Pacific Airlines wants to add a Copilot Studio agent to their public booking website. Most visitors are anonymous (not logged in) and should be able to ask flight schedule questions without signing in. Only a small subset of interactions (like retrieving a booking) require the user to authenticate. Which configuration approach is correct?

## Why C is Correct Copilot Studio's Custom authentication option includes a setting to require authentication only for specific actions rather than at session start. For topics that access protected data (like booking records), an authentication card is shown at that point in the conversation. General-purpose topics (flight schedules, FAQs) continue to work anonymously. This balances user experience with security.

## Why the Distractors Are Wrong A (Separate agent for bookings): Two separate agents create a fragmented user experience. Users would need to switch agents mid-conversation, losing context. It also doubles the maintenance burden.

B (Entra ID with guest bypass): The 'Authenticate with Microsoft' option is designed for internal (Microsoft identity) users. It does not support external loyalty/airline account IdPs and its guest bypass is limited in scope.

D (Require account for all questions): Requiring mandatory authentication for anonymous FAQ queries would severely reduce the agent's usefulness and likely increase support call volume — the opposite of the business goal.

## Exam Tip For public-facing agents: No authentication = fully anonymous (no access to user-specific data at all). Custom with 'only when needed' = mixed anonymous + authenticated in the same agent. Full authentication required = all interactions require login.