A pharmaceutical company is deploying a Copilot Studio agent for external customer interactions. The company's AI governance policy requires that all agent responses be reviewed for safety before reaching customers, that any response flagged as potentially harmful be blocked and replaced with a predefined safe response, and that all flagged interactions be logged for compliance review. The solution must not require custom-built moderation code. Which Copilot Studio configuration combination satisfies all three governance requirements?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Building a custom content filter is like hiring a security guard, training them yourself, and writing all the rules from scratch — Copilot Studio's built-in Content Moderation setting is the professional security firm that already has the training and protocols built in. Enable it, set the safe fallback message, and flip on conversation transcripts to Dataverse for the audit trail. Three requirements, three built-in settings — no custom code needed.
Full explanation below image
Full Explanation
Copilot Studio includes built-in responsible AI features designed to address enterprise governance requirements without requiring custom moderation code. The question specifically excludes custom-built moderation solutions, which eliminates options that rely on external services or custom logic.
Option C is correct because Copilot Studio's Content Moderation feature (available in AI capabilities settings) uses the Azure AI Content Safety service under the hood, integrated natively into the agent's response pipeline. When enabled, it evaluates every generated response before delivery to the user. Responses flagged as potentially harmful are blocked and replaced with the administrator-configured safe message — satisfying the 'block and replace' requirement. Enabling conversation transcripts causes all conversation data, including flagged interactions, to be written to Dataverse automatically — satisfying the compliance logging requirement. All three governance requirements are met through platform-native settings.
Option A is incorrect because the profanity filter addresses only offensive language in user inputs, not safety evaluation of agent-generated responses. Keyword-based blocking in a fallback topic is a brittle approach that requires continuous maintenance of the keyword list and does not constitute a responsible AI content safety system. It also does not log flagged interactions to a compliance-ready store.
Option B is incorrect because routing responses through an Azure Logic App with custom moderation code violates the explicit requirement to avoid custom-built moderation code. This solution introduces external dependencies, adds response latency, and requires ongoing maintenance. SharePoint audit lists are also not purpose-built compliance logging stores for agent interactions.
Option D is incorrect for the same core reason as option B: deploying Azure AI Content Safety as a standalone service and connecting it via Power Automate constitutes custom-built moderation code. While technically functional, it directly violates the stated constraint. Additionally, storing flagged responses in Azure SQL requires a separate data pipeline that is not natively integrated with Copilot Studio's governance framework.
Exam tip: Copilot Studio's native responsible AI features include Content Moderation, conversation transcripts (written to Dataverse), and topic-level safety settings. When a governance question says 'without custom code,' the answer uses these built-in features. When logging for compliance is required, conversation transcripts to Dataverse is the native Copilot Studio answer.