Copilot Studio Agents: Capabilities, Data & Use Cases

A company wants an agent that continuously watches warehouse inventory levels, tracks supplier delivery confirmations, and automatically triggers a reorder workflow before stock runs out, with no employee starting the process. Which category of agent fits this scenario?

• AA Power Automate desktop flow
• BAn autonomous agent✓
• CA Copilot Studio topic
• DA conversational agent

Answer: An autonomous agent takes action proactively, on a schedule, in response to a trigger, or as part of a multi-step process, without a human initiating each action, which matches continuous inventory monitoring and automatic reordering. A conversational agent only responds when a user starts a dialogue, a desktop flow automates legacy user-interface steps rather than making monitoring decisions, and a topic is a single conversation path inside an agent rather than a category of agent.

Which statement best distinguishes a conversational agent from an autonomous agent in Copilot Studio?

• AA conversational agent uses Power Fx expressions, while an autonomous agent uses only Dataverse tables
• BA conversational agent is built with agent flows, while an autonomous agent is built with topics
• CA conversational agent can only run inside Microsoft Teams, while an autonomous agent can only run on public websites
• DA conversational agent responds to a user's natural-language dialogue, while an autonomous agent acts proactively on a schedule, trigger or multi-step process✓

Answer: Copilot Studio defines the two agent categories by how they start acting: a conversational agent waits for a user to ask a question, while an autonomous agent begins work on its own in response to a schedule or event. Channel availability is not what separates the two categories, since either type of agent can be published to Teams, a website or another channel. Power Fx and Dataverse are tools and data sources available to any agent rather than a dividing line between the categories, and agent flows and topics are both building blocks either category of agent can use.

Contoso's HR team builds an agent called Benefits Advisor that answers employee questions about plan options by drawing on a SharePoint-hosted guide. Which type of agent is Benefits Advisor?

• AAn agent flow
• BA Power Automate cloud flow
• CAn autonomous agent that acts without a user starting the conversation
• DA conversational agent✓

Answer: Benefits Advisor responds to employee questions through natural-language dialogue, which is the defining trait of a conversational agent. An autonomous agent instead acts on its own initiative without a user asking a question, an agent flow is a deterministic automation an agent invokes as a tool rather than a conversational experience itself, and a cloud flow is a Power Automate automation, not a Copilot Studio agent type.

Contoso's Enrollment Processor agent monitors a shared mailbox for completed benefits forms, extracts the selections, updates the HR system, and sends confirmation emails without any HR staff triggering each run. Which agent category does this describe?

• AA custom knowledge connector
• BA knowledge source
• CA conversational agent
• DAn autonomous agent✓

Answer: Enrollment Processor acts proactively in response to incoming mail rather than waiting for someone to start a conversation, which is the hallmark of an autonomous agent handling a repetitive, data-intensive workflow. A conversational agent only reacts when a user asks something, a knowledge source is content an agent searches rather than a category of agent, and a custom knowledge connector is one specific way to connect an external knowledge source, not an agent type.

Which of these is a common use case for a conversational agent in Copilot Studio, according to Microsoft's guidance?

• AAnswering employee questions about vacation balances and benefits enrollment✓
• BScanning records on a schedule to generate compliance reports for administrators
• CMonitoring inventory levels and triggering reorder workflows before stock runs out
• DExtracting key terms from incoming contracts and flagging exceptions for legal review

Answer: Employee self-service HR is listed as a conversational use case: an agent answers questions about vacation balances, benefits and onboarding directly through chat, without every question being routed to an HR specialist. Contract term extraction, inventory reorder monitoring and scheduled compliance scanning are all autonomous use cases, since each runs on its own trigger or schedule rather than in response to a user's question.

Which of the following is one of the knowledge source types Copilot Studio supports for grounding an agent's answers?

• AAgent flows
• BMCP servers
• CPublic websites✓
• DCustom prompts

Answer: Copilot Studio supports several knowledge source types, including public websites, alongside SharePoint sites and documents, uploaded files, Dataverse knowledge, and custom knowledge connectors, so a customer-facing agent can ground answers in published web content. Agent flows, MCP servers and custom prompts are all tool categories that let an agent take action, not content repositories an agent searches to answer a question.

In Copilot Studio, what fundamentally distinguishes a knowledge source from a tool?

• AA knowledge source is content an agent searches to answer questions, while a tool is a capability an agent invokes to take action✓
• BA knowledge source is configured only by an administrator, while a tool is configured only by end users
• CA knowledge source always requires Microsoft Entra ID authentication, while a tool never requires any authentication
• DA knowledge source can only ever be a SharePoint site or a public website, while a tool can only ever be an MCP server connection

Answer: Copilot Studio capabilities rest on two building blocks: knowledge gives an agent something to read and reason over when answering questions, while tools give an agent something to do, such as retrieving live data or running a process. Knowledge sources are not limited to SharePoint or public websites and tools are not limited to MCP servers, since each category includes several types; makers, not end users, configure both knowledge and tools; and authentication needs depend on the specific source or tool connected, not on whether it is classified as knowledge versus a tool.

How does Microsoft describe what happens to an organization's prompts, responses and connected data when Copilot Studio generates an agent's reply?

• AThey are copied into a public training dataset that is shared publicly unless an administrator opts out of sharing
• BThey are processed outside the Power Platform environment's assigned geographic region by default
• CThey are anonymized and shared with other Microsoft customers to improve response quality
• DThey stay within the Microsoft cloud boundary and are never used to train foundation AI models✓

Answer: Copilot Studio is built on Azure OpenAI Service and runs entirely within the Azure cloud, so prompts, responses and the data reached through knowledge sources remain within the Microsoft cloud boundary and are never used to train foundation AI models. Sharing data with other organizations, copying it into a public training set, or moving it outside the environment's assigned region by default all contradict this data-protection commitment.

Copilot Studio grounds an agent's answers in organizational data using Retrieval-Augmented Generation. What are its three stages, in order?

• AIndexing, translation, and summarization
• BIngestion, moderation, and publication
• CRetrieval, augmentation, and generation✓
• DAuthentication, orchestration, and logging

Answer: Retrieval-Augmented Generation works in three stages: retrieval finds the most relevant passages from configured knowledge sources, augmentation combines that content with the user's question as context, and generation produces a response grounded in the retrieved content rather than speculation. Indexing, translation and summarization; authentication, orchestration and logging; and ingestion, moderation and publication are not the stage names Copilot Studio documentation uses for RAG.

By default, where does Copilot Studio store an agent's conversation logs and agent data?

• AWithin the geographic region associated with the Power Platform environment✓
• BOn the SharePoint site the agent uses as a knowledge source
• CIn a single global data center regardless of the environment's region
• DWherever the end user's device happens to be located at the time

Answer: Copilot Studio follows the Power Platform geographic data residency model, so when an environment is created and associated with a region, agent data and conversation logs are stored in that region by default. A single global data center that ignores environment region, storage tied to a user's device location, and storage on a SharePoint knowledge source are all inconsistent with how Copilot Studio actually manages data residency.

An employee asks Copilot Studio's Benefits Advisor agent a question. The agent can only retrieve information the employee is already permitted to see in SharePoint or Dataverse. Which security principle does this illustrate?

• AThe agent bypasses SharePoint permissions whenever generative orchestration is enabled instead of topic-based orchestration
• BThe agent shares one service account's permissions across every employee who uses it
• CThe agent runs with elevated, system-administrator-level privileges so it can always find an answer, regardless of the requesting user's own permissions
• DThe agent runs as the authenticated user and never has elevated privileges beyond that user's own permissions✓

Answer: Copilot Studio agents run as the authenticated user, so when an agent retrieves information from SharePoint, Dataverse or another secured system it can only access content that signed-in user already has permission to see, with no elevated privileges. Running with administrator rights, sharing one account across everyone, or bypassing permissions under generative orchestration would all give the agent broader access than the user actually has, which is not how Copilot Studio enforces security.

An administrator blocks a specific connector using a Power Platform Data Loss Prevention (DLP) policy. What is the effect on a Copilot Studio agent that relies on that connector?

• AThe connector remains available to the agent but is hidden from the analytics dashboard
• BThe agent automatically switches to an equivalent MCP server to bypass the restriction
• CThe DLP policy only affects Power Automate flows, so the agent keeps using the connector as before
• DThe agent can no longer use that connector as a tool or knowledge source✓

Answer: Power Platform DLP policies apply to Copilot Studio agents just as they do to flows and apps, so if a connector is blocked by policy the agent cannot use it as a tool or as a knowledge source. DLP restrictions are not limited to flows, an agent cannot route around a block by silently switching to an MCP server since MCP connections rely on the same underlying connectors and are subject to the same policies, and a blocked connector is removed from use rather than merely hidden in analytics.

What does Copilot Studio's support for Customer Lockbox provide?

• AA dedicated Azure region and separate physical hardware reserved exclusively for a single customer's agents
• BAutomatic encryption of every Dataverse table and SharePoint document at rest, applied without any administrator configuration
• CA locked editing mode that prevents makers from changing a published agent
• DA requirement for explicit customer approval before Microsoft support staff can access customer data✓

Answer: Customer Lockbox requires explicit customer approval before Microsoft support personnel can access customer data during a troubleshooting scenario, giving the customer direct control over that access. Automatic table and document encryption, a read-only editing lock, and a dedicated single-tenant Azure region are all different capabilities that Customer Lockbox does not describe.

A maker wants an agent to answer questions using structured business records such as customer accounts and product catalogs stored in Power Platform. Which knowledge source type should they configure?

• ADataverse knowledge✓
• BA public website containing externally published product documentation
• CAn uploaded file
• DA custom knowledge connector

Answer: Dataverse knowledge lets an agent search structured Dataverse tables directly, which fits questions about business records such as customer accounts, product catalogs or case history. A public website suits externally published content rather than internal structured records, an uploaded file is a maker-supplied document such as a PDF rather than a live table, and a custom knowledge connector is for content held in an external system, not Dataverse itself.