A 300-person retailer enables Copilot Business for a merchandising analytics repository containing customer emails and purchase history. Leadership wants to limit exposure, control who can use Copilot, and audit activity. Which governance control should the lead evaluate first to enforce privacy and risk limits?

The correct control covers all three goals because content exclusion keeps the sensitive repository from informing Copilot suggestions, organization policies and seat assignment limit which users and repositories can use Copilot Business, and audit log review provides traceability for policy and usage changes. Restricting the repository to private visibility with team-based permissions supports least privilege but fails for Copilot governance because authorized users would still trigger suggestions grounded in emails and purchase history. Managing seats and reviewing usage dashboards supports adoption and cost control but fails privacy and auditability because it tracks entitlement without excluding sensitive content or reviewing security events. Streaming audit logs to a SIEM with retention supports detection of data access but fails prevention because it monitors after exposure without limiting Copilot processing or access. An exam caveat is to favor the preventive privacy-enforcing control over general hygiene or detective monitoring when customer data and Copilot scope are in the stem. As a practical check, confirm excluded repositories, allowed teams and Copilot policy events in organization settings and audit logs before expanding seats.