AB-731 Sample Questions Answers

uses reasoning capabilities to generate deep insights based on organizational data and the web.

The sentence is best completed by the option describing Researcher as a research-oriented reasoning agent that combines information from the web and your work data to produce deeper insights. Microsoft describes Researcher as an agent built into Microsoft 365 Copilot to tackle complex, multistep research and to help users gather, analyze, and summarize information from “the web, your work documents, or both,” producing a structured output that supports decision-making. That is exactly what the completion “uses reasoning capabilities to generate deep insights based on organizational data and the web” captures.

The other dropdown options are better matches for different tools/agents: “creates visual dashboards from structured data in Excel and Power BI” is more aligned to BI/reporting workflows; “generates a pivot table and performs time series forecasting” is spreadsheet/analytics functionality; and “performs complex, multi-step, data analysis and code execution tasks over arbitrary datasets” is the hallmark positioning of the Analyst agent (“virtual data scientist”) rather than Researcher. Researcher’s differentiator is deep research across both organizational context and the open web, while Analyst’s differentiator is data analysis and computation.

The correct answer is B. Retrieval Augmented Generation (RAG). The requirement is to answer questions based on the content of internal business reports. RAG is the correct architecture because it retrieves relevant information from trusted internal documents at runtime and supplies that information as grounding context to the generative AI model. This allows the agent to generate answers that are more accurate, current, and relevant to the organization’s own content without retraining the model. Azure Machine Learning is mainly used for training and deploying predictive models. A Generative Adversarial Network is typically associated with synthetic content generation, especially images, and is not the right fit for document-grounded Q & A. Natural language processing is too broad; RAG is the specific recommended pattern.

Answer Area

Protect personal information and apply strong safeguards to keep data secure. Answer: Privacy and security

Make AI solutions understandable by explaining how and why decisions are made. Answer: Transparency

Design AI solutions that are accessible to people of all abilities and experiences. Answer: Inclusiveness

Involve human oversight in the control of AI solutions. Answer: Accountability

Microsoft’s Responsible AI principles provide a practical framework for building and deploying trustworthy AI systems.

Privacy and security is the principle focused on protecting personal information and ensuring strong safeguards—such as least privilege access, encryption, DLP controls, secure storage, and auditing—so data remains protected throughout collection, processing, and usage.

Transparency is about making AI systems understandable. This includes communicating when AI is being used, explaining system capabilities and limitations, and providing clarity on how outputs are produced (for example, what data sources are used, what assumptions apply, and why certain recommendations are generated). Transparency reduces confusion and helps users calibrate trust appropriately.

Inclusiveness ensures AI solutions are designed to benefit people of diverse abilities, backgrounds, and experiences. Practically, this includes accessibility (assistive technologies, readable outputs), inclusive UX design, and testing across diverse user groups so the solution does not exclude or disadvantage certain populations.

Accountability emphasizes that humans and organizations remain responsible for AI outcomes. Involving human oversight is a direct expression of accountability: setting governance, defining who owns decisions, establishing escalation paths, and ensuring there are controls for review, intervention, and correction when AI outputs are unsafe or incorrect.

Answer Area

A manufacturer can use Azure Vision in Foundry Tools to identify product defects on an assembly line. Answer: Yes

A logistics company can use Azure Vision in Foundry Tools to recognize package shipping labels. Answer: Yes

The HR department at your company can only use Azure Vision in Foundry Tools to extract written content from Microsoft Word files. Answer: No

Azure Vision in Foundry Tools provides computer vision capabilities to analyze images, including identifying visual features and reading text with OCR. Because it is designed to “analyze images” and support vision scenarios, it can be applied to manufacturing quality inspection use cases where the goal is to detect anomalies/defects from images captured on a production line. This aligns with statement 1 being Yes.

Statement 2 is also Yes because recognizing shipping labels is fundamentally text extraction from images (often plus some layout/field parsing). Azure Vision supports optical character recognition (OCR) to read printed text from images, and Microsoft documentation explicitly notes OCR can extract text from images such as product labels and similar real-world text surfaces—making shipping labels a direct fit.

Statement 3 is No because it is incorrectly restrictive. Azure Vision is not limited to extracting written content from Word documents, nor is OCR restricted to Word files. Vision capabilities apply broadly to images (and, depending on the capability, various document/image inputs) for tasks like image analysis and text recognition. HR could use it for many scenarios such as extracting text from scanned images, photos, or other visual inputs—not “only” Word files.

Responsible AI is fundamentally about earning and maintaining trust while scaling AI across the enterprise. Option C is the best answer because responsible AI practices (fairness, reliability and safety, privacy and security, transparency, accountability, and inclusiveness) reduce reputational, legal, and operational risk and make adoption sustainable over time. When stakeholders trust that AI is governed, tested, and monitored, the organization can expand AI usage confidently across business units.

The other options are incorrect because they make absolute or counterproductive claims. A is false: responsible AI does not “guarantee” accuracy; it reduces risk and improves assurance, but no model can be guaranteed correct in all contexts. B is the opposite of reality: responsible AI increases the importance of data protection and governance; it does not reduce the need for them. D is also incorrect: responsible AI requires clear ownership and oversight, especially from leadership, because accountability is a core principle. In short, responsible AI matters because it builds stakeholder confidence and provides guardrails that support long-term, scalable, and compliant AI adoption—exactly what executives care about when investing in an AI portfolio.

model inaccuracy

The scenario describes a model producing plausible-sounding content that is factually wrong—a common generative AI failure mode often referred to as a “hallucination.” Since “hallucination” is not offered in the dropdown, the best matching choice is model inaccuracy because the core problem is that the model’s output is incorrect even though it appears confident and coherent.

The other options do not fit the definition of the behavior: data leakage is about sensitive information being exposed (for example, proprietary prompts, secrets, or personal data). Prompt injection is an attack technique where a user tries to override system instructions or cause unsafe actions. Overreliance describes a human/organizational risk —trusting the model too much—rather than the model’s intrinsic behavior of generating incorrect facts. Overreliance can be a consequence of this behavior, but it is not what the behavior itself is called.

In practice, you mitigate this kind of inaccuracy by grounding responses in trusted sources (for example, RAG), constraining prompts with explicit requirements, using verification steps (citations, cross-checking, tool-based validation), and adding human review for high-impact use cases.

Answer Area

A generative AI model guarantees factually accurate responses if the model is trained on a large dataset. Answer: No

Content filtering and responsible AI safeguards help a generative AI model generate safe and inoffensive content. Answer: Yes

A generative AI model always produces fair and unbiased results when the training data has been properly prepared and reviewed for fairness. Answer: No

No — A larger training dataset can improve coverage and fluency, but it does not guarantee factual accuracy. Generative models can still hallucinate, mix concepts, or produce plausible-but-incorrect statements because they generate likely text rather than verifying truth. This is why solution designs commonly add grounding/retrieval, validation, and human review for high-stakes outputs.

Yes — Content filtering and Responsible AI controls are specifically used to reduce harmful, unsafe, or policy-violating outputs. In practice, safeguards include input/output filters, safety classifiers, and governance controls that help enforce safety policies and minimize offensive content. These controls don’t make outputs “perfect,” but they materially reduce risk and are a standard part of production AI deployments.

No — Even with careful data preparation and fairness reviews, models can still produce biased outcomes due to residual bias in data, label/measurement issues, deployment context, and shifting real-world distributions. “Always fair and unbiased” is an absolute claim that is not achievable in real systems; fairness is managed through continuous evaluation, monitoring, and mitigations—not assumed as guaranteed.

The requirement is to analyze text and identify “people, locations, and companies” mentioned in news articles. This is a classic Named Entity Recognition (NER) / entity extraction scenario, which falls under natural language processing. Azure Language in Foundry Tools is the correct choice because it provides text analytics capabilities that detect and categorize entities in unstructured text—commonly including Person, Location, and Organization. This enables downstream experiences such as topic tagging, search filters (e.g., “all articles mentioning Company X”), trend dashboards (top people/places mentioned this week), and improved content discovery.

The other options do not match the requirement. Content Safety focuses on moderating harmful or policy-violating content (for example, hate, violence, self-harm, sexual content) and is not the primary tool for extracting named entities. Azure Vision is for analyzing images and performing OCR; it would only be relevant if the articles were images or scans, but the task here is entity extraction from text articles. Azure Speech is for speech-to-text, text-to-speech, and audio analysis; it would be used if your input were audio recordings rather than written articles.

Therefore, to identify key entities (people, locations, companies) from daily news article text, the best recommendation is Azure Language in Foundry Tools.

Answer Area

Retrieval Augmented Generation (RAG) architectures require that a large language model (LLM) be retrained on proprietary data. Answer: No

Retrieval-Augmented Generation (RAG) grounds a language model to produce more factual and context-relevant responses. Answer: Yes

Retrieval Augmented Generation (RAG) retrieves information from external knowledge sources at runtime instead of relying solely on the knowledge of a generative AI model. Answer: Yes

1) No — RAG does not require retraining or fine-tuning the base LLM on proprietary data. The defining idea of RAG is to keep the model as-is and instead supply it with relevant context retrieved from trusted sources at inference time. Fine-tuning can be optional for style or specialized behavior, but it is not a requirement for RAG.

2) Yes — RAG is a grounding approach. By retrieving authoritative passages (policies, manuals, product specs, internal knowledge bases) and injecting them into the prompt context, the model’s answer is constrained by evidence that is relevant to the user’s question. This improves factuality and domain relevance and helps reduce hallucinations.

3) Yes — RAG explicitly depends on runtime retrieval from external knowledge sources, such as indexed documents, databases, or enterprise repositories. The retrieval layer finds the best matching content for the query, and the generation layer uses that retrieved content to craft the response. This is why RAG is valuable when information changes frequently: you update the source documents/index rather than retraining the LLM.

Overall, RAG is best understood as an architecture pattern that combines search/retrieval + generation, improving accuracy and freshness without the cost and risk of retraining the underlying model each time the knowledge base changes.

Microsoft Copilot Studio is built for creating and managing custom agents that handle employee self-service and business process automation. The two capabilities that align directly to this purpose are D and E.

D is correct because Copilot Studio lets you build agents that connect to enterprise data and systems and then perform actions on behalf of users. This is the foundation for automation and self-service: the agent can answer questions using connected knowledge sources and can also trigger workflows (for example, submitting a request, creating a ticket, checking status, or updating records) through connectors and actions. These integrations allow the agent to move beyond “chat” into real operational outcomes, which is exactly what business process automation requires.

E is correct because Copilot Studio provides the controls needed to customize how an agent behaves and responds. This includes defining conversational topics/flows, setting instructions and guardrails, shaping tone and response style, configuring fallback behavior, and controlling how generative answers are produced (for example, using approved knowledge sources). Customization ensures the agent behaves consistently with company policies and provides reliable employee experiences.

The other choices represent different Microsoft products: A is aligned to security operations tooling (Security Copilot), B relates to information protection/governance (Purview), and C is a Microsoft 365 Copilot capability inside Word/PowerPoint rather than a Copilot Studio feature.

The correct answer is D. predicting customer retention. Azure Machine Learning is best suited for predictive analytics scenarios where historical data is used to train a model that predicts future outcomes. Customer retention prediction typically uses customer behavior, purchase history, engagement data, service interactions, churn signals, and account attributes to estimate whether a customer is likely to stay or leave. That is a classic machine learning use case. Generating marketing campaigns and summarizing customer service transcripts are generative AI or natural language processing tasks. Creating product descriptions from images is a multimodal or generative AI scenario. The wording “predicting” is the key indicator: when the business requirement is to forecast outcomes from patterns in data, Azure Machine Learning is the correct fit.

guide AI strategy, ensure responsible AI oversight, and promote alignment across business units.

A trustworthy AI program requires more than technical implementation; it requires enterprise governance: clear ownership, risk management, policy, and cross-functional coordination. An AI governance council’s primary role is to provide strategic direction and oversight so AI initiatives align with business goals while meeting Responsible/Trustworthy AI expectations (fairness, reliability and safety, privacy and security, transparency, accountability, and inclusiveness).

Therefore, the best completion is that the council should guide AI strategy, ensure responsible AI oversight, and promote alignment across business units. This captures why councils are created: to avoid siloed deployments, define guardrails and approval processes, standardize evaluation/monitoring practices, and coordinate stakeholders such as legal, compliance, security, data governance, HR, and business leadership. The council also helps prioritize use cases, establish policies for data use and access, set documentation requirements, and require ongoing monitoring and incident response for AI systems in production.

The other options are narrower operational responsibilities. Configuring and deploying models in Azure is typically owned by engineering/cloud teams. Day-to-day model training and labeling is handled by data science/ML teams. The council sits above those activities to ensure the organization’s AI work is consistent, accountable, and strategically aligned.

improves the accuracy and reliability of the predictions and outputs of AI.

High-quality grounding data improves a generative AI solution by anchoring responses to trusted, relevant, and up-to-date information, which increases the likelihood that outputs are accurate, consistent, and aligned with the organization’s expectations. This is why the best completion is “improves the accuracy and reliability of the predictions and outputs of AI.” When the model is given authoritative context (for example, approved policy text, product specifications, knowledge base articles, or controlled enterprise content), it has less need to “guess” based on general patterns in its training data. That reduces hallucinations and improves response relevance to the user’s question and the business domain.

It does not “ensure that all responses are factually accurate” because grounding reduces errors but cannot eliminate them completely—retrieval can return incomplete or irrelevant passages, user prompts can be ambiguous, and the model can still misinterpret context. It also does not inherently “increase performance of an AI model” in the sense of speed/throughput or model capability; grounding is an architecture and data strategy that improves output quality, not compute efficiency. Finally, grounding is not about “increasing storage required to host an AI model.” While you may store documents in an index or repository, the core benefit is improved response quality through better context, not larger model hosting requirements.

Answer Area

Extracting structured data from forms and invoices: Answer: Azure Document Intelligence in Foundry Tools

Summarizing written content from business reports: Answer: Azure Language in Foundry Tools

Generating descriptive text for uploaded images: Answer: Azure Vision in Foundry Tools

These three tasks align to three different Azure AI capability families: document processing, language understanding/generation, and computer vision.

Forms and invoices are semi-structured documents where the business need is to extract specific fields (IDs, names, totals, dates) reliably into structured output. Azure Document Intelligence is designed for intelligent document processing and includes prebuilt models (such as invoices) as well as custom extraction options, making it the correct choice for structured data extraction from documents.

Summarizing written business reports is an NLP task focused on compressing long text into key points, themes, and action items. Azure Language provides language processing capabilities (including summarization features within language service capabilities), so it is the best fit for summarization scenarios.

Generating descriptive text for images (image captioning/description) is a computer vision task. Azure Vision can analyze uploaded images and return descriptions/captions and other visual insights, which directly matches the requirement to produce descriptive text from images.

By default, Microsoft 365 Copilot is grounded in your organization’s Microsoft 365 data through Microsoft Graph, and it respects the user’s existing permissions. For “find and summarize information across internal documents,” the most direct default document repositories in Microsoft 365 are SharePoint (team sites and shared libraries) and OneDrive (a user’s work files). That is why C (Microsoft SharePoint) and D (Microsoft OneDrive) are the correct selections. Microsoft explicitly describes Copilot as accessing organizational content via Microsoft Graph, including user documents and related work content.

The other options are not “by default” sources. A (on-premises file share) is not automatically part of Microsoft Graph unless you integrate/migrate content or use connectors to make it discoverable in Microsoft 365 experiences. B (custom CRM) similarly requires an integration approach (for example, Microsoft 365 Copilot connectors / Graph connectors) to index and expose that data for Copilot to use. E (Microsoft Sway) is not a primary default content source for Copilot’s document grounding and is not typically referenced as a core internal document repository compared to SharePoint/OneDrive.

So, for immediate, out-of-the-box internal document discovery and summarization within Microsoft 365, SharePoint + OneDrive are the default answer.

This scenario is a clear violation of the fairness principle. Fairness in Microsoft’s Responsible AI framework is about ensuring AI systems do not create unjustified bias or discriminatory outcomes—especially when decisions affect people’s access to opportunities such as credit, employment, housing, or education. A rule or learned behavior that rejects all applicants over a certain age creates a systematic, categorical disadvantage for a protected demographic group and indicates a discriminatory decision boundary rather than an individualized assessment of creditworthiness.

Even if the model designers believed age correlates with risk, using a hard cutoff that rejects every applicant older than 60 is not an equitable approach. It suggests the model is either using age directly as a dominant feature or reflects biased training data/labels that encoded discriminatory outcomes. Fairness requires you to evaluate model outcomes across groups (for example, age brackets), measure disparate impact, and apply mitigations such as feature review (removing or constraining sensitive attributes), rebalancing training data, adjusting thresholds, or using fairness-aware training/evaluation methods. It also requires governance and review of high-stakes automated decisions.

The other principles are not the best match: transparency concerns explainability and user understanding, accountability concerns human oversight and ownership, and reliability and safety concerns consistent and safe operation. The core issue here is discriminatory treatment across an age group—fairness.

Most generative AI language model pricing is based on token consumption, which measures the amount of text processed by the model. Tokens are sub-word units used internally by language models (for example, parts of words, whole words, or punctuation). When you send a prompt, the model consumes input tokens (your prompt + any system instructions + retrieved grounding context). When it generates a response, it consumes output tokens (the generated completion). Costs typically scale with the total input + output tokens processed, which is why long prompts, large grounding passages, and lengthy responses increase spend. This also explains why prompt optimization, response length limits, caching, and careful grounding are common cost-control techniques in enterprise solutions.

By contrast, “documents” is too coarse (a document can be 1 page or 500 pages). “Requests” is not the primary unit for most LLM pricing models because request sizes vary dramatically. “Words” is not used because the model’s actual compute unit is tokens, and tokenization differs across languages and text patterns. Therefore, the most accurate completion is tokens.

Microsoft Foundry is positioned as a unified, enterprise-grade platform that helps organizations build, deploy, scale, and govern AI apps and agents—especially generative AI solutions that need to work with business context and internal data. That directly aligns with A: Foundry provides a scalable platform for developing and deploying generative AI solutions. Microsoft describes Foundry as an interoperable platform that makes it easier to build, deploy, and scale AI apps and agents, while also providing centralized security and governance features for organizations.

B is incorrect because Foundry does not remove model choice/configuration; in fact, it supports selecting among models and using tools/frameworks to build solutions. You still choose appropriate model(s), configure endpoints, and design grounding and safety controls.

C and D are not the best characterization of Foundry’s primary benefit. While Foundry offers “friendly interfaces,” Microsoft primarily positions it for developers, model builders, and enterprise AI operations—not as a low-code platform for business users (that role is more commonly filled by Copilot Studio/Power Platform).

Answer Area

Microsoft Copilot in Outlook can automatically send follow-up replies to emails. Answer: No

Microsoft Copilot in Outlook can identify and surface tasks mentioned in your emails. Answer: Yes

Microsoft Copilot in Outlook can summarize long email threads and highlight action items and deadlines. Answer: Yes

1) No — Copilot in Outlook can draft email responses and help you take actions, but sending messages is not positioned as an automatic “follow-up reply” behavior. Microsoft describes capabilities such as “Draft with Copilot” (generating email drafts from prompts) and Copilot chat actions that update the mailbox, which implies user-directed execution rather than autonomous follow-up sending.

2) Yes — Copilot supports contextual help over your inbox and can help you “catch up” and understand what’s due, which includes surfacing action-oriented items from recent communications. This aligns with using Copilot to pull together summaries of email messages and identify what requires attention.

3) Yes — Microsoft explicitly documents email-thread summarization in Outlook: Copilot scans a conversation and produces a summary of key points. Microsoft also describes Copilot’s summarization capability as extracting key points from threads, which is commonly used to surface what matters most (including actions to take) when the thread is long.

Construction blueprints in PDFs often contain a mix of text, symbols, linework, and diagrams. The requirements include understanding both visual layout (where systems are located) and textual annotations, producing summaries, and answering Q & A. That combination requires a multimodal generative AI approach—models that can reason over images and text together. Therefore, A is best.

OCR alone (B) can extract printed text, but it won’t reliably interpret diagram geometry, symbols, or spatial relationships (e.g., “electrical riser is on the east core near gridline B-4”). Text completion (C) is too generic and doesn’t address image understanding. Document summarization (D) is only one requirement (summary) and still depends on first extracting/understanding both visual and textual elements.

A multimodal solution can ingest the PDF pages as images (or rendered page images) plus extracted text, then answer questions grounded in both modalities. In practice, you may combine OCR and layout extraction with a multimodal LLM so the model can reference drawing regions, legends, callouts, and system diagrams to produce accurate explanations and field extractions.

For a proof of concept, the key requirements are low commitment, quick start, and the ability to scale up or down as you learn what real usage looks like. Azure OpenAI Standard On-Demand pricing is designed for exactly that: you pay per token consumed (input and output) on a pay-as-you-go basis, which makes it ideal when demand is uncertain or variable—typical in early pilots and PoCs.

By contrast, Provisioned (PTUs) is best when you have well-defined, predictable throughput and latency requirements—usually a more mature, production workload. PTUs involve reserving model processing capacity to achieve consistent performance and more predictable costs, which is usually premature for a PoC where actual traffic patterns are not yet known.

Batch API is optimized for asynchronous high-volume jobs with a target turnaround (for example, up to 24 hours) and discounted pricing. That’s great for offline processing, but it does not match an interactive “agent” PoC that typically needs near-real-time responses and iterative testing.

Microsoft 365 Copilot is a separate SaaS licensing model and is not the Azure OpenAI pricing model for building your own agent solution.

Answer Area

Larger datasets can increase the cost of a generative AI solution that uses an Azure Machine Learning workspace. Answer: Yes

The cost of consuming Azure OpenAI models is primarily identified by the number of input and output tokens processed. Answer: Yes

The cost of custom generative AI solutions always remains the same regardless of the model version or capability used. Answer: No

Yes — In Azure Machine Learning, cost is driven by the resources you consume to store, process, and train. Larger datasets typically require more storage, more data transfer, and more compute time for preprocessing, training, evaluation, and experimentation. Even if you are not training foundation models, handling larger corpora can increase pipeline duration and the number/size of compute instances used, which increases overall cost.

Yes — For Azure OpenAI usage under Standard (on-demand), pricing is primarily tied to token-based consumption (input tokens + output tokens). The more context you send and the longer the generated responses, the more tokens you consume, and the higher the cost. This is why prompt optimization, response length controls, and grounding strategies matter for cost management.

No — Costs vary with model choice and capability. Different model families and versions have different price points, and larger/more capable models generally cost more per token or per unit of throughput. Additionally, architecture choices (RAG, vector search, caching), usage patterns, and throughput requirements can significantly change total cost—so it is never “always the same.”

Azure Machine Learning

Forecasting product demand from historical sales data is a predictive analytics / machine learning use case. It typically requires selecting an appropriate forecasting approach (for example, regression, tree-based methods, or time-series models), preparing and splitting historical data, training and validating the model, tuning hyperparameters, and then deploying the model for ongoing inference. The Microsoft service designed to support that end-to-end ML lifecycle is Azure Machine Learning, which is why it correctly completes the sentence.

Azure Machine Learning provides the tooling and infrastructure to: manage datasets, run training jobs on scalable compute, track experiments, compare model performance, register models, and operationalize them through managed endpoints and pipelines. This makes it well-suited for iterative forecasting work, where you may retrain on new data regularly, monitor drift, and update models as product lines, promotions, or seasonality patterns change.

The other options do not directly fit “train a model” for forecasting. Azure AI Search is an indexing/retrieval service used to search and ground generative AI responses, not for training predictive models. Azure OpenAI provides access to large language and multimodal models for generative tasks (drafting, summarizing, Q & A) and is not the primary platform for building classical forecasting models. Microsoft Foundry is a broader platform experience for building and governing AI apps and agents, but the specific service for training a forecasting model on historical sales data is Azure Machine Learning.

Answer Area

Microsoft 365 Copilot helps users create and analyze content in Microsoft 365 apps. Answer: Yes

Microsoft Copilot Studio can only be used to customize Microsoft 365 Copilot. Answer: No

Microsoft Security Copilot uses AI to assign sensitivity labels to documents. Answer: No

Yes — Microsoft 365 Copilot is built into Microsoft 365 apps (such as Word, Excel, PowerPoint, Outlook, and Teams) to help users draft, summarize, rewrite, and analyze work content. This includes creating documents and presentations, summarizing emails and meetings, and analyzing information in productivity workflows. That is its primary value proposition, so the statement is true.

No — Copilot Studio is not limited to customizing Microsoft 365 Copilot. It is used to build and manage agents (conversational experiences) and extend Copilot experiences by connecting to data and actions, creating custom topics/behaviors, and integrating business processes. While it can be used to extend Microsoft 365 Copilot (for example, via declarative agents and other extensibility paths), it is broader than “only customizing Microsoft 365 Copilot,” so the statement is false.

No — Assigning sensitivity labels to documents is primarily a Microsoft Purview Information Protection capability (manual labeling, default labeling, auto-labeling) rather than a core function of Microsoft Security Copilot. Security Copilot is focused on security operations (incident investigation, threat hunting, response guidance). Although AI can support security workflows, the specific act of assigning sensitivity labels to documents is not what Security Copilot is designed to do by default, making the statement false.

When AI adoption spans multiple business units, the primary risk is fragmented delivery: inconsistent standards, duplicated spend, uneven risk controls, and misalignment with enterprise strategy. Establishing an AI council (D) is the best approach because it creates a cross-functional governance mechanism that aligns AI initiatives to business priorities while enforcing Responsible AI practices consistently.

An AI council typically includes senior stakeholders from business leadership, IT, security, legal, compliance, privacy, data, and HR. Its role is to define AI principles and guardrails, approve high-impact use cases, set policy for data usage and access, establish evaluation and monitoring requirements, and coordinate change management and training. This also enables portfolio management—deciding which projects to prioritize, reuse, or stop—so AI investments map to measurable business outcomes.

The other options are weaker: A encourages siloed deployments and inconsistent risk management. B centralizes too narrowly in IT; Responsible AI requires broader accountability than a single function. C can help delivery capacity but does not replace internal governance; vendors still need direction, controls, and oversight from the organization.