Microsoft Copilot Studio Guidebook
Microsoft Copilot Studio Guidebook
Microsoft Copilot
A Dynamics
Communities
GUIDEBOOK
Aaron Back
Microsoft Business Applications MVP
Analyst At Large
Property of [Link]
2 Back to Contents
Property of [Link]
So, here’s what you can expect to learn throughout this guidebook:
Lastly, keep this guidebook handy as you reimagine what’s possible with the most disruptive
technology in the universe.
Aaron Back
3 Back to Contents
Property of [Link]
Contents
Reimagining What’s Possible with the Most
Disruptive Technology
Page 02
-By Aaron Back
4 Back to Contents
Property of [Link]
How To Get
Started with
Microsoft Copilot
Studio
By Aaron Back
Analyst At Large
Implementing any new application or solution within your organization is a feat that shouldn’t be taken
lightly – no matter the size! The ripple effect of a poorly designed or planned application will be felt
across teams that are directly and indirectly using it. That’s why the Microsoft Copilot Studio is no
exception, and since this is an AI-powered solution, there are bound to be areas of ambiguity that you
will need to address.
So, before you dive into Copilot Studio to try it out or implement a solution, let’s cover the basics to
ensure you are equipped.
According to the Microsoft Learn site, “Microsoft Copilot Studio lets you create powerful AI-powered
copilots for a range of requests—from providing simple answers to common questions to resolving
issues requiring complex conversations. Engage with customers and employees in multiple languages
across websites, mobile apps, Facebook, Microsoft Teams, or any channel supported by the Azure Bot
Framework.”
5 Back to Contents
Property of [Link]
I would strongly recommend creating a Center of Excellence (CoE) that will allow your users to ask
questions, share concerns, provide feedback, and represent their area(s) of the company.
Microsoft has provided a Center of Excellence Kit to make this process easier.
Security
Security by default and zero trust should be the mindset of every organization. Yours included! Part of
this mindset means that “every kind of access is blocked by default, and explicit permission must be
granted for each kind of access to each data element in each situation.”
Accompanying this mindset should be a Security Development Lifecycle (SDL) and a Trust Center.
The SDL is a “set of practices that support security assurance and compliance requirements. The SDL
helps developers build more secure software by reducing the number and severity of vulnerabilities in
software, while reducing development cost.“
The Trust Center, established by Microsoft, is a way to provide transparency around data. Specifically,
the company has noted that:
6 Back to Contents
Property of [Link]
sure you have purchased what you need, understand the limits, define a process to work within the
limits, and reduce the risk of costly overruns.
Again, the Copilot Studio has default quotas built in which Microsoft states the purpose is to “throttle
the client’s service load, which protects a service from being overloaded and the client from unexpected
resource usage.”
Note
The quota with a paid plan includes 800 RPM per Dataverse environment and is defined
as “Messages to a chatbot.” This includes any message from a user or integrations,
such as Azure Bot Framework skills, to a single chatbot.
7 Back to Contents
Property of [Link]
Key Concepts
A final item worth noting is that the Power Virtual Agents (PVA) capabilities are now part of Microsoft
Copilot Studio. As part of this shift, there are different concepts that need to be addressed within your
organization to ensure everyone understands the correct terminology and definitions when designing
solutions.
For example, within the PVA Composer, the concept that was once called “Intents” is now called “Trigger
phrases,” and “Actions and prompts” are now called “Nodes” within Copilot Studio.
Final Thoughts
Yes, Microsoft Copilot Studio is the “new kid on the block,” but it is already creating major shifts and
disruptions in how people create solutions to augment human ingenuity. By establishing the foundation
now, you can be ready for the adaptability and flexibility needed for an AI-powered future.
8 Back to Contents
Property of [Link]
By Aaron Back
Analyst At Large
In November 2023, Microsoft Copilot Studio was announced and brought a new way of creating AI-
powered, intelligent, and interactive copilots to streamline work and assist people daily.
So, how do you get started with Copilot Studio? To answer that, I would highly recommend a few things:
Note
The Copilot I am referring to is the Copilot Studio solution. Microsoft offers multiple
Copilots such as Dynamics 365 Copilot, Microsoft Copilot (previously Bing Chat), and
Microsoft Copilot Studio Mobile (Android or Apple).
Pricing
If are you looking to jump into using Copilot Studio, you will need to purchase it. As of December 2023,
Microsoft Copilot Studio (standalone) has a starting price of $200 per month per tenant for 25,000
messages. Copilot Studio is included in the $30 user license for customizing Copilot for Microsoft 365/
Dynamics 365.
9 Back to Contents
Property of [Link]
Note
For a detailed outline of the Dynamics 365 Copilot pricing, I would
recommend reviewing the full licensing guide here: [Link]
fwlink/?LinkId=866544&usg=AOvVaw31TJQMIji481LIHcfzy3Qw Licensing
Once the Copilot Solution has been purchased, you will need to be granted access to it. Per the Microsoft
documentation, access can be granted by following these steps:
• Go to the Microsoft 365 admin center and sign in with your Admin account.
• On the side pane, expand the Users menu, and then select Active users.
• Select a name, and then select Manage product licenses.
• On the flyout pane, select the check box next to Power Virtual Agent user license, and then select
Save changes.
Note
You can simplify license assignment by using a Microsoft Entra ID security
group. Check here for more details.
Creating
Now we get to the fun part – creating a Copilot! After you have been granted the correct access, you can
go to either:
• [Link]
◊ I would suggest using this one as the one below will likely be deprecated at some
point, in my opinion.
• [Link]
10 Back to Contents
Property of [Link]
On the left-hand side, you will see the home screen menu. Please note that several of the options are
currently in preview.
11 Back to Contents
Property of [Link]
An important thing to note is that the home screen will (typically) be located within the Default
environment. However, you can toggle to other available environments of your choice IF you have the
security access to do so.
Note
I would highly recommend creating your Copilot within a Sandbox environment and NOT
within the Production or Default environments. If you do not see a Sandbox environment
or have access to one, please contact your system administrator.
Creating A Copilot
For this post’s purpose, I will focus on the Copilots area of Copilot studio. I will cover the other options
at a later date.
12 Back to Contents
Property of [Link]
After you select the Copilots option, you will see a screen like what you see below. Please note that the
Copilots shown have been set up within the Sandbox environment.
Click on the “New copilot” button at the top to start the creation process.
You might see this screen while the initial creation process is happening.
13 Back to Contents
Property of [Link]
14 Back to Contents
Property of [Link]
Along the left side, to the right of the menu, the Copilot chat panel is displayed. This is where you can
test your setup, see the generative AI responses, and more.
15 Back to Contents
Property of [Link]
Generative AI Area
The next area to note is the Generative AI area. This is where you can do several things:
16 Back to Contents
Property of [Link]
17 Back to Contents
Property of [Link]
Note
I would highly recommend reviewing this section and the linked details about data flow
and responsible AI to ensure this complies with your company’s data and AI governance
policies.
18 Back to Contents
Property of [Link]
• Create Topics
◊ According to Microsoft documentation, “a topic represents some portion of a
conversational thread between a user and a copilot.”
19 Back to Contents
Property of [Link]
20 Back to Contents
Property of [Link]
21 Back to Contents
Property of [Link]
Note
For this post, I will focus briefly on creating and editing a Topic. I will cover Plugins
and Actions later.
Creating a Topic
You can create a Topic from two different methods.
• From blank – this means you start from scratch and need to define all the steps.
• From a description – this means AI will assist you in creating the topic.
First, I chose the “Create from description” option so that the AI assistant could help me get started. I
named it “Copilot Content – Dynamics 365, Microsoft 365, System Administration” and described the
intent of the copilot.
22 Back to Contents
Property of [Link]
23 Back to Contents
Property of [Link]
24 Back to Contents
Property of [Link]
25 Back to Contents
Property of [Link]
Note
After reviewing this, editing, or adding additional steps, be sure to save your work!
Let’s test the topic that was just created by using the Chat panel and see what the output is.
26 Back to Contents
Property of [Link]
As you can see, the response contained the text and links from the Message step. The links are clickable
and will direct the user to the appropriate sites.
If you would like to use the “from blank” option to create a Topic, you can do this but will need to create
and update each step. You can achieve the same outcome, but it will mean additional work on your part.
Closing Thoughts
Yes, there is a LOT more to cover with Copilot Studio, but I wanted to help you get started easily so
that the process doesn’t seem overwhelming. What I’m finding is that the innovation you can create
with Copilot is awesome! With that in mind, I would love to hear from you about what you created, the
challenges you were presented with, and how you used Copilot to deliver helpful outcomes. Even better,
if you could share what DIDN’T work and what DID work, that would be very beneficial to this community.
27 Back to Contents
Property of [Link]
Security and
Microsoft Copilot –
What You Need
to Know
By Aaron Back
Analyst At Large
In the article above I outlined how to get started with Microsoft Copilot Studio and shared a few areas
to focus on – one of which is security. Building on this, I wanted to expand on the security premise and
offer two ways to view Copilot and security.
For many companies, that person is you. However, you may not have been trained or certified in various
cybersecurity protocols, mitigating risk, or providing remediation should a breach occur. Yes, these
seem like foreign concepts to some, but are the bread and butter of others. Even then, there are a few
things to consider as part of your system administration.
28 Back to Contents
Property of [Link]
Microsoft introduced its Microsoft Security Copilot to help with navigating security challenges.
The solution provides a natural language, assistive copilot experience that helps support security
professionals in end-to-end scenarios such as incident response, threat hunting, intelligence gathering,
and posture management.
29 Back to Contents
Property of [Link]
Further, it can swiftly summarize information about an incident by enhancing the details with context
from data sources, assessing its impact, and guiding analysts on how to take remediation steps with
guided suggestions.
What’s nice about this is that if you are asked for a summarization of what happened, it can generate
ready-to-share executive reports on security investigations, publicly disclosed vulnerabilities, or threat
actors and their campaigns
Closing Thoughts
While there is the buzz around Microsoft Copilot, keep in mind that this is still an AI solution at the core.
So, it’s important to recognize the benefits and risks when using an AI-powered solution.
Additionally, it’s important to note that geographical locations around the world have unique (and
sometimes very strict) rules for AI and data governance that should be complied with, such as GDPR
and the European Union (EU) Data Boundary.
Note
One last thing: How confident are you that your AI and data are secure within
your company’s ecosystem?
30 Back to Contents
Property of [Link]
By Aaron Back
Analyst At Large
According to McKinsey, prompt engineering for artificial intelligence is described as “The practice of
designing inputs for generative AI tools that will produce optimal outputs.”
This is an important aspect of understanding generative AI in the context of Microsoft Copilot. Why?
Building the best prompt is important so that you get the correct results without which you could
potentially make incorrect decisions, such as “avoid common pitfalls by learning what to do and what
not to do.”
Microsoft described prompts as this, “Prompts are how you ask Microsoft 365 Copilot to do something
for you — like creating, summarizing, editing, or transforming. Think about prompting like having a
conversation, using plain but clear language, and providing context like you would with an assistant.“
So, what are the best ways to create an effective prompt and what are the things to avoid?
31 Back to Contents
Property of [Link]
• Goal
o This is how you specify what you want Copilot to generate. Think about what type of
content you are looking for such as a summary, bulleted list, or overview.
• Context
o This is how you specify why you need it and who it is for. For example, is this for a meeting,
a sales presentation, or a customer demo? Further, is this in the context of a marketing
manager, a sales director, or a CFO?
• Source
o This is how you specify which data or information you need to reference – basically, the
location of the data. For example, should the prompt look at emails, images, documents,
data on public sites, or data within your ecosystem?
32 Back to Contents
Property of [Link]
• Expectations
o This is how you specify how Copilot should respond. Meaning, should Copilot respond with
simple language, technical details, a story, a poem, or other types of output?
Closing Thoughts
Rethinking Prompts
In his article called “The Art of the Prompt“, Jake Siegel shares a quote from Jennifer Marsman, principal
engineer in Microsoft’s Office of the Chief Technology Officer, to describe how we as users should think
about AI prompts.
“I compare it to the early days of search engines — there was an art to choosing the right keywords to
get good results and, over time, both the users and the search engine got better at understanding each
other,” she said. “This is the same paradigm. Over time, both we as users and the machine learning
models will understand each other better.”
Fact-checking Prompts
A post from ChatAI provides great advice on ensuring the information returned from Copilot (or any
generative AI solution) is factual:
33 Back to Contents
Property of [Link]
• I would suggest using Microsoft Copilot only after it has been securely configured to run within
your company’s data estate.
• If you are unsure of any of the above helpful tips, collaborate with your internal technical/IT team
and share what you are looking to do, how you plan to test the solutions, and what the future
goals are.
34 Back to Contents
Property of [Link]
By Aaron Back
Analyst At Large
Let’s take a step back and walk through a few basic principles to ensure you are headed on the right
path when it comes to AI and Microsoft Copilot.
Why?
It’s great to be excited about new technology, the potential it could bring, and how it could join people
together to foster creativity. While this is all well and good, it’s often difficult to be an end-user where
you are used to specific functionality and processes that have made your work more productive.
However, it’s important to rethink how technology can be an enabler which often requires reworking
processes, changing collaboration, and learning new skills along the way.
So, what does that mean in the context of your everyday tasks for work?
35 Back to Contents
Property of [Link]
Imagine a personal assistant, not just one who manages your schedule and errands, but one who
anticipates your needs before they arise. This assistant learns your preferences, habits, and goals,
constantly adapting to optimize your life. It effortlessly handles repetitive tasks, freeing your time and
energy for creativity and personal growth.
This is how you could view Microsoft Copilot – as an AI assistant. Not just a tool but a partner evolving
alongside you, leveraging its vast knowledge and processing power to augment your capabilities. For
example, think about having a research assistant who can sift through mountains of data to present
you with the most relevant insights; or maybe a personal chef who can analyze your dietary needs and
preferences to create a personalized meal plan.
Yes, they are like copilots (pun intended), constantly monitoring the situation and offering valuable
suggestions while ultimately leaving the final say in our hands as pilots.
If you had an assistant and expected them to help you, but you lacked the skills to effectively communicate,
share ideas, or provide new information, do you think the assistant would be very helpful?
This is (partially) why AI skills need to be learned and continuously improved upon. As you improve
your skillset and how you interact with Copilot, you will increase the quality of the output and how it can
assist you.
Knowing this, here are a few skills that should be learned and honed to achieve the best results:
36 Back to Contents
Property of [Link]
• Digital Literacy
o Data-Driven Decision Making
• Since you are inundated with data, it’s crucial to be able to analyze and interpret it
effectively. This includes understanding data visualization tools, querying databases,
and applying statistical analysis to draw insights. By leveraging data, you can make
informed decisions, identify trends and opportunities, and optimize their strategies.
o Technology Adaptability
• The pace of technological change means you need to be comfortable learning and
adapting to new technologies, like AI or Microsoft Copilot. This includes staying up to
date on emerging trends, understanding the capabilities of different platforms and tools,
and exploring new ways to leverage technology to improve efficiency and productivity.
37 Back to Contents
Property of [Link]
• Soft Skills
o Critical Thinking and Problem-Solving
• With increasing complexity and uncertainty in the business environment, critical
thinking and problem-solving skills will be crucial for tackling challenges and finding
solutions. This includes the ability to analyze situations, identify root causes, develop
creative solutions, and think strategically.
• By developing these skills, you can improve your AI/Copilot prompt engineering inputs
for the best outputs.
• Combine this with continuous learning and technology adaptability, and you have a
recipe for success.
Closing Thoughts
Of course, Copilot can help business users automate repetitive tasks, reduce errors, and improve
efficiency. However, the technology is only as good as the people using it and learning to adapt.
38 Back to Contents
Property of [Link]
Microsoft Copilot
is Creating a
New Type of
Manager
By Aaron Back
Analyst At Large
The constant pressure on business leaders to be adaptable to changing work environments is never-
ending. Not only are employee expectations different than they were, say, 5-10 years ago, but new
technologies force leaders to adjust how they manage.
These pressures are emphasized by the findings in Microsoft’s 2023 Work Index Annual Report.
According to the report, “There’s a new AI-employee alliance: While 49% of people say they’re worried
AI will replace their jobs, even more — 70% — would delegate as much work as possible to AI to lessen
their workloads.”
Leaders feel squeezed by employees needing consistency in their employment while simultaneously
striving toward meeting revenue and company goals, effectively making managing change an essential
skill.
39 Back to Contents
Property of [Link]
But what does it mean to think like a manager if you have never been one?
According to the article linked above, thinking like a manager has the following components:
• Breaking down work into smaller pieces
• Assigning work in a way that clearly defines expectations and provides the necessary context
and parameters
• Evaluating the work that comes in, reviewing it, and offering feedback
• Effectively moving forward with decisions and deliverables
Communication is the foundation of how things get done. This could mean person-to-person
communication, machine-to-machine communication, or person-to-machine communication. In
any case, how, when, and where something is communicated plays a huge role in the efficacy of the
outcomes.
I came across a great example from Chris Capossela, Microsoft’s Executive Vice President & Chief
Marketing Officer.
40 Back to Contents
Property of [Link]
“I like prompts that allow me to interrogate documents, like, what are the risks called
out in this document? Other prompts might be content-specific, like, what are
Company X’s strengths and weaknesses? These prompts save me time by letting me
Chris Capossela gather information quicker. I also like to ask a lot of questions through Bing Chat
Microsoft’s Executive Vice President Enterprise about publicly available data and ask to be shown the data in different
& Chief Marketing Officer
formats, like a table.”
Another example comes from Amy Coleman, Microsoft CVP, Human Resources & Corporate Functions.
Amy needs context that is HR-focused due to her role in the organization – much like you might need a
specific context that applies to your role. For Amy, she uses Copilot like this:
“Once a week, to keep myself informed and prepare for meetings with global HR
partners, I ask Copilot: What are the top challenges facing global HR organizations
this week in September 2023? What about in Australia, 2023? Are HR trends in the US
for September 2023 different than the HR trends in Germany for September 2023?
Amy Coleman Show me HR research across all of our global offices from the past three months,
Microsoft CVP, Human Resources
& Corporate Functions 2023. Who are the top voices talking about these challenges? It opens the door to
possibilities rather than simply coming to a conclusion.”
In Closing
How YOU communicate with Microsoft Copilot through your prompts will greatly impact the type of
output you get…and how much it will ultimately help you in your role.
Yes, you can purchase Copilot for Microsoft 365 or Dynamics 365 as an add-on, but it’s only as good
as the person using it. I would suggest diving into the Microsoft Copilot documentation, joining the MS
Copilot UG Community, and catching up on the MS Copilot UG Content so that you know how to rethink
the way you work and elevate your skills.
41 Back to Contents
Property of [Link]
Microsoft
Copilot
Considerations
for IT Pros
By Aaron Back
Analyst At Large
A technology professional in the context of Microsoft Business Applications can differ from one
company to another. For some in a small/mid-market business (SMB), a technology professional could
be someone who’s been handed the role of a Dynamics 365 or Power Platform Admin as they are tech-
savvy and understand the business – and you may be that person!
In a large-scale enterprise organization, a technology professional could be someone on a team that has
the responsibility of managing security (and only security) for the entire company and across multiple
geographies.
In both cases, some things need to be understood and managed when it comes to Microsoft Copilot from
the implementation to the licensing, from the security considerations to the configuration, and much
more. This post will outline just a few of the things you need to know and what you should conside
Note
Any references to technology requirements, standards, or needs are subject to
change by Microsoft. Please refer to Microsoft’s documentation for details.
Prerequisites
Before diving into your Copilot implementation, there are a few prerequisites that you should be aware
of. Further, these prerequisites are scattered across various Microsoft sites. So, I’ve assembled a few of
the key items you should be aware of before implementation.
42 Back to Contents
Property of [Link]
Additionally, in a blog post, Microsoft indicated that “your organization must meet some technical
requirements and have some features enabled. Copilot users must have either a Microsoft 365 E3 or
E5 license and an Azure Active Directory account, which gives them access to the Microsoft 365 apps
and services that work with Copilot including Word, Excel, PowerPoint, OneDrive, Outlook, Loop, and
more. Once available to your organization, your users will need to be on the Current Channel or Monthly
Enterprise Channel for Microsoft 365 apps to have access to Copilot in desktop clients.”
Enable Users
Once you have set up the proper license types and Azure Active Directory, you will need to select which
users will be allowed to use Copilot within your organization. However, I would suggest that you ask
these questions when considering your user setup.
• Based on the users’ roles, which Copilot should they have access to?
o Microsoft Copilot for Microsoft 365
o Microsoft Sales Copilot
o Microsoft Copilot for Service
o Microsoft Security Copilot
o Microsoft Copilot for Development
o Microsoft Copilot Studio
o Azure AI Studio
In summary, multiple Copilot options can allow you to set up the one that is right for specific users.
Further, I would suggest that users are not only trained (as indicated above) but understand the
purpose of Copilot and its intended use within your organization. By combining these elements, you can
personalize the internal training and help increase user adoption.
43 Back to Contents
Property of [Link]
First, most see security, privacy, and governance as a hindrance to new technology rollouts or adoption,
while others see them as enablers for long-term success. This means rethinking security as not just a
means to restrict, but by implementing the right policies, you and your organization can:
PROTECT
ASSETS
Protect internal data, IP,
DEBT
or other critical digital Reduce future
assets from being potentialtechnical
exposed to publicly debt.
accessible.
MITIGATE
USAGE RISKS
Mitigate potential INNOVATION
Provide safe usage
security risks (internal Foster innovation
of the Copilot/AI
applications. and external) that and creativity.
could be detrimental.
Second, all security decisions should be rooted in a zero-trust mindset. This mindset is based on
providing access when and where it’s needed, and no one can be trusted. This may seem contradictory
to my last point above, but one bad actor can cause irreparable harm.
However, there is a caveat that you should be aware of when you are implementing security policies.
Microsoft noted that there are occasions when your data could potentially leave service boundaries.
44 Back to Contents
Property of [Link]
“When using Microsoft Copilot for Microsoft 365, your organization’s data might leave the Microsoft
365 service boundary under the following circumstances:
• When you allow Microsoft Copilot for Microsoft 365 chat experiences to reference public web
content. The query sent to Bing might include your organization’s data. For more information, see
Microsoft Copilot for Microsoft 365 and public web content.
• When you’re using plugins to help Microsoft Copilot for Microsoft 365 to provide more relevant
information. Check the privacy statement and terms of use of the plugin to determine how it
will handle your organization’s data. For information, see Extensibility of Microsoft Copilot for
Microsoft 365.”
After digging a bit further, I found that you can control if Copilot can access the public web content or
not. However, the tradeoff is that the AI grounding may not provide the best outcomes as Copilot will not
continuously learn from public data, semantics, sentiment, and phrasing. This could result in a longer
“learning curve” if Copilot is solely based on internal data.
• Turn on Copilot with public web access for non-critical data locations to test the pros/cons.
• Reevaluate the degree of risk your company can take – Risk Appetite vs. Risk Tolerance.
Extended Copilot
Yes, you can be very creative working within the boundaries outlined above. However, many companies
need the option to extend Copilot to connect to custom-built apps and services or create custom
connections to SaaS apps that are not provided out of the box.
45 Back to Contents
Property of [Link]
Source: [Link]
According to Microsoft, “When you extend Copilot for Microsoft 365, you maximize the efficiency of your
apps and data with AI, by:
In short, the intent of this section is not to tell you how to extend Copilot. Rather, it’s intended to help
create awareness of certain things as you plan your extensibility. As such, here are a few things to
consider:
• Referencing the above image, I would recommend putting a security layer after the “External
data” steps. This means that the data hits your security policies/tools (whichever you use)
before the data goes into the Microsoft Graph Connect and/or the Plugin.
• Joining the “Microsoft 365 Developer Technology Adoption Program (TAP)” could
o Help you learn about upcoming features.
o Allow you to provide technical feedback.
o Connect with other like-minded developers.
46 Back to Contents
Property of [Link]
• Don’t extend Copilot just because you can. While extending a service or app might be easy for
you to do or your “go-to” method, consider other alternatives before you decide to go down the
extensibility path.
Closing Thoughts
While I covered only three areas in the post, these are critical considerations for every IT pro to dig
into when it comes to Copilot – no matter if you are a business applications system administrator, a
cybersecurity specialist/architect, or a professional developer.
Further, I would recommend closely collaborating with other business decision-makers to ensure
the configurations and policies that are implemented align with the company’s goals and objectives.
Especially when it comes to understanding the degree of risk that the company can tolerate.
• Join the MS Copilot User Group community to learn, share, and collaborate with many others as
they navigate their Copilot journey.
47 Back to Contents
Property of [Link]
48 Back to Contents