Microsoft AB-731 - AI Transformation Leader

Preventing generative AI from accessing confidential or classified information is primarily a data access and classification control problem. The most effective broad solution is data governance (B)—the framework of policies and controls that ensures sensitive content is identified, classified, protected, and access is restricted using least privilege. Data governance includes information classification/sensitivity labels, access control reviews, secure sharing practices, data loss prevention (DLP), and auditing—controls that directly limit what data is available to the AI through permission trimming and policy enforcement.

An information barrier (A) policy is more specific: it’s intended to prevent communication and collaboration between defined user groups (often for regulatory/ethical walls). It does not comprehensively address document classification or restrict AI access to sensitive files across the tenant. A data retention policy (C) governs how long content is kept and when it’s deleted; it’s not a primary access-prevention mechanism. Communication monitoring (D) is a detection/oversight control; it can help identify risky activity, but it does not itself prevent access to confidential content by the AI.

Therefore, to prevent AI from surfacing confidential/classified data during summarization and analysis, you should recommend data governance as the primary control layer.

For a user to access organizational data from a mobile device, the user needs a Microsoft 365 Copilot license. No

To reason over your organizational data by using Microsoft Graph, you need a Microsoft 365 Copilot license. Yes

To use the Analyst agent, you need a Microsoft 365 Copilot license. Yes

Top of Form

Bottom of Form

The key distinction here is between Copilot Chat capabilities available with a standard Microsoft 365 subscription and the full Microsoft 365 Copilot add-on that enables richer, in-context experiences grounded in organizational data.

Mobile access to organizational data does not inherently require a Microsoft 365 Copilot license. Microsoft’s Microsoft 365 Copilot app (and related mobile experiences) can provide Copilot Chat for work/school accounts with a Microsoft 365 license, so simply accessing organizational content on a mobile device is not the same as having the paid Copilot add-on. The statement claims a Copilot license is required just to access org data from mobile, which is too broad—there are mobile Microsoft 365 apps that access org data without the Copilot add-on.

Reasoning over organizational data via Microsoft Graph is a core value proposition of Microsoft 365 Copilot. Microsoft documents explain that Microsoft 365 Copilot connects LLMs to your organization’s content and context through Microsoft Graph and generates responses “anchored” in organizational data. That deeper integration is tied to the Microsoft 365 Copilot experience (an add-on license).

Analyst is a “reasoning agent” within Microsoft 365 Copilot and Microsoft states that users with a Microsoft 365 Copilot license can use Analyst (with defined usage limits). Therefore, the Analyst agent requires the Microsoft 365 Copilot license.

The correct selections are Yes, No, Yes. Prompt engineering is the practice of designing clear and effective inputs that guide a generative AI model toward relevant, accurate, and useful output. Guidelines, constraints, role instructions, tone requirements, and output-format rules are all common prompt-engineering techniques, so statement A is true. Statement B is false because examples are normally considered examples or few-shot demonstrations, not the instruction itself. The instruction tells the model what task to perform, while examples demonstrate the preferred pattern or output style. Statement C is true because context supplies the background information, source material, business scenario, audience, or constraints the model should use when generating the answer. Strong prompts usually combine instruction, context, constraints, and examples.

The correct answers are A and E. A governance program should include a formal process to review AI initiatives for responsible AI alignment. This ensures that projects are assessed for fairness, privacy, security, reliability, transparency, accountability, and business risk before deployment and during operation. Defining accountability norms across business and technical teams is also essential because responsible AI cannot be owned only by engineers or data scientists. Business owners, legal, compliance, security, privacy, and technical teams must understand who approves AI use cases, who monitors outcomes, and who responds when issues occur. Letting departments use separate governance methods creates inconsistency. Focusing only on regulated or sensitive-data systems is too narrow.

create a Microsoft Word document.

Microsoft 365 Copilot is a productivity-focused AI capability embedded across Microsoft 365 apps such as Word, Excel, PowerPoint, Outlook, and Teams. A core, common use case is drafting and generating documents in Word from prompts and existing context. Therefore, “create a Microsoft Word document” is the best completion.

The other options are not appropriate for Microsoft 365 Copilot’s scope. “Monitor network traffic and alerts in real time” is a security/operations function more aligned to security monitoring tools and, in Microsoft’s product set, closer to Microsoft Security Copilot or dedicated SIEM/SOAR platforms (for example, Microsoft Sentinel). “Modify administrative permissions for SharePoint files” is an admin/governance action that is intentionally protected by role-based access control and is not something end-user Copilot features are meant to perform as a default capability. “Create a list in Microsoft SharePoint” is closer, because Copilot can assist in generating content and can work within Microsoft 365 collaboration contexts; however, the most universally accurate and directly supported capability among the options is creating/drafting a Word document, which is a primary Copilot scenario in Word.

In short, Microsoft 365 Copilot is designed to help users create, summarize, rewrite, and transform content within Microsoft 365 apps, and document creation in Word is a canonical example of that value.

The correct selections are Yes, Yes, Yes. Lack of trust is a common AI adoption barrier because users and leaders may worry about security, privacy, hallucinations, inaccurate outputs, and unclear accountability. If people do not trust the system, they will avoid using it or over-escalate decisions outside the intended workflow. AI adoption also fails when organizations overlook high-quality data. Poor, outdated, incomplete, or poorly governed data weakens grounding, reduces output quality, and damages user confidence. Finally, adoption is strongest when business and compliance stakeholders are involved early. Business stakeholders ensure the solution solves real problems and delivers measurable value, while compliance, legal, risk, and privacy teams ensure the solution aligns with policy and regulatory obligations.

ï‚· Extract information from invoices and credit notes: Azure Document Intelligence in Foundry Tools

ï‚· Identify discussion topics in customer service call recordings: Azure AI Search

ï‚· Detect customer sentiment and opinions: Azure AI Search

To minimize development time, you should select services that provide prebuilt extraction and enrichment rather than building custom models.

For invoices and credit notes, the best fit is Azure Document Intelligence because it is purpose-built for intelligent document processing and includes prebuilt models (such as invoice-style extraction) that return structured fields (invoice number, vendor, totals, dates, line items). This directly satisfies “extract information” from financial documents without custom ML training.

For customer service call recordings, the raw input is audio, but the task is to identify “discussion topics,” which is an information discovery and text-enrichment problem once the calls are transcribed. Azure AI Search is the correct recommendation because it can index large collections of content and apply built-in AI enrichment (for example, key phrase extraction and entity extraction) to help derive and query “topics” across many records.

For sentiment and opinions, Azure AI Search is again the best choice in this constrained list because it can run built-in enrichment skills over ingested text (such as transcripts or notes) to annotate content with sentiment-related metadata and then make that enriched data searchable and filterable at scale. This approach delivers fast time-to-value: ingest → enrich → index → query, without standing up a custom training pipeline.

Enterprise AI adoption succeeds when it is cross-functional from the start. Option A is best practice because AI impacts legal risk, privacy, security, compliance, workforce processes, and business strategy—not just technology. Including leadership ensures alignment to priorities and funding; including business units ensures use cases and success metrics are real; including legal/compliance ensures responsible AI and regulatory obligations are addressed early. This prevents rework and reduces the chance of deploying solutions that are misaligned with policy or unacceptable risk.

Options B and C delay governance and business alignment, which often leads to “build first, govern later” failure modes—solutions that work technically but cannot be approved or scaled due to privacy/security gaps or unclear accountability. Option D over-optimizes for vendor selection without ensuring the organization has defined responsible AI requirements, target use cases, and operating model. Procurement is important, but it is not the primary driver of a successful adoption team. The most sustainable approach is a representative adoption team that integrates business, technical, and governance stakeholders from day one.