PL-900 Practice Question: Demonstrate the capabilities of Microsoft Copilot Studio
A financial services company uses Microsoft Copilot Studio to build an internal copilot that answers questions about loan policies. The copilot must ensure that only employees in the loan department can access sensitive policy details. The company uses Microsoft Entra ID for authentication. What should the maker configure to enforce this access restriction?
⚠ Common exam trap
The trap here is believing that publishing to a specific channel or asking users to self-identify provides sufficient access control, when only authentication combined with security group restrictions enforces true authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable authentication for the copilot and configure the security group restriction in the copilot's security settings.
Enabling authentication in Microsoft Copilot Studio and configuring a security group restriction ties access to Microsoft Entra ID group membership. Only users in the specified loan department security group can interact with the copilot and access sensitive policy details. This provides a secure, manageable, and authoritative access control mechanism that aligns with the company's existing identity infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Publish the copilot only to the Microsoft Teams channel and rely on Teams membership for access control.
Why it's wrong here
Publishing to Teams makes the copilot available to Teams users, but Teams membership alone does not restrict access to a specific department. Many employees outside the loan department may use Teams. Without an explicit security group restriction, unauthorized users could still interact with the copilot. This option does not satisfy the requirement to limit access to loan department employees.
- ✗
Add a question node at the start of each topic that asks the user to type their department name.
Why it's wrong here
Asking users to self-identify their department does not enforce access control because anyone could type 'loan department' regardless of their actual role. This approach relies on the honor system and does not authenticate or authorize users. It fails to meet the security requirement of restricting sensitive content to loan department employees, so it is not a valid configuration.
- ✓
Enable authentication for the copilot and configure the security group restriction in the copilot's security settings.
Why this is correct
Microsoft Copilot Studio supports authentication and can restrict access to specific Microsoft Entra ID security groups. Enabling authentication ensures users sign in, and configuring the security group restriction limits access to loan department employees. This directly enforces the requirement that only authorized personnel can access sensitive policy details, making it the correct configuration.
- ✗
Use a condition node that checks the user's display name against a list of loan department employees.
Why it's wrong here
Condition nodes can evaluate variables, but comparing a display name against a static list is fragile and does not provide secure authentication. Display names can change, and the list would require manual maintenance. This approach does not leverage Microsoft Entra ID for authoritative access control and could allow unauthorized access if names are spoofed or misconfigured, so it is not the correct solution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PL-900 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This PL-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-900 exam.