Adventure Works is publishing an internal HR Copilot Studio agent to employees. The agent must identify the signed-in user so it can personalize leave balances and must not allow anonymous public access. Which authentication approach should they configure for end users?

Copilot Studio supports authentication options including No authentication and Microsoft Entra ID (Azure AD). Internal line-of-business agents that need user identity for personalization and delegated connector calls should use Entra ID authentication. The correct approach is to authenticate with Microsoft Entra ID so only organizational users can sign in, and use the authenticated user identity in topics and connectors that support user context. Entra ID restricts access to organizational identities and provides a user token/context the agent can use for personalized data access patterns where connectors support user authentication. Leaving authentication set to No authentication and relying on Teams channel membership alone is wrong because No authentication allows scenarios where the agent does not establish a verified user identity for secure personalization, and channel membership alone is not a substitute for agent authentication configuration when identity is required for data access. Requiring each user to type an API key at the start of every conversation as a Question node answer is wrong because conversational API keys are poor UX, hard to rotate, and not the Entra-based enterprise model for employee agents. Using only a single shared service account username/password embedded in the agent's system prompt is wrong because embedding shared credentials in prompts is a severe security anti-pattern and does not provide per-user identity. Exam tip: Internal employee agents should use Entra ID authentication; public FAQ bots may use no authentication with carefully limited knowledge and no sensitive actions.