Your Copilot Studio agent is deployed on both the public company website (unauthenticated) and the internal Microsoft Teams channel (authenticated). From a security governance perspective, which statement correctly describes a key difference in what these two deployments should be allowed to do?
Select an answer to reveal the explanation.
Short Explanation and Infographic
An authenticated channel knows who it's talking to — it can unlock the filing cabinet. An unauthenticated channel is talking to a stranger at the front desk — it should only hand over the public brochure. These two personas need different permission scopes in your governance model.
Full explanation below image
Full Explanation
Copilot Studio allows you to publish agents to multiple channels simultaneously. Authenticated channels (Teams, SharePoint internal, custom with SSO) have a verified user identity, which enables the agent to access user-specific data, trigger actions on behalf of that user, and retrieve documents the user is authorized to see (via delegated authentication to SharePoint, for example).
Unauthenticated channels (public website widget, demo environments) have no identity context. From a governance perspective, these should be configured to access only publicly available information — public knowledge bases, FAQ content, generic company information. They should not have access to SharePoint libraries with sensitive content, user-specific records, or sensitive APIs.
Option A is a critical misconception — unauthenticated channels should have less access, not more, precisely because there's no identity verification.
Option C (identical permissions) is wrong — the governance best practice is to scope each channel's access appropriately to its authentication context.
Option D (unauthenticated channels auto-apply DLP) is incorrect — DLP policies apply to connector usage regardless of channel authentication, but DLP does not make unauthenticated access as secure as authenticated.
Exam governance principle: authentication context determines data access scope. Configure knowledge sources, API actions, and connector permissions per channel based on the authentication model of that channel.