Adventure Works is publishing an internal HR Copilot Studio agent to employees. The agent must identify the signed-in user so it can personalize leave balances and must not allow anonymous public access. Which authentication approach should they configure for end users?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Entra ID is the front door badge for internal agents — employees sign in with their work identity, the agent knows who they are, and random internet strangers stay outside. Shared passwords or API keys typed in chat are not enterprise auth.
Full explanation below image
Full Explanation
Copilot Studio supports authentication options including No authentication and Microsoft Entra ID (Azure AD). Internal line-of-business agents that need user identity for personalization and delegated connector calls should use Entra ID authentication.
Option A is correct. Entra ID restricts access to organizational identities and provides a user token/context the agent can use for personalized data access patterns (where connectors support user authentication).
Option B is wrong because No authentication allows scenarios where the agent does not establish a verified user identity for secure personalization; channel membership alone is not a substitute for agent authentication configuration when identity is required for data access.
Option C is wrong because conversational API keys are poor UX, hard to rotate, and not the Entra-based enterprise model for employee agents.
Option D is wrong because embedding shared credentials in prompts is a severe security anti-pattern and does not provide per-user identity.
Exam tip: Internal employee agents → Entra ID auth; public FAQ bots may use no auth with carefully limited knowledge and no sensitive actions.