Farouk is deploying a Copilot Studio agent at Westbrook Consulting that uses a Copilot connector to search the user's Outlook email for client-related messages. During testing, Farouk notices that when a consultant first interacts with the agent and asks about client emails, the agent responds with an error instead of email results. The connector is correctly configured in the agent. What is the most likely cause, and what must happen for the agent to successfully access the consultant's email?

Copilot connectors that access user-owned data — such as Outlook email, OneDrive files, or Teams messages — operate under the Microsoft identity platform's delegated permission model. The connector must be authorized by the individual user (or by an administrator on their behalf) before it can access their data.

Option D is correct and captures both resolution paths. The standard path is the per-user consent flow: the first time a consultant interacts with the email-searching agent feature, a consent prompt appears in the agent's chat interface asking the user to sign in and approve the connector's requested Microsoft Graph permissions (e.g., Mail.Read, Mail.ReadBasic). Once the user consents, the connector stores the authorization token and can access their mailbox on subsequent interactions without prompting again.

The admin pre-consent path is also valid: an Entra ID Global Administrator can grant tenant-wide admin consent in the Entra ID portal for the connector's application permissions, eliminating the per-user consent prompt entirely. This is common in enterprise deployments where prompting every user is impractical.

Option A is incorrect because there is no 'Copilot Connector Standard' license product. Copilot connectors are included with Copilot Studio licensing — no separate connector license is required for standard connectors.

Option B is partially correct in that it describes the user consent flow, but it omits the admin pre-consent alternative, making it less complete than option D. The key distinction is that option D explicitly names the permission level (Mail.Read) and both resolution methods.

Option C is incorrect because Outlook Copilot connectors access individual user mailboxes using delegated authentication — they are not designed around shared service accounts. A service account approach would require a custom connector or application permission model, not a Copilot connector.

Exam tip: Whenever an AB-620 question mentions a connector that accesses personal data (email, calendar, files) and describes a first-use error, the answer involves user consent or admin consent — not licensing, not service accounts.