Nordic Biotech's compliance team has determined that employees must not use AI tools that reference external internet sources when working with proprietary research data. The Microsoft 365 admin needs to ensure that Microsoft 365 Copilot Chat does not use web content to generate responses for any user in the tenant. What is the correct configuration step?
Select an answer to reveal the explanation.
Short Explanation
You need to disable web search for Copilot in Microsoft 365 admin center. That switch keeps Copilot inside your tenant's data instead of reaching out to web content. It's the clean, admin-controlled way to meet this compliance rule, no firewall hacks needed.
Full Explanation
Microsoft 365 admin center > Settings > Copilot (or the Copilot section) provides a dedicated web search control that governs whether Copilot Chat and other Copilot experiences can pull in public web content via Bing when generating responses. Disabling this setting is the correct, Microsoft-supported mechanism to restrict Copilot to tenant-internal data only, satisfying data sovereignty and compliance requirements.
The Purview communication compliance policy that flags responses containing URLs from external websites is incorrect because communication compliance policies in Purview monitor and flag content after the fact — they don't prevent Copilot from using web data to generate responses. This is a detective control, not a preventive one.
The Conditional Access policy that blocks users from accessing Bing.com while signed into Microsoft 365 is incorrect because blocking Bing.com with Conditional Access would disrupt Bing search for users in their browsers too, creating unintended side effects. Conditional Access policies also don't specifically target Copilot's internal service-to-service calls.
The network firewall rule that blocks outbound HTTPS traffic to Bing API endpoints from corporate devices is incorrect because Copilot's Bing integration happens at the Microsoft 365 service level, not directly from client devices. Firewall rules at the corporate perimeter would not intercept cloud-to-cloud service calls made by the Copilot backend on Microsoft's infrastructure. This approach would also be operationally complex and unreliable.
Exam tip: Know the exact location of the web search toggle: Microsoft 365 admin center > Settings > Copilot. The exam distinguishes between controls that block behavior at the SERVICE level (correct) versus controls that try to block it at network or compliance monitoring levels (incorrect for this use case).