Contoso invites vendor guest users in Teams and wants them to use an internal Copilot Studio agent that reads confidential HR policies from SharePoint. What is the primary risk if guests are granted agent access without redesign?
Select an answer to reveal the explanation.
Short Explanation
Guests can wander into the wrong door if the agent’s knowledge and auth aren’t scoped. Confidential HR policies aren’t vendor reading material, so you need tight boundaries.
Full Explanation
Least privilege must align channel access, agent authentication, and knowledge permissions. Guests may gain conversational access beyond their boundary if those are not tightly scoped. Guests do not automatically receive Global Administrator rights by messaging an agent. Teams does not block all Copilot Studio agents whenever a guest exists. SharePoint knowledge does not become read-only for employees when a guest is added to a Team. Exam tip: For guests, prefer separate agents, limited knowledge, and explicit auth design.