Domain 1: Plan AI-powered business solutions
- A decision governed by written thresholds and a fixed policy is deterministic, and a workflow automates it more cheaply, faster and more auditably than a generative agent. A written rule needs a workflow, not an agent.
- The dividing line is unstructured variety: language arriving in a hundred different phrasings is exactly what a deterministic rule cannot enumerate and what a language model handles. High volume alone is not the criterion.
- The agent's case is language in and judgement out - reading unstructured text and producing something no lookup table contains.
- An agent that reads external text and then writes to a record has given whoever writes that text influence over the action. Putting a model between an untrusted input and a write is the defining risk to design around.
- Summarising and deciding carry different consequences: a wrong summary wastes time, a wrong decision creates liability. Automation writes; analytics reads.
- Size the opportunity before designing it. Twenty-two hours a year saved is not a project, and small savings multiplied by large volume is usually where the real value sits.
- Look for the delay a process causes rather than the hours it consumes - the cost of a slow approval is frequently larger than the labour inside it.
- You cannot automate a process nobody can describe. If the organisation cannot state how the work is done today, that is the finding, not an obstacle to work around.
- Map where the exceptions are and where the human judgement sits, because those are what determine whether an agent can carry the process or only part of it.
- When sources conflict, the agent should escalate the conflict rather than absorb it. Grounding cannot resolve a contradiction it was handed.
- Unanticipated questions are the agent's case; anticipated ones can be answered by a guided flow.
- A human approval gate converts a wrong draft into rework rather than into a liability, which is what makes it the right control on consequential actions.
- A named approver is an auditable control, and controls are not generated - the model can draft, but accountability has to be assigned to a person.
- The two failure modes worth naming in a plan are wrong numbers and wrong audience: an inaccurate figure delivered confidently, and correct information shown to someone who should not see it.
- Every additional agent is another thing to govern, secure, evaluate and pay for. Many agents means many governance surfaces.
- A value case needs an existing baseline and a benefit genuinely attributable to the agent - if a number cannot be compared with something measured beforehand, it will be argued about rather than accepted.
- Rank candidate scenarios by value and by blast radius, not by how easy the demo is. The valuable architectural answer is often that the scenario does not warrant an agent.
- If the agent adds no capability the user did not already have, or has no access to live data, it has nothing to add and the project should not proceed.
- Measure the outcome the business wanted rather than the activity around it - messages sent and prompts run are not outcomes.
Domain 2: Design AI-powered business solutions
- Policy text states a rule and then qualifies it, often several paragraphs later. A chunk boundary between the two returns the rule without its exception, after which the model answers confidently and incompletely. Overlapping chunks reduce this.
- When the user's vocabulary and the document's vocabulary differ, retrieval fails before the model is involved. Fix the mismatch at the query - map the local term to the published one and search for both - rather than returning more chunks.
- Metadata stored beside each chunk is what makes entitlement filtering and citation possible: neither who may see it nor which document and revision it came from is recoverable from the text alone.
- Plausible but incomplete answers are the signature of near-miss retrieval - the right document, the wrong passage.
- Scope of data belongs to retrieval, not to the prompt. A prompt is a request, not an access control, and cannot be relied on to keep the model away from content it was given.
- Arithmetic belongs in code. Have a tool compute the figure and let the model read the answer, because generation produces plausible output rather than verified output.
- An intranet is a graveyard as well as a library: superseded documents sit alongside current ones, and without an effective-date filter the model will cite whichever it retrieves.
- Effective date is a retrieval filter, not something for the model to adjudicate.
- Sources that change at different rates need different refresh schedules, set per source rather than rebuilding everything on the slowest or fastest cadence.
- Citing a 300-page document is handing the user a search problem. A citation should point at the passage that supports the claim.
- Two embedding spaces cannot be compared, and mixing them fails silently - re-embed everything when the model changes rather than mixing vectors from different models.
- Log the retrieved passages alongside the answer. Without them you cannot tell whether a bad answer came from retrieval or from generation.
- Shape the output with instructions; do not starve the input or truncate the result to control length.
- Design seams deliberately - the boundary where you can test a component and swap it is what keeps the system maintainable.
- Test the refusal path explicitly. Evaluating only questions the corpus covers never exercises what happens when it does not.
- Structured data deserves a lookup, not a similarity search. Similarity search over a table returns rows that read alike rather than rows that match.
- Consistency comes from retrieving the same evidence, not from the model remembering - agents do not carry state between sessions unless you give it to them.
- A prompt full of conditionals is a program written in the wrong language; move the branching into orchestration.
- When the model chooses between tools, describe how to choose. Tool selection is a decision, and decisions get worse as the number of options grows.
- Authority is granted per tool, so a single tool that both reads and writes cannot be governed separately - split it.
- Instruct the agent to ask when it does not know and refuse what does not fit, rather than letting it produce its best guess.
- Pass the request and the findings between steps, not the whole conversation or the model's reasoning.
Domain 3: Deploy AI-powered business solutions
- Environments differ in connections, entitlements and content, so a pass in test is evidence about test. Running the same evaluation in the target environment is what turns it into evidence about production.
- Environments exist so identical logic runs against separate credentials and separate data. The agent definition must be the same version in each, or the thing tested is not the thing shipped.
- The promotion sequence is measure, compare against the current baseline, promote the same package, re-measure, then watch. A number without a baseline is not a verdict, because a change routinely improves one thing and degrades another.
- A deployment package is the evidence that the tested thing is the running thing. Hand-configuring production means the running agent was assembled separately from the one that passed, and the differences stay invisible until something behaves oddly.
- The evaluation set travels with the thing it tests, so the same questions can be re-run wherever the agent is promoted.
- Empty answers in one environment and not another is almost always permissions - the identity the agent runs as cannot see the content.
- A sudden spike in refusals usually means retrieval is finding nothing, not that the model has become more cautious.
- When a bad answer is reported, find the passage, fix the source, verify nothing else broke, and tell the people who were given the wrong answer. All four steps matter.
- Page on total failure and dashboard everything else. Alerting on quality signals produces noise that trains people to ignore the alert.
- A runbook is written for the person paged at eight in the morning, which means it has to be followable by someone who did not build the system.
- Evaluation sets do not contain the questions that expose a regression, because if you had thought of them they would already be fixed. Sampling real traffic is what finds them.
- Degradation is answers that still arrive and are no longer right - it does not trigger an availability alert, which is why quality needs its own monitoring.
- The only way to see drift is to keep asking the same questions over time and compare the answers.
- Silence is the most common response to a bad answer. Absence of complaints is not evidence of quality.
- Read what the agent actually said while the audience is still small - review of real transcripts during a limited rollout catches what evaluation sets miss.
- Withdrawing a document and removing it from the index are two different actions, and doing only the first leaves the content answerable.
- A retention period is a promise about deletion, not about storage - it commits you to removing data, which needs a mechanism.
- Scope the incident first: what was affected, for how long, and who saw it. Everything else depends on knowing that.
- An incident review needs both the cause and the reason the safeguards did not catch it.
- Cost per request is the variable that moves without anybody noticing, because each individual request is cheap.
- A department reporting more failures usually has thinner content rather than harder questions.
AB-100: Agentic AI Solutions Architect exam tips
- A large share of AB-100 asks whether an agent is the right answer at all. If the scenario describes a written rule, fixed thresholds or a required exact figure, the answer is a deterministic workflow or a calculation tool - not a generative agent.
- When a question describes a wrong or incomplete answer, decide whether it is a retrieval failure or a generation failure. Plausible-but-incomplete, vocabulary mismatch, stale documents and missing exceptions are all retrieval; only genuinely fabricated content is generation.
- Prompts are requests, not controls. Any answer that relies on instructing the model not to reveal, not to use or not to act is weaker than one that removes the data or the tool from its reach.
- For deployment questions, prefer the option that promotes the same tested package and re-measures in the target environment. Anything involving hand-configuration in production, or a test result from a different environment, is the wrong answer.
- Watch for the untrusted-input-plus-write combination. An agent that reads external text and then modifies a record is the exam's recurring risk scenario, and a human approval gate is usually the control it is looking for.
Study guide FAQ
How is the AB-100 exam scored and structured?
A scaled score of 700 or greater out of 1000 is required to pass, with about 120 minutes for the exam. Questions are multiple-choice and multiple-select and are heavily scenario-based, describing a business situation and asking for the architectural decision rather than testing recall of product features.
Which domain should I focus on most?
Deploy AI-powered business solutions is the largest domain in this bank, covering environments, promotion, evaluation, monitoring and incident handling. Plan and Design are equally weighted between themselves, but Plan is the one that most changes how you read every other question, because it teaches the exam's view of when an agent is inappropriate.
Is AB-100 a coding exam?
No. It is an architect-level exam about solution design, feasibility, governance and operations. You need to understand retrieval, grounding, tool use, evaluation and deployment concepts well enough to make and defend design decisions, but you are not asked to write code.
Is this a new exam?
Yes, AB-100 is part of Microsoft's recent agentic AI certification track. Because the programme is new, check the published skills-measured breakdown before you sit it - domain names and weightings on newer Microsoft exams have been revised within months of launch.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Microsoft Learn - Exam AB-100 study guideBlueprint revised July 22, 2026 · link and content verified 8 September 20263 skills areas: Plan AI-powered business solutions (25-30%); Design AI-powered business solutions (25-30%); Deploy AI-powered business solutions (40-45%). Pass mark 700.