Tag: Microsoft 365

Understand the use case for creating your own agent (AB-730 Exam Prep)

This post is a part of the AB-730: AI Business Professional Exam Prep Hub.
This topic falls under these sections:
Understand generative AI fundamentals (25–30%)
   --> Understand generative AI capabilities across Microsoft 365 experiences
      --> Understand the use case for creating your own agent


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

As organizations adopt generative AI, they often discover that general-purpose AI assistants are useful for a wide variety of tasks. However, some business processes require specialized knowledge, specific instructions, access to unique data sources, or the ability to perform business-specific actions.

This is where creating your own AI agent becomes valuable.

For the AB-730: AI Business Professional exam, it is important to understand that organizations can create custom agents that are designed to assist with specific business functions, workflows, and objectives. These agents extend the capabilities of standard chat experiences by incorporating specialized knowledge, business rules, and task automation.

Rather than relying on a general-purpose assistant for every task, organizations can create agents that are tailored to the needs of a department, team, or business process.


What Is a Custom Agent?

A custom agent is an AI-powered assistant that has been configured to support a specific purpose, role, or workflow.

Unlike a general-purpose Copilot experience that can answer a wide variety of questions, a custom agent is focused on a particular business domain.

Examples include:

  • Human Resources Agent
  • IT Support Agent
  • Customer Service Agent
  • Sales Agent
  • Project Management Agent
  • Finance Agent
  • Procurement Agent
  • Compliance Agent

A custom agent can be designed to:

  • Follow specific instructions
  • Use approved data sources
  • Perform specialized tasks
  • Support business processes
  • Provide role-specific assistance

Why Create Your Own Agent?

Organizations create custom agents when they want AI assistance that is more focused, consistent, and aligned with business needs.

Common reasons include:

Specialization

A custom agent can become an expert in a specific area.

Consistency

The agent can provide standardized responses and recommendations.

Productivity

Employees spend less time searching for information and performing repetitive tasks.

Automation

Agents can help automate portions of business workflows.

Knowledge Accessibility

Agents can make organizational knowledge easier to access.


When a General Copilot May Not Be Enough

A general-purpose AI assistant can help with many tasks, but it may not always be optimized for a particular business process.

Consider a Human Resources department.

Employees may repeatedly ask:

  • What is the vacation policy?
  • How do I enroll in benefits?
  • What forms are required for onboarding?
  • How do I request parental leave?

A specialized HR agent can be configured with:

  • Company policies
  • Employee handbook information
  • HR procedures
  • Benefits documentation

This allows employees to receive faster and more consistent answers.


Common Use Cases for Creating Custom Agents

Human Resources Agent

An HR agent can help:

  • Answer policy questions
  • Assist with onboarding
  • Explain benefits information
  • Locate HR resources
  • Guide employees through procedures

Example

An employee asks:

“How many vacation days do I receive after five years of service?”

The HR agent can provide information based on approved company policies.


IT Help Desk Agent

IT departments often handle repetitive support requests.

An IT agent can:

  • Answer technical questions
  • Troubleshoot common issues
  • Guide users through setup procedures
  • Create support tickets
  • Escalate complex cases

Example

A user asks:

“How do I connect to the company VPN?”

The agent can provide approved instructions and troubleshooting guidance.


Customer Service Agent

Customer service teams often manage large volumes of inquiries.

An agent can:

  • Answer frequently asked questions
  • Search knowledge bases
  • Provide support information
  • Route issues appropriately

Example

A customer asks:

“What is your return policy?”

The agent can provide an accurate response using company-approved information.


Sales Agent

Sales teams spend significant time gathering information and preparing communications.

A sales agent can:

  • Summarize customer information
  • Generate follow-up emails
  • Prepare meeting briefs
  • Suggest next actions
  • Surface relevant sales materials

Example

A sales representative asks:

“Prepare a summary of my upcoming customer meeting.”

The agent gathers relevant information and produces a briefing.


Project Management Agent

Project managers often coordinate multiple workstreams.

A project management agent can:

  • Summarize project status
  • Identify risks
  • Track action items
  • Review project documentation
  • Generate progress reports

Example

A project manager asks:

“What open risks remain for Project Alpha?”

The agent analyzes available project information and provides a summary.


How Custom Agents Improve Productivity

One of the primary reasons organizations create agents is productivity improvement.

Without an agent:

  1. Employee identifies a problem.
  2. Employee searches multiple systems.
  3. Employee locates documentation.
  4. Employee interprets information.
  5. Employee takes action.

With an agent:

  1. Employee asks a question.
  2. Agent gathers relevant information.
  3. Agent provides guidance or completes part of the task.

This reduces time spent searching for information and performing repetitive work.


Role-Based Expertise

Custom agents can be designed around specific business roles.

Examples include:

RoleAgent Focus
HR SpecialistEmployee policies and benefits
Sales RepresentativeCustomer and opportunity information
Project ManagerProject tracking and reporting
IT AdministratorTechnical support and troubleshooting
Finance AnalystBudgeting and financial procedures
Compliance OfficerRegulatory requirements and policies

This specialization helps deliver more relevant and accurate responses.


Organizational Knowledge Management

Many organizations struggle with knowledge scattered across:

  • Documents
  • SharePoint sites
  • Wikis
  • Emails
  • Internal portals

Custom agents can help employees locate information more efficiently.

Instead of searching through multiple repositories, users can simply ask questions in natural language.

Example

Instead of searching dozens of policy documents, an employee asks:

“What approvals are required for international travel expenses?”

The agent can retrieve the relevant information and provide an answer.


Workflow Assistance and Automation

Modern agents increasingly support business workflows.

Depending on their design and permissions, agents may:

  • Create tasks
  • Update records
  • Route requests
  • Trigger processes
  • Generate notifications
  • Coordinate activities

This allows agents to contribute to business outcomes rather than simply generating text.

For exam purposes, remember that automation is one of the major reasons organizations create custom agents.


Governance and Security Considerations

A common misconception is that custom agents can access any organizational information.

This is incorrect.

Custom agents still operate within:

  • User permissions
  • Organizational policies
  • Security controls
  • Compliance requirements
  • Data governance standards

Organizations remain responsible for:

  • Defining agent behavior
  • Controlling access
  • Managing data sources
  • Monitoring usage
  • Ensuring compliance

Benefits of Creating Your Own Agent

Organizations may create custom agents to achieve:

Increased Productivity

Reduce repetitive manual work.

Faster Access to Information

Provide answers without extensive searching.

Consistent Responses

Deliver standardized guidance.

Improved Employee Experience

Help employees complete tasks more efficiently.

Business Process Support

Assist with operational workflows.

Knowledge Retention

Capture and distribute organizational expertise.


When Should an Organization Create a Custom Agent?

A custom agent is often appropriate when:

  • Employees repeatedly ask similar questions.
  • Specialized knowledge is required.
  • Business processes follow predictable patterns.
  • Information is spread across multiple sources.
  • Workflow automation would provide value.
  • Consistent guidance is important.
  • Teams require role-specific assistance.

Common Exam Misconceptions

Misconception 1: Custom agents are only for IT departments.

Reality:

Agents can support HR, sales, finance, operations, customer service, project management, and many other functions.


Misconception 2: Agents replace employees.

Reality:

Agents are designed to assist employees, improve productivity, and automate repetitive work.


Misconception 3: Agents can bypass security permissions.

Reality:

Agents operate within organizational security and governance controls.


Misconception 4: A custom agent must answer every possible question.

Reality:

Custom agents are most effective when focused on a specific purpose or business domain.


Key Exam Takeaways

For the AB-730 exam, remember:

  • A custom agent is designed for a specific business purpose or workflow.
  • Organizations create agents to improve productivity, consistency, and efficiency.
  • Common agent use cases include HR, IT support, customer service, sales, finance, and project management.
  • Agents can help employees access organizational knowledge more easily.
  • Agents can support workflow automation and task execution.
  • Specialized agents provide more focused assistance than general-purpose AI assistants.
  • Agents can use approved organizational data sources.
  • Security, permissions, and governance controls still apply.
  • Agents are most valuable when supporting repetitive, knowledge-intensive, or process-driven work.
  • The goal of a custom agent is to help achieve business outcomes more effectively.

Practice Exam Questions

Question 1

What is the primary reason an organization creates a custom AI agent?

A. To replace all existing software systems

B. To provide specialized assistance for a specific business purpose

C. To bypass organizational security policies

D. To eliminate the need for human oversight

Answer: B

Explanation

Correct: Custom agents are typically created to support specific business functions, workflows, or knowledge domains.

Incorrect Answers:

  • A: Agents complement existing systems rather than replace them.
  • C: Agents must follow security policies.
  • D: Human oversight remains important.

Question 2

Which scenario is the best example of a custom HR agent?

A. Generating random creative stories

B. Managing social media advertisements

C. Answering employee questions about benefits and company policies

D. Designing computer hardware

Answer: C

Explanation

Correct: HR agents are commonly used to provide information about policies, benefits, onboarding, and employee procedures.

Incorrect Answers:

  • A, B, and D are unrelated to HR functions.

Question 3

What business challenge can a custom agent help address?

A. Eliminating the need for data governance

B. Reducing the time employees spend searching for information

C. Granting users unrestricted access to company data

D. Replacing all business processes

Answer: B

Explanation

Correct: One major benefit of agents is helping users locate information more efficiently.

Incorrect Answers:

  • A: Governance remains necessary.
  • C: Access controls still apply.
  • D: Agents support rather than replace business processes.

Question 4

Which use case is most appropriate for a custom sales agent?

A. Managing employee payroll calculations

B. Performing medical diagnoses

C. Generating customer meeting summaries and follow-up recommendations

D. Replacing the organization’s CRM system

Answer: C

Explanation

Correct: Sales agents often help prepare customer information, meeting briefs, and recommended next steps.

Incorrect Answers:

  • A relates to finance/payroll.
  • B is unrelated.
  • D is not the purpose of a sales agent.

Question 5

Why might an organization create a custom agent instead of relying only on a general-purpose AI assistant?

A. To provide focused expertise and business-specific guidance

B. To disable organizational permissions

C. To eliminate compliance requirements

D. To avoid using company data

Answer: A

Explanation

Correct: Custom agents can be tailored to specific business needs, making them more effective in specialized scenarios.

Incorrect Answers:

  • B and C are incorrect because governance remains important.
  • D is incorrect because agents often use approved organizational data.

Question 6

Which department commonly benefits from an IT support agent?

A. Human Resources only

B. Marketing only

C. Executive leadership only

D. Information Technology

Answer: D

Explanation

Correct: IT support agents are designed to assist with technical support, troubleshooting, and help desk activities.

Incorrect Answers:

  • A, B, and C may use agents, but IT support agents are most directly associated with IT departments.

Question 7

What is a major benefit of using a custom agent for organizational knowledge management?

A. It guarantees all answers are always correct.

B. It eliminates the need for documentation.

C. It helps employees access information through natural language interactions.

D. It automatically grants access to restricted files.

Answer: C

Explanation

Correct: Agents can simplify access to organizational knowledge by allowing users to ask questions in natural language.

Incorrect Answers:

  • A: No AI system guarantees perfect accuracy.
  • B: Documentation remains important.
  • D: Permissions are still enforced.

Question 8

Which statement about custom agents and security is accurate?

A. Agents can access all organizational data by default.

B. Agents operate within organizational permissions and governance controls.

C. Agents automatically override compliance requirements.

D. Agents are exempt from security policies.

Answer: B

Explanation

Correct: Custom agents must follow organizational security, compliance, and governance rules.

Incorrect Answers:

  • A, C, and D incorrectly suggest that agents bypass controls.

Question 9

An organization notices employees repeatedly asking the same policy questions. Which solution is most appropriate?

A. Disable employee access to policies

B. Require employees to contact management for every question

C. Remove all policy documents

D. Create a custom policy-support agent

Answer: D

Explanation

Correct: A policy-support agent can provide consistent answers and reduce repetitive inquiries.

Incorrect Answers:

  • A, B, and C would reduce efficiency and access to information.

Question 10

Which characteristic makes a business process a strong candidate for a custom agent?

A. The process changes completely every time it occurs.

B. The process requires no information or decisions.

C. The process is repetitive and follows predictable patterns.

D. The process cannot benefit from automation.

Answer: C

Explanation

Correct: Repetitive, structured, and knowledge-driven processes are often ideal candidates for agent assistance.

Incorrect Answers:

  • A: Highly unpredictable processes are harder to automate.
  • B: Information and decision-making are often part of agent workflows.
  • D: If automation offers no benefit, an agent may not be necessary.

Go to the AB-730 Exam Prep Hub main page

Understand the difference between a chat experience and an agent experience (AB-730 Exam Prep)

This post is a part of the AB-730: AI Business Professional Exam Prep Hub.
This topic falls under these sections:
Understand generative AI fundamentals (25–30%)
   --> Understand generative AI capabilities across Microsoft 365 experiences
      --> Understand the difference between a chat experience and an agent experience


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

As generative AI becomes increasingly integrated into business applications, organizations are moving beyond simple AI conversations and toward AI systems that can perform tasks, automate processes, and assist with complex workflows.

For the AB-730: AI Business Professional exam, it is important to understand the distinction between a chat experience and an agent experience. While both use generative AI and natural language interactions, they serve different purposes and provide different levels of capability.

A chat experience primarily focuses on answering questions and generating content through conversation. An agent experience goes further by taking actions, executing tasks, coordinating workflows, and operating with a degree of autonomy within defined boundaries.

Understanding this distinction is essential because Microsoft is increasingly incorporating both chat-based and agent-based AI capabilities across Microsoft 365, Copilot, and business applications.


What Is a Chat Experience?

A chat experience is an interactive conversation between a user and an AI assistant.

The user provides prompts, questions, or requests, and the AI responds with generated content.

Examples include:

  • Asking Copilot to summarize a document
  • Requesting a draft email
  • Generating meeting notes
  • Explaining a concept
  • Brainstorming ideas
  • Creating a project plan

The interaction is primarily conversational.

Characteristics of a Chat Experience

A chat experience typically:

  • Responds to user prompts
  • Generates content
  • Provides recommendations
  • Answers questions
  • Assists with brainstorming
  • Maintains conversational context
  • Requires ongoing user direction

The AI serves as an assistant that helps users complete tasks but generally does not independently perform actions beyond generating responses.


Examples of Chat Experiences

Example 1: Drafting an Email

A user asks:

“Draft an email announcing our new customer loyalty program.”

Copilot generates the email draft.

The user reviews, edits, and sends the message.

The AI assists with content creation but does not automatically launch the campaign.


Example 2: Summarizing a Meeting

A user asks:

“Summarize yesterday’s project meeting.”

Copilot reviews the available meeting transcript and produces a summary.

Again, the AI provides information but does not take additional actions.


Example 3: Research Assistance

A user asks:

“What are the latest trends in AI adoption?”

Copilot generates a response using available context and knowledge sources.

The interaction remains conversational.


What Is an Agent Experience?

An agent experience extends beyond conversation.

An AI agent can:

  • Understand goals
  • Execute tasks
  • Coordinate multiple actions
  • Use tools and business systems
  • Follow business rules
  • Automate portions of workflows

Rather than only generating responses, an agent can help accomplish objectives.

The user provides an outcome or goal, and the agent helps perform the necessary steps.


Characteristics of an Agent Experience

An agent experience often includes:

  • Goal-oriented behavior
  • Task execution
  • Workflow automation
  • Use of external systems and tools
  • Multi-step reasoning
  • Persistent instructions
  • Reduced need for continuous user input

Agents still operate within permissions, policies, and governance controls established by the organization.


Examples of Agent Experiences

Example 1: Employee Onboarding Agent

A manager requests:

“Onboard a new employee.”

An agent could:

  • Create onboarding tasks
  • Schedule orientation meetings
  • Generate required documents
  • Notify relevant departments
  • Track completion status

Instead of simply describing the onboarding process, the agent actively performs portions of it.


Example 2: Customer Service Agent

A customer submits a support request.

The agent may:

  • Review the request
  • Search knowledge bases
  • Generate responses
  • Update ticket systems
  • Escalate complex issues

The agent is performing actions in addition to generating text.


Example 3: Sales Pipeline Agent

A sales manager requests:

“Prepare this week’s sales follow-up activities.”

The agent may:

  • Review CRM data
  • Identify prospects
  • Draft emails
  • Create tasks
  • Schedule reminders

The focus is on completing work rather than only discussing it.


Comparing Chat Experiences and Agent Experiences

FeatureChat ExperienceAgent Experience
Primary PurposeConversation and assistanceGoal completion and task execution
User InteractionPrompt and responseGoal-oriented collaboration
Generates ContentYesYes
Answers QuestionsYesYes
Performs ActionsLimitedYes
Uses Business SystemsSometimesFrequently
Workflow AutomationMinimalSignificant
Requires Constant User GuidanceUsuallyLess often
Multi-Step TasksLimitedCommon
AutonomyLowHigher

Chat Experiences in Microsoft Copilot

Microsoft Copilot Chat is a good example of a chat experience.

Users can:

  • Ask questions
  • Generate content
  • Brainstorm ideas
  • Summarize information
  • Rewrite documents

The interaction remains largely conversational.

Examples:

  • “Create a marketing slogan.”
  • “Summarize this proposal.”
  • “Explain cloud computing.”
  • “Draft a project update.”

The AI helps users think, write, and communicate more effectively.


Agent Experiences in Microsoft Copilot

Microsoft is increasingly introducing agents that can work alongside users.

These agents can:

  • Handle specialized business processes
  • Automate repetitive work
  • Connect to organizational data
  • Perform actions within approved systems
  • Follow defined business instructions

Examples may include:

  • HR agents
  • Sales agents
  • Customer service agents
  • IT support agents
  • Project management agents

These agents focus on achieving outcomes rather than simply responding to prompts.


How Agents Use Tools

One major distinction between chats and agents involves tool usage.

A chat experience primarily generates responses.

An agent may use tools to:

  • Access databases
  • Update records
  • Retrieve documents
  • Schedule meetings
  • Create tickets
  • Trigger workflows

For example:

A chat experience may explain how to create a support ticket.

An agent experience may actually create the ticket.

This difference is frequently emphasized in discussions about agentic AI.


Levels of User Control

Another important distinction is the level of human involvement.

Chat Experience

The user generally controls each step.

Example:

  1. Ask a question.
  2. Receive a response.
  3. Decide what to do next.

Agent Experience

The user defines a goal.

The agent may:

  1. Determine required steps.
  2. Execute approved actions.
  3. Report progress.
  4. Deliver results.

The agent reduces manual effort while keeping the user informed.


Agents Still Follow Organizational Rules

A common misconception is that agents have unlimited authority.

This is incorrect.

Agents remain constrained by:

  • User permissions
  • Organizational policies
  • Compliance requirements
  • Security controls
  • Governance rules

Agents cannot bypass access controls simply because they are capable of taking actions.

Like Microsoft Copilot generally, agents only operate within authorized boundaries.


Benefits of Chat Experiences

Chat experiences are useful when users need:

  • Information
  • Explanations
  • Brainstorming
  • Drafting assistance
  • Summaries
  • Recommendations
  • Creative content

Benefits include:

  • Simplicity
  • Ease of use
  • Fast responses
  • Flexible conversations

Benefits of Agent Experiences

Agent experiences are useful when users need:

  • Process automation
  • Task execution
  • Workflow management
  • Repetitive work reduction
  • Operational efficiency
  • Goal completion

Benefits include:

  • Increased productivity
  • Reduced manual effort
  • Consistent execution
  • Faster business processes

Common Exam Misconceptions

Misconception 1: Chat and agent experiences are the same.

Reality:

A chat experience focuses on conversation, while an agent experience focuses on completing tasks and achieving outcomes.


Misconception 2: Agents only generate text.

Reality:

Agents can perform actions and interact with systems when authorized.


Misconception 3: Agents operate without governance.

Reality:

Agents remain subject to security, permissions, and compliance controls.


Misconception 4: Chat experiences automate workflows.

Reality:

Chat experiences primarily assist users through conversation and content generation.


Key Exam Takeaways

For the AB-730 exam, remember:

  • A chat experience is primarily conversational.
  • Chat experiences answer questions and generate content.
  • Agent experiences focus on goals, tasks, and outcomes.
  • Agents can perform actions and automate workflows.
  • Agents often use tools and business systems.
  • Chat experiences generally require more direct user guidance.
  • Agent experiences can execute multi-step processes.
  • Agents remain subject to permissions and governance controls.
  • Microsoft Copilot includes both chat-based and agent-based capabilities.
  • The primary distinction is that chats assist through conversation, while agents assist through action.

Practice Exam Questions

Question 1

Which statement best describes a chat experience?

A. It primarily focuses on conversation and content generation.

B. It automatically manages business processes.

C. It independently executes workflows.

D. It replaces organizational governance controls.

Answer: A

Explanation

Correct: Chat experiences are designed for interactive conversations, answering questions, generating content, and assisting users.

Incorrect Answers:

  • B: Workflow management is more characteristic of agents.
  • C: Independent task execution is an agent capability.
  • D: Governance controls still apply.

Question 2

What is a key characteristic of an agent experience?

A. It only answers questions.

B. It can execute tasks and work toward goals.

C. It cannot access business systems.

D. It ignores user instructions after activation.

Answer: B

Explanation

Correct: Agents are designed to perform actions, coordinate workflows, and help achieve business objectives.

Incorrect Answers:

  • A: Agents do much more than answer questions.
  • C: Agents often interact with business systems.
  • D: Agents continue to operate within defined instructions and boundaries.

Question 3

A user asks Copilot to summarize a project proposal and receives a written summary. This is an example of:

A. Workflow orchestration

B. Agent execution

C. Chat experience

D. Autonomous task management

Answer: C

Explanation

Correct: Summarizing content through conversation is a classic chat experience.

Incorrect Answers:

  • A: No workflow is being orchestrated.
  • B: No actions beyond content generation are occurring.
  • D: The AI is not independently managing tasks.

Question 4

Which activity is most likely associated with an agent experience?

A. Explaining a business concept

B. Rewriting an email

C. Brainstorming marketing ideas

D. Creating tasks and scheduling follow-up activities automatically

Answer: D

Explanation

Correct: Creating tasks and managing follow-up activities involves task execution and workflow automation.

Incorrect Answers:

  • A, B, and C: These are typical chat-oriented activities.

Question 5

How does user involvement typically differ between chat and agent experiences?

A. Agents generally require less step-by-step guidance from users.

B. Chats require less user involvement than agents.

C. Agents never need user input.

D. There is no difference.

Answer: A

Explanation

Correct: Agents often work toward goals with reduced need for continuous user direction.

Incorrect Answers:

  • B: Chats usually require ongoing prompting.
  • C: Agents still require goals, permissions, and oversight.
  • D: There are significant differences.

Question 6

Which statement about agents is accurate?

A. Agents bypass organizational security controls.

B. Agents can only generate text.

C. Agents operate within permissions and governance boundaries.

D. Agents cannot access tools.

Answer: C

Explanation

Correct: Agents remain subject to security, compliance, and permission controls.

Incorrect Answers:

  • A: Agents cannot bypass security.
  • B: Agents may perform actions in addition to generating text.
  • D: Many agents use tools and systems.

Question 7

A customer service AI that updates support tickets and escalates issues is best classified as:

A. A search engine

B. An agent experience

C. A spreadsheet assistant

D. A traditional chatbot only

Answer: B

Explanation

Correct: Updating tickets and escalating issues involves taking actions and executing processes.

Incorrect Answers:

  • A: Search engines do not manage workflows.
  • C: Spreadsheet assistants are unrelated.
  • D: A traditional chatbot typically would not perform these actions.

Question 8

What is one of the primary benefits of a chat experience?

A. Full workflow automation

B. Autonomous business process execution

C. Eliminating all human involvement

D. Fast access to information, summaries, and content generation

Answer: D

Explanation

Correct: Chat experiences excel at generating content, answering questions, and providing information quickly.

Incorrect Answers:

  • A and B: These are more closely associated with agents.
  • C: Human involvement remains important.

Question 9

Which statement best differentiates agents from chat experiences?

A. Agents can work toward goals and perform actions.

B. Agents cannot generate content.

C. Chat experiences can bypass permissions.

D. Chat experiences are always more autonomous.

Answer: A

Explanation

Correct: The defining distinction is that agents can execute tasks and pursue objectives.

Incorrect Answers:

  • B: Agents can also generate content.
  • C: Permissions still apply.
  • D: Agents are generally more autonomous.

Question 10

A manager asks an AI system to onboard a new employee, and the system schedules orientation meetings, creates tasks, and tracks progress. This is an example of:

A. Content summarization

B. Conversational search

C. Prompt refinement

D. Agent experience

Answer: D

Explanation

Correct: The AI is actively performing multiple business tasks to achieve a goal, which is characteristic of an agent experience.

Incorrect Answers:

  • A: The AI is doing more than summarization.
  • B: Search is only a small part of the process.
  • C: Prompt refinement is not the primary activity.

Go to the AB-730 Exam Prep Hub main page

Understand How Copilot Works to Keep Your Organization’s Information Private and Secure (AB-730 Exam Prep Hub)

This post is a part of the AB-730: AI Business Professional Exam Prep Hub.
This topic falls under these sections:
Understand generative AI fundamentals (25–30%)
   --> Understand generative AI capabilities across Microsoft 365 experiences
      --> Understand how Copilot works to keep your organization’s information private and secure


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most common concerns organizations have when adopting generative AI is data privacy and security. Business leaders want to take advantage of AI-powered productivity tools such as Microsoft 365 Copilot while ensuring that sensitive company information remains protected.

For the AB-730 exam, it is important to understand that Microsoft 365 Copilot was designed with enterprise security, privacy, compliance, and responsible AI principles in mind. Rather than creating a separate data repository or granting itself unrestricted access to organizational information, Copilot works within the existing Microsoft 365 security framework and respects the permissions already in place. (Microsoft Learn)


Why Security and Privacy Matter in Generative AI

Generative AI systems can access and process large amounts of information to generate useful responses. Without proper controls, this could potentially expose confidential business information.

Organizations must ensure that:

  • Employees only see information they are authorized to access.
  • Sensitive content remains protected.
  • Regulatory and compliance requirements are met.
  • Company data is not used to train public AI models.
  • AI-generated content follows existing governance policies.

Microsoft 365 Copilot addresses these concerns by building on the same security infrastructure that already protects Microsoft 365 services. (Microsoft Learn)


How Microsoft 365 Copilot Works

When a user submits a prompt, Microsoft 365 Copilot performs several steps:

  1. Receives the user’s prompt.
  2. Retrieves relevant information from approved data sources.
  3. Uses AI models to generate a response.
  4. Returns the response to the user.

A key concept is grounding.

Grounding means Copilot uses relevant business information—such as emails, documents, meetings, chats, and files—to provide responses that are accurate and relevant to the user’s work context. Rather than relying solely on general AI training data, Copilot grounds responses in organizational information and current context. (Microsoft Support)

Examples of grounding sources include:

  • Outlook emails
  • Teams chats
  • Meeting transcripts
  • Word documents
  • Excel workbooks
  • SharePoint sites
  • OneDrive files
  • Public web content (when enabled)

However, Copilot can only use information the user is already permitted to access. (Microsoft Support)


Copilot Respects Existing Permissions

One of the most important exam concepts is:

Copilot does not grant additional permissions.

Microsoft 365 Copilot operates using the identity of the signed-in user. If a user cannot access a file manually, Copilot cannot access that file on the user’s behalf. (Microsoft Learn)

For example:

Scenario 1

A sales manager asks:

“Summarize our Q3 sales strategy.”

Copilot can access documents the manager already has permission to view and generate a summary.

Scenario 2

The same manager asks:

“Show me confidential HR salary information.”

If the manager lacks access to those HR documents, Copilot cannot retrieve or display them. (Microsoft Learn)

This permission model is one of the most important safeguards in Microsoft 365 Copilot.


Microsoft Graph and Copilot

Microsoft 365 Copilot uses the Microsoft Graph to retrieve organizational information.

Microsoft Graph acts as a secure gateway to Microsoft 365 data and includes information from:

  • Outlook
  • Teams
  • SharePoint
  • OneDrive
  • Calendar data
  • Contacts
  • Meetings

When Copilot gathers information, it uses Microsoft Graph while enforcing the same access controls already configured within Microsoft 365. (Microsoft Learn)

For exam purposes, remember:

Copilot accesses organizational information through Microsoft Graph and honors existing user permissions.


Your Organization’s Data Is Not Used to Train Public AI Models

Another frequently tested concept is how Microsoft handles customer data.

Microsoft states that:

  • Organizational data is not used to train public foundation models.
  • Prompts and responses remain within the Microsoft 365 service boundary.
  • Customer content is not shared across tenants.
  • Data remains isolated between organizations. (Microsoft Support)

This means that if an employee uploads a confidential business document and uses Copilot to summarize it, that document is not added to a public AI training dataset. (Microsoft Support)


Enterprise Data Protection

Microsoft 365 Copilot includes enterprise-grade protections designed specifically for business environments.

These protections include:

  • Data encryption
  • Identity management
  • Access controls
  • Tenant isolation
  • Compliance controls
  • Audit capabilities
  • Threat detection

Microsoft refers to these protections as part of its enterprise data protection approach. (Microsoft Learn)

Key principle:

Business data remains protected by the same security controls already used throughout Microsoft 365.


Encryption and Data Protection

Microsoft encrypts data:

  • At rest (stored data)
  • In transit (data moving across networks)

This helps prevent unauthorized access while information is stored or transmitted. Microsoft also supports advanced encryption technologies and integrates with Microsoft Purview protection capabilities. (Microsoft Learn)


Microsoft Purview and Compliance Controls

Organizations often use Microsoft Purview to classify, protect, and govern sensitive information.

Copilot works alongside Microsoft Purview features such as:

  • Sensitivity labels
  • Data Loss Prevention (DLP)
  • Information Protection
  • eDiscovery
  • Records Management
  • Compliance monitoring

If a document is protected by sensitivity labels or other compliance controls, Copilot honors those protections during content generation. (Microsoft Learn)


Tenant Isolation

Microsoft 365 customers operate within separate tenants.

A tenant can be thought of as a secure organizational boundary.

Copilot maintains tenant isolation by ensuring:

  • One organization’s data is not exposed to another organization.
  • Data remains within the customer’s Microsoft 365 environment.
  • Access is limited to authorized users. (Microsoft Learn)

For example, employees at one company cannot use Copilot to access documents belonging to another company’s Microsoft 365 tenant.


Protection Against Prompt Injection and Malicious Content

Prompt injection attacks attempt to manipulate AI systems into ignoring rules or revealing information.

Microsoft uses multiple layers of protection, including:

  • Content filtering
  • Prompt injection detection
  • Security monitoring
  • Threat intelligence
  • AI-specific security controls

These protections help reduce risks associated with malicious prompts and attempts to extract unauthorized information. (Microsoft Learn)


Shared Responsibility

Although Microsoft provides extensive security controls, organizations also have responsibilities.

Organizations should:

  • Review permissions regularly.
  • Protect sensitive content.
  • Apply appropriate sensitivity labels.
  • Configure compliance policies.
  • Train employees on responsible AI usage.

A common misunderstanding is that Copilot creates security problems. In reality, Copilot often exposes existing permission issues that were already present within the organization. If users already have access to content, Copilot may make that content easier to find and summarize. Therefore, proper governance remains essential. (Microsoft Learn)


Key Exam Takeaways

Remember these points for the AB-730 exam:

  • Copilot respects existing Microsoft 365 permissions.
  • Copilot only accesses content users are authorized to view.
  • Microsoft Graph provides access to organizational data.
  • Grounding improves response relevance using organizational context.
  • Customer data is not used to train public AI models.
  • Prompts and responses remain within Microsoft’s enterprise-protected environment.
  • Encryption protects data both in transit and at rest.
  • Microsoft Purview compliance controls are honored by Copilot.
  • Tenant isolation prevents cross-organization data exposure.
  • Organizations remain responsible for proper governance and permissions management.

Practice Exam Questions

Question 1

What is the primary purpose of grounding in Microsoft 365 Copilot?

A. Encrypt organizational data

B. Replace Microsoft Graph

C. Improve responses by using relevant contextual information

D. Create new permissions for users

Answer: C


Question 2

Which statement best describes how Copilot accesses organizational information?

A. Through Microsoft Graph while honoring existing permissions

B. Through a separate AI database that stores all company information

C. By granting itself administrative access

D. By scanning all tenants globally

Answer: A


Question 3

A user asks Copilot to summarize a confidential HR document that they cannot access manually. What will happen?

A. Copilot displays the document because it is AI-powered

B. Copilot requests administrator approval automatically

C. Copilot generates a partial summary

D. Copilot cannot access the document

Answer: D


Question 4

Which Microsoft technology serves as the secure gateway to Microsoft 365 organizational data used by Copilot?

A. Microsoft Defender

B. Microsoft Graph

C. Microsoft Fabric

D. Azure AI Foundry

Answer: B


Question 5

How does Microsoft use customer organizational data submitted to Microsoft 365 Copilot?

A. It is used to train public AI models.

B. It is shared across Microsoft tenants.

C. It is not used to train public foundation models.

D. It is automatically published to Microsoft Graph.

Answer: C


Question 6

Which feature helps classify and protect sensitive information that Copilot respects during content generation?

A. Microsoft Purview

B. Microsoft Edge

C. Microsoft Stream

D. Microsoft Planner

Answer: A


Question 7

What does tenant isolation help ensure?

A. Users can share information across organizations.

B. Data is automatically replicated between tenants.

C. Every employee receives administrator permissions.

D. One organization’s data remains separate from another organization’s data.

Answer: D


Question 8

Which statement is true regarding Copilot and permissions?

A. Copilot creates temporary permissions when needed.

B. Copilot only accesses information that the user is already authorized to view.

C. Copilot bypasses SharePoint security controls.

D. Copilot can view all files within a tenant.

Answer: B


Question 9

Which security capability helps protect data while it is being transmitted across networks?

A. Grounding

B. Tenant isolation

C. Encryption in transit

D. Prompt engineering

Answer: C


Question 10

Who shares responsibility for protecting organizational information when using Microsoft 365 Copilot?

A. Only Microsoft

B. Only end users

C. Only IT administrators

D. Microsoft and the organization

Answer: D


Go to the AB-730 Exam Prep Hub main page