Contoso’s HR department has built a Copilot Studio agent that answers employees’ HR policy questions. They want only the HR security group to use it…

Question breakdown

Tests

Manage agent access and availability for Microsoft 365 Copilot

Difficulty

Medium

Key idea: Admins approve or deploy custom agents centrally and limit their availability to specific users or security groups, rather than relying on default sharing.

How to reach the answer

1. The users are already licensed, so licensing is not what controls access here.
2. The requirements are that only the HR group can use the agent and it must not reach the whole tenant.
3. That calls for central admin approval with availability scoped to a group.
4. Option C approves the agent and scopes it to the HR security group, which meets both requirements.

Each option

• AIncorrect. Licenses give users Copilot features but do not control who can see a particular agent.
• BIncorrect. Sharing with Everyone causes the tenant-wide exposure the requirement forbids, and trusting users is not a control.
• CCorrect. Central approval with security-group scoping limits the agent to HR and prevents tenant-wide rollout.
• DIncorrect. Disabling other agents does nothing to restrict who can use this one and disrupts other teams.

Common trap: Option A is tempting because licensing is often the first Copilot prerequisite, but a license grants capability, not access to a specific agent.

In practice: Departmental agents built in Copilot Studio often contain sensitive content. Admins review them in the Microsoft 365 admin center's agent management and publish them only to the owning group.

Remember: Control access to individual agents through admin approval and group-scoped availability, not through licenses or broad sharing.

Drafted with AI assistance and checked against the answer key.