A consultant is deploying Copilot's next-best-action recommendations for a sales team at a healthcare equipment distributor. Compliance requires that any recommendation a seller acts on be traceable to information already stored in the organization's Dataverse records, not to content Copilot may have retrieved from the public web. Which configuration should the consultant apply?

The correct configuration is to restrict Copilot's grounding sources to Dataverse and connected first-party data, disabling web content grounding for next-best-action suggestions. The compliance requirement is that every recommendation must trace back to information the organization already holds in Dataverse, so grounding must be limited to first-party data sources and web content grounding must be turned off for this feature. That configuration satisfies the traceability requirement while preserving the value of AI-generated recommendations. Enabling Copilot's full web search grounding is incorrect because it does the opposite of what compliance requires, deliberately pulling in ungoverned web content that cannot be traced to internal records. Configuring next-best-action to run only after a seller manually enters a research summary from external sources is incorrect because it adds a manual research step without actually restricting where Copilot's own grounding pulls from, so the underlying traceability gap is not closed and sellers gain extra work for no compliance benefit. Turning off next-best-action recommendations entirely and relying on manual account reviews is incorrect because it eliminates a useful capability entirely when a narrower, supported configuration change achieves the same compliance outcome without losing the feature. The consultant's job is to match the tool's grounding settings to the regulatory constraint, not to add manual workarounds or remove the capability outright.