MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your company is implementing Microsoft 365 Copilot for Microsoft 365. You need to ensure that Copilot can access data from across the organization, but only for users who have the appropriate permissions. What is the primary security boundary for Copilot data access?
⚠ Common exam trap
MS-102 often tests the misconception that Copilot requires a new security group or that Purview labels alone define access — the correct answer is that Copilot inherits existing Microsoft 365 permissions and sensitivity labels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft 365 permissions and sensitivity labels
Microsoft 365 Copilot respects the existing Microsoft 365 permissions and sensitivity labels as its primary security boundary. Copilot only surfaces data that the signed-in user already has permission to access, and sensitivity labels govern how that data can be used or shared. This means Copilot inherits the tenant's existing security model rather than introducing a separate one.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft 365 permissions and sensitivity labels
Why this is correct
Copilot honours the signed-in user's existing Microsoft 365 permissions and sensitivity labels, so it only surfaces content that user can already access. This permission-trimming model is the primary boundary, ensuring no oversharing occurs beyond each user's granted entitlements.
- ✗
A dedicated Copilot security group in Microsoft Entra ID
Why it's wrong here
A dedicated Entra ID group controls Copilot licensing and feature rollout, not data access; Copilot honours each user's existing SharePoint, Exchange and Teams permissions. It is tempting for staged deployment, but the security boundary remains the permissions already assigned to the signed-in user.
- ✗
Microsoft Purview Information Protection labels
Why it's wrong here
Purview Information Protection labels classify and encrypt content, but they do not define which users Copilot queries; oversharing still exposes unlabelled files. Labels are correct for sensitivity-driven encryption and DLP, whereas Copilot's boundary is the user's existing Microsoft 365 permissions.
- ✗
The geographic location of the data
Why it's wrong here
Geographic location governs data residency and compliance boundaries, not which users Copilot may query. It is tempting because residency matters for regulatory scoping, but Copilot's access is filtered by each user's existing Microsoft 365 permissions, not by datacentre region.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Security Posture Improvement
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Copilot for Microsoft 365
Copilot for Microsoft 365 is an AI assistant integrated into Microsoft 365 apps that helps users create documents, analyze data, summarize communications, and automate tasks using natural language prompts.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.