Stepping into the Architect Tier: My AB-100 Study Blueprint for Agentic-First Enterprise Systems

1. Study log: what changes at the architect tier

AB-900 asked where the admin controls for Copilot and agents live. AB-100 asks an earlier question: should this business problem get a prebuilt Copilot, an agent that extends Copilot, a custom engine agent, or a custom model, and who owns the result once it runs? The study guide puts that in plain words with objectives like “Determine when to build custom agents or extend Microsoft 365 Copilot” and “Determine when custom AI models should be created”.[1]

This entry is my study blueprint for that tier. It maps the official skills list to the rest of this series and builds the first AB-100 deliverable: an architecture trade-off matrix, plus a small PowerShell script that applies the matrix to a list of use cases. I haven’t taken AB-100, and nothing here comes from exam content. I didn’t connect to a tenant or an Azure subscription. The script ran locally against four synthetic use cases (section 4).

Blueprint version: the study guide lists skills measured as of October 14, 2026, and the exam page says the English version of the exam “was updated on October 14, 2026”.[1][2] That version is in effect now, so this article targets it, as of October 20, 2026. The change log marks three skill groups as minor changes: “Design overall AI strategy for business solutions”, “Design AI and agents for business solutions” and “Design the ALM process for AI-powered business solutions”.[1] Neither page announced a later update when I checked. If you test in another language, Microsoft updates localized versions about eight weeks after the English version, so your exam can still be on the prior version for a while.[1][2]

The three domains in the October 14 version:[1]

Domain	Weight	Skill groups	Objectives listed
Plan AI-powered business solutions	25–30%	3	20
Design AI-powered business solutions	25–30%	3	30
Deploy AI-powered business solutions	40–45%	4	24

I counted the objectives from the study guide on October 20, 2026. Design has the most objectives, and Deploy carries the most weight.

Default approach	AI-hardened approach
Start AB-100 prep inside the Copilot Studio canvas.	Start with the tier decision. The Plan domain asks when to extend Microsoft 365 Copilot, when to build custom agents, and when to create custom models.[1]
Build a custom agent because you can.	Microsoft’s Cloud Adoption Framework says to approve “the solution that meets their requirements with the least operational responsibility”.[6]
Fine-tune a model so it knows this quarter’s policies.	Fine-tuning “doesn’t replace retrieval for current information or application-level safety controls”.[7]
Assume a custom engine agent inherits Microsoft 365 compliance.	Microsoft’s comparison says custom engine agents “Must ensure your own compliance, RAI practices, and security measures”.[4]
Assume passing AB-100 makes you an Expert.	You also need one of the listed Associate certifications.[2][3]

2. Exam facts and the prerequisite gate

These facts come from Microsoft Learn as of October 20, 2026.

Item	What Microsoft says
Credential	Microsoft Certified: Agentic AI Business Solutions Architect Expert, job role Solution Architect[3]
Required exam	AB-100: Agentic AI Business Solutions Architect[3]
Extra requirement	At least one of the prerequisite Associate-level certifications listed on the page[2][3]
Passing score	700[1][2]
Price	Based on the country or region where the exam is proctored[2]
Languages	English plus 12 other languages listed on the exam page[2]
Retirement date	None listed[2]
Renewal	Associate, expert and specialty certifications expire annually. Renewal is a free online assessment you can take during a six-month window.[1][13]
Practice	A practice assessment on AI Skills Navigator, which needs a sign-in, and an exam sandbox[1]
Preview features	Most questions cover GA features, but the exam may include commonly used Preview features[1]

I didn’t find an exam duration on the pages I read, so check it in the scheduling flow.

The prerequisite lists still don’t match. The exam page lists 15 Associate certifications, including MB-280 (Dynamics 365 Customer Experience Analyst) and PL-200 (Power Platform Functional Consultant). The credential page lists 13 and leaves out those two.[2][3] Our AB-100 certification guide flagged the same mismatch on October 5, and it was still there on October 20. If your path depends on MB-280 or PL-200, confirm it with Microsoft Credentials support before you pay for anything.

Two smaller page problems:

The exam page lists a 3-day instructor-led course, AB-100T00 “Architecting agentic AI business solutions”, and the course page says it “is not a test-preparation course”.[2][14] The credential page says “Learning paths or modules are not yet available for this certification”.[3] I’d treat the study guide’s documentation links as the self-paced path for now.
Both pages carry a one-line summary that says the exam measures “implement information protection; implement data loss prevention and retention; manage risks, alerts, and activities”.[2][3] None of those phrases appear in the AB-100 skills list, so I study from the study guide.[1]

3. Study blueprint: map the objectives to the series

The study guide has 10 skill groups. Here is where each one lands in this series. The later entries are planned, not published yet.

Skill group	Objectives	Where I study it
Analyze requirements for AI-powered business solutions	3	This entry: tier decision inputs
Design overall AI strategy for business solutions	13	This entry: build vs extend, custom models, CAF adoption, AI Center of Excellence
Evaluate the costs and benefits of an AI-powered business solution	4	This entry: cost drivers and model router
Design AI and agents for business solutions	16	Next entry: an IT triage agent in Copilot Studio with Power Automate
Design extensibility of AI solutions	7	MCP and Computer Use entry
Orchestrate configuration for prebuilt agents and apps	7	Dynamics 365 documentation (no dedicated entry)
Analyze, monitor, and tune AI-powered business solutions	5	Observability and FinOps entry
Manage the testing of AI-powered business solutions	5	Triage agent and observability entries
Design the ALM process for AI-powered business solutions	6	Copilot Studio ALM entry
Design responsible AI, security, governance, risk management, and compliance	8	Spread across every entry, starting with the agent lifecycle entry

For endpoint engineers, the gap is business applications. By my count, 13 of the 74 objectives are about Dynamics 365 apps, finance and operations agent chats, or Microsoft 365 Copilot for Sales and Service.[1] This series won’t fake depth there. If Dynamics 365 is new to you, plan extra time with its own docs, or pick a Dynamics 365 Associate as your prerequisite so you learn it on the way.

The steps I’m following:

Pick your prerequisite. Choose the Associate certification from the exam page list that matches your work, and confirm it appears on both pages.[2][3] Failure point: finishing AB-100 prep and then finding out your Associate isn’t on the credential page list.
Pin the blueprint. Note the “Skills measured as of” date and your exam language before you book.[1] Failure point: studying the October 14 English version for a localized exam that hasn’t been updated yet.
Rate each skill group. Mark each of the 10 groups as solid, partial or new. Failure point: rating Deploy as solid because you deploy software for a living. Its objectives are about agent monitoring, AI testing, ALM for agents and models, and AI security.[1]
Read the decision docs before the product docs. Start with Microsoft’s comparison of declarative and custom engine agents, the Cloud Adoption Framework AI adoption article, and the Foundry fine-tuning overview.[4][6][7] Failure point: learning every Copilot Studio feature and still being unable to say when not to use it.
Run the matrix in section 4 on three to five use cases from your own work, with names and data scrubbed. Defend each tier out loud. Failure point: treating the script’s output as the answer. It encodes my reading of Microsoft’s guidance, so argue with it.
Take the practice assessment on AI Skills Navigator after you’ve covered each domain once.[1]

4. Engineering deliverable: the architecture trade-off matrix

The matrix

Microsoft documents two kinds of agent that extend Copilot, so the matrix has four columns: prebuilt Copilot, a declarative agent that extends Copilot, a custom engine agent, and a custom (fine-tuned) model. A custom model isn’t a separate agent. It’s a model choice that only a custom engine agent can use, because declarative agents are “Limited to Copilot’s orchestrator and models”.[4]

	Prebuilt Copilot	Declarative agent (extends Copilot)	Custom engine agent	Custom model (fine-tuned)
What you build	Nothing. You choose Microsoft 365 Copilot, an in-product Copilot or a role-based Copilot[6]	Custom instructions, knowledge and actions[4]	Your own orchestration, with one or more models[4]	Additional training that “adjusts the model’s weights”[7]
Orchestrator and model	Microsoft’s	Copilot’s orchestrator and foundation model[4]	Yours[4]	Yours, starting from a pretrained base model[7]
Hosting	None for you	”No additional hosting is required”[4]	Outside Microsoft 365, “typically with cloud services such as Azure, at an additional cost”, or in Microsoft 365 with Copilot Studio[4]	Foundry deployment options, such as serverless or managed compute (preview)[7]
Compliance, RAI, security	Microsoft-built service	”Inherits Microsoft 365 compliance, RAI, and security standards”[4]	“Must ensure your own compliance, RAI practices, and security measures”[4]	Doesn’t replace application-level safety controls[7]
Proactive behavior	Not part of Microsoft’s comparison	”Not supported; rely on user-initiated interactions”[4]	Can trigger actions “even without direct user input”[4]	Not applicable
Channels	The Microsoft product it ships in	Microsoft 365 apps[4]	Microsoft 365 and external apps[4]	Whatever agent or app calls it
Cost drivers	License, or included with the base product[6]	Copilot license, or Copilot Chat plus Copilot Credits when unlicensed users touch shared tenant data[5]	Hosting, plus Copilot Credits for unlicensed users on shared tenant data[5]	Training and hosting costs[7]
Build surface	None	Agent Builder, Copilot Studio or Microsoft 365 Agents Toolkit[4][11]	Copilot Studio, or pro-code with Agents Toolkit, Semantic Kernel or LangChain; Foundry Agent Service for hosted agents[4][9]	Foundry managed fine-tuning or interactive training (preview)[7]
Choose it when	The goal is individual efficiency[6]	The workflow lives in Microsoft 365 apps and you want Copilot’s security and compliance model[4]	You need custom orchestration, your own models, group collaboration in Teams, proactive messaging, channels outside Microsoft 365, or to integrate an existing assistant[4]	You have high-quality, task-specific training data and need accuracy, lower prompt overhead, consistent format, better tool use or a smaller model[7]
Watch out	Domain-specific skills need extensibility tools[6]	Declarative agents are “Designed to be used by individuals”[4]	You own the security and RAI work, and the hosting bill	”Benefits aren’t guaranteed”. Use held-out evaluation against a baseline.[7]

Licensing, builder and residency details

Licensing changes the cost. Users with a Microsoft 365 Copilot license don’t pay extra to use agents. Users on Copilot Chat pay nothing for agents that use only instructions or public websites, but agents that read shared tenant data such as SharePoint or Copilot connectors generate usage-based charges in Copilot Credits.[5]
Agent Builder and Copilot Studio both build agents for Copilot, but for different audiences. Agent Builder fits “yourself or a small team”. Copilot Studio fits a department, the organization or external customers, and anything with multi-step workflows or custom integrations.[10] Copilot Studio’s docs add that its agents for Microsoft Copilot “are called declarative agents in Microsoft Copilot”.[11]
Data residency follows the training type. Standard training stays in the Foundry resource’s region, Data zone training is US-only for now, Global training copies data and weights to the region where training runs, and Developer training has no data residency guarantee.[7]

The script

New-AB100TradeoffMatrix.ps1 applies the matrix to a JSON file of use cases. It validates every field, assigns a tier with the least operational responsibility that meets the stated needs, flags fine-tuning only when the documented conditions hold, and writes decision-record.md, decisions.csv, manifest.json and an audit.log. -Rollback removes only the files it wrote whose SHA-256 hash still matches the manifest. It never connects to a tenant or to Azure.

What I tested, on Linux with PowerShell 7.4.6, all against synthetic input: -WhatIf created no output folder. A normal run wrote all four files, and a second identical run reported no changes. Changed input without -Force stopped with an error, and -Force rebuilt the output. A file with a bad schema version, a bad ID, an unknown goal, a string where a boolean belongs and a duplicate ID failed validation, listed every error, and wrote nothing. Invalid JSON stopped with a parse error. -Rollback -WhatIf removed nothing. -Rollback removed the Markdown record but skipped decisions.csv after I edited it, logged the hash mismatch, and kept the manifest. A use case name containing <b> and a pipe character came out HTML-encoded in the Markdown table. PSScriptAnalyzer 1.25.0 reported only PSReviewUnusedParameter for the -Rollback switch, which selects a parameter set.

#Requires -Version 7.2
<#
.SYNOPSIS
  Scores synthetic or real use cases against an AB-100 architecture trade-off matrix:
  prebuilt Copilot, declarative agent, custom engine agent, and custom (fine-tuned) model.
.DESCRIPTION
  Reads a JSON file of use cases, validates every field, applies decision rules taken from
  Microsoft Learn (rule IDs are listed in the output), and writes decision-record.md,
  decisions.csv, manifest.json and audit.log. -Rollback removes only files this script wrote
  whose SHA-256 hash still matches the manifest. Nothing here connects to a tenant or to Azure.
#>
[CmdletBinding(SupportsShouldProcess, DefaultParameterSetName = 'Render')]
param(
    [Parameter(Mandatory, ParameterSetName = 'Render')]
    [ValidateScript({ Test-Path -LiteralPath $_ -PathType Leaf })]
    [string] $InputPath,

    [Parameter(ParameterSetName = 'Render')]
    [Parameter(ParameterSetName = 'Rollback')]
    [string] $OutputDirectory = './ab100-matrix',

    [Parameter(ParameterSetName = 'Render')]
    [switch] $Force,

    [Parameter(Mandatory, ParameterSetName = 'Rollback')]
    [switch] $Rollback
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

$NeedKeys = @('customInstructionsOrKnowledge', 'apiActions', 'customOrchestration', 'ownOrSpecializedModel',
    'groupCollaboration', 'proactiveTriggers', 'channelsOutsideMicrosoft365', 'existingAssistantToIntegrate')
$CustomEngineTriggers = @('customOrchestration', 'ownOrSpecializedModel', 'groupCollaboration',
    'proactiveTriggers', 'channelsOutsideMicrosoft365', 'existingAssistantToIntegrate')
$FineTuneGoals = @('accuracy', 'prompt-overhead', 'style-structure', 'tool-use', 'smaller-model')
$AllGoals = $FineTuneGoals + @('none', 'current-information')
$TierRank = @{ 'prebuilt-copilot' = 1; 'declarative-agent' = 2; 'custom-engine-agent' = 3 }

function Write-Audit {
    param([string] $Action, [string] $Target, [string] $Detail = '')
    if ($WhatIfPreference) { return }
    if (-not (Test-Path -LiteralPath $OutputDirectory)) { return }
    $line = [ordered]@{ utc = [DateTime]::UtcNow.ToString('o'); action = $Action; target = $Target; detail = $Detail } |
        ConvertTo-Json -Compress
    Add-Content -LiteralPath (Join-Path $OutputDirectory 'audit.log') -Value $line -Encoding utf8
}

function Get-Sha256 { param([string] $Path) (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant() }

function Test-Bool { param($Value) $Value -is [bool] }

function ConvertTo-MdCell {
    param([string] $Text)
    [System.Net.WebUtility]::HtmlEncode($Text).Replace('|', '&#124;')
}

$manifestPath = Join-Path $OutputDirectory 'manifest.json'

# Rollback: delete only what we wrote and nobody has edited since.
if ($PSCmdlet.ParameterSetName -eq 'Rollback') {
    if (-not (Test-Path -LiteralPath $manifestPath)) { throw "No manifest at $manifestPath. Nothing to roll back." }
    $manifest = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
    $skipped = 0
    foreach ($f in $manifest.files) {
        $p = Join-Path $OutputDirectory $f.name
        if (-not (Test-Path -LiteralPath $p)) { continue }
        if ((Get-Sha256 -Path $p) -ne $f.sha256) {
            $skipped++
            Write-Warning "Skipped $($f.name): it changed after this script wrote it."
            Write-Audit -Action 'skip-remove' -Target $f.name -Detail 'hash mismatch'
            continue
        }
        if ($PSCmdlet.ShouldProcess($p, 'Remove generated file')) {
            Remove-Item -LiteralPath $p
            Write-Audit -Action 'remove' -Target $f.name
        }
    }
    if ($skipped -eq 0 -and $PSCmdlet.ShouldProcess($manifestPath, 'Remove manifest')) {
        Remove-Item -LiteralPath $manifestPath
        Write-Audit -Action 'remove' -Target 'manifest.json'
    }
    return
}

# Input validation: collect every problem, then stop once.
try { $doc = Get-Content -LiteralPath $InputPath -Raw | ConvertFrom-Json -AsHashtable }
catch { throw "Input is not valid JSON: $($_.Exception.Message)" }

$errors = [System.Collections.Generic.List[string]]::new()
if ($doc -isnot [hashtable]) { throw 'Input root must be a JSON object.' }
if ($doc['schemaVersion'] -ne 1) { $errors.Add('schemaVersion must be 1.') }
$useCases = @($doc['useCases'])
if ($null -eq $doc['useCases'] -or $useCases.Count -eq 0) { $errors.Add('useCases must be a non-empty array.') }
$seen = @{}
foreach ($uc in $useCases) {
    if ($uc -isnot [hashtable]) { $errors.Add('Every use case must be an object.'); continue }
    $id = [string]$uc['id']
    if ($id -notmatch '^[A-Za-z0-9-]{1,32}$') { $errors.Add("Use case id '$id' must be 1-32 letters, digits or hyphens.") }
    elseif ($seen.ContainsKey($id)) { $errors.Add("Duplicate use case id '$id'.") }
    else { $seen[$id] = $true }
    $name = [string]$uc['name']
    if ([string]::IsNullOrWhiteSpace($name) -or $name.Length -gt 120) { $errors.Add("${id}: name must be 1-120 characters.") }
    if ($uc['goal'] -notin @('individual-efficiency', 'automate-business-function')) {
        $errors.Add("${id}: goal must be individual-efficiency or automate-business-function.")
    }
    $needs = $uc['needs']
    if ($needs -isnot [hashtable]) { $errors.Add("${id}: needs must be an object.") }
    else { foreach ($k in $NeedKeys) { if (-not (Test-Bool $needs[$k])) { $errors.Add("${id}: needs.$k must be true or false.") } } }
    $model = $uc['model']
    if ($model -isnot [hashtable]) { $errors.Add("${id}: model must be an object.") }
    else {
        foreach ($k in 'taskTrainingDataAvailable', 'dataResidencyRequired') {
            if (-not (Test-Bool $model[$k])) { $errors.Add("${id}: model.$k must be true or false.") }
        }
        if ($model['fineTuneGoal'] -notin $AllGoals) { $errors.Add("${id}: model.fineTuneGoal must be one of $($AllGoals -join ', ').") }
    }
    $users = $uc['users']
    if ($users -isnot [hashtable]) { $errors.Add("${id}: users must be an object.") }
    else {
        foreach ($k in 'copilotLicensed', 'usesSharedTenantData') {
            if (-not (Test-Bool $users[$k])) { $errors.Add("${id}: users.$k must be true or false.") }
        }
    }
}
if ($errors.Count -gt 0) { throw ("Validation failed:`n - " + ($errors -join "`n - ")) }

# Decision rules. Each rule ID maps to a Microsoft Learn page cited in the article.
$rows = foreach ($uc in ($useCases | Sort-Object { $_['id'] })) {
    $n = $uc['needs']; $m = $uc['model']; $u = $uc['users']
    $rules = [System.Collections.Generic.List[string]]::new()
    $notes = [System.Collections.Generic.List[string]]::new()

    $triggers = @($CustomEngineTriggers | Where-Object { $n[$_] })
    if ($triggers.Count -gt 0) {
        $tier = 'custom-engine-agent'
        $rules.Add("CEA-TRIGGER($($triggers -join ','))")
    }
    elseif ($n['customInstructionsOrKnowledge'] -or $n['apiActions'] -or $uc['goal'] -eq 'automate-business-function') {
        $tier = 'declarative-agent'
        $rules.Add('DA-EXTEND')
    }
    else {
        $tier = 'prebuilt-copilot'
        $rules.Add('PREBUILT-LEAST-OPS')
    }

    $customModel = 'not-indicated'
    if ($m['fineTuneGoal'] -eq 'current-information') {
        $customModel = 'use-retrieval'
        $rules.Add('FT-NOT-FOR-FRESH-DATA')
        $notes.Add('Fine-tuning does not replace retrieval for current information.')
    }
    elseif ($m['fineTuneGoal'] -in $FineTuneGoals -and -not $m['taskTrainingDataAvailable']) {
        $rules.Add('FT-NEEDS-DATA')
        $notes.Add('Fine-tuning needs high-quality, task-specific training data. Start with prompts and grounding.')
    }
    elseif ($m['fineTuneGoal'] -in $FineTuneGoals) {
        $customModel = 'evaluate-fine-tuning'
        $rules.Add("FT-CANDIDATE($($m['fineTuneGoal']))")
        $notes.Add('Compare against a baseline with held-out evaluation. Training and hosting costs apply.')
        if ($TierRank[$tier] -lt $TierRank['custom-engine-agent']) {
            $tier = 'custom-engine-agent'
            $rules.Add('DA-MODEL-LIMIT')
        }
        if ($m['dataResidencyRequired']) {
            $rules.Add('FT-RESIDENCY')
            $notes.Add('Use the Standard or Data zone (US only) training type. Global and Developer training do not guarantee data residency.')
        }
    }

    $surface = switch ($tier) {
        'prebuilt-copilot' { 'Microsoft 365 Copilot or a prebuilt agent' }
        'declarative-agent' { 'Agent Builder, Copilot Studio (agent for Microsoft Copilot) or Agents Toolkit' }
        'custom-engine-agent' {
            if ($n['ownOrSpecializedModel'] -or $n['existingAssistantToIntegrate'] -or $customModel -eq 'evaluate-fine-tuning') { 'Microsoft Foundry or pro-code' }
            else { 'Copilot Studio custom agent' }
        }
    }
    $complianceOwner = if ($tier -eq 'custom-engine-agent') { 'You: compliance, RAI and security' } else { 'Inherits Microsoft 365 standards' }

    $cost = switch ($tier) {
        'prebuilt-copilot' { 'Copilot license' }
        'declarative-agent' {
            if (-not $u['copilotLicensed'] -and $u['usesSharedTenantData']) { 'Copilot Credits for unlicensed users on shared tenant data; no extra hosting' }
            else { 'No extra hosting' }
        }
        'custom-engine-agent' {
            $c = 'Hosting outside Microsoft 365 (or Copilot Studio)'
            if (-not $u['copilotLicensed'] -and $u['usesSharedTenantData']) { $c += '; Copilot Credits for unlicensed users on shared tenant data' }
            $c
        }
    }

    [pscustomobject][ordered]@{
        Id              = $uc['id']
        Name            = $uc['name']
        Tier            = $tier
        OpsRank         = $TierRank[$tier] + ([int]($customModel -eq 'evaluate-fine-tuning'))
        CustomModel     = $customModel
        BuildSurface    = $surface
        ComplianceOwner = $complianceOwner
        CostDrivers     = $cost
        Rules           = $rules -join ' '
        Notes           = $notes -join ' '
    }
}

# Idempotency: same input and untouched outputs means nothing to write.
$inputHash = Get-Sha256 -Path $InputPath
$mdPath = Join-Path $OutputDirectory 'decision-record.md'
$csvPath = Join-Path $OutputDirectory 'decisions.csv'
if (Test-Path -LiteralPath $manifestPath) {
    $old = Get-Content -LiteralPath $manifestPath -Raw | ConvertFrom-Json
    $intact = @($old.files | Where-Object {
            $p = Join-Path $OutputDirectory $_.name
            (Test-Path -LiteralPath $p) -and ((Get-Sha256 -Path $p) -eq $_.sha256)
        }).Count -eq @($old.files).Count
    if ($old.inputSha256 -eq $inputHash -and $intact) {
        Write-Output "No changes: $OutputDirectory already matches $InputPath."
        return
    }
    if (-not $Force) { throw "Output in $OutputDirectory came from different input or was edited. Re-run with -Force to rebuild." }
}

$sb = [System.Text.StringBuilder]::new()
[void]$sb.AppendLine('# AB-100 architecture trade-off decision record')
[void]$sb.AppendLine()
[void]$sb.AppendLine("Input SHA-256: ``$inputHash``. Rules map to Microsoft Learn pages; this is a study aid, not a Microsoft tool.")
[void]$sb.AppendLine()
[void]$sb.AppendLine('| Id | Use case | Tier | Ops rank | Custom model | Build surface | Compliance owner | Cost drivers | Rules |')
[void]$sb.AppendLine('|---|---|---|---|---|---|---|---|---|')
foreach ($r in $rows) {
    $cells = @($r.Id, $r.Name, $r.Tier, $r.OpsRank, $r.CustomModel, $r.BuildSurface, $r.ComplianceOwner, $r.CostDrivers, $r.Rules) |
        ForEach-Object { ConvertTo-MdCell ([string]$_) }
    [void]$sb.AppendLine('| ' + ($cells -join ' | ') + ' |')
}
$noted = @($rows | Where-Object Notes)
if ($noted.Count -gt 0) { [void]$sb.AppendLine() }
foreach ($r in $noted) {
    [void]$sb.AppendLine("- $(ConvertTo-MdCell $r.Id): $(ConvertTo-MdCell $r.Notes)")
}

if ($PSCmdlet.ShouldProcess($OutputDirectory, "Write decision record for $(@($rows).Count) use cases")) {
    if (-not (Test-Path -LiteralPath $OutputDirectory)) { New-Item -ItemType Directory -Path $OutputDirectory | Out-Null }
    Set-Content -LiteralPath $mdPath -Value $sb.ToString() -Encoding utf8
    $rows | Export-Csv -LiteralPath $csvPath -NoTypeInformation -Encoding utf8
    [ordered]@{
        inputSha256 = $inputHash
        files       = @(foreach ($p in $mdPath, $csvPath) { [ordered]@{ name = Split-Path $p -Leaf; sha256 = Get-Sha256 -Path $p } })
    } | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath $manifestPath -Encoding utf8
    Write-Audit -Action 'write' -Target 'decision-record.md,decisions.csv,manifest.json' -Detail "useCases=$(@($rows).Count)"
    $rows | Format-Table Id, Tier, OpsRank, CustomModel, Rules -AutoSize | Out-String -Width 200 | Write-Output
}

The synthetic input I used. Every use case is made up:

{
  "schemaVersion": 1,
  "useCases": [
    {
      "id": "ZK-01",
      "name": "Meeting recaps and email drafts for the endpoint team",
      "goal": "individual-efficiency",
      "needs": { "customInstructionsOrKnowledge": false, "apiActions": false, "customOrchestration": false, "ownOrSpecializedModel": false, "groupCollaboration": false, "proactiveTriggers": false, "channelsOutsideMicrosoft365": false, "existingAssistantToIntegrate": false },
      "model": { "taskTrainingDataAvailable": false, "fineTuneGoal": "none", "dataResidencyRequired": false },
      "users": { "copilotLicensed": true, "usesSharedTenantData": false }
    },
    {
      "id": "ZK-02",
      "name": "Device policy Q&A grounded on the IT SharePoint site",
      "goal": "individual-efficiency",
      "needs": { "customInstructionsOrKnowledge": true, "apiActions": false, "customOrchestration": false, "ownOrSpecializedModel": false, "groupCollaboration": false, "proactiveTriggers": false, "channelsOutsideMicrosoft365": false, "existingAssistantToIntegrate": false },
      "model": { "taskTrainingDataAvailable": false, "fineTuneGoal": "current-information", "dataResidencyRequired": false },
      "users": { "copilotLicensed": false, "usesSharedTenantData": true }
    },
    {
      "id": "ZK-03",
      "name": "Noncompliant-device triage that posts to a Teams channel on a schedule",
      "goal": "automate-business-function",
      "needs": { "customInstructionsOrKnowledge": true, "apiActions": true, "customOrchestration": true, "ownOrSpecializedModel": false, "groupCollaboration": true, "proactiveTriggers": true, "channelsOutsideMicrosoft365": false, "existingAssistantToIntegrate": false },
      "model": { "taskTrainingDataAvailable": false, "fineTuneGoal": "none", "dataResidencyRequired": false },
      "users": { "copilotLicensed": true, "usesSharedTenantData": true }
    },
    {
      "id": "ZK-04",
      "name": "Ticket classifier that must return a fixed JSON schema",
      "goal": "automate-business-function",
      "needs": { "customInstructionsOrKnowledge": true, "apiActions": true, "customOrchestration": false, "ownOrSpecializedModel": false, "groupCollaboration": false, "proactiveTriggers": false, "channelsOutsideMicrosoft365": false, "existingAssistantToIntegrate": false },
      "model": { "taskTrainingDataAvailable": true, "fineTuneGoal": "style-structure", "dataResidencyRequired": true },
      "users": { "copilotLicensed": true, "usesSharedTenantData": false }
    }
  ]
}

Usage:

./New-AB100TradeoffMatrix.ps1 -InputPath ./synthetic-use-cases.json -OutputDirectory ./ab100-matrix -WhatIf
./New-AB100TradeoffMatrix.ps1 -InputPath ./synthetic-use-cases.json -OutputDirectory ./ab100-matrix
./New-AB100TradeoffMatrix.ps1 -Rollback -OutputDirectory ./ab100-matrix

The output from my local run:

Id    Tier                OpsRank CustomModel          Rules
--    ----                ------- -----------          -----
ZK-01 prebuilt-copilot          1 not-indicated        PREBUILT-LEAST-OPS
ZK-02 declarative-agent         2 use-retrieval        DA-EXTEND FT-NOT-FOR-FRESH-DATA
ZK-03 custom-engine-agent       3 not-indicated        CEA-TRIGGER(customOrchestration,groupCollaboration,proactiveTriggers)
ZK-04 custom-engine-agent       4 evaluate-fine-tuning DA-EXTEND FT-CANDIDATE(style-structure) DA-MODEL-LIMIT FT-RESIDENCY

How each rule maps to Microsoft’s guidance:

Rule ID	What it does	Source
`PREBUILT-LEAST-OPS`	No custom knowledge, actions or automation, so stay on prebuilt Copilot	Least operational responsibility[6]
`DA-EXTEND`	Custom instructions, knowledge or API actions, or a business automation goal, without a custom engine trigger	Declarative agent guidance and SaaS-first automation[4][6]
`CEA-TRIGGER(...)`	Any of the six “Build a custom engine agent when” conditions	Custom engine agent guidance[4]
`DA-MODEL-LIMIT`	A fine-tuning candidate moves a declarative agent to custom engine	”Limited to Copilot’s orchestrator and models”[4]
`FT-CANDIDATE(...)`	Training data exists and the goal is one Microsoft lists for fine-tuning	Fine-tuning overview[7]
`FT-NEEDS-DATA`	A fine-tuning goal without high-quality, task-specific training data	Fine-tuning overview[7]
`FT-NOT-FOR-FRESH-DATA`	The need is current information, so use retrieval	Fine-tuning overview[7]
`FT-RESIDENCY`	Residency is required, so use Standard or Data zone training	Training types[7]

Design notes:

Validation collects every error before it stops, so you fix the file once. IDs are limited to letters, digits and hyphens because they end up in file content and logs.
Idempotency comes from the manifest, which stores the SHA-256 of the input and of each output.
Audit lines are JSON with UTC timestamps for each write, removal and skipped removal. -WhatIf runs log nothing.
The “build surface” column is a starting hint. I point fine-tuning and own-model cases at Foundry because the Cloud Adoption Framework says to move to Azure platforms “when SaaS capabilities don’t provide enough control over models, application logic, data integration, or AI development”.[6]
ZK-03 came out as a custom engine agent because it posts proactively to a Teams channel. That’s the agent the next entry designs.

5. Public-objective concepts to retain

These are my notes against the October 14, 2026 skills list.[1] They’re study notes from Microsoft Learn, not exam questions.

Plan AI-powered business solutions (25–30%)

The Cloud Adoption Framework splits AI use into enhancing individual efficiency and automating business functionality. For automation it goes SaaS first (Copilot extensibility tools, Copilot Studio), then Azure platforms such as Microsoft Foundry, then Azure infrastructure, which “shouldn’t be the default approach”.[6]
The CAF adoption steps are AI planning, AI ready, and AI govern, secure, manage. A central governance function “such as an AI Center of Excellence” defines Responsible AI requirements and common boundaries.[6] Both map to Plan objectives.[1]
Model router is “a trained language model” deployed like any other Foundry model, and it picks an underlying model per request. Balanced is the default mode, alongside Cost and Quality. The effective context window is limited by the smallest underlying model, and Microsoft still says to evaluate it against your current baseline.[8]
For ROI and TCO, Microsoft’s extensibility cost article lists categories beyond licenses: usage-based consumption, hosting for APIs and remote MCP servers, identity and secrets, monitoring and audit, and support through retirement.[5]

Design AI-powered business solutions (25–30%)

Copilot Studio builds agents, workflows and agent flows. What you build runs on a harness: the GitHub Copilot harness for reasoning-heavy multi-step work, the standard harness for rule-based and structured conversations, and the Copilot chat harness for extending Copilot Chat with your organization’s knowledge.[12]
On the standard harness, an agent matches a request to a topic. When a request falls outside your topics, the agent can still answer from its connected knowledge.[12] Keep that behavior in mind for the objective “Design topics for Copilot Studio, including fallback”.[1]
Foundry Agent Service has three agent types: prompt agents, voice-based prompt agents and hosted agents. Hosted agents run your own code as a container with a managed endpoint, scaling and a dedicated Microsoft Entra identity.[9]
Agent Builder agents are managed mainly in the Microsoft 365 admin center, and Copilot Studio agents through the Power Platform admin center.[10]

Deploy AI-powered business solutions (40–45%)

Prompt manipulation is a design input. Copilot Studio tools can pull data from untrusted sources such as emails and support tickets, and Microsoft warns that “Bad actors can create payloads in these untrusted sources to manipulate the agent’s behavior”. Its mitigation is to configure secure connectors for knowledge and custom tools with Copilot Studio’s controls.[11]
Fine-tuning methods: supervised fine-tuning (SFT) for demonstrated behavior, direct preference optimization (DPO) for preferences like tone, and reinforcement fine-tuning (RFT) when you can reliably grade responses.[7] Residency follows the training type, as covered in section 4.
Foundry Agent Service includes tracing, metrics, evaluations and Application Insights integration for observability.[9] The observability entry goes deeper.

My recommendation: learn the four-column matrix until you can argue each tier in one sentence. In my reading of the skills list, many Plan and Design objectives come back to that decision.[1]

6. Next step in the study journey

Next is the IT triage agent: a Copilot Studio design that triggers Intune remediation through Power Automate, with approval gates and synthetic endpoint tests. It’s the ZK-03 case from section 4. If you came here from AB-900, the AB-900 exam review and cheat sheet closes that track, and the AB-100 certification guide covers whether the Expert credential fits your career.

Sources

Stepping into the Architect Tier: My AB-100 Study Blueprint for Agentic-First Enterprise Systems

Top 10 Intune and Autopilot Enrollment Errors: Causes and Fixes