A healthcare tenant is publishing a Microsoft 365 Copilot agent that answers policy questions and can file compliance tickets through a plugin…

The correct sequence follows a standard Software Development Life Cycle (SDLC) adapted for AI agents. First, the foundational knowledge must be identified (3). Next, a robust evaluation and testing framework is built to ensure quality and accuracy (4). With the agent's core logic and validation defined, governance policies and approval gates are configured to control its behavior and promotion (1). Finally, after passing all tests and approvals, the agent is published for end-user consumption (2). This order ensures that governance is applied to a validated asset before it is released.

A. Configuring policies (1) before building evaluation prompts (4) is premature, as the evaluation results should inform the final policy tuning.

C. Building evaluation prompts (4) before identifying knowledge sources (3) is illogical; you cannot test what has not yet been defined or sourced.

D. While configuring policies (1) early is good practice, building the evaluation pack (4) is a core development/testing activity that should precede final production gating (1) and publishing (2).

1. Microsoft Copilot Studio Documentation, "Application lifecycle management (ALM) for copilots". This document outlines the typical stages: Plan and design, Build, Test, Publish, and Maintain, which aligns with identifying sources, building evaluations, then configuring policies for publishing.

2. Microsoft Cloud Adoption Framework, "Govern AI solutions". This guide emphasizes establishing a governance framework, which includes defining data sources, testing strategies, and then implementing access and deployment controls. The logical flow is to define what you're building and how you'll test it before locking down the deployment mechanisms.