Copilot vs Agents: When to Use Which

The core distinction

Side-by-side comparison

This is the comparison the exam tests most heavily. Know each row.

Copilot vs Agents — key differences

Feature	Copilot	Agents
How users interact	Direct, conversational — you type a prompt and get a response	Automated — triggered by events, schedules, or workflows
Where it lives	Inside M365 apps (Word, Excel, Outlook, Teams, Chat)	Copilot Chat, SharePoint sites, or background processes
Data access	Uses YOUR permissions via Microsoft Graph	Uses service accounts or managed identities — can access broader data
Customisation	Org-level configuration (admin settings, tuning)	Fully customisable — knowledge sources, connectors, workflows, logic
Best for	Drafting, summarising, analysing, brainstorming — interactive work	Automating processes, monitoring, reporting — repeatable tasks
Who creates it	Microsoft (built-in)	Microsoft (prebuilt), business users, or developers
Security model	User's own permissions (safe by default)	Needs careful permission scoping (least privilege is critical)

When to use Copilot

Copilot shines when you need real-time, interactive help within the apps you’re already using:

• ✍️ Draft a document — “Turn these bullet points into a professional report” (Word)
• 📊 Analyse data — “What’s the trend in Q3 sales?” (Excel)
• 📧 Summarise emails — “Summarise this 47-message thread in 3 bullets” (Outlook)
• 🎤 Catch up on meetings — “What did I miss in the last hour?” (Teams)
• 🔍 Cross-app search — “What’s the latest on Project Phoenix?” (Business Chat)

Pattern: The user is present, driving the conversation, and making the final decision.

When to use an agent

Agents shine when you need automated, repeatable workflows that run without constant human input:

• 📋 Process invoices — parse, validate, and route for approval automatically
• 📢 Answer common questions — “What’s our return policy?” from a SharePoint knowledge base
• 🔔 Monitor and alert — watch for security incidents and create tickets
• 📊 Generate reports — aggregate data nightly and post summaries to Teams
• 👋 Onboard new employees — assign tasks, send welcome emails, provision accounts

Pattern: The process is repeatable, the rules are clear, and humans review exceptions.

💡 Real-world scenario: Northwave picks the right tool

Northwave’s departments each have a different need. Here’s what Maya recommends:

Department	Need	Right Tool	Why
Marketing	”Help me draft social media posts”	Copilot (Word/Chat)	Interactive, creative, user-driven
Finance	”Auto-process 200 expense reports monthly”	Agent	Repeatable, rule-based, multi-step
HR	”New hires need to find company policies”	Agent (SharePoint)	Always available, no human needed
CEO	”Summarise this board pack for me”	Copilot (Word)	One-off, interactive, judgment needed
IT	”Alert me if a backup fails and run diagnostics”	Agent	Event-triggered, automated response

Exam tip: If the scenario involves a person sitting at their desk needing help RIGHT NOW → Copilot. If it involves a process that should run automatically → Agent.

Security: the critical difference

This is where the exam gets tricky. The security models are fundamentally different:

Copilot uses your permissions. It can only see what you can see. If Maya can’t access the Finance SharePoint site, Copilot can’t access it when Maya is using it. This is safe by default.

Agents use service accounts or managed identities. They can access data across teams or departments. This is powerful but risky — if you give an agent too many permissions, it could expose sensitive data.

⚠️ Best practices for agent security

The exam tests these governance principles:

1. Least privilege — only give agents the minimum permissions they need
2. Managed identities over shared passwords — more secure, auto-rotated
3. Approval steps for sensitive actions — don’t let agents make irreversible changes alone
4. Monitor activity — send agent logs to Azure Monitor or your SIEM
5. Test in sandbox first — never deploy an untested agent to production
6. Rotate credentials — set expiration dates on service account access

Exam tip: Questions about agent security almost always test whether you know to apply least privilege and require human approval for sensitive actions.

Common failure modes (exam loves these)

Failure	What Happens	Mitigation
Hallucinations	Copilot or agent generates inaccurate info	Include verification steps; human review for high-stakes outputs
Over-permissioned agents	Agent accesses data it shouldn’t	Scope permissions narrowly; use managed identities
Fragile UI automation	Agent breaks when app interface changes	Use API connections instead of UI automation
Credential sprawl	Too many service accounts, hard to track	Centralise in Azure Key Vault; set expiration dates

🎬 Video walkthrough

🎬 Video coming soon

Copilot vs Agents — AB-900 Module 23

Copilot vs Agents — AB-900 Module 23

~10 min

Flashcards

Question

What data does Copilot use, and whose permissions does it respect?

Click or press Enter to reveal answer

Answer

Copilot uses data from Microsoft 365 via Microsoft Graph, and it respects the signed-in user's own permissions. It can only see what you can see.

Click to flip back

Question

How is an agent's data access different from Copilot's?

Click or press Enter to reveal answer

Answer

Agents use service accounts or managed identities that can access broader data across teams or systems. They don't rely on an individual user's permissions — which is why least-privilege scoping is critical.

Click to flip back

💡 Show hint

Question

When should you recommend Copilot vs an agent?

Click or press Enter to reveal answer

Answer

Copilot: interactive, user-driven tasks (drafting, summarising, brainstorming — person is present). Agent: repeatable, automated workflows (processing, monitoring, reporting — runs on schedule/trigger).

Click to flip back

💡 Show hint

Knowledge Check

Knowledge Check

Clearfield Council needs to onboard 50 new hires each quarter. The process involves assigning tasks, sending welcome emails, provisioning accounts, and sharing orientation materials — all following the same repeatable steps. What should Director Chen recommend?

AUse Copilot in Outlook to draft individual welcome emails for each new hireBCreate an agent that automates the onboarding workflow — triggered when a new hire is addedCAsk HR staff to use Copilot Chat to generate onboarding checklists manually each timeDDeploy Microsoft Defender XDR — it handles all employee provisioning

Check Answer

Knowledge CheckSelect all that apply

Which TWO statements correctly describe the security differences between Copilot and agents? (Select 2)

ACopilot uses the signed-in user's permissions via Microsoft GraphBAgents always have full tenant-wide admin access by defaultCAgents use service accounts or managed identities that need careful permission scopingDCopilot requires separate security credentials configured by the admin

Check Answer

---

Next up: Copilot Licensing — the difference between monthly licenses, pay-as-you-go, and what’s free, and why admins need to understand the cost model.