This post is a part of the AB-900: Microsoft 365 Copilot and Agent Administration Fundamentals Exam Prep Hub.
This topic falls under these sections:
Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%)
--> Understand data security implications of Copilot
--> Understand how Microsoft Graph influences Copilot responses
Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.
Introduction
One of the most important concepts for the AB-900 exam is understanding how Microsoft 365 Copilot generates responses. Many users assume that Copilot simply searches documents and emails. In reality, Microsoft 365 Copilot relies heavily on Microsoft Graph to provide personalized, context-aware, and permission-trimmed responses.
Understanding the relationship between Microsoft Graph and Copilot is essential because it explains why Copilot can provide relevant answers, summarize organizational information, and generate content based on a user’s work data while maintaining security boundaries.
What Is Microsoft Graph?
Microsoft Graph is Microsoft’s unified API and data layer that connects information across Microsoft 365 services.
It serves as a central gateway to organizational data stored in services such as:
- Microsoft Outlook
- Microsoft Teams
- Microsoft SharePoint
- Microsoft OneDrive
- Microsoft Exchange Online
- Microsoft Planner
- Microsoft To Do
- Microsoft Entra ID
- Microsoft Loop
- Microsoft Viva
Microsoft Graph not only stores references to data but also understands the relationships between people, files, meetings, emails, chats, and organizational activities.
Think of Microsoft Graph as the intelligence layer that helps Microsoft 365 understand:
- Who users are
- What content they can access
- Which colleagues they work with
- What meetings they attend
- Which documents they frequently use
- How information is connected across the organization
How Microsoft 365 Copilot Uses Microsoft Graph
Microsoft 365 Copilot combines:
- Large Language Models (LLMs)
- Microsoft Graph
- Microsoft 365 applications
When a user submits a prompt, Copilot does not rely solely on the LLM’s pre-trained knowledge.
Instead, Copilot uses Microsoft Graph to retrieve relevant organizational data and then grounds the LLM’s response using that data.
This process helps ensure responses are:
- Relevant
- Up-to-date
- Personalized
- Context-aware
- Based on enterprise data
The Copilot Response Process
A simplified workflow looks like this:
Step 1: User Submits a Prompt
Example:
“Summarize the project status for the Contoso migration project.”
Step 2: Copilot Queries Microsoft Graph
Microsoft Graph searches organizational data that the user is permitted to access, including:
- Project documents
- Emails
- Teams conversations
- Meeting notes
- SharePoint files
Step 3: Relevant Information Is Retrieved
Graph identifies content related to:
- The project
- Team members
- Recent updates
- Supporting documents
Step 4: Grounding Occurs
The retrieved business information is provided to the LLM.
This process is known as grounding.
Grounding helps ensure the response is based on actual organizational data rather than relying only on the model’s training data.
Step 5: Copilot Generates a Response
The LLM combines:
- User prompt
- Retrieved Graph data
- Application context
to generate a final response.
What Is Grounding?
Grounding is one of the most important concepts for the AB-900 exam.
Grounding refers to supplying real organizational data from Microsoft Graph to the large language model before it generates a response.
Without grounding:
- Responses could be generic
- Information could be outdated
- Answers would lack organizational context
With grounding:
- Responses are more accurate
- Responses are personalized
- Responses reflect current business information
Why Microsoft Graph Improves Copilot Responses
Microsoft Graph helps Copilot provide responses that are:
Personalized
Different users receive different answers because they have access to different data.
Example:
A manager may receive a project summary containing budget information.
A team member may receive the same summary without budget details if they lack permission.
Context-Aware
Graph understands relationships between:
- People
- Teams
- Projects
- Meetings
- Documents
Example:
When a user asks:
“What happened in yesterday’s meeting?”
Copilot can locate:
- Meeting recordings
- Meeting transcripts
- Chat discussions
- Shared files
and generate a summary.
Current
Unlike the LLM’s training data, Microsoft Graph accesses live Microsoft 365 information.
This allows Copilot to work with:
- Today’s emails
- Current documents
- Recent chats
- New meeting notes
Relevant
Graph helps prioritize information most closely related to the user’s work activities.
As a result, Copilot can identify content likely to be useful rather than searching randomly across the organization.
Microsoft Graph Connectors
Organizations often store information outside Microsoft 365.
Microsoft Graph Connectors allow external content to be indexed and accessed through Microsoft Graph.
Examples include:
- ServiceNow
- Salesforce
- Confluence
- Jira
- File shares
- Custom business systems
When properly configured, Copilot can use connected external data as part of its grounding process.
This expands the knowledge available to Copilot beyond Microsoft 365 content.
Security and Permission Trimming
A critical exam concept is that Microsoft Graph enforces existing permissions.
Copilot cannot bypass security controls.
This is called permission trimming.
When Graph retrieves data:
- User permissions are evaluated.
- Only accessible content is returned.
- Unauthorized content is excluded.
As a result:
- Copilot only sees what the user can see.
- Users cannot retrieve restricted documents through Copilot.
- Existing Microsoft 365 security controls remain in effect.
Examples of Microsoft Graph Influencing Copilot
Example 1: Meeting Summaries
Prompt:
“Summarize my meetings from this week.”
Graph provides:
- Calendar events
- Meeting transcripts
- Chat messages
- Shared files
Copilot generates a personalized summary.
Example 2: Document Creation
Prompt:
“Create a proposal using our latest marketing plan.”
Graph retrieves:
- Marketing documents
- Recent presentations
- Strategy files
Copilot uses this information to draft the proposal.
Example 3: Team Updates
Prompt:
“What is the latest status of the migration project?”
Graph gathers:
- Team conversations
- Project files
- Status reports
- Meeting notes
Copilot generates an informed status summary.
Benefits of Microsoft Graph for Copilot
Microsoft Graph provides several advantages:
Better Accuracy
Responses are grounded in organizational data.
Personalization
Responses reflect the user’s work context.
Real-Time Information
Current business data can be used.
Security
Permission trimming protects sensitive information.
Cross-Application Insights
Information can be gathered from multiple Microsoft 365 services.
Key Exam Tips
For the AB-900 exam, remember:
- Microsoft Graph is the data and relationship layer of Microsoft 365.
- Copilot combines LLMs with Microsoft Graph data.
- Grounding provides organizational data to improve response quality.
- Microsoft Graph retrieves information from Microsoft 365 services.
- Copilot respects existing permissions.
- Permission trimming ensures users only receive data they are authorized to access.
- Microsoft Graph Connectors can extend Copilot to external systems.
- Microsoft Graph enables personalized and context-aware responses.
Practice Exam Questions
Question 1
What is the primary role of Microsoft Graph in Microsoft 365 Copilot?
A. Train large language models
B. Store Copilot prompts permanently
C. Provide organizational data and context for responses
D. Replace Microsoft Entra ID authentication
Answer: C
Explanation: Microsoft Graph provides organizational data and relationships that Copilot uses to generate personalized and grounded responses.
Question 2
What process occurs when Copilot uses organizational data to improve the accuracy of a response?
A. Classification
B. Grounding
C. Encryption
D. Federation
Answer: B
Explanation: Grounding is the process of supplying relevant organizational data from Microsoft Graph to the language model before generating a response.
Question 3
Which Microsoft 365 service helps Copilot understand relationships among people, files, meetings, and communications?
A. Microsoft Defender XDR
B. Microsoft Purview
C. Microsoft Intune
D. Microsoft Graph
Answer: D
Explanation: Microsoft Graph provides relationship intelligence across Microsoft 365 services and organizational data.
Question 4
A user asks Copilot to summarize a project. Which source is most likely retrieved through Microsoft Graph?
A. Public internet websites only
B. Operating system registry settings
C. Organizational emails, files, and chats the user can access
D. Device firmware information
Answer: C
Explanation: Microsoft Graph retrieves relevant Microsoft 365 content that the user is authorized to access.
Question 5
Why might two users receive different Copilot responses to the same prompt?
A. Microsoft Graph uses permission-trimmed access to data
B. Copilot randomly changes responses
C. Different users run different operating systems
D. Copilot ignores organizational security controls
Answer: A
Explanation: Responses depend on what data each user is authorized to access through Microsoft Graph.
Question 6
What is the benefit of grounding in Microsoft 365 Copilot?
A. Reduces storage requirements
B. Disables user permissions
C. Makes responses more relevant and based on current business data
D. Eliminates the need for Microsoft Graph
Answer: C
Explanation: Grounding helps ensure responses are accurate, contextual, and based on organizational information.
Question 7
Which statement best describes permission trimming?
A. Copilot grants temporary administrative access to users
B. Copilot can access all organizational content regardless of permissions
C. Permissions are evaluated only after a response is generated
D. Only content a user is authorized to access is available to Copilot
Answer: D
Explanation: Permission trimming ensures that Copilot only retrieves and uses data that the user already has permission to view.
Question 8
What can Microsoft Graph Connectors enable?
A. Replacement of Microsoft Entra ID
B. Access to external business data sources through Microsoft Graph
C. Automatic deletion of all external content
D. Disabling Microsoft 365 search
Answer: B
Explanation: Graph Connectors allow organizations to bring external content sources into Microsoft Graph for search and Copilot experiences.
Question 9
Which Microsoft Graph capability most directly helps Copilot create personalized responses?
A. Relationship awareness across users, documents, meetings, and activities
B. Operating system patch management
C. Network packet inspection
D. Hardware monitoring
Answer: A
Explanation: Microsoft Graph understands relationships among organizational resources and activities, enabling personalized responses.
Question 10
When a user submits a prompt to Microsoft 365 Copilot, what generally happens first?
A. Copilot immediately generates a response without retrieving data
B. The user’s device is scanned for malware
C. Microsoft Graph retrieves relevant authorized organizational information
D. All tenant data is copied into the language model
Answer: C
Explanation: Before generating a response, Copilot typically retrieves relevant data through Microsoft Graph to ground the response in current organizational context.
Go to the AB-900 Exam Prep Hub main page
The Data Community 