Microsoft Designing and Building Integrated AI Agent Solutions in Copilot Studio (AB-620)

Stop additional failed executions while troubleshooting.

✅ Disable the flow

Reasoning: Disabling (or turning off) a cloud flow is the standard, non-destructive method to prevent it from being triggered. This action effectively pauses the flow, stopping new runs from starting while you investigate and resolve the temporary authentication issue.

Process a failed execution after resolving the authentication issue.

✅ Resubmit the run

Reasoning: After fixing the authentication problem, the 'Resubmit' action on a failed run instance re-executes the flow using the original trigger data. This allows you to process the specific failed transaction without requiring a new trigger event from the copilot agent.

Validate if the most recent executions succeeded immediately after resolution.

✅ Review the Activity history

Reasoning: The run history page for a flow provides a detailed log of all executions, including their start time, duration, and status (Succeeded, Failed). This is the most direct and effective way to verify that the fix is working and that new flow runs are completing successfully.

Reference: https://learn.microsoft.com/en-us/power-automate/manage-cloud-flows

✅ Option A (Correct)

Reasoning: Configuring 'run after' conditions for failure paths in a Power Automate flow (often used within Copilot Studio agents) directly addresses both requirements. When an action fails or times out, subsequent actions configured with 'has failed' or 'has timed out' conditions will execute. This prevents silent termination. Within these failure paths, specific actions can be added to retrieve error details and send notifications (e.g., email, Teams message), thus fulfilling the notification requirement.

Evaluation Interpretation

This hotspot question requires matching the description of an evaluation result with the logical conclusion drawn from that result when testing a Copilot Studio agent.

Row 1: Evaluation case meeting or missing expected response.

✅ **Pass or fail status**

Reasoning: The statement that a test case is either "meeting or missing" the expected response is the fundamental definition of a binary outcome. In testing, this directly translates to the pass or fail status of that specific test case.

Row 2: Some evaluation cases fail repeatedly.

✅ **Prompt revisions**

Reasoning: When specific test cases fail consistently across multiple runs, it indicates a systematic issue rather than a random error. This points to a flaw in the agent's configuration for those scenarios, most commonly the prompts, topic triggers, or generative AI instructions, which require revision to correct the behavior.

Row 3: Each run displays expected response and agent response.

✅ **Root cause of failures**

Reasoning: The side-by-side comparison of the expected response versus the agent's actual generated response provides the necessary detail for debugging. By analyzing the differences, a developer can diagnose exactly why the agent failed, thereby determining the root cause of the failure.

Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/nlu-authoring-evaluation

The solution 'Send a notification with relevant error details' only addresses the output requirement (sending a notification). It does not, by itself, ensure that the agent 'must not terminate silently' or that failures are handled in a 'controlled and predictable way'. To meet these requirements, the agent flow must incorporate robust error handling mechanisms (e.g., try-catch blocks, specific error conditions) to actively detect and manage failures, preventing silent termination, before a notification can even be triggered. Therefore, the solution is incomplete.

Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/nlu-system-fallback#system-topic-for-error-handling

Solution Lifecycle Strategy

This question assesses knowledge of Application Lifecycle Management (ALM) concepts within the Power Platform, which applies directly to Copilot Studio agents.

✅ Allow ongoing development: Unmanaged solution

Reasoning: Development environments use unmanaged solutions. They are considered the 'source' and are open for modification, allowing developers to add, configure, and delete components like copilots, topics, and flows. This directly supports the requirement for ongoing development.

✅ Prevent modification in production: Managed solution

Reasoning: To lock down an environment like production, you import solutions as 'managed'. Managed solutions cannot be directly edited. This prevents accidental or unapproved changes, ensuring the stability and integrity of the production environment. Any changes must originate from a new version of the solution from the development environment.

✅ Export from development and import into production in deployment-ready state: Managed solution

Reasoning: The 'deployment-ready state' refers to the packaged solution file that is moved between environments. When exporting from the development environment, the unmanaged solution is exported *as* a managed solution. This managed solution package is the final, distributable artifact that gets imported into production. 

Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/alm-export-import-bots-solutions

The solution meets the goal. Configuring a custom prompt at the topic level allows you to dictate the response format (e.g., executive summary) specifically for that topic, without affecting others. Custom prompts work in conjunction with configured knowledge sources, meaning the generative answers node will still use its defined data sources to retrieve information. Furthermore, custom prompts do not override or bypass existing connector security controls; these are enforced independently.

Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/nlu-generative-custom-prompt

• ✅ Option A (Correct): The case study specifies 'Travel Advisory Content: Uses REST API with partner services' and 'Knowledge sources must be used for unstructured content.' Microsoft Graph connectors are designed to ingest data from external repositories, making that content discoverable and usable by Microsoft Search and, consequently, by Copilot Studio's generative answers as an external knowledge source. This provides a scalable method for integrating partner content.
• ✅ Option D (Correct): The case study identifies 'Customer Support Knowledge Base: SharePoint library with PDFs and policy documents' and states 'Knowledge sources must be used for unstructured content.' Directly adding these internal policy documents as a knowledge source in Copilot Studio allows the agent to leverage generative answers for questions related to these documents, adhering to the requirement for scalable knowledge integration without manual Q&A.

• ❌ Option B is incorrect: The business requirements explicitly state that the agent 'must not rely on manually authored Q&A topics for each document,' which directly contradicts this option.
• ❌ Option C is incorrect: The technical requirements emphasize 'Responsible AI content moderation filters must be enabled' and 'Generative responses must be constrained to avoid policy violations.' Enabling unrestricted web search would violate these constraints by introducing unpredictable and unmoderated external information.

✅ Option C (Correct)Reasoning: The case study explicitly states, "For shipment tracking inquiries, Fabrikam Inc. will delegate to a partner-provided agent that is only available through a standardized agent-to-agent endpoint." An A2A (Agent-to-Agent) integration is the designated mechanism in Copilot Studio for connecting to and delegating tasks to external agents via their specific endpoints.❌ Why the other choices are incorrect:

• Option A is incorrect: The partner provides an agent for delegation, not a knowledge source for indexed retrieval.
• Option B is incorrect: MCP tools are for direct transactional operations or data access, not for delegating to another intelligent agent through an A2A endpoint.
• Option D is incorrect: The requirement is to delegate to a partner-provided agent, not to handle the inquiry with generative responses directly from the primary agent.

Correct Authentication Model Mapping:

The authentication model for each scenario is determined by the type of user and the data being accessed, as defined in the case study's requirements.

✅ Step 1: "Allow anonymous access." matches with -> "A customer asks, 'What is the baggage allowance for international flights?'"

Reasoning: The case study specifies under "Identity and access" that "Anonymous access for general inquiries (e.g., flight status, baggage policy)" is allowed. This question is a general policy inquiry and does not require access to personal data.

✅ Step 2: "Require customer sign-in using an account." matches with -> "A customer asks, 'Can I review my upcoming trips?'"

Reasoning: Reviewing upcoming trips involves accessing personal data related to bookings. The case study requirements state, "Authentication is required for personal data access (e.g., bookings, loyalty points)." Therefore, the customer must sign in.

✅ Step 3: "Require internal agent sign-in using Microsoft Entra ID." matches with -> "An internal support agent accesses the Copilot agent from Microsoft Teams to look up a loyalty member's profile."

Reasoning: This scenario involves an internal employee using the agent on the designated internal channel (Microsoft Teams). The case study explicitly dictates, "Internal staff: Authenticate via Microsoft Entra ID."

The option "Use agent author credentials" is incorrect because the technical requirements explicitly forbid this practice: "User identity must be used for data access; shared or builder credentials must not be used."

Reference: https://learn.microsoft.com/en-us/microsoft-copilot-studio/configuration-end-user-authentication

• ✅ Option A is correct: The technical requirements explicitly state, "Prompt modifications must be added to enforce tone, disclaimers, and refusal behavior," and that "Disclaimers must be applied consistently across all generative responses. Manual edits to individual topics must be avoided." This mandates a system-level configuration for consistency and compliance.
• ✅ Option D is correct: The compliance and security requirements clearly state, "Power Platform DLP policies must be enforced to block unauthorized data flows." This is a critical prerequisite for data protection before deployment.
• ☒ Option B is incorrect: The technical requirements specifically state that "Manual edits to individual topics must be avoided" for applying disclaimers, promoting system-level consistency instead.
• ☒ Option C is incorrect: Responsible AI content moderation and prompt modifications are typically configured at the copilot level, not solely reliant on channel-specific settings, to ensure consistent enforcement across all channels.
• ☒ Option E is incorrect: Responsible AI filters and prompt modifications are foundational to the copilot's behavior and should be configured and enabled at the copilot level *before* publishing to channels, not individually per channel after publishing.