A financial services company must demonstrate to regulators that their Copilot Studio agent never provides investment advice and that all agent conversations are retained for seven years for audit purposes. The compliance team also requires that a human reviewer be notified immediately when the agent declines to answer a topic due to responsible AI policy. Which combination of Copilot Studio and Power Platform features satisfies all three compliance requirements?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Regulatory compliance for an AI agent is like running an airport — you need a black box recorder (Dataverse conversation transcripts), security screening that stops prohibited items (Content Moderation for investment advice), and an alert system that pages the tower when something is flagged (Power Automate on system topic events). All three tools exist natively in Copilot Studio and Power Platform without needing to wire up external Azure services. That's always the first answer to check when the exam says 'Copilot Studio compliance requirements.'
Full explanation below image
Full Explanation
Copilot Studio and Power Platform together provide native compliance and governance features that, when combined correctly, can satisfy regulatory requirements without requiring external Azure infrastructure.
Option C is correct because it uses three native platform features in combination. First, conversation transcripts saved to Dataverse provides the long-term retention store. Dataverse supports configurable data retention policies and is integrated with Microsoft Purview for enterprise compliance, meeting the seven-year retention requirement. Second, Content Moderation in Copilot Studio's AI capabilities can be configured to block responses that fall into prohibited categories — combined with topic-level guardrails, this prevents investment advice from being delivered. Third, Power Automate can be triggered by Copilot Studio's system topics (including 'Escalate to Agent' and content-blocked events), enabling real-time email notifications to the compliance team when a policy boundary is triggered.
Option A is incorrect because conversation transcripts are stored in Dataverse by default in Copilot Studio, not SharePoint. While SharePoint supports document retention, it is not the native store for Copilot Studio conversation transcripts. Keyword detection in a topic is also a brittle approach compared to Content Moderation — keywords can be easily circumvented by paraphrasing. Additionally, keyword-based escalation would trigger on user messages, not on agent responses, which is the wrong event for compliance purposes.
Option B is incorrect because Dataverse auditing logs changes to Dataverse table records, not conversation content. It is designed for tracking who created, updated, or deleted rows in a table — it is not a conversation transcript mechanism. The 'Escalate' system event approach in Power Automate is directionally correct but this option incorrectly uses Dataverse auditing instead of conversation transcripts as the retention mechanism.
Option D is incorrect because it relies entirely on external Azure services (Azure OpenAI, Blob Storage, Logic Apps, Azure Monitor) rather than Copilot Studio's native governance features. While technically implementable, this approach bypasses the platform-native capabilities, requires significant custom integration, and increases architectural complexity unnecessarily. The question asks what satisfies requirements using Copilot Studio and Power Platform features.
Exam tip: Copilot Studio compliance toolbox: (1) Conversation Transcripts to Dataverse for retention and audit, (2) Content Moderation for blocking policy-violating responses, (3) System Topics (Escalate, End of Conversation) as Power Automate triggers for notifications, (4) Microsoft Purview for data governance on top of Dataverse. Know these four and their roles.