the artifact that proves readiness, and the status you still need to verify.
Key takeaways
A certification, its exam, its course, and an Applied Skills lab are four different records.
Choose an AB-series credential from the work you actually own. A senior-sounding title isn't the criterion.
GH-300 is the developer track, SC-200 the security analyst track, and SC-500 the engineering track.
AB-100 needs both architecture responsibility and a qualifying credential. It is not a next step for most people.
A credential proves a skill. It never grants a product license, and it may already be retired.
Check your understanding
1. You lead your department's Copilot rollout: choosing valuable scenarios, building the business case, and planning adoption. Which credential is your best primary target?
2. A colleague says, "I passed AB-900, so I automatically have Microsoft 365 Copilot access." What's the error?
3. A developer builds and reviews software, a SOC analyst investigates incidents, and an engineer configures Security Copilot workspaces and capacity. Which mapping is right?
4. Your plan lists a route as its next rung, but its official page shows it was retired with no successor established. What should you do?
5. An administrator drafts the route "MS-900 → MS-4006 → AB-900." Why is it broken, and what's the healthy fix?
Frequently asked questions
Terms used in this lesson
certification
A formal Microsoft credential earned by meeting its stated requirements, usually by passing an associated exam.
Applied Skills
A hands-on, scenario-based lab assessment that validates a bounded set of product skills, rather than a multiple-choice exam.
lifecycle status
Whether a credential is active, beta, scheduled, or retired: a different field from its relationship (direct or adjacent) to Copilot.
eligibility gate
A formal prerequisite, such as AB-100 requiring that you already hold a listed qualifying credential before you can target it.
