Microsoft 365 Copilot and Agent Administration Fundamentals — knowledge map
The 60 core concepts of Microsoft 365 Copilot and Agent Administration Fundamentals and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (60)
Microsoft 365
A SaaS productivity suite delivering email, documents, and meetings in the cloud, used via per-user subscription.
Related: SaaS (Software as a Service)
Microsoft 365 licensing (per-user subscription)
License per user (seat), paid monthly/annually; plans include Business/Enterprise/Frontline; assign in the Microsoft 365 admin center. Differs from AWS/Azure pay-as-you-go.
Prerequisites: Consumption-based pricing
Related: Microsoft 365 admin center
Microsoft 365 Copilot
An AI assistant embedded in apps like Word, Excel, Outlook, and Teams. It operates only within data the user can already access and creates no new access. Requires a separate license.
Prerequisites: Microsoft 365 licensing (per-user subscription)、Office apps (Word/Excel/PowerPoint/Outlook)、Microsoft 365、Microsoft Teams
Copilot licensing and billing
Copilot offers a fixed monthly license and pay-as-you-go (PAYG, applied to uses like SharePoint agents) billed by usage; PAYG cost is managed via billing policies. Licenses are assigned to users/groups in the Microsoft 365 admin center.
Prerequisites: Microsoft 365 admin center、Consumption-based pricing、Microsoft 365 licensing (per-user subscription)、Microsoft 365
Related: Copilot pay-as-you-go (PAYG)
Microsoft 365 admin center
The central admin portal for Microsoft 365. It manages users, licenses, groups, domain names, and org settings, and is the gateway to each workload-specific admin center. Copilot license assignment and usage reports are done here too.
Prerequisites: Microsoft 365
Microsoft Purview
Microsoft's unified governance and compliance solutions: information protection, data lifecycle, risk management, eDiscovery, and auditing, plus cross-estate data governance via the data map/catalog (integrating the former Azure Purview).
Prerequisites: eDiscovery
Related: Purview Information Protection
Copilot administration (usage and prompts)
Monitor usage and adoption via Copilot Analytics and Microsoft 365 admin center reports to drive enablement and license optimization. Prompt management saves, shares, schedules, and deletes frequently used prompts to reuse/standardize them across the org.
Prerequisites: Microsoft 365 admin center、Prompt management、Microsoft 365 licensing (per-user subscription)、Microsoft 365
Related: Copilot Analytics
Conditional Access
Grants or challenges access based on conditions like location, device, or risk (a Zero Trust implementation).
Prerequisites: Zero Trust
Microsoft Teams
A collaboration hub for chat, meetings, calls, and teamwork; files are stored behind the scenes in SharePoint/OneDrive.
Prerequisites: OneDrive
Related: SharePoint
Copilot Analytics
A reporting capability that visualizes Copilot usage and adoption. Used alongside the Microsoft 365 admin center to drive enablement and optimize licenses.
Prerequisites: Microsoft 365 admin center、Microsoft 365 licensing (per-user subscription)、Microsoft 365
SharePoint oversharing controls
Because Copilot inherits existing permissions, oversharing can surface sensitive data via Copilot. Use the data access governance report to find widely shared / sensitivity-labeled sites and remediate with restricted site access in SharePoint Advanced Management.
Prerequisites: SharePoint
Related: SharePoint Advanced Management and restricted site access、Data access governance (DAG) report
Copilot pay-as-you-go (PAYG)
A Copilot model billed by usage, separate from the fixed monthly license. Applied to uses like SharePoint agents, with cost managed via billing policies.
Prerequisites: Consumption-based pricing、Microsoft 365 licensing (per-user subscription)、SharePoint
Related: Copilot licensing and billing
Consumption-based pricing
Paying for what you actually use rather than reserved capacity; no up-front investment and less waste.
Analyst (built-in agent)
One of Microsoft 365 Copilot’s built-in agents. It analyzes and visualizes raw data, using a code interpreter to help with calculations and report building.
Prerequisites: Microsoft 365 Copilot、Microsoft 365
Researcher (built-in agent)
One of Microsoft 365 Copilot’s built-in agents. It performs deep research across internal data and the web, working through complex investigation tasks step by step.
Prerequisites: Microsoft 365 Copilot、Microsoft 365
Microsoft Entra ID
Cloud identity/access management (formerly Azure AD) providing MFA/SSO/Conditional Access; distinct from on-prem AD DS.
Prerequisites: Conditional Access
Office apps (Word/Excel/PowerPoint/Outlook)
Core apps for documents/spreadsheets/presentations/email; in Microsoft 365 they stay up to date via subscription across web/desktop/mobile with co-authoring.
Prerequisites: Microsoft 365
Custom agents
Agents built for an organization’s specific tasks and knowledge. Created in tools like Copilot Studio and published/managed through an approval process.
Prerequisites: Microsoft Copilot Studio (formerly Power Virtual Agents)
Data access governance (DAG) report
A report that surfaces widely shared SharePoint sites and sites with sensitivity labels to understand oversharing risk, serving as the starting point for remediation.
Prerequisites: SharePoint
Related: SharePoint oversharing controls
Data Lifecycle Management and retention labels
Microsoft Purview Data Lifecycle Management uses retention labels to keep information only as long as needed and delete it afterward, balancing compliance and storage optimization.
Prerequisites: Microsoft Purview、Retention policy
Identity Secure Score
A numeric measure of identity posture in Microsoft Entra ID. It shows the current score and recommended improvements, guiding actions like enforcing MFA or Conditional Access.
Prerequisites: Conditional Access、Microsoft Entra ID
Purview Information Protection
Microsoft Purview Information Protection discovers and classifies sensitive information and applies protection (encryption, access restriction, watermarks) via sensitivity labels. It is foundational to limiting exposure in Copilot responses.
Prerequisites: Sensitivity labels
Related: Microsoft Purview
License assignment (direct / group-based)
Access to Microsoft 365 and Copilot features depends on license type, assigned directly to users or in bulk via group-based licensing. Copilot needs a separate license on top of existing M365 licenses.
Prerequisites: Microsoft 365 licensing (per-user subscription)、Microsoft 365
Microsoft Defender XDR
Unifies protection across endpoints/email/identity/SaaS, correlating signals across domains (Endpoint/Office 365/Identity/Cloud Apps).
Prerequisites: SaaS (Software as a Service)
Sensitivity labels
Classify data and apply protection (encryption, usage limits); labels travel with the file, persisting outside the org.
Agent administration
Govern agents through a lifecycle: configure user access (least privilege) → create → approval process → monitor. Monitoring uses the Microsoft 365 admin center and the Microsoft Power Platform admin center for usage, operational insights, and lifecycle.
Prerequisites: Microsoft 365 admin center、Microsoft 365、Power Platform admin center
Agents (Copilot)
Customizable AIs specialized for specific tasks/knowledge that work semi-autonomously. Built-in Researcher (deep cross-source research) and Analyst (data analysis/visualization), plus custom agents built for org-specific needs.
Prerequisites: Analyst (built-in agent)、Custom agents、Researcher (built-in agent)
App registrations and enterprise apps
An app registration is the blueprint (template) for registering an app in Entra ID. An enterprise application is the service principal—the instance of that registration in each tenant—representing sign-in and permissions.
Prerequisites: Microsoft Entra ID
Authentication methods (MFA / passwordless)
Means of verifying identity. Methods stronger than passwords alone, such as multifactor authentication (MFA) and passwordless (FIDO2 security keys, Authenticator, Windows Hello).
Prerequisites: Multi-factor authentication (MFA)
Communication Compliance
Microsoft Purview Communication Compliance detects inappropriate language or policy violations in email and chat and flags them as policy violations.
Prerequisites: Microsoft Purview
Data classification (SITs / trainable classifiers)
Data classification identifies content using sensitive information types (patterns like credit cards or national IDs) and trainable classifiers. It informs where to apply sensitivity labels and DLP.
Prerequisites: Sensitivity labels
Data / Activity Explorer
Purview tools where Data Explorer (content explorer) reveals where sensitive data resides and Activity Explorer surfaces actions taken on that data.
Prerequisites: Microsoft Purview
Exchange admin center
The dedicated admin center for configuring Exchange Online mail objects. It manages mailboxes and distribution lists (groups that broadcast to multiple recipients).
Prerequisites: Exchange Online
Prompt management
A capability for admins and users to save, share, schedule, and delete frequently used prompts to reuse and standardize them across the org.
SharePoint Advanced Management and restricted site access
Restricted site access in SharePoint Advanced Management limits access to a specific site to allowed users only, reducing exposure through Copilot caused by oversharing.
Prerequisites: SharePoint
Related: SharePoint oversharing controls
Teams admin center
The dedicated admin center for Microsoft Teams teams, channels, and policies. Policies control the scope of meetings, messaging, and apps.
Prerequisites: Microsoft Teams
Threat protection and threat intelligence
Capabilities for detecting, analyzing, and responding to attacks. Microsoft Defender XDR unifies signals across domains to deliver extended detection and response (XDR).
Prerequisites: Microsoft Defender XDR
Multi-factor authentication (MFA)
Strengthens identity proof with a second factor beyond a password.
Microsoft Copilot Studio (formerly Power Virtual Agents)
A low-code tool to build chatbots/assistants (assist); conversations use topics (by intent), with generative-AI knowledge and Power Automate integration.
OneDrive
Personal cloud file storage and sync—keep your own files and share as needed (SharePoint is for org sharing).
Prerequisites: SharePoint
Purview DSPM for AI
Microsoft Purview Data Security Posture Management for AI. Visualizes sensitive-data risk and overexposure handled by Copilot and AI apps, driving remediation via labeling, access review, and DLP—a proactive posture capability.
Prerequisites: Microsoft Purview
eDiscovery
Searches, preserves (holds), collects, and exports relevant content for litigation or investigations.
Microsoft Entra ID Protection
Computes user/sign-in risk from leaked credentials, impossible travel, etc., integrating with Conditional Access.
Prerequisites: Conditional Access、Microsoft Entra ID
Exchange Online
A cloud service for email and calendar (hosted mailboxes); Outlook is the client that uses it.
Prerequisites: Office apps (Word/Excel/PowerPoint/Outlook)
OpEx (operational expenditure)
Spending paid continuously as you consume it. Cloud pay-as-you-go billing follows this model, minimizing upfront investment and letting cost flex with demand. The CapEx-to-OpEx shift is commonly cited as a core financial benefit of moving to the cloud.
Prerequisites: CapEx (capital expenditure)、Consumption-based pricing
Reliability
The ability to recover from and withstand failures/disasters; if HA means "do not fall," reliability means "get back up."
Retention policy
Keeps data for the required period and deletes it when no longer needed, managing its lifecycle.
SaaS (Software as a Service)
Using finished software as-is; the provider manages almost everything (e.g., Microsoft 365).
Related: Microsoft 365
Role-based access control (RBAC)
Authorization that grants permissions by assigning roles to identities at a scope; least privilege, inherited downward.
Prerequisites: Authorization (AuthZ)
CapEx (capital expenditure)
Spending to buy and own equipment or facilities up front—like building an on-prem data center—requiring a large initial outlay that is depreciated as an asset over years. It was the center of the traditional pre-cloud IT investment model.
Elasticity
Automatically scaling capacity with load (autoscaling); scalability made automatic.
Prerequisites: Scalability
Microsoft Intune
A cloud service to manage/secure devices and apps; MDM manages the device itself, MAM manages in-app data; integrates with Conditional Access.
Prerequisites: Conditional Access
Microsoft Viva
An employee experience platform (learning, insights, engage)—a different category from Teams’ real-time conversation.
Prerequisites: Microsoft Teams
Power Platform admin center
The admin portal to centrally manage environments, capacity, DLP policies, analytics, and settings, including per-product (Power Apps/Automate) administration.
Responsible AI
Guidance for using AI safely, fairly, transparently; Microsoft’s six: fairness, reliability & safety, privacy & security, inclusiveness, transparency, accountability.
Prerequisites: Reliability
Scalability
Adjusting capacity to demand; scale up = vertical (bigger machine), scale out = horizontal (more machines).
Zero Trust
The principle of "never trust, always verify"; verify identity, device, and context on every access, even inside.